> The latest version of Flatpak provided upstream is 1.19.0: https://github.com/flatpak/flatpak/releases
The 1.19.x series are development pre-releases and should not be packaged in a LTS distribution. When this branch is ready for general use, it will be versioned as 1.20.x. The recommended releases to use in a LTS distribution are the newest stable branch as documented in https://github.com/flatpak/flatpak/blob/main/SECURITY.md. At the time of writing, that means 1.18.x. Everything else said in this report is still true, though. The version of Flatpak currently found in Ubuntu universe is not suitable for use with untrusted apps, and not suitable for systems that have untrusted local users. Security-sensitive software needs active maintenance, especially with LLMs hammering all of the world's software looking for vulnerabilities. I've reported separate Launchpad issues such as LP: #2167694 for the various vulnerabilities that were fixed in 1.18.1, most of which affect all Ubuntu LTS branches at the moment (notably including 26.04 'resolute'). There are some concrete suggestions for what Ubuntu could to do resolve this on #2167694. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2163587 Title: Flatpak package in Universe is 2 years old & is missing critical security updates To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/2163587/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
