Bubblewrap sandbox fix and glibc heap overflow

Security updates landed for sandbox isolation tooling and the GNU C Library. The higher-impact change closes a path for writes outside a bubblewrap sandbox during setup.

Bubblewrap 0.12.0 closes sandbox escape on setup

Bubblewrap 0.12.0 fixes a symlink traversal flaw that allowed writes outside the sandbox during setup. The issue affects Flatpak, which relies on bubblewrap for isolation. Developers shipping or running sandboxed applications should treat the update as a priority to restore the intended confinement boundary.

Glibc advisory for uncommon fopen heap overflow

The GNU C Library published a security advisory covering CVE-2026-18374, a heap overflow in uncommon fopen usage with the ccs= option. The issue carries a CVSS score of 4.9. Most code paths are unaffected, but maintainers should review whether their builds or callers exercise the reported case.