Release notes for Yocto-5.0.19 (Scarthgap) ------------------------------------------ Security Fixes in Yocto-5.0.19 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - build-appliance-image: Update to scarthgap head revisions - poky.conf: Bump version for 5.0.19 release - recipetool: Recognise https://git. as git urls - oeqa: Drop /git/ from our urls - gawk-native: fix gcc-15/C23 compilation issues - gawk: trim native build configuration - grub/glibc: Bump versions to resolve hashequiv/reproducibility issues - gawk: use native gawk when building glibc and grub - linux-yocto/6.6: address ltp hang - linux-yocto/6.6: genericarm64 fix configuration audit warning - lttng-modules: Fix trace_hrtimer_start build failure - linux-yocto/6.6: update to v6.6.142 - linux-yocto/6.6: update to v6.6.141 - linux-yocto/6.6: update to v6.6.140 - linux-yocto/6.6: update to v6.6.138 - linux-yocto/6.6: update to v6.6.137 - linux-yocto/6.6: update to v6.6.136 - linux-yocto/6.6: update to v6.6.135 - linux-yocto/6.6: update to v6.6.134 - linux-yocto/6.6: update to v6.6.132 - linux-yocto/6.6: update to v6.6.130 - linux-yocto/6.6: update to v6.6.129 - oeqa/runtime/parselogs: update pci BAR ignore for kernel 6.10 - classes/gtk-icon-cache: fix libdir passed to the postrm intercept - oeqa/core/runner: stub addDuration in OETestResult - gdb: backport a patch to fix static_assert in recent GCC - openssl: upgrade 3.5.6 -> 3.5.7 - pseudo: Update to version 1.9.8 - ref-manual: add more explanation to glossary variable LICENSE - ref-manual: document RM_WORK_EXCLUDE_ITEMS variable - ref-manual: clarify use of "PACKAGE_ARCH" in a packagegroup - dev-manual: SysVinit is the default init manager for Poky - dev-manual: update AUTOREV explanation to match current file - kernel-dev: remove references to defunct LTSI project - dev-manual: fully define SOLIBS-related variables in bitbake.conf - dev-manual: fix broken grammar in "Libraries" section - dev-manual: fix grammatical error, missing word "with" - dev-manual: drop "PREFERRED_VERSION" from x86-base.inc snippet - build-manual: update ROOTFS_POSTPROCESS_COMMAND example - ref-manual: clarify that PACKAGE_EXCLUDE supports DEB packaging - python_setuptools_build_meta: clean the build directory in configure - setuptools3: clean the build directory in configure - setuptools3_legacy: ensure ${B} is clean - meta: fix generation of kernel CONFIG_ in SPDX3 - conf/machine: fix typos in ARM and x86 README files - bitbake: data: fix issue with varflag exclusion - bitbake: tests/fetch: cover checkstatus redirect auth handling - bitbake: fetch2/wget: limit auth on checkstatus redirects - bitbake: fetch2/wget: handle HTTP 308 Permanent Redirect - meta/lib/oe/package.py: fix path to kernel sources in save_debugsources_info - devtool: prevent 'devtool modify -n' from corrupting kernel Git repos - pseudo: Upgrade 1.9.6 -> 1.9.7 - pseudo: Update 1.9.5 -> 1.9.6 - pseudo: Upgrade to 1.9.5 - pseudo: Upgrade to 1.9.4 - tzdata/tzcode-native: upgrade 2026a -> 2026b - wic: filemap: use separate fd for SEEK_HOLE probes - classes/base: prefer gnu-prefixed HOSTTOOLS - scripts/install-buildtools: Update to 5.0.18 - gnupg: upgrade 2.4.8 -> 2.4.9 - perl: link to the system zlib instead of a vendored copy - oeqa: runtime: go: Increase test_go_compile/test_go_module timeout - go.bbclass: disable workspaces - go.bbclass: change GOTMPDIR to improve reproducibility - systemd: update musl specific patch to apply - migration-guide: add release notes for 5.0.18 - contributor-guide: couple minor typo/grammar fixes - dev-manual: remove semicolons for rootfs commands - overview-manual: update deploy.bbclass snippet - overview-manual: use correct spelling "counterpart" - overview-manual: mention that patch files can be compressed - security-team: Add section on multi-project embargoes - security-team: Tidy and update section on security team operations - security-team: Update membership list - security-team.rst: update my email address and key - overview-manual: provide a more expansive definition of "layer" - overview-manual: add ":term:" for OE Build System - ref-manual/variables.rst: link *MIRRORS definitions to the BitBake manual - overview-manual: inform the reader early of "bitbake-getvar" - bsp-guide: update guide to reflect newer beaglebone - bsp-guide: mention bootloader and device tree in BSP intro - recipe-style-guide.rst: two minor grammatical tweaks - overview-manual: hyphens not allowed in file version - overview-manual: fix typo, "semi-colon" -> "colon" - overview-manual: remind reader that meta-poky is a distro layer - conf.py: add a :yocto_bug: role - conf.py: define new *_path roles - conf.py: define new {oecore,bitbake,meta_yocto}_rev roles - bitbake: hashserv: validate unihash values - bitbake: hashserv/tests: use valid 64-character unihashes - bitbake: fetch2: Unpack RPMs with --no-absolute-filenames - bitbake: fetch2/git: quote shallow extra ref arguments - bitbake: fetch2: validate striplevel parameter - bitbake: fetch2: validate deb/ipk data member names - contributor-guide: fix type "maintainance" to "maintenance" - overview-manual: fix "checkout" versus "check out" - What I Wish I'd KNown: Various pedantic cleanups - "Transitioning ..." doc: Various pedantic cleanups - YP Quick Build: delete extraneous periods in list - yp-intro.rst: add link to "buildbot" - yp-intro.rst: delete really old references - index.rst: update "Software Overview" to "Technical Overview" - migration-guide: add release notes for 4.0.35 Fixes in Yocto-5.0.19 ~~~~~~~~~~~~~~~~~~~~~ - python3: fix :cve:`2026-4224` - nfs-utils: fix :cve:`2025-12801` - libusb1: fix :cve:`2026-23679` and :cve:`2026-47104` - xwayland: Fix :cve:`2026-34003` - xwayland: Fix :cve:`2026-34002` - xwayland: Fix :cve:`2026-34001` - xwayland: Fix :cve:`2026-34000` - xwayland: Fix :cve:`2026-33999` - go: patch :cve:`2026-27145` - libsoup: fix for :cve:`2026-2369` - libsoup: fix for :cve:`2025-11021` - rust,libstd-rs: set status for :cve:`2024-3566` - go: set status for :cve:`2026-39836` - go-binary-native: set status for :cve:`2026-39836` - apr: Add CVE_PRODUCT to support product name - apr-util: Add CVE_PRODUCT to support product name - bzip2: set CVE_PRODUCT - python3: :cve:`2026-3087` not applicable - libinput: fix for :cve:`2026-50292` - libsolv: fix :cve:`2026-9150` - dpkg: Fix :cve:`2026-2219` - qemu: Fix :cve:`2024-6519` - python3: Fix :cve:`2025-13462` - python3: Fix :cve:`2026-6019` - python3: Fix :cve:`2026-4519` and :cve:`2026-4786` - python3: Fix :cve:`2026-3644` and :cve:`2026-0672` - binutils: Fix :cve:`2025-69644` - go: fix :cve:`2026-32288` - go: fix :cve:`2026-25679` - go: fix :cve:`2025-58183` - tiff: fix :cve:`2026-4775` - openssh: fix :cve:`2026-35386` - xserver-xorg: Fix :cve:`2026-34003` - xserver-xorg: Fix :cve:`2026-34002` - xserver-xorg: Fix :cve:`2026-34001` - xserver-xorg: Fix :cve:`2026-34000` - xserver-xorg: Fix :cve:`2026-33999` - python3: fix :cve:`2026-6100` - python3: fix for :cve:`2026-1502` - libxml-parser-perl: fix for :cve:`2006-10003` - qemu: fix for :cve:`2025-11234` - avahi: Remove a reference to the rejected :cve:`2021-36217` - go 1.22.12: fix :cve:`2026-27143`, :cve:`2026-27144` - go 1.22.12: fix :cve:`2026-27140` - go: patch :cve:`2026-42507` - go: patch :cve:`2026-42504` - go: patch :cve:`2026-42501` - go: patch :cve:`2026-42499` - go: patch :cve:`2026-39826` - go: patch :cve:`2026-39825` - go: patch :cve:`2026-39820` - go: patch :cve:`2026-39819` - go: patch :cve:`2026-39817` - go: patch :cve:`2026-33811` - go: patch :cve:`2026-32289` - go: patch :cve:`2026-32283` - go: patch :cve:`2026-32280` - go: patch :cve:`2026-27142` - util-linux: Fix :cve:`2026-27456` - xz: Fix :cve:`2026-34743` - busybox: Fix :cve:`2026-29004` - libpng: Fix :cve:`2026-33416` - linux-yocto/6.6: update CVE exclusions (6.6.127) - libarchive: Fix :cve:`2026-4424` - openssh: patch :cve:`2026-35388` - openssh: patch :cve:`2026-35387` - openssh: patch :cve:`2026-35385` - libexif: fix for :cve:`2026-40385`, :cve:`2026-40386` - libexif: fix for :cve:`2026-32775` - lz4: Remove a reference to the rejected :cve:`2025-62813` - libssh2: fix for :cve:`2026-7598` - python3-requests: backport fix for :cve:`2026-25645` - cargo: set CVE_PRODUCT Known Issues in Yocto-5.0.19 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Example link for bug : - :yocto_bugs:`bsps-hw.bsps-hw.Test_Seek_bar_and_volume_control manual test case failure ` Contributors to Yocto-5.0.19 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Thanks to the following people who contributed to this release: - Adarsh Jagadish Kamini - Alexander Kanavin - Amaury Couderc - Anders Heimer - Anil Dongare - Ankur Tyagi - Antonin Godard - Benjamin Robin (Schneider Electric) - Bruce Ashfield - Changqing Li - Deepak Rathore - Enrico Jörns - Guðni Már Gilbert - He Zhe - Himanshu Jadon - Hitendra Prajapati - Hugo SIMELIERE (Schneider Electric) - Jonas Munsin - João Marcos Costa (Schneider Electric) - Lee Chee Yang - Marcio Henriques - Mark Hatle - Marta Rybczynska - Martin Jansa - Mathieu Dubois-Briand - Naman Jain - Paul Barker - Peter Bergin - Peter Marko - Prabhudasu Vatala - Richard Purdie - Robert P. J. Day - Ross Burton - Shubham Pushpkar - Sudhir Dumbhare - Theo Gaige (Schneider Electric) - Trevor Woerner - Vijay Anusuri - Yoann Congal - Zahir Hussain Repositories / Downloads for Yocto-5.0.19 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ yocto-docs - Repository Location: :yocto_git:`/yocto-docs` - Branch: :yocto_git:`scarthgap ` - Tag: :yocto_git:`yocto-5.0.19 ` - Git Revision: :yocto_git:`1b819d324780a699d9307a2d4e68c69b576ab748 ` - Release Artefact: yocto-docs-1b819d324780a699d9307a2d4e68c69b576ab748 - sha: b2c484d8d13b05b133f6f23f44e7757e4b53d93c27c9ea76d1a2e5f759f51af0 - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.19/yocto-docs-1b819d324780a699d9307a2d4e68c69b576ab748.tar.bz2 https://mirrors.edge.kernel.org/yocto/yocto/yocto-5.0.19/yocto-docs-1b819d324780a699d9307a2d4e68c69b576ab748.tar.bz2 poky - Repository Location: :yocto_git:`/poky` - Branch: :yocto_git:`scarthgap ` - Tag: :yocto_git:`yocto-5.0.19 ` - Git Revision: :yocto_git:`bb98354685781296e3b3737e7762412100f359c2 ` - Release Artefact: poky-bb98354685781296e3b3737e7762412100f359c2 - sha: 37fd9eeff8043e6d7d595421b8ac40d38357d2d4ce3a6d0f86a0f7d884c995c3 - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.19/poky-bb98354685781296e3b3737e7762412100f359c2.tar.bz2 https://mirrors.edge.kernel.org/yocto/yocto/yocto-5.0.19/poky-bb98354685781296e3b3737e7762412100f359c2.tar.bz2 openembedded-core - Repository Location: :oe_git:`/openembedded-core` - Branch: :oe_git:`scarthgap ` - Tag: :oe_git:`yocto-5.0.19 ` - Git Revision: :oe_git:`2814f0962f56c8d1afa4de76d2895ba9b5cb767d ` - Release Artefact: oecore-2814f0962f56c8d1afa4de76d2895ba9b5cb767d - sha: 8556e454499fcda4026dc58fb8fc627861720f5c006bd72bf3b455dabd22a0e8 - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.19/oecore-2814f0962f56c8d1afa4de76d2895ba9b5cb767d.tar.bz2 https://mirrors.edge.kernel.org/yocto/yocto/yocto-5.0.19/oecore-2814f0962f56c8d1afa4de76d2895ba9b5cb767d.tar.bz2 meta-yocto - Repository Location: :yocto_git:`/meta-yocto` - Branch: :yocto_git:`scarthgap ` - Tag: :yocto_git:`yocto-5.0.19 ` - Git Revision: :yocto_git:`2f749ae477c3b94dce71038f025180d7f612dab0 ` - Release Artefact: meta-yocto-2f749ae477c3b94dce71038f025180d7f612dab0 - sha: 754237ee59a67d31da1f242555c77b75a96d9cdabdf0a4c9cfd98e378643d031 - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.19/meta-yocto-2f749ae477c3b94dce71038f025180d7f612dab0.tar.bz2 https://mirrors.edge.kernel.org/yocto/yocto/yocto-5.0.19/meta-yocto-2f749ae477c3b94dce71038f025180d7f612dab0.tar.bz2 meta-mingw - Repository Location: :yocto_git:`/meta-mingw` - Branch: :yocto_git:`scarthgap ` - Tag: :yocto_git:`yocto-5.0.19 ` - Git Revision: :yocto_git:`bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f ` - Release Artefact: meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f - sha: ab073def6487f237ac125d239b3739bf02415270959546b6b287778664f0ae65 - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.19/meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f.tar.bz2 https://mirrors.edge.kernel.org/yocto/yocto/yocto-5.0.19/meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f.tar.bz2 bitbake - Repository Location: :oe_git:`/bitbake` - Branch: :oe_git:`2.8 ` - Tag: :oe_git:`yocto-5.0.19 ` - Git Revision: :oe_git:`0880963fea4d91a034e4a6e007d23f98658ab986 ` - Release Artefact: bitbake-0880963fea4d91a034e4a6e007d23f98658ab986 - sha: 2bbf83d622fd4ad7ef0110378a9c88b683b2d82a911aba681b561446ec2f486b - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.19/bitbake-0880963fea4d91a034e4a6e007d23f98658ab986.tar.bz2 https://mirrors.edge.kernel.org/yocto/yocto/yocto-5.0.19/bitbake-0880963fea4d91a034e4a6e007d23f98658ab986.tar.bz2