Yocto 5.3 replaced the kernel-fitimage class with the new kernel-fit-image class, and now oelint-adv also knowns about this. This uncovered a bug regarding oelint.file.underscores. The output format can now also be formatted as GitLab Code Quality. Since version 9.11.0 all these changes are included.

When using OpenEmbedded core and a KCONFIG_CONFIG_ROOTDIR other than "B" (the build dir) running savedefconfig failed.

The CMake files of qca still used the long deprecated exec_program().

A patch series to fix SPI multi-block accesses when using uboot-imx on i.MX93 has been posted.

When stress-ng is setup with multiple threads the stressor configuration had a race confition.

The stream of improved data in security announcements continues with an added fix version for Gstreamer SA-2026-0003, added lower bounds for SA-2026-0017 and more, a report about a missing CVE id in GHSA-x4h8-rrrg-q78f, and a malformed CVE id tag in glibc SA-2026-0023. The Linux kernel vulnerabilities for the NTFS and atomisp drivers now reflect their temporary absence from the kernel. Wrong vulnerable versions have been removed from twoCVEs, and a new one has been added for another one. Information about affected versions was added to the upstream bug report of CVE-2026-90828.

While working on the actual security announcements a typo in the glibc documentation has been fixed as part of a patch series to assist finding backported fixes.