new file mode 100644
@@ -0,0 +1,37 @@
+From dbaecb5f0032401617254a2f6eb10cdd28ea04f2 Mon Sep 17 00:00:00 2001
+From: Wang Mingyu <wangmy@fujitsu.com>
+Date: Thu, 20 Aug 2026 10:24:56 +0000
+Subject: [PATCH] fix format security
+
+Upstream-Status: Submitted
+
+Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
+---
+ jitter/gnulib-local/openat-die.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/jitter/gnulib-local/openat-die.c b/jitter/gnulib-local/openat-die.c
+index d37e399..f4b3301 100644
+--- a/jitter/gnulib-local/openat-die.c
++++ b/jitter/gnulib-local/openat-die.c
+@@ -35,7 +35,7 @@ openat_save_fail (int errnum)
+ {
+ #ifndef GNULIB_LIBPOSIX
+ error (exit_failure, errnum,
+- _("unable to record current working directory"));
++ "%s", _("unable to record current working directory"));
+ #endif
+ /* _Noreturn cannot be applied to error, since it returns
+ when its first argument is 0. To help compilers understand that this
+@@ -54,7 +54,7 @@ openat_restore_fail (int errnum)
+ {
+ #ifndef GNULIB_LIBPOSIX
+ error (exit_failure, errnum,
+- _("failed to return to initial working directory"));
++ "%s", _("failed to return to initial working directory"));
+ #endif
+
+ /* As above. */
+--
+2.43.0
+
similarity index 91%
rename from meta-oe/recipes-devtools/poke/poke_4.3.bb
rename to meta-oe/recipes-devtools/poke/poke_5.0.bb
@@ -7,11 +7,12 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
SRC_URI = "${GNU_MIRROR}/poke/poke-${PV}.tar.gz \
file://0003-configure.ac-HELP2MAN-replace-by-true-when-cross-com.patch \
+ file://0001-fix-format-security.patch \
"
DEPENDS = "flex-native bison-native bdwgc readline"
-SRC_URI[sha256sum] = "a84cb9175d50d45a411f2481fd0662b83cb32ce517316b889cfb570819579373"
+SRC_URI[sha256sum] = "6873d59abe821c8111b88623ea7ad9e090892fa95c75562606dd88374e2f5b8f"
UPSTREAM_CHECK_URI = "https://ftp.gnu.org/gnu/poke/"
UPSTREAM_CHECK_REGEX = "poke-(?P<pver>\d+(\.\d+)+)\.tar"