[PATCH 2/2] migration-guide: add release notes for 6.0.3

[chee.yang.lee@intel.com]

From: Lee Chee Yang <chee.yang.lee@intel.com>

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
---
 .../migration-guides/release-6.0.rst          |   1 +
 .../migration-guides/release-notes-6.0.3.rst  | 336 ++++++++++++++++++
 2 files changed, 337 insertions(+)
 create mode 100644 documentation/migration-guides/release-notes-6.0.3.rst

diff --git a/documentation/migration-guides/release-6.0.rst b/documentation/migration-guides/release-6.0.rst
index 5f5ed5e2e4..71ca93ece4 100644
--- a/documentation/migration-guides/release-6.0.rst
+++ b/documentation/migration-guides/release-6.0.rst
@@ -10,3 +10,4 @@ Release 6.0 (wrynose)
    migration-6.0
    release-notes-6.0.1
    release-notes-6.0.2
+   release-notes-6.0.3
diff --git a/documentation/migration-guides/release-notes-6.0.3.rst b/documentation/migration-guides/release-notes-6.0.3.rst
new file mode 100644
index 0000000000..959cc4a4e4
--- /dev/null
+++ b/documentation/migration-guides/release-notes-6.0.3.rst
@@ -0,0 +1,336 @@
+.. SPDX-License-Identifier: CC-BY-SA-2.0-UK
+
+Release notes for Yocto-6.0.3 (Wrynose)
+---------------------------------------
+
+Security Fixes in Yocto-6.0.3
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+-  bind: Fix :cve_nist:`2026-11331`, :cve_nist:`2026-11721`, :cve_nist:`2026-13321`,
+   :cve_nist:`2026-10723`, :cve_nist:`2026-12617` and :cve_nist:`2026-10822`
+-  binutils: Fix :cve_nist:`2026-6846`
+-  bzip2: Fix :cve_nist:`2026-42250`
+-  cargo: Fix :cve_nist:`2026-5222` and :cve_nist:`2026-5223`
+-  cups: Fix :cve_nist:`2026-27447` and :cve_nist:`2026-41079`
+-  curl: Fix :cve_nist:`2026-5545`, :cve_nist:`2026-5773`, :cve_nist:`2026-6253`, :cve_nist:`2026-6429`
+   and :cve_nist:`2026-7168`
+-  curl: Ignore :cve_nist:`2026-10536` if nghttp2 not enabled
+-  dhcpcd: Fix :cve_nist:`2026-56113`, :cve_nist:`2026-56114`, :cve_nist:`2026-56116` and
+   :cve_nist:`2026-56117`
+-  expat: Fix :cve_nist:`2026-41080`, :cve_nist:`2026-45186`, :cve_nist:`2026-56132`,
+   :cve_nist:`2026-56403`, :cve_nist:`2026-56404`, :cve_nist:`2026-56405`, :cve_nist:`2026-56406`,
+   :cve_nist:`2026-56407`, :cve_nist:`2026-56408`, :cve_nist:`2026-56409`, :cve_nist:`2026-56410`
+   and :cve_nist:`2026-56411`
+-  gawk: Fix :cve_nist:`2026-40467`, :cve_nist:`2026-40468`, :cve_nist:`2026-40469` and
+   :cve_nist:`2026-40553`
+-  glib-2.0: Fix :cve_nist:`2026-58010`, :cve_nist:`2026-58011`, :cve_nist:`2026-58012`,
+   :cve_nist:`2026-58013`, :cve_nist:`2026-58014`, :cve_nist:`2026-58015` and :cve_nist:`2026-58016`
+-  gnupg: Fix :cve_nist:`2026-57062`
+-  gnutls: Fix :cve_nist:`2026-3832`, :cve_nist:`2026-3833`, :cve_nist:`2026-42009` and
+   :cve_nist:`2026-33846`
+-  go: Fix :cve_nist:`2026-39822` and :cve_nist:`2026-42505`
+-  gstreamer1.0: Ignore :cve_nist:`2026-5056`
+-  gzip: Fix :cve_nist:`2026-41991` and :cve_nist:`2026-41992`
+-  libcap: Fix :cve_nist:`2026-4878`
+-  libgcrypt: Fix :cve_nist:`2026-41989` and :cve_nist:`2026-41990`
+-  libpng: Fix :cve_nist:`2026-34757`
+-  libpng: Ignore :cve_nist:`2026-40930`
+-  libsolv: Fix :cve_nist:`2026-9149`
+-  libssh2: Fix :cve_nist:`2025-15661`, :cve_nist:`2026-55199` and :cve_nist:`2026-55200`
+-  libxml2: Fix :cve_nist:`2026-11979`
+-  libxpm: Fix :cve_nist:`2026-4367`
+-  openssh: Fix :cve_nist:`2026-59995`, :cve_nist:`2026-59996`, :cve_nist:`2026-59997`,
+   :cve_nist:`2026-59999`, :cve_nist:`2026-60000`, :cve_nist:`2026-60001` and :cve_nist:`2026-60002`
+-  openssh: Ignore :cve_nist:`2026-59998` if kerberos not enabled
+-  openssh: Ignore :cve_nist:`2026-3497`
+-  perl: Fix :cve_nist:`2026-8376`
+-  python3: Fix :cve_nist:`2026-3276`, :cve_nist:`2026-7210`, :cve_nist:`2026-7774`,
+   :cve_nist:`2026-8328`, :cve_nist:`2026-9669`, :cve_nist:`2026-11940` and :cve_nist:`2026-11972`
+-  python3-setuptools: Fix :cve_nist:`2026-59890`
+-  python3-urllib3: Fix :cve_nist:`2026-44431`
+-  qemu: Fix :cve_nist:`2025-14876`, :cve_nist:`2026-0665` and :cve_nist:`2026-2243`
+-  socat: Fix :cve_nist:`2026-56123`
+-  sqlite3: Fix :cve_nist:`2026-11822` and :cve_nist:`2026-11824`
+-  tar: Fix :cve_nist:`2026-5704`
+-  util-linux: Fix :cve_nist:`2026-13595` and :cve_nist:`2026-27456`
+-  vim: Fix :cve_nist:`2026-41411`, :cve_nist:`2026-42307`, :cve_nist:`2026-43961`,
+   :cve_nist:`2026-44656`, :cve_nist:`2026-45130`, :cve_nist:`2026-46483`, :cve_nist:`2026-47162`,
+   :cve_nist:`2026-47167`, :cve_nist:`2026-52858`, :cve_nist:`2026-52859`, :cve_nist:`2026-52860`,
+   :cve_nist:`2026-55892` and :cve_nist:`2026-57452`
+
+
+Fixes in Yocto-6.0.3
+~~~~~~~~~~~~~~~~~~~~
+
+bitbake
+^^^^^^^
+
+-  bitbake-setup: always write newline at end of the README
+-  utils: Add NFS EEXISTS/isdir failure workaround
+
+meta-yocto
+^^^^^^^^^^
+
+-  README: Add wrynose subject-prefix to git-send-email suggestion
+-  b4-config: add send-prefixes for wrynose
+-  poky.conf: Bump version for 6.0.3 release
+-  yocto-bsps: update to v6.18.39
+
+openembedded-core
+^^^^^^^^^^^^^^^^^
+
+-  baremetal-helloworld: Fix override order
+-  bc: set :term:`CVE_PRODUCT`
+-  bind: upgrade to 9.20.26
+-  bluez5: Fix sending extra bytes with MGMT_OP_ADD_EXT_ADV_DATA
+-  bluez5: fix gatt cache sync issue
+-  bluez5: fix set volume failure
+-  bluez5: set L2CAP IMTU for OBEX profile listeners
+-  build-appliance-image: Update to wrynose head revisions
+-  clang/llvm: Upgrade to 22.1.8
+-  cmake-native: prevent host libidn2 contamination
+-  common-licenses/PHP-3.0: Correct the license text
+-  cpan_build: disable .packlist and html doc
+-  create-spdx-image-3.0: correct :term:`SSTATE_SKIP_CREATION` key for do_create_image_sbom_spdx
+-  devtool: provide explicit error for missing "script" command
+-  dmidecode: fix x86-only tools being installed on ARM targets
+-  dropbear: Add missing WTFPL & Unlicense in :term:`LICENSE` and :term:`LIC_FILES_CHKSUM`
+-  flac: fix buildpaths with doxygen enabled
+-  flac: make documentation build deterministic
+-  gdb: Upgrade to 17.2
+-  glib-2.0: upgrade to 2.88.2
+-  go: upgrade to 1.26.5
+-  i2c-tools: add LGPL-2.1-or-later license for libi2c
+-  kernel-fit-image.bbclass: Do not include kernel property in DTBO config subnodes
+-  kernel-fit-image.bbclass: Fix operation with :term:`KERNEL_DTBVENDORED` = "1"
+-  kernel-fit-image: Add :term:`KERNEL_DTBVENDORED` support for :term:`FIT_CONF_DEFAULT_DTB`
+-  libjitterentropy: fix license statement
+-  libxpm: upgrade to 3.5.19
+-  linux-yocto/6.18: drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue
+   worker
+-  linux-yocto/6.18: qat/intel configuration warning fixes
+-  linux-yocto/6.18: update to v6.18.39
+-  nospdx: also drop do_create_recipe_sbom
+-  oe-selftest: fitimage: Add tests for :term:`KERNEL_DTBVENDORED`
+-  oe-selftest: fitimage: Do not expect kernel property in DTBO config subnodes
+-  opensbi: don't override ELFFLAGS, silence ldflags QA for bare-metal ELFs
+-  ovmf: fix tpm :term:`PACKAGECONFIG` to use TPM2_ENABLE
+-  package.bbclass: hardcode emit_pkgdata to run last
+-  ptest-packagelists.inc: disable glib-2.0 for RISCV64
+-  python3: skiptest tracemalloc_track_race
+-  python3: upgrade to 3.14.6
+-  python3-certifi: set :term:`CVE_PRODUCT`
+-  python3-cryptography: set :term:`CVE_PRODUCT`
+-  python3-idna: set :term:`CVE_PRODUCT`
+-  python3-pip: set :term:`CVE_PRODUCT`
+-  python3-ply: set :term:`CVE_PRODUCT`
+-  python3-pyasn1: set :term:`CVE_PRODUCT`
+-  python3-pyopenssl: set :term:`CVE_PRODUCT`
+-  python3-pyyaml: set :term:`CVE_PRODUCT`
+-  python3-xmltodict: set :term:`CVE_PRODUCT`
+-  qemuboot.bbclass: add missing task dependency on kernel deploy
+-  quota: use native rpcgen and a single-word RPCGEN_CPP
+-  rootfs: move tasks using image_list_installed_packages to postuninstall
+-  scripts/install-buildtools: Update to 6.0.2
+-  selftest: uboot: remove duplicated KVM presence test
+-  socat: upgrade to 1.8.1.3
+-  sstate: Reduce native sysroot execution race potential
+-  strace: remove skip-bpf.patch
+-  sudo: fix pam-wheel sed for sudo 1.9.17p2 sudoers
+-  systemd-systemctl-native: disable libpam meson option
+-  tcl: disable the timer tests in run-ptest
+-  texinfo: add missing perl module runtime dependencies
+-  tzdata/tzcode-native: upgrade to 2026c
+-  u-boot: re-enable RISC-V compressed (c) ISA extension
+-  util-linux: upgrade to 2.41.5
+-  vex: remove obsolete semicolon
+-  wic: upgrade to 0.3.1
+-  xmlto: correct srcrev to point to released version
+-  xmlto: update :term:`SRC_URI`
+
+yocto-docs
+^^^^^^^^^^
+
+-  brief-yoctoprojectqs/index.rst: fix a replacement typo
+-  brief-yoctoprojectqs/index.rst: refresh bitbake-setup outputs
+-  brief-yoctoprojectqs/index.rst: use pip to install bitbake-setup
+-  bsp-guide/bsp.rst: fix raspberry layer content example
+-  contributor-guide: Note patch complexity requirements for stable branches
+-  dev-manual/creating-fragments.rst: fix typos
+-  dev-manual/wic.rst: add a requirement to use wic from the build system
+-  dev-manual/wic.rst: add where to set IMAGE_FSTYPES/WKS_FILE[S] from
+-  dev-manual/wic.rst: convert code snippet to code-blocks
+-  dev-manual/wic.rst: remove bullet point on host requirements
+-  dev-manual/wic.rst: remove note on wic-tools
+-  dev-manual/wic.rst: replace deprecated wks directories
+-  dev-manual: Fix missing whitespace around '=' operator
+-  dev-manual: update bmaptool section, refer to "bmaptool" package
+-  docs-wide: fix broken path links
+-  docs-wide: fix various broken links
+-  docs-wide: remove CROPS references
+-  migration-guide: 5.1: Fix typo
+-  migration-guide: add release notes for 5.0.19 and 6.0.2
+-  migration-guides/migration-3.4.rst: replace rlbl broken link
+-  migration-guides/migration-6.0.rst: fix wks file move note
+-  migration-guides/release-notes-3.4.2.rst: fix a broken link
+-  migration-guides/release-notes-5.0.rst: remove broken link
+-  migration-guides: add add release notes for 6.0.1
+-  migration-guides: replace broken link with archive links
+-  recipe-style-guide: Clarify when License-Update tag is needed
+-  ref-manual/classes.rst: replace deprecated wks directory
+-  ref-manual/classes.rst: replace obsolete mailing list thread
+-  ref-manual/images.rst: update obsolete VMWare links
+-  ref-manual/kickstart.rst: document the include directive
+-  ref-manual/kickstart.rst: remove note on available commands
+-  ref-manual/kickstart.rst: replace deprecated wks directory
+-  ref-manual/release-process.rst: update LTS supported versions
+-  ref-manual/variables.rst: document missing CONFLICT_*_FEATURES variables
+-  ref-manual/variables.rst: document the :term:`CCACHE_NATIVE_RECIPES_ALLOWED` variable
+-  ref-manual/variables.rst: document the IMAGE_*_DEBUGFS variables
+-  ref-manual/variables.rst: document the :term:`LOCALE_PATHS` variable
+-  ref-manual/variables.rst: document the LOCALE_UTF8_IS_DEFAULT variable
+-  ref-manual/variables.rst: document the :term:`QB_DEFAULT_BIOS` variable
+-  ref-manual/variables.rst: document the :term:`TEST_SERIALCONTROL_CONNECT_TIMEOUT` variable
+-  ref-manual/variables.rst: document the TEST_SERIALCONTROL_PS1 variable
+-  ref-manual: Fix occurrences of omitted space with :prepend
+-  ref-manual: add "KERNEL_IMAGE_STRIP_EXTRA_SECTIONS" to variables
+-  ref-manual: expand on kernel "do_sizecheck" task
+-  ref-manual: fix incorrect heading level for site.conf section
+-  ref-manual: remove all traces of "kernel_menuconfig" task
+-  ref-manual: under meta/files entry, mention Wic files
+
+
+Known Issues in Yocto-6.0.3
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+- N/A
+
+Contributors to Yocto-6.0.3
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+
+Thanks to the following people who contributed to this release:
+
+-  Adarsh Jagadish Kamini
+-  Adrian Freihofer
+-  Alexander Kanavin
+-  Amaury Couderc
+-  Anil Dongare
+-  Anton Skorup
+-  Antonin Godard
+-  AshishKumar Mishra
+-  Ashishkumar Parmar
+-  Benjamin Robin (Schneider Electric)
+-  Bruce Ashfield
+-  Daniel Turull
+-  Darsh Kelaiya
+-  David Nyström
+-  Deepak Rathore
+-  Deepesh Varatharajan
+-  Devansh Patel
+-  Eilís 'pidge' Ní Fhlannagáin
+-  Eric Meyers
+-  Ernest Van Hoecke
+-  Gustavo Henrique Nihei
+-  Hiago De Franco
+-  Himanshu Jadon
+-  Hitendra Prajapati
+-  Jaipaul Cheernam
+-  Jinwang Li
+-  João Marcos Costa
+-  Khem Raj
+-  Kris Gavvala
+-  Lee Chee Yang
+-  Leonid Iziumtsev
+-  Marek Vasut
+-  Mengshi Wu
+-  Nate Kent
+-  Niko Mauno
+-  Otavio Salvador
+-  Paul Barker
+-  Peter Kjellerstedt
+-  Peter Marko
+-  Pritam Srichandan Sahoo
+-  Richard Purdie
+-  Robert P. J. Day
+-  Roland Kovacs
+-  Ross Burton
+-  Ryan Eatmon
+-  Sai Sneha
+-  Shubham Pushpkar
+-  Siddharth Doshi
+-  Siva Balasubramanian
+-  Sudhir Dumbhare
+-  Theo Gaige (Schneider Electric)
+-  Ulrich Ölmann
+-  Vijay Anusuri
+-  Walter Werner Schneider
+-  Wei Deng
+-  Wei Gao
+-  Wes Malone
+-  Xiaozhan Li
+-  Xiuzhuo Shang
+-  Yoann Congal
+-  jaekyu.lee
+-  mark.yang
+
+
+Repositories / Downloads for Yocto-6.0.3
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+yocto-docs
+
+-  Repository Location: :yocto_git:`/yocto-docs`
+-  Branch: :yocto_git:`wrynose </yocto-docs/log/?h=wrynose>`
+-  Tag:  :yocto_git:`yocto-6.0.3 </yocto-docs/log/?h=yocto-6.0.3>`
+-  Git Revision: :yocto_git:`5b1ff88511d90634bb3077b878176de577464e12 </yocto-docs/commit/?id=5b1ff88511d90634bb3077b878176de577464e12>`
+-  Release Artefact: yocto-docs-5b1ff88511d90634bb3077b878176de577464e12
+-  sha: f686c225af0ef33d4607dc03f090c77b0963dc8f15d750c886004786f4297454
+-  Download Locations:
+
+   https://downloads.yoctoproject.org/releases/yocto/yocto-6.0.3/yocto-docs-5b1ff88511d90634bb3077b878176de577464e12.tar.bz2
+
+   https://mirrors.edge.kernel.org/yocto/yocto/yocto-6.0.3/yocto-docs-5b1ff88511d90634bb3077b878176de577464e12.tar.bz2
+
+openembedded-core
+
+-  Repository Location: :oe_git:`/openembedded-core`
+-  Branch: :oe_git:`wrynose </openembedded-core/log/?h=wrynose>`
+-  Tag:  :oe_git:`yocto-6.0.3 </openembedded-core/log/?h=yocto-6.0.3>`
+-  Git Revision: :oe_git:`ef022bf82d79015802309d14c28b13373ebe53f5 </openembedded-core/commit/?id=ef022bf82d79015802309d14c28b13373ebe53f5>`
+-  Release Artefact: oecore-ef022bf82d79015802309d14c28b13373ebe53f5
+-  sha: f43213e9e658cbf3d3c1fd1fe6b68e1a915eb5aec43a0b568387752a9948955e
+-  Download Locations:
+
+   https://downloads.yoctoproject.org/releases/yocto/yocto-6.0.3/oecore-ef022bf82d79015802309d14c28b13373ebe53f5.tar.bz2
+
+   https://mirrors.edge.kernel.org/yocto/yocto/yocto-6.0.3/oecore-ef022bf82d79015802309d14c28b13373ebe53f5.tar.bz2
+
+meta-yocto
+
+-  Repository Location: :yocto_git:`/meta-yocto`
+-  Branch: :yocto_git:`wrynose </meta-yocto/log/?h=wrynose>`
+-  Tag:  :yocto_git:`yocto-6.0.3 </meta-yocto/log/?h=yocto-6.0.3>`
+-  Git Revision: :yocto_git:`1b132647002eea43a2c7a7f857f63f42dacbc26c </meta-yocto/commit/?id=1b132647002eea43a2c7a7f857f63f42dacbc26c>`
+-  Release Artefact: meta-yocto-1b132647002eea43a2c7a7f857f63f42dacbc26c
+-  sha: 15fa3132056f68e0f4188193bea2ee28dada614ef432a1b2c306d8b1d8141888
+-  Download Locations:
+
+   https://downloads.yoctoproject.org/releases/yocto/yocto-6.0.3/meta-yocto-1b132647002eea43a2c7a7f857f63f42dacbc26c.tar.bz2
+
+   https://mirrors.edge.kernel.org/yocto/yocto/yocto-6.0.3/meta-yocto-1b132647002eea43a2c7a7f857f63f42dacbc26c.tar.bz2
+
+bitbake
+
+-  Repository Location: :oe_git:`/bitbake`
+-  Branch: :oe_git:`2.18 </bitbake/log/?h=2.18>`
+-  Tag:  :oe_git:`yocto-6.0.3 </bitbake/log/?h=yocto-6.0.3>`
+-  Git Revision: :oe_git:`fae9db3168dbff1b8c76fe9c6726a9687ff97514 </bitbake/commit/?id=fae9db3168dbff1b8c76fe9c6726a9687ff97514>`
+-  Release Artefact: bitbake-fae9db3168dbff1b8c76fe9c6726a9687ff97514
+-  sha: 3e338310f008dfb9e8e26a22f44fdf89aa72188acc549905a5cf70a7c4797310
+-  Download Locations:
+
+   https://downloads.yoctoproject.org/releases/yocto/yocto-6.0.3/bitbake-fae9db3168dbff1b8c76fe9c6726a9687ff97514.tar.bz2
+
+   https://mirrors.edge.kernel.org/yocto/yocto/yocto-6.0.3/bitbake-fae9db3168dbff1b8c76fe9c6726a9687ff97514.tar.bz2
+
-- 
2.43.0