Review Results

Comment

The change only adds a runtime dependency on libglvnd in .SRCINFO. This is metadata-only and does not introduce executable code, network access, privilege changes, or packaging behavior changes by itself. The dependency is plausible for a graphics application like Aseprite and does not appear suspicious in isolation.

@@ -68,6 +68,7 @@ pkgname = aseprite
 	depends = libwebp
 	depends = libarchive
 	depends = fmt
+	depends = libglvnd
 	depends = expat
 	depends = harfbuzz
 	depends = libgl

Comment

The change only adds `libglvnd` to the runtime/package dependency list in PKGBUILD. This does not introduce any new build-time code execution, network access, privilege escalation, or packaging behavior changes. It is a normal dependency adjustment for a graphics-related application and does not affect source integrity or install scripts. No security concerns are evident from this diff hunk alone.

@@ -168,7 +168,7 @@ package() {
          # pixman is not linked to because we use Skia instead
          # harfbuzz is linked statically because Aseprite expects an older version
          cmark curl giflib libjpeg-turbo zlib libpng 'tinyxml2>=11.0.0' freetype2
-         libwebp libarchive fmt
+         libwebp libarchive fmt libglvnd
          # ~ Skia deps ~
          # (Skia links dynamically to HarfBuzz, only Aseprite itself doesn't. >_<)
          expat harfbuzz libgl