Review Results

Comment

The change is a routine version bump in .SRCINFO for the official Visual Studio Code binary package. The sources remain HTTPS downloads from the upstream Microsoft update endpoint, and the only modifications are updated versioned .deb filenames and their corresponding SHA256 checksums for x86_64, aarch64, and armv7h. No new scripts, install hooks, permissions changes, or other suspicious packaging behavior are introduced by this diff. Risk is therefore minimal.

@@ -1,6 +1,6 @@
 pkgbase = visual-studio-code-bin
 	pkgdesc = Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)
-	pkgver = 1.130.0
+	pkgver = 1.131.0
 	pkgrel = 1
 	url = https://code.visualstudio.com/
 	install = visual-studio-code-bin.install

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Visual Studio Code package, updating the upstream HTTPS download URLs and checksums for all architectures from 1.130.0 to 1.131.0. There are no new sources, scripts, install-time actions, privilege changes, or packaging logic changes in this diff. Security risk is low and limited to the usual trust in upstream release artifacts already present in the package.

@@ -31,11 +31,11 @@ pkgbase = visual-studio-code-bin
 	options = !strip
 	source = visual-studio-code-bin.sh
 	sha256sums = bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad
-	source_x86_64 = code_1.130.0_amd64.deb::https://update.code.visualstudio.com/1.130.0/linux-deb-x64/stable
-	sha256sums_x86_64 = 63835d9a09ba93c88fb57d35fad0f4c28788221285c7120281ac53ff2deaf183
-	source_aarch64 = code_1.130.0_arm64.deb::https://update.code.visualstudio.com/1.130.0/linux-deb-arm64/stable
-	sha256sums_aarch64 = 4b67f4e83154dfb281ed5e8ed7be03d9ce3c489bb00c8653c5207d61744d864b
-	source_armv7h = code_1.130.0_armhf.deb::https://update.code.visualstudio.com/1.130.0/linux-deb-armhf/stable
-	sha256sums_armv7h = a67c839d7d33a5a0213068d71f281930ce7ec09e4ae8fb2089784841deba935d
+	source_x86_64 = code_1.131.0_amd64.deb::https://update.code.visualstudio.com/1.131.0/linux-deb-x64/stable
+	sha256sums_x86_64 = fe2ed2d94ccc694f49d9084846c0be78ba56c42810355fa3999160079bb53c9a
+	source_aarch64 = code_1.131.0_arm64.deb::https://update.code.visualstudio.com/1.131.0/linux-deb-arm64/stable
+	sha256sums_aarch64 = b57f73e4a8a4524bf2a796757f64bd7b594515dd8dabae9b8cd07b1beb204d9c
+	source_armv7h = code_1.131.0_armhf.deb::https://update.code.visualstudio.com/1.131.0/linux-deb-armhf/stable
+	sha256sums_armv7h = d52ffec8d83eabd500c795007ef3ac286277ff9a1ee014a2797dd215ad3cd4af
 
 pkgname = visual-studio-code-bin

Comment

The change only bumps pkgver from 1.130.0 to 1.131.0 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or packaging logic were altered in the reviewed hunk. On its face this is a routine version update with no new security-relevant behavior visible in the diff.

@@ -2,7 +2,7 @@
 
 pkgname=visual-studio-code-bin
 _pkgname=visual-studio-code
-pkgver=1.130.0
+pkgver=1.131.0
 pkgrel=1
 pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)"
 arch=('x86_64' 'aarch64' 'armv7h')

Comment

Risk score 0. The change only bumps pkgver from 1.130.0 to 1.131.0 and updates the expected SHA-256 checksums for the official Microsoft .deb sources on all architectures. The source URLs remain HTTPS and point to the upstream update endpoint, and there are no new build steps, scripts, privilege changes, or other suspicious packaging behaviors in the diff.

@@ -27,9 +27,9 @@ source_x86_64=(code_${pkgver}_amd64.deb::https://update.code.visualstudio.com/${
 source_aarch64=(code_${pkgver}_arm64.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-arm64/stable)
 source_armv7h=(code_${pkgver}_armhf.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-armhf/stable)
 sha256sums=('bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad')
-sha256sums_x86_64=('63835d9a09ba93c88fb57d35fad0f4c28788221285c7120281ac53ff2deaf183')
-sha256sums_aarch64=('4b67f4e83154dfb281ed5e8ed7be03d9ce3c489bb00c8653c5207d61744d864b')
-sha256sums_armv7h=('a67c839d7d33a5a0213068d71f281930ce7ec09e4ae8fb2089784841deba935d')
+sha256sums_x86_64=('fe2ed2d94ccc694f49d9084846c0be78ba56c42810355fa3999160079bb53c9a')
+sha256sums_aarch64=('b57f73e4a8a4524bf2a796757f64bd7b594515dd8dabae9b8cd07b1beb204d9c')
+sha256sums_armv7h=('d52ffec8d83eabd500c795007ef3ac286277ff9a1ee014a2797dd215ad3cd4af')
 
 package() {
   bsdtar -xf data.tar.xz -C "${pkgdir}/"