Review Results

Comment

The change only bumps pkgrel from 1 to 2 in .SRCINFO. No sources, build logic, install scripts, dependencies, or shipped artifacts are modified, so there is no new security risk introduced by this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = ffmpeg-full
 	pkgdesc = Complete solution to record, convert and stream audio and video (all possible features including libfdk-aac)
 	pkgver = 9.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://ffmpeg.org/
 	arch = x86_64
 	license = LicenseRef-nonfree-and-unredistributable

Comment

The change is limited to .SRCINFO metadata: it bumps pkgrel and replaces the dependency on uavs3d-git with the stable uavs3d package. This reduces supply-chain risk rather than increasing it, since it removes a VCS dependency that could otherwise float to unpinned upstream state. No build logic, install scripts, or source URLs are changed, and there are no signs of added network access, privilege escalation, or persistence mechanisms in this diff.

@@ -122,7 +122,7 @@ pkgbase = ffmpeg-full
 	depends = svt-vp9
 	depends = tesseract
 	depends = twolame
-	depends = uavs3d-git
+	depends = uavs3d
 	depends = v4l-utils
 	depends = vapoursynth
 	depends = vid.stab

Comment

The change only bumps pkgrel from 1 to 2 with no source, build, install, dependency, or packaging logic changes. This is a metadata-only rebuild and does not introduce any new attack surface or integrity concern in the reviewed hunk.

@@ -3,7 +3,7 @@
 
 pkgname=ffmpeg-full
 pkgver=9.0
-pkgrel=1
+pkgrel=2
 _svt_hevc_ver='4181c9ee0611baefb40b4c0ed10023cfd837d522'
 _whispercpp_ver='1.9.2'
 pkgdesc='Complete solution to record, convert and stream audio and video (all possible features including libfdk-aac)'

Comment

The change only swaps a dependency from the VCS package `uavs3d-git` to the stable `uavs3d` package and bumps pkgrel. This reduces supply-chain risk rather than introducing it: it removes a floating git dependency and does not add new sources, scripts, network fetches, privilege changes, or packaging behavior. No security concerns are evident in the provided diff.

@@ -113,7 +113,7 @@ depends=(
     'svt-vp9'
     'tesseract'
     'twolame'
-    'uavs3d-git'
+    'uavs3d'
     'v4l-utils'
     'vapoursynth' # loaded on-demand by dlopen()
     'vid.stab'