[ANNOUNCEMENT] Yocto Project 5.0.15(scarthgap-5.0.15) is Released

Hi

We are pleased to announce the Yocto Project 5.0.15 Release is now available for download.

https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/poky-72983ac391008ebceb45edc7a8f0f6d5f4fe715c.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/poky-72983ac391008ebceb45edc7a8f0f6d5f4fe715c.tar.bz2

A gpg signed version of these release notes is available at:

https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/RELEASENOTES

Full Test Report:

https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/testreport.txt

Thank you for everyone's contributions to this release.

Chee Yang
[email protected]
Yocto Project Build and Release


--------------------------
yocto-5.0.15 Release Notes
--------------------------

Users of Alma 9, Rocky 9 and Centos Stream 9 rolling releases have seen obtuse failures in the execution of tar in various tasks after recent host distro updates. These newer versions of tar contain a CVE fix
which uses a new glibc call/syscall (openat2). The fix is to update to a newer pseudo version which handles this syscall. This is not included in this stable release but we aim to include it in the next one.

--------------------------
 Repositories/Downloads
--------------------------

Repository Name: yocto-docs
Repository Location: https://git.yoctoproject.org/yocto-docs
Branch: scarthgap
Tag: yocto-5.0.15
Git Revision: d84d916d4fc505e8386693306b6a90b0064c0518
Release Artefact: yocto-docs-d84d916d4fc505e8386693306b6a90b0064c0518
sha: 9020251d0bc11277df0afc1baad05566433d665f31c0b3a45e6cd01c0de6c099
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/yocto-docs-d84d916d4fc505e8386693306b6a90b0064c0518.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/yocto-docs-d84d916d4fc505e8386693306b6a90b0064c0518.tar.bz2

Repository Name: poky
Repository Location: https://git.yoctoproject.org/poky
Branch: scarthgap
Tag: yocto-5.0.15
Git Revision: 72983ac391008ebceb45edc7a8f0f6d5f4fe715c
Release Artefact: poky-72983ac391008ebceb45edc7a8f0f6d5f4fe715c
sha: d5336d1ef1dd48b88cb92748c669360901004d458b7786ddc1918da12fef4edd
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/poky-72983ac391008ebceb45edc7a8f0f6d5f4fe715c.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/poky-72983ac391008ebceb45edc7a8f0f6d5f4fe715c.tar.bz2

Repository Name: openembedded-core
Repository Location: https://git.openembedded.org/openembedded-core
Branch: scarthgap
Tag: yocto-5.0.15
Git Revision: 6988157ad983978ffd6b12bcefedd4deaffdbbd1
Release Artefact: oecore-6988157ad983978ffd6b12bcefedd4deaffdbbd1
sha: 98a691ce87f9aba57007e91b56bbe0af6d6c8f62aacb68820026478ff8e1f819
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/oecore-6988157ad983978ffd6b12bcefedd4deaffdbbd1.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/oecore-6988157ad983978ffd6b12bcefedd4deaffdbbd1.tar.bz2

Repository Name: meta-yocto
Repository Location: https://git.yoctoproject.org/meta-yocto
Branch: scarthgap
Tag: yocto-5.0.15
Git Revision: e1363aa3333cda3a4ae4706ce6577b987ba3a815
Release Artefact: meta-yocto-e1363aa3333cda3a4ae4706ce6577b987ba3a815
sha: 91a1f0c65bd4fff4af2aef4b583d1366efc347726feb36a4d2cdfb480774cc19
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/meta-yocto-e1363aa3333cda3a4ae4706ce6577b987ba3a815.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/meta-yocto-e1363aa3333cda3a4ae4706ce6577b987ba3a815.tar.bz2

Repository Name: meta-mingw
Repository Location: https://git.yoctoproject.org/meta-mingw
Branch: scarthgap
Tag: yocto-5.0.15
Git Revision: bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f
Release Artefact: meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f
sha: ab073def6487f237ac125d239b3739bf02415270959546b6b287778664f0ae65
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f.tar.bz2

Repository Name: bitbake
Repository Location: https://git.openembedded.org/bitbake
Branch: 2.8
Tag: yocto-5.0.15
Git Revision: 8dcf084522b9c66a6639b5f117f554fde9b6b45a
Release Artefact: bitbake-8dcf084522b9c66a6639b5f117f554fde9b6b45a
sha: 766eda21f2a914276d2723b1d8248be11507f954aef8fc5bb1767f3cb65688dd
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.15/bitbake-8dcf084522b9c66a6639b5f117f554fde9b6b45a.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.15/bitbake-8dcf084522b9c66a6639b5f117f554fde9b6b45a.tar.bz2


---------------
 Contributors
---------------

Thanks to the following people who contributed to this release:

Adarsh Jagadish Kamini
Aleksandar Nikolic
Alexander Kanavin
Benjamin Robin (Schneider Electric)
Changqing Li
Daniel Turull
Deepak Rathore
Deepesh Varatharajan
Enrico Jörns
Gyorgy Sarvari
Hitendra Prajapati
Hongxu Jia
Hugo SIMELIERE
Jiaying Song
Kai Kang
Kamel Bouhara (Schneider Electric)
Lee Chee Yang
Martin Jansa
Mingli Yu
Moritz Haase
Osama Abdelkader
Ovidiu Panait
Peter Marko
Praveen Kumar
Quentin Schulz
Robert P. J. Day
Ross Burton
Steve Sakoman
Vijay Anusuri
Walter Werner SCHNEIDER
Yash Shinde
Yogita Urade

---------------
 Known Issues
---------------
N/A


---------------
Security Fixes
---------------
binutils: Fix CVE-2025-11494 CVE-2025-11839 CVE-2025-11840
cmake-native: Fix CVE-2025-9301
cups: Fix CVE-2025-58436 CVE-2025-61915
gnutls: Fix CVE-2025-9820
go: Fix CVE-2025-61727 CVE-2025-61729
go: Update CVE-2025-58187 patches
grub: Fix CVE-2025-54770 CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664
libarchive: Fix CVE-2025-60753
libarchive: Fix 2 security issue (https://github.com/libarchive/libarchive/pull/2753 and  https://github.com/libarchive/libarchive/pull/2768)
libmicrohttpd: Ignore CVE-2025-59777 CVE-2025-62689 by disable experimental code
libpng: Fix CVE-2025-64505 CVE-2025-64506 CVE-2025-64720 CVE-2025-65018 CVE-2025-66293
libsoup: Fix CVE-2025-12105
libssh2: Fix CVE-2023-48795
libxml2: Fix CVE-2025-7425
libxslt: Fix CVE-2025-11731
musl: Fix CVE-2025-26519
python3-urllib3: Fix CVE-2025-66418 CVE-2025-66471
python3: Fix CVE-2025-6075
qemu: Fix CVE-2025-12464
rsync: Fix CVE-2025-10158
ruby: Fix CVE-2025-24294 CVE-2025-25186 CVE-2025-61594
sqlite3: Fix CVE-2025-7709
xserver-xorg: Fix CVE-2025-62229 CVE-2025-62230 CVE-2025-62231
xwayland: Fix CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


---------------
Fixes/Feature Changes
---------------
build-appliance-image: Update to scarthgap head revision
classes/create-spdx-2.2: Define SPDX_VERSION to 2.2
cml1.bbclass: use consistent make flags for menuconfig
cross.bbclass: Propagate dependencies to outhash
curl: Ensure 'CURL_CA_BUNDLE' from host env is indeed respected
curl: Use host CA bundle by default for native(sdk) builds
cve-check: extract extending CVE_STATUS to library function
dev-manual/layers.rst: document "bitbake-layers show-machines"
dev-manual/new-recipe.rst: replace 'bitbake -e' with 'bitbake-getvar'
dev-manual/new-recipe.rst: typo, "whith" -> "which"
dev-manual/new-recipe.rst: update "recipetool -h" output
dev-manual/sbom.rst: reflect that create-spdx is enabled by default
dev-manual: debugging: use bitbake-getvar in Viewing Variable Values section
documentation: link to the Releases page on yoctoproject.org instead of wiki
glslang: fix compiling with gcc15
go: add sdk test
go: extend runtime test
go: remove duplicate arch map in sdk test
goarch.bbclass: do not leak TUNE_FEATURES into crosssdk task signatures
kernel-dev: add disable config example
kernel-dev: common: migrate bitbake -e to bitbake-getvar
kernel.bbclass: Add task to export kernel configuration to SPDX
libssh2: fix regression in KEX method validation (GH-1553)
libssh2: upgrade to 1.11.1
migration-guides: add release notes for 4.0.31 and 5.0.13
oe/sdk: fix empty SDK manifests
oeqa/sdk/buildepoxy: skip test in eSDK
oeqa/selftest: oe-selftest: Add SPDX tests for kernel config and PACKAGECONFIG
oeqa: drop unnecessary dependency from go runtime tests
oeqa: fix package detection in go sdk tests
overview-manual: migrate to SVG + fix typo
poky.conf: bump version for 5.0.15
ref-manual: variables: migrate the OVERRIDES note to bitbake-getvar
ruby: Upgrade to 3.3.10
rust-target-config: fix nativesdk-libstd-rs build with baremetal
scripts/install-buildtools: Update to 5.0.14
spdx30: Provide software_packageUrl field in SPDX 3.0 SBOM
spdx30: fix cve status for patch files in VEX
spdx30: provide all CVE_STATUS, not only Patched status
spdx30_tasks: Add support for exporting PACKAGECONFIG to SPDX
spdx: Revert "spdx: Update for bitbake changes"
spdx: extend CVE_STATUS variables
testsdk: allow user to specify which tests to run
vex.bbclass: add a new class
vex: fix rootfs manifest
xserver-xorg: remove redundant patch