Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.7.6 to 26.7.7. No sources, checksums, build steps, dependencies, install scripts, or permissions changed in the reviewed diff, so there is no new security concern visible here. This is a routine metadata update with minimal risk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.7.6
+	pkgver = 26.7.7
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from QOwnNotes 26.7.6 to 26.7.7, with the source URL updated accordingly. No new sources, scripts, build steps, permissions, or packaging behavior are introduced by this diff. Based on the provided hunk alone, this is low risk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.6/qownnotes-26.7.6.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.7/qownnotes-26.7.7.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

Low risk. The change only bumps the package version/tag and updates the source tarball checksum for an upstream release. Source remains HTTPS from the official GitHub release URL, and there are no new build-time commands, patches, binaries, install scripts, or privilege/persistence mechanisms introduced in this diff. I did not find any supply-chain red flags in the reviewed hunk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.7.6
-tag="41007a3fc265935c95307fc419d541afa937a24f"
+pkgver=26.7.7
+tag="1ca3e43b4d21ad465784cbf9e8761070619019a0"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

Low risk. The change only updates qownnotes to a new upstream release by bumping pkgver/tag and replacing the source tarball checksum. The source remains an HTTPS GitHub release artifact, with no new build steps, scripts, patches, or privilege/network changes introduced in the PKGBUILD diff. I did not see any supply-chain red flags in this hunk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('71798dd1e711574fa69c4559473057e9b5c2f4261b1ee4866698e2f61e1360a3')
+sha256sums=('de6fc912b0435d0782bb54a12133c9b5991ffdcd0f2ff46b289b2157f097625b')
 
 prepare() {
     cd "${pkgname}-${pkgver}"