roboform cask fails to upgrade due to unversioned URL and caching behavior

[aholland]

Verification

• I understand that if I ignore these instructions, my issue may be closed without review.
• I have retried my command with --force.
• I ran brew update-reset && brew update and retried my command.
• I ran brew doctor, fixed as many issues as possible and retried my command.
• I have checked the instructions for reporting bugs.
• I made doubly sure this is not a checksum does not match / SHA256 mismatch error (do not open an issue before trying to open a PR to fix first).

Description of issue

The roboform cask (https://www.roboform.com/dist/roboform-mac-v9.dmg) uses an unversioned URL, causing Homebrew to reuse an outdated cached file during brew upgrade --greedy. This results in a “successful upgrade” message without installing the latest version from the vendor. Specifically, my installed version remains stuck at 9.6.4 due to a cached file, even though Homebrew reports upgrading from 9.6.5 to 9.6.6.

NB This is closely related to the verification point above, that "I made doubly sure this is not a checksum does not match / SHA256 mismatch error (do not open an issue before trying to open a PR to fix first)." However I can't fix this with a PR. The checksum in the formula is correct. It's the caching behaviour that is the problem. Last year I opened Homebrew/brew#18630, where I proposed disabling caching for unversioned URLs in casks. That issue was closed as “not planned,” and I was asked by maintainers to open a formula-specific issue here instead. The roboform cask exemplifies the problem: its unversioned URL and lack of checksum lead to outdated cached files breaking upgrades. I contacted RoboForm about using versioned URLs; their response was, “We’ll forward it to the developers, but it may not be implemented.”
I have attempted a fix in this PR: #204165

Steps to Reproduce

1. Install roboform with brew install --cask roboform.
2. Wait for RoboForm to update the file at the unversioned URL.
3. Run brew upgrade --cask roboform --greedy.
4. Check the installed version vs. the latest on RoboForm’s site.
   NOTE: Because waiting for a new version of Roboform is impractical or annoying, I have tried to attached the cached file so that you can use it. Unfortunately it is 44MB, so I can't. I suspect that a dummy file would do. But if you do want the actual one, tell me how you would like me to deliver it.

Cached File

❰anthonyholland❙~/Library/Caches/Homebrew/downloads❱✘≻ ls -hl | grep robo
-rw-r--r--@ 1 anthonyholland  staff    44M  9 Dec 12:53 349a2b57a312c7d520b6fd0620596d72707681457e050a50badd706914674642--roboform-mac-v9.dmg
❰anthonyholland❙~/Library/Caches/Homebrew/downloads❱✔≻ 

Expected Behaviour
Homebrew fetches and installs the latest version (e.g., 9.6.6 or newer).

Actual Behaviour
Homebrew reuses the cached file, reinstalls the same version (9.6.4 in my case), and claims success. Output from March 6, 2025:

==> Upgrading 2 outdated packages:
cursor 0.45.17,7c00f62dd81412c8defe2b64b4d32d06e0a7e727 -> 0.46.9,3395357a4ee2975d5d03595e7607ee84e3db0f2c
roboform 9.6.5 -> 9.6.6
==> Upgrading roboform
==> Downloading https://www.roboform.com/dist/roboform-mac-v9.dmg
Already downloaded: /Users/anthonyholland/Library/Caches/Homebrew/downloads/349a2b57a312c7d520b6fd0620596d72707681457e050a50badd706914674642--roboform-mac-v9.dmg
Warning: Cannot verify integrity of '349a2b57a312c7d520b6fd0620596d72707681457e050a50badd706914674642--roboform-mac-v9.dmg'.
No checksum was provided.
For your reference, the checksum is:
  sha256 "9fbac05a13e3e93a27a5bb4325d057cee199e60976d60c2c8f7dbbf3ad9063f1"
...
🍺  roboform was successfully upgraded!

Despite the output claiming an upgrade to 9.6.6, the installed version (checked via RoboForm’s "About" menu) remains 9.6.4, while the latest version on RoboForm’s site is [X, e.g., 9.6.6 or newer].

Proposed Fix
Add cache: false to the URL in the cask definition.
Alternatively, define a checksum and update it per release (less practical due to the unversioned URL).

Environment
macOS: 15.4 Beta (24E5222f)
Homebrew: Homebrew 4.4.23-75-gdac4c0c

Command that failed

brew upgrade --greedy

Output of command with --verbose --debug

==> Upgrading roboform
==> Downloading https://www.roboform.com/dist/roboform-mac-v9.dmg
Already downloaded: /Users/anthonyholland/Library/Caches/Homebrew/downloads/349a2b57a312c7d520b6fd0620596d72707681457e050a50badd706914674642--roboform-mac-v9.dmg
Warning: Cannot verify integrity of '349a2b57a312c7d520b6fd0620596d72707681457e050a50badd706914674642--roboform-mac-v9.dmg'.
No checksum was provided.
For your reference, the checksum is:
  sha256 "9fbac05a13e3e93a27a5bb4325d057cee199e60976d60c2c8f7dbbf3ad9063f1"

Output of brew doctor and brew config

❰anthonyholland❙~/Library/Caches/Homebrew/downloads❱✔≻ brew doctor
Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  [email protected]

Warning: You have the following deprecated, official taps tapped:
  Homebrew/homebrew-cask-versions
Untap them with `brew untap`.

Warning: The following casks have the same name as core casks:
  ngrok/ngrok/ngrok
Some of these can be resolved with:
  brew untap ngrok/ngrok

Warning: The following formulae have the same name as core formulae:
  coursier/formulas/coursier
Some of these can be resolved with:
  brew untap coursier/formulas

Warning: Homebrew's "sbin" was not found in your PATH but you have installed
formulae that put executables in /opt/homebrew/sbin.
Consider setting your PATH for example like so:
  fish_add_path /opt/homebrew/sbin
❰anthonyholland❙~/Library/Caches/Homebrew/downloads❱✘≻ brew config
HOMEBREW_VERSION: 4.4.23-75-gdac4c0c
ORIGIN: https://github.com/Homebrew/brew
HEAD: dac4c0cc6c31e8d28bcb7612a6c81c8a038102ea
Last commit: 9 hours ago
Branch: master
Core tap JSON: 07 Mar 02:26 UTC
Core cask tap JSON: 07 Mar 02:26 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_GITHUB_API_TOKEN: set
HOMEBREW_MAKE_JOBS: 8
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.3.7 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.7/bin/ruby
CPU: octa-core 64-bit arm_firestorm_icestorm
Clang: 16.0.0 build 1600
Git: 2.48.1 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.4-arm64
CLT: 16.2.0.0.1.1733547573
Xcode: 16.0
Rosetta 2: false

Output of brew tap

❰anthonyholland❙~/Library/Caches/Homebrew/downloads❱✔≻ brew tap
bell-sw/liberica
coursier/formulas
dart-lang/dart
homebrew/cask-versions
homebrew/services
lambdatest/tap-lambdatest-tunnel
microsoft/git
ngrok/ngrok
sass/sass
stripe/stripe-cli