From 409e65ecb83edbdf198c188e04567415e7cffabb Mon Sep 17 00:00:00 2001
From: Doug <6060466+pixlwave@users.noreply.github.com>
Date: Tue, 16 Jun 2026 11:19:58 +0100
Subject: [PATCH] Update CHANGES.md.

---
 CHANGES.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGES.md b/CHANGES.md
index d19cae9a2..e225d6fa8 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -176,6 +176,9 @@ Others
 
 ### What's Changed
 
+🔐 Security fixes
+* Remove support for handling SPA calls within the app by @pixlwave in https://github.com/element-hq/element-x-ios/pull/5515. Fixes [GHSA-54w7-rw44-49m7](https://github.com/element-hq/element-x-ios/security/advisories/GHSA-54w7-rw44-49m7).
+
 ✨ Features
 * Promote "history sharing on invite" out of developer options by @richvdh in https://github.com/element-hq/element-x-ios/pull/5480
 * Removed Live Location Sharing feature flag by @Velin92 in https://github.com/element-hq/element-x-ios/pull/5498