2 files changed, 11 insertions, 0 deletions
diff --git a/apt-pkg/cachefilter-patterns.cc b/apt-pkg/cachefilter-patterns.cc
index 6ef34c953..7e6d84ff6 100644
--- a/apt-pkg/cachefilter-patterns.cc
+++ b/apt-pkg/cachefilter-patterns.cc
@@ -502,6 +502,8 @@ std::unique_ptr<APT::CacheFilter::Matcher> PatternParser::aPattern(std::unique_p
       return std::make_unique<Patterns::PackageIsPhasing>(file);
    if (node->matches("?section", 1, 1))
       return std::make_unique<Patterns::VersionIsSection>(aWord(node->arguments[0]));
+   if (node->matches("?security", 0, 0))
+      return std::make_unique<Patterns::VersionIsSecurity>();
    if (node->matches("?source-package", 1, 1))
       return std::make_unique<Patterns::VersionIsSourcePackage>(aWord(node->arguments[0]));
    if (node->matches("?source-version", 1, 1))
diff --git a/apt-pkg/cachefilter-patterns.h b/apt-pkg/cachefilter-patterns.h
index 5fc00377f..fa4605253 100644
--- a/apt-pkg/cachefilter-patterns.h
+++ b/apt-pkg/cachefilter-patterns.h
@@ -415,6 +415,15 @@ struct APT_HIDDEN VersionIsSection : public VersionAnyMatcher
    }
 };
 
+struct APT_HIDDEN VersionIsSecurity : public VersionAnyMatcher
+{
+   VersionIsSecurity() {}
+   bool operator()(pkgCache::VerIterator const &Ver) override
+   {
+      return Ver.IsSecurityUpdate();
+   }
+};
+
 struct APT_HIDDEN VersionIsSourcePackage : public VersionAnyMatcher
 {
    BaseRegexMatcher matcher;