Release notes for Yocto-5.0.18 (Scarthgap)

Security Fixes in Yocto-5.0.18

The large number of CVE updates for the linux-yocto recipe is linked to two backport commits on OpenEmbedded-Core (OE-Core). See 66a13f9 and 4bdf534 for more details on these changes.

Fixes in Yocto-5.0.18

  • apt: Add CVE_PRODUCT to support product name

  • apt: Fix build with GCC 15

  • archiver: Don’t try to preserve all attributes when copying files

  • base-passwd: upgrade 3.6.8

  • binutils: backport patch to fix build with glibc-2.43 on host

  • bitbake: fetch/git: Fix leaking of temporary directory

  • bitbake: fetch2/crate: use CDN for fetching crates

  • bitbake: runqueue.py: make sure we use bb multiprocessing

  • bitbake: tests/fetch: Avoid using git protocol in tests

  • build-appliance-image: switch SRC_URI to https protocol

  • build-appliance-image: Update to scarthgap head revisions

  • ca-certificates: upgrade to 20260223

  • cmake: backport a fix for gcc-16 on host

  • contributor-guide/submit-changes.rst: Added missing word

  • coreutils: set CVE_PRODUCT

  • db: Pin to use C99 std

  • dbus: gate user-session PACKAGECONFIG on systemd in DISTRO_FEATURES

  • dbus: use ${PN} in pkg_postinst instead of ‘dbus’

  • dev-manual: “–runonly” should be “–runall”

  • devtool: Disable gpg signing when setting up source tree repos

  • dtc: backport fix for build with glibc-2.43

  • elfutils: don’t add -Werror to avoid discarded-qualifiers

  • gcc: backport a fix for building with gcc-16

  • ghostscript: fix build with gcc-15 on host

  • ghostscript: Pin to C17 std

  • glibc: Fix recipe bug that disabled stack protector

  • grub: update search parameter

  • kernel-devsrc: make tools/Build optional

  • lib/oeqa/utils/httpserver: use multiprocessing from bb

  • libatomic-ops: upgrade to 7.8.4

  • liburcu: upgrade to 0.14.2

  • libxcrypt: avoid discarded-qualifiers build failure with glibc 2.43

  • libxcrypt: Fix build wrt C23 support

  • libxcrypt: Use configure knob to disable warnings as errors

  • license.py: Drop visit_Str from SeenVisitor in selftest

  • linux-yocto/6.6: update to v6.6.127

  • linux/generate-cve-exclusions: backport script from master branch

  • ltp: fix epoll_ctl04 failed

  • lttng-ust: upgrade to 2.13.10

  • mesa: fix build on host with glibc-2.43

  • meta/files/layers.example.json: switch to https clone URIs

  • migration-guide: add release notes for 4.0.33 4.0.34 5.0.17

  • oeqa/sdk: Default to https git protocol for YP/OE repos

  • oeqa/selftest/git-submodule-test: Default to https git protocol for YP/OE repos

  • openssl: upgrade to 3.5.6

  • overview-manual/concepts.rst: fix do_prepare_recipe_sysroot task description

  • ovmf: backport a fix for build with gcc-16

  • poky.conf: Bump version for 5.0.18 release

  • poky: Fix CentOS Stream distro names

  • pseudo: Add fix for glibc 2.43

  • python3: upgrade to 3.12.13

  • qemu: backport patches to support python 3.14

  • ref-manual/variables.rst: update COMPONENTS_DIR’s PKGDATA_DIR’s RECIPE_SYSROOT* STAGING_DIR* descriptions

  • scripts: Default to https git protocol for YP/OE repos

  • selftest/gdbserver: replace shutil.unpack_archive with tarfile extract

  • selftest/minidebuginfo: extract files from tar archive using tarfile module

  • selftest/scripts: Update old git protocol references

  • spdx30_tasks: fix condition in create_spdx

  • sphinx-static/theme_overrides.css: switch to a fixed width documentation

  • spirv-tools: backport a fix for building with gcc-16

  • sudo: upgrade to 1.9.17p2

  • tcl: skip http11 tests

  • texinfo: Backport patches for hosts with newer GCC

  • tzdata/tzcode-native: upgrade to 2026a

  • unfs3: Fix race issue causing a glibc test hang

  • variables.rst: expand explanation of RSUGGESTS

  • virglrenderer: Fix build with glibc 2.43+

  • yocto-uninative: Update to 5.1 for glibc 2.43

Known Issues in Yocto-5.0.18

  • N/A

Contributors to Yocto-5.0.18

Thanks to the following people who contributed to this release:

  • Adam Blank

  • Adarsh Jagadish Kamini

  • Alexander Kanavin

  • Andrej Kozemcak

  • Anil Dongare

  • Antonin Godard

  • Bruce Ashfield

  • Changqing Li

  • Daniel Turull

  • Dawid Bijak

  • Fabien Thomas

  • Guocai He

  • Hemanth Kumar M D

  • Himanshu Jadon

  • Hitendra Prajapati

  • Hongxu Jia

  • Hugo SIMELIERE

  • Ivan Nestlerode

  • Jhonata Poma-Hansen

  • Jiaying Song

  • Jinfeng Wang

  • Johan Anderholm

  • João Marcos Costa (Schneider Electric)

  • Khem Raj

  • Lee Chee Yang

  • Li Wang

  • Martin Jansa

  • Michael Halstead

  • Mingli Yu

  • Moritz Haase

  • Paul Barker

  • Peter Marko

  • Richard Purdie

  • Robert P. J. Day

  • Ross Burton

  • Sudhir Dumbhare

  • Sunil Dora

  • Trevor Gamblin

  • Vijay Anusuri

  • Xiangyu Chen

  • Yanis BINARD

  • Yoann Congal

  • Zhang Peng

Repositories / Downloads for Yocto-5.0.18

yocto-docs

poky

openembedded-core

meta-yocto

meta-mingw

bitbake