In my Discover / apt update list I have two sizeable updates listed. One for GNOME Application Platform version 3.38, and one for KDE Application Platform 5.15. Each is around 327MB and 366MB.

My concern is the source of these two updates. The source is listed as flathub (Flatpak), with the website link going direct to the front page of each website (http://www.gnome.org, and kde.org).

The red flag is raised. Do such large official updates really originate from flathub? I cannot find a listing on flathub for these two updates.

I'm running KDE neon 5.20, Plasma 5.20.3.

These are updates are for the runtimes (shared bits for all applications built on the respective app eco systems). They aren't listed on flathub because they aren't actual applications. They are definitely from flathub though.