Review Results

Comment

The change is a straightforward version bump in .SRCINFO, updating the recorded upstream tarball URLs and SHA-256 checksums for postman-bin from 12.19.0 to 12.20.0. There are no new scripts, install hooks, privilege changes, or build-time network behaviors introduced by this diff. The package still fetches the official Postman CDN over HTTPS and remains pinned by checksum. Low risk.

@@ -1,6 +1,6 @@
 pkgbase = postman-bin
 	pkgdesc = Build, test, and document your APIs faster
-	pkgver = 12.19.0
+	pkgver = 12.20.0
 	pkgrel = 1
 	url = https://www.getpostman.com
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Postman binaries, updating the x86_64 and aarch64 download URLs and their SHA256 checksums. The sources remain HTTPS on the official Postman download domain, and there are no new build steps, scripts, or privilege-related changes. No security red flags are apparent in this diff alone.

@@ -38,9 +38,9 @@ pkgbase = postman-bin
 	options = !strip
 	source = postman.desktop
 	sha256sums = d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d
-	source_x86_64 = postman-12.19.0-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.19.0/linux64
-	sha256sums_x86_64 = 18367a5946c1f560f64c805771bf8b3ceaffaccc58bfa3ab7bce2c3faad62d1f
-	source_aarch64 = postman-12.19.0-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.19.0/linux_arm64
-	sha256sums_aarch64 = a707b1a59c16af32054a926771c26c8d8237003c7cb9660cb73763a36f95438c
+	source_x86_64 = postman-12.20.0-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.20.0/linux64
+	sha256sums_x86_64 = 5d9e19d745a01824f0e81ecc639b142ba079dcf8ace701f20bb73dd000147331
+	source_aarch64 = postman-12.20.0-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.20.0/linux_arm64
+	sha256sums_aarch64 = 34db7a77474837778fb20d8ad787ec06323e4d22027907185db3a4f35845cf40
 
 pkgname = postman-bin

Comment

This change is a routine version bump for a binary package: pkgver advances from 12.19.0 to 12.20.0 and the corresponding upstream tarball checksums are updated. The source URLs remain HTTPS and point to the official Postman download host, with no new build-time code execution, install-script changes, privilege escalation, or packaging-policy red flags introduced by this diff. Risk is low because the package still ships a prebuilt upstream binary, but that is unchanged from before and the update is integrity-pinned by SHA256.

@@ -4,7 +4,7 @@
 # Contributor: Juan Francisco Miranda <jfmiranda at gmail dot com>
 
 pkgname=postman-bin
-pkgver=12.19.0
+pkgver=12.20.0
 pkgrel=1
 pkgdesc="Build, test, and document your APIs faster"
 provides=('postman')

Comment

The change is limited to bumping postman-bin from 12.19.0 to 12.20.0 and updating the x86_64/aarch64 SHA-256 checksums for the upstream release tarballs. The download URLs remain HTTPS and still point to the official Postman distribution host, with no new build-time network access, scripts, or packaging logic changes. I don’t see any added persistence, privilege escalation, or integrity red flags in this diff alone.

@@ -20,8 +20,8 @@ source_x86_64=("postman-${pkgver}-linux-${arch[0]}.tar.gz::https://dl.pstmn.io/d
 source_aarch64=("postman-${pkgver}-linux-${arch[1]}.tar.gz::https://dl.pstmn.io/download/version/${pkgver}/linux_arm64")
 
 sha256sums=('d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d')
-sha256sums_x86_64=('18367a5946c1f560f64c805771bf8b3ceaffaccc58bfa3ab7bce2c3faad62d1f')
-sha256sums_aarch64=('a707b1a59c16af32054a926771c26c8d8237003c7cb9660cb73763a36f95438c')
+sha256sums_x86_64=('5d9e19d745a01824f0e81ecc639b142ba079dcf8ace701f20bb73dd000147331')
+sha256sums_aarch64=('34db7a77474837778fb20d8ad787ec06323e4d22027907185db3a4f35845cf40')
 
 package() {
   install -dm755 "${pkgdir}/opt/"