Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.7.8 to 26.7.9. No sources, checksums, build steps, dependencies, install scripts, or permissions are changed here, so there is no new security-relevant behavior introduced by this diff alone. Risk is therefore minimal.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.7.8
+	pkgver = 26.7.9
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball from v26.7.8 to v26.7.9. The source remains an HTTPS GitHub release asset from the same upstream project, with no new build steps, scripts, dependencies, or packaging behavior introduced by this diff. Based on the provided hunk alone, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.8/qownnotes-26.7.8.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.9/qownnotes-26.7.9.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump in PKGBUILD: it updates pkgver, the pinned upstream git tag, and the source tarball checksum to match the new release. The source remains an HTTPS GitHub release asset, there are no new build steps, no added scripts, and no packaging/persistence red flags in the diff. Risk is low because the review scope only changes release metadata and integrity pinning, not executable logic.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.7.8
-tag="d3eced16eee20ec2bd906224620b9b2f2ceb99a2"
+pkgver=26.7.9
+tag="b114fd519a6520d49394f1ebc87190b4c76abeaf"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change is a routine upstream version bump in PKGBUILD: pkgver/tag and the release tarball checksum were updated to match the new QOwnNotes release. The source remains an HTTPS GitHub release asset, there are no new build-time downloads, no added scripts, and no packaging/persistence changes. I don’t see any integrity or privilege-escalation concerns in this diff alone.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('59840821cd896c9079fccddc89faf2f3e81d327a7c4baa2d014d4b70152bd1a2')
+sha256sums=('28e50a336623ea24d06c2917b1f88106cf253fc83267ca31c199e26ae4b8e337')
 
 prepare() {
     cd "${pkgname}-${pkgver}"