It should be several Packages that got updated. Did You checked the installed Versions? With apt list flatpak and apt list bubblewrap You should see that these are the current Versions.
When added the PPA and You make a sudo apt update && sudo apt upgrade, You should directly get the Updates.
Thanks for the Link, it shows very actual security infos!
Just updated. 
Wish I had noticed and done this sooner, usually I'm on top of things but this one I greatly overlooked.
flatpak version says 1.14.10 so I tried the flatpak 1.18.4 command and it just said 1.18.4 is not a flatpak command. also tried flatpak update which updated a few apps that were from flatpak (I don't use flatpak unless absolutely necessary) and update flatpak wasan error too.
What is the command to update to 1.18.4??
This command adds the PPA to your sources
sudo add-apt-repository ppa:flatpak/stable
This command updates the system
sudo apt update
Once completed, now check your flatpak version...
flatpak --version
There is the sudo apt upgrade missing.
It was me who posted originally, not Sapien. 
He posted on August 14
I used his exact installation instructions and easily upgraded. @Ponce-De-Leon mentioned the upgrade command but the install code in that post has no upgrade command?
Because @SAPien wrote:
which leads to the Installation of the newer flatpak Version. And it should update the related Packages, too.
When You would do after adding the PPA a sudo apt update && sudo apt upgrade the newer Versions would be detected, too and get updated.
At the end: Several Ways lead to the same Result.
That's what ran through my mind after posting. 
Thank you for the explanation.
In view of the recent Flatpak security issue of breaking out into the system I decided to search for instances of A.I. use in any Flatpak.
I found an interesting article on FOSS LINUX. The article is very good and gives an in-depth look at Flatpak and comparisons with Snap and AppImage packaging. I will give the link at the end, but here are some highlights from it, starting with A.I. Policy:
" Why It Matters: Flathub’s AI policy is not just about code quality. It is about trust. When a user installs an app from Flathub, they are trusting that a real person reviewed the permissions, tested the sandboxing, and will respond to security issues. AI-generated apps skip all of that accountability."
Followed by [emphasis by me in Bold]
"There are exceptions for mature, well-maintained projects."
Interesting facts on validation [I have used Bold emphasis on an interesting point on the numbers]:
"## Evaluating App Quality on Flathub
Not every app on Flathub is created equal. With 3,542 apps, you need to know how to separate quality from noise. I look at three things before installing anything.
First, check for the Verified badge. Verified apps are published by the original developers and have been confirmed by the Flathub team. There are currently 2,092 verified apps out of 3,542 total. If an app is verified, you know the developer is actively maintaining it."
There is also mention of third party repositories, but if there are such third party repositories for unique Flatpak apps, how can verification be maintained and how do we know if there has been any bad actor involvement like occurred with xz?
Whilst a couple of CVE's have been rectified, one historic one in particular made me glad I never touched Flatpak:
"CVE-2026-34079 prevented arbitrary file deletion."
Whilst some small praise was given to Canonical's Snap it was balanced by stating it's drawbacks [which I have emphasised in Bold] and let's not forget Canonical's implementation of A.I. in Ubuntu 26.04:
" Snap wins on Ubuntu integration. If you are running Ubuntu, Snaps work seamlessly out of the box. The snapd daemon handles updates automatically, and the Ubuntu Software Center surfaces Snaps prominently. The downside is the canonical-controlled store and the daemon overhead that runs in the background."
Read the full article here including useful tips if you are still keen to use it, but not in my daily OS .
https://www.fosslinux.com/157752/flathub-flatpak-complete-guide.htm
[Side note: On the comment on AppImage:
" AppImage wins on simplicity. Download one file, make it executable, run it. No daemon, no repository, no sandbox. The trade-off is no automatic updates and no centralized discovery. AppImages are great for portable tools but do not scale well for a desktop app ecosystem."
There are instances in an Education setting where AppImages are essential in respect of portableapps from portableapps.com. I recently gave advice to someone whose student's needed NVDA, and similarly Inkscape in situations where schools won't agree to install anything outside the MS ecosystem. I was fortunate to work in an IR of a school where the IT Department agreed for us to use Inkscape which saved the service wasting £200 per machine licence on Accessible Drawing Software that was not needed. Just pity the students with a visual impairment who attend schools running Google Classrooms who don't have access to MS Office, as Google Docs is nowhere near as accessible visually when it comes to applying Styles!]
I updated and upgraded, but it took it no further than version 1.16.6. ...because I'm on Z16.
Then perhaps it is time to move to Zorin 17 at least?
Zorin 16 was based on Ubuntu 20.04, and the Flatpak versions have two CVE issues stated in that FOSS LINUX article I posted. Or just remove Flatpak and hope for the best.
Yes, you've run into the one negative con with staying on Zorin OS 16, lack of new software support. Its not the end of the world though. Unless you really need the latest version, you'll do fine.
I wouldn't say new software, rather, how secure do you want your system.
Wow, what a blast from the past! I haven't even thought about PortableApps.com in, gosh, well over a decade! I'm slightly surprised it's still going strong, last update released just a month ago, but pleasantly so. I might have to dig out a spare USB stick and set it up with some again for old times' sake.
As people like myself come over from Windows or Mac, the bad guys are going to see this and do the same. They will start tayloring malware for Linux. Creeps always go where the action is, that is human nature. We have to start working on better virus apps for the home user through open source.
Actually, Virii are dependent on .exe.
ClamAV is really meant to be used for checking potential viruses in emails that you don't want to pass on to friends/relatives running Windows.
The main source of malware can be tied down to code injected into applications as occurred with .xz compression/decompression utility.
Cross-platform malware includes bootkits and rootkits.
Bootkits are prevented with Secure Boot (as well as other security precautions: Bootkitty Unveiled: The First UEFI Bootkit For Linux Systems 2025 - FireXCore), rootkits are protected by using terminal command software, rkhunter (https://rkhunter.sourceforge.net/) and chkrootkit (https://www.chkrootkit.org/).
Then there is Lynis which checks on system security by auditing your system and recommending steps to harden your system security if needed:
" UEFI Secure Boot is the primary defense protecting Linux systems from bootkits by verifying the cryptographic signatures of the bootloader, kernel, and modules before execution, thereby blocking unsigned or tampered code.
To ensure effective protection, users should:
Enable Secure Boot in UEFI settings, as it prevents unauthorized modifications to the boot chain.
Keep the Forbidden Signature Database (dbx) updated to revoke known-vulnerable or compromised boot components that might otherwise bypass verification.
Use distribution-signed kernels (such as those from Ubuntu, Fedora, or Debian) which rely on a trusted chain involving the Microsoft-signed Shim bootloader and distribution-specific keys.
Implement additional hardening like Kernel Module Signing and TPM-based measured boot to detect integrity violations even if Secure Boot is circumvented.
While Secure Boot significantly raises the barrier for bootkits like the discovered Bootkitty, it is not a silver bullet; attackers have occasionally bypassed it by exploiting vulnerabilities in signed components before those components were added to the revocation list.
AI-generated answer. Please verify critical facts."
