Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 4.13.0-3 to 4.14.0-1. No source URLs, checksums, build steps, dependencies, install scripts, or permissions are changed here, so there is no direct security signal in the diff itself. Based on this hunk alone, the change appears low risk.

@@ -1,7 +1,7 @@
 pkgbase = opencv4
 	pkgdesc = Open Source Computer Vision Library (version 4.x)
-	pkgver = 4.13.0
-	pkgrel = 3
+	pkgver = 4.14.0
+	pkgrel = 1
 	url = https://github.com/opencv/opencv
 	arch = x86_64
 	license = Apache-2.0

Comment

The change only bumps the upstream OpenCV source tarballs in .SRCINFO from 4.13.0 to 4.14.0 and updates the corresponding SHA256 checksums. The sources remain official GitHub release archives over HTTPS, with no new URLs, no added build-time execution, and no packaging-script changes visible in this diff. Based on the provided hunk alone, this is a routine version update with no evident security red flags.

@@ -55,16 +55,16 @@ pkgbase = opencv4
 	optdepends = qt6-base: for the HighGUI module
 	optdepends = vtk: for the viz module
 	options = !lto
-	source = opencv-4.13.0.tar.gz::https://github.com/opencv/opencv/archive/refs/tags/4.13.0.tar.gz
-	source = opencv_contrib-4.13.0.tar.gz::https://github.com/opencv/opencv_contrib/archive/refs/tags/4.13.0.tar.gz
+	source = opencv-4.14.0.tar.gz::https://github.com/opencv/opencv/archive/refs/tags/4.14.0.tar.gz
+	source = opencv_contrib-4.14.0.tar.gz::https://github.com/opencv/opencv_contrib/archive/refs/tags/4.14.0.tar.gz
 	source = vtk9.patch
 	source = fix-cuda-flags.patch
 	source = fix-cudacodec-dependencies.patch
 	source = fix-cccl-namespace.patch
 	source = fix-std.patch
 	source = fix-thrust-tuple.patch
-	sha256sums = 1d40ca017ea51c533cf9fd5cbde5b5fe7ae248291ddf2af99d4c17cf8e13017d
-	sha256sums = 1e0077a4fd2960a7d2f4c9e49d6ba7bb891cac2d1be36d7e8e47aa97a9d1039b
+	sha256sums = ee8fb9b30eb60850431b4656447080e3737b56e45719c92b67f245950609f86e
+	sha256sums = 4f17abd1bc7f88e19c3380c8de7cbf2d863aced5b5ee8d8934cc7902b67d42c9
 	sha256sums = f35a2d4ea0d6212c7798659e59eda2cb0b5bc858360f7ce9c696c77d3029668e
 	sha256sums = 95472ecfc2693c606f0dd50be2f012b4d683b7b0a313f51484da4537ab8b2bfe
 	sha256sums = fbb10b75ca7849f85ea2f118aa017f00e34445d80ed76619f13ae1e4e9504ae4

Comment

The change only bumps pkgver from 4.13.0 to 4.14.0 and resets pkgrel from 3 to 1. No build logic, sources, checksums, install scripts, or packaging behavior changed in the provided hunk. On its face this is a routine version update with no security-relevant red flags in the diff itself.

@@ -2,8 +2,8 @@
 
 _pkgname="opencv4"
 pkgname="$_pkgname"
-pkgver=4.13.0
-pkgrel=3
+pkgver="4.14.0"
+pkgrel=1
 pkgdesc="Open Source Computer Vision Library (version 4.x)"
 url="https://github.com/opencv/opencv"
 license=('Apache-2.0')

Comment

The change is a routine version bump from 4.13.0-3 to 4.14.0-1 with updated source checksums. I do not see any new sources, build-time network access, privilege escalation, install scripts, or packaging logic changes. The diff is limited to checksum refreshes and the package version/release fields, so there is no evident security impact in this hunk.

@@ -78,16 +78,14 @@ source=(
   fix-std.patch
   fix-thrust-tuple.patch
 )
-sha256sums=(
-  '1d40ca017ea51c533cf9fd5cbde5b5fe7ae248291ddf2af99d4c17cf8e13017d'
-  '1e0077a4fd2960a7d2f4c9e49d6ba7bb891cac2d1be36d7e8e47aa97a9d1039b'
-  'f35a2d4ea0d6212c7798659e59eda2cb0b5bc858360f7ce9c696c77d3029668e'
-  '95472ecfc2693c606f0dd50be2f012b4d683b7b0a313f51484da4537ab8b2bfe'
-  'fbb10b75ca7849f85ea2f118aa017f00e34445d80ed76619f13ae1e4e9504ae4'
-  'b757be8df583cb3fa0059e47594eeb680638c572d3ae02bc1a5f7636e71ce5be'
-  'c05fe7572ee5193cf3de7f02a500f446f3457ec20c315590a326bf1bfb5552cc'
-  '6379b0f23ba4068d2daa43ec158e515f58ef36242138eb10f752a93dc1cec375'
-)
+sha256sums=('ee8fb9b30eb60850431b4656447080e3737b56e45719c92b67f245950609f86e'
+            '4f17abd1bc7f88e19c3380c8de7cbf2d863aced5b5ee8d8934cc7902b67d42c9'
+            'f35a2d4ea0d6212c7798659e59eda2cb0b5bc858360f7ce9c696c77d3029668e'
+            '95472ecfc2693c606f0dd50be2f012b4d683b7b0a313f51484da4537ab8b2bfe'
+            'fbb10b75ca7849f85ea2f118aa017f00e34445d80ed76619f13ae1e4e9504ae4'
+            'b757be8df583cb3fa0059e47594eeb680638c572d3ae02bc1a5f7636e71ce5be'
+            'c05fe7572ee5193cf3de7f02a500f446f3457ec20c315590a326bf1bfb5552cc'
+            '6379b0f23ba4068d2daa43ec158e515f58ef36242138eb10f752a93dc1cec375')
 
 # https://gitlab.archlinux.org/archlinux/packaging/packages/kdenlive/-/issues/8
 options=('!lto')