As mentioned on the mailing list [0], it is not feasible to apply patches
for all CVEs to libskia. Moritz replied to my mail to security@debian.org
and suggested to mark it as not receiving security updates.

As per the suggestion, I have uploaded a new version of the package that
has a README.Debian.security file that describes the situation. Could the
package please be appropriately marked in accordance on the archive side?

Thanks!

Greetings,
  Filip

[0]: https://lists.debian.org/debian-security/2026/09/msg00007.html