Review Results

Comment

The change only bumps the recorded pkgver in .SRCINFO from one upstream git snapshot to a newer one. No sources, checksums, install scripts, permissions, or build logic changed in the provided diff, and the URL remains the official upstream GitHub project. On this diff alone there are no security red flags.

@@ -1,6 +1,6 @@
 pkgbase = hyprland-git
 	pkgdesc = Hyprland is an independent, highly customizable, dynamic tiling Wayland compositor that doesn't sacrifice on its looks
-	pkgver = 0.55.2.r79.g515b883
+	pkgver = 0.56.0.r1.g5b260fa
 	pkgrel = 1
 	url = https://github.com/hyprwm/Hyprland
 	arch = x86_64

Comment

The change only adds a runtime dependency on sdbus-cpp in .SRCINFO. This is a metadata-only update with no evidence of new build steps, scripts, network access, privilege escalation, or packaging behavior changes. I don't see any security concern in this diff hunk itself.

@@ -46,6 +46,7 @@ pkgbase = hyprland-git
 	depends = pixman
 	depends = polkit
 	depends = re2
+	depends = sdbus-cpp
 	depends = seatd
 	depends = systemd-libs
 	depends = tomlplusplus

Comment

The change is limited to .SRCINFO metadata: it updates one optdepend from uwsm to rtkit and bumps the provided hyprland version from 0.55.2 to 0.56.0. This does not introduce code execution, network access, privilege escalation, or packaging-path changes. The only notable effect is dependency metadata drift, which could affect install-time recommendations but is not a security issue by itself.

@@ -66,8 +67,8 @@ pkgbase = hyprland-git
 	optdepends = glaze: to build and install plugins using hyprpm
 	optdepends = hyprqt6engine-git: the recommended way to manage qt styles
 	optdepends = meson: to build and install plugins using hyprpm
-	optdepends = uwsm: the recommended way to start Hyprland
-	provides = hyprland=0.55.2
+	optdepends = rtkit: real-time scheduling support
+	provides = hyprland=0.56.0
 	provides = wayland-compositor
 	conflicts = hyprland
 	backup = usr/share/xdg-desktop-portal/hyprland-portals.conf

Comment

The change only bumps the VCS-derived pkgver in PKGBUILD from 0.55.2.r79.g515b883 to 0.56.0.r1.g5b260fa. No source URLs, build commands, install scripts, permissions, or packaging logic changed, and there are no new integrity or execution red flags in the provided diff. This appears to be a routine version update with negligible security impact.

@@ -5,7 +5,7 @@
 
 _pkgname="hyprland"
 pkgname="$_pkgname-git"
-pkgver=0.55.2.r79.g515b883
+pkgver=0.56.0.r1.g5b260fa
 pkgrel=1
 pkgdesc="Hyprland is an independent, highly customizable, dynamic tiling Wayland compositor that doesn't sacrifice on its looks"
 arch=('x86_64' 'aarch64')

Comment

The change is low risk. It only adds a new runtime dependency (`sdbus-cpp`) and updates an optdepend from `uwsm` to `rtkit`, with no new build-time code execution, no network fetches, no privilege changes, and no packaging/install-script behavior. The dependency addition is plausible for Hyprland’s D-Bus integration and does not by itself introduce a supply-chain or persistence concern in this diff.

@@ -46,6 +46,7 @@ depends=(
   pixman
   polkit
   re2
+  sdbus-cpp
   seatd
   systemd-libs
   tomlplusplus

Comment

The change is low risk. It only updates package metadata: a new upstream snapshot version, adds a runtime dependency on sdbus-cpp, and swaps an optional dependency from uwsm to rtkit. There are no new build-time downloads, no shell execution, no install script changes, and no privilege/persistence mechanisms introduced in the reviewed hunk. The rtkit optdepend is a normal desktop audio/RT scheduling helper and does not itself imply elevated behavior in the package.

@@ -79,7 +80,7 @@ optdepends=(
   'glaze: to build and install plugins using hyprpm'
   'hyprqt6engine-git: the recommended way to manage qt styles'
   'meson: to build and install plugins using hyprpm'
-  'uwsm: the recommended way to start Hyprland'
+  'rtkit: real-time scheduling support'
 )
 
 conflicts=("$_pkgname")