This doesn’t appear to be a false positive. Rather, it appears that WebEngine is building with an old, embedded copy of rollup instead of using the system one. See the parallel discussion about Qt WebEngine 5 at:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023334
--
Soren Stoutner
soren@stoutner.com
Attachment:
signature.asc
Description: This is a digitally signed message part.