Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 26.7.4 to 26.7.5. No sources, checksums, build steps, dependencies, install scripts, or packaging permissions were modified in the reviewed hunk. On its face this is a routine metadata update with no security-relevant behavior change visible in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.7.4
+	pkgver = 26.7.5
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release URL from v26.7.4 to v26.7.5. No new sources, scripts, build steps, permissions, or packaging metadata were introduced, and the source remains an HTTPS GitHub release tarball from the same upstream project. Based on the provided diff alone, there are no evident security concerns.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.4/qownnotes-26.7.4.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.5/qownnotes-26.7.5.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump in PKGBUILD: it updates pkgver/tag and the source checksum to match the new upstream release tarball. The source remains an HTTPS GitHub release URL, there are no new build-time downloads, no added scripts, no privilege escalation, and no packaging changes beyond the version/hash refresh. I found no security-relevant red flags in this diff.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.7.4
-tag="e0ea937bd577857099ff3443c238b2ba452ca0d3"
+pkgver=26.7.5
+tag="1aebac99caa5d9890c9b29435731de167a93bcf0"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change is a straightforward version bump for an upstream release tarball, with the source still fetched over HTTPS from the official GitHub releases page and the checksum updated accordingly. The VCS tag is pinned to a specific commit, there are no new build-time downloads, scripts, patches, or packaging changes, and no privilege/persistence red flags are introduced by this diff. Based on the provided hunk, this looks low risk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('9ab27d4c59877e153ec1e702aa03271d0ddb8341c10809ae02a4b58b5ea40c3e')
+sha256sums=('c51983b66f3c8c6a42305890cd35278968dd32ec14ce2765deba90301578c3d3')
 
 prepare() {
     cd "${pkgname}-${pkgver}"