Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 26.8.4 to 26.8.5 with no other metadata, source, dependency, or build-script changes shown. On its face this does not introduce any new attack surface or packaging red flags. I did not see evidence in the provided diff of suspicious sources, build-time downloads, privilege escalation, or install-script changes.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.8.4
+	pkgver = 26.8.5
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO from qownnotes 26.8.4 to 26.8.5, with the source URL updated accordingly. It remains an HTTPS download from the official GitHub release path and does not introduce new sources, scripts, build steps, or packaging behavior. No security-relevant red flags are visible in this diff alone.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.4/qownnotes-26.8.4.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.5/qownnotes-26.8.5.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump in PKGBUILD: it updates pkgver, the pinned upstream git tag, and the source tarball checksum to match the new release. The source remains an HTTPS GitHub release asset, there are no new build-time downloads, no added scripts, and no packaging/persistence red flags in the diff. Based on the provided hunk, this looks low risk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.8.4
-tag="83ab5f0d85953517d276791cbfb612791a64be0a"
+pkgver=26.8.5
+tag="12671328f78e2bb362867e01359df60db3de8db6"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains the official GitHub release over HTTPS, and there are no new build steps, scripts, or packaging changes that would introduce execution or persistence risks. This is a routine integrity update with no security red flags in the diff provided.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('1c6275517befcc8b5f204e0181300875d4fbde024b585351b084ccaebcbe5856')
+sha256sums=('46dd9e7712c4dcb7649da996dbac2fe8df671f1be676cb34b8c55122a0d68a12')
 
 prepare() {
     cd "${pkgname}-${pkgver}"