Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 6.21.3 to 6.22.0. No sources, checksums, build steps, dependencies, install scripts, or packaging permissions are altered here, so there is no new security concern visible in this diff. The change is low risk and appears to be a routine upstream version update.

@@ -1,6 +1,6 @@
 pkgbase = qtutilities
 	pkgdesc = Common Qt related C++ classes and routines used by my applications such as dialogs, widgets and models
-	pkgver = 6.21.3
+	pkgver = 6.22.0
 	pkgrel = 1
 	url = https://github.com/Martchus/qtutilities
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from qtutilities 6.21.3 to 6.22.0, with the source URL still using HTTPS to the official upstream GitHub release archive and a corresponding updated SHA256 checksum. No new sources, build steps, scripts, or packaging metadata that would suggest privilege escalation, persistence, or integrity bypass were introduced in this diff. Based on the provided hunk alone, this looks low risk.

@@ -17,8 +17,8 @@ pkgbase = qtutilities
 	depends = libx11
 	optdepends = qtutilities-doc: API documentation
 	provides = libqtutilities.so
-	source = qtutilities-6.21.3.tar.gz::https://github.com/Martchus/qtutilities/archive/v6.21.3.tar.gz
-	sha256sums = 84fe062018ece8dfa58a8e529248f3fb07cf6681ecb458918ac75294c96ab2b8
+	source = qtutilities-6.22.0.tar.gz::https://github.com/Martchus/qtutilities/archive/v6.22.0.tar.gz
+	sha256sums = 840edb961631589c9054ad3fb6679c6fdd5b6461e078d8c9de3e8799e3863eaf
 
 pkgname = qtutilities
 	depends = c++utilities

Comment

The change is a routine version bump in PKGBUILD from 6.21.3 to 6.22.0 with the corresponding source tarball checksum update. The source remains an HTTPS GitHub release archive from the upstream project, there are no new build steps, no added scripts, no network fetches outside source=(), and no packaging/persistence red flags in the diff. Risk is low.

@@ -5,7 +5,7 @@
 
 _reponame=qtutilities
 pkgname=qtutilities
-pkgver=6.21.3
+pkgver=6.22.0
 pkgrel=1
 arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64')
 pkgdesc='Common Qt related C++ classes and routines used by my applications such as dialogs, widgets and models'

Comment

The change only updates the SHA-256 checksum for the upstream release tarball source in PKGBUILD. The source URL remains HTTPS and points to the official GitHub repository, with no new build steps, scripts, or packaging logic introduced. I did not find any evidence of network access at build time, privilege escalation, persistence mechanisms, or suspicious extra sources in this diff hunk. Risk is minimal and limited to normal integrity metadata maintenance.

@@ -16,7 +16,7 @@ optdepends=("$pkgname-doc: API documentation")
 provides=(libqtutilities.so)
 url="https://github.com/Martchus/${_reponame}"
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Martchus/${_reponame}/archive/v${pkgver}.tar.gz")
-sha256sums=('84fe062018ece8dfa58a8e529248f3fb07cf6681ecb458918ac75294c96ab2b8')
+sha256sums=('840edb961631589c9054ad3fb6679c6fdd5b6461e078d8c9de3e8799e3863eaf')
 
 build() {
   cd "$srcdir/${PROJECT_DIR_NAME:-$_reponame-$pkgver}"