This pull request improves the handling of version comparisons for
Windows application patch policies in the `winget` ingester,
specifically to support installers (like python.org) where the
registry's `DisplayVersion` does not match the package's marketing
version. It introduces a new option to compare against the
`DisplayVersion`, adds robust test coverage for this logic, and onboards
Python 3.13 and 3.14 as maintained apps with correct install/uninstall
scripts.
**Patch policy improvements:**
* Added a `UseDisplayVersionForPatch` field to `inputApp` and supporting
logic in the ingester to optionally compare patch policy versions
against the registry `DisplayVersion` instead of the package version,
with error handling if no display version is found.
[[1]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R414-R434)
[[2]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R566-R571)
* Introduced the helper function `firstDisplayVersion` and extended the
`appsAndFeaturesEntries` struct to include `DisplayVersion`.
[[1]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R448-R458)
[[2]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R612)
**Test coverage:**
* Expanded test cases in `ingester_test.go` to cover the new
`UseDisplayVersionForPatch` logic, including both positive and negative
scenarios.
[[1]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055R347)
[[2]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055R374-R424)
[[3]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055L410-R470)
* Updated test server config and fixtures to support `DisplayVersion`
for accurate test simulation.
[[1]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055R482)
[[2]](diffhunk://#diff-c68f0564df3c6e38ad333d4ca6e1040305eb079eb0d168d29c95b1b250463055L447-R503)
**New maintained apps:**
* Added onboarding for Python 3.13 and Python 3.14 as maintained apps,
each with a `use_display_version_for_patch` flag, install/uninstall
scripts, and appropriate configuration.
[[1]](diffhunk://#diff-8a640dba0d8cc9ee50cef0397c5efce6655957dde836df94e6d5fb536f422fecR1-R15)
[[2]](diffhunk://#diff-e25e77b6c53c5fcc80a6d7589547873b5007dbcca660decbff3c9579c057b0fbR1-R15)
[[3]](diffhunk://#diff-fca224dfb5a7262b0b4ad68061b06552dc5291aeb8e2409fd5c9c6f8d8022dacR1-R32)
[[4]](diffhunk://#diff-b2bd0383162063c7923532a2be6b7014310a79fe3b0c681d1647bcd0fa6e3fe8R1-R147)
These changes ensure that patch policies correctly flag outdated
installs for apps where the registry version format differs from the
package version, and Python installs are now robustly managed via Fleet.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37326
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Python 3.13 and Python 3.14 on Windows Fleet,
including install/uninstall workflows and manifests
* Option to use installer-displayed version for patch comparisons
* **Improvements**
* Normalized Windows-reported Python version strings for consistent
inventory and vulnerability matching
* Added icons for Python 3.13 and 3.14 in the software catalog
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Allen Houchins
61064687e4