Review Results

Comment

The only change in this .SRCINFO diff is a pkgver bump from 2026.1.2.11 to 2026.1.3.7. No sources, checksums, install scripts, permissions, or build logic are modified here, so there is no direct security impact visible in this change alone. The risk is low because .SRCINFO is metadata-only and the review scope shows no new attack surface.

@@ -1,6 +1,6 @@
 pkgbase = android-studio
 	pkgdesc = The official Android IDE (Stable branch)
-	pkgver = 2026.1.2.11
+	pkgver = 2026.1.3.7
 	pkgrel = 1
 	url = https://developer.android.com/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO: it switches the Android Studio source tarball from one Google HTTPS release URL to another and updates the corresponding checksum. There are no new build steps, scripts, patches, or privilege-related artifacts introduced by this diff, and the source remains pinned to an official Google download over HTTPS. Based on the provided hunk alone, I see no security red flags beyond the usual trust in upstream binaries already present in this package.

@@ -15,10 +15,10 @@ pkgbase = android-studio
 	optdepends = libgl: emulator support
 	optdepends = ncurses5-compat-libs: native debugger support
 	options = !strip
-	source = https://dl.google.com/dl/android/studio/ide-zips/2026.1.2.11/android-studio-quail2-patch1-linux.tar.gz
+	source = https://dl.google.com/dl/android/studio/ide-zips/2026.1.3.7/android-studio-quail3-linux.tar.gz
 	source = android-studio.desktop
 	source = license.html
-	sha256sums = 1cc9cd54f400dbb0d07884f0f7c0cab524db5ce0a5ef70b23aed6fdd3cd445b9
+	sha256sums = 36832122557ab73ca68dfd9bd989ddac40103ac003ca10e04c949a1f61578a67
 	sha256sums = 73cd2dde1d0f99aaba5baad1e2b91c834edd5db3c817f6fb78868d102360d3c4
 	sha256sums = 9a7563f7fb88c9a83df6cee9731660dc73a039ab594747e9e774916275b2e23e
 

Comment

The change is a routine version bump in PKGBUILD: it updates the upstream Android Studio release version, the corresponding tarball name fragment, and the SHA-256 checksum for that tarball. The source still uses HTTPS from Google’s official download host, and there are no new build-time commands, scripts, privilege changes, or packaging behavior changes in this diff. No security red flags are introduced by this patch alone.

@@ -10,8 +10,8 @@
 # Maintainer: Kordian Bruck <k@bruck.me>
 
 pkgname=android-studio
-pkgver=2026.1.2.11
-_vername="quail2-patch1"
+pkgver=2026.1.3.7
+_vername="quail3"
 pkgrel=1
 pkgdesc="The official Android IDE (Stable branch)"
 arch=('i686' 'x86_64')

Comment

The change is a routine upstream version bump in PKGBUILD: it updates the Android Studio release version, the corresponding upstream tarball name, and the SHA256 checksum. The source remains the official Google HTTPS download URL, there are no new build steps, scripts, patches, privilege changes, or packaging behavior changes. No security red flags are introduced by this diff alone.

@@ -26,7 +26,7 @@ options=('!strip')
 source=("https://dl.google.com/dl/android/studio/ide-zips/$pkgver/android-studio-$_vername-linux.tar.gz"
         "$pkgname.desktop"
         "license.html")
-sha256sums=('1cc9cd54f400dbb0d07884f0f7c0cab524db5ce0a5ef70b23aed6fdd3cd445b9'
+sha256sums=('36832122557ab73ca68dfd9bd989ddac40103ac003ca10e04c949a1f61578a67'
             '73cd2dde1d0f99aaba5baad1e2b91c834edd5db3c817f6fb78868d102360d3c4'
             '9a7563f7fb88c9a83df6cee9731660dc73a039ab594747e9e774916275b2e23e')