Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 9.48 to 9.49 with no accompanying changes to sources, build logic, install scripts, or package metadata beyond pkgver. On its face this does not introduce any new attack surface or supply-chain risk. I did not see evidence in the provided diff of suspicious URLs, build-time downloads, privilege escalation, or persistence mechanisms.

@@ -1,6 +1,6 @@
 pkgbase = perl-mojolicious
 	pkgdesc = Real-time web framework
-	pkgver = 9.48
+	pkgver = 9.49
 	pkgrel = 1
 	url = https://metacpan.org/release/Mojolicious
 	arch = any

Comment

The change is a straightforward version bump in .SRCINFO from Mojolicious 9.48 to 9.49, with the source remaining on the official CPAN/MetaCPAN HTTPS host and the checksums updated accordingly. No new build steps, scripts, binaries, or privilege-related artifacts are introduced in this diff. Based on the provided hunk alone, there are no obvious supply-chain or packaging red flags.

@@ -10,8 +10,8 @@ pkgbase = perl-mojolicious
 	optdepends = perl-cpanel-json-xs>=4.09: Faster JSON encoding and decoding
 	optdepends = perl-role-tiny>=2.000001: Role support
 	options = !emptydirs
-	source = https://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-9.48.tar.gz
-	md5sums = da7c810242b8d734482f7ce9d51e715b
-	sha512sums = f9bd7e6af0017dc3895367a956c9b0273f011229c55a0efd010ea7497b7a54e37989f307df561cccf1a9abbebdeb45dc4d828f90f279927077fa3d243435bf2f
+	source = https://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-9.49.tar.gz
+	md5sums = cfd3b41597f228c945f6b25215410cc2
+	sha512sums = c2319fc25298863c8cc01bed85767d8676d1e42053b6448907d9c2e03ef53070360a71046a457a2de3d82eb659dee8031773ee4793e1e44faa25278b37194e01
 
 pkgname = perl-mojolicious

Comment

The change is a simple version bump in PKGBUILD from 9.48 to 9.49 with no modifications to sources, checksums, build steps, install scripts, dependencies, or packaging logic. Based on the provided diff, there are no security-relevant red flags such as new network fetches, privilege escalation, persistence mechanisms, or integrity changes.

@@ -3,7 +3,7 @@
 # Generator  : CPANPLUS::Dist::Arch 1.32
 
 pkgname='perl-mojolicious'
-pkgver='9.48'
+pkgver='9.49'
 pkgrel='1'
 pkgdesc="Real-time web framework"
 arch=('any')

Comment

The change only updates the integrity hashes for the upstream Mojolicious source tarball while keeping the HTTPS CPAN source URL unchanged. There are no new build steps, no additional sources, no install-script changes, and no signs of network access or privilege escalation introduced by this diff. Security impact is limited to normal package maintenance (checksum refresh) and does not itself indicate malicious behavior.

@@ -14,8 +14,8 @@ makedepends=()
 optdepends=('perl-cpanel-json-xs>=4.09: Faster JSON encoding and decoding' 'perl-role-tiny>=2.000001: Role support')
 url='https://metacpan.org/release/Mojolicious'
 source=("https://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-${pkgver}.tar.gz")
-md5sums=('da7c810242b8d734482f7ce9d51e715b')
-sha512sums=('f9bd7e6af0017dc3895367a956c9b0273f011229c55a0efd010ea7497b7a54e37989f307df561cccf1a9abbebdeb45dc4d828f90f279927077fa3d243435bf2f')
+md5sums=('cfd3b41597f228c945f6b25215410cc2')
+sha512sums=('c2319fc25298863c8cc01bed85767d8676d1e42053b6448907d9c2e03ef53070360a71046a457a2de3d82eb659dee8031773ee4793e1e44faa25278b37194e01')
 _distdir="Mojolicious-${pkgver}"
 
 build() {