Review Results

Comment

The change is limited to bumping pkgver in .SRCINFO from 2026.2.0.1 to 2026.2.1. No build logic, sources, install scripts, or packaging behavior changed. .SRCINFO is metadata only, so this diff does not introduce a direct security issue by itself. One pre-existing concern remains that the URL field uses http:// rather than https://, but that is unchanged in this commit and outside the scope of this diff.

@@ -1,6 +1,6 @@
 pkgbase = clion
 	pkgdesc = Cross-platform IDE for C and C++ from JetBrains.
-	pkgver = 2026.2.0.1
+	pkgver = 2026.2.1
 	pkgrel = 1
 	epoch = 1
 	url = http://www.jetbrains.com/clion

Comment

The change is a straightforward version bump in .SRCINFO for JetBrains CLion, updating the noextract/source filenames and their SHA256 checksums for x86_64 and aarch64. The source URLs remain on the official JetBrains download domain over HTTPS, and there are no new scripts, build steps, or packaging directives introduced. No supply-chain red flags are present in this diff alone.

@@ -8,15 +8,15 @@ pkgbase = clion
 	arch = aarch64
 	license = custom
 	makedepends = rsync
-	noextract = CLion-2026.2.0.1.tar.gz
-	noextract = CLion-2026.2.0.1-aarch64.tar.gz
+	noextract = CLion-2026.2.1.tar.gz
+	noextract = CLion-2026.2.1-aarch64.tar.gz
 	options = !strip
 	source = jetbrains-clion.desktop
 	sha256sums = a7a3f9891f5d8e7e5650afe00819909413fa2ed911393dd0648fba91233974a2
-	source_x86_64 = https://download-cf.jetbrains.com/cpp/CLion-2026.2.0.1.tar.gz
-	sha256sums_x86_64 = dff48d82de9ba6bd1a2105a64c99ef9207ed759134339c1c13f2c34b51e4e11d
-	source_aarch64 = https://download-cf.jetbrains.com/cpp/CLion-2026.2.0.1-aarch64.tar.gz
-	sha256sums_aarch64 = 206d94daff664e4f8609b07d8c95685f984a8eedfbf837ea46232dc6ef1bf1ba
+	source_x86_64 = https://download-cf.jetbrains.com/cpp/CLion-2026.2.1.tar.gz
+	sha256sums_x86_64 = 09c3310bc37abce1678df118d742fe1b0eeaef23f3b7ca6aaffff5db0993fbb1
+	source_aarch64 = https://download-cf.jetbrains.com/cpp/CLion-2026.2.1-aarch64.tar.gz
+	sha256sums_aarch64 = e0135cd9c991161a877085f5f653c7320a7d035b8de8ba08e11b09e1a80d4ec1
 
 pkgname = clion
 	depends = libdbusmenu-glib

Comment

The only change in this diff is a pkgver bump from 2026.2.0.1 to 2026.2.1. No build logic, sources, install scripts, permissions, or dependencies were modified, so there is no new security-relevant behavior to assess in this hunk. This appears to be a routine version update only.

@@ -9,7 +9,7 @@ pkgbase=clion
 pkgname=(clion clion-jre clion-cmake clion-gdb clion-lldb)
 _pkgname=clion
 _dlname=CLion
-pkgver=2026.2.0.1
+pkgver=2026.2.1
 pkgrel=1
 epoch=1
 pkgdesc="Cross-platform IDE for C and C++ from JetBrains."

Comment

The change only updates the pinned SHA-256 checksums for the upstream JetBrains CLion release tarballs on x86_64 and aarch64. Source URLs remain HTTPS and point to the official JetBrains download host, with no new build steps, scripts, or packaging logic introduced. This is a normal integrity-update for a new upstream release and does not add any obvious supply-chain or privilege-escalation risk in the reviewed hunk.

@@ -22,8 +22,8 @@ source=("jetbrains-${pkgbase}.desktop")
 source_x86_64=("https://download-cf.jetbrains.com/cpp/${_dlname}-${pkgver}.tar.gz")
 source_aarch64=("https://download-cf.jetbrains.com/cpp/${_dlname}-${pkgver}-aarch64.tar.gz")
 sha256sums=('a7a3f9891f5d8e7e5650afe00819909413fa2ed911393dd0648fba91233974a2')
-sha256sums_x86_64=('dff48d82de9ba6bd1a2105a64c99ef9207ed759134339c1c13f2c34b51e4e11d')
-sha256sums_aarch64=('206d94daff664e4f8609b07d8c95685f984a8eedfbf837ea46232dc6ef1bf1ba')
+sha256sums_x86_64=('09c3310bc37abce1678df118d742fe1b0eeaef23f3b7ca6aaffff5db0993fbb1')
+sha256sums_aarch64=('e0135cd9c991161a877085f5f653c7320a7d035b8de8ba08e11b09e1a80d4ec1')
 noextract=("${_dlname}-${pkgver}.tar.gz"
            "${_dlname}-${pkgver}-aarch64.tar.gz")