Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2026.1.4 to 2026.2. No sources, checksums, install scripts, build commands, or metadata affecting trust boundaries were changed in the reviewed diff. On its face this is a routine package update with no security red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = pycharm
 	pkgdesc = The only Python IDE you need. Bundled with the official JetBrains Runtime (JBR)
-	pkgver = 2026.1.4
+	pkgver = 2026.2
 	pkgrel = 1
 	url = https://www.jetbrains.com/pycharm/
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the JetBrains download URLs and corresponding SHA-256 checksums for x86_64 and aarch64. The sources remain HTTPS on the official JetBrains domain, there are no new build-time commands, scripts, or packaging changes, and no integrity red flags are introduced by this metadata-only update. Risk is low.

@@ -37,9 +37,9 @@ pkgbase = pycharm
 	source = ltedit.desktop
 	sha256sums = 444611514a2e2e168d20ec866af0102fbdd0472af00925847471609578b187b7
 	sha256sums = 944d01526dcc0e6d4c321873bd42d2c7885973e929f3b363c31019f642af0101
-	source_x86_64 = https://download-cf.jetbrains.com/python/pycharm-2026.1.4.tar.gz
-	sha256sums_x86_64 = 448b9f819860fe7f83d6e11d703c984634c37e1f0989ccb3e21d01d644db557b
-	source_aarch64 = https://download-cf.jetbrains.com/python/pycharm-2026.1.4-aarch64.tar.gz
-	sha256sums_aarch64 = ef515b629374b1e27993fc9903b6a85e05385bf3750618ed2a5ed6ec789cf541
+	source_x86_64 = https://download-cf.jetbrains.com/python/pycharm-2026.2.tar.gz
+	sha256sums_x86_64 = ac36f7c0743465215bf8227079b77272945338c485c1da6b924e56468046bd5a
+	source_aarch64 = https://download-cf.jetbrains.com/python/pycharm-2026.2-aarch64.tar.gz
+	sha256sums_aarch64 = 3b63d2f490c14c541c98afd851f218069a3c885ceaedd9bdb00e5a07285cf802
 
 pkgname = pycharm

Comment

The change is a simple version bump in PKGBUILD from 2026.1.4 to 2026.2 with no accompanying changes to sources, build logic, install scripts, permissions, or dependencies. On its face this does not introduce any new security risk in the reviewed hunk. I did not see evidence here of network fetches, privilege escalation, persistence, or integrity regressions.

@@ -5,7 +5,7 @@
 # Contributor: Juan Francisco Miranda <aurarchlinux.sleek355 at passfwd dot com>
 
 pkgname=pycharm
-pkgver=2026.1.4
+pkgver=2026.2
 pkgrel=1
 provides=("pycharm")
 replaces=("pycharm-professional")

Comment

The change only updates the SHA-256 checksums for the existing JetBrains HTTPS release tarballs on x86_64 and aarch64. No build logic, install scripts, dependencies, or source URLs changed, and there are no new execution or persistence paths introduced. This looks like a routine upstream release checksum refresh with low security risk.

@@ -33,8 +33,8 @@ source_x86_64=("https://download-cf.jetbrains.com/python/${pkgname}-${pkgver}.ta
 source_aarch64=("https://download-cf.jetbrains.com/python/${pkgname}-${pkgver}-aarch64.tar.gz")
 sha256sums=('444611514a2e2e168d20ec866af0102fbdd0472af00925847471609578b187b7'
             '944d01526dcc0e6d4c321873bd42d2c7885973e929f3b363c31019f642af0101')
-sha256sums_x86_64=('448b9f819860fe7f83d6e11d703c984634c37e1f0989ccb3e21d01d644db557b')
-sha256sums_aarch64=('ef515b629374b1e27993fc9903b6a85e05385bf3750618ed2a5ed6ec789cf541')
+sha256sums_x86_64=('ac36f7c0743465215bf8227079b77272945338c485c1da6b924e56468046bd5a')
+sha256sums_aarch64=('3b63d2f490c14c541c98afd851f218069a3c885ceaedd9bdb00e5a07285cf802')
 makedepends=('python-setuptools' 'cython')
 optdepends=(
     'ipython: For enhanced interactive Python shell inside Pycharm'