SECURITY Signal 157
Flatpak 1.18.3 Released With Security Fixes for Bubblewrap and xdg-dbus-proxy
↗
Flatpak 1.18.3 is out with updated Bubblewrap and xdg-dbus-proxy components, plus fixes for regressions introduced in version 1.18.2.
The release of Flatpak 1.18.3 addresses important security vulnerabilities in dependency components, which is crucial for maintaining the integrity of applications deployed via Flatpak. Additionally, the regression fixes enhance the overall functionality and stability of application builds, particularly for users operating under SELinux.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The update resolves security issues identified as CVE-2026-87766 and CVE-2026-93676.
It fixes regressions affecting application building on systems using SELinux.
The release also addresses a crash issue when installing Flatpak bundles with explicit key bytes.
THE READ
What the cluster adds up to.
Flatpak 1.18.3 introduces critical security updates to its dependencies, specifically addressing vulnerabilities in Bubblewrap and xdg-dbus-proxy. Updating to this version is essential for engineers who rely on Flatpak for containerized application deployment to mitigate potential security risks.
The fixes for regressions from version 1.18.2 are particularly relevant for developers working in environments that utilize SELinux. These changes should reduce the likelihood of encountering build issues, ensuring smoother development processes and application deployment.
The update not only enhances security but also improves the reliability of subsandbox startups initiated through flatpak-spawn. Engineers should prioritize implementing this update to avoid crashes related to specific command options, thus improving user experience and stability.
While the update is beneficial, engineers need to ensure their development environments are compatible with the new versions of the bundled components. Users must also be aware of the possibility of new issues arising from other dependencies not addressed in this release.
Overall, adopting Flatpak 1.18.3 will require engineers to test their applications against the new version to confirm compatibility and functionality, particularly if they experienced issues with the previous version.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER