Snapd 2.77.1 Release Update

ernestl · September 22, 2026, 12:00pm

Dear Snapd Community,

We’re pleased to share that the snapd 2.77.1 snap is available for testing in the candidate channel, and the snapd debian package (2.77.1+ubuntu26.10.1) has been released for Ubuntu 26.10 (Stonking).

Snapd 2.77.1 is the first stable release in the 2.77.x series, since the following blocking issue was found in 2.77:

Fix undo of unlink-component after its snap revision was discarded. This is the regression that kept 2.77 from release. A refresh or removal that had to undo unlinking a component could fail once that revision was already gone.
power-control: allow reading battery state files (low impact)

Notable updates

FDE

Snapd 2.77.1 carries the 26.10 FDE work for reprovision and post-install handling.

A device can be reprovisioned without a factory reset. The release adds APIs for reprovision, for generating a recovery key as part of reprovision, and for post-install actions.
Storage-encrypted system information is extended.
Perform a reseal dry-run check after a snapd refresh
Improve cleanup robustness of FDE tasks

Packaging and AppArmor

Update the bundled AppArmor to 5.0.2, and accept the 5.0 ABI when snapd is running as a deb
Build the deb with Go 1.23 on Noble and Jammy, and Go 1.22 on Focal
Fix service startup during install, and session-agent socket handling, on Ubuntu 26.04 and later
Use a relative symlink for snapctl, and update the steam-support udev rules

Interfaces

New interfaces: apparmor-observe, kernel-sched-ext-control, vsock (LP: #2161982), and xdg-portal-permission-store
content: a plug now mounts the parallel instance that provides the slot (LP: #1915709)
docker: allow connecting to the system-wide Docker socket on classic
Make polkit and upower implicit on Ubuntu Core only
opengl: expose WSL libraries
Allow Wine to execute files opened through the Document Portal
Allow networkctl and systemd-networkd link property changes
Allow reading /proc/self/smaps_rollup (LP: #2110510)
network-control and network-manager: allow a missing resolve1 link (LP: #2143934)

Other

Seed refresh and remodel: express remodeling as updates; let reverts trigger a seed refresh; make a snap’s prerequisites available before it is installed; keep snaps required by seed refresh from being removed
Snap applications receive SNAP_APP_NAME and, when applicable, SNAP_APP_COMMON_ID, SNAP_APP_DESKTOP_FILE, and SNAP_APP_BUS_NAME. Environment entries may use shell conditional syntax
Snapshots: restore keeps mounts created with snapctl; save skips mount points
Removal: fail early when user mounts are still present under snap data; snapctl mounts under global data no longer make snap remove fail
Verify cached downloads and detect obvious corruption
Support systems that ship only ca-certificate.crt, such as core26
snap-confine: retry BPF program loading when verifier logs cannot be collected; set AppArmor profile flags; work around a kernel mount-namespace ordering bug on 6.18 (LP: #2161539)
Set the target hostname from install mode
Prompting: report hidden-file access for paths allowed by home, and read-only access for paths allowed by system-packages-doc
Option names with underscores are no longer permitted

Experimental features

Graduated

These experimental features have graduated. They are now always enabled.

layouts: a snap can bind-mount, symlink, or place a tmpfs inside its mount namespace
classic-preserves-xdg-runtime-dir: on classic, a snap keeps the session XDG_RUNTIME_DIR and can reach user-session services there
refresh-app-awareness: snapd holds a refresh while that snap’s apps are running
dbus-activation: a snap app or service can be started by D-Bus activation

Enabled by default

quota-groups: resource limits for snaps are available without setting the experimental flag

In development

The following are still under active development and are not yet considered stable for general use.

confdb: validation-sets support; fix data loss when writing to a new schema or account; run observe-view-* hooks after commit; sign-only external keypair backends; validate map keys in JSON config values (LP: #2072331)
Security logging: log administrative actions, token create and remove events, and adding, updating, or removing a snapd user; strip trailing whitespace from audit message payloads (LP: #2160691)
Remote device management: validate request messages, apply management messages, queue responses, and improve sequencing and redelivery

For the release plan and complete list of changes, please refer to the full release notes.

Test Feedback

Feel free to provide your test feedback here or directly in Launchpad. To help fast track investigations please provide (1) details about the system, (2) snapd version(s) and (3) steps to reproduce the issue.

Security reports

Please report security vulnerabilities in private. The snapd security policy describes what qualifies and how to report it.

Known issues

The bundled AppArmor update to 5.0.2 can cause issues in some outdated kernels. If you see issues related to network access, update your kernel to the latest version provided by your system. If you are using the EOL 25.04 version of Ubuntu, you cannot use 2.77.1 or any later version of snapd snap. Add SNAP_REEXEC=0 to /etc/environment to force using the deb package.