Release notes for Yocto-5.0.21 (Scarthgap)

Expat has been updated to v2.8.3 to fix CVEs for which the patches were too complex to backport.

Security Fixes in Yocto-5.0.21

Fixes in Yocto-5.0.21

  • at-spi2-core: RDEPENDS on gsettings-desktop-schemas

  • bitbake.conf: add TMPDIR to GIT_CEILING_DIRECTORIES

  • bitbake: fetch/gitsm: Store the original url data to fix relative gitsm paths

  • bitbake: fetch2/gcp: treat GatewayTimeout as fetch failure

  • bitbake: tests/fetch: Drop ftp checkstatus test

  • bitbake: tests/fetch: Drop github url from testing

  • bitbake: tests/fetch: Swap bitbake github mirror for YP one

  • bitbake: tests/fetch: Swap github grpc repo for our own small test repo

  • bitbake: tests/fetch: Switch to YP mirror repos instead of github

  • bitbake: toastergui/views: Replace os.system call with improved parameter handling

  • bsp-manual/bsp.rst: fix a “local.conf” -> “layer.conf” typo

  • build-appliance-image: Update to scarthgap head revision

  • ca-certificates: upgrade to 20260816

  • curl: Fix CVE-2025-10148.patch for websockets on 8.7.1

  • dev-manual: correct OVERRIDES to FILESOVERRIDES for FILESPATH

  • dev-manual: drop link to out-of-date wiki page

  • dev-manual: quote the values in two recipe examples

  • documentation: use “https” protocol for git.yoctoproject.org

  • expat: upgrade 2.6.4 -> 2.8.3 (exception security update)

  • gcc: Upgrade to GCC 13.5

  • golang: fix homepage

  • improve_kernel_cve_report: fix backported-patch check

  • improve_kernel_cve_report: validate that cve details field exists

  • libevent: merge inherit statements

  • libevent: upgrade to 2.1.13

  • libevent: use libtool to install test binaries

  • linux-yocto/6.6: fix tiny build

  • linux-yocto/6.6: update to v6.6.151

  • migration-guide: add release notes for 5.0.20

  • openssl: upgrade to 3.5.8

  • ovmf: fix tpm PACKAGECONFIG to use TPM2_ENABLE

  • poky.conf: Bump version for 5.0.21 release

  • pseudo: upgrade to 1.9.11

  • pseudo: Add in openat2, exec and linkat fixes

  • ptest-runner: Upgrade to 2.5.1

  • python3: skip ptest incompatible with ptest-runner >= 2.5.0

  • python3: upgrade to 3.12.14

  • python3-attrs: fix CVE_PRODUCT

  • python3-babel: fix CVE_PRODUCT

  • python3-certifi: fix homepage

  • python3-click: fix CVE_PRODUCT

  • python3-dbusmock: fix CVE_PRODUCT

  • python3-git: fix CVE_PRODUCT

  • python3-mako: correct CVE_PRODUCT mapping

  • python3-numpy: fix CVE_PRODUCT

  • python3-py: set CVE_PRODUCT

  • python3-pycryptodome: fix CVE_PRODUCT

  • python3-pycryptodomex: fix CVE_PRODUCT

  • python3-wheel: fix CVE_PRODUCT

  • ref-manual/features.rst: add tools-profile

  • ref-manual/structure.rst: fix a “local.conf” -> “layer.conf” typo

  • ref-manual/variables.rst: BBMULTICONFIG: fix a typo

  • ref-manual/varlocality.rst: remove BBFILES from local configuration assignments

  • ref-manual: add new vex class

  • ref-manual: drop the full stop from the QB_SMP example

  • ref-manual: fix a typo in the QB_SMP description

  • rootfs.py: fix run-postinsts removal on multilib images

  • scripts/install-buildtools: Update to 5.0.20

  • socat: fix native build on host with newer glibc

  • spdx30_tasks: Fix SPDX_CUSTOM_ANNOTATION_VARS implementation

  • sstate: Update mtime/atime for sig/siginfo files in sstate_checkhashes()

  • sstate: Update unpack touch code to be consistent

  • systemd: upgrade to 255.22

  • testimage: avoid symlinking missing qemu boot log

  • time64: enable 64-bit time/file-offset flags for 32-bit nativesdk

  • toaster-manual: spell the json code-block language in lower case

  • u-boot: share CVE_PRODUCT with u-boot-tools

  • wireless-regdb: upgrade to 2026.09.03

Known Issues in Yocto-5.0.21

  • N/A

Contributors to Yocto-5.0.21

Thanks to the following people who contributed to this release:

  • Adarsh Jagadish Kamini

  • Anil Dongare

  • Antonin Godard

  • Bruce Ashfield

  • Daniel Turull

  • Darsh Kelaiya

  • Deepak Rathore

  • Deepesh Varatharajan

  • Devansh Patel

  • Eilís ‘pidge’ Ní Fhlannagáin

  • Emily Vekariya

  • Etienne Cordonnier

  • Gyorgy Sarvari

  • Hemanth Kumar M D

  • Hetvi Thakar

  • Hiago De Franco

  • Hitendra Prajapati

  • Jaipaul Cheernam

  • Jakub Szczudlo (Nokia)

  • Kyungjik Min

  • Lee Chee Yang

  • Martin Jansa

  • Paul Barker

  • Peter Marko

  • Peter Tatrai

  • Pratik Farkase

  • Richard Purdie

  • Robert P. J. Day

  • Roland Kovacs

  • Ross Burton

  • Sebastian Muxel

  • Siddharth Doshi

  • Stefano Tondo

  • Tim Orling

  • Trevor Woerner

  • Vijay Anusuri

  • Wang Mingyu

  • Yoann Congal

  • Yogita Urade

Repositories / Downloads for Yocto-5.0.21

yocto-docs

poky

openembedded-core

meta-yocto

meta-mingw

bitbake