5.9.7 is presumably in very strict mode by now, so only security issues or critical problems in the third party component warrant an update. Please review whether the following actually need updates; and update those that need it. (Presumably on 5.11, to cherry-pick back to 5.9.7, where possible.)

src/3rdparty/xcb/qt_attribution.json

• Upstream has had an update this year.

src/3rdparty/xkbcommon/qt_attribution.json

• 0.8.2 released this August; fixes some out-of-bounds access, so potentially security issues

src/3rdparty/pixman/qt_attribution.json

• Upstream is active.