From 0869e469cf3bc9ef29d891b9ab7cf54285d57dc9 Mon Sep 17 00:00:00 2001
From: SandObserver <260779319+SandObserver@users.noreply.github.com>
Date: Sat, 17 Oct 2026 16:26:26 -0400
Subject: [PATCH] Security: note the expat CVE fixes in the changelog

---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c789b5fd..c4e864a2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -107,6 +107,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Show settings labels in full on a phone instead of cutting them off.
 
+### Security
+
+- Update expat to 2.9.0 to fix CVE-2026-77214 and CVE-2026-102633.
+
 ## [1.17.0] - 2026-10-11
 
 ### Added