Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 3.0.3 to 4.0.0, with the source URL updated to the corresponding upstream GitHub release archive and a new SHA-256 checksum. There are no signs of added build-time code execution, new dependencies, install scripts, or other persistence/privilege mechanisms in this diff. Based on the provided hunk alone, this looks like a routine metadata update with low security risk.

@@ -1,7 +1,7 @@
 pkgbase = mpeghdec
 	pkgdesc = Fraunhofer MPEG-H audio decoder
-	pkgver = 3.0.3
-	pkgrel = 2
+	pkgver = 4.0.0
+	pkgrel = 1
 	url = https://mpegh.com/
 	arch = x86_64
 	license = LicenseRef-Custom

Comment

The change is a straightforward upstream version bump in .SRCINFO from r3.0.3 to r4.0.0, with the source still using HTTPS on the official Fraunhofer-IIS GitHub repository and the checksum updated accordingly. No new sources, scripts, build steps, or packaging directives are introduced in this diff, so there is no evidence of added supply-chain or persistence risk in the reviewed hunk.

@@ -10,7 +10,7 @@ pkgbase = mpeghdec
 	depends = glibc
 	depends = libgcc
 	depends = libstdc++
-	source = https://github.com/Fraunhofer-IIS/mpeghdec/archive/r3.0.3/mpeghdec-3.0.3.tar.gz
-	sha256sums = 0198ebc824332926c0c39abf216df65606da896a4204c93be77b1581b5bf0b73
+	source = https://github.com/Fraunhofer-IIS/mpeghdec/archive/r4.0.0/mpeghdec-4.0.0.tar.gz
+	sha256sums = 62733df4f7bcd38c19c4eccafa12e789dec0c38e052a3dec46039d86d49ee17c
 
 pkgname = mpeghdec

Comment

The change is low risk. It only bumps the package version from 3.0.3 to 4.0.0, updates the source tarball checksum, and changes a CMake warning flag from -Wno-dev to -Wno-author. The source remains an HTTPS GitHub release tarball from the upstream Fraunhofer-IIS repository, with no new build-time downloads, scripts, privilege changes, or packaging behavior changes visible in the diff. No obvious supply-chain or persistence concerns are introduced by this patch.

@@ -1,8 +1,8 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=mpeghdec
-pkgver=3.0.3
-pkgrel=2
+pkgver=4.0.0
+pkgrel=1
 pkgdesc='Fraunhofer MPEG-H audio decoder'
 arch=('x86_64')
 url='https://mpegh.com/'

Comment

The change is a straightforward version bump from 3.0.3 to 4.0.0 with an updated source checksum. The source remains an HTTPS tarball from the upstream GitHub release archive, and there are no new build-time downloads, scripts, privilege changes, install hooks, or packaging path changes. The only other modification is replacing a CMake warning flag (-Wno-dev -> -Wno-author), which does not affect security posture. No obvious supply-chain or persistence concerns are introduced by this diff.

@@ -15,7 +15,7 @@ makedepends=(
     'cmake'
     'git')
 source=("https://github.com/Fraunhofer-IIS/mpeghdec/archive/r${pkgver}/${pkgname}-${pkgver}.tar.gz")
-sha256sums=('0198ebc824332926c0c39abf216df65606da896a4204c93be77b1581b5bf0b73')
+sha256sums=('62733df4f7bcd38c19c4eccafa12e789dec0c38e052a3dec46039d86d49ee17c')
 
 build() {
     cmake -B build -S "mpeghdec-r${pkgver}" \

Comment

The change is limited to replacing a CMake configure flag from `-Wno-dev` to `-Wno-author`. This only affects suppression of CMake warnings during the build and does not introduce new sources, network access, privilege changes, install-time scripts, or packaging behavior. I see no security impact from this diff hunk alone.

@@ -24,7 +24,7 @@ build() {
         -DCMAKE_BUILD_TYPE:STRING='None' \
         -DCMAKE_INSTALL_PREFIX:PATH='/usr' \
         -DCMAKE_SKIP_RPATH:BOOL='YES' \
-        -Wno-dev
+        -Wno-author
     cmake --build build
 }