Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 2.1.3 to 2.1.4 with no accompanying changes to sources, build logic, install scripts, or metadata that would affect security. On the provided diff alone there are no red flags such as new URLs, checksums, dependencies, or execution paths.

@@ -1,6 +1,6 @@
 pkgbase = syncthingtray
 	pkgdesc = Tray application for Syncthing
-	pkgver = 2.1.3
+	pkgver = 2.1.4
 	pkgrel = 1
 	url = https://github.com/Martchus/syncthingtray
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from syncthingtray 2.1.3 to 2.1.4, with the source URL still using HTTPS and the checksum updated accordingly. No new sources, build steps, install scripts, or privilege-related artifacts are introduced by this diff. Based on the provided hunk alone, there are no security red flags.

@@ -26,8 +26,8 @@ pkgbase = syncthingtray
 	depends = qt5-base
 	depends = qt5-declarative
 	optdepends = gnome-shell-extension-appindicator: tray icon support for GNOME Shell
-	source = syncthingtray-2.1.3.tar.gz::https://github.com/Martchus/syncthingtray/archive/v2.1.3.tar.gz
-	sha256sums = 1c7c1d1469f56e89f4bb353bbf6cc36e2a898cca20a784933abbb43ffcfbae6e
+	source = syncthingtray-2.1.4.tar.gz::https://github.com/Martchus/syncthingtray/archive/v2.1.4.tar.gz
+	sha256sums = 935143ffe94365551345ae5cf5b710539925bf48168b17360e94243a6e1a32d7
 
 pkgname = syncthingtray
 	depends = qtutilities

Comment

The change is a routine version bump from 2.1.3 to 2.1.4 with the corresponding source tarball checksum update. The source remains the official GitHub upstream release over HTTPS, there are no new build-time downloads, scripts, privilege changes, or packaging behavior changes in the reviewed hunk. No security-relevant red flags are introduced by this diff.

@@ -24,7 +24,7 @@ _enable_plasmoid=${SYNCTHING_TRAY_ENABLE_PLASMOID:-0}
 
 _reponame=syncthingtray
 pkgname=syncthingtray
-pkgver=2.1.3
+pkgver=2.1.4
 pkgrel=1
 arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64')
 pkgdesc='Tray application for Syncthing'

Comment

The change is a straightforward version bump in PKGBUILD from 2.1.3 to 2.1.4 with the corresponding upstream tarball checksum update. The source remains an HTTPS GitHub release archive from the official repository, there are no new build-time network fetches, no added scripts, and no packaging/persistence red flags in the diff. Based on the provided hunk, this appears low risk.

@@ -44,7 +44,7 @@ checkdepends=('cppunit' 'syncthing' 'iproute2')
 [[ $_enable_plasmoid ]] && makedepends+=('plasma-framework5' 'extra-cmake-modules')
 url="https://github.com/Martchus/${_reponame}"
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Martchus/${_reponame}/archive/v${pkgver}.tar.gz")
-sha256sums=('1c7c1d1469f56e89f4bb353bbf6cc36e2a898cca20a784933abbb43ffcfbae6e')
+sha256sums=('935143ffe94365551345ae5cf5b710539925bf48168b17360e94243a6e1a32d7')
 
 ephemeral_port() {
   comm -23 <(seq 49152 65535) <(ss -tan | awk '{print $4}' | cut -d':' -f2 | grep "[0-9]\{1,5\}" | sort | uniq) | shuf | head -n 1