This package is listed in debian-security-support to have limited
security support. It is now end-of-life. To meet our Social Contract we
should not release this with forky to prevent exposing users to
known vulnerabilites.

All of the reverse dependencies have a Qt6 port (in development or
released).

Of the packages that are affected, there is actually one without Qt6 or
the unpatched option to build without webengine: pep8-simul. Maybe its
successor project pep9 does...

On Tue, 01 Sep 2026 14:05:37 +0200 Bastian Germann <bage@debian.org> wrote:
 > Source: qtwebengine-opensource-src
 > Version: 5.15.19+dfsg2-1
 > Severity: serious
 >
 > This package is listed in debian-security-support to have limited
 > security support. It is now end-of-life. To meet our Social Contract we
 > should not release this with forky to prevent exposing users to
 > known vulnerabilites.
 >
 > All of the reverse dependencies have a Qt6 port (in development or
 > released).

What difference does porting to Qt 6 make?
qt6-webengine is also listed in debian-security-support to not receive
security support.
I think in many cases it's better to stick with Qt 5 applications for now
instead of
uploading a half-baked Qt 6 port that's really still in development.

Removing Qt WebEngine support from packages that use it to render untrusted input
might be a worthwhile goal but I don't see the need to remove the package itself.

Cheers,
Felix

The major difference between Qt5 and Qt6 was already mentioned in the
bug creation message: Qt5 "is now end-of-life".