Review Results

Comment

The change is a straightforward version bump in .SRCINFO, updating pkgver and the corresponding upstream tarball URLs/checksums for x86_64 and aarch64. I do not see any new red flags in the metadata itself: sources remain HTTPS, point to the vendor’s download host, and are pinned by checksum. No build/install logic changed in this diff, so there is no evidence of added code execution, persistence, or privilege escalation. Risk is low.

@@ -1,6 +1,6 @@
 pkgbase = postman-bin
 	pkgdesc = Build, test, and document your APIs faster
-	pkgver = 12.17.5
+	pkgver = 12.19.0
 	pkgrel = 1
 	url = https://www.getpostman.com
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Postman binaries, with sources still using HTTPS from the official pstmn.io download endpoint and updated SHA256 checksums for x86_64/aarch64. No new build steps, scripts, or privilege-related artifacts are introduced in this diff. Based on the provided hunk alone, I don't see a security issue beyond the usual trust inherent in shipping upstream binaries.

@@ -38,9 +38,9 @@ pkgbase = postman-bin
 	options = !strip
 	source = postman.desktop
 	sha256sums = d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d
-	source_x86_64 = postman-12.17.5-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.17.5/linux64
-	sha256sums_x86_64 = 5641b98fca26fca6cff67845157b01e1430bc3bbc6b7cb1e37b3a4f0a30a5a99
-	source_aarch64 = postman-12.17.5-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.17.5/linux_arm64
-	sha256sums_aarch64 = d63a933457bae9cea301972f036190875bc7576b160cac11c38241aeef34aac5
+	source_x86_64 = postman-12.19.0-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.19.0/linux64
+	sha256sums_x86_64 = 18367a5946c1f560f64c805771bf8b3ceaffaccc58bfa3ab7bce2c3faad62d1f
+	source_aarch64 = postman-12.19.0-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.19.0/linux_arm64
+	sha256sums_aarch64 = a707b1a59c16af32054a926771c26c8d8237003c7cb9660cb73763a36f95438c
 
 pkgname = postman-bin

Comment

The change is a straightforward version bump in PKGBUILD for a prebuilt upstream binary package, with updated SHA-256 checksums for the new release artifacts. The source URLs remain HTTPS and point to the official Postman download host, and there are no new build steps, scripts, or privilege-related changes in the diff. Based on the provided hunk, I do not see any security red flags beyond the usual trust inherent in shipping a vendor binary.

@@ -4,7 +4,7 @@
 # Contributor: Juan Francisco Miranda <jfmiranda at gmail dot com>
 
 pkgname=postman-bin
-pkgver=12.17.5
+pkgver=12.19.0
 pkgrel=1
 pkgdesc="Build, test, and document your APIs faster"
 provides=('postman')

Comment

The change only bumps postman-bin from 12.17.5 to 12.19.0 and updates the expected SHA-256 checksums for the upstream release tarballs. The source URLs remain HTTPS and point to the official Postman download host, with no new build-time code execution, no added scripts, and no packaging changes beyond integrity metadata. I don’t see a security regression in this diff.

@@ -20,8 +20,8 @@ source_x86_64=("postman-${pkgver}-linux-${arch[0]}.tar.gz::https://dl.pstmn.io/d
 source_aarch64=("postman-${pkgver}-linux-${arch[1]}.tar.gz::https://dl.pstmn.io/download/version/${pkgver}/linux_arm64")
 
 sha256sums=('d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d')
-sha256sums_x86_64=('5641b98fca26fca6cff67845157b01e1430bc3bbc6b7cb1e37b3a4f0a30a5a99')
-sha256sums_aarch64=('d63a933457bae9cea301972f036190875bc7576b160cac11c38241aeef34aac5')
+sha256sums_x86_64=('18367a5946c1f560f64c805771bf8b3ceaffaccc58bfa3ab7bce2c3faad62d1f')
+sha256sums_aarch64=('a707b1a59c16af32054a926771c26c8d8237003c7cb9660cb73763a36f95438c')
 
 package() {
   install -dm755 "${pkgdir}/opt/"