fedora-qa / blocker-review

#2101 [flatpak] flatpak-1.17.4 is available | rhbz#2456353
Closed by blockerbot. Opened by blockerbot.

Closed
Reopen Issue

Bug details: ** https://bugzilla.redhat.com/show_bug.cgi?id=2456353 **
Information from BlockerBugs App:
2456353

Current vote summary

Commented but haven't voted yet: lruzicka

The votes have been last counted at 2026-04-13 18:24 UTC and the last processed comment was #comment-1010979

To learn how to vote, see:
https://pagure.io/fedora-qa/blocker-review
A quick example: BetaBlocker +1 (where the tracker name is one of BetaBlocker/FinalBlocker/BetaFE/FinalFE/0Day/PreviousRelease and the vote is one of +1/0/-1)

The latest 1.17.6 Flatpak release brings important CVE fixes and other fixes.

FinalBlocker +1
FinalFE +1

FinalFE +1

FinalFE +1

FinalFE +1
AGREED AcceptedFinalFE

The following votes have been closed:

The update that this is attempting to block is now obsolete.

FinalBlocker -1

boniboyblue, This is about the latest 1.17.6 update, not the original 1.17.4 one.

boniboyblue, This is about the latest 1.17.6 update, not the original 1.17.4 one.

My apologies - the bug and the title of this seems to indicate it was for 1.17.4.

I don't really see why this would be a blocker. I'm also not really seeing a situation where a person would be installing Flatpaks, but can't pull this in as a 0-day update. That being said, this seems safe enough to pull in and having CVE fixes ship on release media is a good thing.

FinalBlocker -1
FinalFE +1

I too think that bringing in security fixes (in the form of CVEs) is important and I hope I am doing the voting process correctly.
FinalBlocker -1
FinalFE +1

Here's the criterion:
https://fedoraproject.org/wiki/Fedora_44_Final_Release_Criteria#Security_bugs

Both CVEs are rated Moderate by RH, so they don't seem to hit the criterion.

FinalBlocker -1

AGREED RejectedFinalBlocker

Discussed at the 2026-04-13 (blocker / freeze exception) review meeting:

The CVE criterion says CVEs rated Important or above on RH's scale can be blockers, and the two cited here are both Moderate. Note this is already accepted FE and will be pushed stable soon anyhow.

https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2026-04-13/f44-blocker-review.2026-04-13-16.00.log.txt

The following votes have been closed:

Metadata Update from @blockerbot:
- Issue status updated to: Closed (was: Open)

Release F44 is no longer tracked by BlockerBugs, closing this ticket.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.