Add patch queries to frozen FMAs

[jkatz01]

Related issue: Resolves #43441

Adds patch policies to a few frozen FMAs that match the frozen version. Also removes outputs/cisco-webex/windows.json since it has been replaced by webex/darwin and webex/windows and is no longer in apps.json

Note that the Backblaze install script doesn't actually work, it tries to use a -nogui flag that doesn't actually exist. Keeping that out of this ticket though. It looks like this app requires email authentication, so it might not be trivial to get a working install script without users providing secrets for a --createaccount_or_signinaccount flag.

Checklist for submitter

Testing

• Added/updated automated tests

• Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)

• QA'd all new/changed functionality manually

  • Tested that the patch policies don't fail. I'm not sure if we have been manually testing the patch policies to see that they fail appropriately for every single FMA, so please let me know if that needs to be done.

Summary by CodeRabbit

Release Notes

• Updates

  • Updated version detection logic for Adobe Acrobat Pro, Backblaze, and Keeper Password Manager

• Removals

  • Discontinued support for Cisco Webex on Windows

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/adobe-acrobat-pro/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/backblaze/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/cisco-webex/windows.json

Error: File 'ee/maintained-apps/outputs/cisco-webex/windows.json' does not exist

ee/maintained-apps/outputs/keeper-password-manager/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9bd70a82-87c2-4350-97d3-3193f4850c27

📥 Commits

Reviewing files that changed from the base of the PR and between 89b2a5e and 8e79308.

📒 Files selected for processing (4)

• ee/maintained-apps/outputs/adobe-acrobat-pro/darwin.json
• ee/maintained-apps/outputs/backblaze/darwin.json
• ee/maintained-apps/outputs/cisco-webex/windows.json
• ee/maintained-apps/outputs/keeper-password-manager/darwin.json

💤 Files with no reviewable changes (1)

• ee/maintained-apps/outputs/cisco-webex/windows.json

---

Walkthrough

This PR updates three macOS app detection manifests in the Fleet-maintained apps directory to add version-aware patched SQL queries. Adobe Acrobat Pro (25.001.20937), Backblaze (10.0.0.1030), and Keeper Password Manager (17.5.0) now include patched queries that use NOT EXISTS with version_compare(bundle_short_version, ...) conditions to detect when an app is already installed at or above a target version threshold. The PR also addresses issue #43441 by supplying missing patched queries for apps whose manifests previously had only exists detection logic.

Possibly related PRs

• fleetdm/fleet#46238: Both PRs update Fleet-maintained app detection by modifying the queries.patched logic in ee/maintained-apps/outputs/*/darwin.json to use version-aware version_compare(...) gating alongside existing exists checks.
• fleetdm/fleet#46199: Both PRs update the macOS app output JSONs to add or adjust version-aware queries.patched logic for apps like Adobe Acrobat Pro and Backblaze with bundle identifier and bundle short version gating.
• fleetdm/fleet#45799: The PR's updates to app patched SQL predicates with version_compare(...) logic are consistent with a refactor of GenerateQueryForManifest that changes how NOT EXISTS and version_compare clauses are composed and tested.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Add patch queries to frozen FMAs' is clear, concise, and directly describes the main change in the changeset.
Description check	✅ Passed	The PR description includes the related issue (#43441), manually tested QA confirmation, and relevant context about the changes and known limitations.
Linked Issues check	✅ Passed	The PR successfully addresses all coding requirements from issue #43441 by adding patched queries to frozen FMA manifests and removing the orphaned cisco-webex/windows.json file.
Out of Scope Changes check	✅ Passed	All changes are directly aligned with the objectives in issue #43441; the PR adds patched queries to affected FMA manifests and removes the orphaned cisco-webex/windows.json file as required.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 43441-missing-patch-queries

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}