Review Results

Comment

The change only bumps pkgrel from 1 to 2 and removes the epoch line from .SRCINFO. There are no source, build, install, dependency, or script changes in the provided diff hunk, so there is no evident security impact from this metadata-only update. The only thing to note is that removing epoch could affect version comparison semantics, but that is a packaging/versioning concern rather than a security issue in this change.

@@ -1,8 +1,7 @@
 pkgbase = python-pypdf2
 	pkgdesc = Python library for manipulating pages of PDF files (legacy v2)
 	pkgver = 3.0.1
-	pkgrel = 1
-	epoch = 2
+	pkgrel = 2
 	url = https://pypi.org/project/PyPDF2
 	arch = any
 	license = BSD

Comment

The change only bumps pkgrel from 1 to 2 and removes epoch=2 from PKGBUILD metadata. There are no source, build, install, dependency, or script changes in the provided diff hunk, so this does not introduce a security issue by itself. The only potential impact is versioning/upgrade behavior, but that is not a security concern in this change alone.

@@ -9,8 +9,7 @@
 _name=PyPDF2
 pkgname=python-pypdf2
 pkgver=3.0.1
-pkgrel=1
-epoch=2
+pkgrel=2
 pkgdesc='Python library for manipulating pages of PDF files (legacy v2)'
 arch=(any)
 url="https://pypi.org/project/PyPDF2"

Comment

The change is low risk. It only adds a prepare() step that edits the upstream pyproject.toml to remove an upper dependency bound (`,<4`) before building, which is a local source modification and does not introduce network access, privilege escalation, persistence, or embedded binaries. The package still builds from the pinned PyPI source tarball with a fixed SHA256, and the rest of the packaging logic remains unchanged. The only concern is that it relaxes dependency constraints, which can affect compatibility, but that is not a security issue by itself.

@@ -30,6 +29,11 @@ makedepends=(
 source=("https://files.pythonhosted.org/packages/source/${_name::1}/${_name}/${_name}-${pkgver}.tar.gz")
 sha256sums=('a74408f69ba6271f71b9352ef4ed03dc53a31aa404d29b5d31f53bfecfee1440')
 
+prepare() {
+  cd ${_name}-${pkgver}
+  sed -i 's/,<4//' pyproject.toml
+}
+
 build() {
   cd ${_name}-${pkgver}
   python -m build --wheel --no-isolation