Review Results

Comment

The change is a routine version bump in .SRCINFO from Oracle JDK 26.0.1 to 26.0.2, with corresponding source URL updates and no new sources, scripts, patches, or packaging logic changes. The URLs remain HTTPS and point to Oracle’s official download domains, and there is no evidence here of added execution, privilege escalation, or integrity bypass beyond the existing upstream binary source model. Low risk.

@@ -1,15 +1,15 @@
 pkgbase = jdk
 	pkgdesc = Oracle Java
-	pkgver = 26.0.1
+	pkgver = 26.0.2
 	pkgrel = 1
 	url = https://www.oracle.com/java/
 	arch = x86_64
 	license = LicenseRef-Custom
 	makedepends = python-html2text
 	makedepends = alsa-lib
-	noextract = jdk-26.0.1_doc-all.zip
-	source = https://download.oracle.com/java/26/archive/jdk-26.0.1_linux-x64_bin.tar.gz
-	source = https://download.oracle.com/otn_software/java/jdk/26.0.1+8/458fda22e4c54d5ba572ab8d2b22eb83/jdk-26.0.1_doc-all.zip
+	noextract = jdk-26.0.2_doc-all.zip
+	source = https://download.oracle.com/java/26/archive/jdk-26.0.2_linux-x64_bin.tar.gz
+	source = https://download.oracle.com/otn_software/java/jdk/26.0.2+10/818d462d89b645c7a1aad49066c454e5/jdk-26.0.2_doc-all.zip
 	source = jdk-26_doc-license.html::https://download.oracle.com/otndocs/jcp/java_se-26-final-spec/license.html
 	source = java.desktop
 	source = jconsole.desktop

Comment

The change only updates two SHA-256 checksums in .SRCINFO for existing local source files (the Java icon assets). No sources, build logic, dependencies, install scripts, or package metadata affecting execution/persistence were changed. This is a routine integrity metadata refresh with no security impact visible from the diff.

@@ -17,8 +17,8 @@ pkgbase = jdk
 	source = java_16.png
 	source = java_48.png
 	source = LICENSE
-	sha256sums = 389213eea280b09443f7559561f3ffd88f5c5439455e18f63bd06ed7ee0ffdbd
-	sha256sums = d1298fc3bfe61c2e18fe2b2748c175c5b09ee30304ed0c3fdd50ba172449b754
+	sha256sums = 11de2bce72e7f07b9e80afa9bdd950b42f3a5c69cf4969e44389d50f466959e2
+	sha256sums = b6600b90e3d177d8b02a278761ac2ec59742682a722bad281421013844e0e875
 	sha256sums = 27984b214d135bc4f6fb04c2d2cb85de8b9ad55f7b5752bf128f58c62e11ddcc
 	sha256sums = 0a0c33a4cebf59d365a95869f0513a8f2b54ed69db7c8b8220f364b4a3069726
 	sha256sums = 25aa549dfc515ca177e416bc1635db85655db2d2e9c77ea153b8768e11953b16

Comment

The change is limited to .SRCINFO metadata version bumps for the jre provides entries from 26.0.1-1 to 26.0.2-1. This does not alter build logic, sources, install scripts, or package contents, and there are no new dependencies, conflicts, or privilege-related changes. Low risk.

@@ -44,10 +44,10 @@ pkgname = jre
 	optdepends = gtk3: for the Gtk+ 3 look and feel - desktop usage
 	provides = java-runtime=26
 	provides = java-runtime-jdk26
-	provides = jre26-jdk=26.0.1-1
+	provides = jre26-jdk=26.0.2-1
 	provides = java-runtime-headless=26
 	provides = java-runtime-headless-jdk=26
-	provides = jre26-jdk-headless=26.0.1-1
+	provides = jre26-jdk-headless=26.0.2-1
 	conflicts = jdk
 	backup = etc/java-jdk/jaxp.properties
 	backup = etc/java-jdk/jaxp-strict.properties.template

Comment

The change only bumps the version strings in .SRCINFO provides entries from 26.0.1-1 to 26.0.2-1. No source URLs, build commands, install scripts, permissions, or dependency metadata are altered, so there is no meaningful security impact in this diff.

@@ -85,14 +85,14 @@ pkgname = jdk
 	optdepends = gtk3: for the Gtk+ 3 look and feel - desktop usage
 	provides = java-environment=26
 	provides = java-environment-jdk=26
-	provides = jdk26-jdk=26.0.1-1
+	provides = jdk26-jdk=26.0.2-1
 	provides = jre=26
 	provides = java-runtime=26
 	provides = java-runtime-jdk26
-	provides = jre26-jdk=26.0.1-1
+	provides = jre26-jdk=26.0.2-1
 	provides = java-runtime-headless=26
 	provides = java-runtime-headless-jdk=26
-	provides = jre26-jdk-headless=26.0.1-1
+	provides = jre26-jdk-headless=26.0.2-1
 	conflicts = jre
 	backup = etc/java-jdk/jaxp.properties
 	backup = etc/java-jdk/jaxp-strict.properties.template

Comment

The change only bumps the upstream JDK version/build/hash in PKGBUILD. There are no new sources, scripts, install hooks, permissions changes, or packaging logic changes in the provided diff. This looks like a routine version update with no evident security impact from the diff alone.

@@ -3,9 +3,9 @@
 
 pkgbase=jdk
 pkgname=('jre' 'jdk' 'jdk-doc')
-pkgver=26.0.1
-_build=8
-_hash=458fda22e4c54d5ba572ab8d2b22eb83
+pkgver=26.0.2
+_build=10
+_hash=818d462d89b645c7a1aad49066c454e5
 _majver="${pkgver%%.*}"
 pkgrel=1
 pkgdesc='Oracle Java'

Comment

The change only updates two SHA-256 checksums for existing Oracle JDK source artifacts in PKGBUILD. The source URL remains the same official HTTPS Oracle download location, there are no new sources, scripts, install hooks, privilege changes, or packaging logic changes. This is a routine integrity hash refresh and does not introduce a security concern on its own.

@@ -26,8 +26,8 @@ source=("https://download.oracle.com/java/${_majver}/archive/jdk-${pkgver}_linux
         'java_48.png'
         'LICENSE')
 noextract=("jdk-${pkgver}_doc-all.zip")
-sha256sums=('389213eea280b09443f7559561f3ffd88f5c5439455e18f63bd06ed7ee0ffdbd'
-            'd1298fc3bfe61c2e18fe2b2748c175c5b09ee30304ed0c3fdd50ba172449b754'
+sha256sums=('11de2bce72e7f07b9e80afa9bdd950b42f3a5c69cf4969e44389d50f466959e2'
+            'b6600b90e3d177d8b02a278761ac2ec59742682a722bad281421013844e0e875'
             '27984b214d135bc4f6fb04c2d2cb85de8b9ad55f7b5752bf128f58c62e11ddcc'
             '0a0c33a4cebf59d365a95869f0513a8f2b54ed69db7c8b8220f364b4a3069726'
             '25aa549dfc515ca177e416bc1635db85655db2d2e9c77ea153b8768e11953b16'