Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package flatpak for openSUSE:Factory checked in at 2026-08-19 17:55:43 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/flatpak (Old) and /work/SRC/openSUSE:Factory/.flatpak.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "flatpak" Wed Aug 19 17:55:43 2026 rev:102 rq:1371781 version:1.18.1 Changes: -------- --- /work/SRC/openSUSE:Factory/flatpak/flatpak.changes 2026-06-11 17:25:29.653622960 +0200 +++ /work/SRC/openSUSE:Factory/.flatpak.new.1258/flatpak.changes 2026-08-19 17:56:25.605915060 +0200 @@ -1,0 +2,44 @@ +Tue Aug 11 17:04:33 UTC 2026 - Bjørn Lie <[email protected]> + +- Update to version 1.18.1: + + Security fixes: + - Fix sandbox escape with full host filesystem read/write + access via symlink attack on app data directories + (GHSA-8688-9x26-hhxj) + - Fix local root privilege escalation via revokefs symlink path + traversal and commit tampering (GHSA-qrwq-7qwx-q9rp) + - Fix arbitrary root write via symlink and path traversal in + extra-data extraction (GHSA-fqx6-vh4p-42cg) + - Fix arbitrary root write via path traversal in `flatpak + build-init` (GHSA-8qxj-x646-phcm) + - Fix arbitrary host file read via hardlink path traversal in + OCI archive extraction (GHSA-9rww-v4mm-x4jg) + - Fix path traversal via unvalidated architecture parameter in + DeployAppstream (GHSA-v2gw-v9h5-9q4x) + - Fix buffer overflow in OCI delta stream path names on 32-bit + systems (GHSA-jr92-2v97-wgvc) + - Fix fixed-filename writes to arbitrary locations via symlink + attack on .ld.so (GHSA-99wv-m8rp-g58x) + - Fix extension metadata path traversal allowing host + filesystem probing and unintended mount locations + (GHSA-w69g-9x8j-7p8f) + - Fix anti-downgrade bypass allowing unprivileged users to + downgrade system apps (GHSA-q4gr-vc25-57m5) + + Bug fixes: + - Fix portal flatpak-spawn environment handling regression + - Fix negated permission strings for allow and share run + options + - Fix build failure when exporting metainfo releases.xml files + - Fix crashes in the portal update monitor and OCI JSON + handling + - Error out if file forwarding of empty paths is attempted + - Check OCI signatures from the mirrored repo in the system + helper instead of fetching from the lookaside server + - Apply TLS certs to OCI registry requests and propagate stream + write failures to curl + - Fix GI annotation for flatpak_instance_get_all + - Cleanup of Bash completion + - Numerous internal fixes for crashes, error handling, and + hardening + +------------------------------------------------------------------- Old: ---- flatpak-1.18.0.tar.xz New: ---- flatpak-1.18.1.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ flatpak.spec ++++++ --- /var/tmp/diff_new_pack.TLin2k/_old 2026-08-19 17:56:26.739955348 +0200 +++ /var/tmp/diff_new_pack.TLin2k/_new 2026-08-19 17:56:26.742955455 +0200 @@ -30,7 +30,7 @@ %define support_environment_generators 1 %endif Name: flatpak -Version: 1.18.0 +Version: 1.18.1 Release: 0 Summary: OSTree based application bundles management License: LGPL-2.1-or-later ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.TLin2k/_old 2026-08-19 17:56:26.783956911 +0200 +++ /var/tmp/diff_new_pack.TLin2k/_new 2026-08-19 17:56:26.785956982 +0200 @@ -1,6 +1,6 @@ -mtime: 1780933997 -commit: 1f42a3274dcb70e0e5bad89548ff1f9886f59bfedd1d935b52ff525a20ec56e7 +mtime: 1786606426 +commit: 551ced48d109f8bffdd1319b78c1ee69df22949c823ed4cdaaba987f371c99d4 url: https://src.opensuse.org/GNOME/flatpak -revision: 1f42a3274dcb70e0e5bad89548ff1f9886f59bfedd1d935b52ff525a20ec56e7 +revision: 551ced48d109f8bffdd1319b78c1ee69df22949c823ed4cdaaba987f371c99d4 projectscmsync: https://src.opensuse.org/GNOME/_ObsPrj ++++++ _service ++++++ --- /var/tmp/diff_new_pack.TLin2k/_old 2026-08-19 17:56:26.808957800 +0200 +++ /var/tmp/diff_new_pack.TLin2k/_new 2026-08-19 17:56:26.811957906 +0200 @@ -3,7 +3,7 @@ <service name="obs_scm" mode="manual"> <param name="scm">git</param> <param name="url">https://github.com/flatpak/flatpak.git</param> - <param name="revision">1.18.0</param> + <param name="revision">1.18.1</param> <param name="versionformat">@PARENT_TAG@+@TAG_OFFSET@</param> <param name="versionrewrite-pattern">(.*)\+0</param> <param name="versionrewrite-replacement">\1</param> ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-13 09:33:46.000000000 +0200 @@ -0,0 +1,5 @@ +*.obscpio +*.osc +_build.* +.pbuild +osc-collab.* ++++++ flatpak-1.18.0.tar.xz -> flatpak-1.18.1.tar.xz ++++++ ++++ 38607 lines of diff (skipped) ++++++ flatpak.obsinfo ++++++ --- /var/tmp/diff_new_pack.TLin2k/_old 2026-08-19 17:56:27.349977020 +0200 +++ /var/tmp/diff_new_pack.TLin2k/_new 2026-08-19 17:56:27.359977375 +0200 @@ -1,5 +1,5 @@ name: flatpak -version: 1.18.0 -mtime: 1780922193 -commit: 5de2b58bdafde88515d9d6b9189bd1cfd3b88c46 +version: 1.18.1 +mtime: 1786404170 +commit: abc06c8bf434171e931426e76a9eb0bfe17cfabd
