Update Fleet-maintained apps

[fleet-release]

Automated ingestion of latest Fleet-maintained app data.

Summary by CodeRabbit

• Chores
  • Updated version metadata for Arc, Grammarly Desktop, Raycast, and WhatsApp on macOS to reflect the latest releases.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

Walkthrough

This pull request updates release metadata for four macOS maintained applications by bumping their version numbers in ee/maintained-apps/outputs/*/darwin.json. Each update refreshes the version identifier, adjusts the SQL version-comparison logic used for patch detection, and replaces the installer URL and SHA256 checksum to match the new release artifacts. Arc is updated to 1.147.1, Grammarly to 1.166.1, Raycast to 1.104.18, and WhatsApp to 26.20.20. Script references and other configuration fields remain unchanged.

Possibly related PRs

• fleetdm/fleet#45666: Performs the same pattern of bumping maintained-app versions in ee/maintained-apps/outputs/*/darwin.json files, updating version, installer_url, and sha256 values alongside version-comparison thresholds.
• fleetdm/fleet#45680: Updates ee/maintained-apps/outputs/*/darwin.json entries for different applications, following the identical schema of version bumps, query threshold adjustments, and artifact URL/checksum refreshes.
• fleetdm/fleet#44921: Data-only updates to ee/maintained-apps/outputs/*/darwin.json that bump app versions and synchronize the corresponding queries.patched version-compare thresholds plus installer and checksum artifacts.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description 'Automated ingestion of latest Fleet-maintained app data' is vague and generic, providing no specific details about which apps were updated, what versions were changed, or why these updates were made.	Expand the description to include specific details about which applications were updated and their new versions (e.g., Arc 1.147.1, Grammarly 1.166.1, Raycast 1.104.18, WhatsApp 26.20.20).

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Update Fleet-maintained apps' clearly summarizes the main change—updating metadata for multiple Fleet-maintained applications (Arc, Grammarly, Raycast, WhatsApp) across the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fma-2605201659

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

ee/maintained-apps/outputs/whatsapp/darwin.json (1)

12-12: WhatsApp installer integrity is not verified.

The sha256: "no_check" setting means downloaded installers are not cryptographically verified, creating a security risk if the download is compromised. This appears to be intentional due to WhatsApp's dynamic download URL, but consider whether there's an alternative approach to verify installer integrity.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/whatsapp/darwin.json` at line 12, The manifest
uses the insecure setting sha256: "no_check" which skips integrity verification
for the WhatsApp installer; replace this with a concrete verification step:
change the sha256 value to the actual checksum computed from the official
installer or implement a dynamic checksum-fetch routine that retrieves a signed
checksum or signature file from WhatsApp (or a trusted mirror) and verifies the
downloaded binary before install; update the code that reads the sha256 field
(the manifest entry "sha256") to fail the install on mismatch and document the
process for keeping the checksum updated when the WhatsApp download URL changes.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@ee/maintained-apps/outputs/whatsapp/darwin.json`:
- Line 12: The manifest uses the insecure setting sha256: "no_check" which skips
integrity verification for the WhatsApp installer; replace this with a concrete
verification step: change the sha256 value to the actual checksum computed from
the official installer or implement a dynamic checksum-fetch routine that
retrieves a signed checksum or signature file from WhatsApp (or a trusted
mirror) and verifies the downloaded binary before install; update the code that
reads the sha256 field (the manifest entry "sha256") to fail the install on
mismatch and document the process for keeping the checksum updated when the
WhatsApp download URL changes.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 809bd143-a92e-45c6-ad79-5b218494e708

📥 Commits

Reviewing files that changed from the base of the PR and between b15a131 and bbca14d.

📒 Files selected for processing (4)

• ee/maintained-apps/outputs/arc/darwin.json
• ee/maintained-apps/outputs/grammarly-desktop/darwin.json
• ee/maintained-apps/outputs/raycast/darwin.json
• ee/maintained-apps/outputs/whatsapp/darwin.json