Installing and updating
Each program checks its own update feed when it starts and offers a newer version when there is one. Nothing is installed without asking, and every download is verified against the published SHA-256 before it runs.
Windows may show a blue “Windows protected your PC” screen for a program it has not seen before. Choose More info, then Run anyway.