Release notes for Yocto-5.0.20 (Scarthgap)

Security Fixes in Yocto-5.0.20

Fixes in Yocto-5.0.20

  • bind: Upgrade to 9.18.49

  • binutils: CVE-2025-69648.patch also fixed CVE-2025-69646

  • bitbake.rst: rename section to “BitBake User Manual”

  • bitbake: README: Add “2.8” subject-prefix to git-send-email suggestion

  • bitbake: utils: Add NFS EEXISTS/isdir failure workaround

  • build-appliance-image: Update to scarthgap head revision

  • bzip2: fix ‘bzip2 –version > /tmp/aaa 2>&1’ hang

  • ca-certificates: upgrade to 20260601

  • cargo-update-recipe-crates: Don’t fail for partially empty Cargo.lock

  • contributor-guide/identify-component.rst: use the same tense as other section

  • contributor-guide: Note patch complexity requirements for stable branches

  • create-spdx-image-3.0: correct SSTATE_SKIP_CREATION key for do_create_image_sbom_spdx

  • cve-update: Avoid NFS caching issues

  • dev-manual/sbom.rst: refresh for SPDX3

  • docs: fix broken path links

  • docs: fix manual names in cross references

  • docs: fix various broken links

  • docs: index.rst: add introduction paragraphs

  • docs: index.rst: move external links to the bottom of the intro section

  • docs: index.rst: move release notes in their own section

  • docs: index.rst: move the “Overview and Concepts” manual in the “Introduction and Overview” section

  • docs: index.rst: move the contributor guide out of the Manuals section

  • docs: index.rst: show the intro paragraph only for html-based docs

  • docs: kernel-dev/common.rst: remove taskhash mismatch note

  • docs: README: update instructions for installing vale and sphinx-lint

  • docs: recipe-style-guide: Clarify when License-Update tag is needed

  • docs: remove CROPS references

  • flex: update CVE_PRODUCT

  • glibc-testsuite: Do not generate SPDX

  • glibc: stable 2.39 branch updates

  • libgcrypt: upgrade to 1.10.4

  • linux-yocto/6.6: update to v6.6.147

  • migration-guide: add release notes for 5.0.19

  • migration-guides/release-notes-3.4.2.rst: fix a broken link

  • migration-guides/release-notes-5.0.rst: remove broken link

  • migration-guides: replace broken link with archive links

  • openssh: CVE-2026-35387.patch also fixed CVE-2026-35414

  • overview-manual: move the intro content in the index

  • package.bbclass: hardcode emit_pkgdata to run last

  • perf: drop newt from tui build requirements

  • poky.conf: Bump version for 5.0.20 release

  • python3-certifi: set CVE_PRODUCT

  • python3-cryptography: set CVE_PRODUCT

  • python3-idna: set CVE_PRODUCT

  • python3-pip: set CVE_PRODUCT

  • python3-ply: set CVE_PRODUCT

  • python3-pyasn1: set CVE_PRODUCT

  • python3-pyopenssl: set CVE_PRODUCT

  • python3-pyyaml: set CVE_PRODUCT

  • python3-xmltodict: set CVE_PRODUCT

  • python3: Simplify ptest exclusion list

  • python3: skiptest tracemalloc_track_race

  • ref-manual/classes.rst: replace obsolete mailing list thread

  • ref-manual/features.rst: fix some cross references

  • ref-manual/images.rst: update obsolete VMWare links

  • ref-manual/release-process.rst: update LTS supported versions

  • ref-manual: Fix occurrences of omitted space with :prepend

  • ref-manual: remove all traces of “kernel_menuconfig” task

  • rootfs: move tasks using image_list_installed_packages to postuninstall

  • scripts/install-buildtools: Update to 5.0.19

  • shadow: set CVE_PRODUCT

  • sudo: fix pam-wheel sed for sudo 1.9.17p2 sudoers

  • sudo: set CVE_PRODUCT

  • tzdata/tzcode-native: upgrade 2026b -> 2026c

  • u-boot: Set CVE_PRODUCT

  • vex: remove obsolete semicolon

  • wic: Fix updating fstab for nvme devices

  • wireless-regdb: upgrade to 2026.05.30

  • xmlto: update SRC_URI

  • xserver-org: update CVE_PRODUCT

Known Issues in Yocto-5.0.20

  • N/A

Contributors to Yocto-5.0.20

Thanks to the following people who contributed to this release:

  • Adarsh Jagadish Kamini

  • Aleksandar Nikolic

  • Alexander Kanavin

  • Amaury Couderc

  • Anil Dongare

  • Ankur Tyagi

  • Antonin Godard

  • AshishKumar Mishra

  • Ashishkumar Parmar

  • Benjamin Robin (Schneider Electric)

  • Bruce Ashfield

  • Daiane Angolini

  • Daniel Turull

  • Darsh Kelaiya

  • David Nyström

  • Deepak Rathore

  • Devansh Patel

  • Enoch Ng

  • Eric Meyers

  • Esa Jaaskela

  • Harish Sadineni

  • Himanshu Jadon

  • Hitendra Prajapati

  • Hongxu Jia

  • Hugo SIMELIERE (Schneider Electric)

  • Jaipaul Cheernam

  • Jakub Szczudlo

  • Joshua Watt

  • João Marcos Costa

  • Kris Gavvala

  • Lee Chee Yang

  • Maik Otto

  • Marta Rybczynska

  • Martin Schwan

  • Mathieu Dubois-Briand

  • Nate Kent

  • Niko Mauno

  • Paul Barker

  • Peter Marko

  • Quentin Schulz

  • Richard Purdie

  • Robert P. J. Day

  • Roland Kovacs

  • Ross Burton

  • Shubham Pushpkar

  • Siddharth Doshi

  • Sudhir Dumbhare

  • Theo Gaige

  • Theo Gaige (Schneider Electric)

  • Vijay Anusuri

  • Yoann Congal

  • mark.yang

Repositories / Downloads for Yocto-5.0.20

yocto-docs

poky

openembedded-core

meta-yocto

meta-mingw

bitbake