Update Fleet-maintained apps

[fleet-release]

Automated ingestion of latest Fleet-maintained app data.

Summary by CodeRabbit

• Chores
  • Refreshed installer configurations, URLs, and security checksums for Brave Browser (Windows to 148.1.90.121), Signal (macOS to 8.9.1), Warp (macOS to 0.2026.05.06.15.42.02), Zed (macOS to 1.1.7), and Zotero (Windows to 9.0.3) to maintain platform compatibility and ensure safe installations with verified builds.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

Walkthrough

This PR updates installer metadata for five maintained applications across the Fleet system. Each update follows a consistent pattern: the application version field is bumped, the SQL patched version-compare predicate is adjusted to the new version, the installer_url is changed to point to the new release artifact, and the sha256 checksum is replaced with the new binary hash. Script reference identifiers remain unchanged. The affected applications are Brave Browser (Windows, to 148.1.90.121), Signal (macOS, to 8.9.1), Warp (macOS, to 0.2026.05.06.15.42.02), Zed (macOS, to 1.1.7), and Zotero (Windows, to 9.0.3).

Possibly related PRs

• fleetdm/fleet#44962: Overlaps on maintained-apps outputs metadata updates including Signal and Brave Browser version entries.
• fleetdm/fleet#44900: Modifies the same Zed macOS metadata file (ee/maintained-apps/outputs/zed/darwin.json) with version and installer updates.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The pull request description is minimal and provides only 'Automated ingestion of latest Fleet-maintained app data.' without addressing required checklist items in the template.	Add a completed checklist indicating which sections apply to this data-only update, and include a related issue reference if applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Update Fleet-maintained apps' is directly related to the changeset, which updates version metadata for multiple Fleet-maintained applications (Brave Browser, Signal, Warp, Zed, and Zotero).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fma-2605090019

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ee/maintained-apps/outputs/warp/darwin.json`:
- Line 12: The sha256 integrity check in
ee/maintained-apps/outputs/warp/darwin.json is disabled by the entry "sha256":
"no_check"; replace that placeholder with the actual SHA256 checksum of the Warp
installer (compute from the official installer binary or vendor-provided
checksum), update the "sha256" field with the hex checksum string, and ensure
any install/verify logic that reads the "sha256" field (installer verification
code) will perform the checksum validation against the downloaded file.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ca48ec54-3ca0-4435-8615-0533d5850843

📥 Commits

Reviewing files that changed from the base of the PR and between e8f0139 and 0d3845a.

📒 Files selected for processing (5)

• ee/maintained-apps/outputs/brave-browser/windows.json
• ee/maintained-apps/outputs/signal/darwin.json
• ee/maintained-apps/outputs/warp/darwin.json
• ee/maintained-apps/outputs/zed/darwin.json
• ee/maintained-apps/outputs/zotero/windows.json

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Security risk: SHA256 checksum verification is disabled.

The sha256 field is set to "no_check", which disables integrity verification of the installer. This creates a security vulnerability where compromised, tampered, or corrupted downloads could be installed without detection.

Please obtain and use the actual SHA256 checksum for the Warp installer to ensure installation integrity.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/warp/darwin.json` at line 12, The sha256 integrity
check in ee/maintained-apps/outputs/warp/darwin.json is disabled by the entry
"sha256": "no_check"; replace that placeholder with the actual SHA256 checksum
of the Warp installer (compute from the official installer binary or
vendor-provided checksum), update the "sha256" field with the hex checksum
string, and ensure any install/verify logic that reads the "sha256" field
(installer verification code) will perform the checksum validation against the
downloaded file.

[github-actions]

Closing in favor of #45096.