Update Fleet-maintained apps - #46394
Conversation
Generated automatically with cmd/maintained-apps.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
Script Diff Resultsee/maintained-apps/outputs/brave-browser/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/camtasia/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/dialpad/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/notepad++/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/parallels/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/power-bi/windows.json=== Install // 4be62464 -> cc478c11 ===
No differences found in script content
=== Uninstall // 201475bb -> abc3b459 ===
No differences found in script content |
WalkthroughThis PR updates metadata for six maintained applications across the Fleet maintained-apps system. Five apps receive version bumps: Brave Browser, Camtasia, Dialpad, Notepad++, and Parallels Desktop. Each version update includes corresponding adjustments to version comparison thresholds used for patch detection, installer download URLs, and SHA-256 checksums. Power BI Desktop on Windows receives a script reference migration, replacing prior install and uninstall script IDs with new reference IDs and providing updated PowerShell script bodies for those references. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
ee/maintained-apps/outputs/dialpad/darwin.json (1)
9-12:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSecurity:
sha256integrity check is disabled for Dialpad PKG downloads.
ee/maintained-apps/outputs/dialpad/darwin.jsonsets"sha256": "no_check"for the statichttps://download.dialpad.com/osx/arm64/dialpad.pkg, so Fleet will not validate the downloaded PKG against a checksum.
- Public Dialpad docs/metadata don’t appear to provide versioned URLs or SHA-256 values for macOS PKGs (curling the URL shows no checksum headers).
- This removes detection for corrupted/altered payloads; relying solely on HTTPS transport integrity (and any OS-level signing/notarization) doesn’t provide the same “known-good bytes” assurance.
If Dialpad won’t publish checksums, consider documenting the tradeoff explicitly and/or adding an alternative integrity/signature verification step (where supported) or using a versioned source/manifest (if available).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ee/maintained-apps/outputs/dialpad/darwin.json` around lines 9 - 12, The darwin.json currently sets "sha256": "no_check" for the static installer_url (dialpad.pkg), which disables integrity validation; update this by either replacing "no_check" with the actual SHA-256 checksum of the PKG (compute and paste the hex value into the "sha256" field) or, if Dialpad does not publish checksums, add a clear documented alternative: add an integrity verification entry (e.g., a field named "integrity_verification" or "integrity_note") describing the tradeoff and any OS-level/Notarization checks to be relied on, or implement a signature/manifest verification step where supported; target the "sha256" key and the "installer_url" reference when making the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@ee/maintained-apps/outputs/dialpad/darwin.json`:
- Around line 9-12: The darwin.json currently sets "sha256": "no_check" for the
static installer_url (dialpad.pkg), which disables integrity validation; update
this by either replacing "no_check" with the actual SHA-256 checksum of the PKG
(compute and paste the hex value into the "sha256" field) or, if Dialpad does
not publish checksums, add a clear documented alternative: add an integrity
verification entry (e.g., a field named "integrity_verification" or
"integrity_note") describing the tradeoff and any OS-level/Notarization checks
to be relied on, or implement a signature/manifest verification step where
supported; target the "sha256" key and the "installer_url" reference when making
the change.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 38ace226-7d9f-4adc-a404-d84ddbc6f14c
📒 Files selected for processing (6)
ee/maintained-apps/outputs/brave-browser/darwin.jsonee/maintained-apps/outputs/camtasia/darwin.jsonee/maintained-apps/outputs/dialpad/darwin.jsonee/maintained-apps/outputs/notepad++/windows.jsonee/maintained-apps/outputs/parallels/darwin.jsonee/maintained-apps/outputs/power-bi/windows.json
2 participants
Automated ingestion of latest Fleet-maintained app data.
Summary by CodeRabbit