Flatpak 1.18.2 has been released as the second maintenance update in the 1.18 series, bringing bug fixes for sandbox handling, the system helper, portals, repository metadata validation, and build compatibility.
The most visible fix addresses a crash in the system helper that could occur when iterating through cache directories. The update also fixes another system-helper issue where the wrong D-Bus sender was tracked during pull operations.
Several sandbox-related problems have been corrected as well. Flatpak now properly handles an EAGAIN response from openat2, which previously could prevent extensions from populating inside the sandbox.
Another fix addresses a portal issue where sandbox-expose-fd-ro could pass the wrong file descriptor during a descriptor-remapping collision.
On the repository handling side, Flatpak now validates the GVariant structure of repository summaries before using generated variant readers, improving robustness when processing repository metadata.
Finally, the update prevents corrupted output when error messages contain non-UTF-8 characters, and restores build compatibility for systems using GLib versions older than 2.72.
For more details on all changes in Flatpak 1.18.2, see the changelog.
