Flatpak

ID

flatpak

Home page

https://flatpak.org

Version requirement

>= 1.2

Platforms

🅱️ BSD · 🐧 Linux · ⨂ Unix

Operations

installed · outdated · search · install · upgrade · upgrade_all · remove · cleanup · doctor

purl types

pkg:flatpak

Brewfile entry

flatpak, in Brewfile backups

CLI name

flatpak

Issues and PRs

📦 manager: flatpak

Source

meta_package_manager/managers/flatpak.py

Flatpak manages sandboxed desktop applications pulled from remotes like Flathub.

mpm covers applications only: every listing passes --app, so runtimes and SDKs stay out of scope. Listings are requested with --columns=name,application,version --ostree-verbose and parsed as tab-separated rows.

Note

All operations target the system-wide scope except cleanup which only repairs the user installation. Per-scope targeting (system vs user) is tracked in #1725.

Note

Escalation is polkit’s job, so no operation is marked sudo: flatpak hands system-scope mutations to its privileged system helper over D-Bus, which authorizes them through polkit (Flathub documents plain flatpak install). Under a strict polkit policy, unattended mutations need a rule permitting them without interactive authentication.

Caution

outdated reads each pending update’s latest version from remote-ls --updates, then runs one flatpak info per package to recover its installed version: a follow-up CLI call for every outdated app.

Note

Brewfile backups emit the bare flatpak "id" form: mpm does not capture each app’s origin remote, so brew bundle install restores through Flathub and non-Flathub apps must be edited in by hand.

What mpm adds to flatpak

Through mpm, flatpak gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover flatpak alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your flatpak commands, in mpm

You already know flatpak: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…

With flatpak

With mpm

List what’s installed

flatpak list --app --columns=name,application,version > --ostree-verbose

mpm --flatpak installed

List outdated packages

flatpak remote-ls --app --updates --columns=name,application,version --ostree-verbose

mpm --flatpak outdated

Search for a package

flatpak search gitg --ostree-verbose

mpm --flatpak search gitg

Install a package

flatpak install --noninteractive org.gnome.Dictionary

mpm install pkg:flatpak/org.gnome.Dictionary

Upgrade one package

flatpak update --noninteractive org.gnome.Dictionary

mpm --flatpak upgrade org.gnome.Dictionary

Upgrade everything

flatpak update --noninteractive

mpm --flatpak upgrade --all

Remove a package

flatpak uninstall --noninteractive org.gnome.Dictionary

mpm remove pkg:flatpak/org.gnome.Dictionary

Run health checks

flatpak repair --user --dry-run

mpm --flatpak doctor

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation

Supported

Notes

installed

✓

outdated

✓

orphans

search

✓

exact and extended search backfilled by mpm

install

✓

upgrade

✓

upgrade_all

✓

remove

✓

sync

cleanup

✓

--orphans runs the system-wide orphan sweep

doctor

✓

Selecting and configuring flatpak

Deselect flatpak for a single run with --no-flatpak, or persist the choice in your configuration:

[mpm]
flatpak = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.flatpak]
timeout = 900

mpm config-template flatpak prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around flatpak, one mpm command each:

  • Snapshot and clone a machine: mpm --flatpak dump flatpak.toml, then mpm restore flatpak.toml on the next one.

  • Export a Brewfile entry instead: mpm --flatpak dump --brewfile Brewfile.

  • Export a compliance SBOM: mpm --flatpak sbom (CycloneDX by default, --spdx for SPDX).

  • Gate CI on health: mpm --flatpak doctor relays Flatpak’s own diagnosis and exits non-zero on trouble.

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Flatpak’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: Flathub

  • Retraction: Relabel: end-of-life metadata delists the application, and the maintainer documentation describes no way to remove or roll back an individual build (maintenance)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ flatpak --version
Flatpak 1.4.2

and extracted with:

r"Flatpak\s+(?P<version>\S+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Flatpak well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ flatpak list --app --columns=name,application,version         > --ostree-verbose
Peek	com.uploadedlobster.peek	1.3.1
Fragments	de.haeckerfelix.Fragments	1.4
GNOME MPV	io.github.GnomeMpv	0.16
Syncthing GTK	me.kozec.syncthingtk	v0.9.4.3
Builder	org.flatpak.Builder

$ flatpak remote-ls --app --updates --columns=name,application,version             --ostree-verbose
GNOME Dictionary	org.gnome.Dictionary	3.26.0
Files	org.gnome.Nautilus	42.2

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --flatpak installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

  • 6.4.0 (2026-04-27)

    • Add remove operation. Closes #1775.

  • 5.19.0 (2024-11-14)

    • Fix parsing of descriptions with spaces.

  • 5.6.0 (2022-09-26)

    • A package whose version cannot be parsed now reports no version, instead of the literal string unknown.

  • 3.2.0 (2020-05-31)

    • Fix search keying its results on the package name instead of the application ID: the two columns were swapped when unpacking a result row.