Review Results

Comment

The change only bumps pkgver in .SRCINFO from 2026.2 to 2026.2.0.1. This is metadata-only and does not introduce new sources, build steps, install scripts, permissions changes, or other executable content. No security-relevant behavior is affected by this diff hunk alone.

@@ -1,6 +1,6 @@
 pkgbase = intellij-idea-ultimate-edition
 	pkgdesc = An intelligent IDE for Java, Groovy and other programming languages with advanced refactoring features intensely focused on developer productivity.
-	pkgver = 2026.2
+	pkgver = 2026.2.0.1
 	pkgrel = 1
 	url = https://www.jetbrains.com/idea/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO, updating the JetBrains IDE tarball URLs and checksums for x86_64/aarch64 plus the package version. The sources remain HTTPS and point to the expected upstream JetBrains download locations; there are no new scripts, build-time downloads, privilege changes, or packaging behavior changes visible in this diff. The only notable issue is that the aarch64 fsnotifier source still references GitHub raw/master, which is pre-existing and not introduced here. Overall this looks like a routine upstream update with low security risk.

@@ -11,12 +11,12 @@ pkgbase = intellij-idea-ultimate-edition
 	options = !strip
 	source = jetbrains-idea.desktop
 	sha256sums = 83af2ba8f9f14275a6684e79d6d4bd9b48cd852c047dacfc81324588fa2ff92b
-	source_x86_64 = https://download.jetbrains.com/idea/ideaIU-2026.2.tar.gz
-	sha256sums_x86_64 = a8055cadef1a6eed4558f8bc9bd591c3a4939f4c8c34560fdf58ab4d2a5c783d
-	source_aarch64 = https://download.jetbrains.com/idea/ideaIU-2026.2-aarch64.tar.gz
+	source_x86_64 = https://download.jetbrains.com/idea/ideaIU-2026.2.0.1.tar.gz
+	sha256sums_x86_64 = 914e31e31b4e1285d538cf3fae5b300af08bcff36bc298ac6200504bbe12f180
+	source_aarch64 = https://download.jetbrains.com/idea/ideaIU-2026.2.0.1-aarch64.tar.gz
 	source_aarch64 = https://cache-redirector.jetbrains.com/intellij-jbr/jbr-25.0.3-linux-aarch64-b508.16.tar.gz
-	source_aarch64 = fsnotifier-2026.2::https://github.com/JetBrains/intellij-community/raw/master/bin/linux/aarch64/fsnotifier
-	sha256sums_aarch64 = 41ca911b590f9c1982802bae1a6b5c90cc479e65885f54172824a85f227bc76e
+	source_aarch64 = fsnotifier-2026.2.0.1::https://github.com/JetBrains/intellij-community/raw/master/bin/linux/aarch64/fsnotifier
+	sha256sums_aarch64 = 1e446106ad6f8758918ec8665fe0fd713d62491664fcd133e98913c1684a9748
 	sha256sums_aarch64 = 8704ffff0723bbe00992a02e455cda6a76697b40f9a5b833fc853e3c3b05dd14
 	sha256sums_aarch64 = aa812c5acac06435217b9018aa3e187a3546ea8d3cf136481a2d50aee4b9b23a
 

Comment

The change is a straightforward version bump from 2026.2 to 2026.2.0.1 with corresponding checksum updates for the upstream JetBrains tarballs. The source URLs remain HTTPS and point to official JetBrains/GitHub locations, and there are no new build-time commands, scripts, privilege changes, or packaging logic introduced. I do not see any supply-chain or persistence red flags in this diff.

@@ -3,7 +3,7 @@
 
 
 pkgname=intellij-idea-ultimate-edition
-pkgver=2026.2
+pkgver=2026.2.0.1
 pkgrel=1
 jbr_ver=25.0.3
 jbr_build=aarch64-b508

Comment

The change only updates pkgver and the corresponding SHA-256 checksums for the upstream JetBrains tarballs. The source URLs remain HTTPS and point to the official JetBrains download/cache endpoints, with no new build-time downloads, scripts, privilege changes, or packaging logic introduced. This looks like a routine upstream version bump with integrity hashes refreshed, and I do not see any security-relevant regression in the diff provided.

@@ -21,8 +21,8 @@ source_aarch64=("https://download.jetbrains.com/idea/ideaIU-$pkgver-aarch64.tar.
                 "https://cache-redirector.jetbrains.com/intellij-jbr/jbr-$jbr_ver-linux-$jbr_build.$jbr_minor.tar.gz"
                  "fsnotifier-${pkgver}::https://github.com/JetBrains/intellij-community/raw/master/bin/linux/aarch64/fsnotifier")
 sha256sums=('83af2ba8f9f14275a6684e79d6d4bd9b48cd852c047dacfc81324588fa2ff92b')
-sha256sums_x86_64=('a8055cadef1a6eed4558f8bc9bd591c3a4939f4c8c34560fdf58ab4d2a5c783d')
-sha256sums_aarch64=('41ca911b590f9c1982802bae1a6b5c90cc479e65885f54172824a85f227bc76e'
+sha256sums_x86_64=('914e31e31b4e1285d538cf3fae5b300af08bcff36bc298ac6200504bbe12f180')
+sha256sums_aarch64=('1e446106ad6f8758918ec8665fe0fd713d62491664fcd133e98913c1684a9748'
                     '8704ffff0723bbe00992a02e455cda6a76697b40f9a5b833fc853e3c3b05dd14'
                     'aa812c5acac06435217b9018aa3e187a3546ea8d3cf136481a2d50aee4b9b23a')