Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 26.7.5 to 26.7.6 with no accompanying changes to sources, checksums, build logic, install scripts, or package metadata. On its face this does not introduce any new attack surface or supply-chain risk. I did not see any suspicious source URLs, build-time downloads, privilege changes, or persistence mechanisms in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.7.5
+	pkgver = 26.7.6
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball URL from v26.7.5 to v26.7.6. There are no added build steps, scripts, patches, or metadata changes that would introduce execution, persistence, or integrity risks. Based on the provided diff alone, this is low risk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.5/qownnotes-26.7.5.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.6/qownnotes-26.7.6.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

Risk is low. The change only bumps qownnotes from 26.7.5 to 26.7.6 and updates the pinned upstream tag plus the release tarball checksum. The source remains an HTTPS GitHub release URL, there are no new build-time network fetches, scripts, patches, privilege changes, or packaging/install logic changes. This looks like a routine version update with integrity verification preserved.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.7.5
-tag="1aebac99caa5d9890c9b29435731de167a93bcf0"
+pkgver=26.7.6
+tag="41007a3fc265935c95307fc419d541afa937a24f"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change is a routine upstream version bump for qownnotes: it updates pkgver, the pinned upstream tag, and the source tarball checksum. The source remains an HTTPS GitHub release artifact, there are no new build-time downloads, scripts, privilege changes, or packaging logic changes in the diff. No security red flags are introduced by this hunk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('c51983b66f3c8c6a42305890cd35278968dd32ec14ce2765deba90301578c3d3')
+sha256sums=('71798dd1e711574fa69c4559473057e9b5c2f4261b1ee4866698e2f61e1360a3')
 
 prepare() {
     cd "${pkgname}-${pkgver}"