Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.7.7 to 26.7.8. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the provided diff. Based on this hunk alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.7.7
+	pkgver = 26.7.8
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from qownnotes 26.7.7 to 26.7.8, with the source URL updated to the corresponding GitHub release tarball. No new sources, scripts, build steps, permissions, or packaging metadata were introduced in this diff. Based on the provided hunk alone, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.7/qownnotes-26.7.7.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.8/qownnotes-26.7.8.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a straightforward version bump in PKGBUILD: pkgver advances from 26.7.7 to 26.7.8 and the pinned upstream git tag/commit is updated accordingly. No new sources, build steps, install scripts, permissions changes, or network-fetching logic were introduced in the provided diff. Based on the diff alone, this does not add any security risk beyond the normal trust in the upstream source pinning already present.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.7.7
-tag="1ca3e43b4d21ad465784cbf9e8761070619019a0"
+pkgver=26.7.8
+tag="d3eced16eee20ec2bd906224620b9b2f2ceb99a2"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change is a routine version bump in PKGBUILD: it updates pkgver/tag and the source tarball checksum to match the new upstream release. The source remains an HTTPS GitHub release asset, there are no new build-time downloads, no added scripts, and no packaging or privilege changes. I did not find any security-relevant red flags in the diff provided.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('de6fc912b0435d0782bb54a12133c9b5991ffdcd0f2ff46b289b2157f097625b')
+sha256sums=('59840821cd896c9079fccddc89faf2f3e81d327a7c4baa2d014d4b70152bd1a2')
 
 prepare() {
     cd "${pkgname}-${pkgver}"