Review Results

Comment

The change is a straightforward version bump in .SRCINFO from pandoc-bin 3.10.1 to 3.10.2 with no accompanying changes to sources, install scripts, build logic, or metadata that would indicate a supply-chain or privilege issue. Based on the provided diff alone, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = pandoc-bin
 	pkgdesc = Conversion between documentation formats
-	pkgver = 3.10.1
+	pkgver = 3.10.2
 	pkgrel = 1
 	url = https://pandoc.org
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for pandoc-bin, updating the declared provides and source/checksum entries from 3.10.1 to 3.10.2. The sources remain HTTPS GitHub release/archive URLs from the upstream project, with pinned release tarballs and matching checksums. No new build steps, scripts, permissions changes, or other suspicious metadata were introduced in this diff. Risk is therefore minimal.

@@ -15,16 +15,16 @@ pkgbase = pandoc-bin
 	optdepends = texlive-fontsrecommended: for pdf output using latex or xelatex engines
 	optdepends = texlive-latex: for pdf output using pdflatex engine
 	optdepends = texlive-xetex: for pdf output using xelatex engine
-	provides = pandoc=3.10.1
-	provides = pandoc-cli=3.10.1
+	provides = pandoc=3.10.2
+	provides = pandoc-cli=3.10.2
 	conflicts = pandoc-cli
 	options = !debug
 	options = !strip
-	source = pandoc-bin-3.10.1.tar.gz::https://github.com/jgm/pandoc/archive/3.10.1.tar.gz
-	sha256sums = faee98f42ed1592b2feb8da7fdfa87a23b679ca27ff883e06030f89c25c91ba9
-	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.10.1/pandoc-3.10.1-linux-amd64.tar.gz
-	sha256sums_x86_64 = 72948bf5784f560d5ad1876709daca27e0667f262da727bb33f77b58e52df2f5
-	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.10.1/pandoc-3.10.1-linux-arm64.tar.gz
-	sha256sums_aarch64 = cd3963da375793a4804c65ae538b4f7b9c23f87cac7f6c74a1cf5e2fff7e8d59
+	source = pandoc-bin-3.10.2.tar.gz::https://github.com/jgm/pandoc/archive/3.10.2.tar.gz
+	sha256sums = ec4c5d36e355785802601986637369ada24079ac20af6c0ee85c79502d77b3f0
+	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.10.2/pandoc-3.10.2-linux-amd64.tar.gz
+	sha256sums_x86_64 = c7edd535941c48be6a362081a748272837de81ae11777202d9c341d3d8261c9a
+	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.10.2/pandoc-3.10.2-linux-arm64.tar.gz
+	sha256sums_aarch64 = 1c4d69f2a092bd47cb180e58a4aab7b9637101ced928252458c7d41a7f7fa71d
 
 pkgname = pandoc-bin

Comment

The change is a simple version bump in PKGBUILD from 3.10.1 to 3.10.2 with no other modifications shown. There are no new sources, build steps, install scripts, permissions changes, or packaging logic introduced in this diff hunk. Based on the provided change alone, I do not see a security concern.

@@ -1,5 +1,5 @@
 pkgname=pandoc-bin
-pkgver=3.10.1
+pkgver=3.10.2
 pkgrel=1
 pkgdesc="Conversion between documentation formats"
 url="https://pandoc.org"

Comment

The change only updates SHA-256 checksums for the upstream source tarball and the prebuilt architecture-specific release archives. The URLs remain HTTPS and point to the official jgm/pandoc GitHub release assets, with no new build-time network access, scripts, or packaging logic introduced. I did not find any indication of typosquatting, malicious post-install behavior, or other integrity regressions in this diff hunk.

@@ -25,9 +25,9 @@ source=("$pkgname-$pkgver.tar.gz::https://github.com/jgm/pandoc/archive/${pkgver
 source_x86_64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-amd64.tar.gz")
 source_aarch64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-arm64.tar.gz")
 
-sha256sums=('faee98f42ed1592b2feb8da7fdfa87a23b679ca27ff883e06030f89c25c91ba9')
-sha256sums_x86_64=('72948bf5784f560d5ad1876709daca27e0667f262da727bb33f77b58e52df2f5')
-sha256sums_aarch64=('cd3963da375793a4804c65ae538b4f7b9c23f87cac7f6c74a1cf5e2fff7e8d59')
+sha256sums=('ec4c5d36e355785802601986637369ada24079ac20af6c0ee85c79502d77b3f0')
+sha256sums_x86_64=('c7edd535941c48be6a362081a748272837de81ae11777202d9c341d3d8261c9a')
+sha256sums_aarch64=('1c4d69f2a092bd47cb180e58a4aab7b9637101ced928252458c7d41a7f7fa71d')
 
 package() {
   cd "${srcdir}/pandoc-${pkgver}"