We are excited to announce that Mac Client version 7.2.1.105 will be rolling out next Tuesday (August 4, 2026).
In 7.2.1.105 we have updated the copy of Python that ships inside the Watchman Monitoring Mac agent, moving it from 3.9 to the newest stable release, 3.14.6.
Why we did this
The agent carries its own bundled copy of Python so it does not depend on whatever version of Python is, or is not, present on a given Mac. Over time, that bundled 3.9 build started turning up in vulnerability scans. If you run endpoint security or vulnerability tooling, you may have seen it flag the Python inside the agent for known CVEs. Those flags are based on the version number rather than on anything the agent actually does, but they still create noise and questions for your team.
Moving to Python 3.14.6 clears those version-based flags. As part of this work we also audited every bundled dependency for known vulnerabilities, and the built framework reports none.
What to expect
The update is automatic. The first time a Mac runs the new agent, it downloads and installs the updated Python framework. This is a one-time download of about 37 MB per computer. After that, plugins run on the new framework just as they did before. The framework is universal, so it runs natively on both Intel and Apple Silicon Macs.
For managed or security-restricted Macs
On Macs running endpoint security software such as EDR, MDR, or antivirus, or strict application controls, that automatic download and install can be blocked or quarantined, because it looks like a background process fetching and running an installer. If you manage Macs like this, you can install the framework ahead of time through your RMM or MDM. When the framework is already present, the agent recognizes it and skips its own download, so nothing gets blocked.
The framework package is signed and notarized by Monitoring Client LLC, is universal (Intel and Apple Silicon), and is the same package the agent would otherwise download. One package works for every Mac, regardless of subdomain.
Download URL:
https://app.monitoringclient.com/downloads/extras/com.monitoringclient.pythonframework-latest.pkg
Option 1: RMM or script
Run as root on each Mac:
curl -fL -o /tmp/pythonframework-latest.pkg "https://app.monitoringclient.com/downloads/extras/com.monitoringclient.pythonframework-latest.pkg"
installer -pkg /tmp/pythonframework-latest.pkg -target /
rm -f /tmp/pythonframework-latest.pkg
Option 2: MDM (Jamf, Kandji, Mosyle, Addigy, Munki, and similar)
Download the package from the URL above, upload it to your MDM, and deploy it as a standard package install to the target Macs. Delivering it through your MDM is the most reliable option on security-restricted fleets, because it arrives through a channel your endpoint software already trusts.
Please note: install the package, do not just copy the framework files into place. The agent confirms the framework is present by checking that the package was properly installed, so a manual file copy will not be recognized and the agent will still download its own copy.
Confirm it installed:
defaults read /var/db/receipts/com.monitoringclient.pythonframework PackageVersion
# should report 45 or higher
/Library/MonitoringClient/python3 –version
should report Python 3.14.6 or newer
For the smoothest result, install the framework before the new agent reaches these Macs, so the agent never needs to download it. If the agent updates first and its download is blocked, the Mac keeps running on its current framework and simply retries on each check-in, and installing the framework afterward stops the retries.
Let us know if you have any questions or feature requests!
Ian, Garrett, & Allen