Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 1.3.18.2 to 1.3.18.3. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust were modified in the provided hunk. Based on this diff alone, there is no security signal.

@@ -1,6 +1,6 @@
 pkgbase = aseprite
 	pkgdesc = Create animated sprites and pixel art
-	pkgver = 1.3.18.2
+	pkgver = 1.3.18.3
 	pkgrel = 1
 	url = https://www.aseprite.org/
 	arch = x86_64

Comment

The change only bumps the upstream release artifact from Aseprite v1.3.18.2 to v1.3.18.3 in .SRCINFO. The source remains an HTTPS GitHub release URL, and the other pinned sources are unchanged. No new build steps, scripts, or integrity red flags are introduced by this metadata-only update. Based on the provided diff, this is low risk.

@@ -32,9 +32,9 @@ pkgbase = aseprite
 	depends = fontconfig
 	depends = libxcursor
 	depends = libxrandr
-	noextract = Aseprite-v1.3.18.2-Source.zip
+	noextract = Aseprite-v1.3.18.3-Source.zip
 	noextract = skia-m124.tar.gz
-	source = https://github.com/aseprite/aseprite/releases/download/v1.3.18.2/Aseprite-v1.3.18.2-Source.zip
+	source = https://github.com/aseprite/aseprite/releases/download/v1.3.18.3/Aseprite-v1.3.18.3-Source.zip
 	source = skia-m124.tar.gz::https://github.com/aseprite/skia/archive/refs/tags/m124-08a5439a6b.tar.gz
 	source = skia-m124-icu::git+https://chromium.googlesource.com/chromium/deps/icu.git#commit=a0718d4f121727e30b8d52c7a189ebf5ab52421f
 	source = aseprite-strings::git+https://github.com/aseprite/strings.git#commit=b43be33343efa40c1c4bda00f985b8cd83bddf2a

Comment

The change only updates the SHA-256 checksum for one existing source/patch entry in .SRCINFO. There is no evidence of new sources, network fetches, privilege changes, install-script behavior, or packaging logic changes in the provided diff. On its face this is a routine integrity metadata update, though the underlying file content is not shown here, so the review is limited to the checksum refresh itself.

@@ -50,7 +50,7 @@ pkgbase = aseprite
 	source = shared_libjpeg-turbo.patch
 	source = change_use_of_removed_intrinsic.patch
 	source = fmt-12.2.0-include-format.patch
-	sha256sums = 5729921c1b22f5ad0577a558c8ebf3f3d00a088d82972c45905954eda9c68ab1
+	sha256sums = 268693d1750c4f9f61c9c866f10b993ddfc88424c9dead2a2f66ebb7576b192e
 	sha256sums = c2a567d6b8bb933a92615cbdee0de268d02c3a06863337ee8822eedab9ed66ba
 	sha256sums = b52f179a687ef2f91a52b696ab6581f4a37df5e88cb22040fa1ec6567cf0ebb1
 	sha256sums = 80471354d55d785291bb719596d37ec785e01e94a322f127c0f91d2d8b01be0f

Comment

The change is a simple version bump in PKGBUILD from 1.3.18.2 to 1.3.18.3 with no accompanying changes to source URLs, checksums, build logic, install scripts, or packaging behavior in the provided diff hunk. On its face this does not introduce any new security risk.

@@ -10,7 +10,7 @@
 # Contributor: Jomar Milan <jomarm@jomarm.com>
 
 pkgname=aseprite
-pkgver=1.3.18.2
+pkgver=1.3.18.3
 _skiaver=m124
 _skiahash=08a5439a6b
 pkgrel=1

Comment

The change only updates the SHA-256 checksum for the upstream Aseprite source archive in PKGBUILD. This is a normal integrity pinning update and does not introduce new sources, commands, build steps, or packaging behavior. No security red flags are evident from this diff hunk alone.

@@ -63,7 +63,7 @@ source=("https://github.com/aseprite/aseprite/releases/download/v$pkgver/Aseprit
         fmt-12.2.0-include-format.patch)
 noextract=("Aseprite-v$pkgver-Source.zip"
            "skia-$_skiaver.tar.gz") # Don't extract Aseprite or skia sources at the root
-sha256sums=('5729921c1b22f5ad0577a558c8ebf3f3d00a088d82972c45905954eda9c68ab1'
+sha256sums=('268693d1750c4f9f61c9c866f10b993ddfc88424c9dead2a2f66ebb7576b192e'
             'c2a567d6b8bb933a92615cbdee0de268d02c3a06863337ee8822eedab9ed66ba'
             'b52f179a687ef2f91a52b696ab6581f4a37df5e88cb22040fa1ec6567cf0ebb1'
             '80471354d55d785291bb719596d37ec785e01e94a322f127c0f91d2d8b01be0f'