Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 105 to 106 for the existing package metadata. No sources, checksums, build steps, install scripts, permissions, or dependency metadata are changed here, so there is no evident security impact from this diff alone.

@@ -1,6 +1,6 @@
 pkgbase = gnome-shell-extension-dash-to-dock
 	pkgdesc = Move the dash out of the overview transforming it in a dock
-	pkgver = 105
+	pkgver = 106
 	pkgrel = 1
 	epoch = 1
 	url = https://micheleg.github.io/dash-to-dock/

Comment

The change only updates the pinned upstream git commit in .SRCINFO for the existing HTTPS GitHub source. There are no new sources, no build-script changes, no added install scripts or packaging logic, and no signs of network access or privilege escalation introduced by this diff. This is a routine version pin update with low security risk.

@@ -10,7 +10,7 @@ pkgbase = gnome-shell-extension-dash-to-dock
 	makedepends = git
 	makedepends = sassc
 	depends = gnome-shell
-	source = git+https://github.com/micheleg/dash-to-dock.git#commit=b1478f10a3fca9eaa5dc9d2f9907c20427e269f6
+	source = git+https://github.com/micheleg/dash-to-dock.git#commit=a7b19816b7277e41c18ea5c3ff165e493a14e0d4
 	sha256sums = SKIP
 
 pkgname = gnome-shell-extension-dash-to-dock

Comment

Low risk change. The PKGBUILD only bumps pkgver and updates the pinned upstream git commit in a source URL that still uses HTTPS and remains commit-pinned. No new sources, scripts, install hooks, privilege changes, or packaging logic were introduced. The change is consistent with a routine upstream version update, so I see no security concern in this diff alone.

@@ -6,7 +6,7 @@
 
 pkgname=gnome-shell-extension-dash-to-dock
 _pkgname=dash-to-dock
-pkgver=105
+pkgver=106
 pkgrel=1
 epoch=1
 pkgdesc="Move the dash out of the overview transforming it in a dock"

Comment

The change only bumps the pinned upstream git commit and package version for a VCS-based source. The source remains HTTPS and still pins to an explicit commit hash, with no new build steps, scripts, patches, or packaging logic introduced. I did not find any added integrity, execution, or persistence concerns in this diff.

@@ -15,7 +15,7 @@ url="https://micheleg.github.io/dash-to-dock/"
 license=('GPL-2.0-or-later')
 depends=('gnome-shell')
 makedepends=('gettext' 'git' 'sassc')
-_commit=b1478f10a3fca9eaa5dc9d2f9907c20427e269f6
+_commit=a7b19816b7277e41c18ea5c3ff165e493a14e0d4
 source=("git+https://github.com/micheleg/dash-to-dock.git#commit=$_commit")
 sha256sums=('SKIP')