[qt/qt/qtapplicationmanager]: Summary of bulk changes made

Git repository change summary for qt/qt/qtapplicationmanager
Pushed by mirror-service into branch '6.12'.
Changed from be0d1eb9ea55e33d6bdd64ae67845fb0ea6f949a to 02235924d273f5ed57e3d81cef4ea6fc00e85cca
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit f5bdfd305079fad979fb54ba2d21baa212b69916 by Qt Submodule Update Bot on 07/08/2026 at 12:03..
Update dependencies on '6.12' in qt/qtapplicationmanager

Change-Id: If9ad46a67e740fe9990370c437b61376beb9c512
Reviewed-by: Qt Submodule Update Bot <[email protected]>
https://invent.kde.org/qt/qt/qtapplicationmanager/-/commit/f5bdfd305079fad979fb54ba2d21baa212b69916

Git commit 251005dee344db42218b9f07a36c6057611c53ad by Qt Cherry-pick Bot (on behalf of Robert Griebl) on 07/08/2026 at 16:20..
Fix missing include

Change-Id: Ib347abefb208da6ea7f948711ef3962975d65eef
Reviewed-by: Thomas Senyk <[email protected]>
(cherry picked from commit dcb174f2f71f11be3bd81e9484ccb2bd9929e779)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtapplicationmanager/-/commit/251005dee344db42218b9f07a36c6057611c53ad

Git commit 9684bb371d2ab8441eeb77504bee53b3d3116365 by Qt Cherry-pick Bot (on behalf of Robert Griebl) on 07/08/2026 at 16:20..
Security review: bound the in-memory package header and footer buffers

The header and footer entries of a package are accumulated in memory
while extracting, with their size dictated by the package being read.
A crafted package could drive the extracting process out of memory -
including the appman itself, as the installer uses the same code.

Refuse anything above 1MB, as manifests and config files already do.

Also document that the packager's sign and verify commands unpack into
TMPDIR, so operators processing third-party packages need to bound that
filesystem: the extracted size itself is deliberately not capped, since
no limit would suit every deployment.

Change-Id: Ie487682fa38400fa214ef8aaf02428fd82e2da0d
Fixes: QTBUG-148989
Reviewed-by: Thomas Senyk <[email protected]>
(cherry picked from commit 0cc512216f4175ec9ed21b8eb47ba35f9d7e5216)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtapplicationmanager/-/commit/9684bb371d2ab8441eeb77504bee53b3d3116365

Git commit b4ed01453358ba44745b4197c8380a87988a3f9a by Qt Cherry-pick Bot (on behalf of Robert Griebl) on 07/08/2026 at 16:20..
Add recursion guards to the crash handlers

std::terminate is entered again, if anything throws while we are
reporting - e.g. from a what() implementation or an exception's
destructor. The Windows exception filter can likewise be re-entered by a
fault while parsing and re-throwing the MSVC exception internals, or by a
second thread crashing into its static buffer.

Change-Id: I2e569567e00a819b9b8bc890f82aaeb7168be417
Reviewed-by: Thomas Senyk <[email protected]>
(cherry picked from commit 63a4f32e426e8a397530f5b2c42acfb13bb3399a)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtapplicationmanager/-/commit/b4ed01453358ba44745b4197c8380a87988a3f9a

Git commit 1ded0f4c969b394ff3a91ec73f35498ffcaa1843 by Qt Cherry-pick Bot (on behalf of Robert Griebl) on 07/08/2026 at 16:20..
Replace the linear scan over waiting intent requests with a QHash

Requests that were gc'ed on the JS side before a reply arrived also
only got cleaned out of the list by a timer-throttled sweep on the
next successful reply, letting the list grow unboundedly. Keying by
requestId and erasing via QObject::destroyed removes entries as soon
as the request dies and makes the reply lookup O(1).

Change-Id: Iec3d360424a901c42c42a9ed0d3ac71fafd6a708
Reviewed-by: Thomas Senyk <[email protected]>
(cherry picked from commit 74d54256a344e3a94fcf99208b7434a562b61f33)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtapplicationmanager/-/commit/1ded0f4c969b394ff3a91ec73f35498ffcaa1843

Git commit 02235924d273f5ed57e3d81cef4ea6fc00e85cca by Qt Cherry-pick Bot (on behalf of Robert Griebl) on 07/08/2026 at 16:20..
Reject dangling backslash in debug wrapper specs

parseSpecification silently consumed a trailing '\' via the synthetic
null terminator. Reject it as malformed instead.

Change-Id: I82a2b181abc1798e792b23532f30db6e269c1860
Reviewed-by: Thomas Senyk <[email protected]>
(cherry picked from commit d3a3ed947848c3f550856275f7aa3df514a84e9c)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtapplicationmanager/-/commit/02235924d273f5ed57e3d81cef4ea6fc00e85cca