diff --git a/config.tests/xml2/xml2.cpp b/config.tests/xml2/xml2.cpp
index 93bc80c97e717876a4ff5ffb285ad1387f070c42..497653d9c044641b95044ad825c46283a30e356d 100644
--- a/config.tests/xml2/xml2.cpp
+++ b/config.tests/xml2/xml2.cpp
@@ -27,9 +27,6 @@
 ****************************************************************************/
 
 #include <libxml/xmlversion.h>
-#if defined(LIBXML_CATALOG_ENABLED)
-#error "libxml catalog enabled"
-#endif
 #if !defined(LIBXML_ICU_ENABLED)
 #error "libxml icu not enabled"
 #endif
diff --git a/dist/changes-5.11.2 b/dist/changes-5.11.2
new file mode 100644
index 0000000000000000000000000000000000000000..753e83fa7f0b19150d79b68eae7f6301e3f99f23
--- /dev/null
+++ b/dist/changes-5.11.2
@@ -0,0 +1,78 @@
+Qt 5.11.2 is a bug-fix release. It maintains both forward and backward
+compatibility (source and binary) with Qt 5.11.0 through 5.11.1.
+
+For more details, refer to the online documentation included in this
+distribution. The documentation is also available online:
+
+http://doc.qt.io/qt-5/index.html
+
+The Qt version 5.11 series is binary compatible with the 5.10.x series.
+Applications compiled for 5.10 will continue to run with 5.11.
+
+Some of the changes listed in this file include issue tracking numbers
+corresponding to tasks in the Qt Bug Tracker:
+
+https://bugreports.qt.io/
+
+Each of these identifiers can be entered in the bug tracker to obtain more
+information about a particular change.
+
+****************************************************************************
+*                              Qt 5.11.2 Changes                           *
+****************************************************************************
+
+Chromium
+--------
+
+ - Security fixes from Chromium up to version 68.0.3440.75, including:
+     * CVE-2018-4117
+     * CVE-2018-6150
+     * CVE-2018-6152
+     * CVE-2018-6155
+     * CVE-2018-6158
+     * CVE-2018-6159
+     * CVE-2018-6161
+     * CVE-2018-6162
+     * CVE-2018-6163
+     * CVE-2018-6164
+     * CVE-2018-6165
+     * CVE-2018-6167
+     * CVE-2018-6168
+     * CVE-2018-6172
+     * CVE-2018-6175
+     * CVE-2018-6177
+     * Security Bug 683418
+     * Security Bug 831117
+     * Security Bug 838886
+     * Security Bug 839197
+     * Security Bug 840695
+     * Security Bug 854887
+     * Security Bug 860721
+     * Security Bug 861571
+
+
+General
+-------
+
+    * [QTBUG-59891] Popups are now closed when parent window is moved.
+    * [QTBUG-67801] Fixed assert with some AMD CPUs on Windows.
+    * [QTBUG-68699] Fixed another crash with non-integer Qt scaling.
+    * [QTBUG-69231] Fixed keyboard modifiers on drop events.
+    * [QTBUG-69236] Fixed --enable-webgl-software-rendering to ignore blacklist
+      of software OpenGL.
+    * [QTBUG-69359] Fixed crash in DevTools openInNewTab handling
+    * [QTBUG-69372] QWebEngineUrlRequestJob::initiator() now differs
+      between unique origins and unknown origins.
+    * [QTBUG-69605] HSTS state is now persistent with appropriate profiles.
+    * [QTBUG-69639] Work around MSVC compiler error affecting printing on
+      32-bit Windows.
+    * [QTBUG-69904] JavaScript worldID can now be up to 256 (up from 11),
+      and the limit is now documented.
+    * [QTBUG-70034] Fixed qtwebengine_convert_dict failing on certain
+      dictionaries.
+
+Build
+-----
+
+    * [QTBUG-50554] Update libvpx check to match standard versions.
+    * [QTBUG-69121] Fixed shadow builds on read-only sources.
diff --git a/src/3rdparty b/src/3rdparty
index 82740520c942c91f596ee53ff3ca09ac4e494890..7085115f51ce9d02cfff216a3f74b1fb6715f38d 160000
--- a/src/3rdparty
+++ b/src/3rdparty
@@ -1 +1 @@
-Subproject commit 82740520c942c91f596ee53ff3ca09ac4e494890
+Subproject commit 7085115f51ce9d02cfff216a3f74b1fb6715f38d
diff --git a/src/core/web_engine_context.cpp b/src/core/web_engine_context.cpp
index 62d62119adfedaae1f42d20770489d29a6d0770b..48e5bc4386f2e04695b585ff9d71bd80cae4a2d1 100644
--- a/src/core/web_engine_context.cpp
+++ b/src/core/web_engine_context.cpp
@@ -186,7 +186,7 @@ bool usingSoftwareDynamicGL()
 {
     if (QCoreApplication::testAttribute(Qt::AA_UseSoftwareOpenGL))
         return true;
-#if defined(Q_OS_WIN)
+#if defined(Q_OS_WIN) && !defined(QT_NO_OPENGL)
     HMODULE handle = static_cast<HMODULE>(QOpenGLContext::openGLModuleHandle());
     wchar_t path[MAX_PATH];
     DWORD size = GetModuleFileName(handle, path, MAX_PATH);
diff --git a/src/webengine/api/qquickwebenginescript.cpp b/src/webengine/api/qquickwebenginescript.cpp
index acc5cedb7c7130a5038d57bfed8f0ac4b0be4b7c..ab7aee4cb249806c49af08caf07ef15d25374d9f 100644
--- a/src/webengine/api/qquickwebenginescript.cpp
+++ b/src/webengine/api/qquickwebenginescript.cpp
@@ -86,7 +86,8 @@ QT_BEGIN_NAMESPACE
 /*!
     \enum QQuickWebEngineScript::ScriptWorldId
 
-    The world ID defining which isolated world the script is executed in.
+    The world ID defining which isolated world the script is executed in. Besides these predefined
+    IDs custom IDs can be used, but must be integers between \c 0 and \c 256.
 
     \value MainWorld
            The world used by the page's web contents. It can be useful in order to expose custom
diff --git a/src/webengine/doc/src/webengineview_lgpl.qdoc b/src/webengine/doc/src/webengineview_lgpl.qdoc
index a6a7c088b99063cce60629cb5bd29611bff4c027..c089538b17e2d58ff3df6209101b2210cf514a0e 100644
--- a/src/webengine/doc/src/webengineview_lgpl.qdoc
+++ b/src/webengine/doc/src/webengineview_lgpl.qdoc
@@ -365,7 +365,7 @@
     \since QtWebEngine 1.3
 
     JavaScript world that the web channel instance used by this view is
-    installed in.
+    installed in. The world must be a number between \c 0 and \c 256.
 */
 
 /*!
diff --git a/src/webenginewidgets/api/qwebenginescript.cpp b/src/webenginewidgets/api/qwebenginescript.cpp
index d5247cde126fec8ed05b76b189c0fde766e847f6..d1e996b3ac31e0960517a7cb8a026e468096e328 100644
--- a/src/webenginewidgets/api/qwebenginescript.cpp
+++ b/src/webenginewidgets/api/qwebenginescript.cpp
@@ -224,6 +224,8 @@ quint32 QWebEngineScript::worldId() const
 
 /*!
     Sets the world ID of the isolated world to \a id when running this script.
+
+    Must be between \c 0 and \c 256.
  */
 void QWebEngineScript::setWorldId(quint32 id)
 {
diff --git a/src/webenginewidgets/doc/src/qwebenginepage_lgpl.qdoc b/src/webenginewidgets/doc/src/qwebenginepage_lgpl.qdoc
index 3013903c8554400310896bd42af5683638f070ec..f91b71ea1a035daed4657d7912c554214f2b9721 100644
--- a/src/webenginewidgets/doc/src/qwebenginepage_lgpl.qdoc
+++ b/src/webenginewidgets/doc/src/qwebenginepage_lgpl.qdoc
@@ -718,9 +718,9 @@
     \since 5.7
 
     Runs the JavaScript code contained in \a scriptSource in the world specified by \a worldId.
-    The world ID values are the same as provided by QWebEngineScript::ScriptWorldId. Using the
-    \e runJavaScript() versions without the world ID is the same as running the script in the
-    \c MainWorld.
+    The world ID values are the same as provided by QWebEngineScript::ScriptWorldId, and between \c 0
+    and \c 256. Using the \e runJavaScript() versions without the world ID is the same as running the
+    script in the \c MainWorld.
 
     When the script has been executed, \a resultCallback is called with the result of the last
     executed statement. \c resultCallback can be any of a function pointer, a functor or a lambda,
diff --git a/tests/auto/widgets/qwebengineview/tst_qwebengineview.cpp b/tests/auto/widgets/qwebengineview/tst_qwebengineview.cpp
index fad71a51790ab7021f38b1409cd560c744ee307c..b9a8b6a0905404825d2d64a56451ec2082ba7399 100644
--- a/tests/auto/widgets/qwebengineview/tst_qwebengineview.cpp
+++ b/tests/auto/widgets/qwebengineview/tst_qwebengineview.cpp
@@ -2338,9 +2338,9 @@ void tst_QWebEngineView::imeJSInputEvents()
 
     // Simply committing text should not trigger any JS composition event.
     QTRY_COMPARE(logLines().count(), 3);
-    QCOMPARE(logLines()[0], "[object InputEvent] beforeinput commit");
-    QCOMPARE(logLines()[1], "[object TextEvent] textInput commit");
-    QCOMPARE(logLines()[2], "[object InputEvent] input commit");
+    QCOMPARE(logLines()[0], QStringLiteral("[object InputEvent] beforeinput commit"));
+    QCOMPARE(logLines()[1], QStringLiteral("[object TextEvent] textInput commit"));
+    QCOMPARE(logLines()[2], QStringLiteral("[object InputEvent] input commit"));
 
     evaluateJavaScriptSync(view.page(), "clear()");
     QTRY_VERIFY(evaluateJavaScriptSync(view.page(), "log.textContent + input.textContent").toString().isEmpty());
@@ -2354,10 +2354,10 @@ void tst_QWebEngineView::imeJSInputEvents()
     }
 
     QTRY_COMPARE(logLines().count(), 4);
-    QCOMPARE(logLines()[0], "[object CompositionEvent] compositionstart ");
-    QCOMPARE(logLines()[1], "[object InputEvent] beforeinput preedit");
-    QCOMPARE(logLines()[2], "[object CompositionEvent] compositionupdate preedit");
-    QCOMPARE(logLines()[3], "[object InputEvent] input preedit");
+    QCOMPARE(logLines()[0], QStringLiteral("[object CompositionEvent] compositionstart "));
+    QCOMPARE(logLines()[1], QStringLiteral("[object InputEvent] beforeinput preedit"));
+    QCOMPARE(logLines()[2], QStringLiteral("[object CompositionEvent] compositionupdate preedit"));
+    QCOMPARE(logLines()[3], QStringLiteral("[object InputEvent] input preedit"));
 
     {
         QList<QInputMethodEvent::Attribute> attributes;
@@ -2368,11 +2368,11 @@ void tst_QWebEngineView::imeJSInputEvents()
     }
 
     QTRY_COMPARE(logLines().count(), 9);
-    QCOMPARE(logLines()[4], "[object InputEvent] beforeinput commit");
-    QCOMPARE(logLines()[5], "[object CompositionEvent] compositionupdate commit");
-    QCOMPARE(logLines()[6], "[object TextEvent] textInput commit");
-    QCOMPARE(logLines()[7], "[object InputEvent] input commit");
-    QCOMPARE(logLines()[8], "[object CompositionEvent] compositionend commit");
+    QCOMPARE(logLines()[4], QStringLiteral("[object InputEvent] beforeinput commit"));
+    QCOMPARE(logLines()[5], QStringLiteral("[object CompositionEvent] compositionupdate commit"));
+    QCOMPARE(logLines()[6], QStringLiteral("[object TextEvent] textInput commit"));
+    QCOMPARE(logLines()[7], QStringLiteral("[object InputEvent] input commit"));
+    QCOMPARE(logLines()[8], QStringLiteral("[object CompositionEvent] compositionend commit"));
 
     evaluateJavaScriptSync(view.page(), "clear()");
     QTRY_VERIFY(evaluateJavaScriptSync(view.page(), "log.textContent + input.textContent").toString().isEmpty());
@@ -2386,10 +2386,10 @@ void tst_QWebEngineView::imeJSInputEvents()
     }
 
     QTRY_COMPARE(logLines().count(), 4);
-    QCOMPARE(logLines()[0], "[object CompositionEvent] compositionstart ");
-    QCOMPARE(logLines()[1], "[object InputEvent] beforeinput preedit");
-    QCOMPARE(logLines()[2], "[object CompositionEvent] compositionupdate preedit");
-    QCOMPARE(logLines()[3], "[object InputEvent] input preedit");
+    QCOMPARE(logLines()[0], QStringLiteral("[object CompositionEvent] compositionstart "));
+    QCOMPARE(logLines()[1], QStringLiteral("[object InputEvent] beforeinput preedit"));
+    QCOMPARE(logLines()[2], QStringLiteral("[object CompositionEvent] compositionupdate preedit"));
+    QCOMPARE(logLines()[3], QStringLiteral("[object InputEvent] input preedit"));
 
     {
         QList<QInputMethodEvent::Attribute> attributes;
@@ -2399,11 +2399,11 @@ void tst_QWebEngineView::imeJSInputEvents()
     }
 
     QTRY_COMPARE(logLines().count(), 9);
-    QCOMPARE(logLines()[4], "[object InputEvent] beforeinput ");
-    QCOMPARE(logLines()[5], "[object CompositionEvent] compositionupdate ");
-    QCOMPARE(logLines()[6], "[object TextEvent] textInput ");
-    QCOMPARE(logLines()[7], "[object InputEvent] input null");
-    QCOMPARE(logLines()[8], "[object CompositionEvent] compositionend ");
+    QCOMPARE(logLines()[4], QStringLiteral("[object InputEvent] beforeinput "));
+    QCOMPARE(logLines()[5], QStringLiteral("[object CompositionEvent] compositionupdate "));
+    QCOMPARE(logLines()[6], QStringLiteral("[object TextEvent] textInput "));
+    QCOMPARE(logLines()[7], QStringLiteral("[object InputEvent] input null"));
+    QCOMPARE(logLines()[8], QStringLiteral("[object CompositionEvent] compositionend "));
 
     evaluateJavaScriptSync(view.page(), "clear()");
     QTRY_VERIFY(evaluateJavaScriptSync(view.page(), "log.textContent + input.textContent").toString().isEmpty());