Update Fleet-maintained apps

[fleet-release]

Automated ingestion of latest Fleet-maintained app data.

Summary by CodeRabbit

• Chores
  • Updated Granola app versions to 7.319.1 for macOS and Windows
  • Updated Hive app macOS version to 1.1.27
  • Updated RightFont macOS version to 10.0.1

[coderabbitai]

Walkthrough

This PR updates the version metadata for four maintained applications in JSON configuration files. Granola is bumped from 7.309.0 to 7.319.1 on both macOS and Windows, Hive is bumped from 1.1.25 to 1.1.27 on macOS, and RightFont5 is updated from 10.0 to 10.0.1 on macOS. Each update synchronizes the version field, the SQL version comparison query, the installer download URL, and the SHA256 checksum.

Possibly related PRs

• fleetdm/fleet#46037: Updates the same maintained-app manifest structure for Granola on macOS and Windows by bumping version, patched query threshold, installer URL, and SHA256.
• fleetdm/fleet#45026: Updates Granola's macOS entry in the maintained-apps manifest by changing the version, patched predicate, installer URL, and SHA256 for a new release.
• fleetdm/fleet#45972: Updates Granola's macOS metadata by bumping version, patched threshold, installer URL, and SHA256 together.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is minimal ('Automated ingestion of latest Fleet-maintained app data') and lacks the structured information requested by the repository template, including related issues, checklist items for testing, database migrations, or compatibility verification.	Complete the description template by filling in relevant sections: add a related issue reference, confirm applicable checklist items (especially QA testing for app metadata updates), and note any compatibility or load test considerations.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Update Fleet-maintained apps' clearly and concisely summarizes the main change: updating metadata for multiple Fleet-maintained applications across different platforms.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fma-2606111549

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

ee/maintained-apps/outputs/rightfont/darwin.json (1)

4-12: ⚠️ Potential issue | 🟠 Major

Major integrity/versioning risk: version-pinned query with static installer URL and sha256: no_check

ee/maintained-apps/outputs/rightfont/darwin.json declares version 10.0.1 and the patched query uses that value, but the download source is version-agnostic (https://rightfontapp.com/update/rightfont.zip) and the manifest sets sha256 to no_check. Fleet treats no_check as “skip expected-hash verification” (it computes the SHA256 from whatever it downloads instead of comparing to a manifest checksum), so content drift at the static URL is not detected. This can also desynchronize what the manifest claims (10.0.1) from what’s actually installed while patch policy logic relies on the manifest’s version from the app metadata. Recommend pinning installer_url to a versioned artifact and providing a real checksum (instead of no_check).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/rightfont/darwin.json` around lines 4 - 12, The
manifest declares "version": "10.0.1" and the patched query uses that value but
the "installer_url" is an unversioned URL and "sha256" is "no_check", which
allows silent content drift; update the manifest so the installer_url points at
a versioned artifact matching "10.0.1" (or update "version" to match the
intended artifact), compute and replace "sha256": "no_check" with the real
SHA256 of that versioned package, and ensure the "queries.patched" logic still
references the correct version string so the patch detection remains consistent
with the pinned installer URL.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@ee/maintained-apps/outputs/rightfont/darwin.json`:
- Around line 4-12: The manifest declares "version": "10.0.1" and the patched
query uses that value but the "installer_url" is an unversioned URL and "sha256"
is "no_check", which allows silent content drift; update the manifest so the
installer_url points at a versioned artifact matching "10.0.1" (or update
"version" to match the intended artifact), compute and replace "sha256":
"no_check" with the real SHA256 of that versioned package, and ensure the
"queries.patched" logic still references the correct version string so the patch
detection remains consistent with the pinned installer URL.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9c4b863b-8d67-44dd-9835-0d207adbf22b

📥 Commits

Reviewing files that changed from the base of the PR and between 2899384 and 6ed24d0.

📒 Files selected for processing (4)

• ee/maintained-apps/outputs/granola/darwin.json
• ee/maintained-apps/outputs/granola/windows.json
• ee/maintained-apps/outputs/hive-app/darwin.json
• ee/maintained-apps/outputs/rightfont/darwin.json