Review Results

Comment

The change only bumps pkgver in .SRCINFO from 4.50.143 to 4.51.180. No sources, checksums, build steps, install scripts, or packaging metadata beyond the version string are altered in the provided diff. On its face this is a routine version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = slack-desktop
 	pkgdesc = Slack Desktop (Beta) for Linux
-	pkgver = 4.50.143
+	pkgver = 4.51.180
 	pkgrel = 1
 	url = https://slack.com/downloads
 	arch = x86_64

Comment

The change is a routine version bump in .SRCINFO: it updates pkgver, the Slack .deb source URL, noextract filename, and the corresponding b2sum. The source remains HTTPS on the official Slack download domain, and there are no new build-time commands, install scripts, permissions changes, or other persistence/privilege red flags in this diff. Risk is low because the package still depends on an external prebuilt .deb, but that was already the case and this change does not introduce additional suspicious behavior.

@@ -12,11 +12,11 @@ pkgbase = slack-desktop
 	depends = xdg-utils
 	optdepends = libappindicator-gtk3: Systray indicator support
 	optdepends = org.freedesktop.secrets: Keyring password store support
-	noextract = slack-desktop-4.50.143-amd64.deb
+	noextract = slack-desktop-4.51.180-amd64.deb
 	options = !debug
-	source = https://downloads.slack-edge.com/desktop-releases/linux/x64/4.50.143/slack-desktop-4.50.143-amd64.deb
+	source = https://downloads.slack-edge.com/desktop-releases/linux/x64/4.51.180/slack-desktop-4.51.180-amd64.deb
 	source = slack-desktop.patch
-	b2sums = f0a2f2bf06fe26e2e9da00997c6bcb462897e8ca6420ae23837e565ed9f8d343561b81a90912de556cc0135984da15b62891bd28753106ea0d378979ddbc9178
+	b2sums = 2393045a2f0171e283f16c66cc5c9e13acbc6b40d0a0b39305f04ee28232c85847a985aa762a9063adf5d85241b2d480af5c5f0fcda1bc9b2789d292578eb92d
 	b2sums = 103447636acd7ac2789d7d89008483a2077d862a51a64427a66c51e64dc9eac588de187f13df2778ccb7b24110a36c259b33c0074ff69c9bab3f89283a1efaf1
 
 pkgname = slack-desktop

Comment

The change is a simple version bump in PKGBUILD from 4.50.143 to 4.51.180 with no accompanying changes to sources, checksums, install scripts, or build logic in the provided diff hunk. On its face this does not introduce any new security risk; it is a routine package version update. I did not see evidence in the reviewed hunk of network fetches, privilege escalation, persistence mechanisms, or integrity regressions.

@@ -3,7 +3,7 @@
 # Contributor: Kyle Manna <kyle(at)kylemanna(dot)com>
 
 pkgname=slack-desktop
-pkgver=4.50.143
+pkgver=4.51.180
 pkgrel=1
 pkgdesc="Slack Desktop (Beta) for Linux"
 arch=('x86_64')

Comment

The change is a routine version bump for a prebuilt Slack .deb fetched over HTTPS from the official Slack download host, with the corresponding BLAKE2 checksum updated. No new sources, build-time network access, install scripts, or packaging logic changes are introduced in this diff. The only security-relevant question is whether the new upstream binary is trustworthy, but that is inherent to this package and not a regression in the reviewed change.

@@ -16,7 +16,7 @@ options=('!debug')
 source=("https://downloads.slack-edge.com/desktop-releases/linux/x64/${pkgver}/${pkgname}-${pkgver}-amd64.deb"
         "${pkgname}.patch")
 noextract=("${pkgname}-${pkgver}-amd64.deb")
-b2sums=('f0a2f2bf06fe26e2e9da00997c6bcb462897e8ca6420ae23837e565ed9f8d343561b81a90912de556cc0135984da15b62891bd28753106ea0d378979ddbc9178'
+b2sums=('2393045a2f0171e283f16c66cc5c9e13acbc6b40d0a0b39305f04ee28232c85847a985aa762a9063adf5d85241b2d480af5c5f0fcda1bc9b2789d292578eb92d'
         '103447636acd7ac2789d7d89008483a2077d862a51a64427a66c51e64dc9eac588de187f13df2778ccb7b24110a36c259b33c0074ff69c9bab3f89283a1efaf1')
 
 package() {