Release notes for Yocto-6.0.2 (Wrynose)

This release removed the linux-yocto 6.18 CVE exclusion list (meta/recipes-kernel/linux/cve-exclusion_6.18.inc) as sbom-cve-check now natively handles CVE status.

Security Fixes in Yocto-6.0.2

Fixes in Yocto-6.0.2

bitbake

  • bitbake: fix issue with varflag exclusion

  • fetch2/crate: guard against empty version list

  • fetch2/crate: skip yanked versions when reading cargo index

  • fetch2/git: quote shallow extra ref arguments

  • fetch2/wget: limit auth on checkstatus redirects

  • fetch2: Unpack RPMs with –no-absolute-filenames

  • fetch2: allow empty value for params while formatting URI string.

  • fetch2: reraise IOError during download

  • fetch2: validate deb/ipk data member names

  • fetch2: validate striplevel parameter

  • hashserv/tests: use valid 64-character unihashes

  • hashserv: validate unihash values

  • layerindexlib: restapi.py: fix unbound variable

  • tests/fetch: cover checkstatus redirect auth handling

  • toaster: use https for clones, remove cgit in links in defaults

meta-yocto

  • poky.conf: Bump version for 6.0.2 release

openembedded-core

  • bind: upgrade to 9.20.23

  • binutils: Upgrade to 2.46.1

  • build-appliance-image: Update to wrynose head revisions

  • ca-certificates: upgrade to 20260601

  • classes/gtk-icon-cache: fix libdir passed to the postrm intercept

  • conf/machine: fix typos in ARM and x86 README files

  • curl: fix mbedtls detection

  • dropbear: Clarify LICENSE and drop PD

  • gcc: Upgrade GCC to 15.3 release

  • gettext-minimal-native: Use SPDX License Identifier

  • glib-2.0-native: Remove problematic path reference

  • glib-2.0: Change from Public Domain to Gnome GCR Documentation License

  • go: upgrade to 1.26.4

  • gstreamer1.0-plugins-bad: handle padded buffers in wl_shm buffer creation

  • libpcap: fix error message on 32-bit integer overflow

  • libsdl2: Fix compilation error with DirectFB

  • licenses: Update with the pull-sdpx-licenses.py script to 3.28.0

  • linux-yocto: remove CVE exclusion list, sbom-cve-check does this itself

  • lttng-modules: Fix trace_hrtimer_start build failure

  • matchbox-panel-2: backport patch to set a constant size for the clock

  • mobile-broadband-provider-info: Fix license to be CC-PDDC

  • net-tools: Handle binmerge

  • oeqa/core/runner: stub addDuration in OETestResult

  • openssl: upgrade to 3.5.7

  • perf: disable BUILD_BPF_SKEL by default

  • perf: make libraries for install_headers configurable

  • pixman: Change PD license to HPND-sell-variant

  • ppp: Remove PD license

  • pseudo: Update to version 1.9.8

  • python3-pycryptodome: Update LICENSE PD -> Unlicense

  • python3-pyelftools: Update license to Unlicense

  • python3: Fix ThreadingMock call_count race condition

  • python3: sanitize userbase in _sysconfig_vars JSON to avoid host path leak

  • python3: upgrade to 3.14.5

  • python3targetconfig: pull in nativesdk python when building nativesdk recipes

  • rust: export CARGO_BUILD_TARGET

  • sbom-cve-check-common: Fatalize command failure

  • sbom-cve-check: Fix breakage with empty IMAGE_LINK_NAME

  • scripts/install-buildtools: Update to 6.0.1

  • sqlite3: Use SPDX identifier

  • squashfs-tools: add another CPE

  • sstate: Detect broken sstate paths containing tmpdir

  • udev-extraconf: use -H for unmount tmpfile find

  • util-macros: Remove redundant MIT license

  • wireless-regdb: upgrade to 2026.05.30

  • xserver-xorg/xwayland: ‘Clarify’ xserver license

  • xserver-xorg/xwayland: Drop X11-swapped from LICENSE

  • xserver-xorg: upgrade to 21.1.22

  • xwayland: upgrade 24.1.9 -> 24.1.11

yocto-docs

  • Document shared state signing

  • bsp-guide: mention bootloader and device tree in BSP intro

  • bsp-guide: simplify example of structure of BSP layer

  • bsp-guide: update guide to reflect newer beaglebone

  • build-manual: update ROOTFS_POSTPROCESS_COMMAND example

  • contributor-guide: couple minor typo/grammar fixes

  • dev-manual: SysVinit is the default init manager for Poky

  • dev-manual: change “setup” to “set up” when used as an action

  • dev-manual: drop “PREFERRED_VERSION” from x86-base.inc snippet

  • dev-manual: fix broken grammar in “Libraries” section

  • dev-manual: fix grammatical error, missing word “with”

  • dev-manual: fully define SOLIBS-related variables in bitbake.conf

  • dev-manual: remove semicolons for rootfs commands

  • dev-manual: update AUTOREV explanation to match current file

  • kernel-dev: remove references to defunct LTSI project

  • migration-guide: Fix migration scripts

  • migration-guide: add release notes for 5.0.18

  • overview-manual/concepts: convert several .png to SVG

  • overview-manual/svg: remove white backgrounds

  • overview-manual: add “:term:” for OE Build System

  • overview-manual: correct that “conf” is a subdir of build dir

  • overview-manual: explain “ODM” and “OSV” acronyms

  • overview-manual: fix typo, “semi-colon” -> “colon”

  • overview-manual: hyphens not allowed in file version

  • overview-manual: inform the reader early of “bitbake-getvar”

  • overview-manual: mention that patch files can be compressed

  • overview-manual: provide a more expansive definition of “layer”

  • overview-manual: remind reader that meta-poky is a distro layer

  • overview-manual: update deploy.bbclass snippet

  • overview-manual: use correct spelling “counterpart”

  • recipe-style-guide.rst: two minor grammatical tweaks

  • ref-manual/variables.rst: link *MIRRORS definitions to the BitBake manual

  • ref-manual: add more explanation to glossary variable LICENSE

  • ref-manual: clarify that PACKAGE_EXCLUDE supports DEB packaging

  • ref-manual: clarify use of “PACKAGE_ARCH” in a packagegroup

  • ref-manual: document RM_WORK_EXCLUDE_ITEMS variable

  • ref-manual: update glossary entries for packaging backend variables

  • security-manual: some grammar and wording fixes in intro

  • security-team.rst: update my email address and key

  • security-team: Add section on multi-project embargoes

  • security-team: Tidy and update section on security team operations

  • security-team: Update membership list

Known Issues in Yocto-6.0.2

  • N/A

Contributors to Yocto-6.0.2

Thanks to the following people who contributed to this release:

  • Abhishek Bachiphale

  • Adarsh Jagadish Kamini

  • Alexander Kanavin

  • Anders Heimer

  • Anil Dongare

  • Ankur Tyagi

  • Anthony Squires

  • Antonin Godard

  • Bin Cao

  • David Reyna

  • Deepak Rathore

  • Harish Sadineni

  • He Zhe

  • Hemanth Kumar M D

  • Jate Sujjavanich

  • Jesse Van Gavere

  • Jinfeng Wang

  • Joshua Watt

  • João Marcos Costa

  • Jörg Sommer

  • Lee Chee Yang

  • Marcio Henriques

  • Mark Hatle

  • Mark Jonas

  • Marta Rybczynska

  • Niko Mauno

  • Omkar Patil

  • Paul Barker

  • Peter Marko

  • Prabhudasu Vatala

  • Quentin Schulz

  • Richard Purdie

  • Robert P. J. Day

  • Ross Burton

  • Sai Sneha

  • Thomas Perrot

  • Tushar Darote

  • Vyacheslav Yurkov

  • Wang Mingyu

  • Yoann Congal

  • hongxu

Repositories / Downloads for Yocto-6.0.2

yocto-docs

openembedded-core

meta-yocto

bitbake