Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.128.0 to 1.128.1. No source URLs, build logic, install scripts, permissions, or package metadata beyond the version number are altered in the provided diff. On its face this is a routine version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = visual-studio-code-bin
 	pkgdesc = Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)
-	pkgver = 1.128.0
+	pkgver = 1.128.1
 	pkgrel = 1
 	url = https://code.visualstudio.com/
 	install = visual-studio-code-bin.install

Comment

The change is a routine version bump in .SRCINFO for the prebuilt Visual Studio Code package, updating the upstream Microsoft download URLs and checksums from 1.128.0 to 1.128.1 for x86_64, aarch64, and armv7h. The sources remain HTTPS on the official update.code.visualstudio.com domain, are pinned to exact versioned artifacts, and there are no new build-time commands, scripts, or packaging behavior changes in this diff. No security red flags are introduced by this metadata-only update.

@@ -31,11 +31,11 @@ pkgbase = visual-studio-code-bin
 	options = !strip
 	source = visual-studio-code-bin.sh
 	sha256sums = bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad
-	source_x86_64 = code_1.128.0_amd64.deb::https://update.code.visualstudio.com/1.128.0/linux-deb-x64/stable
-	sha256sums_x86_64 = ee7ff012cf872e497d665486e56c5b1a12e36cca0c07c97887c997cbfdc797b1
-	source_aarch64 = code_1.128.0_arm64.deb::https://update.code.visualstudio.com/1.128.0/linux-deb-arm64/stable
-	sha256sums_aarch64 = eb394338250dc7f5371c8c8e6a26d632c7aa977843d6ee7a496132c301a8ea05
-	source_armv7h = code_1.128.0_armhf.deb::https://update.code.visualstudio.com/1.128.0/linux-deb-armhf/stable
-	sha256sums_armv7h = 230d782d05d84ac82ed1a8b6c5b0d209714c0eb792d87838f1111d9120152091
+	source_x86_64 = code_1.128.1_amd64.deb::https://update.code.visualstudio.com/1.128.1/linux-deb-x64/stable
+	sha256sums_x86_64 = dd9d9e0d6af318ac86252b4e4b47868d0dc2f2144171bc54b67842c0934af099
+	source_aarch64 = code_1.128.1_arm64.deb::https://update.code.visualstudio.com/1.128.1/linux-deb-arm64/stable
+	sha256sums_aarch64 = d4438dab2c9dab81c81ac7f0600eb64ffb90d6109ec352c5ef4408035ca294ec
+	source_armv7h = code_1.128.1_armhf.deb::https://update.code.visualstudio.com/1.128.1/linux-deb-armhf/stable
+	sha256sums_armv7h = 7a63a81ac7d0e1c73f54a0c0536a74c67970d8a114467cb93e5d4673c63769de
 
 pkgname = visual-studio-code-bin

Comment

The change only bumps pkgver from 1.128.0 to 1.128.1 and updates the per-architecture SHA256 checksums for the official Microsoft .deb downloads. Source URLs remain HTTPS and point to the upstream Visual Studio Code update endpoint, with no new build steps, scripts, or packaging behavior changes. I do not see any added supply-chain, persistence, or privilege-escalation risk in this diff.

@@ -2,7 +2,7 @@
 
 pkgname=visual-studio-code-bin
 _pkgname=visual-studio-code
-pkgver=1.128.0
+pkgver=1.128.1
 pkgrel=1
 pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)"
 arch=('x86_64' 'aarch64' 'armv7h')

Comment

The change is a routine version bump from 1.128.0 to 1.128.1 with corresponding SHA-256 updates for the official Microsoft download URLs. No new sources, scripts, build steps, privilege changes, or packaging logic were introduced. The package still fetches from HTTPS update.code.visualstudio.com and only adjusts integrity pins for the new upstream release. Based on the provided diff, this is low risk.

@@ -27,9 +27,9 @@ source_x86_64=(code_${pkgver}_amd64.deb::https://update.code.visualstudio.com/${
 source_aarch64=(code_${pkgver}_arm64.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-arm64/stable)
 source_armv7h=(code_${pkgver}_armhf.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-armhf/stable)
 sha256sums=('bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad')
-sha256sums_x86_64=('ee7ff012cf872e497d665486e56c5b1a12e36cca0c07c97887c997cbfdc797b1')
-sha256sums_aarch64=('eb394338250dc7f5371c8c8e6a26d632c7aa977843d6ee7a496132c301a8ea05')
-sha256sums_armv7h=('230d782d05d84ac82ed1a8b6c5b0d209714c0eb792d87838f1111d9120152091')
+sha256sums_x86_64=('dd9d9e0d6af318ac86252b4e4b47868d0dc2f2144171bc54b67842c0934af099')
+sha256sums_aarch64=('d4438dab2c9dab81c81ac7f0600eb64ffb90d6109ec352c5ef4408035ca294ec')
+sha256sums_armv7h=('7a63a81ac7d0e1c73f54a0c0536a74c67970d8a114467cb93e5d4673c63769de')
 
 package() {
   bsdtar -xf data.tar.xz -C "${pkgdir}/"