-------------------------- yocto-6.0.4 Release Notes -------------------------- sbom-cve-check has been updated to v1.3.5 and will now generate a "not affected" assessment if a vulnerability is disputed. Expat has been updated to v2.8.3 to fix CVEs for which the patches were too complex to backport. The fix for CVE-2026-72693 will change behavior of "openvt -u" when root is involved. See: https://lore.kernel.org/all/CANQUz1807YxnBxVQMeJn8N1mhC698-NEk_tE8XQqRxwa8ke9Vw@mail.gmail.com/ We merged patches to support stable AUH upgrades on a selected few recipes: - babeltrace2 - binutils - dbus - git - glib-2.0 - libgcrypt - libxml2 - lttng-modules - lttng-tools - lttng-ust - openssl - perl - python3 - sqlite3 - systemd - util-linux - xz -------------------------- Repositories/Downloads -------------------------- Repository Name: yocto-docs Repository Location: https://git.yoctoproject.org/yocto-docs Branch: wrynose Tag: yocto-6.0.4 Git Revision: a2cc1f5b86f3cdc9ad3257a2545322c5169da3ca Release Artefact: yocto-docs-a2cc1f5b86f3cdc9ad3257a2545322c5169da3ca sha: 1addfdd9f0f9a98a325102aabd24e221173f42dd1e62b8aa2d0b5f224e25d21a Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-6.0.4/yocto-docs-a2cc1f5b86f3cdc9ad3257a2545322c5169da3ca.tar.bz2 https://mirrors.edge.kernel.org/yocto/yocto/yocto-6.0.4/yocto-docs-a2cc1f5b86f3cdc9ad3257a2545322c5169da3ca.tar.bz2 Repository Name: openembedded-core Repository Location: https://git.openembedded.org/openembedded-core Branch: wrynose Tag: yocto-6.0.4 Git Revision: 0f03c732a0a2d0506b41b1abe60b3f368b2300dc Release Artefact: oecore-0f03c732a0a2d0506b41b1abe60b3f368b2300dc sha: a35af9fd6d814ee2fbe21bbcb8de19cdf63fb2c5c78e8f5badf91dfc723a7748 Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-6.0.4/oecore-0f03c732a0a2d0506b41b1abe60b3f368b2300dc.tar.bz2 https://mirrors.edge.kernel.org/yocto/yocto/yocto-6.0.4/oecore-0f03c732a0a2d0506b41b1abe60b3f368b2300dc.tar.bz2 Repository Name: meta-yocto Repository Location: https://git.yoctoproject.org/meta-yocto Branch: wrynose Tag: yocto-6.0.4 Git Revision: 7c25b11156553145fa6b241a2d4f65d94438f804 Release Artefact: meta-yocto-7c25b11156553145fa6b241a2d4f65d94438f804 sha: 411c783757cd2931e407dff408248b6b15f4508e4bf7a9ceedec13c0e7874b84 Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-6.0.4/meta-yocto-7c25b11156553145fa6b241a2d4f65d94438f804.tar.bz2 https://mirrors.edge.kernel.org/yocto/yocto/yocto-6.0.4/meta-yocto-7c25b11156553145fa6b241a2d4f65d94438f804.tar.bz2 Repository Name: bitbake Repository Location: https://git.openembedded.org/bitbake Branch: 2.18 Tag: yocto-6.0.4 Git Revision: 51fd94a67fa17650a9ff623492005972bbc7d26f Release Artefact: bitbake-51fd94a67fa17650a9ff623492005972bbc7d26f sha: a541a9535cca6e342151e8e7b0c11f322dab879317b32e71bd47490c28af8b7d Download Locations: https://downloads.yoctoproject.org/releases/yocto/yocto-6.0.4/bitbake-51fd94a67fa17650a9ff623492005972bbc7d26f.tar.bz2 https://mirrors.edge.kernel.org/yocto/yocto/yocto-6.0.4/bitbake-51fd94a67fa17650a9ff623492005972bbc7d26f.tar.bz2 --------------- Contributors --------------- Thanks to the following people who contributed to this release: Abhishek Bachiphale Adarsh Jagadish Kamini Adrian Freihofer Alejandro Mery Alexander Kanavin Andrei Lalaev Ankur Tyagi Antonin Godard AshishKumar Mishra Benjamin Robin Benjamin Robin (Schneider Electric) Bhavesh R Maheshwari Bruce Ashfield Chen Qi Chris Laplante Daiane Angolini Daniel Dragomir Daniel Turull Darsh Kelaiya Deepak Rathore Devansh Patel Esa Jaaskela Francisco Pedraza Ghanshyam Banait Harish Sadineni Hetvi Thakar Hiago De Franco Himani Ramesh Barde Himanshu Jadon Hitendra Prajapati Jaipaul Cheernam Jakub Szczudlo (Nokia) Jonas Juffinger Jose Quaresma Joshua Watt Kyungjik Min Lee Chee Yang Leonid Iziumtsev Michal Sieron Paul Barker Peter Marko Peter Tatrai Pratik Farkase Quentin Schulz Richard Purdie Robert P. J. Day Roopa Kalmath Ross Burton Siddharth Doshi Sowmya Sathram Sudhir Dumbhare Tafil Avdyli Tim Orling Trevor Woerner Vijay Anusuri Wang Mingyu Xiuzhuo Shang Yoann Congal --------------- Known Issues --------------- N/A --------------- Security Fixes --------------- alsa-lib: Fix CVE-2026-56109 apr-util: Fix CVE-2025-49506 CVE-2026-32327 CVE-2026-34191 CVE-2026-34501 CVE-2026-34502 apt: Ignore CVE-2011-3374 binutils: Fix CVE-2026-3441 CVE-2026-3442 CVE-2026-15003 CVE-2026-18220 bison: Fix CVE-2026-56389 busybox: Fix CVE-2026-38754 coreutils: Fix CVE-2026-56391 cpio: Fix CVE-2026-66484 CVE-2026-66485 CVE-2026-66486 curl: Fix CVE-2026-4873 CVE-2026-7009 CVE-2026-8286 CVE-2026-8925 CVE-2026-8927 CVE-2026-8932 CVE-2026-9079 CVE-2026-9080 CVE-2026-9545 CVE-2026-9546 CVE-2026-11352 CVE-2026-11586 CVE-2026-13608 CVE-2026-80229 curl: Ignore CVE-2026-8458 CVE-2026-8924 CVE-2026-9547 CVE-2026-12064 CVE-2026-82209 diffutils: Fix CVE-2026-53910 expat: Ignore CVE-2026-72522 expat: Fix CVE-2026-50219 CVE-2026-56131 CVE-2026-56412 CVE-2026-72522 ffmpeg: Fix for CVE-2025-69693 CVE-2026-8461 CVE-2026-30997 CVE-2026-30998 CVE-2026-30999 CVE-2026-40962 CVE-2026-52295 CVE-2026-52296 CVE-2026-52297 CVE-2026-64830 CVE-2026-64831 CVE-2026-64832 CVE-2026-64833 CVE-2026-64834 CVE-2026-64835 CVE-2026-65703 CVE-2026-65704 CVE-2026-65705 CVE-2026-65706 CVE-2026-66037 CVE-2026-66038 CVE-2026-66039 glibc: Fix CVE-2026-5435 CVE-2026-5450 CVE-2026-5928 CVE-2026-6238 CVE-2026-6791 gnutls: Fix CVE-2026-5419 CVE-2026-33845 CVE-2026-42010 CVE-2026-42011 go: Fix CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56864 CVE-2026-56865 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 gstreamer1.0*: Fix CVE-2026-12891 CVE-2026-12892 kbd: Fix CVE-2026-72693 libarchive: Ignore CVE-2026-14164 libevent: Ignore CVE-2026-63380 libpcap: Fix CVE-2026-0799 CVE-2026-6244 CVE-2026-6554 CVE-2026-18238 CVE-2026-18313 CVE-2026-31911 CVE-2026-31912 libsndfile1: Fix CVE-2026-37555 libsoup: Fix CVE-2026-4271 libssh2: Fix CVE-2026-58051 CVE-2026-58050 CVE-2026-66032 CVE-2026-66033 CVE-2026-66034 CVE-2026-66035 libxfont2: Fix CVE-2026-44950 CVE-2026-56001 CVE-2026-56002 CVE-2026-56003 CVE-2026-59679 libxfont: Fix CVE-2026-56001 CVE-2026-56002 CVE-2026-56003 libxml2: Ignore CVE-2026-6732 libxml2: Fix CVE-2026-11979 CVE-2026-86137 CVE-2026-86138 CVE-2026-86139 CVE-2026-86140 CVE-2026-86141 CVE-2026-86142 CVE-2026-86143 CVE-2026-86144 nghttp2: Ignore CVE-2026-58055 openssh: Ignore CVE-2026-55653 openssl: Fix CVE-2026-14456 CVE-2026-14457 CVE-2026-18798 CVE-2026-54874 CVE-2026-63072 CVE-2026-63073 CVE-2026-63074 CVE-2026-63075 CVE-2026-63076 CVE-2026-75803 p11-kit: Fix CVE-2026-13757 CVE-2026-18938 patch: Fix CVE-2026-56288 CVE-2026-56289 perl: Fix CVE-2026-13221 CVE-2026-42496 CVE-2026-42497 CVE-2026-57432 CVE-2026-57433 python3-click: Fix CVE-2026-7246 python3-cryptography(-vectors): Fix CVE-2026-34073 CVE-2026-39892 python3-cryptography: Fix CVE-2026-69248 CVE-2026-69249 python3-git: Fix CVE-2026-42215 CVE-2026-42284 CVE-2026-44243 CVE-2026-44244 python3-idna: Fix CVE-2026-45409 python3-lxml: Fix CVE-2026-41066 python3-pip: Fix CVE-2026-8643 CVE-2026-13346 python3-pyasn1: Fix CVE-2026-30922 CVE-2026-59884 CVE-2026-59885 CVE-2026-59886 qemu: Fix CVE-2026-48914 rpcbind: Fix CVE-2026-16277 ruby: Fix CVE-2026-41316 CVE-2026-46727 u-boot: Ignore CVE-2026-33243 u-boot, u-boot-tools: Fix CVE-2026-46728 u-boot-tools: Ignore CVE-2026-29007 CVE-2026-29008 CVE-2026-29009 CVE-2026-33243 util-linux: Fix CVE-2026-3184 util-linux: Ignore CVE-2026-13595 vim: Fix CVE-2026-28417 CVE-2026-52858 CVE-2026-55693 CVE-2026-55895 CVE-2026-57451 CVE-2026-57453 CVE-2026-57454 CVE-2026-57455 CVE-2026-57456 CVE-2026-59856 CVE-2026-59857 CVE-2026-59858 CVE-2026-73072 CVE-2026-73073 CVE-2026-73074 CVE-2026-73076 CVE-2026-73077 CVE-2026-73078 wget: Fix CVE-2026-16599 CVE-2026-58469 CVE-2026-58470 CVE-2026-58471 CVE-2026-58472 wpa-supplicant: Fix CVE-2026-58374 --------------- Fixes --------------- bitbake ----------- asyncrpc: Close the client event loop when the client is collected bb/tests/fetch.py: add case for filter_regex parameter in latest_versionstring data: Fix expandKeys recursion issue data: Return a list from exported_vars() doc: bitbake-user-manual-environment-setup: use pip to install bitbake-setup fetch/gitsm: Store the original url data to fix relative gitsm paths fetch/wget: Handle long filenames correctly fetch2/__init__.py: add filter_regex to default latest_versionstring fetch2/crate.py: add filter_regex parameter to latest_versionstring fetch2/git.py: add filter_regex parameter to latest_versionstring fetch2/wget.py: add filter_regex parameter to latest_versionstring runqueue: Fix pending_hash_index not including taskname runqueue: fix bad check in process_possible_migrations runqueue: wait for covered tasks before setscene tests/fetch: Drop ftp checkstatus test tests/fetch: Swap bitbake github mirror for YP one tests/fetch: Swap github grpc repo for our own small test repo tests/fetch: Switch to YP mirror repos instead of github toastergui/views: Replace os.system call with improved parameter handling oecore ----------- apr-util: upgrade to 1.6.5 at-spi2-core: RDEPENDS on gsettings-desktop-schemas babeltrace2: inherit upstream-stable-release-point binutils: inherit upstream-stable-release-point binutils: stable 2.46 branch updates bitbake.conf: pseudo add rootfs-dbg to PSEUDO_INCLUDE_PATHS bluez5: restrict delta=0 RSSI to proximity filters build-appliance-image: Update to wrynose head revisions ca-certificates: upgrade 20260601 -> 20260816 cmake-native: use bundled nghttp2 with bundled curl connman: remove connection_manager from CVE_PRODUCTS dbus: inherit upstream-stable-release-point devtool/upgrade.py: add --stable option dhcpcd: upgrade to 10.3.2 expat: upgrade to 2.8.3 ffmpeg: upgrade to 8.0.3 fmt: update branch name to main gawk: skip randtest in ptest suite git: inherit upstream-stable-release-point glib-2.0: inherit upstream-stable-release-point glibc: stable 2.43 branch updates go: upgrade to 1.26.8 golang: fix homepage grub: disable grub-protect for native builds gst-devtools: upgrade to 1.28.5 gstreamer1.0*: upgrade to 1.28.5 gstreamer1.0: disable an intermittently failing test improve_kernel_cve_report: Fix backported-patch check kernel-fit-image: Don't add hash node when signing is enabled kernel-yocto-rust: Add clang toolchain check for riscv64 kern-tools: bump SRCREV for conditional 'depends on X if Y' support lib/oe/recipeutils: make stable_upgrade argument optional in get_recipe_upstream_version() libevent: upgrade to 2.1.13 libgcrypt: inherit upstream-stable-release-point libslirp: add tag in SRC_URI libslirp: fix upstream version check libslirp: upgrade to 4.9.3 libxml2: inherit upstream-stable-release-point libxml2: upgrade to 2.15.4 linux-yocto/6.18: fix kernel reproducibility issues linux-yocto/6.18: update to v6.18.52 lttng-modules: inherit upstream-stable-release-point lttng-tools: inherit upstream-stable-release-point lttng-ust: inherit upstream-stable-release-point mesa: align x86 mesa config with LLVM graphics mirrors: Disable YP mirrors on autobuilder oeqa/maturin: Update dependency version openssl: inherit upstream-stable-release-point openssl: upgrade to 3.5.8 perl: inherit upstream-stable-release-point procps: ptest: skip flaky pgrep full process name match test pseudo: upgrade to 1.9.11 pseudo: Add in openat2, exec and linkat fixes pseudo: Update to 1.9.10 python3: add missing pyc files to core python3: fix stringold cache files python3: inherit upstream-stable-release-point python3: upgrade to 3.14.7 python3-attrs: Fix CVE_PRODUCT python3-babel: Fix CVE_PRODUCT python3-certifi: fix homepage python3-click: Fix CVE_PRODUCT python3-click: upgrade to 8.3.3 python3-cryptography(-vectors): upgrade to 46.0.7 python3-cryptography: backport stray file install fix python3-dbusmock: Fix CVE_PRODUCT python3-git: Fix CVE_PRODUCT python3-mako: correct CVE_PRODUCT mapping python3-mako: upgrade to 1.3.12 python3-numpy: Fix CVE_PRODUCT python3-pyasn1: upgrade to 0.6.4 python3-pycryptodome: Fix CVE_PRODUCT python3-pycryptodomex: Fix CVE_PRODUCT python3-sbom-cve-check: update to version 1.3.5 python3-shacl2code: upgrade to 1.1.0 python3-spdx-python-model: upgrade to 0.0.6 python3-wheel: Fix CVE_PRODUCT qemu: guard RESOLVE_CACHED strace flag recipeutils: add optional stable_upgrade parameter to get_recipe_upgrade_status rootfs.py: fix run-postinsts removal on multilib images rpcbind: Drop dependency on quota rpcbind: upgrade to 1.2.9 ruby: upgrade to 4.0.5 sbom-cve-check-update-{nvd-native,cvelist-native}: upgrade to 2026.09.12 sbom-cve-check-update-db: Exclude recipes from rm_work scripts/install-buildtools: Update to 6.0.3 sqlite3: inherit upstream-stable-release-point sstate: Update mtime/atime for sig/siginfo files in sstate_checkhashes() sstate: Update unpack touch code to be consistent systemd: inherit upstream-stable-release-point testimage: handle bootlog variants on failed qemu tests time64: enable 64-bit time/file-offset flags for 32-bit nativesdk toolchain-scripts: fix kernel host tool builds broken in the SDK u-boot: share CVE_PRODUCT with u-boot-tools upstream-stable-release-point.bbclass: add bbclass for stable point upgrade util-linux: inherit upstream-stable-release-point volatile-binds: order systemd-timesyncd after /var/lib wireless-regdb: upgrade to 2026.09.03 xserver-xorg: upgrade to 21.1.24 xwayland: upgrade to 24.1.13 xz: inherit upstream-stable-release-point meta-yocto ----------- poky.conf: Bump version for 6.0.4 release yocto-bsps: update to v6.18.52 yocto-docs ----------- README: add references to recent security documents README: update instructions for installing vale and sphinx-lint bitbake.rst: rename section to "BitBake User Manual" bsp-manual/bsp.rst: fix a "local.conf" -> "layer.conf" typo contributor-guide/identify-component.rst: use the same tense as other section dev-manual/poky-manual-setup.rst: suggest use of fragment instead of assignments dev-manual/wic.rst: remove local.conf mentions dev-manual: correct OVERRIDES to FILESOVERRIDES for FILESPATH dev-manual: drop link to out-of-date wiki page dev-manual: quote the values in two recipe examples docs-wide: fix manual names in cross references documentation: use "https" protocol for git.yoctoproject.org index.rst: add introduction paragraphs index.rst: move external links to the bottom of the intro section index.rst: move release notes in their own section index.rst: move the "Overview and Concepts" manual in the "Introduction and Overview" section index.rst: move the contributor guide out of the Manuals section index.rst: show the intro paragraph only for html-based docs migration-guide: add release notes for 5.0.20 6.0.3 overview-manual: move the intro content in the index ref-manual/classes.rst: buildstats: remove local.conf default value ref-manual/features.rst: add tools-profile ref-manual/features.rst: fix some cross references ref-manual/structure.rst: fix a "local.conf" -> "layer.conf" typo ref-manual/system-requirements.rst: drop ccache in distros ref-manual/variables.rst: BBMULTICONFIG: fix a typo ref-manual/variables.rst: Document SPDX_AUTHORS ref-manual/variables.rst: Fix the documentation for the SPDX agent variables ref-manual/variables.rst: document the PACKAGEFUNCS PACKAGE_NO_LOCALE variable ref-manual/variables.rst: fix local.conf.extended obsolete path ref-manual/variables.rst: mention built-in fragments for MACHINE/DISTRO ref-manual/variables.rst: GCCVERSION: replace local.conf and mention recipe existence ref-manual/varlocality.rst: mention built-in fragments for distro/machine ref-manual/varlocality.rst: remove BBFILES from local configuration assignments ref-manual: drop the full stop from the QB_SMP example ref-manual: fix a typo in the QB_SMP description ref-manual: update DEBUG_OPTIMIZATION/FULL_OPTIMIZATION security-manual/securing-images.rst: remove "your" in "your OE-Core" toaster-manual: spell the json code-block language in lower case Detached signature at https://downloads.yoctoproject.org/releases/yocto/yocto-6.0.4/RELEASENOTES.asc Signing key at https://downloads.yoctoproject.org/releases/yocto/keys/yocto-release-key.asc