Review Results

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Postman binaries, with source URLs still using HTTPS on the official Postman download domain and updated checksums for both architectures. No new sources, scripts, install hooks, or packaging behavior are introduced in this diff. Based on the provided hunk alone, this looks low risk.

@@ -1,6 +1,6 @@
 pkgbase = postman-bin
 	pkgdesc = Build, test, and document your APIs faster
-	pkgver = 12.21.1
+	pkgver = 12.21.2
 	pkgrel = 1
 	url = https://www.getpostman.com
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Postman binary package, updating the x86_64 and aarch64 download URLs and their checksums from 12.21.1 to 12.21.2. The sources remain HTTPS on the official Postman download domain, and there are no new build-time commands, install-script changes, or suspicious extra artifacts in this diff. Based on the provided hunk alone, this does not introduce an obvious security regression.

@@ -38,9 +38,9 @@ pkgbase = postman-bin
 	options = !strip
 	source = postman.desktop
 	sha256sums = d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d
-	source_x86_64 = postman-12.21.1-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.21.1/linux64
-	sha256sums_x86_64 = 38a1b7abb6fcbe9d3322df5763e44b288d0069002450c4c529338f72ad5dcc85
-	source_aarch64 = postman-12.21.1-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.21.1/linux_arm64
-	sha256sums_aarch64 = 8023f598457626aeeaae45c4b6ea980bd34bb857d5c62e10042f144a107f04c9
+	source_x86_64 = postman-12.21.2-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.21.2/linux64
+	sha256sums_x86_64 = 0361ca8a68ee176df1fae3778137495b2e2c5a5790ebf25a7dbdd9ea14fadcda
+	source_aarch64 = postman-12.21.2-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.21.2/linux_arm64
+	sha256sums_aarch64 = f1bef52e7aecd4cf9041323ced1346dc84d20ac86224776bb4ca111e1f155b8f
 
 pkgname = postman-bin

Comment

Risk score 0. This change is a routine version bump for a binary package: pkgver advances from 12.21.1 to 12.21.2 and the per-architecture SHA256 checksums are updated accordingly. The source URLs remain HTTPS and point to the official Postman download host, with no new sources, scripts, build steps, or packaging logic changes. I do not see any added execution, persistence, privilege escalation, or integrity red flags in this diff.

@@ -4,7 +4,7 @@
 # Contributor: Juan Francisco Miranda <jfmiranda at gmail dot com>
 
 pkgname=postman-bin
-pkgver=12.21.1
+pkgver=12.21.2
 pkgrel=1
 pkgdesc="Build, test, and document your APIs faster"
 provides=('postman')

Comment

The change only updates the pinned SHA-256 checksums for the upstream Postman release tarballs on the official HTTPS download host. No new sources, scripts, build steps, privilege changes, or packaging logic were introduced. This is a routine integrity update and does not by itself indicate a security issue.

@@ -20,8 +20,8 @@ source_x86_64=("postman-${pkgver}-linux-${arch[0]}.tar.gz::https://dl.pstmn.io/d
 source_aarch64=("postman-${pkgver}-linux-${arch[1]}.tar.gz::https://dl.pstmn.io/download/version/${pkgver}/linux_arm64")
 
 sha256sums=('d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d')
-sha256sums_x86_64=('38a1b7abb6fcbe9d3322df5763e44b288d0069002450c4c529338f72ad5dcc85')
-sha256sums_aarch64=('8023f598457626aeeaae45c4b6ea980bd34bb857d5c62e10042f144a107f04c9')
+sha256sums_x86_64=('0361ca8a68ee176df1fae3778137495b2e2c5a5790ebf25a7dbdd9ea14fadcda')
+sha256sums_aarch64=('f1bef52e7aecd4cf9041323ced1346dc84d20ac86224776bb4ca111e1f155b8f')
 
 package() {
   install -dm755 "${pkgdir}/opt/"