Change logs for flatpak source package in Oracular

flatpak (1.14.8-1) unstable; urgency=medium

  * New upstream stable release 1.14.7
    - Automatically reload D-Bus session bus configuration when apps are
      installed or upgraded, ensuring that any new .service files get
      picked up
    - Allow apps to be run if the D-Bus system bus is missing or
      non-functional
    - Add several more environment variables to the list not inherited
      into the sandbox:
      + $LD_AUDIT, $LD_PRELOAD for ld.so
      + $__EGL_VENDOR_LIBRARY_DIRS, etc. for EGL
      + $VK_ADD_DRIVER_FILES, etc. for Vulkan
      + $container, when running Flatpak inside a container manager
    - Use xdg-desktop-portal-gnome, if installed, to detect whether apps
      are running in the background
    - If an app's data is migrated to a new name and then deleted, don't
      try to migrate it again, avoiding a recursive symlink loop
    - Don't leak temporary variable $new_dirs from /etc/profile.d/flatpak.sh
      into user shell sessions
    - Avoid an out-of-bounds left-shift (which is technically undefined
      behaviour) when hashing object names
    - Fix critical warnings "GFileInfo created without
      standard::is-symlink" when using /var/lib/flatpak/extension with
      testing/unstable glib2.0
    - Fix validation of documentation against Docbook DTD
    - Fix a misleading comment in the test for CVE-2024-32462
    - Fix a double-free in the test suite
    - Skip more tests if bubblewrap works but FUSE doesn't
  * New upstream stable release 1.14.8
    - Respin of 1.14.7 reverting unintended submodule changes
  * d/control: Replace one more polkitd|policykit-1 dependency with polkitd
  * d/control: Move dbus-system-bus from Depends to Recommends.
    `flatpak run` no longer has a working system bus as a hard requirement.

 -- Simon McVittie <email address hidden>  Tue, 30 Apr 2024 15:08:35 +0100

flatpak (1.14.6-1) unstable; urgency=high

  * New upstream stable release 1.14.6
    - Don't allow an executable name to be misinterpreted as a command-line
      option for bwrap(1). This prevents a sandbox escape where a malicious
      or compromised app could ask xdg-desktop-portal to generate a .desktop
      file with access to files outside the sandbox. (CVE-2024-32462)
    - Don't parse `<developer><name/></developer>` as the application name
  * d/control: Drop alternative dependencies on transitional policykit-1.
    polkitd was released in Debian 12 and Ubuntu 22.04.

 -- Simon McVittie <email address hidden>  Wed, 17 Apr 2024 19:34:28 +0100