diff --git a/ee/maintained-apps/outputs/1password/darwin.json b/ee/maintained-apps/outputs/1password/darwin.json
index c9a94f8a1f4..67f42445634 100644
--- a/ee/maintained-apps/outputs/1password/darwin.json
+++ b/ee/maintained-apps/outputs/1password/darwin.json
@@ -1,10 +1,10 @@
 {
   "versions": [
     {
-      "version": "8.12.33",
+      "version": "8.12.34",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.1password.1password';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.1password.1password' AND version_compare(bundle_short_version, '8.12.33') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.1password.1password' AND version_compare(bundle_short_version, '8.12.34') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.1password.1password');"
       },
       "installer_url": "https://downloads.1password.com/mac/1Password.pkg",
diff --git a/ee/maintained-apps/outputs/bbedit/darwin.json b/ee/maintained-apps/outputs/bbedit/darwin.json
index d9c2b8e7faf..0848453efef 100644
--- a/ee/maintained-apps/outputs/bbedit/darwin.json
+++ b/ee/maintained-apps/outputs/bbedit/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "16.0.2",
+      "version": "16.0.3",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.barebones.bbedit';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.barebones.bbedit' AND version_compare(bundle_short_version, '16.0.2') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.barebones.bbedit' AND version_compare(bundle_short_version, '16.0.3') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.barebones.bbedit');"
       },
-      "installer_url": "https://s3.amazonaws.com/BBSW-download/BBEdit_16.0.2.dmg",
+      "installer_url": "https://s3.amazonaws.com/BBSW-download/BBEdit_16.0.3.dmg",
       "install_script_ref": "8fd9895e",
       "uninstall_script_ref": "45bbb2ec",
-      "sha256": "f63367b675245752bd6c74072bef840288444d04fc582f9a382112daa61b8874",
+      "sha256": "acf2ae9e5c68beacdfd7534861fa8c992e1bdd5391a71b3c08b3ed879c2b3572",
       "default_categories": [
         "Developer tools"
       ]
diff --git a/ee/maintained-apps/outputs/chatgpt/darwin.json b/ee/maintained-apps/outputs/chatgpt/darwin.json
index 7d6934ddf41..55f407a37b6 100644
--- a/ee/maintained-apps/outputs/chatgpt/darwin.json
+++ b/ee/maintained-apps/outputs/chatgpt/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "26.818.61809",
+      "version": "26.820.60940",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.openai.chat';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.openai.chat' AND version_compare(bundle_short_version, '26.818.61809') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.openai.chat' AND version_compare(bundle_short_version, '26.820.60940') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.openai.chat');"
       },
-      "installer_url": "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.818.61809.zip",
+      "installer_url": "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.820.60940.zip",
       "install_script_ref": "cbce2d7d",
       "uninstall_script_ref": "678e6cf0",
-      "sha256": "36a4c47d0bdee76710c0989b9b077f3c3e88bc0ba452469b86c811cc638a00bc",
+      "sha256": "133a96cff1cc6bdb8b425490d48913599ca7bc8f1cc53fc27d8d03ad14000a1c",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/claude/darwin.json b/ee/maintained-apps/outputs/claude/darwin.json
index 9e5e002cad8..5e7d164cc21 100644
--- a/ee/maintained-apps/outputs/claude/darwin.json
+++ b/ee/maintained-apps/outputs/claude/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "1.34493.1",
+      "version": "1.37937.1",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.anthropic.claudefordesktop';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.anthropic.claudefordesktop' AND version_compare(bundle_short_version, '1.34493.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.anthropic.claudefordesktop' AND version_compare(bundle_short_version, '1.37937.1') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.anthropic.claudefordesktop');"
       },
-      "installer_url": "https://downloads.claude.ai/releases/darwin/universal/1.34493.1/Claude-255293a41a25d54c5177aa9614fb4cd620e70b78.zip",
+      "installer_url": "https://downloads.claude.ai/releases/darwin/universal/1.37937.1/Claude-edbd3c346a2ffba6e653c9e861724f4260f5e749.zip",
       "install_script_ref": "98321e4d",
       "uninstall_script_ref": "421baa98",
-      "sha256": "c89494a96f1a7d6d84d5bf4dc097bf425074166ca3bf6b4d91684119fedaf745",
+      "sha256": "86a2b25795a66d654a4417054e2bc3ac0b54b52d2f85d4b24d87e3b0138ae847",
       "default_categories": [
         "Developer tools"
       ]
diff --git a/ee/maintained-apps/outputs/cmake-app/darwin.json b/ee/maintained-apps/outputs/cmake-app/darwin.json
index e80910f65bb..026111a98b2 100644
--- a/ee/maintained-apps/outputs/cmake-app/darwin.json
+++ b/ee/maintained-apps/outputs/cmake-app/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "4.4.2",
+      "version": "4.4.3",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'org.cmake.cmake';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.cmake.cmake' AND version_compare(bundle_short_version, '4.4.2') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.cmake.cmake' AND version_compare(bundle_short_version, '4.4.3') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'org.cmake.cmake');"
       },
-      "installer_url": "https://cmake.org/files/v4.4/cmake-4.4.2-macos-universal.dmg",
+      "installer_url": "https://cmake.org/files/v4.4/cmake-4.4.3-macos-universal.dmg",
       "install_script_ref": "bf131a87",
       "uninstall_script_ref": "ff358276",
-      "sha256": "33d16c2683aee4fe9a8c26c9f2d3003e04391ac4c4f48273ab1cf70e9b0bf679",
+      "sha256": "0423c5c00f71fb8e7be281afa834137c5f95a5791a125beec7939eef45bcfc94",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/cyberduck/darwin.json b/ee/maintained-apps/outputs/cyberduck/darwin.json
index 042148ba295..e8aae4db684 100644
--- a/ee/maintained-apps/outputs/cyberduck/darwin.json
+++ b/ee/maintained-apps/outputs/cyberduck/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "9.5.3",
+      "version": "9.5.4",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'ch.sudo.cyberduck';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'ch.sudo.cyberduck' AND version_compare(bundle_short_version, '9.5.3') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'ch.sudo.cyberduck' AND version_compare(bundle_short_version, '9.5.4') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'ch.sudo.cyberduck');"
       },
-      "installer_url": "https://update.cyberduck.io/Cyberduck-9.5.3.45464.zip",
+      "installer_url": "https://update.cyberduck.io/Cyberduck-9.5.4.45528.zip",
       "install_script_ref": "809901d0",
-      "uninstall_script_ref": "8d609003",
-      "sha256": "b53092b7b7057d9782c093839bc47b19afd0987b23d7252bae435078f3e47e28",
+      "uninstall_script_ref": "b68eddcb",
+      "sha256": "9398777ad01bfac7228db3990aed1c834437a599664e0f3e27a68feb53cbcebf",
       "default_categories": [
         "Productivity"
       ]
@@ -18,6 +18,6 @@
   ],
   "refs": {
     "809901d0": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# extract contents\nunzip \"$INSTALLER_PATH\" -d \"$TMPDIR\"\n# copy to the applications folder\nquit_and_track_application 'ch.sudo.cyberduck'\nif [ -d \"$APPDIR/Cyberduck.app\" ]; then\n\tsudo mv \"$APPDIR/Cyberduck.app\" \"$TMPDIR/Cyberduck.app.bkp\" || exit $?\nfi\nif ! sudo cp -R \"$TMPDIR/Cyberduck.app\" \"$APPDIR\"; then\n\t# remove the partial copy so a failed install isn't inventoried as the new\n\t# version, then restore the previous version if there was one\n\tsudo rm -rf \"$APPDIR/Cyberduck.app\"\n\tif [ -d \"$TMPDIR/Cyberduck.app.bkp\" ]; then\n\t\tsudo mv \"$TMPDIR/Cyberduck.app.bkp\" \"$APPDIR/Cyberduck.app\"\n\tfi\n\texit 1\nfi\nrelaunch_application 'ch.sudo.cyberduck'\n",
-    "8d609003": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nsudo rm -rf \"$APPDIR/Cyberduck.app\"\ntrash $LOGGED_IN_USER '~/Library/Application Support/Cyberduck'\ntrash $LOGGED_IN_USER '~/Library/Caches/ch.sudo.cyberduck'\ntrash $LOGGED_IN_USER '~/Library/Group Containers/G69SCX94XU.duck'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/ch.sudo.cyberduck'\ntrash $LOGGED_IN_USER '~/Library/Logs/Cyberduck'\ntrash $LOGGED_IN_USER '~/Library/Preferences/ch.sudo.cyberduck.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/ch.sudo.cyberduck.savedState'\n"
+    "b68eddcb": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nquit_application() {\n  local bundle_id=\"$1\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nquit_application 'ch.sudo.cyberduck'\nsudo rm -rf \"$APPDIR/Cyberduck.app\"\ntrash $LOGGED_IN_USER '~/Library/Application Support/Cyberduck'\ntrash $LOGGED_IN_USER '~/Library/Caches/ch.sudo.cyberduck'\ntrash $LOGGED_IN_USER '~/Library/Group Containers/G69SCX94XU.duck'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/ch.sudo.cyberduck'\ntrash $LOGGED_IN_USER '~/Library/Logs/Cyberduck'\ntrash $LOGGED_IN_USER '~/Library/Preferences/ch.sudo.cyberduck.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/ch.sudo.cyberduck.savedState'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/docker-desktop/darwin.json b/ee/maintained-apps/outputs/docker-desktop/darwin.json
index 0c80ce73633..518a503dc70 100644
--- a/ee/maintained-apps/outputs/docker-desktop/darwin.json
+++ b/ee/maintained-apps/outputs/docker-desktop/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "4.88.0",
+      "version": "4.88.1",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.docker.docker';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.docker.docker' AND path NOT LIKE '%.back%' AND version_compare(bundle_short_version, '4.88.0') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.docker.docker' AND path NOT LIKE '%.back%' AND version_compare(bundle_short_version, '4.88.1') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.docker.docker');"
       },
-      "installer_url": "https://desktop.docker.com/mac/main/arm64/237115/Docker.dmg",
+      "installer_url": "https://desktop.docker.com/mac/main/arm64/237512/Docker.dmg",
       "install_script_ref": "4afb9744",
       "uninstall_script_ref": "ba7543f2",
-      "sha256": "1651abab9cda5b8088e02740815e38a112140e304b87dd682509ba1bf7f8b036",
+      "sha256": "94102d4fe056bf3a4fde375d693aae96a429157dad0345af9853d7157d6bd5bd",
       "default_categories": [
         "Developer tools"
       ]
diff --git a/ee/maintained-apps/outputs/docker/windows.json b/ee/maintained-apps/outputs/docker/windows.json
index 65f305c64d9..147925ae54f 100644
--- a/ee/maintained-apps/outputs/docker/windows.json
+++ b/ee/maintained-apps/outputs/docker/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "4.88.0",
+      "version": "4.88.1",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'Docker Desktop' AND publisher = 'Docker Inc.';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Docker Desktop' AND publisher = 'Docker Inc.' AND version_compare(version, '4.88.0') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Docker Desktop' AND publisher = 'Docker Inc.' AND version_compare(version, '4.88.1') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'docker desktop.exe');"
       },
-      "installer_url": "https://desktop.docker.com/win/main/amd64/237115/Docker%20Desktop%20Installer.exe",
+      "installer_url": "https://desktop.docker.com/win/main/amd64/237512/Docker%20Desktop%20Installer.exe",
       "install_script_ref": "b06042dd",
       "uninstall_script_ref": "0b74af50",
-      "sha256": "53bd0193c96dfa81a25c5f4ae4f6d5143c4165d282287630c72ea5fe6025007b",
+      "sha256": "89fe3d80a326a2ad521de09b5a89ef04d10c60593604b344f11f433ca7f1f6f0",
       "default_categories": [
         "Developer tools"
       ]
diff --git a/ee/maintained-apps/outputs/downie/darwin.json b/ee/maintained-apps/outputs/downie/darwin.json
index c7eb25067a5..061ce2ad05d 100644
--- a/ee/maintained-apps/outputs/downie/darwin.json
+++ b/ee/maintained-apps/outputs/downie/darwin.json
@@ -7,10 +7,10 @@
         "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.charliemonroe.Downie-4' AND version_compare(bundle_short_version, '4.12.14') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.charliemonroe.Downie-4');"
       },
-      "installer_url": "https://software.charliemonroe.net/trial/downie/v4/Downie_4_5242.dmg",
+      "installer_url": "https://software.charliemonroe.net/trial/downie/v4/Downie_4_5243.dmg",
       "install_script_ref": "4f6dd0e2",
       "uninstall_script_ref": "65dfe669",
-      "sha256": "b261eb312d3b7a5abad1f322ca30b038c41787069828e2aa4a3aeb0dfe316201",
+      "sha256": "e715f052c924dac979161c17857d36af170c3d932bcb777761ce1d8f40575a11",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/firefox/darwin.json b/ee/maintained-apps/outputs/firefox/darwin.json
index f20b717bab7..80e40785949 100644
--- a/ee/maintained-apps/outputs/firefox/darwin.json
+++ b/ee/maintained-apps/outputs/firefox/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "154.0",
+      "version": "154.0.1",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'org.mozilla.firefox';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.mozilla.firefox' AND version_compare(bundle_short_version, '154.0') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.mozilla.firefox' AND version_compare(bundle_short_version, '154.0.1') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'org.mozilla.firefox');"
       },
-      "installer_url": "https://download-installer.cdn.mozilla.net/pub/firefox/releases/154.0/mac/en-US/Firefox%20154.0.dmg",
+      "installer_url": "https://download-installer.cdn.mozilla.net/pub/firefox/releases/154.0.1/mac/en-US/Firefox%20154.0.1.dmg",
       "install_script_ref": "f4a36f7d",
       "uninstall_script_ref": "94fa5a3b",
-      "sha256": "b0295d3b77ec632a60282cf2b9770e1dada085879d00e43d8d23fddf5015e06a",
+      "sha256": "01d95a6652018bb3d1e0bfad13ed6775864a1f3390d224e713f7d6f8b98fd679",
       "default_categories": [
         "Browsers"
       ]
diff --git a/ee/maintained-apps/outputs/firefox@nightly/darwin.json b/ee/maintained-apps/outputs/firefox@nightly/darwin.json
index 0b2ced86e14..82b60b229d9 100644
--- a/ee/maintained-apps/outputs/firefox@nightly/darwin.json
+++ b/ee/maintained-apps/outputs/firefox@nightly/darwin.json
@@ -4,13 +4,13 @@
       "version": "156.0a1",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'org.mozilla.nightly';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.mozilla.nightly' AND version_compare(bundle_version, '15626.8.24') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.mozilla.nightly' AND version_compare(bundle_version, '15626.8.25') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'org.mozilla.nightly');"
       },
-      "installer_url": "https://ftp.mozilla.org/pub/firefox/nightly/2026/08/2026-08-24-21-44-32-mozilla-central/firefox-156.0a1.en-US.mac.dmg",
+      "installer_url": "https://ftp.mozilla.org/pub/firefox/nightly/2026/08/2026-08-25-09-04-28-mozilla-central/firefox-156.0a1.en-US.mac.dmg",
       "install_script_ref": "d9c4cf87",
       "uninstall_script_ref": "0661f848",
-      "sha256": "4fe9a7695f7b2d6af91d8baf8136508214dbf7060abd74393f936fcc9c781842",
+      "sha256": "e6fa36e84c4114f176dcd66495247af3edacbd3f998ba2d671879a997cf9da4a",
       "default_categories": [
         "Browsers"
       ]
diff --git a/ee/maintained-apps/outputs/firefox@nightly/windows.json b/ee/maintained-apps/outputs/firefox@nightly/windows.json
index dd276e5defe..b1c7912c347 100644
--- a/ee/maintained-apps/outputs/firefox@nightly/windows.json
+++ b/ee/maintained-apps/outputs/firefox@nightly/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "156.2608.1809.0",
+      "version": "156.2608.2321.0",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'Firefox Nightly' AND publisher = 'Mozilla Corporation';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Firefox Nightly' AND publisher = 'Mozilla Corporation' AND version_compare(version, '156.2608.1809.0') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Firefox Nightly' AND publisher = 'Mozilla Corporation' AND version_compare(version, '156.2608.2321.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'mozilla firefox nightly.exe');"
       },
-      "installer_url": "https://ftp.mozilla.org/pub/firefox/nightly/2026/08/2026-08-18-09-20-26-mozilla-central/firefox-156.0a1.multi.win64.installer.msix",
+      "installer_url": "https://ftp.mozilla.org/pub/firefox/nightly/2026/08/2026-08-23-21-38-25-mozilla-central/firefox-156.0a1.multi.win64.installer.msix",
       "install_script_ref": "255e7c51",
       "uninstall_script_ref": "f0d0fed1",
-      "sha256": "377095f7d823da0b41047ac22d0db17ba1f261e3be9cc7351724b429eb8a2fc0",
+      "sha256": "81550eeac20e3eb57de52db23a3a3e0a575c9ea8049ca490fdda4fe43fe5c27d",
       "default_categories": [
         "Browsers"
       ]
diff --git a/ee/maintained-apps/outputs/framer/darwin.json b/ee/maintained-apps/outputs/framer/darwin.json
index b1c38c55552..734bf574282 100644
--- a/ee/maintained-apps/outputs/framer/darwin.json
+++ b/ee/maintained-apps/outputs/framer/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "2026.33.2",
+      "version": "2026.34.0",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.framer.electron';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.framer.electron' AND version_compare(bundle_short_version, '2026.33.2') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.framer.electron' AND version_compare(bundle_short_version, '2026.34.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.framer.electron');"
       },
-      "installer_url": "https://updates.framer.com/electron/darwin/arm64/Framer-2026.33.2.zip",
+      "installer_url": "https://updates.framer.com/electron/darwin/arm64/Framer-2026.34.0.zip",
       "install_script_ref": "76134736",
       "uninstall_script_ref": "12495d2a",
-      "sha256": "3f232a3c7e3d5d09530c20c4198badd8932945077958003f39633db70fa66c3e",
+      "sha256": "b6a3fc4811ece95f7ddc11a58d61849d18d29779ae91c16e323b789e6949c6a2",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/geogebra-classic/windows.json b/ee/maintained-apps/outputs/geogebra-classic/windows.json
index ae7bedc4fd2..91d7e4b2a60 100644
--- a/ee/maintained-apps/outputs/geogebra-classic/windows.json
+++ b/ee/maintained-apps/outputs/geogebra-classic/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "6.0.927",
+      "version": "6.0.929",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'GeoGebra Classic' AND publisher = 'International GeoGebra Institute';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'GeoGebra Classic' AND publisher = 'International GeoGebra Institute' AND version_compare(version, '6.0.927') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'GeoGebra Classic' AND publisher = 'International GeoGebra Institute' AND version_compare(version, '6.0.929') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'geogebra classic.exe');"
       },
-      "installer_url": "https://download.geogebra.org/installers/6.0/GeoGebra-Windows-Installer-6-0-927-1.msi",
+      "installer_url": "https://download.geogebra.org/installers/6.0/GeoGebra-Windows-Installer-6-0-929-3.msi",
       "install_script_ref": "22e48c46",
       "uninstall_script_ref": "3b39b830",
-      "sha256": "c65c64f27692e4dd8eaf0d6ad737f283935caa3b0a334bada3a9795aefbbe1a8",
+      "sha256": "7b30f1f24cc9bf3d87c743949c3b3eda557e56c14f6cfc97b3cdeb7d5c7f0f31",
       "default_categories": [
         "Productivity"
       ],
diff --git a/ee/maintained-apps/outputs/google-chrome/darwin.json b/ee/maintained-apps/outputs/google-chrome/darwin.json
index 5db21c85416..acf654a2fe3 100644
--- a/ee/maintained-apps/outputs/google-chrome/darwin.json
+++ b/ee/maintained-apps/outputs/google-chrome/darwin.json
@@ -1,10 +1,10 @@
 {
   "versions": [
     {
-      "version": "151.0.7922.174",
+      "version": "152.0.7977.65",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.google.Chrome';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.google.Chrome' AND version_compare(bundle_short_version, '151.0.7922.174') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.google.Chrome' AND version_compare(bundle_short_version, '152.0.7977.65') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.google.Chrome');"
       },
       "installer_url": "https://dl.google.com/dl/chrome/mac/universal/stable/gcem/GoogleChrome.pkg",
diff --git a/ee/maintained-apps/outputs/google-drive/windows.json b/ee/maintained-apps/outputs/google-drive/windows.json
index e191f04a04c..06423e9b0ef 100644
--- a/ee/maintained-apps/outputs/google-drive/windows.json
+++ b/ee/maintained-apps/outputs/google-drive/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "129.0.1.0",
+      "version": "130.0.2.0",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'Google Drive' AND publisher = 'Google LLC';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Google Drive' AND publisher = 'Google LLC' AND version_compare(version, '129.0.1.0') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Google Drive' AND publisher = 'Google LLC' AND version_compare(version, '130.0.2.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'google drive.exe');"
       },
-      "installer_url": "https://dl.google.com/release2/drive-file-stream/adrnonybri4rh25g3rwcs6mgeqva_129.0.1.0/setup.exe",
+      "installer_url": "https://dl.google.com/release2/drive-file-stream/acx3t3hyxtsch7palda755pv7gpq_130.0.2.0/setup.exe",
       "install_script_ref": "fa36b892",
       "uninstall_script_ref": "d4d8e35c",
-      "sha256": "e3cf3a5dda289d8eef5fe22c920db59ff936968d9b7b7ffafceba90bf9cb8464",
+      "sha256": "3fcdf80dea25a1af139996e5126ab3b88517e8257eef6f81dc9973c12cc372aa",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/granola/darwin.json b/ee/maintained-apps/outputs/granola/darwin.json
index bee973f54a4..309ec1d9c37 100644
--- a/ee/maintained-apps/outputs/granola/darwin.json
+++ b/ee/maintained-apps/outputs/granola/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "7.498.1",
+      "version": "7.503.0",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.granola.app';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.granola.app' AND version_compare(bundle_short_version, '7.498.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.granola.app' AND version_compare(bundle_short_version, '7.503.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.granola.app');"
       },
-      "installer_url": "https://dr2v7l5emb758.cloudfront.net/7.498.1/Granola-7.498.1-mac-universal.dmg",
+      "installer_url": "https://dr2v7l5emb758.cloudfront.net/7.503.0/Granola-7.503.0-mac-universal.dmg",
       "install_script_ref": "08a593fa",
       "uninstall_script_ref": "903a1d58",
-      "sha256": "410aba51fbe6e65aca0ab8d0f25940a64aa94246d8920d16e6904916b02b0459",
+      "sha256": "2585b48a202e33765c25ec0dd7baca1908b68f69c42e424515898e6d2646fb3d",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/granola/windows.json b/ee/maintained-apps/outputs/granola/windows.json
index 8df219b205d..845c915997d 100644
--- a/ee/maintained-apps/outputs/granola/windows.json
+++ b/ee/maintained-apps/outputs/granola/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "7.498.1",
+      "version": "7.503.0",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name LIKE 'Granola %' AND publisher = 'Granola';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name LIKE 'Granola %' AND publisher = 'Granola' AND version_compare(version, '7.498.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name LIKE 'Granola %' AND publisher = 'Granola' AND version_compare(version, '7.503.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'granola.exe');"
       },
-      "installer_url": "https://dr2v7l5emb758.cloudfront.net/7.498.1/Granola-7.498.1-win-x64.exe",
+      "installer_url": "https://dr2v7l5emb758.cloudfront.net/7.503.0/Granola-7.503.0-win-x64.exe",
       "install_script_ref": "3f66ac53",
       "uninstall_script_ref": "a4fab3f5",
-      "sha256": "70eb376e9f1d7a441d7b325bbcc3700d5e68aefd80220df91ac41f1646f69f9e",
+      "sha256": "4ebefeccf3ad4d02ede93db2cbf894b97fddac07ef170d7f05ef275cf0734355",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/intellij-idea/windows.json b/ee/maintained-apps/outputs/intellij-idea/windows.json
index 9a49dd1c8dc..438a980a24b 100644
--- a/ee/maintained-apps/outputs/intellij-idea/windows.json
+++ b/ee/maintained-apps/outputs/intellij-idea/windows.json
@@ -5,7 +5,7 @@
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name LIKE 'IntelliJ IDEA %' AND name NOT LIKE 'IntelliJ IDEA Community%' AND name NOT LIKE 'IntelliJ IDEA Educational%' AND publisher = 'JetBrains s.r.o.';",
         "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name LIKE 'IntelliJ IDEA %' AND name NOT LIKE 'IntelliJ IDEA Community%' AND name NOT LIKE 'IntelliJ IDEA Educational%' AND publisher = 'JetBrains s.r.o.' AND version_compare(version, '262.9437.185') < 0);",
-        "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) IN ('idea.exe','idea64.exe'));"
+        "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'intellij idea.exe');"
       },
       "installer_url": "https://download.jetbrains.com/idea/idea-2026.2.1.exe",
       "install_script_ref": "a0d4b424",
diff --git a/ee/maintained-apps/outputs/jabra-direct/windows.json b/ee/maintained-apps/outputs/jabra-direct/windows.json
index 9b85108d18d..f2467a5b3f4 100644
--- a/ee/maintained-apps/outputs/jabra-direct/windows.json
+++ b/ee/maintained-apps/outputs/jabra-direct/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "8.1.14601",
+      "version": "8.2.23201",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'Jabra Direct' AND publisher = 'GN Audio A/S';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Jabra Direct' AND publisher = 'GN Audio A/S' AND version_compare(version, '8.1.14601') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Jabra Direct' AND publisher = 'GN Audio A/S' AND version_compare(version, '8.2.23201') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'jabra direct.exe');"
       },
       "installer_url": "https://jabraxpressonlineprdstor.blob.core.windows.net/jdo/JabraDirectSetup.exe",
       "install_script_ref": "66727e5a",
       "uninstall_script_ref": "036b08d5",
-      "sha256": "5e11f3709fb3327b206b19e2291aa69e74ef08d93e56d826488206d94c8c48d5",
+      "sha256": "c1d2c1890be8eaca18a5db775d5efbc3a3c54bdb4c907a5e6399562a8d7c2387",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/kiro-cli/darwin.json b/ee/maintained-apps/outputs/kiro-cli/darwin.json
index 5f4ad094c7a..d7993f6c70c 100644
--- a/ee/maintained-apps/outputs/kiro-cli/darwin.json
+++ b/ee/maintained-apps/outputs/kiro-cli/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "2.19.1",
+      "version": "2.19.2",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'dev.kiro.cli';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'dev.kiro.cli' AND version_compare(bundle_short_version, '2.19.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'dev.kiro.cli' AND version_compare(bundle_short_version, '2.19.2') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'dev.kiro.cli');"
       },
-      "installer_url": "https://desktop-release.q.us-east-1.amazonaws.com/2.19.1/Kiro%20CLI.dmg",
+      "installer_url": "https://desktop-release.q.us-east-1.amazonaws.com/2.19.2/Kiro%20CLI.dmg",
       "install_script_ref": "21bed962",
       "uninstall_script_ref": "ed98f0de",
-      "sha256": "600e2078ae087105e7424583f5feded96c7469a8a18b9cbc802b28809e03e433",
+      "sha256": "1103a77c32ab346200cf9e4ca47143bb4709a18947acb03750c2467392c5baf5",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/melodics/darwin.json b/ee/maintained-apps/outputs/melodics/darwin.json
index 633565c37cd..81f38d67e51 100644
--- a/ee/maintained-apps/outputs/melodics/darwin.json
+++ b/ee/maintained-apps/outputs/melodics/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "5.0.1097",
+      "version": "5.0.1111",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.melodics.Melodics';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.melodics.Melodics' AND version_compare(bundle_short_version, '5.0.1097') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.melodics.Melodics' AND version_compare(bundle_short_version, '5.0.1111') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.melodics.Melodics');"
       },
-      "installer_url": "https://web-cdn.melodics.com/download/D9F75AB3-F672-4886-A531-41B46FD5355A.zip",
+      "installer_url": "https://web-cdn.melodics.com/download/914FCC30-6218-4E9B-B0E2-5176EAD18627.zip",
       "install_script_ref": "fa7d6756",
       "uninstall_script_ref": "4eb92aa5",
-      "sha256": "c67e40df018e1087b911d450b589f1853b3d0aafd8fa8a4f7e16992fcc771e8e",
+      "sha256": "86fb5b1394a57b4f9af9ba53a7b4a54161d61b5c0857663e0d5b5cbc6bc5666f",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/mendeley-reference-manager/darwin.json b/ee/maintained-apps/outputs/mendeley-reference-manager/darwin.json
index b5258f94223..b9b22979f29 100644
--- a/ee/maintained-apps/outputs/mendeley-reference-manager/darwin.json
+++ b/ee/maintained-apps/outputs/mendeley-reference-manager/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "2.148.0",
+      "version": "2.149.0",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.elsevier.mendeley';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.elsevier.mendeley' AND version_compare(bundle_short_version, '2.148.0') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.elsevier.mendeley' AND version_compare(bundle_short_version, '2.149.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.elsevier.mendeley');"
       },
-      "installer_url": "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-2.148.0-universal.dmg",
+      "installer_url": "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-2.149.0-universal.dmg",
       "install_script_ref": "be90d0c1",
       "uninstall_script_ref": "1f744b0c",
-      "sha256": "2fe21cba5e9dac0c5037731ef588515d518518d132686acbf85a1faadba6b61f",
+      "sha256": "97c5dba3fd0152e8f2a63f3fd828dff4b9d3730b6ae79e382ef7381ab8efb9d0",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/microsoft-excel/darwin.json b/ee/maintained-apps/outputs/microsoft-excel/darwin.json
index 85a75a35ad1..5ffb84a1563 100644
--- a/ee/maintained-apps/outputs/microsoft-excel/darwin.json
+++ b/ee/maintained-apps/outputs/microsoft-excel/darwin.json
@@ -1,23 +1,23 @@
 {
   "versions": [
     {
-      "version": "16.112.1",
+      "version": "16.112.2",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.Excel';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.Excel' AND version_compare(bundle_short_version, '16.112.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.Excel' AND version_compare(bundle_short_version, '16.112.2') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.microsoft.Excel');"
       },
-      "installer_url": "https://res.public.onecdn.static.microsoft/mro1cdnstorage/C1297A47-86C4-4C1F-97FA-950631F94777/MacAutoupdate/Microsoft_Excel_16.112.26081720_Installer.pkg",
-      "install_script_ref": "8b24fcc9",
+      "installer_url": "https://res.public.onecdn.static.microsoft/mro1cdnstorage/C1297A47-86C4-4C1F-97FA-950631F94777/MacAutoupdate/Microsoft_Excel_16.112.26082125_Installer.pkg",
+      "install_script_ref": "bc094b0c",
       "uninstall_script_ref": "cdad4413",
-      "sha256": "6f080f49495b919c5f62dd63be155fd94b605dd5d8a40c07534648dd924becaa",
+      "sha256": "62aa6fb517d3f201ffb8c26694dbca181fc001a19dd6cef2210c2dc062c73e7a",
       "default_categories": [
         "Productivity"
       ]
     }
   ],
   "refs": {
-    "8b24fcc9": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.microsoft.Excel'\n\nCHOICE_XML=$(mktemp /tmp/choice_xml_XXX)\n\ncat << EOF > \"$CHOICE_XML\"\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<array>\n  <dict>\n    <key>attributeSetting</key>\n    <integer>0</integer>\n    <key>choiceAttribute</key>\n    <string>selected</string>\n    <key>choiceIdentifier</key>\n    <string>com.microsoft.autoupdate</string>\n  </dict>\n</array>\n</plist>\n\nEOF\n\nsudo installer -pkg \"$TMPDIR/Microsoft_Excel_16.112.26081720_Installer.pkg\" -target / -applyChoiceChangesXML \"$CHOICE_XML\" || exit $?\n\nrelaunch_application 'com.microsoft.Excel'\n",
+    "bc094b0c": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.microsoft.Excel'\n\nCHOICE_XML=$(mktemp /tmp/choice_xml_XXX)\n\ncat << EOF > \"$CHOICE_XML\"\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<array>\n  <dict>\n    <key>attributeSetting</key>\n    <integer>0</integer>\n    <key>choiceAttribute</key>\n    <string>selected</string>\n    <key>choiceIdentifier</key>\n    <string>com.microsoft.autoupdate</string>\n  </dict>\n</array>\n</plist>\n\nEOF\n\nsudo installer -pkg \"$TMPDIR/Microsoft_Excel_16.112.26082125_Installer.pkg\" -target / -applyChoiceChangesXML \"$CHOICE_XML\" || exit $?\n\nrelaunch_application 'com.microsoft.Excel'\n",
     "cdad4413": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nquit_application() {\n  local bundle_id=\"$1\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nremove_launchctl_service() {\n  local service=\"$1\"\n  local booleans=(\"true\" \"false\")\n  local plist_status\n  local paths\n  local should_sudo\n\n  echo \"Removing launchctl service ${service}\"\n\n  # A wildcard label can't be used with launchctl or as a plist name, so expand\n  # it to the labels of currently loaded services that match the pattern.\n  local services=(\"$service\")\n  if [[ \"$service\" == *\"*\"* ]]; then\n    local regex\n    # Escape regex metacharacters, turn '*' into '.*', and anchor the pattern so\n    # it matches a full label rather than a substring.\n    regex=$(printf '%s' \"$service\" | sed -e 's/[][(){}.^$+?|\\\\]/\\\\&/g' -e 's/\\*/.*/g')\n    regex=\"^${regex}$\"\n    services=()\n    local id\n    # Match every loaded job by label regardless of PID; launchctl list reports\n    # loaded-but-not-running jobs with a \"-\" in the PID column.\n    while read -r _ _ id; do\n      [[ \"$id\" =~ $regex ]] && services+=(\"$id\")\n    done < <(launchctl list 2>/dev/null | tail -n +2)\n    if [[ ${#services[@]} -eq 0 ]]; then\n      echo \"No loaded launchctl service matches ${service}\"\n      return\n    fi\n  fi\n\n  local service_label\n  for service_label in \"${services[@]}\"; do\n    for should_sudo in \"${booleans[@]}\"; do\n      plist_status=$(launchctl list \"${service_label}\" 2>/dev/null)\n\n      if [[ $plist_status == \\{* ]]; then\n        if [[ $should_sudo == \"true\" ]]; then\n          sudo launchctl remove \"${service_label}\"\n        else\n          launchctl remove \"${service_label}\"\n        fi\n        sleep 1\n      fi\n\n      paths=(\n        \"/Library/LaunchAgents/${service_label}.plist\"\n        \"/Library/LaunchDaemons/${service_label}.plist\"\n      )\n\n      # if not using sudo, prepend the home directory to the paths\n      if [[ $should_sudo == \"false\" ]]; then\n        for i in \"${!paths[@]}\"; do\n          paths[i]=\"${HOME}${paths[i]}\"\n        done\n      fi\n\n      for path in \"${paths[@]}\"; do\n        if [[ -e \"$path\" ]]; then\n          if [[ $should_sudo == \"true\" ]]; then\n            sudo rm -f -- \"$path\"\n          else\n            rm -f -- \"$path\"\n          fi\n        fi\n      done\n    done\n  done\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_launchctl_service 'com.microsoft.office.licensingV2.helper'\nquit_application 'com.microsoft.autoupdate2'\nremove_pkg_files 'com.microsoft.package.Microsoft_Excel.app'\nforget_pkg 'com.microsoft.package.Microsoft_Excel.app'\nremove_pkg_files 'com.microsoft.pkg.licensing'\nforget_pkg 'com.microsoft.pkg.licensing'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.Excel'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.microsoft.excel.sfl*'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.Excel'\ntrash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.Excel'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.Excel.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.Excel.savedState'\ntrash $LOGGED_IN_USER '~/Library/Webkit/com.microsoft.Excel'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/microsoft-onenote/darwin.json b/ee/maintained-apps/outputs/microsoft-onenote/darwin.json
index 51306d1ede1..4d50b464e89 100644
--- a/ee/maintained-apps/outputs/microsoft-onenote/darwin.json
+++ b/ee/maintained-apps/outputs/microsoft-onenote/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "16.112.1",
+      "version": "16.112.2",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.onenote.mac';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.onenote.mac' AND version_compare(bundle_short_version, '16.112.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.onenote.mac' AND version_compare(bundle_short_version, '16.112.2') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.microsoft.onenote.mac');"
       },
-      "installer_url": "https://res.public.onecdn.static.microsoft/mro1cdnstorage/C1297A47-86C4-4C1F-97FA-950631F94777/MacAutoupdate/Microsoft_OneNote_16.112.26081720_Updater.pkg",
-      "install_script_ref": "e7b65a6c",
+      "installer_url": "https://res.public.onecdn.static.microsoft/mro1cdnstorage/C1297A47-86C4-4C1F-97FA-950631F94777/MacAutoupdate/Microsoft_OneNote_16.112.26082125_Updater.pkg",
+      "install_script_ref": "c7f527ba",
       "uninstall_script_ref": "c71395f6",
-      "sha256": "ad9df74a3ec7991ecb4dfa5640f3f8c8a4bc55b58785355b275c87e63f30f311",
+      "sha256": "8da23bd6fd07199e552393d94c34839e693208038fdc4d819fe5d0d2186863b0",
       "default_categories": [
         "Productivity"
       ]
@@ -18,6 +18,6 @@
   ],
   "refs": {
     "c71395f6": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_pkg_files 'com.microsoft.package.Microsoft_OneNote.app'\nforget_pkg 'com.microsoft.package.Microsoft_OneNote.app'\nsudo rm -rf '/Applications/Microsoft OneNote.app'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.onenote.mac*'\ntrash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.onenote.mac*'\n",
-    "e7b65a6c": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.microsoft.onenote.mac'\nsudo installer -pkg \"$TMPDIR/Microsoft_OneNote_16.112.26081720_Updater.pkg\" -target / || exit $?\nrelaunch_application 'com.microsoft.onenote.mac'\n"
+    "c7f527ba": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.microsoft.onenote.mac'\nsudo installer -pkg \"$TMPDIR/Microsoft_OneNote_16.112.26082125_Updater.pkg\" -target / || exit $?\nrelaunch_application 'com.microsoft.onenote.mac'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/microsoft-powerpoint/darwin.json b/ee/maintained-apps/outputs/microsoft-powerpoint/darwin.json
index 19fe65b549a..fc939855bad 100644
--- a/ee/maintained-apps/outputs/microsoft-powerpoint/darwin.json
+++ b/ee/maintained-apps/outputs/microsoft-powerpoint/darwin.json
@@ -1,23 +1,23 @@
 {
   "versions": [
     {
-      "version": "16.112.1",
+      "version": "16.112.2",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.Powerpoint';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.Powerpoint' AND version_compare(bundle_short_version, '16.112.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.Powerpoint' AND version_compare(bundle_short_version, '16.112.2') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.microsoft.Powerpoint');"
       },
-      "installer_url": "https://res.public.onecdn.static.microsoft/mro1cdnstorage/C1297A47-86C4-4C1F-97FA-950631F94777/MacAutoupdate/Microsoft_PowerPoint_16.112.26081720_Installer.pkg",
-      "install_script_ref": "876af74d",
+      "installer_url": "https://res.public.onecdn.static.microsoft/mro1cdnstorage/C1297A47-86C4-4C1F-97FA-950631F94777/MacAutoupdate/Microsoft_PowerPoint_16.112.26082125_Installer.pkg",
+      "install_script_ref": "29cf4484",
       "uninstall_script_ref": "f61145e4",
-      "sha256": "e38c15bec574e9b3d9a55eee3d957f36242a789c91c060d714d1debdf4eeb3b5",
+      "sha256": "65b942024c7e8cc50b657c5a6a45a73e52ce1c96ee38a4984f870c58963e909d",
       "default_categories": [
         "Productivity"
       ]
     }
   ],
   "refs": {
-    "876af74d": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.microsoft.Powerpoint'\n\nCHOICE_XML=$(mktemp /tmp/choice_xml_XXX)\n\ncat << EOF > \"$CHOICE_XML\"\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<array>\n  <dict>\n    <key>attributeSetting</key>\n    <integer>0</integer>\n    <key>choiceAttribute</key>\n    <string>selected</string>\n    <key>choiceIdentifier</key>\n    <string>com.microsoft.autoupdate</string>\n  </dict>\n</array>\n</plist>\n\nEOF\n\nsudo installer -pkg \"$TMPDIR/Microsoft_PowerPoint_16.112.26081720_Installer.pkg\" -target / -applyChoiceChangesXML \"$CHOICE_XML\" || exit $?\n\nrelaunch_application 'com.microsoft.Powerpoint'\n",
+    "29cf4484": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.microsoft.Powerpoint'\n\nCHOICE_XML=$(mktemp /tmp/choice_xml_XXX)\n\ncat << EOF > \"$CHOICE_XML\"\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<array>\n  <dict>\n    <key>attributeSetting</key>\n    <integer>0</integer>\n    <key>choiceAttribute</key>\n    <string>selected</string>\n    <key>choiceIdentifier</key>\n    <string>com.microsoft.autoupdate</string>\n  </dict>\n</array>\n</plist>\n\nEOF\n\nsudo installer -pkg \"$TMPDIR/Microsoft_PowerPoint_16.112.26082125_Installer.pkg\" -target / -applyChoiceChangesXML \"$CHOICE_XML\" || exit $?\n\nrelaunch_application 'com.microsoft.Powerpoint'\n",
     "f61145e4": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nquit_application() {\n  local bundle_id=\"$1\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nremove_launchctl_service() {\n  local service=\"$1\"\n  local booleans=(\"true\" \"false\")\n  local plist_status\n  local paths\n  local should_sudo\n\n  echo \"Removing launchctl service ${service}\"\n\n  # A wildcard label can't be used with launchctl or as a plist name, so expand\n  # it to the labels of currently loaded services that match the pattern.\n  local services=(\"$service\")\n  if [[ \"$service\" == *\"*\"* ]]; then\n    local regex\n    # Escape regex metacharacters, turn '*' into '.*', and anchor the pattern so\n    # it matches a full label rather than a substring.\n    regex=$(printf '%s' \"$service\" | sed -e 's/[][(){}.^$+?|\\\\]/\\\\&/g' -e 's/\\*/.*/g')\n    regex=\"^${regex}$\"\n    services=()\n    local id\n    # Match every loaded job by label regardless of PID; launchctl list reports\n    # loaded-but-not-running jobs with a \"-\" in the PID column.\n    while read -r _ _ id; do\n      [[ \"$id\" =~ $regex ]] && services+=(\"$id\")\n    done < <(launchctl list 2>/dev/null | tail -n +2)\n    if [[ ${#services[@]} -eq 0 ]]; then\n      echo \"No loaded launchctl service matches ${service}\"\n      return\n    fi\n  fi\n\n  local service_label\n  for service_label in \"${services[@]}\"; do\n    for should_sudo in \"${booleans[@]}\"; do\n      plist_status=$(launchctl list \"${service_label}\" 2>/dev/null)\n\n      if [[ $plist_status == \\{* ]]; then\n        if [[ $should_sudo == \"true\" ]]; then\n          sudo launchctl remove \"${service_label}\"\n        else\n          launchctl remove \"${service_label}\"\n        fi\n        sleep 1\n      fi\n\n      paths=(\n        \"/Library/LaunchAgents/${service_label}.plist\"\n        \"/Library/LaunchDaemons/${service_label}.plist\"\n      )\n\n      # if not using sudo, prepend the home directory to the paths\n      if [[ $should_sudo == \"false\" ]]; then\n        for i in \"${!paths[@]}\"; do\n          paths[i]=\"${HOME}${paths[i]}\"\n        done\n      fi\n\n      for path in \"${paths[@]}\"; do\n        if [[ -e \"$path\" ]]; then\n          if [[ $should_sudo == \"true\" ]]; then\n            sudo rm -f -- \"$path\"\n          else\n            rm -f -- \"$path\"\n          fi\n        fi\n      done\n    done\n  done\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_launchctl_service 'com.microsoft.office.licensingV2.helper'\nquit_application 'com.microsoft.autoupdate2'\nremove_pkg_files 'com.microsoft.package.Microsoft_PowerPoint.app'\nforget_pkg 'com.microsoft.package.Microsoft_PowerPoint.app'\nremove_pkg_files 'com.microsoft.pkg.licensing'\nforget_pkg 'com.microsoft.pkg.licensing'\nsudo rm -rf '/Applications/Microsoft PowerPoint.app'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.Powerpoint*'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.microsoft.powerpoint.sfl*'\ntrash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.Powerpoint*'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.Powerpoint.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.Powerpoint.savedState'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/microsoft-word/darwin.json b/ee/maintained-apps/outputs/microsoft-word/darwin.json
index 6eaab5820f0..00efec777b6 100644
--- a/ee/maintained-apps/outputs/microsoft-word/darwin.json
+++ b/ee/maintained-apps/outputs/microsoft-word/darwin.json
@@ -1,23 +1,23 @@
 {
   "versions": [
     {
-      "version": "16.112.1",
+      "version": "16.112.2",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.Word';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.Word' AND version_compare(bundle_short_version, '16.112.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.Word' AND version_compare(bundle_short_version, '16.112.2') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.microsoft.Word');"
       },
-      "installer_url": "https://res.public.onecdn.static.microsoft/mro1cdnstorage/C1297A47-86C4-4C1F-97FA-950631F94777/MacAutoupdate/Microsoft_Word_16.112.26081720_Installer.pkg",
-      "install_script_ref": "37ff3e3c",
+      "installer_url": "https://res.public.onecdn.static.microsoft/mro1cdnstorage/C1297A47-86C4-4C1F-97FA-950631F94777/MacAutoupdate/Microsoft_Word_16.112.26082125_Installer.pkg",
+      "install_script_ref": "7497b3cd",
       "uninstall_script_ref": "f085ec16",
-      "sha256": "ac0f19fe6ba9ea585d1555e6a622049a8ddb974da9c60bb9f7b3b52d0a0a18cb",
+      "sha256": "7714a3492573e019923ea95541d43082e856104ea0913cfd9b55930bccf296c4",
       "default_categories": [
         "Productivity"
       ]
     }
   ],
   "refs": {
-    "37ff3e3c": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.microsoft.Word'\n\nCHOICE_XML=$(mktemp /tmp/choice_xml_XXX)\n\ncat << EOF > \"$CHOICE_XML\"\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<array>\n  <dict>\n    <key>attributeSetting</key>\n    <integer>0</integer>\n    <key>choiceAttribute</key>\n    <string>selected</string>\n    <key>choiceIdentifier</key>\n    <string>com.microsoft.autoupdate</string>\n  </dict>\n</array>\n</plist>\n\nEOF\n\nsudo installer -pkg \"$TMPDIR/Microsoft_Word_16.112.26081720_Installer.pkg\" -target / -applyChoiceChangesXML \"$CHOICE_XML\" || exit $?\n\nrelaunch_application 'com.microsoft.Word'\n",
+    "7497b3cd": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.microsoft.Word'\n\nCHOICE_XML=$(mktemp /tmp/choice_xml_XXX)\n\ncat << EOF > \"$CHOICE_XML\"\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<array>\n  <dict>\n    <key>attributeSetting</key>\n    <integer>0</integer>\n    <key>choiceAttribute</key>\n    <string>selected</string>\n    <key>choiceIdentifier</key>\n    <string>com.microsoft.autoupdate</string>\n  </dict>\n</array>\n</plist>\n\nEOF\n\nsudo installer -pkg \"$TMPDIR/Microsoft_Word_16.112.26082125_Installer.pkg\" -target / -applyChoiceChangesXML \"$CHOICE_XML\" || exit $?\n\nrelaunch_application 'com.microsoft.Word'\n",
     "f085ec16": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nquit_application() {\n  local bundle_id=\"$1\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nremove_launchctl_service() {\n  local service=\"$1\"\n  local booleans=(\"true\" \"false\")\n  local plist_status\n  local paths\n  local should_sudo\n\n  echo \"Removing launchctl service ${service}\"\n\n  for should_sudo in \"${booleans[@]}\"; do\n    plist_status=$(launchctl list \"${service}\" 2>/dev/null)\n\n    if [[ $plist_status == \\{* ]]; then\n      if [[ $should_sudo == \"true\" ]]; then\n        sudo launchctl remove \"${service}\"\n      else\n        launchctl remove \"${service}\"\n      fi\n      sleep 1\n    fi\n\n    paths=(\n      \"/Library/LaunchAgents/${service}.plist\"\n      \"/Library/LaunchDaemons/${service}.plist\"\n    )\n\n    # if not using sudo, prepend the home directory to the paths\n    if [[ $should_sudo == \"false\" ]]; then\n      for i in \"${!paths[@]}\"; do\n        paths[i]=\"${HOME}${paths[i]}\"\n      done\n    fi\n\n    for path in \"${paths[@]}\"; do\n      if [[ -e \"$path\" ]]; then\n        if [[ $should_sudo == \"true\" ]]; then\n          sudo rm -f -- \"$path\"\n        else\n          rm -f -- \"$path\"\n        fi\n      fi\n    done\n  done\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_launchctl_service 'com.microsoft.office.licensingV2.helper'\nquit_application 'com.microsoft.autoupdate2'\nremove_pkg_files 'com.microsoft.package.Microsoft_Word.app'\nforget_pkg 'com.microsoft.package.Microsoft_Word.app'\nremove_pkg_files 'com.microsoft.pkg.licensing'\nforget_pkg 'com.microsoft.pkg.licensing'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.Word'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.microsoft.word.sfl*'\ntrash $LOGGED_IN_USER '~/Library/Application Support/CrashReporter/Microsoft Word_*.plist'\ntrash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.Word'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.Word.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.Word.savedState'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/mongodb-compass/darwin.json b/ee/maintained-apps/outputs/mongodb-compass/darwin.json
index d3c292e84c6..f94689e0a23 100644
--- a/ee/maintained-apps/outputs/mongodb-compass/darwin.json
+++ b/ee/maintained-apps/outputs/mongodb-compass/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "1.49.14",
+      "version": "1.49.15",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.mongodb.compass';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.mongodb.compass' AND version_compare(bundle_short_version, '1.49.14') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.mongodb.compass' AND version_compare(bundle_short_version, '1.49.15') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.mongodb.compass');"
       },
-      "installer_url": "https://downloads.mongodb.com/compass/mongodb-compass-1.49.14-darwin-arm64.dmg",
+      "installer_url": "https://downloads.mongodb.com/compass/mongodb-compass-1.49.15-darwin-arm64.dmg",
       "install_script_ref": "f6e74b2e",
       "uninstall_script_ref": "022cab65",
-      "sha256": "19622bfbd88aad63a961adbeb9e133ef4744d0ccc30d78ad5549000e3d1801a6",
+      "sha256": "c9bce4d13fbdfe5ab56128b52b8269f0c9ebe45d23a6ae359fed985e4bbfe3b2",
       "default_categories": [
         "Developer tools"
       ]
diff --git a/ee/maintained-apps/outputs/mountain-duck/darwin.json b/ee/maintained-apps/outputs/mountain-duck/darwin.json
index 3dd524b45c3..67159deb725 100644
--- a/ee/maintained-apps/outputs/mountain-duck/darwin.json
+++ b/ee/maintained-apps/outputs/mountain-duck/darwin.json
@@ -1,23 +1,23 @@
 {
   "versions": [
     {
-      "version": "5.3.1",
+      "version": "5.3.2",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'io.mountainduck';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'io.mountainduck' AND version_compare(bundle_short_version, '5.3.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'io.mountainduck' AND version_compare(bundle_short_version, '5.3.2') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'io.mountainduck');"
       },
-      "installer_url": "https://dist.mountainduck.io/Mountain%20Duck-5.3.1.29526.zip",
+      "installer_url": "https://dist.mountainduck.io/Mountain%20Duck-5.3.2.29785.zip",
       "install_script_ref": "b1d40229",
-      "uninstall_script_ref": "9229a596",
-      "sha256": "b224d053f47d30253e0b7b86a19018f94496dc06246f1ff6b79fe3717764936d",
+      "uninstall_script_ref": "cfa30414",
+      "sha256": "682d496bfd747a6f74a63c63f4a441b5d376034249686c7be29f9679628004ef",
       "default_categories": [
         "Productivity"
       ]
     }
   ],
   "refs": {
-    "9229a596": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nsudo rm -rf \"$APPDIR/Mountain Duck.app\"\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/io.mountainduck.findersync'\ntrash $LOGGED_IN_USER '~/Library/Caches/io.mountainduck'\ntrash $LOGGED_IN_USER '~/Library/Containers/io.mountainduck.findersync'\ntrash $LOGGED_IN_USER '~/Library/Group Containers/G69SCX94XU.duck'\ntrash $LOGGED_IN_USER '~/Library/Preferences/G69SCX94XU.duck.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/io.mountainduck.plist'\n",
-    "b1d40229": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# extract contents\nunzip \"$INSTALLER_PATH\" -d \"$TMPDIR\"\n# copy to the applications folder\nquit_and_track_application 'io.mountainduck'\nif [ -d \"$APPDIR/Mountain Duck.app\" ]; then\n\tsudo mv \"$APPDIR/Mountain Duck.app\" \"$TMPDIR/Mountain Duck.app.bkp\" || exit $?\nfi\nif ! sudo cp -R \"$TMPDIR/Mountain Duck.app\" \"$APPDIR\"; then\n\t# remove the partial copy so a failed install isn't inventoried as the new\n\t# version, then restore the previous version if there was one\n\tsudo rm -rf \"$APPDIR/Mountain Duck.app\"\n\tif [ -d \"$TMPDIR/Mountain Duck.app.bkp\" ]; then\n\t\tsudo mv \"$TMPDIR/Mountain Duck.app.bkp\" \"$APPDIR/Mountain Duck.app\"\n\tfi\n\texit 1\nfi\nrelaunch_application 'io.mountainduck'\n"
+    "b1d40229": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# extract contents\nunzip \"$INSTALLER_PATH\" -d \"$TMPDIR\"\n# copy to the applications folder\nquit_and_track_application 'io.mountainduck'\nif [ -d \"$APPDIR/Mountain Duck.app\" ]; then\n\tsudo mv \"$APPDIR/Mountain Duck.app\" \"$TMPDIR/Mountain Duck.app.bkp\" || exit $?\nfi\nif ! sudo cp -R \"$TMPDIR/Mountain Duck.app\" \"$APPDIR\"; then\n\t# remove the partial copy so a failed install isn't inventoried as the new\n\t# version, then restore the previous version if there was one\n\tsudo rm -rf \"$APPDIR/Mountain Duck.app\"\n\tif [ -d \"$TMPDIR/Mountain Duck.app.bkp\" ]; then\n\t\tsudo mv \"$TMPDIR/Mountain Duck.app.bkp\" \"$APPDIR/Mountain Duck.app\"\n\tfi\n\texit 1\nfi\nrelaunch_application 'io.mountainduck'\n",
+    "cfa30414": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nremove_launchctl_service() {\n  local service=\"$1\"\n  local booleans=(\"true\" \"false\")\n  local plist_status\n  local paths\n  local should_sudo\n\n  echo \"Removing launchctl service ${service}\"\n\n  # A wildcard label can't be used with launchctl or as a plist name, so expand\n  # it to the labels of currently loaded services that match the pattern.\n  local services=(\"$service\")\n  if [[ \"$service\" == *\"*\"* ]]; then\n    local regex\n    # Escape regex metacharacters, turn '*' into '.*', and anchor the pattern so\n    # it matches a full label rather than a substring.\n    regex=$(printf '%s' \"$service\" | sed -e 's/[][(){}.^$+?|\\\\]/\\\\&/g' -e 's/\\*/.*/g')\n    regex=\"^${regex}$\"\n    services=()\n    local id\n    # Match every loaded job by label regardless of PID; launchctl list reports\n    # loaded-but-not-running jobs with a \"-\" in the PID column.\n    while read -r _ _ id; do\n      [[ \"$id\" =~ $regex ]] && services+=(\"$id\")\n    done < <(launchctl list 2>/dev/null | tail -n +2)\n    if [[ ${#services[@]} -eq 0 ]]; then\n      echo \"No loaded launchctl service matches ${service}\"\n      return\n    fi\n  fi\n\n  local service_label\n  for service_label in \"${services[@]}\"; do\n    for should_sudo in \"${booleans[@]}\"; do\n      plist_status=$(launchctl list \"${service_label}\" 2>/dev/null)\n\n      if [[ $plist_status == \\{* ]]; then\n        if [[ $should_sudo == \"true\" ]]; then\n          sudo launchctl remove \"${service_label}\"\n        else\n          launchctl remove \"${service_label}\"\n        fi\n        sleep 1\n      fi\n\n      paths=(\n        \"/Library/LaunchAgents/${service_label}.plist\"\n        \"/Library/LaunchDaemons/${service_label}.plist\"\n      )\n\n      # if not using sudo, prepend the home directory to the paths\n      if [[ $should_sudo == \"false\" ]]; then\n        for i in \"${!paths[@]}\"; do\n          paths[i]=\"${HOME}${paths[i]}\"\n        done\n      fi\n\n      for path in \"${paths[@]}\"; do\n        if [[ -e \"$path\" ]]; then\n          if [[ $should_sudo == \"true\" ]]; then\n            sudo rm -f -- \"$path\"\n          else\n            rm -f -- \"$path\"\n          fi\n        fi\n      done\n    done\n  done\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_launchctl_service 'io.mountainduck.loginitem'\nsudo rm -rf \"$APPDIR/Mountain Duck.app\"\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/io.mountainduck.fileprovider'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/io.mountainduck.findersync'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/io.mountainduck.loginitem'\ntrash $LOGGED_IN_USER '~/Library/Application Support/Mountain Duck'\ntrash $LOGGED_IN_USER '~/Library/Caches/io.mountainduck'\ntrash $LOGGED_IN_USER '~/Library/Containers/io.mountainduck.fileprovider'\ntrash $LOGGED_IN_USER '~/Library/Containers/io.mountainduck.findersync'\ntrash $LOGGED_IN_USER '~/Library/Containers/io.mountainduck.loginitem'\ntrash $LOGGED_IN_USER '~/Library/Group Containers/G69SCX94XU.duck'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/io.mountainduck'\ntrash $LOGGED_IN_USER '~/Library/Logs/Mountain Duck'\ntrash $LOGGED_IN_USER '~/Library/Preferences/G69SCX94XU.duck.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/io.mountainduck.plist'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/nordlayer/darwin.json b/ee/maintained-apps/outputs/nordlayer/darwin.json
index 5996f96abb1..a80f932047b 100644
--- a/ee/maintained-apps/outputs/nordlayer/darwin.json
+++ b/ee/maintained-apps/outputs/nordlayer/darwin.json
@@ -1,23 +1,23 @@
 {
   "versions": [
     {
-      "version": "3.12.0",
+      "version": "3.12.1",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.nordvpn.macos.teams';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.nordvpn.macos.teams' AND version_compare(bundle_short_version, '3.12.0') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.nordvpn.macos.teams' AND version_compare(bundle_short_version, '3.12.1') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.nordvpn.macos.teams');"
       },
-      "installer_url": "https://downloads.nordlayer.com/mac/latest/NordLayer_v3.12.0.pkg",
-      "install_script_ref": "3bf22b4b",
+      "installer_url": "https://downloads.nordlayer.com/mac/latest/NordLayer_v3.12.1.pkg",
+      "install_script_ref": "81cb71fe",
       "uninstall_script_ref": "4ab665bb",
-      "sha256": "f52f3981c883cce9615ccb483661733d5fd9be19fc97db286d618615e256a3e2",
+      "sha256": "3d62a50eaeccda650a201cfc742d8f839e5133cae3e3050b1dfcbc746968a672",
       "default_categories": [
         "Productivity"
       ]
     }
   ],
   "refs": {
-    "3bf22b4b": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.nordvpn.macos.teams'\nsudo installer -pkg \"$TMPDIR/NordLayer_v3.12.0.pkg\" -target / || exit $?\nrelaunch_application 'com.nordvpn.macos.teams'\n",
-    "4ab665bb": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nquit_application() {\n  local bundle_id=\"$1\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nremove_launchctl_service() {\n  local service=\"$1\"\n  local booleans=(\"true\" \"false\")\n  local plist_status\n  local paths\n  local should_sudo\n\n  echo \"Removing launchctl service ${service}\"\n\n  # A wildcard label can't be used with launchctl or as a plist name, so expand\n  # it to the labels of currently loaded services that match the pattern.\n  local services=(\"$service\")\n  if [[ \"$service\" == *\"*\"* ]]; then\n    local regex\n    # Escape regex metacharacters, turn '*' into '.*', and anchor the pattern so\n    # it matches a full label rather than a substring.\n    regex=$(printf '%s' \"$service\" | sed -e 's/[][(){}.^$+?|\\\\]/\\\\&/g' -e 's/\\*/.*/g')\n    regex=\"^${regex}$\"\n    services=()\n    local id\n    # Match every loaded job by label regardless of PID; launchctl list reports\n    # loaded-but-not-running jobs with a \"-\" in the PID column.\n    while read -r _ _ id; do\n      [[ \"$id\" =~ $regex ]] && services+=(\"$id\")\n    done < <(launchctl list 2>/dev/null | tail -n +2)\n    if [[ ${#services[@]} -eq 0 ]]; then\n      echo \"No loaded launchctl service matches ${service}\"\n      return\n    fi\n  fi\n\n  local service_label\n  for service_label in \"${services[@]}\"; do\n    for should_sudo in \"${booleans[@]}\"; do\n      plist_status=$(launchctl list \"${service_label}\" 2>/dev/null)\n\n      if [[ $plist_status == \\{* ]]; then\n        if [[ $should_sudo == \"true\" ]]; then\n          sudo launchctl remove \"${service_label}\"\n        else\n          launchctl remove \"${service_label}\"\n        fi\n        sleep 1\n      fi\n\n      paths=(\n        \"/Library/LaunchAgents/${service_label}.plist\"\n        \"/Library/LaunchDaemons/${service_label}.plist\"\n      )\n\n      # if not using sudo, prepend the home directory to the paths\n      if [[ $should_sudo == \"false\" ]]; then\n        for i in \"${!paths[@]}\"; do\n          paths[i]=\"${HOME}${paths[i]}\"\n        done\n      fi\n\n      for path in \"${paths[@]}\"; do\n        if [[ -e \"$path\" ]]; then\n          if [[ $should_sudo == \"true\" ]]; then\n            sudo rm -f -- \"$path\"\n          else\n            rm -f -- \"$path\"\n          fi\n        fi\n      done\n    done\n  done\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_launchctl_service 'com.nordvpn.macos.teams'\nremove_launchctl_service 'com.nordvpn.macos.teams.assistant'\nremove_launchctl_service 'com.nordvpn.macos.teams.helper'\nquit_application 'com.nordvpn.macos.teams'\nremove_pkg_files 'com.nordvpn.macos.teams'\nforget_pkg 'com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/group.com.nordlayer.macos'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.nordvpn.macos.teams.sfl*'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Containers/com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Group Containers/group.com.nordlayer.macos'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.nordvpn.macos.teams.plist'\n"
+    "4ab665bb": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nquit_application() {\n  local bundle_id=\"$1\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nremove_launchctl_service() {\n  local service=\"$1\"\n  local booleans=(\"true\" \"false\")\n  local plist_status\n  local paths\n  local should_sudo\n\n  echo \"Removing launchctl service ${service}\"\n\n  # A wildcard label can't be used with launchctl or as a plist name, so expand\n  # it to the labels of currently loaded services that match the pattern.\n  local services=(\"$service\")\n  if [[ \"$service\" == *\"*\"* ]]; then\n    local regex\n    # Escape regex metacharacters, turn '*' into '.*', and anchor the pattern so\n    # it matches a full label rather than a substring.\n    regex=$(printf '%s' \"$service\" | sed -e 's/[][(){}.^$+?|\\\\]/\\\\&/g' -e 's/\\*/.*/g')\n    regex=\"^${regex}$\"\n    services=()\n    local id\n    # Match every loaded job by label regardless of PID; launchctl list reports\n    # loaded-but-not-running jobs with a \"-\" in the PID column.\n    while read -r _ _ id; do\n      [[ \"$id\" =~ $regex ]] && services+=(\"$id\")\n    done < <(launchctl list 2>/dev/null | tail -n +2)\n    if [[ ${#services[@]} -eq 0 ]]; then\n      echo \"No loaded launchctl service matches ${service}\"\n      return\n    fi\n  fi\n\n  local service_label\n  for service_label in \"${services[@]}\"; do\n    for should_sudo in \"${booleans[@]}\"; do\n      plist_status=$(launchctl list \"${service_label}\" 2>/dev/null)\n\n      if [[ $plist_status == \\{* ]]; then\n        if [[ $should_sudo == \"true\" ]]; then\n          sudo launchctl remove \"${service_label}\"\n        else\n          launchctl remove \"${service_label}\"\n        fi\n        sleep 1\n      fi\n\n      paths=(\n        \"/Library/LaunchAgents/${service_label}.plist\"\n        \"/Library/LaunchDaemons/${service_label}.plist\"\n      )\n\n      # if not using sudo, prepend the home directory to the paths\n      if [[ $should_sudo == \"false\" ]]; then\n        for i in \"${!paths[@]}\"; do\n          paths[i]=\"${HOME}${paths[i]}\"\n        done\n      fi\n\n      for path in \"${paths[@]}\"; do\n        if [[ -e \"$path\" ]]; then\n          if [[ $should_sudo == \"true\" ]]; then\n            sudo rm -f -- \"$path\"\n          else\n            rm -f -- \"$path\"\n          fi\n        fi\n      done\n    done\n  done\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_launchctl_service 'com.nordvpn.macos.teams'\nremove_launchctl_service 'com.nordvpn.macos.teams.assistant'\nremove_launchctl_service 'com.nordvpn.macos.teams.helper'\nquit_application 'com.nordvpn.macos.teams'\nremove_pkg_files 'com.nordvpn.macos.teams'\nforget_pkg 'com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/group.com.nordlayer.macos'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.nordvpn.macos.teams.sfl*'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Containers/com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Group Containers/group.com.nordlayer.macos'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.nordvpn.macos.teams'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.nordvpn.macos.teams.plist'\n",
+    "81cb71fe": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.nordvpn.macos.teams'\nsudo installer -pkg \"$TMPDIR/NordLayer_v3.12.1.pkg\" -target / || exit $?\nrelaunch_application 'com.nordvpn.macos.teams'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/okta-advanced-server-access/darwin.json b/ee/maintained-apps/outputs/okta-advanced-server-access/darwin.json
index 3b2085f6ffa..7058d93b219 100644
--- a/ee/maintained-apps/outputs/okta-advanced-server-access/darwin.json
+++ b/ee/maintained-apps/outputs/okta-advanced-server-access/darwin.json
@@ -1,23 +1,23 @@
 {
   "versions": [
     {
-      "version": "1.111.1",
+      "version": "1.112.0",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.scaleft.ScaleFT';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.scaleft.ScaleFT' AND version_compare(bundle_short_version, '1.111.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.scaleft.ScaleFT' AND version_compare(bundle_short_version, '1.112.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.scaleft.ScaleFT');"
       },
-      "installer_url": "https://dist.scaleft.com/repos/macos/stable/all/macos-client/v1.111.1/ScaleFT-1.111.1.pkg",
-      "install_script_ref": "da255dab",
+      "installer_url": "https://dist.scaleft.com/repos/macos/stable/all/macos-client/v1.112.0/ScaleFT-1.112.0.pkg",
+      "install_script_ref": "71ea34c4",
       "uninstall_script_ref": "a88f3d29",
-      "sha256": "07d24e61a5536bc0ec2b27f44b41fe9da77b6cc267c1990b57656172d54059bf",
+      "sha256": "7cc9092b382ed3f5d3111a2b07115d4d143ea8c93a7c575fcee452c763495bca",
       "default_categories": [
         "Developer tools"
       ]
     }
   ],
   "refs": {
-    "a88f3d29": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_pkg_files 'com.scaleft.ScaleFT'\nforget_pkg 'com.scaleft.ScaleFT'\ntrash $LOGGED_IN_USER '~/Library/Application Support/ScaleFT'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.scaleft.ScaleFT'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.scaleft.ScaleFT'\ntrash $LOGGED_IN_USER '~/Library/Logs/ScaleFT'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.scaleft.ScaleFT.plist'\n",
-    "da255dab": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.scaleft.ScaleFT'\nsudo installer -pkg \"$TMPDIR/ScaleFT-1.111.1.pkg\" -target / || exit $?\nrelaunch_application 'com.scaleft.ScaleFT'\n"
+    "71ea34c4": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.scaleft.ScaleFT'\nsudo installer -pkg \"$TMPDIR/ScaleFT-1.112.0.pkg\" -target / || exit $?\nrelaunch_application 'com.scaleft.ScaleFT'\n",
+    "a88f3d29": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_pkg_files 'com.scaleft.ScaleFT'\nforget_pkg 'com.scaleft.ScaleFT'\ntrash $LOGGED_IN_USER '~/Library/Application Support/ScaleFT'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.scaleft.ScaleFT'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.scaleft.ScaleFT'\ntrash $LOGGED_IN_USER '~/Library/Logs/ScaleFT'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.scaleft.ScaleFT.plist'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/okta-verify/darwin.json b/ee/maintained-apps/outputs/okta-verify/darwin.json
index d234ffbb8bd..c521e749047 100644
--- a/ee/maintained-apps/outputs/okta-verify/darwin.json
+++ b/ee/maintained-apps/outputs/okta-verify/darwin.json
@@ -1,23 +1,23 @@
 {
   "versions": [
     {
-      "version": "9.67.1",
+      "version": "9.69.0",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.okta.mobile';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.okta.mobile' AND version_compare(bundle_short_version, '9.67.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.okta.mobile' AND version_compare(bundle_short_version, '9.69.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.okta.mobile');"
       },
-      "installer_url": "https://okta.okta.com/artifacts/OKTA_VERIFY_MACOS/9.67.1/OktaVerify-9.67.1-6374-c501c62.pkg",
-      "install_script_ref": "379a35a1",
+      "installer_url": "https://okta.okta.com/artifacts/OKTA_VERIFY_MACOS/9.69.0/OktaVerify-9.69.0-6459-c4b02d9.pkg",
+      "install_script_ref": "4957c113",
       "uninstall_script_ref": "76730449",
-      "sha256": "f8bba964544cf9a3260eee3f234d4c675af8e53f55e7a69c00be5ce5c75fb967",
+      "sha256": "55e401165e9e2cb09596a83bac73e6df5c9451bc1bc7d34e60a66d0a24bca674",
       "default_categories": [
         "Productivity"
       ]
     }
   ],
   "refs": {
-    "379a35a1": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.okta.mobile'\nsudo installer -pkg \"$TMPDIR/OktaVerify-9.67.1-6374-c501c62.pkg\" -target / || exit $?\nrelaunch_application 'com.okta.mobile'\n",
+    "4957c113": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.okta.mobile'\nsudo installer -pkg \"$TMPDIR/OktaVerify-9.69.0-6459-c4b02d9.pkg\" -target / || exit $?\nrelaunch_application 'com.okta.mobile'\n",
     "76730449": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nremove_launchctl_service() {\n  local service=\"$1\"\n  local booleans=(\"true\" \"false\")\n  local plist_status\n  local paths\n  local should_sudo\n\n  echo \"Removing launchctl service ${service}\"\n\n  # A wildcard label can't be used with launchctl or as a plist name, so expand\n  # it to the labels of currently loaded services that match the pattern.\n  local services=(\"$service\")\n  if [[ \"$service\" == *\"*\"* ]]; then\n    local regex\n    # Escape regex metacharacters, turn '*' into '.*', and anchor the pattern so\n    # it matches a full label rather than a substring.\n    regex=$(printf '%s' \"$service\" | sed -e 's/[][(){}.^$+?|\\\\]/\\\\&/g' -e 's/\\*/.*/g')\n    regex=\"^${regex}$\"\n    services=()\n    local id\n    # Match every loaded job by label regardless of PID; launchctl list reports\n    # loaded-but-not-running jobs with a \"-\" in the PID column.\n    while read -r _ _ id; do\n      [[ \"$id\" =~ $regex ]] && services+=(\"$id\")\n    done < <(launchctl list 2>/dev/null | tail -n +2)\n    if [[ ${#services[@]} -eq 0 ]]; then\n      echo \"No loaded launchctl service matches ${service}\"\n      return\n    fi\n  fi\n\n  local service_label\n  for service_label in \"${services[@]}\"; do\n    for should_sudo in \"${booleans[@]}\"; do\n      plist_status=$(launchctl list \"${service_label}\" 2>/dev/null)\n\n      if [[ $plist_status == \\{* ]]; then\n        if [[ $should_sudo == \"true\" ]]; then\n          sudo launchctl remove \"${service_label}\"\n        else\n          launchctl remove \"${service_label}\"\n        fi\n        sleep 1\n      fi\n\n      paths=(\n        \"/Library/LaunchAgents/${service_label}.plist\"\n        \"/Library/LaunchDaemons/${service_label}.plist\"\n      )\n\n      # if not using sudo, prepend the home directory to the paths\n      if [[ $should_sudo == \"false\" ]]; then\n        for i in \"${!paths[@]}\"; do\n          paths[i]=\"${HOME}${paths[i]}\"\n        done\n      fi\n\n      for path in \"${paths[@]}\"; do\n        if [[ -e \"$path\" ]]; then\n          if [[ $should_sudo == \"true\" ]]; then\n            sudo rm -f -- \"$path\"\n          else\n            rm -f -- \"$path\"\n          fi\n        fi\n      done\n    done\n  done\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_launchctl_service 'com.okta.authentication.service'\nremove_launchctl_service 'com.okta.autoupdate.daemon'\nremove_launchctl_service 'com.okta.deviceaccess.servicedaemon'\nremove_pkg_files 'com.okta.mobile'\nforget_pkg 'com.okta.mobile'\nsudo rm -rf '/Applications/Okta Verify.app'\nsudo rm -rf '/Library/Application Support/com.okta.deviceaccess.servicedaemon'\nsudo rm -rf '/Library/LaunchDaemons/com.okta.authentication.service.plist'\nsudo rm -rf '/Library/LaunchDaemons/com.okta.autoupdate.daemon.plist'\nsudo rm -rf '/Library/LaunchDaemons/com.okta.deviceaccess.servicedaemon.plist'\nsudo rm -rf '/Library/Security/SecurityAgentPlugins/OktaDAAuthPlugin.bundle'\nsudo rm -rf '/usr/local/bin/AutoUpdateDaemon'\nsudo rm -rf '/usr/local/bin/OktaDAServiceDaemon'\ntrash $LOGGED_IN_USER '~/Library/Containers/com.okta.mobile'\ntrash $LOGGED_IN_USER '~/Library/Preferences/B7F62B65BN.group.okta.verify.shared.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.okta.mobile.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/group.com.okta.mobile.firebase.plist'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/onedrive/windows.json b/ee/maintained-apps/outputs/onedrive/windows.json
index bc6ccd031f9..9035c08bee3 100644
--- a/ee/maintained-apps/outputs/onedrive/windows.json
+++ b/ee/maintained-apps/outputs/onedrive/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "26.129.0706.0004",
+      "version": "26.134.0713.0007",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'Microsoft OneDrive' AND publisher = 'Microsoft Corporation';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Microsoft OneDrive' AND publisher = 'Microsoft Corporation' AND version_compare(version, '26.129.0706.0004') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Microsoft OneDrive' AND publisher = 'Microsoft Corporation' AND version_compare(version, '26.134.0713.0007') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) LIKE 'onedrive%');"
       },
-      "installer_url": "https://oneclient.sfx.ms/Win/Installers/26.129.0706.0004/amd64/OneDriveSetup.exe",
+      "installer_url": "https://oneclient.sfx.ms/Win/Installers/26.134.0713.0007/amd64/OneDriveSetup.exe",
       "install_script_ref": "6e4f072f",
       "uninstall_script_ref": "374be511",
-      "sha256": "8fa27c88c31666457837794c64237d5b2216ca96c8f03ca154dc8dc2d9979578",
+      "sha256": "1b9aa2adacc8dfd26fb888c9ce5cb63806868166ea61bfe71be7a74760c361cc",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/pastebot/darwin.json b/ee/maintained-apps/outputs/pastebot/darwin.json
index 9541a741f7b..1968187a458 100644
--- a/ee/maintained-apps/outputs/pastebot/darwin.json
+++ b/ee/maintained-apps/outputs/pastebot/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "3.1",
+      "version": "3.1.1",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.tapbots.Pastebot2Mac';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.tapbots.Pastebot2Mac' AND version_compare(bundle_short_version, '3.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.tapbots.Pastebot2Mac' AND version_compare(bundle_short_version, '3.1.1') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.tapbots.Pastebot2Mac');"
       },
-      "installer_url": "https://tapbots.net/pastebot3/Pastebot.31000.dmg",
+      "installer_url": "https://tapbots.net/pastebot3/Pastebot.31100.dmg",
       "install_script_ref": "0c5e941b",
       "uninstall_script_ref": "85f0a84b",
-      "sha256": "7142a6644756cde5c7cca2b83585c13225cc0756ad2a3bc020ea2dbace85cd02",
+      "sha256": "0480a08259564dce5e6c580511c01c25670040df1cca6021ad0970c2e9fbc23c",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/postman/darwin.json b/ee/maintained-apps/outputs/postman/darwin.json
index ab18d882a21..9d50fbee4d5 100644
--- a/ee/maintained-apps/outputs/postman/darwin.json
+++ b/ee/maintained-apps/outputs/postman/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "12.25.2",
+      "version": "12.25.3",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.postmanlabs.mac';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.postmanlabs.mac' AND version_compare(bundle_short_version, '12.25.2') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.postmanlabs.mac' AND version_compare(bundle_short_version, '12.25.3') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.postmanlabs.mac');"
       },
-      "installer_url": "https://dl.pstmn.io/download/version/12.25.2/osx_arm64",
+      "installer_url": "https://dl.pstmn.io/download/version/12.25.3/osx_arm64",
       "install_script_ref": "0e85ef74",
       "uninstall_script_ref": "727f8e9d",
-      "sha256": "23dd1b4200843fd6b6dd299a6197f7937c3b14c827414ec12e863e7daa37dfd7",
+      "sha256": "9f44bc3cc642d8732ea08f6d891ca6d5a465b8b9a192fc938b5c2e76b5ba7cf9",
       "default_categories": [
         "Developer tools"
       ]
diff --git a/ee/maintained-apps/outputs/postman/windows.json b/ee/maintained-apps/outputs/postman/windows.json
index d223787dd1c..773ad317da0 100644
--- a/ee/maintained-apps/outputs/postman/windows.json
+++ b/ee/maintained-apps/outputs/postman/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "12.24.6",
+      "version": "12.25.3",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name LIKE 'Postman x64 %' AND publisher = 'Postman';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name LIKE 'Postman x64 %' AND publisher = 'Postman' AND version_compare(version, '12.24.6') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name LIKE 'Postman x64 %' AND publisher = 'Postman' AND version_compare(version, '12.25.3') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'postman.exe');"
       },
-      "installer_url": "https://dl.pstmn.io/download/version/12.24.6/windows_64",
+      "installer_url": "https://dl.pstmn.io/download/version/12.25.3/windows_64",
       "install_script_ref": "8594f0bc",
       "uninstall_script_ref": "fd59d029",
-      "sha256": "86746099bb2619e8db66f4016cfbe04e7009dee3f1259b504c5dc33d7981316c",
+      "sha256": "18f8f1180126a4e2c4bad48bd841dac6ce33be861abdafe24fcecf932c07d466",
       "default_categories": [
         "Developer tools"
       ]
diff --git a/ee/maintained-apps/outputs/prisma-browser/windows.json b/ee/maintained-apps/outputs/prisma-browser/windows.json
index 037404267d8..6be5a858a48 100644
--- a/ee/maintained-apps/outputs/prisma-browser/windows.json
+++ b/ee/maintained-apps/outputs/prisma-browser/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "151.26.5.170",
+      "version": "151.26.6.174",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'Prisma Access Browser' AND publisher = 'Palo Alto Networks Inc';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Prisma Access Browser' AND publisher = 'Palo Alto Networks Inc' AND version_compare(version, '151.26.5.170') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Prisma Access Browser' AND publisher = 'Palo Alto Networks Inc' AND version_compare(version, '151.26.6.174') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'prisma browser.exe');"
       },
-      "installer_url": "https://updates.talon-sec.com/releases/Prisma%20Access%20Browser/win/packaged/x64/crx_signed_o4_stable_prisma_access_browser_installer_151_26_5_170-151.26.5.170-c662c0b2.msi",
+      "installer_url": "https://updates.talon-sec.com/releases/Prisma%20Access%20Browser/win/packaged/x64/crx_signed_o4_stable_prisma_access_browser_installer_151_26_6_174-151.26.6.174-13bd7be3.msi",
       "install_script_ref": "22e48c46",
       "uninstall_script_ref": "84194ed8",
-      "sha256": "a96bab454559fdf5748ec84532f153f8c17c991addfdbf2336e86fec04a1e215",
+      "sha256": "ebfea978650a57fd71eb03c715713884f5b60bf995d5977fd5f33172888cdc1b",
       "default_categories": [
         "Browsers"
       ],
diff --git a/ee/maintained-apps/outputs/rectangle/darwin.json b/ee/maintained-apps/outputs/rectangle/darwin.json
index bd86a529929..945f2d243fc 100644
--- a/ee/maintained-apps/outputs/rectangle/darwin.json
+++ b/ee/maintained-apps/outputs/rectangle/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "0.99",
+      "version": "1.100",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.knollsoft.Rectangle';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.knollsoft.Rectangle' AND version_compare(bundle_short_version, '0.99') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.knollsoft.Rectangle' AND version_compare(bundle_short_version, '1.100') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.knollsoft.Rectangle');"
       },
-      "installer_url": "https://github.com/rxhanson/Rectangle/releases/download/v0.99/Rectangle0.99.dmg",
+      "installer_url": "https://github.com/rxhanson/Rectangle/releases/download/v1.100/Rectangle1.100.dmg",
       "install_script_ref": "aba57348",
       "uninstall_script_ref": "c688569b",
-      "sha256": "d4eddd21f5b249df95b6f7738ced4b09e9894d7fea84fe543a80688395ce5bb9",
+      "sha256": "5cfbe9b68a558458302c5305cb7060491f68029338e2a4561c54a2981eb8622f",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/remote-desktop-manager/windows.json b/ee/maintained-apps/outputs/remote-desktop-manager/windows.json
index fdd6567c178..35ef4fd00e8 100644
--- a/ee/maintained-apps/outputs/remote-desktop-manager/windows.json
+++ b/ee/maintained-apps/outputs/remote-desktop-manager/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "2026.2.17.0",
+      "version": "2026.2.18.0",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'Remote Desktop Manager' AND publisher = 'Devolutions inc.';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Remote Desktop Manager' AND publisher = 'Devolutions inc.' AND version_compare(version, '2026.2.17.0') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Remote Desktop Manager' AND publisher = 'Devolutions inc.' AND version_compare(version, '2026.2.18.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'remote desktop manager.exe');"
       },
-      "installer_url": "https://cdn.devolutions.net/download/Setup.RemoteDesktopManager.win-x64.2026.2.17.0.msi",
+      "installer_url": "https://cdn.devolutions.net/download/Setup.RemoteDesktopManager.win-x64.2026.2.18.0.msi",
       "install_script_ref": "22e48c46",
       "uninstall_script_ref": "df5e7f6c",
-      "sha256": "1cf7042ab9a46b1a3dfcffd57694f2dcea233ff27d030ec9139a21904dba8d1c",
+      "sha256": "939f55adc51a86d1757380de23fc442dcf310300935a0a737c4347fc2eea8882",
       "default_categories": [
         "Productivity"
       ],
diff --git a/ee/maintained-apps/outputs/rstudio/windows.json b/ee/maintained-apps/outputs/rstudio/windows.json
index 92a7e56b220..9e6ad59750c 100644
--- a/ee/maintained-apps/outputs/rstudio/windows.json
+++ b/ee/maintained-apps/outputs/rstudio/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "2026.07.1+147",
+      "version": "2026.08.1+195",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'RStudio' AND publisher = 'Posit Software';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'RStudio' AND publisher = 'Posit Software' AND version_compare(version, '2026.07.1+147') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'RStudio' AND publisher = 'Posit Software' AND version_compare(version, '2026.08.1+195') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) IN ('rgui.exe','rsession.exe','rstudio.exe'));"
       },
-      "installer_url": "https://download1.rstudio.org/electron/windows/RStudio-2026.07.1-147.exe",
+      "installer_url": "https://download1.rstudio.org/electron/windows/RStudio-2026.08.1-195.exe",
       "install_script_ref": "85f22f37",
       "uninstall_script_ref": "d294a15f",
-      "sha256": "6c22bd2cf2af0af4365e74dd0f84573d30385a3b6fe0afa8c112fa34ff408d1b",
+      "sha256": "b867e71732ca89c5fe5de8b3f6a1b038e2a8545e4a8083c381fb12362fc81480",
       "default_categories": [
         "Developer tools"
       ]
diff --git a/ee/maintained-apps/outputs/sabnzbd/darwin.json b/ee/maintained-apps/outputs/sabnzbd/darwin.json
index 06af56affe3..2dd13b828f9 100644
--- a/ee/maintained-apps/outputs/sabnzbd/darwin.json
+++ b/ee/maintained-apps/outputs/sabnzbd/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "5.1.1",
+      "version": "5.1.2",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'org.sabnzbd.sabnzbd';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.sabnzbd.sabnzbd' AND version_compare(bundle_short_version, '5.1.1') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.sabnzbd.sabnzbd' AND version_compare(bundle_short_version, '5.1.2') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'org.sabnzbd.sabnzbd');"
       },
-      "installer_url": "https://github.com/sabnzbd/sabnzbd/releases/download/5.1.1/SABnzbd-5.1.1-macos.dmg",
+      "installer_url": "https://github.com/sabnzbd/sabnzbd/releases/download/5.1.2/SABnzbd-5.1.2-macos.dmg",
       "install_script_ref": "cef073f6",
       "uninstall_script_ref": "8b107d86",
-      "sha256": "8014480e30488a8686861fe4dc57bce121a9726a7ca5acbb0329c2381e73b572",
+      "sha256": "5b8db477635e7d165fd11ec122775182838258b02882349ec3534f655ad0a7f9",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/sharefile/darwin.json b/ee/maintained-apps/outputs/sharefile/darwin.json
index ac49099e994..f357ec3990a 100644
--- a/ee/maintained-apps/outputs/sharefile/darwin.json
+++ b/ee/maintained-apps/outputs/sharefile/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "26.04.20",
+      "version": "26.08.06",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.citrixfiles.ens.service';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.citrixfiles.ens.service' AND version_compare(bundle_short_version, '26.04.20') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.citrixfiles.ens.service' AND version_compare(bundle_short_version, '26.08.06') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.citrixfiles.ens.service');"
       },
-      "installer_url": "https://dl.sharefile.com/sfmac/ShareFile%20v26.04.20%20(20p795).dmg",
+      "installer_url": "https://dl.sharefile.com/sfmac/ShareFile%20v26.08.06%20(06p1008).dmg",
       "install_script_ref": "8d1fd500",
       "uninstall_script_ref": "6491cbe3",
-      "sha256": "079ab663c401f30e7a77fe243c320424c805acad642ccfc9325934866ac2f2f3",
+      "sha256": "15239d2dfd790f312aceeaa4aee9e03831e78bd852c96409683b942f3d7f64a0",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/sqlpro-for-postgres/darwin.json b/ee/maintained-apps/outputs/sqlpro-for-postgres/darwin.json
index 82e82d3edbf..e1b869fdbdb 100644
--- a/ee/maintained-apps/outputs/sqlpro-for-postgres/darwin.json
+++ b/ee/maintained-apps/outputs/sqlpro-for-postgres/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "2026.87",
+      "version": "2026.237",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.hankinsoft.osx.SQLProPostgres';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.hankinsoft.osx.SQLProPostgres' AND version_compare(bundle_short_version, '2026.87') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.hankinsoft.osx.SQLProPostgres' AND version_compare(bundle_short_version, '2026.237') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.hankinsoft.osx.SQLProPostgres');"
       },
-      "installer_url": "https://d3fwkemdw8spx3.cloudfront.net/postgres/SQLProPostgres.2026.87.app.zip",
+      "installer_url": "https://d3fwkemdw8spx3.cloudfront.net/postgres/SQLProPostgres.2026.237.app.zip",
       "install_script_ref": "d3880107",
       "uninstall_script_ref": "30800749",
-      "sha256": "7ff27ebd25497da5015249f6d3ceb0b84b2369fda513781b857d54786f4c562a",
+      "sha256": "8f0508864efec61e005003e87b2ba78bb07ffac16e66a35b1efb94178c502b69",
       "default_categories": [
         "Developer tools"
       ]
diff --git a/ee/maintained-apps/outputs/superhuman/darwin.json b/ee/maintained-apps/outputs/superhuman/darwin.json
index 9d7c6df5651..a6b5efc6dea 100644
--- a/ee/maintained-apps/outputs/superhuman/darwin.json
+++ b/ee/maintained-apps/outputs/superhuman/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "1041.0.34",
+      "version": "1041.0.35",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.superhuman.mail';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.superhuman.mail' AND version_compare(bundle_short_version, '1041.0.34') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.superhuman.mail' AND version_compare(bundle_short_version, '1041.0.35') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.superhuman.mail');"
       },
-      "installer_url": "https://storage.googleapis.com/download.superhuman.com/supertron-update/Superhuman-1041.0.34-arm64-latest-mac.zip",
+      "installer_url": "https://storage.googleapis.com/download.superhuman.com/supertron-update/Superhuman-1041.0.35-arm64-latest-mac.zip",
       "install_script_ref": "7e74bd96",
       "uninstall_script_ref": "1809183d",
-      "sha256": "7d85bebeedf2c779ee25e156a33641b662a78644a35492630274a0927e0d8192",
+      "sha256": "93ca788108469c6d1e8fa106f8298a6ec0129b7b33b2be555ce322c6eb9ade12",
       "default_categories": [
         "Communication"
       ]
diff --git a/ee/maintained-apps/outputs/tailscale/windows.json b/ee/maintained-apps/outputs/tailscale/windows.json
index 7edf01d9879..50c502bb654 100644
--- a/ee/maintained-apps/outputs/tailscale/windows.json
+++ b/ee/maintained-apps/outputs/tailscale/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "1.102.2",
+      "version": "1.102.3",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'Tailscale' AND publisher = 'Tailscale Inc.';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Tailscale' AND publisher = 'Tailscale Inc.' AND version_compare(version, '1.102.2') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Tailscale' AND publisher = 'Tailscale Inc.' AND version_compare(version, '1.102.3') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'tailscale.exe');"
       },
-      "installer_url": "https://pkgs.tailscale.com/stable/tailscale-setup-1.102.2-amd64.msi",
+      "installer_url": "https://pkgs.tailscale.com/stable/tailscale-setup-1.102.3-amd64.msi",
       "install_script_ref": "22e48c46",
       "uninstall_script_ref": "b665a7bd",
-      "sha256": "d2eb69e103b08a5b77de9d7cb8555541aa99f7dfc6048850b2286a1048c885f9",
+      "sha256": "03ac8183c6e3ce276e9b44281ebe7e4c02aef28a971034ca170c4b665df42dce",
       "default_categories": [
         "Productivity"
       ],
diff --git a/ee/maintained-apps/outputs/teamviewer-host/windows.json b/ee/maintained-apps/outputs/teamviewer-host/windows.json
index ef751ec1df2..8b92057564f 100644
--- a/ee/maintained-apps/outputs/teamviewer-host/windows.json
+++ b/ee/maintained-apps/outputs/teamviewer-host/windows.json
@@ -1,10 +1,10 @@
 {
   "versions": [
     {
-      "version": "15.80.6",
+      "version": "15.64.7",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'TeamViewer Host' AND publisher = 'TeamViewer';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'TeamViewer Host' AND publisher = 'TeamViewer' AND version_compare(version, '15.80.6') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'TeamViewer Host' AND publisher = 'TeamViewer' AND version_compare(version, '15.64.7') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'teamviewer host.exe');"
       },
       "installer_url": "https://download.teamviewer.com/download/version_15x/TeamViewer_Host_Setup_x64.exe",
diff --git a/ee/maintained-apps/outputs/teamviewer/windows.json b/ee/maintained-apps/outputs/teamviewer/windows.json
index 0b2cc0033ff..a8d1f2f5072 100644
--- a/ee/maintained-apps/outputs/teamviewer/windows.json
+++ b/ee/maintained-apps/outputs/teamviewer/windows.json
@@ -1,13 +1,13 @@
 {
   "versions": [
     {
-      "version": "15.80.6",
+      "version": "15.81.5",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'TeamViewer' AND publisher = 'TeamViewer';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'TeamViewer' AND publisher = 'TeamViewer' AND version_compare(version, '15.80.6') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'TeamViewer' AND publisher = 'TeamViewer' AND version_compare(version, '15.81.5') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'teamviewer.exe');"
       },
-      "installer_url": "https://download.teamviewer.com/download/version_15x/TeamViewer_Setup_x64_15.80.6.exe",
+      "installer_url": "https://download.teamviewer.com/download/version_15x/TeamViewer_Setup_x64_15.81.5.exe",
       "install_script_ref": "45f422bf",
       "uninstall_script_ref": "390c83e7",
       "sha256": "no_check",
diff --git a/ee/maintained-apps/outputs/teleport-connect/darwin.json b/ee/maintained-apps/outputs/teleport-connect/darwin.json
index 282c557ef6e..bd7f2219b03 100644
--- a/ee/maintained-apps/outputs/teleport-connect/darwin.json
+++ b/ee/maintained-apps/outputs/teleport-connect/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "18.10.7",
+      "version": "18.11.0",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'gravitational.teleport.connect';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'gravitational.teleport.connect' AND version_compare(bundle_short_version, '18.10.7') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'gravitational.teleport.connect' AND version_compare(bundle_short_version, '18.11.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'gravitational.teleport.connect');"
       },
-      "installer_url": "https://cdn.teleport.dev/Teleport%20Connect-18.10.7.dmg",
+      "installer_url": "https://cdn.teleport.dev/Teleport%20Connect-18.11.0.dmg",
       "install_script_ref": "91382f33",
       "uninstall_script_ref": "b650487b",
-      "sha256": "dfbbb3a04189e6cbfd02c1ba256a8a62cff03c913f0fec177d2979b32f3fd4c1",
+      "sha256": "f376f69c709d799aa8bc59c62d886ca1972fb4031ffb77e90ff2af1f1be730ef",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/teleport-connect/windows.json b/ee/maintained-apps/outputs/teleport-connect/windows.json
index e72f0c097a4..07ea764313b 100644
--- a/ee/maintained-apps/outputs/teleport-connect/windows.json
+++ b/ee/maintained-apps/outputs/teleport-connect/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "18.10.6",
+      "version": "18.10.7",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name LIKE 'Teleport Connect %' AND publisher = 'Gravitational, Inc.';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name LIKE 'Teleport Connect %' AND publisher = 'Gravitational, Inc.' AND version_compare(version, '18.10.6') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name LIKE 'Teleport Connect %' AND publisher = 'Gravitational, Inc.' AND version_compare(version, '18.10.7') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'teleport connect.exe');"
       },
-      "installer_url": "https://cdn.teleport.dev/Teleport%20Connect%20Setup-18.10.6.exe",
+      "installer_url": "https://cdn.teleport.dev/Teleport%20Connect%20Setup-18.10.7.exe",
       "install_script_ref": "5203db2b",
       "uninstall_script_ref": "df260b5b",
-      "sha256": "cb9ef4005f9a9ed4157a5580f0c6ea6e63db24c5ec547dc74cf093b0490d4ab0",
+      "sha256": "c17d6e2b0ab6d1386dff7fb3c62d1acf7e57b873361c5beb3cba21e7b034df11",
       "default_categories": [
         "Productivity"
       ]
diff --git a/ee/maintained-apps/outputs/teleport-suite/darwin.json b/ee/maintained-apps/outputs/teleport-suite/darwin.json
index 6e757dcf4fb..6c0c3f77e5e 100644
--- a/ee/maintained-apps/outputs/teleport-suite/darwin.json
+++ b/ee/maintained-apps/outputs/teleport-suite/darwin.json
@@ -1,23 +1,23 @@
 {
   "versions": [
     {
-      "version": "18.10.7",
+      "version": "18.11.0",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.gravitational.teleport.tsh';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.gravitational.teleport.tsh' AND version_compare(bundle_short_version, '18.10.7') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.gravitational.teleport.tsh' AND version_compare(bundle_short_version, '18.11.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.gravitational.teleport.tsh');"
       },
-      "installer_url": "https://cdn.teleport.dev/teleport-18.10.7.pkg",
-      "install_script_ref": "1620f9a9",
+      "installer_url": "https://cdn.teleport.dev/teleport-18.11.0.pkg",
+      "install_script_ref": "7aa067b1",
       "uninstall_script_ref": "343cb8f4",
-      "sha256": "caa611e2c00a589ccdde3c2fe37765a8a1ed48af20a5f0c4129192b00da8dcf0",
+      "sha256": "2034eef9147b1b25c7555db5eb8ce261a816302f9ca23b0a2bd14c0245b2908f",
       "default_categories": [
         "Developer tools"
       ]
     }
   ],
   "refs": {
-    "1620f9a9": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.gravitational.teleport.tsh'\nsudo installer -pkg \"$TMPDIR/teleport-18.10.7.pkg\" -target / || exit $?\nrelaunch_application 'com.gravitational.teleport.tsh'\n",
-    "343cb8f4": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    # Convert (.*) to .* for regex matching to handle patterns like (.*).com.example.app\n    local regex_pattern=$(echo \"$prefix\" | sed 's/(\\.\\*)/.*/g')\n    echo \"Expanding wildcard for PKGID: $PKGID (pattern: ^${regex_pattern})\"\n    for receipt in $(pkgutil --pkgs | grep -E \"^${regex_pattern}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\n# Remove teleport-suite packages (handles wildcard patterns with (.*))\nremove_pkg_files '(.*).com.gravitational.teleport.tctl'\nforget_pkg '(.*).com.gravitational.teleport.tctl'\nremove_pkg_files '(.*).com.gravitational.teleport.tsh'\nforget_pkg '(.*).com.gravitational.teleport.tsh'\nremove_pkg_files 'com.gravitational.teleport'\nforget_pkg 'com.gravitational.teleport'\n\n# Explicitly remove apps from /Applications (in case pkgutil removal didn't catch them)\nsudo rm -rf '/Applications/tctl.app'\nsudo rm -rf '/Applications/tsh.app'\n\n# Remove binaries\nsudo rm -rf '/usr/local/bin/fdpass-teleport'\nsudo rm -rf '/usr/local/bin/tbot'\nsudo rm -rf '/usr/local/bin/tctl'\nsudo rm -rf '/usr/local/bin/teleport'\nsudo rm -rf '/usr/local/bin/tsh'\n\n# Remove user data\ntrash $LOGGED_IN_USER '~/.tsh'\n\n"
+    "343cb8f4": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    # Convert (.*) to .* for regex matching to handle patterns like (.*).com.example.app\n    local regex_pattern=$(echo \"$prefix\" | sed 's/(\\.\\*)/.*/g')\n    echo \"Expanding wildcard for PKGID: $PKGID (pattern: ^${regex_pattern})\"\n    for receipt in $(pkgutil --pkgs | grep -E \"^${regex_pattern}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\n# Remove teleport-suite packages (handles wildcard patterns with (.*))\nremove_pkg_files '(.*).com.gravitational.teleport.tctl'\nforget_pkg '(.*).com.gravitational.teleport.tctl'\nremove_pkg_files '(.*).com.gravitational.teleport.tsh'\nforget_pkg '(.*).com.gravitational.teleport.tsh'\nremove_pkg_files 'com.gravitational.teleport'\nforget_pkg 'com.gravitational.teleport'\n\n# Explicitly remove apps from /Applications (in case pkgutil removal didn't catch them)\nsudo rm -rf '/Applications/tctl.app'\nsudo rm -rf '/Applications/tsh.app'\n\n# Remove binaries\nsudo rm -rf '/usr/local/bin/fdpass-teleport'\nsudo rm -rf '/usr/local/bin/tbot'\nsudo rm -rf '/usr/local/bin/tctl'\nsudo rm -rf '/usr/local/bin/teleport'\nsudo rm -rf '/usr/local/bin/tsh'\n\n# Remove user data\ntrash $LOGGED_IN_USER '~/.tsh'\n\n",
+    "7aa067b1": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.gravitational.teleport.tsh'\nsudo installer -pkg \"$TMPDIR/teleport-18.11.0.pkg\" -target / || exit $?\nrelaunch_application 'com.gravitational.teleport.tsh'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/vpn-tracker-365/darwin.json b/ee/maintained-apps/outputs/vpn-tracker-365/darwin.json
index bc3d993adb1..fd357d03bc3 100644
--- a/ee/maintained-apps/outputs/vpn-tracker-365/darwin.json
+++ b/ee/maintained-apps/outputs/vpn-tracker-365/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "26.7",
+      "version": "26.8",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.equinux.VPNTracker365';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.equinux.VPNTracker365' AND version_compare(bundle_short_version, '26.7') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.equinux.VPNTracker365' AND version_compare(bundle_short_version, '26.8') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.equinux.VPNTracker365');"
       },
-      "installer_url": "https://download.equinux.com/files/other/VPN%20Tracker%20365%20-%2026.7.23.zip",
+      "installer_url": "https://download.equinux.com/files/other/VPN%20Tracker%20365%20-%2026.8.122.zip",
       "install_script_ref": "72c70dd7",
       "uninstall_script_ref": "27f1845a",
-      "sha256": "97281d2a34d96bf56c61f7dbe3beb9e84152d43c3cdaeaa84333bd405a3613d7",
+      "sha256": "579203c310c3997687789793832b32f7ff969f72d489decf0585537dd615be19",
       "default_categories": [
         "Security"
       ]
diff --git a/ee/maintained-apps/outputs/weasis/darwin.json b/ee/maintained-apps/outputs/weasis/darwin.json
index 019f8690a11..c866f55ad1d 100644
--- a/ee/maintained-apps/outputs/weasis/darwin.json
+++ b/ee/maintained-apps/outputs/weasis/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "4.7.2",
+      "version": "4.7.3",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'org.weasis.launcher';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.weasis.launcher' AND version_compare(bundle_short_version, '4.7.2') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'org.weasis.launcher' AND version_compare(bundle_short_version, '4.7.3') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'org.weasis.launcher');"
       },
-      "installer_url": "https://github.com/nroduit/Weasis/releases/download/v4.7.2/Weasis-4.7.2-aarch64.pkg",
-      "install_script_ref": "61706202",
+      "installer_url": "https://github.com/nroduit/Weasis/releases/download/v4.7.3/Weasis-4.7.3-aarch64.pkg",
+      "install_script_ref": "e3f4f906",
       "uninstall_script_ref": "4ca4d644",
-      "sha256": "14ac25390574168da11596a2dd02f79ef9c56b5398c3fbb95d64c73ff58e23aa",
+      "sha256": "5dc395a35390798bc8c9174c00afe968fce29c2845d248f9fa08e90e437a1ba7",
       "default_categories": [
         "Productivity"
       ]
@@ -18,6 +18,6 @@
   ],
   "refs": {
     "4ca4d644": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_pkg_files 'org.weasis.launcher'\nforget_pkg 'org.weasis.launcher'\nremove_pkg_files 'org.weasis.viewer'\nforget_pkg 'org.weasis.viewer'\nsudo rm -rf '/Applications/Weasis.app'\ntrash $LOGGED_IN_USER '~/.weasis'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/org.weasis.launcher.savedState'\n",
-    "61706202": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'org.weasis.launcher'\nsudo installer -pkg \"$TMPDIR/Weasis-4.7.2-aarch64.pkg\" -target / || exit $?\nrelaunch_application 'org.weasis.launcher'\n"
+    "e3f4f906": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'org.weasis.launcher'\nsudo installer -pkg \"$TMPDIR/Weasis-4.7.3-aarch64.pkg\" -target / || exit $?\nrelaunch_application 'org.weasis.launcher'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/weasis/windows.json b/ee/maintained-apps/outputs/weasis/windows.json
index 86dca134829..22d4e9f39a4 100644
--- a/ee/maintained-apps/outputs/weasis/windows.json
+++ b/ee/maintained-apps/outputs/weasis/windows.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "4.7.2",
+      "version": "4.7.3",
       "queries": {
         "exists": "SELECT 1 FROM programs WHERE name = 'Weasis' AND publisher = 'Weasis Team';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Weasis' AND publisher = 'Weasis Team' AND version_compare(version, '4.7.2') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Weasis' AND publisher = 'Weasis Team' AND version_compare(version, '4.7.3') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'weasis.exe');"
       },
-      "installer_url": "https://github.com/nroduit/Weasis/releases/download/v4.7.2/Weasis-4.7.2-x86-64.msi",
+      "installer_url": "https://github.com/nroduit/Weasis/releases/download/v4.7.3/Weasis-4.7.3-x86-64.msi",
       "install_script_ref": "22e48c46",
       "uninstall_script_ref": "0130a935",
-      "sha256": "1f2ccff3975efc31320479690957460c8f6849fa75e2dc69ab4f4f828e014171",
+      "sha256": "c15358f95b79d936dd908ebd9afeebbce90bd463a9ba97aeda5edcfb78712f1c",
       "default_categories": [
         "Productivity"
       ],
diff --git a/ee/maintained-apps/outputs/whatsapp/darwin.json b/ee/maintained-apps/outputs/whatsapp/darwin.json
index 49f2f675338..1b51dc5911c 100644
--- a/ee/maintained-apps/outputs/whatsapp/darwin.json
+++ b/ee/maintained-apps/outputs/whatsapp/darwin.json
@@ -1,10 +1,10 @@
 {
   "versions": [
     {
-      "version": "26.34.12",
+      "version": "26.34.15",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'net.whatsapp.WhatsApp';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'net.whatsapp.WhatsApp' AND version_compare(bundle_short_version, '26.34.12') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'net.whatsapp.WhatsApp' AND version_compare(bundle_short_version, '26.34.15') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'net.whatsapp.WhatsApp');"
       },
       "installer_url": "https://web.whatsapp.com/desktop/mac_native/release/?configuration=Release&src=whatsapp_downloads_page",
diff --git a/ee/maintained-apps/outputs/windows-app/darwin.json b/ee/maintained-apps/outputs/windows-app/darwin.json
index 8b5137b1a48..d13306bc796 100644
--- a/ee/maintained-apps/outputs/windows-app/darwin.json
+++ b/ee/maintained-apps/outputs/windows-app/darwin.json
@@ -1,23 +1,23 @@
 {
   "versions": [
     {
-      "version": "11.3.9",
+      "version": "11.4.0",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.rdc.macos';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.rdc.macos' AND version_compare(bundle_short_version, '11.3.9') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.rdc.macos' AND version_compare(bundle_short_version, '11.4.0') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.microsoft.rdc.macos');"
       },
-      "installer_url": "https://res.public.onecdn.static.microsoft/mro1cdnstorage/C1297A47-86C4-4C1F-97FA-950631F94777/MacAutoupdate/Windows_App_11.3.9_installer.pkg",
-      "install_script_ref": "10ae8fa7",
+      "installer_url": "https://res.public.onecdn.static.microsoft/mro1cdnstorage/C1297A47-86C4-4C1F-97FA-950631F94777/MacAutoupdate/Windows_App_11.4.0_installer.pkg",
+      "install_script_ref": "cec1d345",
       "uninstall_script_ref": "a580bda5",
-      "sha256": "40202478c16a670dd8c472e07a66e42f7cc88b1834a945830efdffde69a8949c",
+      "sha256": "bdc7ccf2914960074d8eaeaa0b3661127bb3a29291f6832ab7dfdadf70c4171a",
       "default_categories": [
         "Productivity"
       ]
     }
   ],
   "refs": {
-    "10ae8fa7": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.microsoft.rdc.macos'\n\nCHOICE_XML=$(mktemp /tmp/choice_xml_XXX)\n\ncat << EOF > \"$CHOICE_XML\"\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<array>\n  <dict>\n    <key>attributeSetting</key>\n    <integer>0</integer>\n    <key>choiceAttribute</key>\n    <string>selected</string>\n    <key>choiceIdentifier</key>\n    <string>com.microsoft.autoupdate</string>\n  </dict>\n</array>\n</plist>\n\nEOF\n\nsudo installer -pkg \"$TMPDIR/Windows_App_11.3.9_installer.pkg\" -target / -applyChoiceChangesXML \"$CHOICE_XML\" || exit $?\n\nrelaunch_application 'com.microsoft.rdc.macos'\n",
-    "a580bda5": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_pkg_files 'com.microsoft.rdc.macos'\nforget_pkg 'com.microsoft.rdc.macos'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.rdc.macos'\ntrash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.rdc.macos'\ntrash $LOGGED_IN_USER '~/Library/Group Containers/UBF8T346G9.com.microsoft.rdc'\n"
+    "a580bda5": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n  local PKGID=\"$1\"\n  local FUNC=\"$2\"\n  if [[ \"$PKGID\" == *\"*\" ]]; then\n    local prefix=\"${PKGID%\\*}\"\n    echo \"Expanding wildcard for PKGID: $PKGID\"\n    for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n      echo \"Processing $receipt\"\n      \"$FUNC\" \"$receipt\"\n    done\n  else\n    \"$FUNC\" \"$PKGID\"\n  fi\n}\n\nforget_pkg() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n  local PKGID=\"$1\"\n  sudo pkgutil --forget \"$PKGID\"\n}\n\nremove_pkg_files() {\n  local PKGID=\"$1\"\n  expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n  local PKGID=\"$1\"\n  local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n  echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n  PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n  VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n  INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n  if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n    FULL_INSTALL_LOCATION=\"$VOLUME\"\n  else\n    FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n    FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n  fi\n\n  echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n  sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n  root_app_dir=$(\n    sudo pkgutil --only-dirs --files \"$PKGID\" \\\n      | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n      | grep 'Applications' \\\n      | awk '{ print length, $0 }' \\\n      | sort -n \\\n      | head -n1 \\\n      | cut -d' ' -f2-\n  )\n  if [ -n \"$root_app_dir\" ]; then\n    echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n    sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n  fi\n}\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n\n  # If the target contains glob characters, expand it and move each match.\n  if [[ \"$target_file\" == *[*?[]* ]]; then\n    local file file_name\n    local matched=false\n    local i=0\n    # compgen -G expands the (quoted) pattern itself, so paths containing\n    # spaces glob correctly; reading line by line keeps each match intact.\n    while IFS= read -r file; do\n      [[ -n \"$file\" ]] || continue\n      [[ -e \"$file\" || -L \"$file\" ]] || continue\n      matched=true\n      i=$((i + 1))\n      file_name=\"$(basename \"$file\")\"\n      echo \"removing $file.\"\n      # The per-match counter keeps matches that share a basename from\n      # overwriting each other in the trash.\n      mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n    done < <(compgen -G \"$target_file\" 2>/dev/null)\n    if [[ \"$matched\" == false ]]; then\n      echo \"$target_file doesn't exist.\"\n    fi\n    return\n  fi\n\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nremove_pkg_files 'com.microsoft.rdc.macos'\nforget_pkg 'com.microsoft.rdc.macos'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.rdc.macos'\ntrash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.rdc.macos'\ntrash $LOGGED_IN_USER '~/Library/Group Containers/UBF8T346G9.com.microsoft.rdc'\n",
+    "cec1d345": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local timeout_duration=10\n\n  # check if the application is running\n  local app_running\n  app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n  if [[ \"$app_running\" != \"true\" ]]; then\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    eval \"export $var_name=0\"\n    return\n  fi\n\n  # App was running, mark it for relaunch\n  eval \"export $var_name=1\"\n  echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\nrelaunch_application() {\n  local bundle_id=\"$1\"\n  local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n  local was_running\n\n  # Check if the app was running before installation\n  eval \"was_running=\\$$var_name\"\n  if [[ \"$was_running\" != \"1\" ]]; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Relaunching application '$bundle_id'...\"\n\n  # Launch the app in the logged-in user's GUI session. Apps launched by root\n  # won't register with the user's Dock/GUI, so run 'open' as the console user.\n  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n  # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n  # LSOpenURLsWithRole() failures even when 'open' exits 0.\n  local open_status=0\n  if [[ $EUID -eq 0 ]]; then\n    local console_uid\n    console_uid=$(id -u \"$console_user\")\n    /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  else\n    open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n  fi\n\n  if [[ $open_status -eq 0 ]]; then\n    echo \"Application '$bundle_id' relaunched successfully.\"\n  else\n    echo \"Failed to relaunch application '$bundle_id'.\"\n  fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.microsoft.rdc.macos'\n\nCHOICE_XML=$(mktemp /tmp/choice_xml_XXX)\n\ncat << EOF > \"$CHOICE_XML\"\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<array>\n  <dict>\n    <key>attributeSetting</key>\n    <integer>0</integer>\n    <key>choiceAttribute</key>\n    <string>selected</string>\n    <key>choiceIdentifier</key>\n    <string>com.microsoft.autoupdate</string>\n  </dict>\n</array>\n</plist>\n\nEOF\n\nsudo installer -pkg \"$TMPDIR/Windows_App_11.4.0_installer.pkg\" -target / -applyChoiceChangesXML \"$CHOICE_XML\" || exit $?\n\nrelaunch_application 'com.microsoft.rdc.macos'\n"
   }
 }
diff --git a/ee/maintained-apps/outputs/workflowy/darwin.json b/ee/maintained-apps/outputs/workflowy/darwin.json
index eb59a83d72b..0c5c4f51976 100644
--- a/ee/maintained-apps/outputs/workflowy/darwin.json
+++ b/ee/maintained-apps/outputs/workflowy/darwin.json
@@ -1,16 +1,16 @@
 {
   "versions": [
     {
-      "version": "4.3.2608181120",
+      "version": "4.3.2608251350",
       "queries": {
         "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.workflowy.desktop';",
-        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.workflowy.desktop' AND version_compare(bundle_short_version, '4.3.2608181120') < 0);",
+        "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.workflowy.desktop' AND version_compare(bundle_short_version, '4.3.2608251350') < 0);",
         "open": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps a JOIN processes p ON substr(p.path, 1, LENGTH(a.path) + 1) = concat(a.path, '/') WHERE a.bundle_identifier = 'com.workflowy.desktop');"
       },
-      "installer_url": "https://github.com/workflowy/desktop/releases/download/v4.3.2608181120/WorkFlowy.zip",
+      "installer_url": "https://github.com/workflowy/desktop/releases/download/v4.3.2608251350/WorkFlowy.zip",
       "install_script_ref": "b65ecb27",
       "uninstall_script_ref": "71fe81c3",
-      "sha256": "debc8e8dbaa3e7001359f634e67f48d2491155ea94d5efc27eba973521c018b5",
+      "sha256": "9bd468c3e8a99919ba638933e1f28bca499de2473268d6f8d43c30317d04a92d",
       "default_categories": [
         "Productivity"
       ]