Release notes for Yocto-4.0.23 (Kirkstone)

Security Fixes in Yocto-4.0.23

curl: Fix CVE-2024-9681
expat: Fix CVE-2024-50602
gcc: Ignore CVE-2023-4039
ghostscript: Fix CVE-2023-46361 and CVE-2024-29508
gstreamer1.0: Ignore CVE-2024-0444
libarchive: Fix CVE-2024-48957 and CVE-2024-48958
openssl: Fix CVE-2024-9143
orc: Fix CVE-2024-40897
python3: Ignore CVE-2023-27043, CVE-2024-6232 and CVE-2024-7592
qemu: Fix CVE-2023-3019
vim: Fix CVE-2024-43790, CVE-2024-43802, CVE-2024-45306 and CVE-2024-47814
zstd: Fix CVE-2022-4899

Fixes in Yocto-4.0.23

at-spi2-core: backport a patch to fix build with gcc-14 on host
bitbake: bitbake: doc/user-manual: Update the BB_HASHSERVE_UPSTREAM
bitbake: codeparser: Fix handling of string AST nodes with older Python versions
bitbake: fetch2/git: Use quote from shlex, not pipes
bitbake: gitsm: Add call_process_submodules() to remove duplicated code
bitbake: gitsm: Remove downloads/tmpdir when failed
bitbake: tests/fetch: Use our own mirror of mobile-broadband-provider to decouple from gnome gitlab
bitbake: tests/fetch: Use our own mirror of sysprof to decouple from gnome gitlab
bmap-tools: update HOMEPAGE and SRC_URI
build-appliance-image: Update to kirkstone head revision
cmake: Fix sporadic issues when determining compiler internals
cracklib: Modify patch to compile with GCC 14
cve-check: add CVSS vector string to CVE database and reports
cve-check: add support for cvss v4.0
cve_check: Use a local copy of the database during builds
dev-manual: document how to provide confs from layer.conf
documentation: Makefile: add SPHINXLINTDOCS to specify subset to sphinx-lint
documentation: Makefile: fix epub and latexpdf targets
documentation: README: add instruction to run Vale on a subset
documentation: brief-yoctoprojectqs: update BB_HASHSERVE_UPSTREAM for new infrastructure
documentation: conf.py: add a bitbake_git extlink
documentation: rename :cve: role to :cve_nist:
documentation: styles: vocabularies: Yocto: add sstate
documnetation: contributor-guide: Remove duplicated words
gcc: restore a patch for Neoverse N2 core
glib-2.0: patch regression of CVE-2023-32665
kmscube: create_framebuffer: backport modifier fix
libffi: backport a fix to build libffi-native with gcc-14
linux-firmware: Upgrade to 20240909
local.conf.sample: update BB_HASHSERVE_UPSTREAM for new infrastructure
migration-guide: add release notes for 4.0.22
migration-guide: release-notes-4.0: update BB_HASHSERVE_UPSTREAM for new infrastructure
nativesdk-intercept: Fix bad intercept chgrp/chown logic
orc: Upgrade to 0.4.40
overlayfs-etc: add option to skip creation of mount dirs
overview-manual: concepts: add details on package splitting
package: Switch debug source handling to use prefix map
patch.py: Use shlex instead of deprecated pipe
poky.conf: bump version for 4.0.23
pseudo: Disable LFS on 32bit arches
pseudo: Fix envp bug and add posix_spawn wrapper
pseudo: Fix to work with glibc 2.40
pseudo: Switch back to the master branch
pseudo: Update to include logic fix
pseudo: Update to include open symlink handling bugfix
pseudo: Update to pull in fchmodat fix
pseudo: Update to pull in fd leak fix
pseudo: Update to pull in gcc14 fix and missing statvfs64 intercept
pseudo: Update to pull in linux-libc-headers race fix
pseudo: Update to pull in python 3.12+ fix
pseudo: Update to pull in syncfs probe fix
ref-manual: add description for the “sysroot” term
ref-manual: add missing CVE_CHECK manifest variables
ref-manual: add missing EXTERNAL_KERNEL_DEVICETREE variable
ref-manual: add missing OPKGBUILDCMD variable
ref-manual: devtool-reference: document missing commands
ref-manual: devtool-reference: refresh example outputs
ref-manual: introduce CVE_CHECK_REPORT_PATCHED variable
ref-manual: release-process: add a reference to the doc’s release
ref-manual: release-process: refresh the current LTS releases
ref-manual: release-process: update releases.svg
ref-manual: release-process: update releases.svg with month after “Current”
ref-manual: structure.rst: document missing tmp/ dirs
ref-manual: variables: add SIGGEN_LOCKEDSIGS* variables
syslinux: Disable error on implicit-function-declaration
util-linux: Define pidfd_* function signatures
vala: add -Wno-error=incompatible-pointer-types work around
vim: Upgrade to 9.1.0764
xmlto: backport a patch to fix build with gcc-14 on host
zip: Fix build with gcc-14
zip: Make configure checks to be more robust