linux/meta-openembedded.git/meta-oe/recipes-extended/flatpak, branch master-next

flatpak: upgrade 1.17.3 -> 1.17.6

2026-04-13T22:28:24+00:00

Contains fixes for CVE-2026-34078 and CVE-2026-34079 Add explicit CVE_STATUS tags for these CVEs, because they are tracked without version info by NVD at this time. Changelog: 17.6: Bug fixes: - Fix the remaining regression for Chromium based browsers by not leaking file descriptors down to wrapped command - Fix a regression when installing extra-data without a runtime, which is the case for openh264 - Fix the remaining regression for Epiphany by ignoring unusable sandbox-expose paths for sub-sandboxes in the portal - Fix the installed tests by allowing to add a new ref to an existing temporary ostree repo - Avoid closing fds 0/1/2 when they are used as a bad argument to flatpak-run, and reduce duplication in handling file descriptor arguments Enhancements: - Disable auto-pin in flatpak-repair to preserve the pin state across re-installs - Small improvements for the tests 17.5: Bug fixes: - Fix regressions caused by the sandbox escape security fix, which impact some browsers, browser-based apps and Steam (#6577, #6569, #6576, #6574) Enhancements: - Expand test coverage of flatpak-run features used by flatpak-portal (#6573) 17.4: Security fixes: - Fix a complete sandbox escape which leads to host file access and code execution in the host context (CVE-2026-34078) - Prevent arbitrary file deletion on the host filesystem (CVE-2026-34079) - Prevent arbitrary read-access to files in the system-helper context (GHSA-2fxp-43j9-pwvc) - Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg) Enhancements: - Enable ntsync unconditionally - Automatic branch following for extensions to ensure that "no-autodownload" extensions stay functional after an update that requires a new branch - Translation updates: eo, kk, sr, zh_CN Bug fixes: - Prevent CPR sequence from showing up in the terminal - Fix a crash for apps/runtimes with multiarch permission - Fixes for Coverity warnings - Add test-preinstall.sh to the test matrix source - Fix a test message to refer to "systemd-localed" instead of "located" Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj

flatpak: update 1.17.2 -> 1.17.3

2026-03-28T02:43:42+00:00

Enhancements: * Improve check for --filesystem paths pointing to a parent folder (#6473) * Fail if non-interactive and multiple refs, remotes or installations match (#5754) * Default to text auth on WSL (#6491) * Add build instructions for Ubuntu 24.04 (#6498) * Show a better message when there are no refs to update (#6521) * Silence AppStream refresh output on non-interactive runs (#6521) * Translation updates: pt_BR (#6483), sl (#6468, #6475), sv (#6514), tr (#6528), zh_CN (#6469, #6477) Bug fixes: * Map the font-dirs.xml file more selectively (#6450) * Change const pointers. This fixes build issues with glibc 2.43. (#6490) * Add custom type flatpak_home_t for ~/.local/share/flatpak for SELinux (#6437) * Fix build warnings when compiling with -Wanalyzer-null-argument and with -Wanalyzer-null-dereference (#6527) * Use raw string for regular expression in the flatpak-bisect script (#6519) Internal changes: * Set the `FLATPAK_TRIGGERSDIR` environment variable when running installed tests. This fixes a regression with autopkg tests in Debian. (#6444) * Add translator comments for some translatable strings (#6462) * Fix typos in translatable strings (#6463) * Fix lots of typos in code comments (#6482) * Remove an unused function (#6529) * Update two strings (#6464) Signed-off-by: Markus Volk Signed-off-by: Khem Raj

flatpak: upgrade 1.17.0 -> 1.17.2

2025-12-23T20:22:42+00:00

1. Changelog: https://github.com/flatpak/flatpak/releases/tag/1.17.2 2. Update 0001-flatpak-pc-add-pc_sysrootdir.patch for 1.17.2 3. Remove http_backend related options as it was removed in 1.17.2 Signed-off-by: Liu Yiding Signed-off-by: Khem Raj

flatpak: upgrade 1.16.1 -> 1.17.0

2025-11-18T16:17:53+00:00

Changelog: https://github.com/flatpak/flatpak/releases/tag/1.17.0 Signed-off-by: Liu Yiding Signed-off-by: Khem Raj

flatpak: update 1.16.0 -> 1.16.1

2025-09-06T17:11:38+00:00

1.16.1 Enhancements: When using parental controls, allow a child account to update existing apps by default, to ensure that security and bugfix updates can be installed. This can be overridden by setting polkit policy rules for the new org.freedesktop.Flatpak.override-parental-controls-update action if necessary. (#5552) Make systemd scopes easier to match to Flatpak app instances, by using the instance ID instead of the top-level process ID in the scope name (#6015) Access to --device=dri now includes /dev/udmabuf (#6158) Improve the error message for an invalid parameter to flatpak-spawn --sandbox-a11y-own-name (#6048) Speed up flatpak prune --dry-run by not calculating potential freed space and avoiding operations that would need to hold a lock (#5813, #6121) Speed up flatpak permission-reset by only writing entries that have actually changed (#5772) Documentation improvements (#4859, #6066, #6134) Look for TLS certificates at /etc/containers/certs.d when interacting with OCI registries (#5916) Translation updates: bg (#6120), ka (#6176), pl (#6106), pt_BR (#6076, #6188), ro (#6139), ru (#6145), sl (#6054), sv (#6193), tr (#6109) This is the first bugfix release of the Flatpak 1.16 series! Users and distributions are strongly encouraged to update to this version. Bug fixes: Fix intermittent flatpak-portal crashes by avoiding unnecessary multi-threading (#5605) Don't show a confusing confirmation prompt when flatpak remove --unused removes autoprune-unless extensions that are no longer needed, such as older Nvidia drivers (#5712, #2718) Don't propagate $PYTHONPYCACHEPREFIX from host into sandbox (#6110) Don't propagate $WAYLAND_DISPLAY, $WAYLAND_SOCKET from host into sandbox if access to the Wayland socket has been denied (#3948) When discovering the AT-SPI bus, treat $AT_SPI_BUS_ADDRESS as higher-priority than GetAddress(), more closely matching the behaviour of AT-SPI itself (#6173) Fix a memory leak when installing extra-data (#6069) Don't show fatal transaction errors twice (#3400) Fix the build with -Ddefault_library=static (#6119) Fix incorrect error reporting (#6127, #5170) When using FLATPAK_TTY_PROGRESS, terminate OSC escape sequence with standard ST sequence instead of xterm-specific BEL (#6092) Include all options in shell completion for flatpak search (#6096) Internal changes: Fix an unclear boolean expression (no functional change) (#5013) Avoid a duplicate redirection in the test suite (#6117) CI updates Signed-off-by: Markus Volk Signed-off-by: Khem Raj

meta-openembedded/all: adapt to UNPACKDIR changes

2025-06-25T13:44:52+00:00

Please see https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265 for what changes are needed, and sed commands that can be used to make them en masse. I've verified that bitbake -c patch world works with these, but did not run a world build; the majority of recipes shouldn't need further fixups, but if there are some that still fall out, they can be fixed in followups. Signed-off-by: Alexander Kanavin Signed-off-by: Khem Raj

flatpak: fix path for nologin

2025-04-19T21:36:06+00:00

Signed-off-by: Markus Volk Signed-off-by: Khem Raj

flatpak: add requested user

2025-04-19T21:36:03+00:00

This fixes: WARNING: gnome-image-1.0-r0 do_rootfs: User flatpak has never been defined Signed-off-by: Markus Volk Signed-off-by: Khem Raj

flatpak: update 1.15.10 -> 1.16.0

2025-02-25T05:31:38+00:00

Changes in 1.16.1 ~~~~~~~~~~~~~~~~~~ Released: not yet ... Changes in 1.16.0 ~~~~~~~~~~~~~~~~~~ Released: 2025-01-09 Bug fixes: * Update libglnx to 2024-12-06: - Fix an assertion failure if creating a parent directory encounters a dangling symlink (GNOME/libglnx#1) - Fix a Meson warning * Don't emit terminal progress indicator escape sequences by default. They are interpreted as notifications by some terminal emulators. (#6052) * Fix introspection annotations in libflatpak Enhancements: * Add the `FLATPAK_TTY_PROGRESS` environment variable, which re-enables the terminal progress indicator escape sequences added in 1.15.91. * Document the `FLATPAK_FANCY_OUTPUT` environment variable, which allows disabling the fancy formatting when outputting to a terminal. Changes in 1.15.91 ~~~~~~~~~~~~~~~~~~ Released: 2024-12-19 Enhancements: * Add the `FLATPAK_DATA_DIR` environment variable, which allows overriding at runtime the data directory location that Flatpak uses to search for configuration files such as remotes. This is useful for running tests, and for when installing using Flatpak in a chroot. * Add a `FLATPAK_DOWNLOAD_TMPDIR` variable. This allows using download directories other than /var/tmp. * Emit progress escape sequence. This can be used by terminal emulators to detect and display progress of Flatpak operations on their graphical user interfaces. Bug fixes: * Install missing test data. This should fix "as-installed" tests via `ginsttest-runner`, used for example in Debian's autopkgtest framework. * Unify and improve how the Wayland socket is passed to the sandboxed app. This should fix a regression that is triggered by compositors that both implement the security-context-v1 protocol, and sets the `WAYLAND_DISPLAY` environment variable when launching Flatpak apps. (#5863) * Fix the plural form of a translatable string. Changes in 1.15.12 ~~~~~~~~~~~~~~~~~~ Released: 2024-11-28 Bug fixes: * Return to using the process ID of the Flatpak app in the cgroup name. Using the instance ID in 1.15.11 caused crashes when installing apps, extensions or runtimes that use the "extra data" mechanism, which does not set up an instance ID. (#6009) Changes in 1.15.11 ~~~~~~~~~~~~~~~~~~ Released: 2024-11-26 Dependencies: * In distributions that compile Flatpak to use a separate bubblewrap executable, version 0.11.0 is recommended (but not required). The minimum bubblewrap continues to be 0.10.0. * In distributions that compile Flatpak to use a separate xdg-dbus-proxy executable, version 0.1.6 is recommended (but not required). The minimum xdg-dbus-proxy continues to be 0.1.0. Enhancements: * Allow applications like WebKit to connect the AT-SPI accessibility tree of processes in a sub-sandbox with the tree in the main process (#5898) * New sandboxing parameter `flatpak run --a11y-own-name`, which is like `--own-name` but for the accessibility bus * flatpak-portal API v7: add new sandbox-a11y-own-names option, which accepts names matching `${FLATPAK_ID}.*` * Apps may call the `org.a11y.atspi.Socket.Embedded` method on names matching `${FLATPAK_ID}.Sandboxed.*` by default * `flatpak run -vv $app_id` shows all applicable sandboxing parameters and their source, including overrides, as debug messages (#5895) * Add --device=usb, a subset of --device=all * Introduce USB device listing * Apps can list which USB devices they want to access ahead of time by using the `--usb` parameter. Check the manpages for the more information about the accepted syntax. * Denying access to USB devices is also possible with the `--no-usb` parameter. The syntax is equal to `--usb`. * Both options merely store metadata, and aren't used by Flatpak itself. This metadata is intended to be used by the (as of now, still in progress) USB portal to decide which devices the app can enumerate and request access. * Add support for KDE search completion * Use the instance id of the Flatpak app as part of the cgroup name. This better matches the naming conventions for cgroup. * Preconfigured repositories can now be set up by OS vendors using `${datadir}/flatpak/remotes.d` (typically /usr/share/flatpak/remotes.d), in addition to `${sysconfdir}/flatpak/remotes.d` (typically /etc/flatpak/remotes.d) which is intended for local sysadmin use Bug fixes: * Update libglnx to 2024-08-23 (#5918) * fix build in environments that use -Werror=return-type, such as openSUSE Tumbleweed (#5778) * add a fallback definition for G_PID_FORMAT with older GLib * avoid warnings for g_steal_fd() with newer GLib * improve compatibility of g_closefrom() backport with newer GLib * Update meson wrap file for bubblewrap to version 0.11.0: * drop Autotools build system * improve handling of EINTR * improve handling of socket control messages * improve compatibility with busybox * improve compatibility with older Meson * fix deprecation warnings * Update meson wrap file for xdg-dbus-proxy to version 0.1.6: * compatibility with D-Bus implementations that pipeline the authentication handshake, such as sd-bus and zbus * compatibility with D-Bus implementations that use non-consecutive serial numbers, such as godbus and zbus * broadcast signals can be allowed without having to add TALK permission (#5828) * fix memory leaks * Fix some memory leaks * Translation updates: cs, pl, zh_CN Internal changes: * Better const-correctness (#5913) * Fix a shellcheck warning in the tests (#5914) Signed-off-by: Markus Volk Signed-off-by: Khem Raj

flatpak-xdg-utils: upgrade 1.0.5 -> 1.0.6

2024-09-10T14:20:36+00:00

Changelog: ========== - flatpak-spawn now supports --sandbox-a11y-own-name (if supported by portal) - flatpak-spawn prints a useful error when --host isn't permitted - fixed minor leak in flatpak-spawn Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj