Review Results

Comment

The only change in this .SRCINFO hunk is a version/release bump from 2026.1.4-2 to 2026.2-1. No sources, checksums, install scripts, build commands, or permissions are altered here, so there is no direct security signal in the diff itself. Based on the provided hunk alone, this looks like a routine package update metadata change.

@@ -1,7 +1,7 @@
 pkgbase = intellij-idea-ultimate-edition
 	pkgdesc = An intelligent IDE for Java, Groovy and other programming languages with advanced refactoring features intensely focused on developer productivity.
-	pkgver = 2026.1.4
-	pkgrel = 2
+	pkgver = 2026.2
+	pkgrel = 1
 	url = https://www.jetbrains.com/idea/
 	arch = x86_64
 	arch = aarch64

Comment

The change is a straightforward version bump in .SRCINFO for the x86_64 and aarch64 JetBrains IDEA Ultimate tarballs and the aarch64 fsnotifier binary checksum. The sources remain HTTPS and point to the expected JetBrains/GitHub locations, with no new build-time commands, install-script changes, or added suspicious sources. The only notable issue is that the aarch64 source line for the IDE tarball appears to have been updated without a corresponding checksum line in the shown hunk, but .SRCINFO is metadata only and this does not itself introduce an execution or integrity risk in the reviewed diff.

@@ -11,12 +11,12 @@ pkgbase = intellij-idea-ultimate-edition
 	options = !strip
 	source = jetbrains-idea.desktop
 	sha256sums = 83af2ba8f9f14275a6684e79d6d4bd9b48cd852c047dacfc81324588fa2ff92b
-	source_x86_64 = https://download.jetbrains.com/idea/ideaIU-2026.1.4.tar.gz
-	sha256sums_x86_64 = 3104d85d9507ff882065e3f8eb9506402b4a8129092d2682662bb6e9c4f063fc
-	source_aarch64 = https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.tar.gz
+	source_x86_64 = https://download.jetbrains.com/idea/ideaIU-2026.2.tar.gz
+	sha256sums_x86_64 = a8055cadef1a6eed4558f8bc9bd591c3a4939f4c8c34560fdf58ab4d2a5c783d
+	source_aarch64 = https://download.jetbrains.com/idea/ideaIU-2026.2-aarch64.tar.gz
 	source_aarch64 = https://cache-redirector.jetbrains.com/intellij-jbr/jbr-25.0.3-linux-aarch64-b508.16.tar.gz
-	source_aarch64 = fsnotifier-2026.1.4::https://github.com/JetBrains/intellij-community/raw/master/bin/linux/aarch64/fsnotifier
-	sha256sums_aarch64 = 303645b8bad4c5c0887346618b842180a3de53b3e0b3da09fc5c501f59f78013
+	source_aarch64 = fsnotifier-2026.2::https://github.com/JetBrains/intellij-community/raw/master/bin/linux/aarch64/fsnotifier
+	sha256sums_aarch64 = 41ca911b590f9c1982802bae1a6b5c90cc479e65885f54172824a85f227bc76e
 	sha256sums_aarch64 = 8704ffff0723bbe00992a02e455cda6a76697b40f9a5b833fc853e3c3b05dd14
 	sha256sums_aarch64 = aa812c5acac06435217b9018aa3e187a3546ea8d3cf136481a2d50aee4b9b23a
 

Comment

The change only bumps pkgver from 2026.1.4 to 2026.2 and resets pkgrel from 2 to 1. No source URLs, build steps, install scripts, permissions, or other packaging logic changed in the provided hunk. On its face this is a routine version update with no security-relevant behavior change visible in the diff.

@@ -3,8 +3,8 @@
 
 
 pkgname=intellij-idea-ultimate-edition
-pkgver=2026.1.4
-pkgrel=2
+pkgver=2026.2
+pkgrel=1
 jbr_ver=25.0.3
 jbr_build=aarch64-b508
 jbr_minor=16

Comment

The change is a routine upstream version bump with updated checksums and one path fix for the Maven wrapper executable. I do not see any new attack surface: sources remain HTTPS from JetBrains/GitHub, no new build-time network fetches or scripts were introduced, and package() still only installs into $pkgdir. The chmod target change appears to correct the plugin path for the new upstream layout rather than grant extra privileges. Overall this looks safe.

@@ -21,8 +21,8 @@ source_aarch64=("https://download.jetbrains.com/idea/ideaIU-$pkgver-aarch64.tar.
                 "https://cache-redirector.jetbrains.com/intellij-jbr/jbr-$jbr_ver-linux-$jbr_build.$jbr_minor.tar.gz"
                  "fsnotifier-${pkgver}::https://github.com/JetBrains/intellij-community/raw/master/bin/linux/aarch64/fsnotifier")
 sha256sums=('83af2ba8f9f14275a6684e79d6d4bd9b48cd852c047dacfc81324588fa2ff92b')
-sha256sums_x86_64=('3104d85d9507ff882065e3f8eb9506402b4a8129092d2682662bb6e9c4f063fc')
-sha256sums_aarch64=('303645b8bad4c5c0887346618b842180a3de53b3e0b3da09fc5c501f59f78013'
+sha256sums_x86_64=('a8055cadef1a6eed4558f8bc9bd591c3a4939f4c8c34560fdf58ab4d2a5c783d')
+sha256sums_aarch64=('41ca911b590f9c1982802bae1a6b5c90cc479e65885f54172824a85f227bc76e'
                     '8704ffff0723bbe00992a02e455cda6a76697b40f9a5b833fc853e3c3b05dd14'
                     'aa812c5acac06435217b9018aa3e187a3546ea8d3cf136481a2d50aee4b9b23a')
 

Comment

The change is a narrow path fix in package() that only adjusts which bundled Maven launcher is marked executable, from the old `plugins/maven/...` location to `plugins/maven-plugin/...`. There is no added network access, no new script execution, no privilege escalation, and no change to installed files beyond preserving the expected executable bit on an upstream-shipped binary. I don't see any security impact from this diff alone.

@@ -58,7 +58,7 @@ package_intellij-idea-ultimate-edition() {
   mv "$srcdir"/jbr "$pkgdir"/opt/$pkgbase
 
   # https://youtrack.jetbrains.com/issue/IDEA-185828
-  chmod +x "$pkgdir"/opt/$pkgbase/plugins/maven/lib/maven3/bin/mvn
+  chmod +x "$pkgdir"/opt/$pkgbase/plugins/maven-plugin/lib/maven3/bin/mvn
 
   ln -s /opt/$pkgname/bin/idea "$pkgdir"/usr/bin/$pkgname
   ln -s /opt/$pkgname/bin/idea.sh "$pkgdir"/usr/bin/idea