Index: introduction/welcome/changelog.xml
===================================================================
--- introduction/welcome/changelog.xml	(revision 2446abadbe15a03eee06c63e4201181cde26a590)
+++ introduction/welcome/changelog.xml	(revision 5765d28ede6b5f613500e54e0e9082e6adfdf018)
@@ -69,5 +69,9 @@
        </listitem>
        <listitem>
-         <para>[bdubbs] - Update to adwaita-icon-theme-40.1. Fixes
+         <para>[ken] - Patch qtwebengine-20210401 for latest fixes (security
+         update). Fixes <ulink url="&blfs-ticket-root;14999">#14999</ulink>.</para>
+       </listitem>
+       <listitem>
+         <para>[bdubbs] - adwaita-icon-theme-40.1. Fixes
          <ulink url="&blfs-ticket-root;14935">#14935</ulink>.</para>
        </listitem>
Index: x/lib/qtwebengine.xml
===================================================================
--- x/lib/qtwebengine.xml	(revision 2446abadbe15a03eee06c63e4201181cde26a590)
+++ x/lib/qtwebengine.xml	(revision 5765d28ede6b5f613500e54e0e9082e6adfdf018)
@@ -14,5 +14,5 @@
   <!ENTITY qtwebengine-size          "306 MB">
   <!ENTITY qtwebengine-buildsize     "5.1 GB (154 MB installed)">
-  <!ENTITY qtwebengine-time          "101 SBU (Using parallelism=4)">
+  <!ENTITY qtwebengine-time          "100 SBU (Using parallelism=4)">
 ]>
 
@@ -80,6 +80,6 @@
         The tarball linked to below was created from the 5.15 git branch
         and the 87-branch of the chromium submodule (which is forked from
-        chromium). See the GIT-VERSIONS file in the tarball for details of
-        the latest commits.
+        chromium). See the GIT-VERSIONS file in the tarball (after applying
+        any patches) for details of the latest commits.
       </para>
     </warning>
@@ -120,4 +120,10 @@
       is private to Qt until they choose to release it.
 
+      NOTE: the 3rdparty/chromium tree may contain more patches than have been
+      merged into the current 5.15.x branch. Any patches after what was in the
+      last 'update chromium' merge in qtwebengine may break the build.  When Qt
+      is close to releasing a paid-for 5.15 version, items from 5.15.x get merged
+      into 5.15.
+
       After merging the contents of the qtwebengine and src/3rdparty git extracts,
       in the top level please create a GIT-VERSIONS file summarising the HEAD
@@ -130,4 +136,15 @@
       tarball, go down to src/3rdparty and untar the submodule tarball.
       Decide on what to call the result and create a full xz tarball using tar -cJf.
+
+      UPDATE: Since we have to host the tarball, and it is over 300MB, it makes
+      sense to create a patch for subsequent fixes (for the first version, 314KB
+      including the updates to the GIT-VERSIONS file).  For future updates, view
+      the current updates patch to see the previous commits. When the new commits
+      have been applied, rename the updated version to 'b', but untar the
+      unpatched tarball as 'a' and then diff a to b in the usual manner to get
+      all updates since the tarball was created.
+
+      For our own releases, probably best to create a fresh tarball.
+
          end of note for editors -->
 
@@ -196,5 +213,11 @@
                that the tarball names names differ
           <ulink url="&patch-root;/qtwebengine-everywhere-src-&qtwebengine-version;-ICU68-2.patch"/> -->
-          <ulink url="&patch-root;/qtwebengine-&qtwebengine-version;-build_fixes-1.patch"/>
+          <ulink url="&patch-root;/qtwebengine-&qtwebengine-version;-build_fixes-2.patch"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Required patch:
+          <ulink url="&patch-root;/qtwebengine-&qtwebengine-version;-upstream_fixes-1.patch"/>
         </para>
       </listitem>
@@ -272,9 +295,15 @@
     </para>
 
-<screen><userinput remap="pre">patch -Np1 -i ../qtwebengine-&qtwebengine-version;-build_fixes-1.patch</userinput></screen>
+<screen><userinput remap="pre">patch -Np1 -i ../qtwebengine-&qtwebengine-version;-build_fixes-2.patch</userinput></screen>
+
+    <para>
+      Next apply a patch for security and other fixes:
+    </para>
+
+<screen><userinput remap="pre">patch -Np1 -i ../qtwebengine-&qtwebengine-version;-upstream_fixes-1.patch</userinput></screen>
 
 <!-- start of commands for git versions only -->
     <para>
-      Although the patch has ensured that git is not invoked during the build,
+      Although the first patch has ensured that git is not invoked during the build,
       the build system has labyrinthine rules of byzantine complexity, and in
       particular trying to build without two <filename>.git</filename> directories
