linux/poky.git/meta, branch yocto-5.0.17

build-appliance-image: Update to scarthgap head revision

2026-04-02T12:49:05+00:00

(From OE-Core rev: 52380df998b3a8fe6a091f8547434a3231320a8e) Signed-off-by: Paul Barker

gnutls: Fix CVE-2025-14831

2026-04-02T12:41:55+00:00

Picked commits which mentions this CVE per [1]. [1] https://ubuntu.com/security/CVE-2025-14831 [2] https://security-tracker.debian.org/tracker/CVE-2025-14831 [3] https://gitlab.com/gnutls/gnutls/-/issues/1773 (From OE-Core rev: d0e844108702e553950cab60d51f1cc4cfeed993) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3-pyopenssl: Fix CVE-2026-27459

2026-04-02T12:41:55+00:00

Pick patch mentioned in NVD [1] https://nvd.nist.gov/vuln/detail/CVE-2026-27459 [2] https://ubuntu.com/security/CVE-2026-27459 (From OE-Core rev: 94c6f16933b9ff4c4a2ea46be1e3fc5f2979a49d) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3-pyopenssl: Fix CVE-2026-27448

2026-04-02T12:41:54+00:00

Pick patch mentioned in NVD [1] https://nvd.nist.gov/vuln/detail/CVE-2026-27448 [2] https://ubuntu.com/security/CVE-2026-27448 (From OE-Core rev: 6349510d2ae9d8f4ad1c52d7356d2359b7bf4826) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

spdx: add option to include only compiled sources

2026-04-02T12:41:54+00:00

When SPDX_INCLUDE_COMPILED_SOURCES is enabled, only include the source code files that are used during compilation. It uses debugsource information generated during do_package. This enables an external tool to use the SPDX information to disregard vulnerabilities that are not compiled. As example, when used with the default config with linux-yocto, the spdx size is reduced from 156MB to 61MB. (From OE-Core rev: c6a2f1fca76fae4c3ea471a0c63d0b453beea968) Adapted to existing files for SPDX3.0 Tested with: - bitbake world on oe-core - oe-selftest --run-tests spdx.SPDX30Check Regarding SPDX2.2, the respective backport was already performed in OE-Core rev: a2866934e58fb377a73e87576c8594988a63ad1b (From OE-Core rev: 1c7dfab26d69a87bb026e05b3bbf6a266858c0d1) Signed-off-by: João Marcos Costa (Schneider Electric) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3-cryptography: Fix CVE-2026-26007

2026-04-02T12:41:54+00:00

CVE-2026-26007 is fixed upstream in version 46.0.5. Our current version (42.0.5, scarthgap) is still reported as vulnerable by NVD. Backport the upstream fix to address this CVE. Upstream commit: https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c CVE report: https://nvd.nist.gov/vuln/detail/CVE-2026-26007 (From OE-Core rev: a363958725430237160b0a83a6a6acbe8380fba3) Signed-off-by: Nguyen Dat Tho Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

tzdata,tzcode-native: Upgrade 2025b -> 2025c

2026-04-02T12:41:54+00:00

This release mostly changes code and commentary. The only changed data are leap second table expiration and pre-1976 time in Baja California. Full release notes: https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/TAGXKYLMAQRZRFTERQ33CEKOW7KRJVAK/ (From OE-Core rev: 7255b0ff315367abb5f0c6f00974bf30f7861d1b) Signed-off-by: Paul Barker Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 452334219309793ad74abd6ff390dcb06cab929b) Signed-off-by: Ankur Tyagi Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3-pip: drop unused Windows distlib launcher templates

2026-03-25T17:34:13+00:00

pip vendors distlib which ships Windows launcher template binaries (*.exe) under pip/_vendor/distlib. These files are only used on Windows systems but are installed and packaged for target, native, and nativesdk builds. Remove the distlib *.exe templates when not building for a mingw (mingw32/mingw64) host to avoid shipping unused Windows binaries and reduce package noise. (From OE-Core rev: 9f2a6cfda6a2305f52411ca8121f27c8a5a91fa2) Signed-off-by: Krupal Ka Patel Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 90d208fbb06b6e6b5aaddb0048fd6e2e1d46c8bd) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3-setuptools: drop Windows launcher executables on non-mingw builds

2026-03-25T17:34:13+00:00

setuptools installs Windows launcher executables (cli*.exe, gui*.exe) into site-packages. These binaries are only used on Windows platforms but are packaged for target, native, and nativesdk builds. Remove the Windows launcher executables when not building for a mingw (mingw32/mingw64) host to avoid shipping unused Windows binaries. (From OE-Core rev: a618c504ba69d20eec08944c577b15a48b1ac578) Signed-off-by: Krupal Ka Patel Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit cf7c79f3962f2be99cfda47e8cc730091e6a18cb) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

inetutils: Fix CVE-2026-32746

2026-03-25T17:34:13+00:00

Pick patch according to [1] [1] https://security-tracker.debian.org/tracker/CVE-2026-32746 [2] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html [3] https://codeberg.org/inetutils/inetutils/pulls/17/files (From OE-Core rev: 53a3cdf7b55b76ec64a314f5fafced4a803ac12f) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker