Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.7.9 to 26.7.10. No sources, checksums, build steps, install scripts, or package metadata affecting trust boundaries were changed in the provided diff. Based on this hunk alone, there are no security concerns to flag.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.7.9
+	pkgver = 26.7.10
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from QOwnNotes 26.7.9 to 26.7.10, with the source URL still using HTTPS and pointing to the official upstream GitHub release asset. No new build steps, scripts, dependencies, or integrity red flags are introduced in this diff. Based on the provided hunk alone, this looks low risk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.9/qownnotes-26.7.9.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.10/qownnotes-26.7.10.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a straightforward version bump in PKGBUILD, updating pkgver and the pinned upstream git tag. No build logic, install scripts, dependencies, permissions, or network behavior changed in the reviewed hunk. Based on the provided diff alone, there are no security red flags.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.7.9
-tag="b114fd519a6520d49394f1ebc87190b4c76abeaf"
+pkgver=26.7.10
+tag="b7f66153f1f44b3bfb6bb310c762c97ac4e03646"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change is a routine upstream version bump for a release tarball on the official GitHub releases URL, with the checksum updated accordingly. No new build steps, scripts, network fetches, privilege changes, or packaging behavior changes were introduced. The only security-relevant consideration is trust in the new upstream release artifact, which is normal for a version update and not inherently suspicious from the PKGBUILD diff alone.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('28e50a336623ea24d06c2917b1f88106cf253fc83267ca31c199e26ae4b8e337')
+sha256sums=('7c6836a5fa18b5a02415c02835548e4b130f8921963c31697ab6c4e0691583cc')
 
 prepare() {
     cd "${pkgname}-${pkgver}"