Review Results

Comment

The change is a simple version bump in .SRCINFO from 26.8.5 to 26.8.6 with no other metadata changes. There are no new sources, scripts, dependencies, install actions, or packaging behavior introduced in the provided diff, so this does not add observable security risk by itself.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.8.5
+	pkgver = 26.8.6
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball from 26.8.5 to 26.8.6. The source remains an HTTPS GitHub release asset from the same upstream project, with no new build steps, scripts, dependencies, or packaging behavior introduced. No security-relevant red flags are present in this diff alone.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.5/qownnotes-26.8.5.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.6/qownnotes-26.8.6.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: pkgver/tag and the release tarball checksum were updated. The source remains an HTTPS GitHub release tarball from the official upstream project, and there are no new build steps, network fetches, privilege changes, or packaging-script additions. No security red flags are introduced by this diff alone.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.8.5
-tag="12671328f78e2bb362867e01359df60db3de8db6"
+pkgver=26.8.6
+tag="c63ed727fa8a2018106cce3dbbb1f0ebdc2d4a0b"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains HTTPS and points to the official GitHub release asset, with no new build steps, scripts, or packaging logic introduced. I do not see any supply-chain red flags in this diff alone.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('46dd9e7712c4dcb7649da996dbac2fe8df671f1be676cb34b8c55122a0d68a12')
+sha256sums=('25819da08a0112c01bb43e0fcb5f9265c9ac08c92ab800db0a4e5896e0d270c4')
 
 prepare() {
     cd "${pkgname}-${pkgver}"