Review Results

Comment

The change only bumps unityhub from 3.19.1 to 3.19.5 in .SRCINFO and updates the corresponding upstream DEB URL and checksum. I did not see any new sources, build steps, install-script behavior, or packaging logic changes in the reviewed hunk. The package still fetches the official Unity-hosted release over HTTPS and the install script remains limited to cache refreshes. No security issue is evident from this metadata-only version bump.

@@ -1,6 +1,6 @@
 pkgbase = unityhub
 	pkgdesc = The Unity Hub is a standalone application that streamlines the way you find, download, and manage your Unity Projects and installations.
-	pkgver = 3.19.1
+	pkgver = 3.19.5
 	pkgrel = 1
 	url = https://unity.com/
 	install = unityhub.install

Comment

The change is a straightforward version bump in .SRCINFO from Unity Hub 3.19.1 to 3.19.5, updating the upstream HTTPS .deb URL and its sha256 checksum. No new sources, scripts, build steps, or privilege-related artifacts are introduced by this diff. Based on the provided hunk alone, this does not add an obvious security risk beyond the normal trust in the upstream binary package already present in the AUR package.

@@ -24,10 +24,10 @@ pkgbase = unityhub
 	optdepends = libappindicator-gtk3: The official deb says this an optional dependency
 	conflicts = unityhub-beta
 	options = !strip
-	source = unityhub-3.19.1.deb::https://hub.unity3d.com/linux/repos/deb/pool/main/u/unity/unityhub_amd64/UnityHubSetup-3.19.1-amd64.deb
+	source = unityhub-3.19.5.deb::https://hub.unity3d.com/linux/repos/deb/pool/main/u/unity/unityhub_amd64/UnityHubSetup-3.19.5-amd64.deb
 	source = license.txt
 	source = services-config.json
-	sha256sums = 3e85a3c87043b093eb19406e4c1db25dd2cfbb6831ac69faf1f969cbb7f10bb4
+	sha256sums = 5a5b57adc9ce20931c4154c57ffded08f3ffa2743286fdf14c9e7add6b212540
 	sha256sums = f0eb3a4bb148bb7f426e4f5b97e891265ac487710cbcba9282518537c7b5d833
 	sha256sums = 557964a3528219723750a7eabeb2e31a2d3e1b2c4a4b2e201b32d4035200562e
 

Comment

The change is a straightforward version bump in PKGBUILD from 3.19.1 to 3.19.5 with no accompanying changes to sources, build steps, install scripts, or package metadata. Based on the provided diff, there are no new security red flags such as added network fetches, script execution, privilege escalation, or integrity changes. Risk is low.

@@ -4,7 +4,7 @@
 # Contributor: Marius Glo <marius@mgl.dev>
 
 pkgname=unityhub
-pkgver=3.19.1
+pkgver=3.19.5
 pkgrel=1
 pkgdesc="The Unity Hub is a standalone application that streamlines the way you find, download, and manage your Unity Projects and installations."
 url="https://unity.com/"

Comment

The change is a straightforward version bump from Unity Hub 3.19.1 to 3.19.5 with the corresponding SHA-256 updated for the upstream .deb source. The source URL remains HTTPS and points to the vendor’s official download host, and there are no new build-time commands, scripts, or packaging changes that would introduce persistence, privilege escalation, or network fetches outside the declared source array. Based on the diff provided, this looks low risk.

@@ -20,7 +20,7 @@ source=(
   'services-config.json'
 )
 sha256sums=(
-  '3e85a3c87043b093eb19406e4c1db25dd2cfbb6831ac69faf1f969cbb7f10bb4'
+  '5a5b57adc9ce20931c4154c57ffded08f3ffa2743286fdf14c9e7add6b212540'
   'f0eb3a4bb148bb7f426e4f5b97e891265ac487710cbcba9282518537c7b5d833'
   '557964a3528219723750a7eabeb2e31a2d3e1b2c4a4b2e201b32d4035200562e'
 )