---
File: DEP-11
Version: '1.0'
Origin: ubuntu-stonking-proposed-main
MediaBaseUrl: https://appstream.ubuntu.com/media/stonking-proposed
Priority: 30
Time: 20261026T124506
---
Type: console-application
ID: org.freedesktop.fwupd
Package: fwupd
ProjectLicense: LGPL-2.0+
Name:
  C: fwupd
Summary:
  C: Update device firmware on Linux
Description:
  C: >-
    <p>
          This project aims to make updating firmware on Linux automatic, safe and
          reliable.
          You can either use a GUI software manager like GNOME Software to view and
          apply updates, the command-line tool or the D-Bus interface directly.
        </p>
    <p>
          The fwupd process is a system daemon to allow session software to update
          device firmware on your local machine.
          It is designed for desktops, but this project is also usable on phones,
          tablets and on headless servers.
        </p>
Developer:
  id: org.fwupd
  name:
    C: The fwupd authors
Url:
  bugtracker: https://github.com/fwupd/fwupd/issues
  homepage: https://fwupd.org/
  translate: https://hosted.weblate.org/projects/fwupd/fwupd/
  vcs-browser: https://github.com/fwupd/fwupd
Provides:
  binaries:
  - fwupdmgr
  - fwupdtool
Languages:
- locale: en_GB
  percentage: 100
- locale: en_US
  percentage: 100
Releases:
- version: 2.1.6
  type: stable
  unix-timestamp: 1782864000
  description:
    C: >-
      <p>
                This release adds the following features:
              </p>
      <ul>
        <li>Add --filter-protocol to fwupdmgr and fwupdtool</li>
        <li>Add a new HSI attribute for coreboot verified boot</li>
        <li>Add hashes for the latest DBX for offline machines</li>
        <li>Allow parsing Hayden Bridge Thunderbolt firmware</li>
        <li>Handle HPE Redfish reset-required updates</li>
        <li>Ignore efivar free space on VMWare, GCE and EC2 VMs</li>
        <li>Prevent FwupdClient from downloading the same file multiple times</li>
        <li>Split UEFI Memory Protection HSI from NX Compat</li>
      </ul>

      <p>This release fixes the following bugs:</p>

      <ul>
        <li>Avoid an integer overflow in the ifwi-cpd manifest length check</li>
        <li>Avoid truncating the AMD Kria FRU board area offset</li>
        <li>Block dbx updates on ASUSTeK GL553VD</li>
        <li>Check SMEE hardware bit directly for AMD SME detection</li>
        <li>Create the ESP OS directory if not found</li>
        <li>Detect the BCR device on Celeron LPC SPI controllers</li>
        <li>Fall back to a binary firmware when no specific MTD image type is set</li>
        <li>Fix AI table clear behavior of the elantp boot code.</li>
        <li>Fix errors with fwupd-refresh service not working properly</li>
        <li>Fix Genesys GL32xx device locker crash due to argument mismatch</li>
        <li>Fix installing KEK updates when using snapd by sending the correct blob</li>
        <li>Fix integer underflow when Elan firmware is smaller than one page</li>
        <li>Fix possible NULL pointer dereference when updating SteelSeries firmware</li>
        <li>Fix the display of the HP UEFI db certificate</li>
        <li>Improved usi-dock progress reporting behavior</li>
        <li>Increase the parser item limit from 100 to 1000 for large KEKs</li>
        <li>Log out of the Redfish session when required on HPE hardware</li>
        <li>Only show 'authenticating' after a short delay</li>
        <li>Re-process the device metadata when required after all devices are added</li>
        <li>Require sealed memfd input to prevent possible TOCTOU attacks</li>
        <li>Sanitise the Jabra GNP device version in a more secure way</li>
        <li>Validate raydium-tp buffer size before direct index access</li>
        <li>Validate that Lenovo dock device-reported program sizes are valid</li>
      </ul>

      <p>This release adds support for the following hardware:</p>

      <ul>
        <li>Lenovo dual-bank accessory dongle and paired peripherals</li>
      </ul>
- version: 2.1.5
  type: stable
  unix-timestamp: 1780963200
  description:
    C: >-
      <p>
                This release adds the following features:
              </p>
      <ul>
        <li>Allow overriding the detected CPU vendor to allow more self tests</li>
        <li>Allow updating the Windows-specific UEFI CA on dual boot machines</li>
        <li>Install the db updates on broken hardware with new firmware</li>
      </ul>

      <p>This release fixes the following bugs:</p>

      <ul>
        <li>Add tests for the vbe, upower, uefi-sbat, pci-bcr, mtd, gpio and msr plugins</li>
        <li>Check the array index in some runtime-generated code</li>
        <li>Claim the udev netlink backend before old libusb versions</li>
        <li>Expand the netlink socket buffer to prevent packet loss during event floods</li>
        <li>Fix a msgpack regression when updating some Huddly cameras</li>
        <li>Fix HID feature read buffer size in goodix-tp device probe</li>
        <li>Fix reproducible builds</li>
        <li>Fix the check-reboot-needed command</li>
        <li>Increase the i2c-hid re-bind delay for synaptics-rmi PID 0x96e7</li>
        <li>Parse the dell-dock marketing name in a more safe way</li>
        <li>Set a firmware size limit on intel-gsc aux and oprom firmware types</li>
        <li>Simplify the engine by only loading the config object once</li>
        <li>Use a cryptographically secure RNG when building the idle and inhibit IDs</li>
        <li>Use a more appropriate firmware maximum size for Huddly cameras</li>
      </ul>

      <p>This release adds support for the following hardware:</p>

      <ul>
        <li>Elan touchscreens</li>
      </ul>
- version: 2.1.4
  type: stable
  unix-timestamp: 1780012800
  description:
    C: >-
      <p>
                This release adds the following features:
              </p>
      <ul>
        <li>Add a libcrypto-based JCat implementation for Android</li>
        <li>Add support for NixOS to the quickstart script</li>
        <li>Add support for the Compal BIOS version format</li>
        <li>Allow a remote to specify that a username or password is required</li>
        <li>Allow storing a per-user password in XDG_CONFIG_HOME</li>
        <li>Detect encrypted swap devices below device-mapper</li>
        <li>Ensure that all firmware subclasses set the maximum size</li>
        <li>Remove the flashrom plugin</li>
        <li>Save the SMBIOS BiosReleaseDate string to uploaded reports</li>
        <li>Tell Star Labs coreboot users to manually update when required</li>
      </ul>

      <p>This release fixes the following bugs:</p>

      <ul>
        <li>Add a retry limit when updating failing Goodix MoC devices</li>
        <li>Add several bounds checks for when updating Dell docks</li>
        <li>Add vendor name and name for the various Framework UEFI certificates</li>
        <li>Allow recovery if the Lenovo dock internal state is invalid</li>
        <li>Avoid trunctaion when calculating the AMD GPU atombios size</li>
        <li>Check firmware size against Novatek flash start address</li>
        <li>Check for config offset overflow when updating Synaptics RMI devices</li>
        <li>Check for multiplication overflow in BCM57xx stage1 size calculation</li>
        <li>Check for overflow when writing to CCGX DMC devices</li>
        <li>Check stream size before calculating Legion HID ID offset</li>
        <li>Check stream size before subtracting Ilitek ITS CRC length</li>
        <li>Clear Sunplus camera download state if the previous flash failed</li>
        <li>Do not show plugin warnings when using --version</li>
        <li>Filter the install flags provided by the D-Bus client</li>
        <li>Fix a potential heap buffer overflow in FDT strlist parsing</li>
        <li>Fix a potential heap buffer overflow in Nordic HID peer validation</li>
        <li>Fix a potential OOB read in DFOTA modem response parsing</li>
        <li>Fix a potential path traversal vulnerability in firmware backup</li>
        <li>Fix a regression when searching for file magic</li>
        <li>Fix a regression when using report-export --sign</li>
        <li>Fix fwupd domain check bypass when using Qubes</li>
        <li>Ignore efivar free space requirement on Microsoft Hyper-V hosts</li>
        <li>Limit the number of hints a D-Bus client can set</li>
        <li>Limit the size of parsed USB descriptors to ~64KiB</li>
        <li>Make it easy to enable an authenticated remote</li>
        <li>Make the Novatek boot update more reliable</li>
        <li>Only read BCR from Intel SPI controllers</li>
        <li>Prevent a possible division by zero error in the progressbar code</li>
        <li>Prevent decompression bomb attacks in uSWID zlib payload parsing</li>
        <li>Prevent NVRAM-seeded ptential path traversal when loading ESP files</li>
        <li>Redact the username and password of remotes when using a non-active console</li>
        <li>Require authorization for firmware installation on emulated devices</li>
        <li>Require authorization for more D-Bus methods from non-local users</li>
        <li>Restrict Curl protocols to prevent potential SSRF attacks</li>
        <li>Restrict ModifyRemote to prevent a supply-chain redirection</li>
        <li>Show a short easy-to-read string as the Pixart touchpad name</li>
        <li>Tolerate post-quantum CA PKCS#7 failures when using Qubes</li>
        <li>Validate ACPI PHAT specific data offset before parsing</li>
        <li>Validate Corsair write size before subtracting header size</li>
        <li>Validate DFU address offset before parsing the header</li>
        <li>Validate Elan touchpad IAP address is within firmware bounds</li>
        <li>Validate Logitech TAP AP region bounds before calculating size</li>
        <li>Validate payload length is large enough for FPC sec-link</li>
        <li>Validate sector range before writing pixart-tp firmware</li>
        <li>Validate VBE area start does not exceed area size</li>
        <li>Validate write offset does not exceed TI TPS6598x stream size</li>
      </ul>

      <p>This release adds support for the following hardware:</p>

      <ul>
        <li>Egis MoC devices with PID 9201</li>
        <li>Intel Arc Pro B65 and Arc Pro B70 (#10389)</li>
        <li>Lenovo dock devices in 'provisioned' mode</li>
        <li>Pixart TP devices with PID 1343</li>
        <li>Several GigaDevice and Puya SPI chips</li>
      </ul>
- version: 2.1.3
  type: stable
  unix-timestamp: 1778544000
  description:
    C: >-
      <p>
                This release adds the following features:
              </p>
      <ul>
        <li>Add support for Redfish bearer token authentication</li>
        <li>Add support for several XMC SPI chips</li>
        <li>Parse JCat files in libfwupd without using libjcat</li>
      </ul>

      <p>This release fixes the following bugs:</p>

      <ul>
        <li>Allow configuring a Redfish URI with a path prefix</li>
        <li>Avoid firmware matching errors for Cat-6 and Cat-12 modems</li>
        <li>Calculate and export a floating point percentage progress value</li>
        <li>Do not print clean remote success message if aborted</li>
        <li>Do not probe all Nordic devices with USB VID 0x1915</li>
        <li>Fix force table support in Elan IC types 0x13 and 0x14</li>
        <li>Fix Raydium information check flow to avoid incorrect validation</li>
        <li>Fix the Thunderbolt version number by ignoring the reserved bits</li>
        <li>Load well-known paths in dbxtool to prevent a regression</li>
        <li>Match a specific Raydium device to prevent resetting older hardware</li>
        <li>Only copy the HIDRAW USB properties if a DS-20 has been provided</li>
        <li>Use CA1 for a SK Hynix NVMe drive</li>
      </ul>

      <p>This release adds support for the following hardware:</p>

      <ul>
        <li>SHIFT6mq and SHIFTphone 8</li>
      </ul>
ContentRating:
  oars-1.1:
    social-info: moderate