There was related discussion in Qt Contributors Summit. Memo: https://wiki.qt.io/QtCS2018_Third-Party_Sources_Policy_and_Security

1. Check if we need to update  
   • double-conversion (qtbase/src/3rdparty/double-conversion)
   • gradle (qtbase/src/3rdparty/gradle)
   • pcre2 (qtbase/src/3rdparty/pcre2)
   • sha1 (qtbase/src/3rdparty/sha1)
   • sha3 (qtbase/src/3rdparty/sha3) (including keccak)
   • tinycbor (qtbase/src/3rdparty/tinycbor)
   • zlib (qtbase/src/3rdparty/zlib)
   • The Public Suffix List (qtbase/src/network/kernel/qurltlds_p.h)
   • UCD (qtbase/src/corelib/text)
   • CLDR (qtbase/src/corelib/text) (see: https://github.com/unicode-org/cldr/releases/latest)
   • Catch2 (qtbase/tests/auto/testlib/selftests/catch_p_p.h)
   • freedesktop.org.xml from shared-mime-info(qtbase/src/corelib/mimetypes/mime/packages/freedesktop.org.xml) (see https://codereview.qt-project.org/c/qt/qtbase/+/516110)
2. Check if documentation of 3rd party component usage is correct and do needed updates. Documentation here: http://doc.qt.io/qt-6/licenses-used-in-qt.html
3. In case of 3rd party component update we need to document the update here: http://code.qt.io/cgit/qt/qtdoc.git/tree/doc/src/legal/licensechanges.qdoc

If there are questions, please contact dedicated R&D owner

R&D owner: ablasche

Some components have update instructions available at https://wiki.qt.io/Third_Party_Code_in_Qt