Download Conifer.

On most apps, an update is a new binary, and the OS treats a new binary as a stranger. Every folder grant, every permission, gets asked again. Conifer's builds are signed so that does not happen:

• Every macOS build is Developer-ID signed and notarized by Apple. The signature, not the file path, is the app's identity.
• Because the identity is stable across versions, the OS keeps your grants. Files, calendar, automation: granted once, still granted after the update.
• Updates are in place and you choose when. Whatever you already have keeps working until you click.
• CI refuses to publish a build whose Gatekeeper assessment fails, so a broken signature never ships.

You grant a folder once. It stays granted, version after version.