Review Results

Comment

The only change in this .SRCINFO hunk is a minor version bump from 26.8.3 to 26.8.4. No source URLs, checksums, build steps, install scripts, permissions, or dependency metadata are changed here, so there is no evident security impact from this diff alone.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.8.3
+	pkgver = 26.8.4
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from v26.8.3 to v26.8.4. The source remains on the official GitHub releases domain over HTTPS, with no added build steps, scripts, patches, or packaging logic changes. No new integrity or execution risks are introduced by this diff alone.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.3/qownnotes-26.8.3.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.4/qownnotes-26.8.4.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a straightforward version bump in PKGBUILD: pkgver advances from 26.8.3 to 26.8.4 and the pinned upstream git tag/commit is updated accordingly. No new sources, build steps, install scripts, permissions changes, or other packaging logic are introduced in the provided diff hunk. Based on this hunk alone, there are no apparent supply-chain or privilege-escalation concerns.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.8.3
-tag="05219a3627c265148f77c3c06245960f437aae83"
+pkgver=26.8.4
+tag="83ab5f0d85953517d276791cbfb612791a64be0a"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains the official GitHub release over HTTPS, there are no new build steps, scripts, network fetches, privilege changes, or packaging behavior changes. This is a routine integrity update and does not introduce a security concern by itself.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('1e230f08c922cd59b1d71ff8d2219a54f83c57646bcd89ae0550b27cdffa4ebe')
+sha256sums=('1c6275517befcc8b5f204e0181300875d4fbde024b585351b084ccaebcbe5856')
 
 prepare() {
     cd "${pkgname}-${pkgver}"