Review Results

Comment

The change is a straightforward version bump in .SRCINFO for pandoc-bin, updating pkgver/pkgrel, provides, and the upstream GitHub release/archive URLs and checksums from 3.10 to 3.10.1. The sources remain HTTPS and point to the official upstream project, with no new build steps, scripts, or privilege-related changes introduced in this diff. I do not see any security-relevant red flags in the metadata update itself.

@@ -1,7 +1,7 @@
 pkgbase = pandoc-bin
 	pkgdesc = Conversion between documentation formats
-	pkgver = 3.10
-	pkgrel = 2
+	pkgver = 3.10.1
+	pkgrel = 1
 	url = https://pandoc.org
 	arch = x86_64
 	arch = aarch64

Comment

The change is a straightforward version bump in .SRCINFO for pandoc-bin: it updates the upstream source URLs and checksums from 3.10 to 3.10.1 and adjusts the provided package versions accordingly. The sources remain HTTPS GitHub release/archive URLs, there are no new build-time commands, no added scripts, and no integrity red flags in the diff itself. Based on the provided hunk, this appears low risk.

@@ -15,16 +15,16 @@ pkgbase = pandoc-bin
 	optdepends = texlive-fontsrecommended: for pdf output using latex or xelatex engines
 	optdepends = texlive-latex: for pdf output using pdflatex engine
 	optdepends = texlive-xetex: for pdf output using xelatex engine
-	provides = pandoc=3.10
-	provides = pandoc-cli=3.10
+	provides = pandoc=3.10.1
+	provides = pandoc-cli=3.10.1
 	conflicts = pandoc-cli
 	options = !debug
 	options = !strip
-	source = pandoc-bin-3.10.tar.gz::https://github.com/jgm/pandoc/archive/3.10.tar.gz
-	sha256sums = fc82815542c29802d087c25e2c1421146030806b71255ec40fc0e828fe1df877
-	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.10/pandoc-3.10-linux-amd64.tar.gz
-	sha256sums_x86_64 = e0f8af62d0f267d22baa5bcefe6d5dda3a097ccc60de794b759fe03159923244
-	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.10/pandoc-3.10-linux-arm64.tar.gz
-	sha256sums_aarch64 = 55413dfb0c1aec861641fe858f1f73e84848f3db497b1c0c02e62887ea76f4a4
+	source = pandoc-bin-3.10.1.tar.gz::https://github.com/jgm/pandoc/archive/3.10.1.tar.gz
+	sha256sums = faee98f42ed1592b2feb8da7fdfa87a23b679ca27ff883e06030f89c25c91ba9
+	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.10.1/pandoc-3.10.1-linux-amd64.tar.gz
+	sha256sums_x86_64 = 72948bf5784f560d5ad1876709daca27e0667f262da727bb33f77b58e52df2f5
+	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.10.1/pandoc-3.10.1-linux-arm64.tar.gz
+	sha256sums_aarch64 = cd3963da375793a4804c65ae538b4f7b9c23f87cac7f6c74a1cf5e2fff7e8d59
 
 pkgname = pandoc-bin

Comment

The change only bumps pkgver from 3.10 to 3.10.1 and resets pkgrel from 2 to 1 in PKGBUILD. No source URLs, build steps, install scripts, permissions, or dependency changes are shown in the provided diff hunk, so there is no evident security impact from this change alone. This appears to be a routine version update.

@@ -1,6 +1,6 @@
 pkgname=pandoc-bin
-pkgver=3.10
-pkgrel=2
+pkgver=3.10.1
+pkgrel=1
 pkgdesc="Conversion between documentation formats"
 url="https://pandoc.org"
 license=("GPL-2.0-or-later")

Comment

The change is a straightforward version bump from pandoc 3.10 to 3.10.1 with updated SHA-256 checksums for the upstream source tarball and prebuilt architecture-specific release archives. The source URLs remain HTTPS and point to the official upstream GitHub project/releases, with no new build-time network access, scripts, privilege escalation, or packaging changes. I don’t see any security-relevant red flags in this diff alone.

@@ -25,9 +25,9 @@ source=("$pkgname-$pkgver.tar.gz::https://github.com/jgm/pandoc/archive/${pkgver
 source_x86_64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-amd64.tar.gz")
 source_aarch64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-arm64.tar.gz")
 
-sha256sums=('fc82815542c29802d087c25e2c1421146030806b71255ec40fc0e828fe1df877')
-sha256sums_x86_64=('e0f8af62d0f267d22baa5bcefe6d5dda3a097ccc60de794b759fe03159923244')
-sha256sums_aarch64=('55413dfb0c1aec861641fe858f1f73e84848f3db497b1c0c02e62887ea76f4a4')
+sha256sums=('faee98f42ed1592b2feb8da7fdfa87a23b679ca27ff883e06030f89c25c91ba9')
+sha256sums_x86_64=('72948bf5784f560d5ad1876709daca27e0667f262da727bb33f77b58e52df2f5')
+sha256sums_aarch64=('cd3963da375793a4804c65ae538b4f7b9c23f87cac7f6c74a1cf5e2fff7e8d59')
 
 package() {
   cd "${srcdir}/pandoc-${pkgver}"