Review Results

Comment

The change is a straightforward version bump in .SRCINFO: it updates the Burp Suite release from 2026.7.3 to 2026.8, adjusts the corresponding noextract/source URL, and refreshes the checksum for the new upstream JAR. No new sources, no build-script changes, no added install-time actions, and no suspicious metadata changes are introduced in this diff. Based on the provided hunk alone, this looks like a routine upstream update with normal integrity metadata refresh.

@@ -1,18 +1,18 @@
 pkgbase = burpsuite
 	pkgdesc = An integrated platform for performing security testing of web applications (free edition)
-	pkgver = 2026.7.3
+	pkgver = 2026.8
 	pkgrel = 1
 	url = https://portswigger.net/burp/
 	install = burpsuite.install
 	arch = any
 	license = custom
 	depends = java-runtime>=21
-	noextract = burpsuite-2026.7.3.jar
-	source = burpsuite-2026.7.3.jar::https://portswigger-cdn.net/burp/releases/download?product=desktop&version=2026.7.3&type=Jar
+	noextract = burpsuite-2026.8.jar
+	source = burpsuite-2026.8.jar::https://portswigger-cdn.net/burp/releases/download?product=desktop&version=2026.8&type=Jar
 	source = LICENSE
 	source = burpsuite.desktop
 	source = icon64.png
-	sha256sums = c8262dc5426f38bedc490d66c5d21b6ff77d6dc6d85cefe6a66c882690134069
+	sha256sums = 888f0588cf82a3b70d508dcbf07591184a26249e38cda8ea8b5a68f4b5a30789
 	sha256sums = a1146672de7084a1cddc5b7dab4d18b3530c194bd6e45a2b0ac04b579751ca30
 	sha256sums = 950c61d7ce1257c21a4152abebb8da320d0206ceb59247d6c912903d1ed39fc8
 	sha256sums = d31232a7dbdab9d5723f12aa25c52d13fd46ef2e8837a85fb9a08c3a7f151541

Comment

The change only bumps pkgver and updates the corresponding source checksum for the Burp Suite JAR. I did not see any new sources, build-time downloads, install-script changes, or packaging logic changes. The package still fetches the upstream JAR over HTTPS from the vendor CDN, and the rest of the PKGBUILD is unchanged. No security-relevant red flags are introduced by this diff alone.

@@ -7,7 +7,7 @@
 # Contributor: kageurufu
 
 pkgname=burpsuite
-pkgver=2026.7.3
+pkgver=2026.8
 pkgrel=1
 pkgdesc="An integrated platform for performing security testing of web applications (free edition)"
 url="https://portswigger.net/burp/"

Comment

The change is limited to bumping the Burp Suite upstream version and updating the SHA-256 checksum for the main JAR source. The source remains an HTTPS download from the official PortSwigger CDN, with no new sources, scripts, patches, install logic, or packaging behavior changes. I do not see any added supply-chain, persistence, or privilege-escalation risk in this diff.

@@ -23,7 +23,7 @@ source=("${pkgname}-${pkgver}.jar::https://portswigger-cdn.net/burp/releases/dow
         burpsuite.desktop
         icon64.png)
 install=burpsuite.install
-sha256sums=('c8262dc5426f38bedc490d66c5d21b6ff77d6dc6d85cefe6a66c882690134069'
+sha256sums=('888f0588cf82a3b70d508dcbf07591184a26249e38cda8ea8b5a68f4b5a30789'
             'a1146672de7084a1cddc5b7dab4d18b3530c194bd6e45a2b0ac04b579751ca30'
             '950c61d7ce1257c21a4152abebb8da320d0206ceb59247d6c912903d1ed39fc8'
             'd31232a7dbdab9d5723f12aa25c52d13fd46ef2e8837a85fb9a08c3a7f151541')