Update Fleet-maintained apps

[fleet-release]

Automated ingestion of latest Fleet-maintained app data.

Summary by CodeRabbit

• Chores
  • Updated maintained application metadata for 18+ apps including 1Password, Google Chrome, Signal, Visual Studio Code, and others to support newer versions on macOS and Windows platforms.
  • Synchronized installer URLs, integrity checksums, and version references for latest releases.
  • Enhanced uninstall scripts for improved application cleanup on system removal.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/1password/darwin.json

=== Install Script (no changes) ===
=== Uninstall // f58c31b3 -> dadf8c51 ===

--- /tmp/old.UCbzlG	2026-05-28 00:25:20.501624304 +0000
+++ /tmp/new.m0kkdF	2026-05-28 00:25:20.501624304 +0000
@@ -5,6 +5,46 @@
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
 # functions
 
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
+
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
@@ -27,6 +67,7 @@
   fi
 }
 
+quit_application 'com.1password.1password'
 sudo rm -rf "$APPDIR/1Password.app"
 trash $LOGGED_IN_USER '~/Library/Application Scripts/2BUA8C4S2C.com.1password*'
 trash $LOGGED_IN_USER '~/Library/Application Scripts/2BUA8C4S2C.com.agilebits'

ee/maintained-apps/outputs/amazon-chime/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/cursor/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/drawio/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/dropbox/darwin.json

=== Install Script (no changes) ===
=== Uninstall // 4d5c7d9c -> f2e8d2ab ===

--- /tmp/old.WW9dct	2026-05-28 00:25:20.710622343 +0000
+++ /tmp/new.kKT2hU	2026-05-28 00:25:20.710622343 +0000
@@ -5,6 +5,46 @@
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
 # functions
 
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
+
 remove_launchctl_service() {
   local service="$1"
   local booleans=("true" "false")
@@ -73,6 +113,7 @@
 }
 
 remove_launchctl_service 'com.dropbox.DropboxMacUpdate.agent'
+quit_application 'com.getdropbox.dropbox'
 sudo rm -rf '/Library/DropboxHelperTools'
 sudo rm -rf '/Library/Preferences/com.getdropbox.dropbox.dbkextd.plist'
 sudo rm -rf "$APPDIR/Dropbox.app"

ee/maintained-apps/outputs/google-chrome/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/gotomeeting/windows.json

=== Install Script (no changes) ===
=== Uninstall // cef7f8fa -> f5235386 ===

--- /tmp/old.qEPBWy	2026-05-28 00:25:20.803621470 +0000
+++ /tmp/new.lElPxl	2026-05-28 00:25:20.803621470 +0000
@@ -1,15 +1,11 @@
-# Best-effort uninstall for GoToMeeting.
+# Uninstall for GoToMeeting.
 #
 # The winget installer is the GoToMeeting "Setup" bootstrapper (ARPSYSTEMCOMPONENT=1,
 # so it hides itself from Programs and Features). It installs the actual GoToMeeting
 # app, which self-registers a separate, visible uninstall entry (DisplayName like
 # "GoToMeeting <version>") whose uninstaller is G2MUninstall.exe.
 #
-# We locate that entry and run G2MUninstall.exe directly. NOTE: the registry
-# QuietUninstallString uses "/S", which G2MUninstall.exe does not recognize as a
-# silent switch (it hangs waiting on UI). The vendor's documented silent switch
-# is "/silent" (see silentinstallhq.com), so we build the arguments ourselves
-# rather than trusting the registry string.
+# We locate that entry and run G2MUninstall.exe directly.
 
 $softwareNameLike = "GoToMeeting*"

ee/maintained-apps/outputs/granola/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/granola/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/jabra-direct/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/krita/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/microsoft-edge/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/onedrive/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/signal/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/visual-studio-code/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/whatsapp/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/wrike/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/zed/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/zen/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

[coderabbitai]

Walkthrough

This PR updates installed app metadata across 19 maintained applications. Most changes bump the application version, update the SQL patched query threshold to match the new version, and provide new installer URLs and SHA-256 checksums. Three apps (1Password, Dropbox, and GoToMeeting) additionally reference new uninstall script definitions that introduce quit_application steps to gracefully terminate the app before removal.

Possibly related PRs

• fleetdm/fleet#46247: Updates app uninstall scripts to add quit_application steps before removal, similar to the script reference changes in 1Password and Dropbox.
• fleetdm/fleet#45786: Switches multiple app uninstall_script_ref values to new refs that add quit_application logic for graceful app shutdown.
• fleetdm/fleet#46055: Modifies 1Password macOS version targeting and associated script metadata.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Update Fleet-maintained apps' is directly related to the changeset, which updates version metadata and installer references for 16 Fleet-maintained applications across multiple platforms.
Description check	✅ Passed	The PR description is minimal but appropriate for an automated data ingestion. The template is designed for substantial feature/fix PRs with testing and database considerations that don't apply to this data-only update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fma-2605280022

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ee/maintained-apps/outputs/dropbox/darwin.json`:
- Line 20: The trash() function treats wildcard paths as literals so patterns
like those passed from callers (e.g., trash $LOGGED_IN_USER
'~/Library/Application Scripts/*.com.getdropbox.dropbox.sync') never expand;
update trash() to expand globs and iterate matches: after expanding ~ to
/Users/$logged_in_user, enable globbing with shopt -s nullglob (save/restore
previous state), create an array matches=( $target_file ) (unquoted to allow
expansion), then loop over "${matches[@]}" and perform the existence check and
mv for each file (keeping the timestamp/rand naming), and if matches is empty
print the "doesn't exist" message. Ensure the change references the trash()
function and the target_file/local variables so callers using wildcard patterns
are removed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a3256615-b7f0-421a-81ef-f36288a7f28c

📥 Commits

Reviewing files that changed from the base of the PR and between e642e6a and a1f7882.

📒 Files selected for processing (19)

• ee/maintained-apps/outputs/1password/darwin.json
• ee/maintained-apps/outputs/amazon-chime/darwin.json
• ee/maintained-apps/outputs/cursor/windows.json
• ee/maintained-apps/outputs/drawio/darwin.json
• ee/maintained-apps/outputs/dropbox/darwin.json
• ee/maintained-apps/outputs/google-chrome/windows.json
• ee/maintained-apps/outputs/gotomeeting/windows.json
• ee/maintained-apps/outputs/granola/darwin.json
• ee/maintained-apps/outputs/granola/windows.json
• ee/maintained-apps/outputs/jabra-direct/darwin.json
• ee/maintained-apps/outputs/krita/windows.json
• ee/maintained-apps/outputs/microsoft-edge/windows.json
• ee/maintained-apps/outputs/onedrive/darwin.json
• ee/maintained-apps/outputs/signal/darwin.json
• ee/maintained-apps/outputs/visual-studio-code/darwin.json
• ee/maintained-apps/outputs/whatsapp/darwin.json
• ee/maintained-apps/outputs/wrike/darwin.json
• ee/maintained-apps/outputs/zed/darwin.json
• ee/maintained-apps/outputs/zen/darwin.json

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Wildcard paths in trash() are handled as literals, so cleanup misses globbed targets.

trash() uses [[ -e "$target_file" ]] and mv -f "$target_file" ... while callers pass patterns like ~/Library/Application Scripts/*.com.getdropbox...; those won’t expand and won’t be removed.

Proposed helper fix (bash snippet)

 trash() {
   local logged_in_user="$1"
   local target_file="$2"
   local timestamp="$(date +%Y-%m-%d-%s)"
   local rand="$(jot -r 1 0 99999)"
@@
-  local trash="/Users/$logged_in_user/.Trash"
-  local file_name="$(basename "${target_file}")"
-
-  if [[ -e "$target_file" ]]; then
-    echo "removing $target_file."
-    mv -f "$target_file" "$trash/${file_name}_${timestamp}_${rand}"
-  else
-    echo "$target_file doesn't exist."
-  fi
+  local trash="/Users/$logged_in_user/.Trash"
+  local matched=false
+  local path
+
+  while IFS= read -r path; do
+    matched=true
+    local file_name
+    file_name="$(basename "$path")"
+    echo "removing $path."
+    mv -f "$path" "$trash/${file_name}_${timestamp}_${rand}"
+  done < <(compgen -G "$target_file")
+
+  if [[ "$matched" = false ]]; then
+    echo "$target_file doesn't exist."
+  fi
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/dropbox/darwin.json` at line 20, The trash()
function treats wildcard paths as literals so patterns like those passed from
callers (e.g., trash $LOGGED_IN_USER '~/Library/Application
Scripts/*.com.getdropbox.dropbox.sync') never expand; update trash() to expand
globs and iterate matches: after expanding ~ to /Users/$logged_in_user, enable
globbing with shopt -s nullglob (save/restore previous state), create an array
matches=( $target_file ) (unquoted to allow expansion), then loop over
"${matches[@]}" and perform the existence check and mv for each file (keeping
the timestamp/rand naming), and if matches is empty print the "doesn't exist"
message. Ensure the change references the trash() function and the
target_file/local variables so callers using wildcard patterns are removed.