Review Results

Comment

The change is limited to a version bump in .SRCINFO from 4.1.1.7-2 to 4.1.1.8-1. No sources, checksums, build steps, install scripts, or packaging logic are modified in the reviewed hunk, so there is no direct security signal here. This appears to be routine metadata synchronization with the PKGBUILD and is low risk on its face.

@@ -1,7 +1,7 @@
 pkgbase = wechat-universal-bwrap
 	pkgdesc = WeChat (Universal) with bwrap sandbox
-	pkgver = 4.1.1.7
-	pkgrel = 2
+	pkgver = 4.1.1.8
+	pkgrel = 1
 	url = https://linux.weixin.qq.com/
 	install = wechat-universal.install
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: pkgver/pkgrel updated and the per-architecture source filenames and SHA-256 checksums were refreshed to match the new upstream WeChat .deb releases. The download URLs remain HTTPS and point to the same official Tencent host, with no new build-time code execution, install-script changes, or packaging red flags introduced by this diff. Risk is low because this is metadata-only and does not itself add executable content or weaken integrity controls.

@@ -31,9 +31,9 @@ pkgbase = wechat-universal-bwrap
 	conflicts = wechat-universal
 	replaces = wechat-beta
 	replaces = wechat-beta-bwrap
-	noextract = wechat-universal-4.1.1.7-x86_64.deb
-	noextract = wechat-universal-4.1.1.7-aarch64.deb
-	noextract = wechat-universal-4.1.1.7-loong64.deb
+	noextract = wechat-universal-4.1.1.8-x86_64.deb
+	noextract = wechat-universal-4.1.1.8-aarch64.deb
+	noextract = wechat-universal-4.1.1.8-loong64.deb
 	options = !strip
 	options = !debug
 	options = emptydirs

Comment

The change is a straightforward version bump in .SRCINFO for three architecture-specific upstream .deb sources, with updated SHA-256 checksums. The download URLs remain HTTPS and point to the same official Tencent host as before, and there are no new build-time commands, scripts, or packaging behavior changes in this diff. Based on the provided hunk alone, I don’t see a security issue beyond the usual trust in the upstream binary release.

@@ -47,11 +47,11 @@ pkgbase = wechat-universal-bwrap
 	sha256sums = fc3ce9eb8dee3ee149233ebdb844d3733b2b2a8664422d068cf39b7fb08138f8
 	sha256sums = f05f6f907898740dab9833c1762e56dbc521db3c612dd86d2e2cd4b81eb257bf
 	sha256sums = 898ebc397583d111db9a337e9d09aaee2f795fcd720e65cab5ce0e92efcd8f10
-	source_x86_64 = wechat-universal-4.1.1.7-x86_64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb
-	sha256sums_x86_64 = af28ffa501d6eb1db769eeaf895b10fedcd4bf4ee7764a22d5b3af50e53f5be5
-	source_aarch64 = wechat-universal-4.1.1.7-aarch64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb
-	sha256sums_aarch64 = 2870123ee5e0202711210d82e3435f0a4712ca593eb0480f6d9db4589a288810
-	source_loong64 = wechat-universal-4.1.1.7-loong64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_LoongArch.deb
-	sha256sums_loong64 = 7ed581dfa6a166982f74fbc70ccf9924d89ce7ae069f77ff44a322d90b447321
+	source_x86_64 = wechat-universal-4.1.1.8-x86_64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb
+	sha256sums_x86_64 = c9765e87ee5133bf4bb50d585c1814fafd995e3fb0da62c5ed07259b43dada7b
+	source_aarch64 = wechat-universal-4.1.1.8-aarch64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb
+	sha256sums_aarch64 = c3ed1a481247e6a1b166e87a66cccdee898c3ae0b76613b39bb6e9795e50929f
+	source_loong64 = wechat-universal-4.1.1.8-loong64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_LoongArch.deb
+	sha256sums_loong64 = a5fa706d7936dcf55cff2ae4a59c11ccd0e0095210d602c3233ca7f14c291b94
 
 pkgname = wechat-universal-bwrap

Comment

The change only bumps pkgver from 4.1.1.7 to 4.1.1.8 and resets pkgrel from 2 to 1. No build logic, sources, install scripts, permissions, or dependencies are changed in the provided diff. Based on this hunk alone, there are no new security concerns introduced.

@@ -4,8 +4,8 @@
 
 _pkgname=wechat-universal
 pkgname=${_pkgname}-bwrap
-pkgver=4.1.1.7
-pkgrel=2
+pkgver=4.1.1.8
+pkgrel=1
 pkgdesc="WeChat (Universal) with bwrap sandbox"
 arch=('x86_64' 'aarch64' 'loong64')
 url='https://linux.weixin.qq.com/'

Comment

The change only bumps pkgver/pkgrel and refreshes the per-architecture SHA-256 checksums for the upstream .deb artifacts. There are no new sources, no build-script logic changes, no new install hooks, and no changes to permissions or packaging behavior. The security posture is unchanged aside from trusting the new upstream release artifacts, which is already covered by the checksum pinning in the PKGBUILD.

@@ -70,13 +70,13 @@ sha256sums=(
 )
 
 sha256sums_x86_64=(
-    'af28ffa501d6eb1db769eeaf895b10fedcd4bf4ee7764a22d5b3af50e53f5be5'
+    'c9765e87ee5133bf4bb50d585c1814fafd995e3fb0da62c5ed07259b43dada7b'
 )
 sha256sums_aarch64=(
-    '2870123ee5e0202711210d82e3435f0a4712ca593eb0480f6d9db4589a288810'
+    'c3ed1a481247e6a1b166e87a66cccdee898c3ae0b76613b39bb6e9795e50929f'
 )
 sha256sums_loong64=(
-    '7ed581dfa6a166982f74fbc70ccf9924d89ce7ae069f77ff44a322d90b447321'
+    'a5fa706d7936dcf55cff2ae4a59c11ccd0e0095210d602c3233ca7f14c291b94'
 )
 
 prepare() {