Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 9.45 to 9.48. No build logic, sources, install scripts, permissions, or dependencies are modified here, and there are no new integrity or execution red flags visible in the provided diff. Based on this hunk alone, the change appears low risk.

@@ -1,6 +1,6 @@
 pkgbase = perl-mojolicious
 	pkgdesc = Real-time web framework
-	pkgver = 9.45
+	pkgver = 9.48
 	pkgrel = 1
 	url = https://metacpan.org/release/Mojolicious
 	arch = any

Comment

The change is a straightforward upstream version bump in .SRCINFO from Mojolicious 9.45 to 9.48, with the source URL remaining on the official CPAN/MetaCPAN host over HTTPS. No new build steps, scripts, dependencies, or packaging behaviors are introduced, and the updated checksums simply track the new tarball. I don’t see any supply-chain or privilege-related red flags in this diff.

@@ -10,8 +10,8 @@ pkgbase = perl-mojolicious
 	optdepends = perl-cpanel-json-xs>=4.09: Faster JSON encoding and decoding
 	optdepends = perl-role-tiny>=2.000001: Role support
 	options = !emptydirs
-	source = https://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-9.45.tar.gz
-	md5sums = e752c94ec1b5ee7faa81e1be957bbcb1
-	sha512sums = 22bd715a3dbf6eef56506021806421ff67707ea9dce071f1440a99a18e1f0a9bc2e89a3426d4eee5e727f1ec5eb360860a861868443d9b41088b406f2dbc1660
+	source = https://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-9.48.tar.gz
+	md5sums = da7c810242b8d734482f7ce9d51e715b
+	sha512sums = f9bd7e6af0017dc3895367a956c9b0273f011229c55a0efd010ea7497b7a54e37989f307df561cccf1a9abbebdeb45dc4d828f90f279927077fa3d243435bf2f
 
 pkgname = perl-mojolicious

Comment

The change is a routine upstream version bump from Mojolicious 9.45 to 9.48 with corresponding checksum updates. The source remains an HTTPS CPAN tarball from the official upstream location, there are no new build-time network fetches, no added scripts, and no packaging logic changes beyond the version/hash refresh. I did not find any supply-chain or persistence red flags in this diff.

@@ -3,7 +3,7 @@
 # Generator  : CPANPLUS::Dist::Arch 1.32
 
 pkgname='perl-mojolicious'
-pkgver='9.45'
+pkgver='9.48'
 pkgrel='1'
 pkgdesc="Real-time web framework"
 arch=('any')

Comment

The change is a routine version bump in PKGBUILD from Mojolicious 9.45 to 9.48 with corresponding checksum updates. The source remains the official CPAN HTTPS tarball, there are no new build-time network fetches, no added scripts, and no packaging logic changes. I did not see any integrity or persistence red flags in this diff.

@@ -14,8 +14,8 @@ makedepends=()
 optdepends=('perl-cpanel-json-xs>=4.09: Faster JSON encoding and decoding' 'perl-role-tiny>=2.000001: Role support')
 url='https://metacpan.org/release/Mojolicious'
 source=("https://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-${pkgver}.tar.gz")
-md5sums=('e752c94ec1b5ee7faa81e1be957bbcb1')
-sha512sums=('22bd715a3dbf6eef56506021806421ff67707ea9dce071f1440a99a18e1f0a9bc2e89a3426d4eee5e727f1ec5eb360860a861868443d9b41088b406f2dbc1660')
+md5sums=('da7c810242b8d734482f7ce9d51e715b')
+sha512sums=('f9bd7e6af0017dc3895367a956c9b0273f011229c55a0efd010ea7497b7a54e37989f307df561cccf1a9abbebdeb45dc4d828f90f279927077fa3d243435bf2f')
 _distdir="Mojolicious-${pkgver}"
 
 build() {