Review Results

Comment

The change only swaps one build dependency in .SRCINFO from `java-environment-openjdk=25` to `jdk25-openjdk`. This is a metadata-only update and does not introduce new code execution, network access, privilege changes, or packaging behavior. The new dependency still points to the expected OpenJDK 25 package name on Arch, so there is no obvious supply-chain or persistence risk in this diff.

@@ -16,7 +16,7 @@ pkgbase = java-openjfx
 	makedepends = glib2
 	makedepends = gperf
 	makedepends = gtk3
-	makedepends = java-environment-openjdk=25
+	makedepends = jdk25-openjdk
 	makedepends = libgl
 	makedepends = libx11
 	makedepends = libxtst

Comment

The change only swaps one Java build dependency package name for another equivalent Arch package naming convention (`java-environment-openjdk=$_java_build_ver` -> `jdk${_java_build_ver}-openjdk`). This does not introduce new sources, network access, privilege escalation, install-script behavior, or packaging changes beyond selecting the same JDK version via a different package name. No security-relevant regression is evident from this diff alone.

@@ -39,7 +39,7 @@ makedepends=(
   glib2
   gperf
   gtk3
-  java-environment-openjdk=$_java_build_ver
+  jdk${_java_build_ver}-openjdk
   libgl
   libx11
   libxtst