Flatpak

ID

flatpak

Home page

https://flatpak.org

Upstream stars

⭐ 5,022

Last commit

2026-08-11

Version requirement

>= 1.2

Platforms

🅱️ BSD · 🐧 Linux · ⨂ Unix

Operations

installed · outdated · search · install · upgrade · upgrade_all · remove · cleanup · doctor

purl types

pkg:flatpak

CLI name

flatpak

Issues and PRs

📦 manager: flatpak

Source

meta_package_manager/managers/flatpak.py

Flatpak manages sandboxed desktop applications pulled from remotes like Flathub.

mpm covers applications only: every listing passes --app, so runtimes and SDKs stay out of scope. Listings are requested with --columns=name,application,version --ostree-verbose and parsed as tab-separated rows.

Note

All operations target the system-wide scope except cleanup which only repairs the user installation. Per-scope targeting (system vs user) is tracked in #1725.

Note

Escalation is polkit’s job, so no operation is marked sudo: flatpak hands system-scope mutations to its privileged system helper over D-Bus, which authorizes them through polkit (Flathub documents plain flatpak install). Under a strict polkit policy, unattended mutations need a rule permitting them without interactive authentication.

Caution

outdated reads each pending update’s latest version from remote-ls --updates, then runs one flatpak info per package to recover its installed version: a follow-up CLI call for every outdated app.

Note

A --brewfile dump emits the bare flatpak "id" form, mpm capturing no origin remote per app. See Snapshot and export, section “Flatpak remote”.

What mpm adds to flatpak

Through mpm, flatpak gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover flatpak alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your flatpak commands, in mpm

You already know flatpak: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With flatpak	With mpm
List what’s installed	flatpak list --app --columns=name,application,version > --ostree-verbose	mpm --flatpak installed
List outdated packages	flatpak remote-ls --app --updates --columns=name,application,version --ostree-verbose	mpm --flatpak outdated
Search for a package	flatpak search gitg --ostree-verbose	mpm --flatpak search gitg
Install a package	flatpak install --noninteractive org.gnome.Dictionary	mpm install pkg:flatpak/org.gnome.Dictionary
Upgrade one package	flatpak update --noninteractive org.gnome.Dictionary	mpm --flatpak upgrade org.gnome.Dictionary
Upgrade everything	flatpak update --noninteractive	mpm --flatpak upgrade --all
Remove a package	flatpak uninstall --noninteractive org.gnome.Dictionary	mpm remove pkg:flatpak/org.gnome.Dictionary
Run health checks	flatpak repair --user --dry-run	mpm --flatpak doctor

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated	✓
orphans
search	✓	exact and extended search backfilled by mpm
install	✓
upgrade	✓
upgrade_all	✓
remove	✓
sync
cleanup	✓	--orphans runs the system-wide orphan sweep
doctor	✓

Selecting and configuring flatpak

Deselect flatpak for a single run with --no-flatpak, or persist the choice in your configuration:

[mpm]
flatpak = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.flatpak]
timeout = 900

mpm config-template flatpak prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around flatpak, one mpm command each:

• Snapshot and clone a machine: mpm --flatpak dump flatpak.toml, then mpm restore flatpak.toml on the next one.

• Export a Brewfile entry instead: mpm --flatpak dump --brewfile Brewfile.

• Export a compliance SBOM: mpm --flatpak sbom (CycloneDX by default, --spdx for SPDX).

• Gate CI on health: mpm --flatpak doctor relays Flatpak’s own diagnosis and exits non-zero on trouble.

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Flatpak’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: Flathub

• Retraction: Relabel: end-of-life metadata delists the application, and the maintainer documentation describes no way to remove or roll back an individual build (maintenance)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ flatpak --version
Flatpak 1.4.2

and extracted with:

r"Flatpak\s+(?P<version>\S+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Flatpak well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ flatpak list --app --columns=name,application,version         > --ostree-verbose
Peek	com.uploadedlobster.peek	1.3.1
Fragments	de.haeckerfelix.Fragments	1.4
GNOME MPV	io.github.GnomeMpv	0.16
Syncthing GTK	me.kozec.syncthingtk	v0.9.4.3
Builder	org.flatpak.Builder

$ flatpak remote-ls --app --updates --columns=name,application,version             --ostree-verbose
GNOME Dictionary	org.gnome.Dictionary	3.26.0
Files	org.gnome.Nautilus	42.2

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --flatpak installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Upstream project

Metrics	flatpak/flatpak
Activity
Popularity
Metadata

Changelog

• 6.4.0 (2026-04-27)

  • Add remove operation. Closes #1775.

• 5.19.0 (2024-11-14)

  • Fix parsing of descriptions with spaces.

• 5.6.0 (2022-09-26)

  • A package whose version cannot be parsed now reports no version, instead of the literal string unknown.

• 3.2.0 (2020-05-31)

  • Fix search keying its results on the package name instead of the application ID: the two columns were swapped when unpacking a result row.