Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 4.0.0 to 4.0.1 with no accompanying changes to sources, build logic, install scripts, or package metadata beyond pkgver. On its face this does not introduce any new attack surface or integrity concern. I did not see evidence in the provided diff of suspicious sources, build-time downloads, privilege escalation, or packaging changes.

@@ -1,6 +1,6 @@
 pkgbase = mpeghdec
 	pkgdesc = Fraunhofer MPEG-H audio decoder
-	pkgver = 4.0.0
+	pkgver = 4.0.1
 	pkgrel = 1
 	url = https://mpegh.com/
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO from r4.0.0 to r4.0.1, with the source still using HTTPS on the official Fraunhofer-IIS GitHub repository and the checksum updated accordingly. No new sources, scripts, build steps, or packaging behavior are introduced in this diff, so there are no obvious security red flags in the reviewed change itself.

@@ -10,7 +10,7 @@ pkgbase = mpeghdec
 	depends = glibc
 	depends = libgcc
 	depends = libstdc++
-	source = https://github.com/Fraunhofer-IIS/mpeghdec/archive/r4.0.0/mpeghdec-4.0.0.tar.gz
-	sha256sums = 62733df4f7bcd38c19c4eccafa12e789dec0c38e052a3dec46039d86d49ee17c
+	source = https://github.com/Fraunhofer-IIS/mpeghdec/archive/r4.0.1/mpeghdec-4.0.1.tar.gz
+	sha256sums = e7842b46c8054367eea0537922b61180be7e7dc9747d872071854b08139c6016
 
 pkgname = mpeghdec

Comment

The change is a routine upstream version bump from 4.0.0 to 4.0.1 with the corresponding source tarball checksum updated. The source remains an HTTPS GitHub release archive from the expected upstream project, and there are no new build steps, scripts, dependencies, or packaging behaviors introduced in this diff. No security-relevant red flags are visible in the provided hunk.

@@ -1,7 +1,7 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=mpeghdec
-pkgver=4.0.0
+pkgver=4.0.1
 pkgrel=1
 pkgdesc='Fraunhofer MPEG-H audio decoder'
 arch=('x86_64')

Comment

The change is a straightforward version bump from 4.0.0 to 4.0.1 with a corresponding SHA-256 checksum update for the upstream GitHub release tarball. The source remains an HTTPS URL on the official upstream repository, there are no new build-time downloads, no added scripts, and no packaging/install logic changes. I do not see any integrity or execution red flags in this diff.

@@ -15,7 +15,7 @@ makedepends=(
     'cmake'
     'git')
 source=("https://github.com/Fraunhofer-IIS/mpeghdec/archive/r${pkgver}/${pkgname}-${pkgver}.tar.gz")
-sha256sums=('62733df4f7bcd38c19c4eccafa12e789dec0c38e052a3dec46039d86d49ee17c')
+sha256sums=('e7842b46c8054367eea0537922b61180be7e7dc9747d872071854b08139c6016')
 
 build() {
     cmake -B build -S "mpeghdec-r${pkgver}" \