Your message dated Thu, 20 Aug 2026 19:51:18 +0000
with message-id <[email protected]>
and subject line Bug#1144283: fixed in ostree 2026.4-1
has caused the Debian Bug report #1144283,
regarding flatpak update fails: Decompressed delta part exceeds configured limit
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144283: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144283
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: flatpak
Version: 1.18.1-1
Severity: normal
X-Debbugs-Cc: [email protected]
Dear Maintainer,
I am encountering a failure during the update process of certain Flatpak
applications: the update process is interrupted with an error regarding the
decompressed delta limit.
Steps to reproduce:
- Run flatpak update when an update for a large application (e.g.,
org.mozilla.firefox) is available.
- Observe the process during the download/extraction phase.
Actual behavior:
The update fails for specific packages with the following error message:
"Error: While pulling app/org.mozilla.firefox/x86_64/stable from remote
flathub: Decompressed delta part exceeds configured limit of 76330069 bytes"
Expected behavior:
The update should complete successfully regardless of the delta size, or
the limit should be adjusted to accommodate modern application update sizes.
Logs/Output:
|$ flatpak update
|Looking for updates…
|
| ID Branch Op Remote
Download
| 1. [✓] org.gimp.GIMP stable u flathub
652,1 kB / 99,7 MB
| 2. [✗] org.mozilla.firefox stable u flathub
100,4 MB / 125,6 MB
Error: While pulling app/org.mozilla.firefox/x86_64/stable from remote
flathub: Decompressed delta part exceeds configured limit of 76330069 bytes
Thanks,
Antonio
--- End Message ---
--- Begin Message ---
Source: ostree
Source-Version: 2026.4-1
Done: Simon McVittie <[email protected]>
We believe that the bug you reported is fixed in the latest version of
ostree, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Simon McVittie <[email protected]> (supplier of updated ostree package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 20 Aug 2026 20:16:44 +0100
Source: ostree
Architecture: source
Version: 2026.4-1
Distribution: unstable
Urgency: medium
Maintainer: Utopia Maintenance Team
<[email protected]>
Changed-By: Simon McVittie <[email protected]>
Closes: 1144283
Changes:
ostree (2026.4-1) unstable; urgency=medium
.
* New upstream release
- Fix regression when downloading large Flatpak apps/runtimes
(reopens: #1144105) (Closes: #1144283)
* d/p/static-delta-validate-bspatch-payload-offset-and-length.patch:
Add post-release patch to fix offset validation.
This was an out-of-bounds read when downloading from a
malicious/crafted ostree repository, but is not believed to
be practically exploitable for anything worse than a crash
(denial-of-service).
* Mention #1144105, #1144106 in previous changelog entry
Checksums-Sha1:
07c6c9a404da2898f100a5759e3a6699c928f2c8 3659 ostree_2026.4-1.dsc
be31484d5c00353b6c3d966750c83eb44a8a53d0 2141564 ostree_2026.4.orig.tar.xz
12b48ff7d96c87988c7876e2091b92a61c961927 32388 ostree_2026.4-1.debian.tar.xz
c92fa07d27f72b9b4447340ff03c6c141cd597f9 4404808 ostree_2026.4-1.git.tar.xz
eaec49b59524ecf5d5b322673d96a740bbccf948 17660 ostree_2026.4-1_source.buildinfo
Checksums-Sha256:
fe860de2bd97e6cb51964238cab33b680905edaeed3d5dd21b813e71c3fe19f8 3659
ostree_2026.4-1.dsc
b26c9016eb03bb4ee52cc00c642d56e00fc79ae7faac6bf4aa317d7451339ef7 2141564
ostree_2026.4.orig.tar.xz
88138ea5ab0c0a8dfa5e0eea991ef308e5f70b44f3b2ce10f4bf6c93e1d35d38 32388
ostree_2026.4-1.debian.tar.xz
82c6e8eacbc3d6a9f15cd566dd667acf455dd6a5cc12790efdb9bdf6bf2af954 4404808
ostree_2026.4-1.git.tar.xz
ffdb7973926bf001b20ce5dca311bf10ce007023652c8d41b8ab08d1d309132d 17660
ostree_2026.4-1_source.buildinfo
Files:
f23b4b366843ad133268cf2091b81d6f 3659 admin optional ostree_2026.4-1.dsc
22d3422529c07eef716fea8a6c9b0c2b 2141564 admin optional
ostree_2026.4.orig.tar.xz
d880d033e7125ecb69e7b8e8fbb6522d 32388 admin optional
ostree_2026.4-1.debian.tar.xz
7389dee2cf3f871f1e2fb656b786791b 4404808 admin None ostree_2026.4-1.git.tar.xz
17d23b44b3169c15b74c4b36172498ba 17660 admin optional
ostree_2026.4-1_source.buildinfo
Git-Tag-Info: tag=5b299e2d91e6d04ca690a674004237f6127aa26f
fp=7a073ad1ae694fa25bff62e5235c099d3eb33076
Git-Tag-Tagger: Simon McVittie <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqHVmMACgkQYG0ITkaD
wHnBgQ//Q9BXJf4onNGDNZb1LxLc1HQob5wDZ0gN23VuSr5qX1cbxaIO0+AO/d+j
Ngl5zWr4cuuSjHcVCwHcrx35Oss5zY6A8COOkqq8UIoVRK6mzsPh4hXqTuMw1rEX
f6uqN0MgXfT0Z4/CSvFC4csWjCYqerFGEe1ZgONUzULulIlWPXkPsXQlUBR4G7NY
SXZ+beXI2yDGmbqfbMLPogLaG63k7dmkfggbu1UxRfOECu9jntkJyQiDyb/tdYRZ
l++ss9T/HMPti2q5RXb1bljRP9db+Nu3cZqJYhyo3EVRk34D7SxDUMa3MDtvzM2Q
zrOfKQAOaNoXMbsw6u8wyF8yT3xqTzYd8OtB7jyQKF1bMM13aXNLVNEW23RxCAot
8fdkD2ajtr1TeCv4MNbiICeNw+9i0+G2b4xE7pT7k4F0K4hWEiCtlI47goKVmtZW
/2HsNetjPc7d+Ze+Ohv9Emp1HSh+lw5zzW6NHOXUTU5vdMYHO52voiNYZeUtYuLX
wZt7+XJNLFkD6EqPETM5QtFtCSK2tVJkYAlF1mEYFk/IQjh0azXsbAso2dwMRQV4
vhl6Oeb+el4DyMDk4AkUcaTo57Szj+k2+Db7sClUpnkPJ93asbEfwv9hAHRYW5Kv
XGhWwqyjbIAxcl6poV/Lev2CrQQIdhZnPGwVvzqjziKYXO/Cef0=
=nvHM
-----END PGP SIGNATURE-----
pgpKToRCu4QtQ.pgp
Description: PGP signature
--- End Message ---
