Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.7.10 to 26.8.3. No source URLs, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the provided diff. Based on this hunk alone, there is no evidence of malicious behavior or integrity risk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.7.10
+	pkgver = 26.8.3
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from v26.7.10 to v26.8.3. The source remains an HTTPS GitHub release artifact from the official upstream project, with no added scripts, patches, build-time downloads, privilege changes, or packaging metadata that would suggest a security issue. No suspicious dependencies or install-time behavior are introduced by this diff alone.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.7.10/qownnotes-26.7.10.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.3/qownnotes-26.8.3.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump in PKGBUILD: it updates pkgver/tag and the corresponding source checksum to a new upstream release tarball over HTTPS. There are no added build steps, no new sources, no network-at-build-time behavior, and no packaging/install-script changes. The tag is a pinned commit hash, so the VCS reference remains fixed. I do not see any security-relevant regression in this diff.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.7.10
-tag="b7f66153f1f44b3bfb6bb310c762c97ac4e03646"
+pkgver=26.8.3
+tag="05219a3627c265148f77c3c06245960f437aae83"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change is a straightforward upstream version bump in PKGBUILD: it updates pkgver, the pinned VCS tag, and the release tarball checksum. The source remains an HTTPS GitHub release artifact, there are no new build-time network fetches, no added scripts, and no packaging/persistence red flags in the diff. I did not find evidence of malicious behavior in the reviewed hunk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('7c6836a5fa18b5a02415c02835548e4b130f8921963c31697ab6c4e0691583cc')
+sha256sums=('1e230f08c922cd59b1d71ff8d2219a54f83c57646bcd89ae0550b27cdffa4ebe')
 
 prepare() {
     cd "${pkgname}-${pkgver}"