flatpak - Debian Package Tracker

general

source: flatpak (main)
version: 1.18.0-1
maintainer: Utopia Maintenance Team (archive) (DMD)
uploaders: Simon McVittie [DMD] – Matthias Klumpp [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.10.8-0+deb11u2
o-o-sec: 1.10.8-0+deb11u3
oldstable: 1.14.10-1~deb12u2
old-sec: 1.14.10-1~deb12u2
old-bpo: 1.16.6-1~deb13u1~bpo12+1
stable: 1.16.6-1~deb13u1
stable-sec: 1.16.6-1~deb13u1
testing: 1.16.6-1
unstable: 1.18.0-1

versioned links

1.10.8-0+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.10.8-0+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.14.10-1~deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16.6-1~deb13u1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16.6-1~deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.18.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

flatpak (26 bugs: 0, 24, 2, 0)
flatpak-tests
gir1.2-flatpak-1.0
libflatpak-dev
libflatpak-doc
libflatpak0

action needed

4 security issues in bullseye high

There are 4 open security issues in bullseye.

4 important issues:

CVE-2026-34078: Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
CVE-2026-34079: Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.
TEMP-1132945-4CEFB2:
TEMP-1132946-5EDD2C:

Created: 2026-04-08 Last update: 2026-06-09 01:01

1 bug tagged help in the BTS normal

The BTS contains 1 bug tagged help, please consider helping the maintainer in dealing with it.

Created: 2025-06-13 Last update: 2026-06-11 17:17

Depends on packages which need a new maintainer normal

The packages that flatpak depends on which need a new maintainer are:

docbook-xsl (#802370)
- Build-Depends: docbook-xsl

Created: 2023-09-01 Last update: 2026-06-11 16:00

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-06-09 Last update: 2026-06-09 06:00

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2026-01-25 Last update: 2026-06-09 09:01

testing migrations

excuses:
- Migration status for flatpak (1.16.6-1 to 1.18.0-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Reproducibility regression on amd64: flatpak, flatpak-tests, gir1.2-flatpak-1.0, libflatpak-dev, libflatpak0
- ∙ ∙ Too young, only 2 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/f/flatpak.html
- ∙ ∙ Autopkgtest for flatpak/1.18.0-1: amd64: Pass, arm64: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻ (reference ♻), loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), riscv64: No tests, superficial or marked flaky ♻, s390x: No tests, superficial or marked flaky ♻
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-06-08] Accepted flatpak 1.18.0-1 (source) into unstable (Simon McVittie)
[2026-04-25] Accepted flatpak 1.14.10-1~deb12u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Simon McVittie)
[2026-04-22] Accepted flatpak 1.14.10-1~deb12u2 (source) into oldstable-security (Debian FTP Masters) (signed by: Simon McVittie)
[2026-04-18] Accepted flatpak 1.16.6-1~deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Simon McVittie)
[2026-04-13] Accepted flatpak 1.17.6-1 (source) into experimental (Simon McVittie)
[2026-04-13] Accepted flatpak 1.16.6-1~deb13u1~bpo12+1 (source) into oldstable-backports (Simon McVittie)
[2026-04-13] flatpak 1.16.6-1 MIGRATED to testing (Debian testing watch)
[2026-04-12] Accepted flatpak 1.16.6-1~deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Simon McVittie)
[2026-04-10] Accepted flatpak 1.16.6-1 (source) into unstable (Simon McVittie)
[2026-04-10] Accepted flatpak 1.16.5-1 (source) into unstable (Simon McVittie)
[2026-04-08] Accepted flatpak 1.16.4-2 (source) into unstable (Simon McVittie)
[2026-04-07] Accepted flatpak 1.17.3-2 (source) into experimental (Simon McVittie)
[2026-04-07] Accepted flatpak 1.16.4-1 (source) into unstable (Simon McVittie)
[2026-03-19] Accepted flatpak 1.17.3-1 (source) into experimental (Simon McVittie)
[2026-02-27] Accepted flatpak 1.16.3-1~deb13u1 (source) into proposed-updates (Debian FTP Masters)
[2026-01-30] flatpak 1.16.3-1 MIGRATED to testing (Debian testing watch)
[2026-01-24] Accepted flatpak 1.16.3-1 (source) into unstable (Simon McVittie)
[2026-01-01] Accepted flatpak 1.16.2-1~deb13u1 (source) into proposed-updates (Debian FTP Masters)
[2025-12-25] flatpak 1.16.2-1 MIGRATED to testing (Debian testing watch)
[2025-12-25] flatpak 1.16.2-1 MIGRATED to testing (Debian testing watch)
[2025-12-19] Accepted flatpak 1.16.2-1 (source) into unstable (Simon McVittie)
[2025-12-17] Accepted flatpak 1.17.2-1 (source) into experimental (Simon McVittie)
[2025-10-06] flatpak 1.16.1-3 MIGRATED to testing (Debian testing watch)
[2025-09-30] Accepted flatpak 1.16.1-3 (source) into unstable (Simon McVittie)
[2025-08-21] flatpak 1.16.1-2 MIGRATED to testing (Debian testing watch)
[2025-08-14] Accepted flatpak 1.16.1-2 (source) into unstable (Simon McVittie)
[2025-05-30] flatpak 1.16.1-1 MIGRATED to testing (Debian testing watch)
[2025-05-29] Accepted flatpak 1.16.1-1~bpo12+1 (source) into stable-backports (Simon McVittie)
[2025-05-13] Accepted flatpak 1.16.0-2~bpo12+1 (all amd64 source) into stable-backports (Debian FTP Masters) (signed by: Simon McVittie)
[2025-05-12] Accepted flatpak 1.16.1-1 (source) into unstable (Simon McVittie)

bugs [bug history graph]

all: 30
RC: 0
I&N: 28
M&W: 2
F&P: 0
patch: 0
help: 1

links

homepage
lintian (0, 3)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
screenshots
l10n (-, 80)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.18.0-1