Update Fleet-maintained apps - #46037
Conversation
Generated automatically with cmd/maintained-apps.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
WalkthroughThis pull request performs a bulk version update across 16 maintained application manifests in the Fleet repository. Each application entry—covering 1Password, Adobe Acrobat Reader, Arc, Claude, Firefox, GitHub Desktop, Granola, Loom, Microsoft Edge, OmniGraffle, Podman Desktop, Twingate, Warp, WhatsApp, and Zed—is advanced to a new release version. For each application, four fields are consistently updated: the version identifier string, the SQL Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
ee/maintained-apps/outputs/1password/darwin.json (1)
4-12: ⚡ Quick winConsider verifying installer integrity for 1Password.
The manifest consistently updates the version to 8.12.21, but uses
sha256: "no_check"with a stable installer URL that doesn't include version information. This pattern prevents cryptographic verification of downloaded installers, which could allow corrupted or tampered files to be installed undetected.🔍 Verification approach
If 1Password provides version-specific URLs or checksums, consider using them. Otherwise, document why integrity checks are skipped for this application.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ee/maintained-apps/outputs/1password/darwin.json` around lines 4 - 12, The manifest sets "sha256": "no_check" for the 1Password entry while "version" is "8.12.21" and "installer_url" is a stable URL; replace the no_check placeholder with a real SHA256 checksum for the 1Password.pkg for version 8.12.21 (or switch to a versioned installer_url + corresponding checksum) to enable cryptographic verification, or add a clear comment/field documenting why integrity checks are intentionally skipped; update the keys referenced ("version", "installer_url", "sha256") in the 1Password JSON entry accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ee/maintained-apps/outputs/twingate/windows.json`:
- Line 9: The installer_url field currently points to a vendor URL containing
"2026.140.168" (TwingateWindowsInstaller.msi); instead of assuming the URL path
encodes the product version, download the MSI and extract its internal
ProductVersion/ProductName (e.g., via msiexec/msiinfo, sigcheck, or PowerShell
Get-ItemProperty on the MSI) and then update the JSON's version field to match
that MSI metadata (or add a separate "package_version" field) so the recorded
version reflects the MSI's actual internal version rather than the URL path.
---
Nitpick comments:
In `@ee/maintained-apps/outputs/1password/darwin.json`:
- Around line 4-12: The manifest sets "sha256": "no_check" for the 1Password
entry while "version" is "8.12.21" and "installer_url" is a stable URL; replace
the no_check placeholder with a real SHA256 checksum for the 1Password.pkg for
version 8.12.21 (or switch to a versioned installer_url + corresponding
checksum) to enable cryptographic verification, or add a clear comment/field
documenting why integrity checks are intentionally skipped; update the keys
referenced ("version", "installer_url", "sha256") in the 1Password JSON entry
accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 071e5e8f-4e31-43c8-8cf4-e70ce3bd4e6e
📒 Files selected for processing (18)
ee/maintained-apps/outputs/1password/darwin.jsonee/maintained-apps/outputs/adobe-acrobat-reader/windows.jsonee/maintained-apps/outputs/arc/darwin.jsonee/maintained-apps/outputs/claude/darwin.jsonee/maintained-apps/outputs/firefox/darwin.jsonee/maintained-apps/outputs/firefox/windows.jsonee/maintained-apps/outputs/github-desktop/windows.jsonee/maintained-apps/outputs/github/darwin.jsonee/maintained-apps/outputs/granola/darwin.jsonee/maintained-apps/outputs/granola/windows.jsonee/maintained-apps/outputs/loom/darwin.jsonee/maintained-apps/outputs/microsoft-edge/darwin.jsonee/maintained-apps/outputs/omnigraffle/darwin.jsonee/maintained-apps/outputs/podman-desktop/darwin.jsonee/maintained-apps/outputs/twingate/windows.jsonee/maintained-apps/outputs/warp/darwin.jsonee/maintained-apps/outputs/whatsapp/darwin.jsonee/maintained-apps/outputs/zed/darwin.json
| "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Twingate' AND publisher = 'Twingate Inc.' AND version_compare(version, '20.26.140.168') < 0);" | ||
| }, | ||
| "installer_url": "https://binaries.twingate.com/client/windows/versions/2026.120.9484/TwingateWindowsInstaller.msi", | ||
| "installer_url": "https://binaries.twingate.com/client/windows/versions/2026.140.168/TwingateWindowsInstaller.msi", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify that the Twingate installer URL is accessible and returns valid content
url="https://binaries.twingate.com/client/windows/versions/2026.140.168/TwingateWindowsInstaller.msi"
echo "Checking URL accessibility..."
http_code=$(curl -s -o /dev/null -w "%{http_code}" -L -I "$url")
echo "HTTP Status Code: $http_code"
if [ "$http_code" = "200" ] || [ "$http_code" = "302" ]; then
echo "✓ URL is accessible"
# Check Content-Type header
content_type=$(curl -s -L -I "$url" | grep -i "content-type:" | head -1)
echo "Content-Type: $content_type"
# Check Content-Length to ensure it's not empty
content_length=$(curl -s -L -I "$url" | grep -i "content-length:" | head -1)
echo "$content_length"
else
echo "✗ URL returned HTTP $http_code"
exit 1
fiRepository: fleetdm/fleet
Length of output: 223
Update: Twingate installer URL accessibility is OK; still validate MSI’s internal version if required.
ee/maintained-apps/outputs/twingate/windows.json points to https://binaries.twingate.com/client/windows/versions/2026.140.168/TwingateWindowsInstaller.msi, which returns HTTP 200 (binary content). The alternative path using versions/20.26.140.168/ does not appear to exist (HTTP 404), so the 20.26 → 2026 mapping looks vendor-specific. If the JSON version must exactly match the MSI’s internal product/version, inspect the MSI metadata rather than relying on the URL path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ee/maintained-apps/outputs/twingate/windows.json` at line 9, The
installer_url field currently points to a vendor URL containing "2026.140.168"
(TwingateWindowsInstaller.msi); instead of assuming the URL path encodes the
product version, download the MSI and extract its internal
ProductVersion/ProductName (e.g., via msiexec/msiinfo, sigcheck, or PowerShell
Get-ItemProperty on the MSI) and then update the JSON's version field to match
that MSI metadata (or add a separate "package_version" field) so the recorded
version reflects the MSI's actual internal version rather than the URL path.
2 participants
Automated ingestion of latest Fleet-maintained app data.
Summary by CodeRabbit