[PATCH v2 03/18] migration-guides/migration-6.0.rst: document the CVE_PRODUCT behavior change

Antonin Godard
2026-04-24T08:28:59Z

After 9dd9c0038907 ("cve_check: Escape special characters in CPE 2.3
strings") and 3c73dafd03b1 ("cve_check: Improve escaping of special
characters in CPE 2.3") in OE-Core.

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
---
documentation/migration-guides/migration-6.0.rst | 14 ++++++++++++++
1 file changed, 14 insertions(+)

diff --git a/documentation/migration-guides/migration-6.0.rst b/documentation/migration-guides/migration-6.0.rst
index 42c688a89..d763062da 100644
--- a/documentation/migration-guides/migration-6.0.rst
+++ b/documentation/migration-guides/migration-6.0.rst
@@ -291,6 +291,20 @@ information.
Users are advised to transition to SDPX 3.0, which is provided by the
:ref:`ref-classes-create-spdx` class.

+:term:`CVE_PRODUCT` character escaping change
+---------------------------------------------
+
+The :term:`CVE_PRODUCT` variable, which specifies a name used to match the
+recipe name against the name in the upstream `NIST CVE database
+<https://nvd.nist.gov/>`__, used to require special characters to be escaped.
+
+This is no longer, the case. For example, the :term:`CVE_PRODUCT` variable for
+the ``webkitgtk`` recipe must no longer be written as ``webkitgtk\+`` but
+``webkitgtk+``.
+
+Users are advised to review their :term:`CVE_PRODUCT` assignments and remove any
+special character escaping.
+
.. _ref-migration-6-0-wic-sector-size-change:

:term:`WIC_SECTOR_SIZE` should be replaced by ``--sector-size``

--
2.53.0