There was related discussion in Qt Contributors Summit. Memo: https://wiki.qt.io/QtCS2018_Third-Party_Sources_Policy_and_Security

1. Check if we need to update  
   • double-conversion (qtbase/src/3rdparty/double-conversion)
   • gradle (qtbase/src/3rdparty/gradle) QTBUG-71328
   • pcre2 (qtbase/src/3rdparty/pcre2)
   • sha1 (qtbase/src/3rdparty/sha1)
   • sha3 (qtbase/src/3rdparty/sha3)
   • tinycbor (qtbase/src/3rdparty/tinycbor)
   • zlib (qtbase/src/3rdparty/zlib)
   • Text Codecs
     • Big5, Big5-HKSCS (qtbase/src/corelib/codecs/qbig5codec.cpp)
     •  EUC-JP (qtbase/src/corelib/codecs/qeucjpcodec.cpp)
     • EUC-KR (qtbase/src/corelib/codecs/qeuckrcodec.cpp)
     • JIS (qtbase/src/corelib/codecs/qjiscodec.cpp)
     • Shift-JIS (qtbase/src/corelib/codecs/qsjiscodec.cpp)
     • TSCII (src/corelib/codecs/qtsciicodec.cpp)
     • GBK (qtbase/src/corelib/codecs/qgb18030codec.cpp)
   •  The Public Suffix List (qtbase/src/corelib/io/qurltlds_p.h)
   • UCD (qtbase/src/corelib/tools)
   • CLDR (qtbase/src/corelib/tools)
2. Check if documentation of 3rd party component usage is correct and do needed updates. Documentation here: http://doc.qt.io/qt-5/licenses-used-in-qt.html
3. In case of 3rd party component update we need to document the update here: http://code.qt.io/cgit/qt/qtdoc.git/tree/doc/src/legal/licensechanges.qdoc

If there are questions, please contact dedicated R&D owner

R&D owner: vhilshei