.. SPDX-License-Identifier: CC-BY-SA-2.0-UK Release notes for Yocto-5.0.15 (Scarthgap) ------------------------------------------ Users of Alma 9, Rocky 9 and Centos Stream 9 rolling releases have seen obtuse failures in the execution of tar in various tasks after recent host distro updates. These newer versions of tar contain a CVE fix which uses a new glibc call/syscall (openat2). The fix is to update to a newer pseudo version which handles this syscall. This is not included in this stable release but we aim to include it in the next one. Security Fixes in Yocto-5.0.15 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - binutils: Fix :cve_nist:`2025-11494`, :cve_nist:`2025-11839` and :cve_nist:`2025-11840` - cmake-native: Fix :cve_nist:`2025-9301` - cups: Fix :cve_nist:`2025-58436` and :cve_nist:`2025-61915` - gnutls: Fix CVE-2025-9820 - go: Fix :cve_nist:`2025-61727` and :cve_nist:`2025-61729` - go: Update :cve_nist:`2025-58187` patches - grub: Fix :cve_nist:`2025-54770`, :cve_nist:`2025-61661`, :cve_nist:`2025-61662`, :cve_nist:`2025-61663` and :cve_nist:`2025-61664` - libarchive: Fix :cve_nist:`2025-60753` - libarchive: Fix 2 security issue (https://github.com/libarchive/libarchive/pull/2753 and https://github.com/libarchive/libarchive/pull/2768) - libmicrohttpd: Ignore :cve_nist:`2025-59777` and :cve_nist:`2025-62689` - libpng: Fix :cve_nist:`2025-64505`, :cve_nist:`2025-64506`, :cve_nist:`2025-64720`, :cve_nist:`2025-65018` and :cve_nist:`2025-66293` - libsoup: Fix :cve_nist:`2025-12105` - libssh2: Fix :cve_nist:`2023-48795` - libxml2: Fix :cve_nist:`2025-7425` - libxslt: Fix :cve_nist:`2025-11731` - musl: Fix :cve_nist:`2025-26519` - python3-urllib3: Fix :cve_nist:`2025-66418` and :cve_nist:`2025-66471` - python3: Fix :cve_nist:`2025-6075` - qemu: Fix :cve_nist:`2025-12464` - rsync: Fix :cve_nist:`2025-10158` - ruby: Fix :cve_nist:`2025-24294`, :cve_nist:`2025-25186` and :cve_nist:`2025-61594` - sqlite3: Fix :cve_nist:`2025-7709` - xserver-xorg: Fix :cve_nist:`2025-62229`, :cve_nist:`2025-62230` and :cve_nist:`2025-62231` - xwayland: Fix :cve_nist:`2025-62229`, :cve_nist:`2025-62230` and :cve_nist:`2025-62231` Fixes and Feature Changes in Yocto-5.0.15 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - build-appliance-image: Update to scarthgap head revision - classes/create-spdx-2.2: Define SPDX_VERSION to 2.2 - cml1.bbclass: use consistent make flags for menuconfig - cross.bbclass: Propagate dependencies to outhash - curl: Ensure 'CURL_CA_BUNDLE' from host env is indeed respected - curl: Use host CA bundle by default for native(sdk) builds - cve-check: extract extending :term:`CVE_STATUS` to library function - dev-manual/layers.rst: document "bitbake-layers show-machines" - dev-manual/new-recipe.rst: replace 'bitbake -e' with 'bitbake-getvar' - dev-manual/new-recipe.rst: typo, "whith" -> "which" - dev-manual/new-recipe.rst: update "recipetool -h" output - dev-manual/sbom.rst: reflect that create-spdx is enabled by default - dev-manual: debugging: use bitbake-getvar in Viewing Variable Values section - documentation: link to the Releases page on yoctoproject.org instead of wiki - glslang: fix compiling with gcc15 - go: add sdk test - go: extend runtime test - go: remove duplicate arch map in sdk test - goarch.bbclass: do not leak :term:`TUNE_FEATURES` into crosssdk task signatures - kernel-dev: add disable config example - kernel-dev: common: migrate bitbake -e to bitbake-getvar - kernel.bbclass: Add task to export kernel configuration to :term:`SPDX` - libssh2: fix regression in KEX method validation (GH-1553) - libssh2: upgrade to 1.11.1 - migration-guides: add release notes for 4.0.31 and 5.0.13 - oe/sdk: fix empty SDK manifests - oeqa/sdk/buildepoxy: skip test in eSDK - oeqa/selftest: oe-selftest: Add :term:`SPDX` tests for kernel config and :term:`PACKAGECONFIG` - oeqa: drop unnecessary dependency from go runtime tests - oeqa: fix package detection in go sdk tests - overview-manual: migrate to SVG + fix typo - poky.conf: bump version for 5.0.15 - ref-manual: variables: migrate the :term:`OVERRIDES` note to bitbake-getvar - ruby: Upgrade to 3.3.10 - rust-target-config: fix nativesdk-libstd-rs build with baremetal - scripts/install-buildtools: Update to 5.0.14 - spdx30: Provide software_packageUrl field in :term:`SPDX` 3.0 SBOM - spdx30: fix cve status for patch files in VEX - spdx30: provide all CVE_STATUS, not only Patched status - spdx30_tasks: Add support for exporting :term:`PACKAGECONFIG` to :term:`SPDX` - spdx: Revert "spdx: Update for bitbake changes" - spdx: extend :term:`CVE_STATUS` variables - testsdk: allow user to specify which tests to run - vex.bbclass: add a new class - vex: fix rootfs manifest - xserver-xorg: remove redundant patch Known Issues in Yocto-5.0.15 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - N/A Contributors to Yocto-5.0.15 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Thanks to the following people who contributed to this release: - Adarsh Jagadish Kamini - Aleksandar Nikolic - Alexander Kanavin - Benjamin Robin (Schneider Electric) - Changqing Li - Daniel Turull - Deepak Rathore - Deepesh Varatharajan - Enrico Jörns - Gyorgy Sarvari - Hitendra Prajapati - Hongxu Jia - Hugo SIMELIERE - Jiaying Song - Kai Kang - Kamel Bouhara (Schneider Electric) - Lee Chee Yang - Martin Jansa - Mingli Yu - Moritz Haase - Osama Abdelkader - Ovidiu Panait - Peter Marko - Praveen Kumar - Quentin Schulz - Robert P. J. Day - Ross Burton - Steve Sakoman - Vijay Anusuri - Walter Werner SCHNEIDER - Yash Shinde - Yogita Urade Repositories / Downloads for Yocto-5.0.15 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ yocto-docs - Repository Location: :yocto_git:`/yocto-docs` - Branch: :yocto_git:`scarthgap ` - Tag: :yocto_git:`yocto-5.0.15 ` - Git Revision: :yocto_git:`b0f5cc276639916df197435780b3e94accd4af41 ` - Release Artefact: yocto-docs-b0f5cc276639916df197435780b3e94accd4af41 - sha: 28ebedfa6471e4ed7583aca0925cd31f4429af3d27ffc0a7e250f7b75404edd7 - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/yocto-docs-b0f5cc276639916df197435780b3e94accd4af41.tar.bz2 https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/yocto-docs-b0f5cc276639916df197435780b3e94accd4af41.tar.bz2 poky - Repository Location: :yocto_git:`/poky` - Branch: :yocto_git:`scarthgap ` - Tag: :yocto_git:`yocto-5.0.15 ` - Git Revision: :yocto_git:`72983ac391008ebceb45edc7a8f0f6d5f4fe715c ` - Release Artefact: poky-72983ac391008ebceb45edc7a8f0f6d5f4fe715c - sha: d5336d1ef1dd48b88cb92748c669360901004d458b7786ddc1918da12fef4edd - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/poky-72983ac391008ebceb45edc7a8f0f6d5f4fe715c.tar.bz2 https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/poky-72983ac391008ebceb45edc7a8f0f6d5f4fe715c.tar.bz2 openembedded-core - Repository Location: :oe_git:`/openembedded-core` - Branch: :oe_git:`scarthgap ` - Tag: :oe_git:`yocto-5.0.15 ` - Git Revision: :oe_git:`6988157ad983978ffd6b12bcefedd4deaffdbbd1 ` - Release Artefact: oecore-6988157ad983978ffd6b12bcefedd4deaffdbbd1 - sha: 98a691ce87f9aba57007e91b56bbe0af6d6c8f62aacb68820026478ff8e1f819 - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/oecore-6988157ad983978ffd6b12bcefedd4deaffdbbd1.tar.bz2 https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/oecore-6988157ad983978ffd6b12bcefedd4deaffdbbd1.tar.bz2 meta-yocto - Repository Location: :yocto_git:`/meta-yocto` - Branch: :yocto_git:`scarthgap ` - Tag: :yocto_git:`yocto-5.0.15 ` - Git Revision: :yocto_git:`9bb6e6e8b016a0c9dfe290369a6ed91ef4020535 ` - Release Artefact: meta-yocto-9bb6e6e8b016a0c9dfe290369a6ed91ef4020535 - sha: 01778c43673ef11ec5d0fb76bd7c600031f5fc9bcfd9bfa586d5fb6b6babff95 - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/meta-yocto-9bb6e6e8b016a0c9dfe290369a6ed91ef4020535.tar.bz2 https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/meta-yocto-9bb6e6e8b016a0c9dfe290369a6ed91ef4020535.tar.bz2 meta-mingw - Repository Location: :yocto_git:`/meta-mingw` - Branch: :yocto_git:`scarthgap ` - Tag: :yocto_git:`yocto-5.0.15 ` - Git Revision: :yocto_git:`bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f ` - Release Artefact: meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f - sha: ab073def6487f237ac125d239b3739bf02415270959546b6b287778664f0ae65 - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f.tar.bz2 https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f.tar.bz2 bitbake - Repository Location: :oe_git:`/bitbake` - Branch: :oe_git:`2.8 ` - Tag: :oe_git:`yocto-5.0.15 ` - Git Revision: :oe_git:`8dcf084522b9c66a6639b5f117f554fde9b6b45a ` - Release Artefact: bitbake-8dcf084522b9c66a6639b5f117f554fde9b6b45a - sha: 766eda21f2a914276d2723b1d8248be11507f954aef8fc5bb1767f3cb65688dd - Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/bitbake-8dcf084522b9c66a6639b5f117f554fde9b6b45a.tar.bz2 https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/bitbake-8dcf084522b9c66a6639b5f117f554fde9b6b45a.tar.bz2