Update Fleet-maintained apps

[fleet-release]

Automated ingestion of latest Fleet-maintained app data.

Summary by CodeRabbit

• Updates
  • GitHubClient updated to version 3.5.10 with new installer package and verification checksums.
  • NordPass macOS updated to version 7.7.12 with improved version detection and validation logic.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

Walkthrough

This PR updates metadata for two maintained macOS applications. GitHub Client version is bumped from 3.5.9 to 3.5.10 with an updated installer URL and sha256 checksum, along with the patched SQL query threshold. NordPass version is bumped from 7.6.20 to 7.7.12 with the patched SQL query threshold adjusted to match. No script references or uninstaller definitions were modified.

Possibly related PRs

• fleetdm/fleet#45016: Updates Fleet-maintained app metadata JSON by bumping app versions and adjusting patched SQL thresholds plus installer artifacts.
• fleetdm/fleet#46037: Updates ee/maintained-apps/outputs/github/darwin.json by bumping GitHubClient version and adjusting patched query threshold with corresponding installer URL and checksum.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The PR description is minimal but appropriate for an automated ingestion. However, it does not follow the provided template structure with required sections like checklist items and testing information.	Consider whether this automated PR should follow the standard template or have a dedicated lightweight template for automated changes. If the standard template applies, add relevant checklist items and clarify testing approach.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Update Fleet-maintained apps' directly reflects the main change: updating version metadata for GitHub and NordPass apps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fma-2605221429

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

ee/maintained-apps/outputs/nordpass/darwin.json (1)

9-12: Consider adding checksum validation and versioned URLs for improved security.

NordPass uses a generic installer URL without version numbers and disables checksum verification with "sha256": "no_check". This approach has operational and security implications:

• Version drift risk: The generic URL always serves the latest version, which could become newer than the metadata version (7.7.12) without this file being updated, potentially causing the "patched" query to incorrectly report systems as unpatched.
• No integrity verification: Without checksum validation, there's no protection against corrupted downloads or potential man-in-the-middle attacks.

While this appears to be NordPass's existing distribution pattern (not introduced in this PR), consider whether versioned URLs and checksum validation could be adopted, similar to the GitHub Desktop approach.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/nordpass/darwin.json` around lines 9 - 12, The
metadata uses a generic installer_url and disables integrity checks with
"sha256": "no_check", which risks version drift and download tampering; update
the record by replacing the generic installer_url with a versioned download URL
(matching the package version, e.g., include the 7.7.12 token) and restore
checksum verification by computing and setting a real sha256 value, and if
necessary update or annotate install_script_ref and uninstall_script_ref to
ensure they reference scripts compatible with the versioned installer; ensure
the new URL and sha256 correspond to the exact binary used by the current
install/uninstall scripts.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@ee/maintained-apps/outputs/nordpass/darwin.json`:
- Around line 9-12: The metadata uses a generic installer_url and disables
integrity checks with "sha256": "no_check", which risks version drift and
download tampering; update the record by replacing the generic installer_url
with a versioned download URL (matching the package version, e.g., include the
7.7.12 token) and restore checksum verification by computing and setting a real
sha256 value, and if necessary update or annotate install_script_ref and
uninstall_script_ref to ensure they reference scripts compatible with the
versioned installer; ensure the new URL and sha256 correspond to the exact
binary used by the current install/uninstall scripts.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7eb52264-97f1-4644-99e2-13d848b9c2d9

📥 Commits

Reviewing files that changed from the base of the PR and between f413df0 and c22f608.

📒 Files selected for processing (2)

• ee/maintained-apps/outputs/github/darwin.json
• ee/maintained-apps/outputs/nordpass/darwin.json