[ANNOUNCEMENT] Yocto Project 4.0.35 (kirkstone-4.0.35) is Released

Hi

We are pleased to announce the Yocto Project 4.0.35 Release is now available for download.

https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.35/poky-93431249a6260da7bd29ee3ca32145d89e5b8259.tar.bz2

A gpg signed version of these release notes is available at:

https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.35/RELEASENOTES

Full Test Report:

https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.35/testreport.txt

Please note that this is the last planned release for the 4.0.X kirkstone series as our 4 year LTS period has come to an end.

Due to ongoing maintenance on the kernel.org mirrors, mirroring to kernel.org is currently delayed.

Thank you for everyone's contributions to this release.

Chee Yang
[email protected]
Yocto Project Build and Release

--------------------------
yocto-4.0.35 Release Notes
--------------------------

--------------------------
 Repositories/Downloads
--------------------------

Repository Name: yocto-docs
Repository Location: https://git.yoctoproject.org/yocto-docs
Branch: kirkstone
Tag: yocto-4.0.35
Git Revision: ce6734c68649739c635675a133fa77edb9865028
Release Artefact: yocto-docs-ce6734c68649739c635675a133fa77edb9865028
sha: ddb6fac4d257f4f76836055cafad529729e99c293d3b8d3dabef926fad5e725f
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.35/yocto-docs-ce6734c68649739c635675a133fa77edb9865028.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.35/yocto-docs-ce6734c68649739c635675a133fa77edb9865028.tar.bz2

Repository Name: poky
Repository Location: https://git.yoctoproject.org/poky
Branch: kirkstone
Tag: yocto-4.0.35
Git Revision: 93431249a6260da7bd29ee3ca32145d89e5b8259
Release Artefact: poky-93431249a6260da7bd29ee3ca32145d89e5b8259
sha: a8e95213248c5400276611754f2c98b8d8972e166bdf41433c45fcdd2bf668cb
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.35/poky-93431249a6260da7bd29ee3ca32145d89e5b8259.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.35/poky-93431249a6260da7bd29ee3ca32145d89e5b8259.tar.bz2

Repository Name: openembedded-core
Repository Location: https://git.openembedded.org/openembedded-core
Branch: kirkstone
Tag: yocto-4.0.35
Git Revision: 51259c7e933a2ac8ebc01604d6e65607b76b7b56
Release Artefact: oecore-51259c7e933a2ac8ebc01604d6e65607b76b7b56
sha: 2cd531e2a107849e7a452e71e41f22b42160979066e10d0661e97acfab125b1f
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.35/oecore-51259c7e933a2ac8ebc01604d6e65607b76b7b56.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.35/oecore-51259c7e933a2ac8ebc01604d6e65607b76b7b56.tar.bz2

Repository Name: meta-yocto
Repository Location: https://git.yoctoproject.org/meta-yocto
Branch: kirkstone
Tag: yocto-4.0.35
Git Revision: 34e3c9a19b8b955116109a2e9528966db3fced37
Release Artefact: meta-yocto-34e3c9a19b8b955116109a2e9528966db3fced37
sha: 18da6dbb745d5e4e42a93527c36751778155e3762728b0b1020b890480402dde
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.35/meta-yocto-34e3c9a19b8b955116109a2e9528966db3fced37.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.35/meta-yocto-34e3c9a19b8b955116109a2e9528966db3fced37.tar.bz2

Repository Name: meta-mingw
Repository Location: https://git.yoctoproject.org/meta-mingw
Branch: kirkstone
Tag: yocto-4.0.35
Git Revision: 87c22abb1f11be430caf4372e6b833dc7d77564e
Release Artefact: meta-mingw-87c22abb1f11be430caf4372e6b833dc7d77564e
sha: f0bc4873e2e0319fb9d6d6ab9b98eb3f89664d4339a167d2db6a787dd12bc1a8
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.35/meta-mingw-87c22abb1f11be430caf4372e6b833dc7d77564e.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.35/meta-mingw-87c22abb1f11be430caf4372e6b833dc7d77564e.tar.bz2

Repository Name: meta-gplv2
Repository Location: https://git.yoctoproject.org/meta-gplv2
Branch: kirkstone
Tag: yocto-4.0.35
Git Revision: d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a
Release Artefact: meta-gplv2-d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a
sha: c386f59f8a672747dc3d0be1d4234b6039273d0e57933eb87caa20f56b9cca6d
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.35/meta-gplv2-d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.35/meta-gplv2-d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a.tar.bz2

Repository Name: bitbake
Repository Location: https://git.openembedded.org/bitbake
Branch: 2.0
Tag: yocto-4.0.35
Git Revision: 7fd0197fd5fedd23cc885b5e7e816d86a392fdf9
Release Artefact: bitbake-7fd0197fd5fedd23cc885b5e7e816d86a392fdf9
sha: 6c01ff2b4b0060ef3d6d3f1fc11690094b22865af4989946544d08d74b473ec9
Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.35/bitbake-7fd0197fd5fedd23cc885b5e7e816d86a392fdf9.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.35/bitbake-7fd0197fd5fedd23cc885b5e7e816d86a392fdf9.tar.bz2


---------------
 Contributors
---------------
Aleksandar Nikolic
Antonin Godard
Bruce Ashfield
Fabien Thomas
Hitendra Prajapati
Jinfeng Wang
Ken Kurematsu
Kristiyan Chakarov
Lee Chee Yang
Martin Jansa
Paul Barker
Peter Marko
Richard Purdie
Ross Burton
Shaik Moin
Vijay Anusuri
Yanis BINARD
Yoann Congal

---------------
 Known Issues
---------------
N/A


---------------
Security Fixes
---------------
alsa-lib: Fix CVE-2026-25068
busybox: Fix CVE-2025-60876
curl: Fix CVE-2025-14524 CVE-2026-1965 CVE-2026-3783 CVE-2026-3784
ffmpeg: Fix CVE-2025-10256
gdk-pixbuf: Fix CVE-2025-6199
inetutils: Fix CVE-2026-28372
libarchive: Fix CVE-2026-4111
libpam: Fix CVE-2024-10963
linux-yocto/5.15: Fix CVE-2025-40082 CVE-2025-68358 CVE-2025-71089 CVE-2025-71220 CVE-2025-71222 CVE-2025-71232 CVE-2025-71233 CVE-2025-71235 CVE-2025-71236 CVE-2025-71237 CVE-2025-71238 CVE-2026-23111 CVE-2026-23112 CVE-2026-23169 CVE-2026-23190 CVE-2026-23193 CVE-2026-23198 CVE-2026-23202 CVE-2026-23206 CVE-2026-23209 CVE-2026-23216 CVE-2026-23221 CVE-2026-23222 CVE-2026-23228 CVE-2026-23229 CVE-2026-23231 CVE-2026-23234 CVE-2026-23235 CVE-2026-23236 CVE-2026-23237 CVE-2026-23238
ncurses: Fix CVE-2025-69720
python3: Fix CVE-2024-6923 CVE-2025-15282 CVE-2025-59375 CVE-2026-0865 CVE-2026-24515 CVE-2026-25210
python3-pip: Fix CVE-2026-1703
python3-pyopenssl: Fix CVE-2026-27448 CVE-2026-27459
sqlite3: Fix CVE-2025-70873
tiff: Fix CVE-2025-61143 CVE-2025-61144
vim: Fix CVE-2026-25749 CVE-2026-26269 CVE-2026-28418 CVE-2026-28419 CVE-2026-33412

---------------
Fixes
---------------
bitbake: tests/fetch: Avoid using git protocol in tests
build-appliance-image: Update to kirkstone head revision
contributor-guide/submit-changes.rst: Added missing word
create-pull-request: Keep commit hash to be pulled in cover email
createrepo-c: Fix createrepo-c-native build on GCC14 hosts (e.g. Fedora 41)
gtk+3: fix incompatible-pointer-types errors for native build on Fedora 41
libcomps: Fix libcomps-native build on GCC14 hosts (e.g. Fedora 41)
libpam: re-add missing libgen include
libtheora: set CVE_PRODUCT
linux-yocto/5.15: update to v5.15.201
lsb.py: strip ' from os-release file
migration-guide: add release notes for 4.0.33 4.0.34
oeqa/manual: Default to https git protocol for YP/OE repos
oeqa/sdk: Default to https git protocol for YP/OE repos
oeqa/selftest/git-submodule-test: Default to https git protocol for YP/OE repos
overview-manual: escape wildcard in inline markup
poky.conf: Bump version for 4.0.35 release
python3: upgrade to 3.10.20
README.OE-Core: update contributor links and add kirkstone prefix
recipes: Default to https git protocol for YP/OE repos
recipetool: Recognise https://git. as git urls
ref-manual/system-requirements.rst: update end-of-life distros
scripts/install-buildtools: Update to 4.0.34
scripts: Default to https git protocol for YP/OE repos
selftest/scripts: Update old git protocol references
tcl: skip http11 tests
tiff: set status of CVE-2025-61145 as fixed by patch for CVE-2025-8961
tzdata,tzcode-native: Upgrade to 2026a