Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.9.2 to 2.10.0. No sources, checksums, install scripts, permissions, or build logic are modified here, so there is no direct security signal in the reviewed diff. Based on this hunk alone, the change appears low risk.

@@ -1,6 +1,6 @@
 pkgbase = mongosh-bin
 	pkgdesc = An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.
-	pkgver = 2.9.2
+	pkgver = 2.10.0
 	pkgrel = 1
 	url = https://github.com/mongodb-js/mongosh.git
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from mongosh 2.9.2 to 2.10.0, with updated HTTPS GitHub release tarball URLs and matching SHA-256 checksums for both x86_64 and aarch64. No new sources, scripts, install hooks, privilege changes, or packaging metadata red flags are introduced in this diff. Based on the provided hunk alone, this appears low risk.

@@ -9,9 +9,9 @@ pkgbase = mongosh-bin
 	depends = krb5
 	provides = mongosh
 	conflicts = mongosh
-	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.9.2/mongosh-2.9.2-linux-x64.tgz
-	sha256sums_x86_64 = b0febe385c10c9be755c29095ffa95a42bed16ea6625ea3fbde36ae33b42da79
-	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.9.2/mongosh-2.9.2-linux-arm64.tgz
-	sha256sums_aarch64 = e8cd0a2279acb6d29bdb0555457f6cfc6207dd95a40ed091b57318b4ed566104
+	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.10.0/mongosh-2.10.0-linux-x64.tgz
+	sha256sums_x86_64 = 42034ba0fc9a48fd65ddcc5150b2e9d8a777965019220744baee42ee9669d543
+	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.10.0/mongosh-2.10.0-linux-arm64.tgz
+	sha256sums_aarch64 = 585da7587d862a2fc54f38e4db1d5bc17823cf29a51d3d73e5838b86778cb98a
 
 pkgname = mongosh-bin

Comment

The change is a straightforward version bump of a binary package from 2.9.2 to 2.10.0, with corresponding SHA-256 checksum updates for the official GitHub release tarballs. The source URLs remain HTTPS and point to the upstream MongoDB JS GitHub releases, with no added build-time network fetches, scripts, patches, or packaging logic changes. I do not see any new persistence, privilege escalation, or integrity red flags in this diff.

@@ -3,7 +3,7 @@
 
 pkgname=mongosh-bin
 _pkgname=mongosh
-pkgver=2.9.2
+pkgver=2.10.0
 pkgrel=1
 pkgdesc='An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.'
 arch=('x86_64' 'aarch64')

Comment

The change is a straightforward version bump in PKGBUILD from 2.9.2 to 2.10.0 with updated SHA256 checksums for the official GitHub release tarballs. The source URLs remain HTTPS and point to the upstream MongoDB JS GitHub releases, there are no new build-time downloads, scripts, privilege changes, or packaging logic changes. Based on the diff provided, I do not see any security red flags in this update.

@@ -17,8 +17,8 @@ _mongosh_folder=mongosh-${pkgver}-linux
 source_x86_64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-x64.tgz")
 source_aarch64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64.tgz")
 
-sha256sums_x86_64=('b0febe385c10c9be755c29095ffa95a42bed16ea6625ea3fbde36ae33b42da79')
-sha256sums_aarch64=('e8cd0a2279acb6d29bdb0555457f6cfc6207dd95a40ed091b57318b4ed566104')
+sha256sums_x86_64=('42034ba0fc9a48fd65ddcc5150b2e9d8a777965019220744baee42ee9669d543')
+sha256sums_aarch64=('585da7587d862a2fc54f38e4db1d5bc17823cf29a51d3d73e5838b86778cb98a')
 
 package() {
 	if [ $CARCH = 'x86_64' ]; then