# Patch maintenance

Official Qt security fixes for codec and binary-JSON boundary checks. Reassess against upstream security announcements on version updates.

Applied order:

- `debian/patches/01-CVE-2026-101201-qtqt5compat-6.11-0001.patch`
- `debian/patches/02-CVE-2026-101201-qtqt5compat-6.11-0002.patch`
- `debian/patches/03-CVE-2026-107472-qt5compat-6.11.patch`
- `debian/patches/04-CVE-2026-107590-qt5compat-6.11.patch`

Patch bytes and ordering are covered by config/recipes.lock.json. This file explains policy. it is not copied into the Debian source tree.