> Resolute (which still has 1.16.6-1 from 10 Apr 2026 with no updates) There is a version of Flatpak 1.16.x in Debian 13 security updates (trixie-security) that is precisely 1.16.6 + backports of subsequent security fixes, so it would be very straightforward for an Ubuntu contributor to update to the equivalent of the version in Debian 13.
For future security updates, I intend to keep https://github.com/flatpak/flatpak/commits/flatpak-1.16.x/ up to date with backported fixes for the lifetime of Debian 13 if feasible, although that branch is not officially supported by upstream and will not have any more formal releases. Older Ubuntu LTS branches would be more difficult. Realistically, doing isolated backports into 1.14.x or older is going to be increasingly difficult as time goes on, and at some point a backport of all of 1.16.x or 1.18.x becomes a more feasible solution. The Debian LTS team has been looking at doing a full-version backport for this reason: https://salsa.debian.org/lts-team/lts-updates-tasks/-/work_items/436 Having a Flatpak provide a meaningful security boundary will also require fixing LP: #2166359 in bubblewrap (I think the only realistic way to do this without regressions will be to backport bubblewrap 0.12.x), and LP: #2168468, LP: #2167727 in xdg-dbus-proxy. > Someone needs to prepare an SRU for 26.04 LTS For avoidance of doubt, I am not going to do this (I am not an Ubuntu member). Ubuntu developers are welcome to use https://salsa.debian.org/debian/flatpak, https://salsa.debian.org/debian/bubblewrap, https://salsa.debian.org/debian/xdg-dbus-proxy as a reference: those have all had security updates in Debian 13. There are also https://github.com/flatpak/ppa-flatpak, https://github.com/flatpak/ppa- bubblewrap which target Ubuntu with whole-upstream-version backports. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2168773 Title: Multiple vulnerabilities fixed in Flatpak 1.18.4 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/2168773/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
