Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for numerous current macOS and Windows application
releases, including updated installers, download links, and integrity
checks.
* Improved uninstall cleanup for several applications by removing
additional services, launch items, recent-document entries, and
application data.
* **Bug Fixes**
* Corrected version detection thresholds so outdated installations are
accurately identified.
* Updated installer and uninstaller behavior for newer application
builds, including improved relaunch and cleanup handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved uninstall reliability across many macOS apps, especially
where background services use wildcard-style launch service names.
* Uninstall cleanup now more accurately finds and removes matching
services and their related plist/config/log files.
* Added safer handling for cases like “no matching services found” and
more robust app shutdown during uninstall.
* **Updates**
* Updated maintained app definitions and installer/uninstaller script
references, including version refreshes for Dataflare, ElectronMail,
Granola, and JASP (and related Windows installer checksums).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated installer metadata, version references, checksums, and
deployment scripts for 40+ maintained applications across Windows and
macOS platforms. Includes updates to Android Studio, Firefox, Visual
Studio Code, Node.js, Microsoft Office suite, Joplin, Cursor, Cyberduck,
Ollama, Warp, and others, ensuring system compatibility with their
latest available releases and proper installation procedures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Correct the 'patched' SQL predicates across many
ee/maintained-apps/outputs/*.json files by moving the version_compare
condition into the subquery's WHERE clause and removing the extra
parentheses. This normalizes the NOT EXISTS checks so installed-version
detection works as intended for both macOS and Windows app outputs.
## Summary
- `pkg/patch_policy/GenerateQueryForManifest` now wraps the
caller-supplied exists query in an inner set of parentheses before
appending the trailing `AND version_compare(...) < 0` clause. Without
the wrap, any `OR` in the exists body binds *after* the appended `AND`
(SQL precedence: `AND` > `OR`), producing an incorrect `patched` query.
The bug is currently only observable on `codex-cli` (uses `path = ... OR
path LIKE ...`) but would silently break any future FMA whose exists
query contains `OR`.
- All FMA outputs regenerated via `cmd/maintained-apps`. For AND-only
exists queries (the vast majority of existing FMAs), the new patched SQL
is semantically identical to the previous form — just with extra parens
around the WHERE body. `codex-cli/windows.json`'s OR clause is now
correctly grouped.
- `docker-desktop` is unchanged: its patched SQL is constructed inline
in the homebrew ingester at
[ingester.go:198-201](https://github.com/fleetdm/fleet/blob/claude/compassionate-merkle-afbd8a/ee/maintained-apps/ingesters/homebrew/ingester.go#L198-L201)
and bypasses the generator.
### Heads-up: upstream version drift bundled in
The regeneration also pulled in a handful of upstream version bumps that
landed since the last FMA run. These are real upstream changes, not
generator artifacts:
| App | Platform | Old → New |
|---|---|---|
| Figma | windows | 126.3.12 → 126.4.9 |
| GoLand | darwin | 2026.1.1 → 2026.1.2 |
| IntelliJ IDEA | darwin | 2026.1.1 → 2026.1.2 |
| RubyMine | darwin | 2026.1.1 → 2026.1.2 |
| Zed | darwin | 1.2.5 → 1.2.6 |
If you'd prefer these isolated from the paren-only change, let me know
and I'll split the PR.
### Code changes
- [pkg/patch_policy/patch_policy.go](pkg/patch_policy/patch_policy.go):
added `(` to `templateStart` and `)` to `templateEnd{Darwin,Windows}` so
`GenerateQueryForManifest` emits `... NOT EXISTS ((<before>) AND
version_compare(...) < 0);`.
-
[pkg/patch_policy/patch_policy_test.go](pkg/patch_policy/patch_policy_test.go):
updated existing expectations and added an OR-precedence case mirroring
codex-cli's exists query.
-
[ee/maintained-apps/ingesters/homebrew/ingester_test.go](ee/maintained-apps/ingesters/homebrew/ingester_test.go):
updated the generic `Patched` assertion (docker-desktop's hardcoded
expectation is unchanged — it bypasses the generator).
- 282 regenerated files under `ee/maintained-apps/outputs/**/*.json`.
## Test plan
- [x] `go test ./pkg/patch_policy/...` passes (incl. new OR case).
- [x] `go test ./ee/maintained-apps/...` passes.
- [x] `go vet ./pkg/patch_policy/... ./ee/maintained-apps/...` clean.
- [x] `cmd/maintained-apps` runs end-to-end with no errors against the
live Homebrew/winget APIs (with `NETWORK_TEST_GITHUB_TOKEN` set).
- [x] `git diff` audited: every diffed `patched` line on
`outputs/**/*.json` is a paren-only delta; non-`patched` deltas confined
to the 5 upstream version bumps listed above.
- [x] `docker-desktop/darwin.json` unchanged after regeneration.
- [ ] CI green.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42673
Every manifest version now matches what hosts report. Here's the
before/after comparison:
| App | Before (Library) | After (Library) | Host Reports | Match? |
|-----|-----------------|----------------|-------------|--------|
| Android Studio | `2025.3.2.6` | `2025.3` | `2025.3` | Yes |
| Citrix Workspace | `25.11.1.42` | `25.11.1` | `25.11.1` | Yes |
| Elgato Stream Deck | `7.3.1.22604` | `7.3.1` | `7.3.1` | Yes |
| FileMaker Pro | `22.0.5.500` | `22.0.5` | `22.0.5` | Yes |
| Microsoft Auto Update | `4.82.26020434` | `4.82` | `4.82` | Yes |
| Opera | `129.0.5823.28` | `129.0` | `129.0` | Yes |
| Royal TSX | `6.4.2.1000` | `6.4.2` | `6.4.2` | Yes |
| Twingate | `2026.29.22575` | `2026.29` | `2026.29` | Yes |
| Microsoft OneNote | `16.107.26032211` | `16.107.2` | `16.107.2` | Yes
|
| Microsoft Outlook | `16.107.26032211` | `16.107.2` | `16.107.2` | Yes
|
| Microsoft PowerPoint | `16.107.26032211` | `16.107.2` | `16.107.2` |
Yes |
| Sublime Text | `4200` | `Build 4200` | `Build 4200` | Yes |
| Sublime Merge | `2123` | `Build 2123` | `Build 2123` | Yes |
| MySQL Workbench | `8.0.46` | `8.0.46.CE` | `8.0.46.CE` | Yes |
| Lens | `2026.3.251250` | `2026.3.251250-latest` |
`2026.3.251250-latest` | Yes |
The library version, the patch policy `version_compare`, and the
frontend comparison will all use versions that match what hosts actually
report.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42492
Includes changes from running ingestions on all FMAs
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
This pull request updates the installer scripts for the macOS FMAs to
improve the user experience during installation. The main enhancement is
that the installer scripts now detect if the application was running
before installation, quit it if necessary, and automatically relaunch it
after the installation completes.
