Review Results

Comment

The change is a straightforward version bump in .SRCINFO for the binary package, updating the upstream download URLs and checksums for x86_64 and aarch64. The sources remain HTTPS on the official Postman download domain, there is no new build logic, no added scripts, and no indication of privilege escalation or persistence mechanisms. Based on the diff provided, this appears low risk.

@@ -1,6 +1,6 @@
 pkgbase = postman-bin
 	pkgdesc = Build, test, and document your APIs faster
-	pkgver = 12.21.9
+	pkgver = 12.22.3
 	pkgrel = 1
 	url = https://www.getpostman.com
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Postman binaries, with updated HTTPS source URLs and matching checksums for x86_64 and aarch64. No new sources, scripts, install hooks, or packaging logic are introduced, and the diff does not suggest any integrity or persistence concerns beyond the usual trust in upstream binary releases already present in this package.

@@ -38,9 +38,9 @@ pkgbase = postman-bin
 	options = !strip
 	source = postman.desktop
 	sha256sums = d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d
-	source_x86_64 = postman-12.21.9-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.21.9/linux64
-	sha256sums_x86_64 = 1fc15e439df2a522259f128b3f2d49a91ad1954f6ed1c7708846b9cda6dc6ac6
-	source_aarch64 = postman-12.21.9-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.21.9/linux_arm64
-	sha256sums_aarch64 = 19a578578613fa1dc432a5d6ce86f31c823d1f66727cb28bf1a6556fd6ae6728
+	source_x86_64 = postman-12.22.3-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.22.3/linux64
+	sha256sums_x86_64 = 6c92039178292460c17d28ac0b07b82ab797bed55c018701d82310189bdf4c54
+	source_aarch64 = postman-12.22.3-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.22.3/linux_arm64
+	sha256sums_aarch64 = 9a8a2d8c50ad3e9541c79ef5ab9c93bda062d0990ae46c8ed1646538432d0d8e
 
 pkgname = postman-bin

Comment

The change is a straightforward version bump in PKGBUILD from 12.21.9 to 12.22.3 with updated SHA256 checksums for the official Postman download URLs. The source remains HTTPS from the upstream vendor domain, there are no new build steps, no added scripts, and no packaging/persistence changes. Based on the diff provided, this does not introduce any obvious security risk beyond the usual trust in the upstream binary release.

@@ -4,7 +4,7 @@
 # Contributor: Juan Francisco Miranda <jfmiranda at gmail dot com>
 
 pkgname=postman-bin
-pkgver=12.21.9
+pkgver=12.22.3
 pkgrel=1
 pkgdesc="Build, test, and document your APIs faster"
 provides=('postman')

Comment

The change only updates the SHA-256 checksums for the upstream Postman tarballs on x86_64 and aarch64. The source URLs remain HTTPS and point to the official Postman download host, and there are no new build steps, scripts, or packaging behaviors introduced. This is a routine integrity-pin update with no evident security regression in the diff provided.

@@ -20,8 +20,8 @@ source_x86_64=("postman-${pkgver}-linux-${arch[0]}.tar.gz::https://dl.pstmn.io/d
 source_aarch64=("postman-${pkgver}-linux-${arch[1]}.tar.gz::https://dl.pstmn.io/download/version/${pkgver}/linux_arm64")
 
 sha256sums=('d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d')
-sha256sums_x86_64=('1fc15e439df2a522259f128b3f2d49a91ad1954f6ed1c7708846b9cda6dc6ac6')
-sha256sums_aarch64=('19a578578613fa1dc432a5d6ce86f31c823d1f66727cb28bf1a6556fd6ae6728')
+sha256sums_x86_64=('6c92039178292460c17d28ac0b07b82ab797bed55c018701d82310189bdf4c54')
+sha256sums_aarch64=('9a8a2d8c50ad3e9541c79ef5ab9c93bda062d0990ae46c8ed1646538432d0d8e')
 
 package() {
   install -dm755 "${pkgdir}/opt/"