1 9 ˆl–Ü4ý(&”ÔD¨ ÅÕÆCq ©‹Fÿ¿ ƒh¹a–Ü4ý(&”ÔD¨ ÅÕÆCq ©‹FÿÅ Normal "ˆl–ß=¿JJj"Tâ‚ ÆÛ¸ÔÅ£Á ƒh¹¿Æ1 $ˆl–äY>” ªC]Ši@»pA¸Tţ …œ}¶ÀÇ?÷Changes in 1.12.9 ~~~~~~~~~~~~~~~~~ Security fixes: * Don't allow an executable name to be misinterpreted as a command-line option for bwrap(1). This prevents a sandbox escape where a malicious or compromised app could ask xdg-desktop-portal to generate a .desktop file with access to files outside the sandbox. (CVE-2024-32462) Changes in 1.12.8 ~~~~~~~~~~~~~~~~~ Released: 2023-03-16 Security fixes: * Escape special characters when displaying permissions and metadata, preventing malicious apps from manipulating the appearance of the permissions list using crafted metadata (CVE-2023-28101). * If a Flatpak app is run on a Linux virtual console (tty1, tty2, etc.), don't allow copy/paste via the TIOCLINUX ioctl (CVE-2023-28100). Note that this is specific to virtual consoles: Flatpak is not vulnerable to this if run from a graphical terminal emulator such as xterm, gnome-terminal or Konsole. Other bug fixes: * Update the SELinux module to explicitly permit the system helper have read access to /etc/passwd and systemd-userdbd, read and lock access to /var/lib/flatpak, and watch files inside $libexecdir (#4852, #4855, #4892; Red Hat #2071217, #2071215, #2070741, #2053634, #2070350) * If an app update is blocked by parental controls policies, clean up the temporary deploy directory (#5146) * Fix Autotools build with versions of gpgme that no longer provide gpgme-config(1) (#5173) * Remove some unreachable code (Coverity: CID 1514265) * Add missing handling for some D-Bus errors Changes in 1.12.7 ~~~~~~~~~~~~~~~~~ Released: 2022-03-14 * We now allow networked access to X11 and PulseAudio services if that is configured, and the application has network access. (#397, #3908, #4702) * Absolute paths in WAYLAND_DISPLAY now work (#4752) * Allow apps that were built with Flatpak 1.13.x to export AppStream metadata in share/metainfo (#4350, #4599) * Most commands now work if /var/lib/flatpak exists but /var/lib/flatpak/repo does not, and will automatically populate the repo directory if possible (#4111) * Consistently pass relative subpaths to libostree, working around a bug in libostree < 2021.6 when used with GLib >= 2.71 (#4805) * Fix some memory leaks in GVariant data processing Changes in 1.12.6 ~~~~~~~~~~~~~~~~~ Released: 2022-02-21 * Fix a bug that sometimes caused repo corruption in case downloads are interrupted or canceled, necessitating a "flatpak repair" to recover (#3479, #4258) * More reliably detect the GTK theme (#4754) * Fix history command unit test in some edge cases (#4764) * Improve NEWS for 1.12.5 * Translation update: pt_BR Changes in 1.12.5 ~~~~~~~~~~~~~~~~~ Released: 2022-02-11 * Fixed a case where temporary data was sometimes left in /var/lib/flatpak/appstream, and we now detect such leftover data and remove it. (#4735) * Fix regressions in `flatpak history` since 1.9.1 (#4121, #4332) - Don't display the appstream branch used internally - Don't display temporary repositories used internally - Warn instead of failing if other non-app, non-runtime refs are found - Don't set up an unnecessary polkit agent for `flatpak history` - Add test coverage * Don't propagate GStreamer-related environment variables into sandbox (#4728) * Fix a typo in an error message * Fix incorrect year in NEWS for 1.12.4 release * Translation update: pl Changes in 1.12.4 ~~~~~~~~~~~~~~~~~ Released: 2022-01-18 This is a regression fix update, reverting non-backwards-compatible behaviour changes in the solution previously chosen for CVE-2022-21682. Flatpak 1.12.3 and 1.10.6 changed the behaviour of `--nofilesystem=host` and `--nofilesystem=home` in a way that was not backwards-compatible in all cases. For example, some Flatpak users previously used a global `flatpak override --nofilesystem=home` or `flatpak override --nofilesystem=host`, bu