Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2026.1.4 to 2026.2. By itself, this does not introduce new build logic, sources, install scripts, permissions, or other security-relevant behavior. I did not see any indication in the provided diff of added network fetching, privilege escalation, or packaging changes. Risk is therefore minimal for this specific change.

@@ -1,6 +1,6 @@
 pkgbase = webstorm
 	pkgdesc = JavaScript IDE and HTML editor
-	pkgver = 2026.1.4
+	pkgver = 2026.2
 	pkgrel = 1
 	url = https://www.jetbrains.com/webstorm/
 	arch = x86_64

Comment

Risk is low. The change only bumps the WebStorm upstream version in .SRCINFO and updates the corresponding source checksum; the source remains the official JetBrains HTTPS download URL, and there are no new build steps, scripts, or privilege-related artifacts introduced by this diff. No obvious supply-chain red flags are present in the reviewed hunk.

@@ -8,10 +8,10 @@ pkgbase = webstorm
 	license = custom:jetbrains
 	depends = glib2
 	options = !strip
-	source = https://download.jetbrains.com/webstorm/WebStorm-2026.1.4.tar.gz
+	source = https://download.jetbrains.com/webstorm/WebStorm-2026.2.tar.gz
 	source = jetbrains-webstorm.desktop
 	source = LICENSE
-	b2sums = 3e8e53aefd2c923e39b38c1677ec2d673397232677ba8df064c70dcae2eff0521cf57fb82586ccdcd6bebfd294c886fb29168913f66fbbc5ea78e9f36b19c859
+	b2sums = da5c23dc891a2e5b6669e2b4b24efb4d1ba747078baa98d29bc652459d9b7be4125914f2d7758db34e94a2bae85a6767d8dc845a424837ca1ccb3a07eb39b119
 	b2sums = a7c2c63112c967b1a866c2f27b5f4181a4a6a5666803a7a44fd9c4b707f69e69d21fbd8f95669f12e139838a3a90c730788f645cc303aed1ed78689637ec61ea
 	b2sums = dadaf0e67b598aa7a7a4bf8644943a7ee8ebf4412abb17cd307f5989e36caf9d0db529a0e717a9df5d9537b10c4b13e814b955ada6f0d445913c812b63804e77
 

Comment

The change is a straightforward version bump in PKGBUILD from WebStorm 2026.1.4 to 2026.2, with the corresponding source checksum updated. The source remains the official JetBrains HTTPS download URL, there are no new build steps, scripts, patches, or privilege/persistence mechanisms introduced, and no integrity red flags beyond the normal need to trust the new upstream release artifact. Risk is low.

@@ -4,7 +4,7 @@
 
 pkgbase=webstorm
 pkgname=(webstorm webstorm-jre)
-pkgver=2026.1.4
+pkgver=2026.2
 pkgrel=1
 pkgdesc='JavaScript IDE and HTML editor'
 arch=('x86_64' 'i686')

Comment

The change only bumps WebStorm from 2026.1.4 to 2026.2 and updates the BLAKE2 checksum for the official JetBrains tarball. The source remains the same HTTPS download URL on the vendor site, with no new build steps, scripts, patches, or packaging logic introduced. I don’t see any integrity or execution red flags in this diff.

@@ -15,7 +15,7 @@ options=('!strip')
 source=("https://download.jetbrains.com/webstorm/WebStorm-${pkgver}.tar.gz"
         jetbrains-webstorm.desktop
         LICENSE)
-b2sums=('3e8e53aefd2c923e39b38c1677ec2d673397232677ba8df064c70dcae2eff0521cf57fb82586ccdcd6bebfd294c886fb29168913f66fbbc5ea78e9f36b19c859'
+b2sums=('da5c23dc891a2e5b6669e2b4b24efb4d1ba747078baa98d29bc652459d9b7be4125914f2d7758db34e94a2bae85a6767d8dc845a424837ca1ccb3a07eb39b119'
         'a7c2c63112c967b1a866c2f27b5f4181a4a6a5666803a7a44fd9c4b707f69e69d21fbd8f95669f12e139838a3a90c730788f645cc303aed1ed78689637ec61ea'
         'dadaf0e67b598aa7a7a4bf8644943a7ee8ebf4412abb17cd307f5989e36caf9d0db529a0e717a9df5d9537b10c4b13e814b955ada6f0d445913c812b63804e77')