[ANNOUNCEMENT] Yocto Project 5.3.3 (whinlatter-5.3.3) is Released

Hi

We are pleased to announce the Yocto Project 5.3.3 Release is now available for download.

https://downloads.yoctoproject.org/releases/yocto/yocto-5.3.3/
https://mirrors.kernel.org/yocto/yocto/yocto-5.3.3/

A gpg signed version of these release notes is available at:

https://downloads.yoctoproject.org/releases/yocto/yocto-5.3.3/RELEASENOTES

Full Test Report:

https://downloads.yoctoproject.org/releases/yocto/yocto-5.3.3/testreport.txt

Thank you for everyone's contributions to this release.

Chee Yang
[email protected]
Yocto Project Build and Release


--------------------------
yocto-5.3.3 Release Notes
--------------------------


--------------------------
 Repositories/Downloads
--------------------------

Repository Name: yocto-docs
Repository Location: https://git.yoctoproject.org/yocto-docs
Branch: whinlatter
Tag: yocto-5.3.3
Git Revision: 82bd1a71e6e6a707d0009725969976cf2256af36
Release Artefact: yocto-docs-82bd1a71e6e6a707d0009725969976cf2256af36
sha: fcf7020e34198f3b89077f9649cec579f4d23228f7f0a3a28a21c6b5b3649857
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.3.3/yocto-docs-82bd1a71e6e6a707d0009725969976cf2256af36.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-5.3.3/yocto-docs-82bd1a71e6e6a707d0009725969976cf2256af36.tar.bz2

Repository Name: openembedded-core
Repository Location: https://git.openembedded.org/openembedded-core
Branch: whinlatter
Tag: yocto-5.3.3
Git Revision: ab57471acad7ce2a037480dc7b301104620f1ebf
Release Artefact: oecore-ab57471acad7ce2a037480dc7b301104620f1ebf
sha: 63ed486722e186d517e333c204def0a7bf578ca78bdeb2ad982625c49e7ee833
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.3.3/oecore-ab57471acad7ce2a037480dc7b301104620f1ebf.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-5.3.3/oecore-ab57471acad7ce2a037480dc7b301104620f1ebf.tar.bz2

Repository Name: meta-yocto
Repository Location: https://git.yoctoproject.org/meta-yocto
Branch: whinlatter
Tag: yocto-5.3.3
Git Revision: 9b98ec5e6cfb6c9dc74d3c2e6304eeb274f7c487
Release Artefact: meta-yocto-9b98ec5e6cfb6c9dc74d3c2e6304eeb274f7c487
sha: fcb81c6835036c4157b16dfc9f6d8c5a7dd0ed7ac72f59be238e99b486b1f8fa
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.3.3/meta-yocto-9b98ec5e6cfb6c9dc74d3c2e6304eeb274f7c487.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-5.3.3/meta-yocto-9b98ec5e6cfb6c9dc74d3c2e6304eeb274f7c487.tar.bz2

Repository Name: meta-mingw
Repository Location: https://git.yoctoproject.org/meta-mingw
Branch: whinlatter
Tag: yocto-5.3.3
Git Revision: 00323de97e397d4f6734ef2191806616989f5e10
Release Artefact: meta-mingw-00323de97e397d4f6734ef2191806616989f5e10
sha: c9a70539b12c0642596fde6a2766d4a6a8fec8b2a366453fb6473363127a1c77
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.3.3/meta-mingw-00323de97e397d4f6734ef2191806616989f5e10.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-5.3.3/meta-mingw-00323de97e397d4f6734ef2191806616989f5e10.tar.bz2

Repository Name: bitbake
Repository Location: https://git.openembedded.org/bitbake
Branch: 2.16
Tag: yocto-5.3.3
Git Revision: 7af7e04f3adc8ba144d9e2e6b37ed4ddb3b59df0
Release Artefact: bitbake-7af7e04f3adc8ba144d9e2e6b37ed4ddb3b59df0
sha: 06dd68908a5ffafae46ff7616e93a80f8b73c016f541e9517cf63b05f52f15c7
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.3.3/bitbake-7af7e04f3adc8ba144d9e2e6b37ed4ddb3b59df0.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-5.3.3/bitbake-7af7e04f3adc8ba144d9e2e6b37ed4ddb3b59df0.tar.bz2


---------------
 Contributors
---------------

Thanks to the following people who contributed to this release:

Adarsh Jagadish Kamini
Ankur Tyagi
Antonin Godard
Benjamin Robin (Schneider Electric)
Daniel Dragomir
Fabio Berton
Hugo SIMELIERE
Jan Vermaete
Kristiyan Chakarov
Liu Yiding
Livin Sunny
Martin Jansa
Michael Opdenacker
Paul Barker
Peter Marko
Quentin Schulz
Richard Purdie
Robert P. J. Day
Ross Burton
Shaik Moin
Vijay Anusuri
Yoann Congal

---------------
 Known Issues
---------------
N/A


---------------
Security Fixes
---------------
alsa-lib: patch CVE-2026-25068
busybox: Fix CVE-2025-60876
ffmpeg: Ignore CVE-2025-12343
freetype: Fix CVE-2026-23865
gdk-pixbuf: Fix CVE-2025-6199
glib-2.0: Fix CVE-2026-1484 CVE-2026-1485 CVE-2026-1489
gnutls: Fix CVE-2025-14831
go: Fix CVE-2026-25679 CVE-2026-27137 CVE-2026-27138 CVE-2026-27139 CVE-2026-27142
harfbuzz: Fix CVE-2026-22693
inetutils: Fix CVE-2026-28372
libpam: Ignore CVE-2024-10041
libpng: Fix CVE-2026-25646
linux-yocto: Ignore CVE-2022-38096 CVE-2023-6535 CVE-2023-39176 CVE-2023-39179 CVE-2023-39180
python3-pip: Fix CVE-2026-1703
python3-urllib3: Fix CVE-2025-66471
zlib: Fix CVE-2026-27171

---------------
Fixes
---------------

oecore
-----------
README: Add whinlatter subject-prefix to git-send-email suggestion
avahi: Remove a reference to the rejected CVE-2021-36217
b4-config: add send-prefixes for whinlatter
build-appliance-image: Update to whinlatter head revisions
classes/buildhistory: Do not sign buildhistory commits
create-pull-request: Keep commit hash to be pulled in cover email
glib-2.0: upgrade to 2.86.4
gnutls: fix postinst script for ${PN}-fips for multilibs
gnutls: use libtool to install test binaries
go: upgrade to 1.25.8
libpng: upgrade to 1.6.55
linux-yocto: apply cve-exclusions also to rt and tiny recipe variants
lsb.py: strip ' from os-release file
lz4: Remove a reference to the rejected CVE-2025-62813
pseudo: Update to include a fix for systems with kernel <5.6
python3: skip flaky test_default_timeout test
scripts/install-buildtools: Update to 5.3.2
wic/engine: error on old host debugfs for standalone directory copy
wireless-regdb: upgrade to 2026.02.04

meta-yocto
-----------
poky.conf: Bump version for 5.3.3 release

yocto-docs
-----------
Makefile: pass -silent to latexmk
dev-manual: delete references to "tar" package format
overview-manual/concepts: list other possible class directories
overview-manual: escape wildcard in inline markup
qemu.rst: parsing of the code-block was not done
ref-manual/classes.rst: fix broken links to U-Boot documentation
tools/host_packages_scripts/tlmgr_docs_pdf.sh: install perl
what-i-wish-id-known.rst: replace figure by the new SVG