Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.8.6 to 26.8.7. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the reviewed diff. On its face this is a routine upstream version update with no security-relevant indicators in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.8.6
+	pkgver = 26.8.7
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from QOwnNotes 26.8.6 to 26.8.7, updating the release tarball URL accordingly. No new sources, scripts, build steps, permissions, or packaging behaviors are introduced, and the source remains an HTTPS GitHub release artifact. Based on the provided diff alone, this does not present an obvious security concern.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.6/qownnotes-26.8.6.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.7/qownnotes-26.8.7.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: it updates pkgver, the pinned release tag, and the source tarball checksum to match the new upstream release. The source remains an HTTPS GitHub release URL, there are no new build-time network fetches, no added scripts, and no packaging/persistence red flags in the diff. Based on the provided hunk alone, this looks low risk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.8.6
-tag="c63ed727fa8a2018106cce3dbbb1f0ebdc2d4a0b"
+pkgver=26.8.7
+tag="f9e0806474ce6f8e72e9353131f72bde074bf9e4"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change is a routine upstream version bump for QOwnNotes: it updates pkgver, the pinned release tag, and the source checksum to match the new release tarball. The source remains an HTTPS GitHub release URL, there are no new build-time downloads, scripts, patches, or packaging changes, and nothing suggests privilege escalation or persistence behavior. Based on the diff shown, this is low risk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('25819da08a0112c01bb43e0fcb5f9265c9ac08c92ab800db0a4e5896e0d270c4')
+sha256sums=('96c6875550f91e4bdb50eb0564471bc3e28711357a23bdfa3337edd4fcf69923')
 
 prepare() {
     cd "${pkgname}-${pkgver}"