Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 3.39.10 to 3.39.11 with no accompanying changes to sources, build logic, install scripts, or package metadata that would introduce new risk. On the provided diff alone, there are no signs of malicious behavior, integrity issues, or packaging red flags.

@@ -1,6 +1,6 @@
 pkgbase = ngrok
 	pkgdesc = A tunneling, reverse proxy for developing and understanding networked, HTTP services
-	pkgver = 3.39.10
+	pkgver = 3.39.11
 	pkgrel = 1
 	url = https://ngrok.com
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from ngrok 3.39.10 to 3.39.11, with corresponding updated HTTPS source URLs and checksums for each architecture. There are no new build steps, scripts, patches, privilege changes, or network-fetch behavior beyond the existing predeclared upstream binary downloads. The sources remain pinned to specific release tarballs and the integrity hashes were updated accordingly. No obvious security red flags in this diff alone.

@@ -12,13 +12,13 @@ pkgbase = ngrok
 	options = !strip
 	source = TERMS-OF-SERVICE.txt
 	sha256sums = d1fce3c7e78d5f7e5307238ee5f371b7a10911aeb249e3358e945eaa8cf2f1b2
-	source_i686 = https://bin.equinox.io/a/yYu6hg4DiE/ngrok-v3-3.39.10-linux-386.tar.gz
-	sha256sums_i686 = cff5b6e704090d9fccc9c43b44d6418ca8445eff2187433466a223adac81353a
-	source_x86_64 = https://bin.equinox.io/a/9sRAW6esxUB/ngrok-v3-3.39.10-linux-amd64.tar.gz
-	sha256sums_x86_64 = 9dfbe1a914e69cc7e980d61e6bd5a642025918102c5bc69905d1c57703aca3e8
-	source_armv7h = https://bin.equinox.io/a/fPHdc3GnMU4/ngrok-v3-3.39.10-linux-arm.tar.gz
-	sha256sums_armv7h = a23e84d4706587740a5d590fa57fc42e289f2fd23c8694e9265a398890efb753
-	source_aarch64 = https://bin.equinox.io/a/hqQ7mubGtHu/ngrok-v3-3.39.10-linux-arm64.tar.gz
-	sha256sums_aarch64 = 7176f5e5d5a2f6c332ff911ef895741f13168f1f0c225492c4412bde8b2f9a0d
+	source_i686 = https://bin.equinox.io/a/3erXiNs3rKK/ngrok-v3-3.39.11-linux-386.tar.gz
+	sha256sums_i686 = ade0d9fc069b990d0103bb87600d69931d85cb13bb68d94a4dfcb6b8ad54d714
+	source_x86_64 = https://bin.equinox.io/a/5Mrhp7gRDVb/ngrok-v3-3.39.11-linux-amd64.tar.gz
+	sha256sums_x86_64 = cec0b4997fcc5f529dfc74bac89050354d11a915f968720600039738fdf330cf
+	source_armv7h = https://bin.equinox.io/a/8ofUdPNoYoQ/ngrok-v3-3.39.11-linux-arm.tar.gz
+	sha256sums_armv7h = 3ace51ed57d18eb8d35404729121654eaa19ae1a7fd2c371eb991cac11c0eadb
+	source_aarch64 = https://bin.equinox.io/a/dg26hrkwY2F/ngrok-v3-3.39.11-linux-arm64.tar.gz
+	sha256sums_aarch64 = 3b6ba05a9d9585c34157fa0819fa95cdb13839f5b506b9e63204705cf7f79e29
 
 pkgname = ngrok

Comment

The change is a simple version bump in PKGBUILD from 3.39.10 to 3.39.11 with no accompanying changes to source URLs, checksums, build steps, install scripts, or package metadata. Based on the provided diff, there are no new security red flags such as added network fetches, privilege escalation, persistence mechanisms, or suspicious sources. Risk is minimal.

@@ -4,7 +4,7 @@
 # Contributor: Peter Sutton (foxxy) <foxxy@foxdogstudios.com>
 
 pkgname=ngrok
-pkgver=3.39.10
+pkgver=3.39.11
 pkgrel=1
 pkgdesc='A tunneling, reverse proxy for developing and understanding networked, HTTP services'
 url='https://ngrok.com'

Comment

The change is a straightforward version bump of the prebuilt ngrok release tarballs from 3.39.10 to 3.39.11, with corresponding SHA-256 updates. Sources remain HTTPS on the official Equinox/ngrok distribution host, there are no new build-time downloads, scripts, patches, or privilege-related changes, and the package still just ships the upstream binary. No security red flags are introduced by this diff alone.

@@ -12,15 +12,15 @@ license=('LicenseRef-custom')
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')
 optdepends=('bash-completion: Bash completion support')
 source=("TERMS-OF-SERVICE.txt")
-source_x86_64=("https://bin.equinox.io/a/9sRAW6esxUB/ngrok-v3-3.39.10-linux-amd64.tar.gz")
-source_i686=("https://bin.equinox.io/a/yYu6hg4DiE/ngrok-v3-3.39.10-linux-386.tar.gz")
-source_armv7h=("https://bin.equinox.io/a/fPHdc3GnMU4/ngrok-v3-3.39.10-linux-arm.tar.gz")
-source_aarch64=("https://bin.equinox.io/a/hqQ7mubGtHu/ngrok-v3-3.39.10-linux-arm64.tar.gz")
+source_x86_64=("https://bin.equinox.io/a/5Mrhp7gRDVb/ngrok-v3-3.39.11-linux-amd64.tar.gz")
+source_i686=("https://bin.equinox.io/a/3erXiNs3rKK/ngrok-v3-3.39.11-linux-386.tar.gz")
+source_armv7h=("https://bin.equinox.io/a/8ofUdPNoYoQ/ngrok-v3-3.39.11-linux-arm.tar.gz")
+source_aarch64=("https://bin.equinox.io/a/dg26hrkwY2F/ngrok-v3-3.39.11-linux-arm64.tar.gz")
 sha256sums=('d1fce3c7e78d5f7e5307238ee5f371b7a10911aeb249e3358e945eaa8cf2f1b2')
-sha256sums_i686=('cff5b6e704090d9fccc9c43b44d6418ca8445eff2187433466a223adac81353a')
-sha256sums_x86_64=('9dfbe1a914e69cc7e980d61e6bd5a642025918102c5bc69905d1c57703aca3e8')
-sha256sums_armv7h=('a23e84d4706587740a5d590fa57fc42e289f2fd23c8694e9265a398890efb753')
-sha256sums_aarch64=('7176f5e5d5a2f6c332ff911ef895741f13168f1f0c225492c4412bde8b2f9a0d')
+sha256sums_i686=('ade0d9fc069b990d0103bb87600d69931d85cb13bb68d94a4dfcb6b8ad54d714')
+sha256sums_x86_64=('cec0b4997fcc5f529dfc74bac89050354d11a915f968720600039738fdf330cf')
+sha256sums_armv7h=('3ace51ed57d18eb8d35404729121654eaa19ae1a7fd2c371eb991cac11c0eadb')
+sha256sums_aarch64=('3b6ba05a9d9585c34157fa0819fa95cdb13839f5b506b9e63204705cf7f79e29')
 
 # In order to make Ngrok's built-in updater happy, we need to avoid modifying the binary
 options=(!strip)