Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.13.6 to 1.14.8. No source URLs, checksums, install scripts, build commands, or packaging metadata changed in the provided diff, so there is no new security-relevant behavior to assess from this hunk alone.

@@ -1,6 +1,6 @@
 pkgbase = typora
 	pkgdesc = A minimal markdown editor and reader.
-	pkgver = 1.13.6
+	pkgver = 1.14.8
 	pkgrel = 1
 	url = https://typora.io/
 	arch = x86_64

Comment

The change only updates the pinned upstream binary package URLs and their SHA-512 checksums from Typora 1.13.6 to 1.14.8 for x86_64 and aarch64. The sources remain HTTPS on the official download domain, and there are no new build-time commands, install-script changes, or packaging red flags in this diff. This is a routine version bump with integrity hashes updated accordingly, so I see no security issue in the reviewed hunk.

@@ -13,9 +13,9 @@ pkgbase = typora
 	optdepends = pandoc: Import/export for extra file formats
 	source = typora.sh
 	sha512sums = de9c883c63f3ea35bd551c8761e605f8e1a3468943e000abcbf94bb0c5cbb5f0f6c7fa4d49ab39c177f167e0e3d0b061c861bf828627b4a34f7f1589119c3d04
-	source_x86_64 = https://download.typora.io/linux/typora_1.13.6_amd64.deb
-	sha512sums_x86_64 = a4b92a800731dee9186bcb3ddacbc2c3c99b66c4bec3c905dc80f945eb8900cf88bc0169077bca4660f2d4ea27562099e31093f0782ad1a849b9f4ebbf4de162
-	source_aarch64 = https://download.typora.io/linux/typora_1.13.6_arm64.deb
-	sha512sums_aarch64 = b10a85fcbdfe89a0e2fc260d06005b60e298fc8f5513e60575d685ef8a679e73d3d90776f17dac03e0a716a05e0ae06bfa69af39a35f19aec910289db4bdfbe7
+	source_x86_64 = https://download.typora.io/linux/typora_1.14.8_amd64.deb
+	sha512sums_x86_64 = 38ed5ce4301def6e4ba1aeb2a4b06e114bde3816b46f3977468dbb738dd7566428f30bc913c3b888f86fd53390bd54f4f6f09b07e5765789091e4bfdf7718006
+	source_aarch64 = https://download.typora.io/linux/typora_1.14.8_arm64.deb
+	sha512sums_aarch64 = 0818ba36cc892e050d5a7550c85d8eb3cd44c614b68e68bb2bcd9583ed0c04059cb3f058f65408a262715201ddf7a8ccbb317558fede1716f914208ab3289dc3
 
 pkgname = typora

Comment

The change only bumps typora from 1.13.6 to 1.14.8 and updates the corresponding SHA-512 checksums for the upstream .deb artifacts. No new sources, scripts, install hooks, privilege changes, or build logic were introduced in the diff. Based on the reviewed hunk, this is a routine version/checksum update with no evident security regression.

@@ -2,7 +2,7 @@
 # Contributor: Jonathan Duck <duckbrain30@gmail.com>
 
 pkgname=typora
-pkgver=1.13.6
+pkgver=1.14.8
 _pkgver_x86_64="$pkgver"
 _pkgver_aarch64="$pkgver"
 pkgrel=1

Comment

The change only updates the pinned SHA-512 checksums for the upstream .deb sources for x86_64 and aarch64. The source URLs remain HTTPS and point to the official Typora download host, with no new build steps, scripts, or packaging logic introduced. I do not see any added execution, persistence, privilege escalation, or integrity red flags in this hunk. Risk is low because the security impact is limited to trusting the new upstream artifacts, which is expected for a checksum refresh.

@@ -19,8 +19,8 @@ _urlbase="https://download.typora.io/linux/typora_"
 source_x86_64=("${_urlbase}${_pkgver_x86_64}_amd64.deb")
 source_aarch64=("${_urlbase}${_pkgver_aarch64}_arm64.deb")
 sha512sums=('de9c883c63f3ea35bd551c8761e605f8e1a3468943e000abcbf94bb0c5cbb5f0f6c7fa4d49ab39c177f167e0e3d0b061c861bf828627b4a34f7f1589119c3d04')
-sha512sums_x86_64=('a4b92a800731dee9186bcb3ddacbc2c3c99b66c4bec3c905dc80f945eb8900cf88bc0169077bca4660f2d4ea27562099e31093f0782ad1a849b9f4ebbf4de162')
-sha512sums_aarch64=('b10a85fcbdfe89a0e2fc260d06005b60e298fc8f5513e60575d685ef8a679e73d3d90776f17dac03e0a716a05e0ae06bfa69af39a35f19aec910289db4bdfbe7')
+sha512sums_x86_64=('38ed5ce4301def6e4ba1aeb2a4b06e114bde3816b46f3977468dbb738dd7566428f30bc913c3b888f86fd53390bd54f4f6f09b07e5765789091e4bfdf7718006')
+sha512sums_aarch64=('0818ba36cc892e050d5a7550c85d8eb3cd44c614b68e68bb2bcd9583ed0c04059cb3f058f65408a262715201ddf7a8ccbb317558fede1716f914208ab3289dc3')
 
 package() {
 	# unpack archive