** Description changed: On Noble, the dominant Ubuntu LTS system, Flatpak packages from the Universe repo hasn't been updated in 2 years and is missing a several dozen security (CVE/GHSA) fixes, including critical security issues such as sandbox escapes, privilege escalation, and more. The latest version of Flatpak provided in the Universe repo is 1.14.6-1ubuntu0.1, which was last updated 23 Sep 2024: https://changelogs.ubuntu.com/changelogs/pool/universe/f/flatpak/flatpak_1.14.6-1ubuntu0.1/changelog The latest version of Flatpak provided upstream is 1.19.0: https://github.com/flatpak/flatpak/releases + + (Edit: See Simon's correction below. The latest *stable* version of + Flatpak is v1.18) I understand that Flatpak & Snap are competitors, but the non- cooperation here is putting innocent users in danger. As it stands today, a simple command like `apt install flatpak` installs an outdated package which is full of security holes. # What you expected to happen I expected an this command would install a current version of Flatpak. ``` % sudo apt install --only-upgrade flatpak Reading package lists... Done Building dependency tree... Done Reading state information... Done flatpak is already the newest version (1.14.6-1ubuntu0.1). 0 upgraded, 0 newly installed, 0 to remove and 41 not upgraded. ``` # What happened instead It kept the same ancient version of Flatpak - - Details are provided in the extra debugging information provided by `ubuntu-bug`. + Details are provided in the extra debugging information provided by + `ubuntu-bug`. ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: flatpak 1.14.6-1ubuntu0.1 ProcVersionSignature: Ubuntu 6.8.0-137.137-generic 6.8.12 Uname: Linux 6.8.0-137-generic x86_64 ApportVersion: 2.28.2-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Sat Aug 15 13:48:09 2026 InstallationDate: Installed on 2020-01-19 (2401 days ago) InstallationMedia: Ubuntu 19.10 "Eoan Ermine" - Release amd64 (20191017) ProcEnviron: - LANG=en_US.UTF-8 - PATH=(custom, no user) - SHELL=/bin/zsh - TERM=xterm-256color - XDG_RUNTIME_DIR=<set> + LANG=en_US.UTF-8 + PATH=(custom, no user) + SHELL=/bin/zsh + TERM=xterm-256color + XDG_RUNTIME_DIR=<set> SourcePackage: flatpak UpgradeStatus: No upgrade log present (probably fresh install)
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2163587 Title: Flatpak package in Universe is 2 years old & is missing critical security updates To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/2163587/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
