Review Results

Comment

The change is a simple version bump in .SRCINFO from 3.1.0a4 to 3.1.0a5 with no accompanying changes to sources, build logic, install scripts, or metadata that would affect security. On its face this does not introduce any new attack surface or integrity concern; it only updates the recorded package version.

@@ -1,6 +1,6 @@
 pkgbase = gns3-gui
 	pkgdesc = GNS3 network simulator. Graphical user interface package.
-	pkgver = 3.1.0a4
+	pkgver = 3.1.0a5
 	pkgrel = 1
 	url = https://github.com/GNS3/gns3-gui
 	arch = any

Comment

The change is a routine upstream version bump in .SRCINFO from v3.1.0a4 to v3.1.0a5 with corresponding checksum updates. The source remains an HTTPS GitHub release tarball, and there are no new sources, scripts, install actions, or packaging behavior changes in this diff. No security red flags are introduced by this metadata-only update.

@@ -22,11 +22,11 @@ pkgbase = gns3-gui
 	optdepends = python-sentry_sdk: Python SDK for Sentry.io
 	optdepends = xterm: Default terminal emulator for CLI management of virtual instances
 	optdepends = wireshark-qt: Live packet capture
-	source = gns3-gui-3.1.0a4.tar.gz::https://github.com/GNS3/gns3-gui/archive/v3.1.0a4.tar.gz
+	source = gns3-gui-3.1.0a5.tar.gz::https://github.com/GNS3/gns3-gui/archive/v3.1.0a5.tar.gz
 	source = gns3.desktop
 	source = fix_requirements_for_Arch.patch
-	sha256sums = c408e2ba40d2d4d5c5a15bc2c8072f913590aea86f172f6be5d48cd6a03968fa
+	sha256sums = 4baa32d83a15854560ce5533c94cde66b8804f886c5c9062683ea1361b368700
 	sha256sums = 51e6db5b47e6af3d008d85e8c597755369fafb75ddb2af9e79a441f943f4c166
-	sha256sums = cdf52d8383a1d0d001d95a2787b5dfb09ad43a526ab180b93038c7acf392b949
+	sha256sums = 062eab7da12b2c6743a6833b3b249b0132837db7ac109dbc1a48b8e7c9aee854
 
 pkgname = gns3-gui

Comment

The change is a routine upstream version bump from 3.1.0a4 to 3.1.0a5 with corresponding checksum updates. The source remains an HTTPS GitHub tarball pinned to a specific tag, and there are no new build steps, scripts, or packaging changes introduced by this diff. No security-relevant behavior changes are evident in the reviewed hunk.

@@ -3,7 +3,7 @@
 # Contributor: korjjj <korjjj+aur[at]gmail[dot]com>
 
 pkgname=gns3-gui
-pkgver=3.1.0a4
+pkgver=3.1.0a5
 pkgrel=1
 pkgdesc='GNS3 network simulator. Graphical user interface package.'
 arch=(any)

Comment

The change is a routine version bump from 3.1.0a4 to 3.1.0a5 with corresponding checksum updates for the upstream tarball and an existing patch file. The source list still uses HTTPS GitHub release/archive URLs, there are no new build-time downloads, no added scripts, and no changes to package install behavior or privileges. I did not see any new supply-chain or persistence risk introduced by this diff.

@@ -34,9 +34,9 @@ optdepends=(
 source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz"
         gns3.desktop
         fix_requirements_for_Arch.patch)
-sha256sums=('c408e2ba40d2d4d5c5a15bc2c8072f913590aea86f172f6be5d48cd6a03968fa'
+sha256sums=('4baa32d83a15854560ce5533c94cde66b8804f886c5c9062683ea1361b368700'
             '51e6db5b47e6af3d008d85e8c597755369fafb75ddb2af9e79a441f943f4c166'
-            'cdf52d8383a1d0d001d95a2787b5dfb09ad43a526ab180b93038c7acf392b949')
+            '062eab7da12b2c6743a6833b3b249b0132837db7ac109dbc1a48b8e7c9aee854')
 
 prepare() {
     cd "$pkgname-$pkgver"

Comment

The patch only relaxes Python dependency pins in requirements.txt: jsonschema and QDarkStyle become unpinned minimums, sentry-sdk is bumped to a newer minimum, and truststore is made unconditional. There is no added code execution, no new sources, no install-script or packaging logic change, and no indication of malicious behavior in this diff. The main impact is reduced reproducibility / tighter supply-chain control from loosening exact pins, but that is a low-severity packaging hygiene issue rather than a security vulnerability in itself.

@@ -1,15 +1,14 @@
---- a/gns3-gui-3.1.0a4/requirements.txt	2026-07-09 10:40:43.000000000 +0200
-+++ b/gns3-gui-3.1.0a4/requirements.txt	2026-07-13 11:43:58.546252863 +0200
+--- a/gns3-gui-3.1.0a5/requirements.txt	2026-08-19 18:06:13.000000000 +0200
++++ b/gns3-gui-3.1.0a5/requirements.txt	2026-08-21 18:34:55.289914345 +0200
 @@ -1,7 +1,6 @@
 -jsonschema==4.25.1; python_version == '3.9'  # version 4.25.1 is the last to support Python 3.9
 -jsonschema>=4.26.0,<4.27; python_version >= '3.10'
--sentry-sdk>=2.59.0,<3  # optional dependency
+-sentry-sdk>=2.68.0,<3  # optional dependency
 +jsonschema>=4.26.0
-+sentry-sdk>=2.59.0
++sentry-sdk>=2.68.0  # optional dependency
  psutil>=7.2.2
  distro>=1.9.0
--truststore>=0.10.4; python_version >= '3.10'
+ truststore>=0.10.4; python_version >= '3.10'
 -QDarkStyle==3.2.3
 \ No newline at end of file
-+truststore>=0.10.4
 +QDarkStyle>=3.2.3