<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48486
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Apple MDM devices manually re-enrolled during a pending SCEP renewal
are now handled as a fresh enrollment, so enrollment steps run
correctly.
* Renewal and re-enrollment flows are now better distinguished, reducing
cases where profile or app setup could be skipped.
* Enrollment certificates now carry clearer markers to help the system
apply the right lifecycle behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated app installation metadata for several maintained apps on macOS
and Windows, including AWS VPN Client, Beekeeper Studio, Discord, Loom,
MacWhisper, and Superwhisper.
* Improved version detection and download references so supported app
records point to the latest available releases.
* Refreshed package checksums to match the updated installers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
Follow-up to #48817 (Gemini → Google Gemini rename).
Renames MacPaw's Gemini maintained app to "Gemini 2" (matching the
actual app, which installs as `Gemini 2.app`) and fixes the app icons
for both Gemini apps:
- `ee/maintained-apps/inputs/homebrew/gemini.json` and
`ee/maintained-apps/outputs/apps.json`: name and description updated to
"Gemini 2". The slug/token stays `gemini`.
- The existing `Gemini.tsx` frontend icon and the website's
`app-icon-gemini-60x60@2x.png` were actually Google's sparkle icon, so
MacPaw's app showed the wrong icon, and after #48817 "Google Gemini"
matched no icon key and fell back to the generic package icon.
- `Gemini.tsx` is renamed to `GoogleGemini.tsx`, and a new `Gemini2.tsx`
(generated from MacPaw's app bundle via
`tools/software/icons/generate-icons.sh`) is added.
- Icon map now resolves: `"gemini 2"` → MacPaw icon (FMA list + host
inventory), `"google gemini"` → Google sparkle (FMA list), `gemini` →
Google sparkle (host inventory, since Google's app installs as
`Gemini.app`).
- The website PNG for the `gemini` slug is replaced with MacPaw's icon;
`app-icon-google-gemini-60x60@2x.png` was already correct.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the app listing to show **Gemini 2** instead of Gemini.
* Added support for the new Gemini 2 branding across app icons and
display labels.
* **Bug Fixes**
* Improved icon matching so Gemini-related entries display the correct
artwork and naming.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48102
Changes:
- Renames `ExtractIPAMetadata` to `ExtractZIPMetadata` because the magic
bytes for zip based installers (.ipa, .msix, .zip, etc) are the same so
any zip file reaches it. If the zip does not contain an `Info.plist`
file it will now fail with `ErrInvalidType`.
- Did **NOT** make typeFromBytes return "zip" instead of "ipa" because
meta.Extension is set from that which has downstream effects.
- Added test files
The actual error message is still just "invalid file type".
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Tested adding a valid `.ipa`, a macos FMA that uses a .zip file
(alt-tab/darwin), and a windows FMA that uses a .zip file
(vnc-server/windows).
- Tested an msix file (renamed or not) cannot be uploaded or edited for
an existing msi installer
- Also tested the same things via GitOps
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved installer type detection so ZIP-based packages are less
likely to be misidentified.
* Fixed an error message that incorrectly referred to the wrong file
type when detection fails.
* MSIX packages are now reported more accurately when they don’t match
IPA parsing rules.
* **Refactor**
* Cleaned up installer metadata handling for ZIP-based archives.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updates the maintained app name from "Gemini" to "Google Gemini" in both
the input config and generated apps.json output, including the app
description.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated app release metadata for Cursor, Hive, OpenCode Desktop,
Postman, and Wavebox to reflect the latest available versions, download
links, and checksums.
* Adjusted installation status checks so these apps are detected
correctly after upgrading.
* Refreshed uninstall handling for Docker Desktop and Nova to use the
latest removal instructions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
This pull request improves the reliability and efficiency of the Winget
ingester by introducing robust retry logic for fetching manifest files
and directory contents, switching to CDN-backed raw file downloads, and
updating tests to cover these changes. The main focus is on handling
transient errors (like rate limits and server errors) gracefully,
preventing ingestion failures due to temporary issues with GitHub's API
or file servers.
**Reliability improvements for manifest fetching:**
* Added `getRawManifestFile` method to fetch manifest files directly
from `raw.githubusercontent.com` (or a testable override), avoiding
GitHub API rate limits and using CDN-backed downloads. This method
implements retry logic for transient HTTP errors (e.g., 429, 5xx), with
exponential backoff, and returns a specific error for missing files.
(`ee/maintained-apps/ingesters/winget/ingester.go`)
* Introduced `getRepoDirContents` method to list repository directories
via the GitHub API with retry logic for transient errors, improving
resilience against API throttling.
(`ee/maintained-apps/ingesters/winget/ingester.go`)
**Ingestion logic updates:**
* Updated `ingestOne` to use the new retry-enabled methods for both
directory listing and manifest file fetching, ensuring that only true
missing files are skipped and transient errors cause a controlled
failure, not silent downgrades.
(`ee/maintained-apps/ingesters/winget/ingester.go`)
[[1]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8L143-R270)
[[2]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8L182-R324)
**Test enhancements:**
* Modified test server and test cases to simulate the new raw file
fetching logic, including scenarios for retries, maximum attempts, and
handling of 404 errors. Added comprehensive tests for both
`getRawManifestFile` and `getRepoDirContents` retry behavior.
(`ee/maintained-apps/ingesters/winget/ingester_test.go`)
[[1]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055L509-R512)
[[2]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055L529-R678)
* Improved test reliability by reducing retry intervals for faster test
execution and using assertions for YAML marshaling and writing.
(`ee/maintained-apps/ingesters/winget/ingester_test.go`)
**Dependency and setup changes:**
* Added necessary imports for new functionality (`io`, `net/http`,
`net/url`, `time`, and `github.com/fleetdm/fleet/v4/pkg/retry`) and
updated struct initialization to support the new fields.
(`ee/maintained-apps/ingesters/winget/ingester.go`,
`ee/maintained-apps/ingesters/winget/ingester_test.go`)
[[1]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R7-R25)
[[2]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R52-R53)
[[3]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055R474-R475)
These changes make the Winget ingestion process more robust against
transient infrastructure issues and provide better test coverage for
error handling and retry logic.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved app ingestion resilience when GitHub returns transient
rate-limit or server errors, so a single failure no longer stops the
full import run.
* Added clearer handling for missing installer data: only genuine “not
found” responses now fall back to an older version, while other errors
are surfaced properly.
* **Tests**
* Added coverage for version fallback behavior and transient error
handling during ingestion.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds WinDirStat to maintained apps for Windows by introducing the winget
input metadata, generated app output entries, and installer/uninstaller
version data. Also adds the WinDirStat icon asset and wires it into the
SoftwarePage icon map so the app displays with the correct branding in
the UI.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the Windows release metadata for Cursor to version 3.10.11,
including the download link and checksum.
* Updated the Windows release metadata for DBeaver Community to version
26.1.2, including the download link and checksum.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated macOS release metadata for several apps to their latest
versions, including DBeaver Community, DockDoor, Marked, OnlySwitch,
OpenRCT2, Spokenly, and Tunnelblick.
* Refreshes download links and checksums so installers point to the
newest available releases.
* **Bug Fixes**
* Improved patch detection logic to match the updated app versions,
helping keep upgrade checks accurate.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the macOS app entries for Clop and Stats to the latest
available versions.
* Refreshed download links and checksums so installs point to the
correct release artifacts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated release metadata for several maintained apps to newer
versions, including BetterMouse, Beyond Compare, Clop, CodexBar,
DaisyDisk, and Kiro.
* Refreshed installer links and checksums so the latest available
packages are detected and installed correctly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Refreshed release metadata for multiple maintained apps across macOS
and Windows by updating versions, installer download links, and
integrity checks so the latest installers are recognized.
* **New Features**
* Added an Egnyte Windows installer script that runs the MSI with
detailed logging and treats reboot-required outcomes as successful,
ensuring required follow-up behavior occurs on the next reboot.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated download links, version checks, and checksums for multiple
maintained apps on macOS and Windows, including browsers, developer
tools, and productivity apps.
* Bumped several apps to newer releases so install/upgrade detection
stays accurate.
* Refreshed the 7-Zip Windows download source to a newer release asset.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated app metadata for several maintained apps so install status
checks and download links point to the latest releases.
* Refreshed installer checksums to match the new versions.
* Bumped supported versions for Bruno, CLion, Dangerzone, Dot, IntelliJ
IDEA, Merlin Project, Raycast, Rider, and RubyMine.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed app package metadata for several maintained apps to the
latest versions on macOS and Windows.
* Included updated download links and checksums so installers match the
new releases.
* Improved version checks so the app status correctly reflects the newer
installed versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated installer metadata and version checks for several maintained
apps on macOS and Windows.
* Refreshed download links and checksums to match the latest released
installers.
* Included version updates for AWS SAM CLI, Badgeify, BlueJ, Bruno,
Claude, CMake, Cyberduck, GitHub Desktop, Google Chrome, Opera, Postman,
Reqable, Rocket.Chat, and Splashtop Streamer.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated package metadata for several maintained apps so the latest
versions are available on macOS and Windows.
* **Bug Fixes**
* Refreshed version checks, download links, and checksums across
multiple app entries to match newer releases.
* Included updates for AlDente, AWS CLI, ChatWise, Claude Desktop, DFU
Blaster Pro, Franz, GitHub Desktop, Google Gemini, Loom, OpenCode
Desktop, Signal, Unity Hub, WhatsApp, and Zed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved uninstall reliability across many macOS apps, especially
where background services use wildcard-style launch service names.
* Uninstall cleanup now more accurately finds and removes matching
services and their related plist/config/log files.
* Added safer handling for cases like “no matching services found” and
more robust app shutdown during uninstall.
* **Updates**
* Updated maintained app definitions and installer/uninstaller script
references, including version refreshes for Dataflare, ElectronMail,
Granola, and JASP (and related Windows installer checksums).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Update the remove_launchctl_service() function to properly handle
wildcard launchctl labels (e.g., 'com.elgato.StreamDeck*'). Wildcard
labels cannot be used directly with 'launchctl list' or as plist
filenames, so they must be expanded to concrete labels first. The
updated function matches the wildcard pattern as a regex against
currently-loaded services and removes each match individually, mirroring
Homebrew's approach. Adds test coverage for this behavior and
regenerates uninstall scripts for affected applications.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved uninstall reliability when apps use wildcard `launchctl`
service labels.
* Uninstall scripts now expand wildcard labels to the set of currently
loaded matching services, remove those services, and delete the related
LaunchAgents/LaunchDaemons plist files.
* If no matching services are found, cleanup exits gracefully.
* Applied to Stream Deck, Fantastical, Company Portal, Krisp,
Pearcleaner, and Wacom Tablet.
* **Tests**
* Added a regression test covering wildcard `launchctl` expansion during
uninstall.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The Homebrew formulae API (served by GitHub Pages) intermittently
returns 5xx errors, which previously aborted the entire ingestion run.
This change adds smart retry logic with exponential backoff for
transient failures (network errors, 5xx/429 responses) while preserving
immediate failure for permanent errors (404, other 4xx).
Implementation:
- Created transientErr wrapper type to distinguish retryable from
permanent failures
- Wrapped fetchCask HTTP logic in retry.Do with configurable interval
and max attempts
- Added comprehensive tests verifying recovery after transient errors,
exhaustion of attempts, and non-retrying of 404s
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved reliability when fetching Homebrew casks by automatically
retrying temporary failures.
* Added smarter handling for rate limits and server/network errors,
while avoiding retries for missing apps.
* Made error messages from failed responses more concise and readable.
* **Tests**
* Added coverage to verify transient retry behavior, retry exhaustion
handling, and that “not found” responses are not retried.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated the macOS app entries for Timing and WhatsApp to newer
versions.
* Refreshed the Timing download link and checksum to match the latest
release.
* Adjusted version checks so the apps are recognized correctly when
determining whether they need updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Resolves https://github.com/fleetdm/fleet/issues/48378 (issue found
while working on the Google Workspace IdP integration).
## Summary
Fixes a bug where an IdP user associated with **multiple hosts** only
had IdP host vitals populated on **one** of them.
`maybeAssociateScimUserWithHostMDMIdP` (called when a SCIM/IdP user is
created) matched all hosts whose MDM IdP account corresponds to the
user, but then deliberately linked only `hostIDs[0]` (with a `// TODO:
confirm desired behavior` / "just use the first one"). So when a user is
created *after* the hosts already enrolled — e.g. a directory sync
creating users for people who each have a laptop and a desktop — only
the first host got a `host_scim_user` row, and therefore only that host
received the user's IdP host vitals and profile-variable resends.
The fix links **every** matching host. `associateHostWithScimUser` is
keyed on `host_id` (`INSERT … ON DUPLICATE KEY UPDATE`) and triggers its
own per-host profile resend, so calling it once per host is safe and
idempotent.
This is shared SCIM linking code, so the fix benefits all IdP sources
(Okta/Entra SCIM as well as the Google Workspace directory sync that
surfaced it). Deletes and updates already handled multiple hosts
correctly; only the initial reverse-link was capped.
## Testing
Added `testScimUserCreateAssociatesAllMatchingHosts`
(`server/datastore/mysql/scim_test.go`): two hosts share one MDM IdP
account, then a SCIM user is created — both hosts must resolve to it via
`ScimUserByHostID`. Fails before the fix (host #2 unlinked), passes
after.
**Related issue:** Resolves#48378
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
## Testing
- [x] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* SCIM/IdP user provisioning now associates a new SCIM user with **all**
matching hosts, not just the first match.
* Host end-user details (including IdP username/full name) are now
populated consistently on every associated host.
* **Tests**
* Added SCIM integration and datastore regression coverage to ensure
multiple hosts linked to the same IdP account are all associated during
user creation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated available installers for several apps, including Firefox,
Visual Studio Code, Git for Windows, OneDrive, Microsoft Teams, and
others.
* Bumped multiple macOS and Windows app entries to newer releases, such
as BlueJ 6.0.0, Notesnook 3.4.2, and ChatWise 26.7.0.
* Improved version detection so installed apps are recognized correctly
against the latest releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated app release metadata so the latest versions are correctly
detected and installed across macOS and Windows.
* Refreshed download links and checksums for several apps, including
Claude, Codex, Gemini, Postman, Thunderbird, VirtualBox, Ollama, and
others.
* Improved version matching for patch detection so upgrade checks
reflect the newest releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated package definitions to match the latest releases for several
maintained apps on macOS and Windows, including browsers, productivity
tools, developer tools, and utilities.
* **Bug Fixes**
* Improved version detection so installed apps are identified correctly
as up to date after upgrading.
* Refreshed download links and checksums to match the newest installers.
* **Chores**
* Bumped version metadata across multiple app entries to keep the
catalog current.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Relates to #35120
## Summary
Eleven policy queries in the macOS 26 CIS v1.0.0 benchmark fail or
produce incorrect results due to macOS 26 architecture changes. All
fixes are confined to `ee/cis/macos-26/cis-policy-queries.yml`.
| CIS ID | Policy | Root Cause | Change |
|---|---|---|---|
| 2.3.3.1 | Screen Sharing Is Disabled | macOS 26 socket activation:
`com.apple.screensharing` appears in `launchd` table when sharing is
**off**, not on — logic inverted | Replace `launchd WHERE label =
'com.apple.screensharing'` with `listening_ports WHERE port = 5900` |
| 2.3.3.2 | File Sharing Is Disabled | Same socket activation inversion
— `com.apple.smbd` entry behavior reversed | Replace `launchd WHERE
label = 'com.apple.smbd'` with `listening_ports WHERE port = 445` |
| 2.3.3.4 | Remote Login Is Disabled | Same socket activation inversion
— `com.openssh.sshd` entry behavior reversed | Replace `launchd WHERE
label = 'com.openssh.sshd'` with `listening_ports WHERE port = 22` |
| 2.3.3.6 | Remote Apple Events Is Disabled | Same socket activation
inversion — `com.apple.AEServer` entry behavior reversed | Replace
`launchd WHERE label = 'com.apple.AEServer'` with `listening_ports WHERE
port = 3031` |
| 2.3.3.7 | Internet Sharing Is Disabled | `com.apple.nat` plist nests
`Enabled` inside a `NAT` dictionary; `key = 'Enabled'` never matches at
the top level on macOS 26 | Replace `plist` check with
`sharing_preferences WHERE internet_sharing = 1` |
| 2.3.3.10 | Bluetooth Sharing Is Disabled | `com.apple.Bluetooth` plist
does not exist on macOS 26; `preferences` table returns no rows
regardless of sharing state | Replace `preferences` check with
`sharing_preferences WHERE bluetooth_sharing = 1` |
| 2.3.4.2 | Time Machine Volumes Are Encrypted | Previous query checked
`value = 'NotEncrypted'` in the `plist` table which never matches on
macOS 26; macOS 26 changed the `AutoBackup` boolean from `'1'` to
`'true'` | Rewrite to check `preferences WHERE key = 'AutoBackup' AND
value = 'true'` (TM enabled), pass if TM disabled or if an encrypted
volume is mounted |
| 5.2.2 | Password Minimum Length | macOS 26 `pwpolicy` creates
identifier `com.apple.policy.legacy.minChars`; query filters on
`%minLength` which never matches | Rewrite to use
`JSON_EXTRACT(policy_parameters, '$.minimumLength')` with
`policy_identifier LIKE '%minChars'` |
| 5.7 | Admin Cannot Unlock Locked Session | `LIKE
'%authenticate-session-owner%'` matches both
`authenticate-session-owner` (secure) and
`authenticate-session-owner-or-admin` (insecure) — query can never fail
| Add `AND rule NOT LIKE '%authenticate-session-owner-or-admin%'` |
| 5.10 | XProtect Is Running and Updated | `launchd` table on macOS 26
reads plist files from disk, not live service state — both entries
always present regardless of whether XProtect is running | Replace
`launchd` COUNT check with `processes WHERE name IN ('xprotectd',
'XProtectPluginService')` |
| 5.11 | Logging Is Enabled for Sudo | `sudo_info` JSON stores boolean
flags as `null` (sudo -V prints key name with no value); query checks
for `'true'`/`'1'` which never matches | Use `json_type(...) IS NOT
NULL` to detect key presence vs absence |
## Test plan
- [ ] Verify 2.3.3.1: screen sharing OFF → no port 5900 → PASS; screen
sharing ON → port 5900 present → FAIL
- [ ] Verify 2.3.3.2: file sharing OFF → no port 445 → PASS; file
sharing ON → port 445 present → FAIL
- [ ] Verify 2.3.3.4: remote login OFF → no port 22 → PASS; remote login
ON → port 22 present → FAIL
- [ ] Verify 2.3.3.6: remote apple events OFF → no port 3031 → PASS;
events ON → port 3031 present → FAIL
- [ ] Verify 2.3.3.7: internet sharing OFF → PASS; internet sharing ON →
FAIL
- [ ] Verify 2.3.3.10: bluetooth sharing OFF → PASS; bluetooth sharing
ON → FAIL
- [ ] Verify 2.3.4.2: Time Machine disabled → PASS; Time Machine enabled
with unencrypted destination → FAIL; Time Machine enabled with encrypted
destination → PASS
- [ ] Verify 5.2.2: `pwpolicy -setglobalpolicy "minChars=15"` → query
returns row (PASS); `minChars=8` → no row (FAIL)
- [ ] Verify 5.7: `authorizationdb write system.login.screensaver
authenticate-session-owner` → PASS;
`authenticate-session-owner-or-admin` → FAIL
- [ ] Verify 5.10: both `xprotectd` and `XProtectPluginService` running
→ PASS; either absent → FAIL
- [ ] Verify 5.11: `Defaults log_allowed` in sudoers.d → PASS; removed →
FAIL
Queries manually verified against macOS 26.5.1 VM and physical MacBook
Pro via fleetctl live queries — see issue #35120 for full QA notes.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated several macOS CIS compliance checks to use more reliable
evidence, improving accuracy for network sharing, remote access, Time
Machine encryption, password policy length, sudo logging, session
security, and XProtect status.
* Tightened session-access validation so administrator login rules are
enforced more consistently.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Marcus Allen <marcus@Marcuss-Work-MacBook-Pro.local>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated maintained app metadata for many Windows and macOS packages to
newer releases.
* Refreshed download links and installer checksums across the catalog.
* Adjusted version-matching rules so installed apps are recognized
correctly after upgrade.
* Included updates for apps such as Docker Desktop, Discord, Notion,
Tailscale, Loom, Cloudflare WARP, and others.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
The SCIM endpoints are served by the elimity-com/scim library mounted as
a single prefix handler on the root ServeMux, so they are never
registered as individual gorilla/mux routes.
Since the routes can't be discovered, supply them to the validator
instead: add scim.RegisterValidationRoutes, a FeatureRouteFunc that
registers stub routes for the SCIM endpoints (handlers are never
invoked, only their path templates and methods are inspected). Wire it
into the three Validate call sites (production serve, test helper,
svctest).
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated app release metadata for multiple macOS and Windows apps so
users get the latest available installers.
* Bumped versions for Bezel, ClipBook, Cryptomator, Downie, DuckDuckGo,
Genesys Cloud, MacWhisper, Miro, Nextcloud, Notepad.exe, Opera, Proton
Drive, Reqable, WhatsApp, and Wins.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
## Summary
**QA / load-test tooling** for the Google Workspace IdP integration —
lets QA exercise the real sync path at scale without a Google Workspace
tenant.
- **`tools/gw-directory-fake`** — a standalone fake of the Google Admin
SDK Directory API (not production code):
- `generate` — writes an editable JSON fixture (`-users`, `-groups`,
`-members-per-group`, `-domain`).
- `serve` — serves users/groups/members with real pagination from the
fixture, **hot-reloading** the file on change (poll modtime), plus
`-latency` / `-error-rate` (429/503) knobs. Responses are built from the
real `directory` SDK structs so the schema can't drift.
- **Fleet-side seam** (`ee/server/googleworkspace/google_workspace.go`):
- honors `token_uri` from the service-account JSON (falls back to
Google's endpoint),
- `FLEET_TEST_GOOGLE_WORKSPACE_ENDPOINT` redirects the Directory API
base to the fake (logs a warning each sync; never set in production),
- `seam_test.go` proves the loop end to end (JWT token exchange +
paginated Directory calls against a local fake over plain HTTP).
### QA workflow
```
go run ./tools/gw-directory-fake generate -users 50000 -groups 2000 -domain qa.example.com -out fixture.json
go run ./tools/gw-directory-fake serve -fixture fixture.json -addr :8091
```
Set `FLEET_TEST_GOOGLE_WORKSPACE_ENDPOINT=http://<host>:8091` on Fleet
and configure the integration with a throwaway service-account JSON
whose `token_uri` is `http://<host>:8091/token`. Edit `fixture.json`
anytime to change directory state mid-test.
> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-5-frontend` (top of the
feature code stack, #48168).
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Google Workspace directory access now supports custom OAuth token
endpoints and a configurable API base endpoint for testing and special
environments.
* Added a local fake Google Workspace Directory server tool for
generating sample data and serving directory responses, including
pagination and optional fault injection.
* **Bug Fixes**
* Improved handling for Google Workspace API calls when alternate
endpoints are required.
* **Tests**
* Added coverage for overriding the Google Workspace directory endpoint.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#42797
Adds support for pre-install query, post-install script, and uninstall
script on script-only packages (`.sh` and `.ps1`) across the API, UI,
and GitOps; previously these were silently stripped. The install script
remains the uploaded file's contents (file-driven) and is shown
read-only. Automatic install stays unsupported for script-only packages.
- **API** (`POST`/`PATCH /software/package`): stop stripping the fields;
validate post-install and uninstall scripts for script packages
- **GitOps**: allow
`uninstall_script`/`post_install_script`/`pre_install_query` paths
inline in the team YAML for script-only packages
- **UI**: show advanced options for `.sh`/`.ps1`; install script shown
read-only
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Script-only packages (`.sh`/`.ps1`) now expose advanced
options—pre-install query, post-install script, and uninstall
script—consistently across the UI, REST API, and GitOps.
* Script-only packages display advanced options in the UI, and the
“Install script” editor can be made read-only where appropriate.
* **Bug Fixes**
* Preserved advanced option values for script-only packages during
upload, edits, and synchronization (including replace-file scenarios).
* Improved YAML generation and validation so supported fields are
included while unsupported ones are correctly rejected/omitted.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
### 🥞 Stack (review/merge bottom-up)
1. #48164 — Activity types (FE+BE)
2. **#48165 — Backend (cron + directory sync) ⬅ this PR**
3. #48166 — Usage statistics
4. #48167 — fleetctl generate-gitops
5. #48168 — Settings UI
📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).
---
## Summary
**PR 2 of 6.** Core **backend** for the Google Workspace IdP
integration:
- Directory sync client (`ee/server/googleworkspace/`) and cron job
(`server/cron/google_workspace_cron.go`) reusing the `scim_*` tables
(Google Workspace and SCIM are mutually exclusive).
- Config types + validation (`server/fleet/google_workspace.go`,
`app.go`, `integrations.go`), appconfig handling + activity emission
(`server/service/appconfig.go`), cron registration and schedule.
- SCIM is ignored while Google Workspace is configured
(`ee/server/scim/scim.go`).
> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-1-activities` (PR 1) —
review/merge that first.
**Related issue:** Resolves#42915
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Google Workspace integration support for syncing users, groups,
and host-related identity data.
* Added a scheduled sync that keeps directory data up to date
automatically.
* Added support for configuring Google Workspace in app settings, with
validation and masking of sensitive credentials.
* **Bug Fixes**
* Prevented SCIM provisioning from overwriting data when Google
Workspace sync is configured.
* Preserved existing Google Workspace credentials when an update omits
masked API key values.
* Added handling for deleted users and group membership changes during
sync.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the Reqable Windows package entry to version 3.2.0.
* Switched the download reference to the latest 3.2.0 release artifact.
* Refreshed the package checksum to match the new release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#47947
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed GitOps generation for script-only packages added by path so it
no longer creates invalid output files.
* Script package entries now use cleaner comments, while regular
packages still show version details.
* Placeholder `script://` installer URLs are now cleared properly and
won’t remain stored after processing.
* **Tests**
* Added coverage for script package comment formatting and for clearing
placeholder installer URLs during GitOps workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Bumped several maintained app entries to newer releases, including
Cursor for macOS and Windows, Proxyman for macOS, and Stats for macOS.
* Refreshed associated download links and checksums so installs and
update checks point to the latest available versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refreshed maintained app entries for several Windows and macOS apps to
their latest releases.
* Updated version checks, download links, and checksums so installs and
update detection reflect the newer builds.
* Included version bumps for Comet, Marked, Notepad, Only Switch, and
Spokenly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated macOS installer metadata for Antigravity, ChatGPT Desktop,
DevKnife, jamovi, Marked, Netron, OpenAudible, and Workflowy to newer
versions.
* Refreshed download links and checksums so installs and updates use the
latest available release files.
* Improved ChatGPT Desktop cleanup behavior during removal for a more
complete uninstall.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated installer metadata for multiple maintained apps on macOS and
Windows, including Claude, Clop, Codex, LookAway, Ocenaudio, Ollama,
Shotcut, Spyder, Teleport Connect, Teleport Suite, and Zen Browser.
* Added newer release versions for several apps, so package listings now
reflect the latest available downloads.
* **Bug Fixes**
* Refreshed download links and checksum values to match the updated
installer packages.
* Improved version checks so installed apps are compared against the
correct current release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated maintained app definitions so installs and update checks
recognize the latest releases for Arc, Brave, Claude, Dockside, eM
Client, Fantastical, Figma, Funter, Gather, Microsoft Edge, Ocenaudio,
Ollama, P4V, Quip, R for Windows, Tuple, and Warp.
* Refreshed download links and package checksums to match the newest
installers, improving update reliability across macOS and Windows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated installer metadata for Brave Browser on macOS, Granola on
Windows, Linear on Windows, and Remote Desktop Manager on Windows.
* Refreshed version checks, download links, and package checksums so the
latest releases are detected and installed correctly.
* Kept existing install/uninstall behavior unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#38504
**Constituent PRs (merged into this feature branch):**
- #47682 — Fleet UI: APRF Software title details page Library/Inventory
layout
- #47808 — Extend update software installer API to support FMA version
pinning
- #47944 — Fleet UI: APRF library item accordion component
- #48081 — Versions modal, multi-row Library, pinned state
- #48098 — Add `pinned_version` to `edited_software` activity
- #48123 — Auto-update FMA cron
- #48144 — Download a newly-published FMA version when pinned to it
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or
`ee/fleetd-chrome/changes`. See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates
to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Fleet-maintained app version pinning (Latest, exact, and major)
via a new Versions modal.
* Introduced premium auto-updates for maintained apps with pin-aware
promotion and rollback-safe caching.
* Added expandable library version rows and a Policies modal.
* **Bug Fixes**
* Improved pin handling, cache/manifest hydration, and safer update
behavior on per-app failures and deduplication.
* **UI/UX**
* Refreshed the Software title details experience with new
accordion/list patterns, redesigned details widget/tooltips, and updated
installer presentation.
* **Documentation**
* Expanded Storybook component/page coverage and adjusted Storybook
canvas padding.
* **Tests**
* Added/updated unit and integration tests for pinning, auto-update
flows, and new modal/UI behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated macOS installer details for Vimcal to the latest available
release, including version info, download link, and checksum.
* Adjusted WhatsApp’s patched eligibility check to recognize the newer
app version.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Jordan Montgomery
