<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **AOMEI Backupper Standard** as a Windows Fleet-maintained app. One
of the 11 apps split out of #48501 that failed the FMA validator; #50016
shipped the 6 that passed.
## Why it was failing
Install and detection were already fine on the SYSTEM-context Windows
runner — the validator installed it and osquery found `AOMEI Backupper`
8.4.0. **Uninstall** was the failure:
```
ERROR msg="Error uninstalling app: exit status 1" app="AOMEI Backupper Standard"
ERROR msg="Output: Uninstaller for 'AOMEI Backupper Standard' not found."
```
AOMEI unified the ARP `DisplayName` across editions around v7.4 — the
registry entry reads `AOMEI Backupper`, with no `Standard` suffix. The
uninstall script searched for the catalog name and matched nothing.
`unique_identifier` was already corrected to `AOMEI Backupper`; this
fixes the uninstall script to match.
## Notes
- **Edition matching.** `AOMEI Backupper` also matches the paid
Pro/Workstation/Server editions — AOMEI shares the DisplayName across
editions and no registry value distinguishes them. Detecting the free
edition specifically isn't possible from inventory.
- **Non-pinned installer URL.**
`https://www2.aomeisoftware.com/download/adb/AOMEIBackupperStd.exe` is a
"latest" URL, so the pinned SHA will drift when AOMEI ships a new build
until the FMA auto-update bumps it.
- x86-only installer, so it lands in `C:\Program Files (x86)`. The
validator's "no changes detected in `C:\Program Files`" line is an
expected warning, not a failure.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30383902487](https://github.com/fleetdm/fleet/actions/runs/30383902487)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added **AOMEI Backupper Standard** (version **8.4.0.0.0**) to the
Windows software catalog, including verified installer download
(SHA-256).
- Introduced dedicated silent **install** and **uninstall** support,
with version gating and idempotent uninstall behavior when the app isn’t
present.
- Added a **new software icon** and updated the listing so the correct
icon now appears for this product.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **Gpg4win** as a Windows Fleet-maintained app. One of the 11 apps
split out of #48501 that failed the FMA validator; #50016 shipped the 6
that passed.
## Why it was failing
Same root cause as GNU Privacy Guard (#50025) — Gpg4win bundles GnuPG.
The install worked; the *script* never returned:
```
20:30:53 INFO msg="Executing install script..." app=Gpg4win
20:40:53 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later
20:40:53 INFO msg="New application detected at: C:\Program Files\Gpg4win"
```
Ten minutes on the nose is the validator's `executeScript` timeout.
**`Start-Process -Wait` waits for the process *and all of its
descendants***, and Gpg4win leaves `gpg-agent`, `dirmngr`, `keyboxd` and
`scdaemon` resident (plus Kleopatra), so `-Wait` never returns. The same
run left `gpg4win-5.0.2.exe` locked in the validator's temp dir,
confirming a live child process.
The install script now follows the pattern already established by
[`ollama_install.ps1`](ee/maintained-apps/inputs/winget/scripts/ollama_install.ps1):
start with `-PassThru` (no `-Wait`), wait on the installer process alone
with a 7-minute cap (below the caller's 10-minute script budget), poll
for the Add/Remove Programs entry, then stop the leftovers.
The uninstall script stops those processes up front (they hold file
locks that make the uninstall fail), uses NSIS's `_?=<dir>` switch so
the uninstaller runs in place rather than relaunching itself detached
from `%TEMP%`, and polls the ARP key to confirm removal.
## Notes
- **Versioned ARP name.** The registry `DisplayName` is `Gpg4win
(5.0.2)`, so the input uses `fuzzy_match_name` and the exists query is
`name LIKE 'Gpg4win %'`. The uninstall script matches the same prefix.
- x86-only installer. Publisher `The Gpg4win Project`.
- Ships a new catalog icon and website asset.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30384125610](https://github.com/fleetdm/fleet/actions/runs/30384125610)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added Gpg4win as a supported Windows application.
- Added Gpg4win version 5.0.2 with Security categorization.
- Added a Gpg4win icon to the software interface.
- Introduced silent install and uninstall support with process cleanup,
timeouts, and registry-based verification to confirm install/removal
outcomes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Brave Browser for macOS to version 151.1.93.129.
* Updated IBM Semeru JRE 8 for Windows to version 8.0.502.0.
* Updated NordPass for macOS to version 7.9.3.
* Refreshed installer information, checksums, and version detection for
the updated releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Refreshed Windows packages for 1Password, Claude, Cursor, GitKraken,
Node.js, OBS Studio, VirtualBox, and IBM Semeru JDK/JRE releases.
- Refreshed macOS packages for Arc, Beeper, BrickLink Studio, ChatGPT,
Firefox Nightly, Kiro CLI, Melodics, Azure Storage Explorer, Nextcloud
Talk, Spokenly, and Warp.
- Updated installer metadata, version detection, download sources, and
integrity checks to support the latest releases.
- Updated uninstall handling where required for 1Password and Node.js.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#50056
## Summary
macOS FMA install scripts never checked the exit code of the install
command (`installer -pkg` / `cp -R`) — the script's last statement is
always `relaunch_application`, which exits 0 — so a failed install
exited 0 and Fleet reported it installed.
**Generated scripts.** The generator now propagates failure: both
`installer -pkg` variants end with `|| exit $?`, and the `cp -R` path
exits non-zero on a failed copy, removes the partial copy (so a failed
fresh install isn't inventoried as the new version), and restores the
app it moved aside. Regenerated `outputs/` for non-frozen generated apps
are produced by the `ingest-maintained-apps` job, so they aren't
committed here.
**Custom scripts.** 9 of the 18 custom input scripts had the same bug
and are fixed with the same pattern: Google Chrome, Zoom, Microsoft
Edge, GitHub Desktop, Webex, Cycling '74 Max, Pd, Grammarly Desktop, and
P4V. The DMG-based ones also now fail before removing/moving the
existing app when the mount or staging copy fails, so a bad download
can't leave a host with nothing. Their `outputs/*/darwin.json` are
updated in the same commit (script content + recomputed 8-char sha256
ref, versions untouched), following the precedent of #49033. Docker
Desktop (`set -euo pipefail`), 1Password/Slack/LogiTune (installer is
the last statement), and the rest already propagated errors.
**Frozen apps.** The ingest job never rewrites frozen outputs, so the 10
frozen apps with generated scripts (adobe-acrobat-pro, comet, evernote,
firealpaca, keeper-password-manager, nvidia-geforce-now, pritunl,
vnc-viewer, wins, worksheet-crafter) had the fix applied directly to
their published `darwin.json` scripts — the exact text the current
generator would emit, with pinned versions/URLs/hashes untouched. The
11th frozen app (logi-options+) uses a custom script that was already
correct and in sync.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
(`changes/50056-fma-install-scripts-ignore-errors`).
- [x] Untrusted data interpolated into shell scripts is validated
against shell metacharacters. (No new untrusted interpolation: the guard
reuses the same curated cask-derived name the adjacent lines already
interpolate.)
## Testing
- [x] Added/updated automated tests (three generator tests: pkg,
pkg-with-choices, cp-R restore — the last now pins the exact emitted
block).
- [x] All 19 updated output manifests validated: embedded scripts pass
`bash -n`, refs match `sha256(script)[:8]`, refs map stays key-sorted
like Go's encoder.
- [x] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* macOS Fleet-maintained app installations now fail fast when
installers, DMG extraction/mounting, or app copy steps error.
* If an upgrade fails, the system removes any partial app and restores
the previously installed version when available.
* Improved robustness during app staging/copying, including safer
handling of paths with spaces or special characters.
* **Tests**
* Added unit coverage to verify installer failure propagation and
rollback behavior.
* **Documentation**
* Clarified that the install-script error handling applies to both
generated and custom scripts, including already-published frozen apps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Proton Drive for Windows to version 3.0.4.
* Refreshed the installer download reference and checksum verification.
* Improved uninstall behavior by adding a pre-uninstall stop for running
Proton Drive processes and introducing a timeout-based “watchdog” to
prevent the uninstaller from hanging.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Evernote for Windows to version 11.27.5.
* Updated Granola for Windows to version 7.452.1.
* Updated Postman for Windows to version 12.21.7.
* Updated Trezor Suite for macOS to version 26.7.3.
* Refreshed installer links and verification checksums for each release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added availability for the latest releases of numerous maintained
applications across Windows and macOS.
* Updated applications include Chrome, Firefox Nightly, Postman, Signal,
Notion, Podman Desktop, Draw.io, CMake, JDK/JRE, and many others.
* **Bug Fixes**
* Refreshed installer links, version detection, and package verification
data to ensure updates install and validate correctly.
* Updated app-specific installation handling where required for newer
releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA — fixing a failing scheduled "Update
Fleet-maintained apps" run.
Removes the **macOS** Dynalist Fleet-maintained app. The Windows
(winget) FMA is unaffected and stays.
## Why
The `dynalist` cask was deleted from homebrew-cask on 2026-07-30
([commit
`adac21ffc4`](https://github.com/Homebrew/homebrew-cask/commit/adac21ffc401)),
completing Homebrew's full deprecation lifecycle:
- `deprecate!` 2024-07-29, `because: :unmaintained`
- `disable!` 2025-07-29
- cask file removed 2026-07-30
`https://formulae.brew.sh/api/cask/dynalist.json` now returns 404, so
the scheduled ingester panics:
```
{"level":"INFO","msg":"ingesting homebrew app","name":"Dynalist"}
panic: ingesting homebrew app: app not found in brew API
```
Marking the app `"frozen": true` does **not** fix this — the ingester
fetches the cask JSON before the frozen flag is consulted
(`cmd/maintained-apps/main.go`), so removal is the only fix for a dead
upstream cask.
## What changed
Deletions only (39 lines, no additions):
- `ee/maintained-apps/inputs/homebrew/dynalist.json` — deleted
- `ee/maintained-apps/outputs/dynalist/darwin.json` — deleted
- the `dynalist/darwin` entry in `ee/maintained-apps/outputs/apps.json`
— removed; `dynalist/windows` remains
## Deliberately kept
Because the Windows FMA still needs them:
- `ee/maintained-apps/outputs/dynalist/windows.json`,
`ee/maintained-apps/inputs/winget/dynalist.json`, and its
install/uninstall scripts
- `frontend/pages/SoftwarePage/components/icons/Dynalist.tsx` and its
`dynalist:` mapping in `icons/index.ts` — the map is keyed by lowercased
app name and is shared across platforms
- `website/assets/images/app-icon-dynalist-60x60@2x.png` — keyed by slug
token, still serving the Windows entry in the app library
## Note for reviewers
Hosts that currently have the macOS Dynalist FMA installed will lose the
maintained-app entry on the next sync. This matches the behavior of
prior FMA removals (Nocturnal #50050, Dell Display Manager #47420,
Messenger #46541).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
Not applicable — consistent with prior FMA removal PRs, which do not add
a changes file.
## Testing
- [x] QA'd all new/changed functionality manually
Verified that `ee/maintained-apps/outputs/apps.json` still parses as
valid JSON (1381 apps) and that `Dynalist` now resolves to only
`dynalist/windows`. Confirmed the 404 against the brew API and read the
pre-removal cask at `adac21ffc4~1` to establish the deprecation reason.
`git diff` confirms the change is deletions-only.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated AWS CLI for Windows to version 2.36.11.
* Updated Windsurf for macOS to version 3.6.22.
* Updated Gitify for macOS to version 7.2.0.
* Updated GoLand for Windows to the 2026.2 release.
* Updated Linear for macOS to version 1.32.0.
* Updated Rancher Desktop for macOS to version 1.24.0.
* Refreshed installer links and verification data for each release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated Krita for Windows to version 5.3.3.0.
- Updated Loom for macOS and Windows to version 0.365.0.
- Updated Vivaldi for Windows to version 8.1.4087.61.
- Refreshed installer links and verification data to support reliable
installation and version detection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated managed Zed app installers for macOS and Windows to version
1.13.1.
* Updated download links and integrity checks to match the new release.
* Improved version detection so outdated installations are correctly
identified.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated maintained app releases for macOS and Windows, including
Adlock, Another Redis Desktop Manager, BetterTouchTool, BoltAI,
CodexBar, Egnyte, Firefox Developer Edition, Mimestream, Superwhisper,
and TeamViewer.
* Updated installation downloads and version detection for each new
release.
* Refreshed package integrity checks to support the latest installers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated maintained app releases for Gitify, JetBrains Toolbox,
Microsoft 365 Copilot, Spokenly, Tower, and Vivaldi.
* Refreshed installer links and verification checksums for the latest
versions across macOS and Windows.
* **Bug Fixes**
* Updated Pastebot’s macOS uninstall process to remove the app and
related user files while avoiding removal of additional system paths.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for the latest versions of AnyBurn, BetterZip, Canva,
Eclipse Temurin, ExifCleaner, Gemini, LibreOffice, NordVPN, Postman,
TablePlus, Tailscale, and other maintained applications across Windows
and macOS.
* **Bug Fixes**
* Improved macOS uninstall cleanup for numerous applications by removing
additional caches, preferences, recent-document entries, containers,
support files, and related data.
* Updated installer downloads and verification checks to match the
latest releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **Rtools** as a Windows Fleet-maintained app. One of the 11 apps
split out of #48501 that failed the FMA validator; #50016 shipped the 6
that passed.
## Why it was failing
The install script hit the validator's 10-minute `executeScript` cap
exactly:
```
20:41:22 INFO msg="Executing install script..." app=Rtools
20:51:22 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later
20:51:22 WARN msg="failed to remove rtools45-6768-6492.exe: ... Access is denied."
```
The locked installer in the temp dir shows a process was still alive.
`Start-Process -Wait` waits for the process *and all of its
descendants*, which is the same root cause as the other install-timeout
apps in this batch.
Rtools is also the one app in the batch where a **slow unpack** is a
plausible second cause — the installer is ~460 MB and expands a full
toolchain. So rather than assume, the script now waits on the installer
process alone with a 480s cap (under the caller's 10-minute budget) and
logs elapsed time plus Add/Remove Programs registration state on every
poll. If the cap is reached:
- **registered** → the install finished and only a lingering child
remains, so it stops that process and succeeds;
- **not registered** → the unpack genuinely didn't finish, and it fails
with that stated explicitly.
Either way the CI log now says which one happened instead of just timing
out.
## Notes
- **Identity verified against the installer**, not winget metadata. The
setup stub's PE version resource reads `CompanyName: The R Foundation`,
`ProductName: Rtools`. Inno derives `VersionInfoCompany` from
`AppPublisher`, so the ARP publisher is `The R Foundation` — which is
what the exists query uses.
- **Versioned ARP name.** The registry `DisplayName` is `Rtools 4.5
(6768-6492)`, so the input uses `fuzzy_match_name` and the exists query
is `name LIKE 'Rtools %'`.
- Installs to `C:\rtools45`, not Program Files, so the validator's "no
changes detected in `C:\Program Files`" line is an expected warning, not
a failure.
- Ships a new catalog icon and website asset.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30384196159](https://github.com/fleetdm/fleet/actions/runs/30384196159)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries checked against the installer's PE
version resource, `apps.json` is valid JSON with a description filled
in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Rtools as a supported Windows application.
* Added installation and uninstallation support with silent setup and
silent removal.
* Added Rtools version metadata, installer verification, and Developer
tools categorization.
* Added a dedicated Rtools icon for software listings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **Google Earth Pro** as a Windows Fleet-maintained app (a Windows
counterpart to the existing `google-earth-pro/darwin` FMA). One of the
11 apps split out of #48501 that failed the FMA validator; #50016
shipped the 6 that passed.
## Why it was failing
Install and detection were already fine on the SYSTEM-context Windows
runner — osquery found `Google Earth Pro` 7.3.7.1155. **Uninstall** was
the failure:
```
INFO msg="Executing uninstall script for app..." app="Google Earth Pro"
INFO msg="Found app: 'Google Earth Pro' at , Version: 7.3.7.1155"
ERROR msg="App still present after uninstall (expected no match for version '7.3.7.1155' in programs)"
```
The EXE wraps a WiX MSI, so the ARP `UninstallString` is `MsiExec.exe
/X{ProductCode}` — with **no quiet switch**. The old script ran that
string verbatim, which raises a confirmation dialog in session 0 where
nothing can click it, so the uninstall silently no-ops.
The uninstall script now resolves the MSI product code (from the
`UninstallString`, falling back to the registry key name) and runs
`msiexec /x <code> /quiet /norestart` with a bounded 5-minute wait, then
drains child `msiexec` processes. `3010`/`1641` are treated as success.
## Notes
- **Identity verified against the real installer**, not winget metadata.
The installer's embedded MSI Property table reads: `ProductName` =
`Google Earth Pro`, `Manufacturer` = `Google`, `ProductVersion` =
`7.3.7.1155`, `ALLUSERS` = `1`, `ProductCode` =
`{E3B69BB6-FFD8-441C-933E-BB8A3136ED8F}`. No `ARPSYSTEMCOMPONENT`, so it
is not a bootstrapper. That confirms `unique_identifier` = `Google Earth
Pro` and the exists-query publisher `Google` (not "Google LLC").
- Installs to `C:\Program Files (x86)`, so the validator's "no changes
detected in `C:\Program Files`" line is an expected warning, not a
failure.
- Reuses the existing `google earth pro` catalog icon — no new icon
needed.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30383934805](https://github.com/fleetdm/fleet/actions/runs/30383934805)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries checked against the MSI Property table,
`apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Google Earth Pro for Windows to the maintained app catalog.
* Added maintained-apps install and uninstall support for Google Earth
Pro (version 7.3.7.1155).
* Included automated download integrity verification and detection logic
for installed/updated versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **Logitech Unifying Software** as a Windows Fleet-maintained app.
One of the 11 apps split out of #48501 that failed the FMA validator;
#50016 shipped the 6 that passed.
## Why it was failing
Install and detection were already fine on the SYSTEM-context Windows
runner — osquery found `Logitech Unifying Software 2.52` at `C:\Program
Files\Common Files\LogiShrd\Unifying`. **Uninstall** was the failure:
```
20:40:55 INFO msg="Executing uninstall script for app..."
20:40:57 INFO msg="Found app: 'Logitech Unifying Software 2.52' ... Version: 2.52.33"
20:40:57 ERROR msg="App still present after uninstall (expected no match for version '2.52.33' in programs)"
```
Two seconds start to finish — the uninstaller hadn't actually done
anything yet. This is standard NSIS behavior: the uninstaller copies
itself to `%TEMP%` and relaunches, so the process the script starts
exits almost immediately while the real work happens in a detached
child.
The fix passes NSIS's `_?=<dir>` switch, which runs the uninstaller in
place instead of relaunching, making it synchronous. It has to be the
last argument and unquoted, so the script builds a single argument
string rather than an array (PowerShell would quote an element
containing spaces). A bounded poll on the ARP key follows as a backstop,
and the script fails explicitly if the entry is still there.
## Notes
- **Versioned ARP name.** The registry `DisplayName` is `Logitech
Unifying Software 2.52`, so the input uses `fuzzy_match_name` and the
exists query is `name LIKE 'Logitech Unifying Software %'`. The
uninstall script matches the same prefix rather than an exact string.
- Publisher `Logitech` confirmed against the winget locale manifest.
- Installs under `C:\Program Files\Common Files`, so the validator's "no
changes detected in `C:\Program Files`" line is an expected warning, not
a failure.
- Ships a new catalog icon and website asset.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30384010810](https://github.com/fleetdm/fleet/actions/runs/30384010810)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Logitech Unifying Software to the Windows software catalog,
including the version 2.52.33 download, checksum, and install-detection
metadata.
* Implemented silent installation and a robust, registry-aware uninstall
flow (with process lock handling and timeout behavior).
* Added a dedicated Logitech Unifying Software icon to the software page
UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **GNU Privacy Guard** as a Windows Fleet-maintained app. One of the
11 apps split out of #48501 that failed the FMA validator; #50016
shipped the 6 that passed.
## Why it was failing
The install itself worked — the validator logged `New application
detected at: C:\Program Files\GnuPG`. The *script* never returned:
```
20:18:36 INFO msg="Executing install script..." app="GNU Privacy Guard"
20:28:36 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later
20:28:36 INFO msg="New application detected at: C:\Program Files\GnuPG"
```
Ten minutes on the nose is the validator's `executeScript` timeout. The
cause is a PowerShell detail rather than anything wrong with the
installer: **`Start-Process -Wait` waits for the process *and all of its
descendants***. GnuPG's installer starts `gpg-agent`, `dirmngr`,
`keyboxd` and `scdaemon` and leaves them resident, so `-Wait` never
returns. The same run left the installer `.exe` locked in the
validator's temp dir, which is the other tell that a child process was
still alive.
The install script now follows the pattern already established by
[`ollama_install.ps1`](ee/maintained-apps/inputs/winget/scripts/ollama_install.ps1):
start with `-PassThru` (no `-Wait`), wait on the installer process alone
with a 7-minute cap (below the caller's 10-minute script budget), poll
for the Add/Remove Programs entry so a fast-returning installer can't be
mistaken for a finished one, then stop the daemons.
Stopping the daemons also fixes the uninstall, which would otherwise
fail on files those processes hold open. The uninstall script stops them
up front, uses NSIS's `_?=<dir>` switch so the uninstaller runs in place
instead of relaunching itself detached from `%TEMP%`, and polls the ARP
key to confirm removal.
## Notes
- Clean ARP `DisplayName` (`GNU Privacy Guard`), so exact name matching
— no `fuzzy_match_name` needed. Publisher `The GnuPG Project`.
- Ships a new catalog icon and website asset.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30384069714](https://github.com/fleetdm/fleet/actions/runs/30384069714)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added GNU Privacy Guard as a supported Windows application in the
maintained apps catalog.
* Added install/upgrade detection and uninstall support for Windows.
* Added GNU Privacy Guard to the software catalog (Security category).
* Added a dedicated GNU Privacy Guard icon to the software interface for
proper name-based display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #50020
# What this does
Adds **Azure Data Studio** as a Windows Fleet-maintained app. One of the
11 apps split out of #48501 that failed the FMA validator; #50016
shipped the 6 that passed.
## Why it was failing
The install itself worked — the validator logged `New application
detected at: C:\Program Files\Azure Data Studio`. The *script* never
returned:
```
20:08:19 INFO msg="Executing install script..." app="Azure Data Studio"
20:18:19 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later
20:18:19 INFO msg="New application detected at: C:\Program Files\Azure Data Studio"
```
Ten minutes on the nose is the validator's `executeScript` timeout.
Azure Data Studio is a Visual Studio Code fork and ships the same Inno
Setup script — including the **`runcode` task, which launches the app
when the install finishes**. Because `Start-Process -Wait` waits for the
process *and all of its descendants*, the launched app kept the script
blocked forever.
The fix is the switch VS Code's own FMA already uses:
`/MERGETASKS=!runcode` (see
[`vscode_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscode_install.ps1)
and
[`vscodium_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscodium_install.ps1),
both of which pass validation). The script also waits on the installer
process alone rather than its descendants, polls for the Add/Remove
Programs entry, and stops a stray `azuredatastudio` process as a
backstop in case a future build ignores the task suppression.
## Notes
- Machine-scope x64 installer, per the winget manifest — Azure Data
Studio publishes both user and machine scope, and Fleet installs run as
SYSTEM, so machine scope is required.
- Clean ARP `DisplayName` (`Azure Data Studio`), so exact name matching.
Publisher `Microsoft Corporation`.
- Uninstall is unchanged: the Inno uninstaller doesn't leave anything
resident, and `-Wait` waiting on descendants is the desired behavior
there (Inno relaunches itself from `%TEMP%`).
- Ships a new catalog icon and website asset.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] FMA CI validator (install → detect → uninstall) **passes** on the
SYSTEM-context Windows runner — [run
30384162280](https://github.com/fleetdm/fleet/actions/runs/30384162280)
(`All checks passed`)
- [x] Generated output verified locally: manifest SHA matches the winget
manifest, exists/patched queries reviewed for name + publisher
correctness, `apps.json` is valid JSON with a description filled in.
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Azure Data Studio to the available Windows software catalog.
* Added support for installing and uninstalling Azure Data Studio
(version 1.52.0) via silent installer and uninstaller flows with
completion detection.
* Added an Azure Data Studio icon to the software interface for better
visual identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for numerous current macOS and Windows application
releases, including updated installers, download links, and integrity
checks.
* Improved uninstall cleanup for several applications by removing
additional services, launch items, recent-document entries, and
application data.
* **Bug Fixes**
* Corrected version detection thresholds so outdated installations are
accurately identified.
* Updated installer and uninstaller behavior for newer application
builds, including improved relaunch and cleanup handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A — found while removing the macOS Yubikey Manager
FMA (#50109)
Two Windows Fleet-maintained apps describe themselves as macOS software
in `ee/maintained-apps/outputs/apps.json`, because the entries were
copy-pasted from their macOS counterparts. This copy is customer-facing:
it shows in the Fleet UI's software catalog and on
`fleetdm.com/software-catalog/<slug>`.
- `proxyman/windows` — "Proxyman is a high-performance **macOS** app
that enables developers to view HTTP/HTTPS requests and responses." →
drops "macOS". (The `proxyman/darwin` description keeps it; it's
accurate there.)
- `wechat/windows` — name "**WeChat for Mac**" and "**WeChat for Mac**
is a free messaging and calling application." → "WeChat". The winget
input (`inputs/winget/wechat.json`) already declares `"name": "WeChat"`,
so this also makes `apps.json` agree with its own input. The
`wechat/darwin` entry keeps "WeChat for Mac", which is the actual macOS
product name.
Renaming the Windows entry needs a matching icon key.
`getMatchedSoftwareIcon` matches on the lowercased app name and requires
an exact match or a whole-word prefix (`matchLoosePrefixToKey`: `s ===
key || s.startsWith(key + " ")`), so the existing `"wechat for mac"` key
would **not** match a name of "WeChat" and the app would fall back to
the generic package icon. Added a `wechat: Wechat` key alongside it
(both point at the same component; the `"wechat for mac"` key stays for
macOS and for hosts reporting that name in inventory).
No server-side impact: `UpsertMaintainedApp` keys on `slug` and updates
`name` in place, and `ReconcileMaintainedAppSoftwareNames` only renames
`darwin` titles, so the Windows rename doesn't touch existing software
titles. Website icons resolve from the slug (`build-static-content.js`
builds `app-icon-<slug>-60x60@2x.png`), not the name, so
`app-icon-wechat-60x60@2x.png` is unaffected.
Descriptions here mirror upstream cask/winget copy, so these are minimal
factual corrections rather than a voice rewrite.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually:
- `apps.json` still parses; 1378 apps; verified the four
`proxyman`/`wechat` entries read as intended and the `darwin` ones are
untouched.
- Traced the icon lookup by hand: name "wechat" now hits the new
exact-match key; "wechat for mac" still hits the original.
- Swept every non-darwin entry in `apps.json` for macOS-only phrasing
(`Rosetta`, `macOS`, `Mac`, `Apple`) — these two were the only genuine
mismatches. `duo-desktop/windows` (lists macOS, Windows, and Linux) and
`imazing-profile-editor/windows` (edits Apple configuration profiles)
are correct as written.
Note: `node_modules` isn't installed in my working copy, so
ESLint/Prettier weren't run locally — the added line is a one-line map
entry matching the surrounding style. CI will confirm.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A — fixes the failing scheduled "Update
Fleet-maintained apps" workflow
The `yubico-yubikey-manager` cask was removed from homebrew-cask on
2026-07-28
([Homebrew/homebrew-cask@7ffabaa](https://github.com/Homebrew/homebrew-cask/commit/7ffabaad8fcc657dc90343844ad76a50bb60b945))
after being disabled on 2025-07-27 `because: :discontinued,
replacement_cask: "yubico-authenticator"` — Yubico discontinued
`yubikey-manager-qt` (the 1.2.5 installer this FMA pinned) in favor of
Yubico Authenticator. The brew API now returns 404 for the token, so the
maintained-apps ingester panics:
```
{"level":"INFO","msg":"ingesting homebrew app","name":"Yubikey Manager"}
panic: ingesting homebrew app: app not found in brew API
```
Freezing the app in #50054 did not resolve this: `fetchCask` runs before
the `frozen` flag is applied, so the ingester still fetches the cask and
fails on the 404. This is the follow-up that PR called out.
Removes Yubikey Manager as a **macOS** Fleet-maintained app, following
the same pattern as #50050 (Nocturnal), #46541 (Messenger), and #47420
(Dell Display Manager):
- `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` —
Homebrew input
- `ee/maintained-apps/outputs/yubico-yubikey-manager/darwin.json` —
macOS output data
- `ee/maintained-apps/outputs/apps.json` — the
`yubico-yubikey-manager/darwin` entry
- `website/config/routes.js` — the bare
`/software-catalog/yubico-yubikey-manager` redirect pointed at
`-darwin`, which would now 404; retargeted to `-windows`
The **Windows** FMA is unaffected and continues to update, so these are
deliberately kept:
- `ee/maintained-apps/inputs/winget/yubico-yubikey-manager.json` and its
install/uninstall scripts
- `ee/maintained-apps/outputs/yubico-yubikey-manager/windows.json`
- the `yubico-yubikey-manager/windows` entry in `apps.json`
- `frontend/pages/SoftwarePage/components/icons/YubikeyManager.tsx` and
its `"yubikey manager"` mapping in `index.ts`
- `website/assets/images/app-icon-yubico-yubikey-manager-60x60@2x.png`
Also drops "Requires Rosetta 2." from the Windows entry's description in
`apps.json`. Rosetta is macOS-only; the sentence was copy-pasted from
the macOS entry, and with macOS gone the Windows page is what
`/software-catalog/yubico-yubikey-manager` now resolves to. Descriptions
in `apps.json` are hand-maintained — `updateAppsListFile` in
`cmd/maintained-apps/main.go` only appends entries whose slug it doesn't
already find, so it won't overwrite the edit.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually:
- `go run ./cmd/maintained-apps -slug yubico-yubikey-manager/darwin`
exits 0 with no panic and writes no files (before this change, the same
run panicked on the brew 404).
- `apps.json` still parses and holds 1377 apps; the only remaining
`yubico-yubikey-manager` entry is `/windows`.
- Grepped the repo for `yubico-yubikey-manager`: remaining hits are the
winget input, its two script paths, the windows `apps.json` entry, and
the retargeted website redirect.
No automated tests added — this is a data-file removal with no new code
paths.
My workstation has Docker Desktop 4.84.0 (latest as of today) and was
incorrectly failing the "macOS - Docker Desktop up to date" patch
policy.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved Docker Desktop patch-status detection on macOS by excluding
application paths containing `.back` anywhere in the path, avoiding
incorrect patching of nested/backup bundles.
- **Improvements**
- Enhanced Docker Desktop install and uninstall cleanup to remove stale
`Docker.app.back` artifacts and related staged in-progress update copies
(including cleanup during upgrade timing).
- **Tests**
- Updated macOS Docker Desktop ingestion/patched check expectations to
match the new `.back` path filtering behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A
Pins the macOS Fleet-maintained app for Yubikey Manager at its current
output version, `1.2.5`, by setting `"frozen": true` on the Homebrew
input.
- `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` —
added `"frozen": true`
The flag is read by the ingester into the manifest
([`homebrew/ingester.go`](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/ingesters/homebrew/ingester.go))
and then consumed in two places:
-
[`cmd/maintained-apps/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/main.go)
skips overwriting `outputs/yubico-yubikey-manager/darwin.json` when the
output file already exists, so the published version, installer URL,
SHA256, and patch-policy query stop moving.
-
[`cmd/maintained-apps/validate/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/validate/main.go)
skips the app entirely during validation.
`frozen` is tagged `json:"-"` on the manifest struct, so it does not
appear in the output JSON — that file is intentionally left untouched by
this PR.
The Windows FMA (`inputs/winget/yubico-yubikey-manager.json`) is
deliberately **not** frozen and continues to update.
## Note for reviewers
While preparing this change I found that the `yubico-yubikey-manager`
cask has been **removed from homebrew-cask**:
```
https://formulae.brew.sh/api/cask/yubico-yubikey-manager.json → 404
```
The full cask list now contains only `pallotron-yubiswitch`,
`yubico-authenticator`, and `yubihsm2-sdk`, and the token is not present
in `inputs/homebrew/custom-tap/` either. This matches upstream: Yubico
discontinued `yubikey-manager-qt` (the 1.2.5 installer this FMA pins) in
favor of Yubico Authenticator.
**Freezing does not resolve that 404.** The ingester fetches cask
metadata *before* the frozen flag is applied, so the scheduled "Update
Fleet-maintained apps" workflow is still expected to fail for this app
with:
```
panic: ingesting homebrew app: app not found in brew API
```
Fully resolving that would mean removing the macOS FMA, the way #50050
did for Nocturnal (input, output, `apps.json` entry, frontend icon +
mapping, website PNG). This PR is scoped to the freeze only, per the
request; the removal can be a follow-up if that is the direction we
want.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually — confirmed the edited
input still parses as JSON, and traced the `frozen` flag through the
ingester into both the output-write skip and the validation skip. No
automated tests were added; this is a single data-file flag with no new
code paths.
---------
Co-authored-by: Kitzy <kitzy@kitzy.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
**Related issue:** N/A — Windows Fleet-maintained app (FMA) coverage for
apps found deployed in a customer's ManageEngine SDP environment but
missing from Fleet.
## What this does
Adds **6** Windows Fleet-maintained apps — the subset of a larger batch
that passes the FMA validator cleanly. Each has a winget-sourced input,
a generated output manifest, and a catalog icon. Detection identity was
verified against each app's real registry DisplayName; apps whose
DisplayName carries a version suffix use fuzzy name matching, the rest
match exactly.
**MSI (clean, auto upgrade-code uninstall):**
- **Git Extensions** — versioned ARP name (`Git Extensions 7.2.0.92`) →
fuzzy match
- **TightVNC**, **Yarn**, **SonicWall NetExtender** (WiX), **Zoom
Outlook Plugin** — clean ARP names → exact match
**EXE — NSIS (custom `/S` install + registry-lookup uninstall):**
- **Spyder** — versioned ARP name (`Spyder 6`) → fuzzy match
## Notes
- **Detection verification.** Every app's `unique_identifier` (registry
DisplayName / osquery `programs.name`) and publisher were verified per
the `new-fma` skill against winget `AppsAndFeaturesEntries`, MSI
Property tables (`msiinfo`), and vendor installer scripts — not assumed.
Git Extensions' MSI `ProductName` is `Git Extensions 7.2.0.92` and
Spyder's ARP entry is `Spyder 6`, so both need `fuzzy_match_name`; the
four exact-match apps were confirmed clean (e.g. TightVNC registers as
`TightVNC`, not a versioned string).
- **Validated on a real Windows host.** All six pass the FMA CI
validator (install → detect → uninstall) on the SYSTEM-context Windows
runner.
- **Icons.** Git Extensions, SonicWall NetExtender, TightVNC, Yarn, and
Zoom Outlook Plugin ship new catalog icons + website assets; Spyder
reuses the existing `Spyder` icon.
## Testing
- [x] FMA CI validator (install → detect → uninstall) on the
SYSTEM-context Windows runner.
- Generated outputs verified locally: all 6 produce valid manifests; MSI
apps carry the correct UpgradeCode-based uninstall; exists/patched
queries reviewed for name + publisher correctness; `go test
./ee/maintained-apps/...` passes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added maintained Windows catalog entries for Git Extensions, SonicWall
NetExtender, Spyder, TightVNC, Yarn, and Zoom Outlook Plugin, including
silent install, version upgrade detection, and maintenance-ready
uninstall flows.
* Added new software icons for these apps and expanded icon matching so
they display correctly in the catalog.
* **Bug Fixes**
* Improved Spyder Windows uninstall targeting and command/argument
handling for more reliable removals.
* **Documentation**
* Refreshed Spyder supported version details to 6.1.5.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
**Related issue:** N/A — fixes the failing scheduled "Update
Fleet-maintained apps" workflow
The `nocturnal` cask was removed from homebrew-cask on 2026-07-28
([Homebrew/homebrew-cask@517db75](https://github.com/Homebrew/homebrew-cask/commit/517db75b78))
after being deprecated on 2024-07-27 and disabled on 2025-07-27, both
`because: :unmaintained` (upstream repo's last push was in 2018). The
brew API now returns 404 for it, so the maintained-apps ingester panics:
```
panic: ingesting homebrew app: app not found in brew API
```
This removes Nocturnal as a Fleet-maintained app, following the same
pattern as #46541 (Messenger) and #47420 (Dell Display Manager):
- `ee/maintained-apps/inputs/homebrew/nocturnal.json` — Homebrew input
- `ee/maintained-apps/outputs/nocturnal/darwin.json` — macOS output data
- `ee/maintained-apps/outputs/apps.json` — Nocturnal entry
- `frontend/pages/SoftwarePage/components/icons/Nocturnal.tsx` and its
import/mapping in `index.ts`
- `website/assets/images/app-icon-nocturnal-60x60@2x.png`
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually (verified `apps.json`
still parses, no remaining `nocturnal` references, ESLint passes on the
icons index)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Removed Apps**
- Removed Nocturnal from the maintained application catalog.
- Removed its installation and uninstallation support.
- Removed the Nocturnal icon from software listings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the Windows Discord package to version 1.0.9250.
* Updated the installer download reference and verification checksum.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed maintained application packages to their latest releases
across macOS and Windows.
* Updated ActiveDock, AWS CLI, BetterZip, Cursor, Docker Desktop,
DuckDuckGo, EagleFiler, Figma, Firefox, Garmin Express, Hive, iMazing,
Kiro CLI, Loom, LuLu, Microsoft Edge, Nessus Agent, Notepad, Ollama,
PyCharm, Reqable, Spokenly, SQL Server Management Studio, Telegram, and
Zed.
* Updated download links and verification checksums to match the new
installers.
* Improved uninstall or installation behavior for select applications,
including Figma, iMazing, and Ollama.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for the latest releases of Air Explorer, Appium
Inspector, BetterZip, GeoGebra Classic, Google Drive, Grammarly,
Melodics, NordLayer, Opencode, Screen Studio, VoiceInk, WhatsApp,
RealVNC Server, Firefox Nightly, and Zed.
* **Bug Fixes**
* Refreshed download links and integrity checks for updated application
packages.
* Improved uninstall cleanup for Elgato Control Center, Kiro, Marked,
Mellel, PureVPN, Reqable, and Rize.
* Improved Zed removal by closing the app before deleting its files.
* Updated SourceTree package metadata to the latest available installer.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Mellel for macOS to version 6.7.1.
* Updated OnlySwitch for macOS to version 2.7.2.
* Updated Reqable to version 3.2.15 on macOS and Windows.
* Updated Visual Studio Code for Windows to version 1.130.0.
* Refreshed installer links and verification data for each release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated AnyDesk for macOS to version 9.7.3.
- Updated Elgato Control Center for macOS to version 1.9.
- Updated Firefox Nightly on macOS and Windows to newer builds.
- Updated Marked, Notepad, PureVPN, Rize, Syncovery, and Zettlr for
macOS.
- Updated Zettlr for Windows to version 4.7.0.
- Refreshed download links and verification checksums for applicable
installers.
- Updated installed-version detection so devices correctly recognize the
latest releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated macOS and Windows installation metadata for Kiro, including
version 1.0.228 installers and checksums.
* Updated macOS installation metadata for Notepad to version 1.5.8.
* Updated Firefox Nightly macOS installer metadata to a newer build.
* **Bug Fixes**
* Improved uninstall cleanup for Antigravity IDE, DevKnife, Dot,
IsThereNet, Jellyfin, QLMarkdown, and RetroArch by correcting cleanup
targets and Trash handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated the Franz macOS app to version 6.5.2.
* Updated the Ollama Windows app to version 0.32.4.
* Refreshed download links and verification checksums for both
applications.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added the latest available releases for numerous maintained apps
across macOS and Windows, including ClickUp, OBS Studio, WeChat, Ollama,
Arc, GoLand, and others.
* Updated download packages and verification data so installations use
the correct release artifacts.
* **Bug Fixes**
* Improved upgrade detection for updated app versions.
* Refined cleanup behavior for CapCut and Pastebot during
uninstallation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** N/A — part of the ongoing Windows Fleet-maintained
apps (FMA) parity workstream (letter I).
## What this does
Adds **17** Windows Fleet-maintained apps for the letter-I batch.
apps.json descriptions follow the house `"<Name> is a …"` convention.
**IBM Semeru Runtime Open Edition (Java) — 8 apps** (MSI, machine, x64):
JDK 8/11/17/21 and JRE 8/11/17/21. Per-major detection follows the
Eclipse Temurin pattern — `name LIKE 'IBM Semeru Runtime Open Edition
(JDK|JRE)%' AND publisher = 'Semeru' AND version LIKE '<major>.%'` — so
majors and JDK/JRE never cross-match. All 8 share the IBM Semeru logo.
**Other apps (9):**
- **IronPython 3** — MSI; fuzzy `IronPython 3%` (excludes the EOL v2)
- **ImageGlass** — dual-scope MSI, custom `ALLUSERS=1` install
- **install4j** — install4j installer (bundled JRE), `-q`
- **IrfanView** — custom installer `/silent /allusers=1`; versioned+arch
name → fuzzy `IrfanView%`
- **iMazing HEIC Converter**, **IsoBuster**, **ImpExpPro** — Inno Setup
(`/VERYSILENT`)
- **Infix PDF Editor** — Inno, x86
- **Ibis Calculeren voor Bouw** — InstallShield wrapper; uninstall via
the MSI UpgradeCode (`uninstall_type: msi`)
## Dropped from this batch (recorded in the workstream tracker)
- **IBM Aspera Connect** — MSI installs per-user by default
(`ALLUSERS=2`/`MSIINSTALLPERUSER=1`, no machine switch in the manifest)
+ a rolling `/latest/` URL that 404s on the next release.
- **IcedTea-Web** (Azul and AdoptOpenJDK) — both declare a hard,
unbundled JRE dependency; it's a JNLP launcher that's dead-on-arrival
without Java the FMA won't install (AdoptOpenJDK variant is also
archived).
- **IronPython 2** — EOL (Python 2). **install4j 9** — legacy 2022
build. **IrfanView PlugIns** — add-on that drops DLLs with no
independent ARP entry (undetectable) and depends on the base app.
- **Intermedia Unite** and its **Teams Desktop Plugin** — both use
non-versioned "latest" URLs (winget-bot auto-updated; the pinned SHA
rots each release); the plugin also depends on Teams + Unite.
## Notes
- **Ibis Calculeren voor Bouw**, **ImpExpPro**, and **Infix PDF Editor**
ship without a catalog icon — no clean ≥256px first-party logo exists
for these niche apps (they fall back to the generic icon).
- **Ibis** carries some risk: its DisplayName couldn't be verified
offline (compressed InstallShield payload) and its installer URL is
non-versioned — flagging for the validator; will drop if
detection/version fails.
- **IsoBuster** uses a non-versioned URL that currently matches the
pinned 5.8, so no `ignore_hash`; winget re-ingestion tracks future
drift.
- Verification (installer type/scope/arch, ProductCode/UpgradeCode,
dependencies, silent switches, URL stability, en-US locale) was done per
the `new-fma` skill against the winget-pkgs manifests, with several
DisplayNames confirmed via `innoextract`/`msitools`.
## Testing
- [ ] FMA CI validator (install → detect → uninstall) on the
SYSTEM-context Windows runner — pending.
- Generated outputs verified locally: all 17 produce valid manifests;
per-major Semeru queries and MSI UpgradeCode uninstalls confirmed; all
apps.json descriptions present and convention-compliant.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated managed app installers and metadata to the latest available
versions for AWS CLI, Brave Browser, ChatGPT, Fellow, Granola, Microsoft
Edge, OpenCode Desktop, and Visual Studio Code.
* Refreshed download links and integrity checksums to match the new
installer packages.
* Updated version detection to recognize the latest releases across
Windows and macOS.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated Chef Workstation for Windows to version 25.14.2.1.
* Updated Firefox Nightly for Windows to build 155.2607.2409.0.
* Updated Prisma Access Browser for Windows to version 150.49.8.187.
* Refreshed installer download links and verification checksums for each
application.
* Updated version detection so the latest releases are correctly
recognized as installed and current.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated LibreOffice’s Windows download source for version 26.2.4.2.
* Updated Miro to version 0.11.164.
* Updated Mullvad Browser to version 15.0.19.
* Updated Proxyman to version 6.14.0, including improved removal
cleanup.
* Updated Reqable to version 3.2.14.
* Updated Vivaldi to version 8.1.4087.58.
* Refreshed installer links, checksums, and version detection for each
updated application.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated the Firefox Nightly macOS installer to the latest build and
refreshed its verification details.
* Updated the LibreOffice macOS installer to version 26.2.5, including
its download link and verification details.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Refreshed maintained application releases across Windows and macOS,
including BrowserStackLocal, Bruno, Canva, ChatGPT, Claude, CLion,
Cursor, Draw.io, Dropbox, GOG GALAXY, GoLand, Google Chrome, Kitty,
Downie, and Splice.
- Updated installer download links and integrity checksums where
applicable.
- Improved release detection so systems recognize the latest versions
and apply updates correctly.
- Updated Dropbox’s uninstall handling for its new installer release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated macOS and Windows release metadata for Insomnia to version
13.1.0.
* Updated macOS releases for Kiro (1.0.212), Melodics (5.0.871),
Microsoft Edge (150.0.4078.96), and Wispr Flow (1.6.224).
* Updated Firefox Nightly’s minimum eligible patched build.
* **Bug Fixes**
* Updated installer download links and checksums to match the latest
application releases, improving installation and update reliability
across supported platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the maintained Kiro for Windows package to version 1.0.212.
* Refreshed the installer reference and verification details for the new
release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Updates**
- Updated AWS CLI for Windows to version 2.36.7.
- Updated BetterTouchTool for macOS to version 6.663.
- Updated Box Drive for macOS to version 2.53.219.
- Updated Google Chrome for Windows to version 150.0.7871.187.
- Updated Telegram Desktop’s download source for version 7.0.5.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated maintained app installers to the latest versions for Beeper,
ChatGPT, FreeCAD, Kiro CLI, Ollama, Pastebot2, Remote Desktop Manager,
Superhuman, and Thunderbird.
* Refreshed download links, compatibility checks, and verification data
for each update.
* Improved Ollama and Pastebot2 macOS uninstall cleanup behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added frozen status to Pritunl package configurations, preventing
automatic version changes.
* **Updates**
* Refreshed maintained application packages across Windows and macOS,
including Firefox, Bitwarden, Postman, Arc, Granola, PhpStorm, WebStorm,
Bruno, and others.
* Updated download links and integrity checks to match the latest
available installers.
* Improved version detection so upgrades are recognized correctly for
each refreshed release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
