Weekly sandbox re-pin held: bubblewrap 0.9.0-1ubuntu0.3 reverts the CVE-2026-87766 fix #1329

This week's sandbox re-pin is held rather than taken: bubblewrap 0.9.0-1ubuntu0.3 is a revert of the CVE fix that 0ubuntu0.2 shipped, not a fix on top of it.

bubblewrap (0.9.0-1ubuntu0.3) noble-security; urgency=medium

  * SECURITY REGRESSION: Incompatibility with Flatpak (LP: #2167621)
    - debian: Drop CVE-2026-87766

CVE-2026-87766 is improper link resolution during sandbox setup, and bubblewrap is tend's boundary — so this is the one package where taking the newer version moves the security posture backwards. The incompatibility that motivated the revert is with Flatpak, which nothing here uses. Holding is the right pin for tend on its merits, not only the cautious one.

What the hold parks

The four constants in shared/steps/install-sandbox-runtime.sh move together or not at all, and 0ubuntu0.2 is gone from every pocket at any later instant — so the instant cannot move without taking 0.3:

npm --before reads the same instant, so the parked set also holds sandbox_runtime_version at 0.0.76. SRT 0.0.77 published 2026-09-18T22:13:36Z, after the pinned instant, and cannot be taken while it stands. socat and ripgrep did not move this week, so nothing else is waiting.

The cost of holding, and what bounds it

A GitHub-hosted runner is rolled back onto the pin, which still resolves — snapshots are immutable, so 0ubuntu0.2 stays installable from the pinned instant indefinitely. A self-hosted runner that has already taken 0.3 fails its job instead, by design:

This runner is ahead of Tend's pin (…) and Tend does not downgrade a self-hosted host.

So the hold is free for hosted runners and breaking for self-hosted noble runners that track security updates. That is what makes this a decision rather than a standing preference.

The decision

Canonical's revert is presumably temporary — the CVE is real and the Flatpak breakage is the kind of thing a 0ubuntu0.4 fixes properly. The weekly sweep re-resolves on its own, so doing nothing takes the fix back the week it returns, with SRT 0.0.77 folded into the same PR.

Worth an explicit call only if that wait is too long:

• Keep holding — the sandbox keeps the CVE-2026-87766 fix; self-hosted noble runners stay broken; SRT stays at 0.0.76.
• Take 0.3 — unblocks self-hosted runners and SRT, and drops a sandbox-setup CVE fix from every consumer's boundary. Note that tend already carries the 0o755 container change from fix(sandbox): make the agent workspace container readable, not traverse-only #1277 that 0.2 forced, so 0.3 needs no code change either way; the choice is purely the CVE.

I'll re-check next week and report either way rather than letting the hold go quiet.