Review Results

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Visual Studio Code binary package, updating the package version, source URLs, and checksums to the new upstream release. The sources remain HTTPS on the official Microsoft update domain, there are no added scripts, patches, install-time commands, or packaging behavior changes in this diff. No supply-chain red flags are introduced by this metadata-only update.

@@ -1,6 +1,6 @@
 pkgbase = visual-studio-code-bin
 	pkgdesc = Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)
-	pkgver = 1.129.1
+	pkgver = 1.130.0
 	pkgrel = 1
 	url = https://code.visualstudio.com/
 	install = visual-studio-code-bin.install

Comment

The change is a routine version bump in .SRCINFO from VS Code 1.129.1 to 1.130.0, with corresponding SHA256 updates for the official Microsoft update.code.visualstudio.com Debian artifacts. Sources remain HTTPS and pinned to a specific versioned release URL, and there are no new scripts, patches, or packaging logic changes in this diff. No security red flags are introduced by this metadata-only update.

@@ -31,11 +31,11 @@ pkgbase = visual-studio-code-bin
 	options = !strip
 	source = visual-studio-code-bin.sh
 	sha256sums = bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad
-	source_x86_64 = code_1.129.1_amd64.deb::https://update.code.visualstudio.com/1.129.1/linux-deb-x64/stable
-	sha256sums_x86_64 = 0cf912efe73db485839bda45cdcfe2ba35af3ad5876cc9786d9b04da2eb9ea51
-	source_aarch64 = code_1.129.1_arm64.deb::https://update.code.visualstudio.com/1.129.1/linux-deb-arm64/stable
-	sha256sums_aarch64 = bf47e2e18b6507619a4af1f506e5bc6ca28badc8322b62c37370310f949b51c7
-	source_armv7h = code_1.129.1_armhf.deb::https://update.code.visualstudio.com/1.129.1/linux-deb-armhf/stable
-	sha256sums_armv7h = 7621ddc83255ba955da35471edab212d1d26385d719489877180a8420ce4c5a2
+	source_x86_64 = code_1.130.0_amd64.deb::https://update.code.visualstudio.com/1.130.0/linux-deb-x64/stable
+	sha256sums_x86_64 = 63835d9a09ba93c88fb57d35fad0f4c28788221285c7120281ac53ff2deaf183
+	source_aarch64 = code_1.130.0_arm64.deb::https://update.code.visualstudio.com/1.130.0/linux-deb-arm64/stable
+	sha256sums_aarch64 = 4b67f4e83154dfb281ed5e8ed7be03d9ce3c489bb00c8653c5207d61744d864b
+	source_armv7h = code_1.130.0_armhf.deb::https://update.code.visualstudio.com/1.130.0/linux-deb-armhf/stable
+	sha256sums_armv7h = a67c839d7d33a5a0213068d71f281930ce7ec09e4ae8fb2089784841deba935d
 
 pkgname = visual-studio-code-bin

Comment

The change is a routine version bump for an official binary package, with updated per-architecture SHA256 checksums for the new upstream release. The source URLs remain HTTPS and point to the official Visual Studio Code update endpoint, and there are no new build steps, scripts, or packaging changes that introduce execution, persistence, or integrity risks. No suspicious behavior is present in the diff provided.

@@ -2,7 +2,7 @@
 
 pkgname=visual-studio-code-bin
 _pkgname=visual-studio-code
-pkgver=1.129.1
+pkgver=1.130.0
 pkgrel=1
 pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)"
 arch=('x86_64' 'aarch64' 'armv7h')

Comment

The change is a routine version bump for an official binary package, with only the per-architecture SHA256 checksums updated to match the new upstream release. The source URLs remain HTTPS and point to Microsoft's official update endpoint, and there are no new build-time commands, install scripts, patches, or privilege/persistence mechanisms introduced in this diff. No security red flags are evident in the reviewed hunk.

@@ -27,9 +27,9 @@ source_x86_64=(code_${pkgver}_amd64.deb::https://update.code.visualstudio.com/${
 source_aarch64=(code_${pkgver}_arm64.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-arm64/stable)
 source_armv7h=(code_${pkgver}_armhf.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-armhf/stable)
 sha256sums=('bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad')
-sha256sums_x86_64=('0cf912efe73db485839bda45cdcfe2ba35af3ad5876cc9786d9b04da2eb9ea51')
-sha256sums_aarch64=('bf47e2e18b6507619a4af1f506e5bc6ca28badc8322b62c37370310f949b51c7')
-sha256sums_armv7h=('7621ddc83255ba955da35471edab212d1d26385d719489877180a8420ce4c5a2')
+sha256sums_x86_64=('63835d9a09ba93c88fb57d35fad0f4c28788221285c7120281ac53ff2deaf183')
+sha256sums_aarch64=('4b67f4e83154dfb281ed5e8ed7be03d9ce3c489bb00c8653c5207d61744d864b')
+sha256sums_armv7h=('a67c839d7d33a5a0213068d71f281930ce7ec09e4ae8fb2089784841deba935d')
 
 package() {
   bsdtar -xf data.tar.xz -C "${pkgdir}/"