Release notes for Yocto-6.0.4 (Wrynose)

sbom-cve-check has been updated to v1.3.5 and will now generate a “not affected” assessment if a vulnerability is disputed.

Expat has been updated to v2.8.3 to fix CVEs for which the patches were too complex to backport.

The fix for CVE-2026-72693 will change behavior of “openvt -u” when root is involved. See:

https://lore.kernel.org/all/CANQUz1807YxnBxVQMeJn8N1mhC698-NEk_tE8XQqRxwa8ke9Vw@mail.gmail.com/

We merged patches to support stable AUH upgrades on a selected few recipes:

  • babeltrace2

  • binutils

  • dbus

  • git

  • glib-2.0

  • libgcrypt

  • libxml2

  • lttng-modules

  • lttng-tools

  • lttng-ust

  • openssl

  • perl

  • python3

  • sqlite3

  • systemd

  • util-linux

  • xz

Security Fixes in Yocto-6.0.4

Fixes in Yocto-6.0.4

bitbake

  • asyncrpc: Close the client event loop when the client is collected

  • bb/tests/fetch.py: add case for filter_regex parameter in latest_versionstring

  • data: Fix expandKeys recursion issue

  • data: Return a list from exported_vars()

  • doc: bitbake-user-manual-environment-setup: use pip to install bitbake-setup

  • fetch/gitsm: Store the original url data to fix relative gitsm paths

  • fetch/wget: Handle long filenames correctly

  • fetch2/__init__.py: add filter_regex to default latest_versionstring

  • fetch2/crate.py: add filter_regex parameter to latest_versionstring

  • fetch2/git.py: add filter_regex parameter to latest_versionstring

  • fetch2/wget.py: add filter_regex parameter to latest_versionstring

  • runqueue: Fix pending_hash_index not including taskname

  • runqueue: fix bad check in process_possible_migrations

  • runqueue: wait for covered tasks before setscene

  • tests/fetch: Drop ftp checkstatus test

  • tests/fetch: Swap bitbake github mirror for YP one

  • tests/fetch: Swap github grpc repo for our own small test repo

  • tests/fetch: Switch to YP mirror repos instead of github

  • toastergui/views: Replace os.system call with improved parameter handling

oecore

  • apr-util: upgrade to 1.6.5

  • at-spi2-core: RDEPENDS on gsettings-desktop-schemas

  • babeltrace2: inherit upstream-stable-release-point

  • binutils: inherit upstream-stable-release-point

  • binutils: stable 2.46 branch updates

  • bitbake.conf: pseudo add rootfs-dbg to PSEUDO_INCLUDE_PATHS

  • bluez5: restrict delta=0 RSSI to proximity filters

  • build-appliance-image: Update to wrynose head revisions

  • ca-certificates: upgrade 20260601 -> 20260816

  • cmake-native: use bundled nghttp2 with bundled curl

  • connman: remove connection_manager from CVE_PRODUCTS

  • dbus: inherit upstream-stable-release-point

  • devtool/upgrade.py: add –stable option

  • dhcpcd: upgrade to 10.3.2

  • expat: upgrade to 2.8.3

  • ffmpeg: upgrade to 8.0.3

  • fmt: update branch name to main

  • gawk: skip randtest in ptest suite

  • git: inherit upstream-stable-release-point

  • glib-2.0: inherit upstream-stable-release-point

  • glibc: stable 2.43 branch updates

  • go: upgrade to 1.26.8

  • golang: fix homepage

  • grub: disable grub-protect for native builds

  • gst-devtools: upgrade to 1.28.5

  • gstreamer1.0*: upgrade to 1.28.5

  • gstreamer1.0: disable an intermittently failing test

  • improve_kernel_cve_report: Fix backported-patch check

  • kernel-fit-image: Don’t add hash node when signing is enabled

  • kernel-yocto-rust: Add clang toolchain check for riscv64

  • kern-tools: bump SRCREV for conditional ‘depends on X if Y’ support

  • lib/oe/recipeutils: make stable_upgrade argument optional in get_recipe_upstream_version()

  • libevent: upgrade to 2.1.13

  • libgcrypt: inherit upstream-stable-release-point

  • libslirp: add tag in SRC_URI

  • libslirp: fix upstream version check

  • libslirp: upgrade to 4.9.3

  • libxml2: inherit upstream-stable-release-point

  • libxml2: upgrade to 2.15.4

  • linux-yocto/6.18: fix kernel reproducibility issues

  • linux-yocto/6.18: update to v6.18.52

  • lttng-modules: inherit upstream-stable-release-point

  • lttng-tools: inherit upstream-stable-release-point

  • lttng-ust: inherit upstream-stable-release-point

  • mesa: align x86 mesa config with LLVM graphics

  • mirrors: Disable YP mirrors on autobuilder

  • oeqa/maturin: Update dependency version

  • openssl: inherit upstream-stable-release-point

  • openssl: upgrade to 3.5.8

  • perl: inherit upstream-stable-release-point

  • procps: ptest: skip flaky pgrep full process name match test

  • pseudo: upgrade to 1.9.11

  • pseudo: Add in openat2, exec and linkat fixes

  • pseudo: Update to 1.9.10

  • python3: add missing pyc files to core

  • python3: fix stringold cache files

  • python3: inherit upstream-stable-release-point

  • python3: upgrade to 3.14.7

  • python3-attrs: Fix CVE_PRODUCT

  • python3-babel: Fix CVE_PRODUCT

  • python3-certifi: fix homepage

  • python3-click: Fix CVE_PRODUCT

  • python3-click: upgrade to 8.3.3

  • python3-cryptography(-vectors): upgrade to 46.0.7

  • python3-cryptography: backport stray file install fix

  • python3-dbusmock: Fix CVE_PRODUCT

  • python3-git: Fix CVE_PRODUCT

  • python3-mako: correct CVE_PRODUCT mapping

  • python3-mako: upgrade to 1.3.12

  • python3-numpy: Fix CVE_PRODUCT

  • python3-pyasn1: upgrade to 0.6.4

  • python3-pycryptodome: Fix CVE_PRODUCT

  • python3-pycryptodomex: Fix CVE_PRODUCT

  • python3-sbom-cve-check: update to version 1.3.5

  • python3-shacl2code: upgrade to 1.1.0

  • python3-spdx-python-model: upgrade to 0.0.6

  • python3-wheel: Fix CVE_PRODUCT

  • qemu: guard RESOLVE_CACHED strace flag

  • recipeutils: add optional stable_upgrade parameter to get_recipe_upgrade_status

  • rootfs.py: fix run-postinsts removal on multilib images

  • rpcbind: Drop dependency on quota

  • rpcbind: upgrade to 1.2.9

  • ruby: upgrade to 4.0.5

  • sbom-cve-check-update-{nvd-native,cvelist-native}: upgrade to 2026.09.12

  • sbom-cve-check-update-db: Exclude recipes from rm_work

  • scripts/install-buildtools: Update to 6.0.3

  • sqlite3: inherit upstream-stable-release-point

  • sstate: Update mtime/atime for sig/siginfo files in sstate_checkhashes()

  • sstate: Update unpack touch code to be consistent

  • systemd: inherit upstream-stable-release-point

  • testimage: handle bootlog variants on failed qemu tests

  • time64: enable 64-bit time/file-offset flags for 32-bit nativesdk

  • toolchain-scripts: fix kernel host tool builds broken in the SDK

  • u-boot: share CVE_PRODUCT with u-boot-tools

  • upstream-stable-release-point.bbclass: add bbclass for stable point upgrade

  • util-linux: inherit upstream-stable-release-point

  • volatile-binds: order systemd-timesyncd after /var/lib

  • wireless-regdb: upgrade to 2026.09.03

  • xserver-xorg: upgrade to 21.1.24

  • xwayland: upgrade to 24.1.13

  • xz: inherit upstream-stable-release-point

meta-yocto

  • poky.conf: Bump version for 6.0.4 release

  • yocto-bsps: update to v6.18.52

yocto-docs

  • README: add references to recent security documents

  • README: update instructions for installing vale and sphinx-lint

  • bitbake.rst: rename section to “BitBake User Manual”

  • bsp-manual/bsp.rst: fix a “local.conf” -> “layer.conf” typo

  • contributor-guide/identify-component.rst: use the same tense as other section

  • dev-manual/poky-manual-setup.rst: suggest use of fragment instead of assignments

  • dev-manual/wic.rst: remove local.conf mentions

  • dev-manual: correct OVERRIDES to FILESOVERRIDES for FILESPATH

  • dev-manual: drop link to out-of-date wiki page

  • dev-manual: quote the values in two recipe examples

  • docs-wide: fix manual names in cross references

  • documentation: use “https” protocol for git.yoctoproject.org

  • index.rst: add introduction paragraphs

  • index.rst: move external links to the bottom of the intro section

  • index.rst: move release notes in their own section

  • index.rst: move the “Overview and Concepts” manual in the “Introduction and Overview” section

  • index.rst: move the contributor guide out of the Manuals section

  • index.rst: show the intro paragraph only for html-based docs

  • migration-guide: add release notes for 5.0.20 6.0.3

  • overview-manual: move the intro content in the index

  • ref-manual/classes.rst: buildstats: remove local.conf default value

  • ref-manual/features.rst: add tools-profile

  • ref-manual/features.rst: fix some cross references

  • ref-manual/structure.rst: fix a “local.conf” -> “layer.conf” typo

  • ref-manual/system-requirements.rst: drop ccache in distros

  • ref-manual/variables.rst: BBMULTICONFIG: fix a typo

  • ref-manual/variables.rst: Document SPDX_AUTHORS

  • ref-manual/variables.rst: Fix the documentation for the SPDX agent variables

  • ref-manual/variables.rst: document the PACKAGEFUNCS PACKAGE_NO_LOCALE variable

  • ref-manual/variables.rst: fix local.conf.extended obsolete path

  • ref-manual/variables.rst: mention built-in fragments for MACHINE/DISTRO

  • ref-manual/variables.rst: GCCVERSION: replace local.conf and mention recipe existence

  • ref-manual/varlocality.rst: mention built-in fragments for distro/machine

  • ref-manual/varlocality.rst: remove BBFILES from local configuration assignments

  • ref-manual: drop the full stop from the QB_SMP example

  • ref-manual: fix a typo in the QB_SMP description

  • ref-manual: update DEBUG_OPTIMIZATION/FULL_OPTIMIZATION

  • security-manual/securing-images.rst: remove “your” in “your OE-Core”

  • toaster-manual: spell the json code-block language in lower case

Known Issues in Yocto-6.0.4

  • N/A

Contributors to Yocto-6.0.4

Thanks to the following people who contributed to this release:

  • Abhishek Bachiphale

  • Adarsh Jagadish Kamini

  • Adrian Freihofer

  • Alejandro Mery

  • Alexander Kanavin

  • Andrei Lalaev

  • Ankur Tyagi

  • Antonin Godard

  • AshishKumar Mishra

  • Benjamin Robin (Schneider Electric)

  • Bhavesh R Maheshwari

  • Bruce Ashfield

  • Chen Qi

  • Chris Laplante

  • Daiane Angolini

  • Daniel Dragomir

  • Daniel Turull

  • Darsh Kelaiya

  • Deepak Rathore

  • Devansh Patel

  • Esa Jaaskela

  • Francisco Pedraza

  • Ghanshyam Banait

  • Harish Sadineni

  • Hetvi Thakar

  • Hiago De Franco

  • Himani Ramesh Barde

  • Himanshu Jadon

  • Hitendra Prajapati

  • Jaipaul Cheernam

  • Jakub Szczudlo (Nokia)

  • Jonas Juffinger

  • Jose Quaresma

  • Joshua Watt

  • Kyungjik Min

  • Lee Chee Yang

  • Leonid Iziumtsev

  • Michal Sieron

  • Paul Barker

  • Peter Marko

  • Peter Tatrai

  • Pratik Farkase

  • Quentin Schulz

  • Richard Purdie

  • Robert P. J. Day

  • Roopa Kalmath

  • Ross Burton

  • Siddharth Doshi

  • Sowmya Sathram

  • Sudhir Dumbhare

  • Tafil Avdyli

  • Tim Orling

  • Trevor Woerner

  • Vijay Anusuri

  • Wang Mingyu

  • Xiuzhuo Shang

  • Yoann Congal

Repositories / Downloads for Yocto-6.0.4

yocto-docs

openembedded-core

mixin

meta-yocto

bitbake