Review Results

Comment

The change only bumps pkgver in .SRCINFO from 3.1.0a3 to 3.1.0a4. No sources, checksums, build steps, install scripts, permissions, or dependencies are altered, and .SRCINFO is metadata only. I see no security-relevant behavior introduced by this diff.

@@ -1,6 +1,6 @@
 pkgbase = gns3-gui
 	pkgdesc = GNS3 network simulator. Graphical user interface package.
-	pkgver = 3.1.0a3
+	pkgver = 3.1.0a4
 	pkgrel = 1
 	url = https://github.com/GNS3/gns3-gui
 	arch = any

Comment

The change is a straightforward upstream version bump in .SRCINFO from v3.1.0a3 to v3.1.0a4 with corresponding checksum updates. The source remains an HTTPS GitHub release tarball, there are no new sources, no build-script changes, and no signs of added execution, persistence, or integrity bypass mechanisms in this diff. Based on the provided hunk alone, this looks low risk.

@@ -22,11 +22,11 @@ pkgbase = gns3-gui
 	optdepends = python-sentry_sdk: Python SDK for Sentry.io
 	optdepends = xterm: Default terminal emulator for CLI management of virtual instances
 	optdepends = wireshark-qt: Live packet capture
-	source = gns3-gui-3.1.0a3.tar.gz::https://github.com/GNS3/gns3-gui/archive/v3.1.0a3.tar.gz
+	source = gns3-gui-3.1.0a4.tar.gz::https://github.com/GNS3/gns3-gui/archive/v3.1.0a4.tar.gz
 	source = gns3.desktop
 	source = fix_requirements_for_Arch.patch
-	sha256sums = bb187178b21e9c2b6c4e2e4fcf3139e4a445e75263526a47cffeffe5283740c2
+	sha256sums = c408e2ba40d2d4d5c5a15bc2c8072f913590aea86f172f6be5d48cd6a03968fa
 	sha256sums = 51e6db5b47e6af3d008d85e8c597755369fafb75ddb2af9e79a441f943f4c166
-	sha256sums = d628916b0ec8a528abe9ad1379432dec8497b8d4686f90ec941dc2ccf8b6978b
+	sha256sums = cdf52d8383a1d0d001d95a2787b5dfb09ad43a526ab180b93038c7acf392b949
 
 pkgname = gns3-gui

Comment

The change is a simple version bump in PKGBUILD from 3.1.0a3 to 3.1.0a4 with no other modifications. There are no new sources, build steps, install scripts, permissions changes, or packaging logic introduced in the reviewed hunk. Based on this diff alone, I see no security-relevant impact.

@@ -3,7 +3,7 @@
 # Contributor: korjjj <korjjj+aur[at]gmail[dot]com>
 
 pkgname=gns3-gui
-pkgver=3.1.0a3
+pkgver=3.1.0a4
 pkgrel=1
 pkgdesc='GNS3 network simulator. Graphical user interface package.'
 arch=(any)

Comment

The change only bumps the package version and refreshes checksums for the upstream tarball and an existing local patch. I inspected the patch content: it merely relaxes Python dependency pins in requirements.txt (jsonschema, sentry-sdk, truststore, QDarkStyle) and does not introduce any code execution, network fetches at build time, privilege escalation, or packaging changes outside the normal source/patch flow. No suspicious new sources or install scripts were added. Overall this looks like a routine upstream version update with low security risk.

@@ -34,9 +34,9 @@ optdepends=(
 source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz"
         gns3.desktop
         fix_requirements_for_Arch.patch)
-sha256sums=('bb187178b21e9c2b6c4e2e4fcf3139e4a445e75263526a47cffeffe5283740c2'
+sha256sums=('c408e2ba40d2d4d5c5a15bc2c8072f913590aea86f172f6be5d48cd6a03968fa'
             '51e6db5b47e6af3d008d85e8c597755369fafb75ddb2af9e79a441f943f4c166'
-            'd628916b0ec8a528abe9ad1379432dec8497b8d4686f90ec941dc2ccf8b6978b')
+            'cdf52d8383a1d0d001d95a2787b5dfb09ad43a526ab180b93038c7acf392b949')
 
 prepare() {
     cd "$pkgname-$pkgver"

Comment

The provided patch hunk only updates the path/timestamps in a requirements.txt diff header and removes two jsonschema pins from the displayed context. There is no evidence here of malicious build-time execution, network fetching, privilege escalation, or packaging persistence mechanisms. Based on the limited hunk shown, this looks like a benign requirements adjustment with no direct security impact visible in the reviewed change.

@@ -1,5 +1,5 @@
---- a/gns3-gui-3.1.0a3/requirements.txt	2026-06-06 23:19:24.000000000 +0200
-+++ b/gns3-gui-3.1.0a3/requirements.txt	2026-06-22 14:11:00.985143955 +0200
+--- a/gns3-gui-3.1.0a4/requirements.txt	2026-07-09 10:40:43.000000000 +0200
++++ b/gns3-gui-3.1.0a4/requirements.txt	2026-07-13 11:43:58.546252863 +0200
 @@ -1,7 +1,6 @@
 -jsonschema==4.25.1; python_version == '3.9'  # version 4.25.1 is the last to support Python 3.9
 -jsonschema>=4.26.0,<4.27; python_version >= '3.10'