Review Results

Comment

The change only bumps pkgver in .SRCINFO from 26.8.8 to 26.8.9. No sources, checksums, build logic, install scripts, or package metadata affecting execution/persistence were changed in the provided diff. On its face this is a routine version update with no security-relevant indicators.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.8.8
+	pkgver = 26.8.9
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from 26.8.8 to 26.8.9, with the source URL updated to the corresponding GitHub release tarball. No new sources, scripts, build steps, or packaging metadata that would introduce privilege escalation, persistence, or integrity issues are present in this diff. Based on the provided hunk alone, this appears low risk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.8/qownnotes-26.8.8.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.9/qownnotes-26.8.9.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump for qownnotes: it updates pkgver, the pinned upstream commit/tag, and the source tarball checksum. The source remains an HTTPS GitHub release tarball, and there are no new build steps, network fetches, install scripts, privilege changes, or packaging red flags introduced by this diff. Based on the provided hunk alone, this appears low risk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.8.8
-tag="f89299e265dcc941a215891361b98f43b87a7001"
+pkgver=26.8.9
+tag="75a2c592ae840b72ace6a7e405dd5963e0e5d5e0"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains HTTPS and points to the official GitHub release asset, with no new build steps, scripts, or packaging logic introduced. I do not see any added supply-chain, persistence, or privilege-escalation risk in this diff.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('8b812eebc65b5a4f2a2bed03e00a96aa9a8cfee99e023f62a137e296c4be2d35')
+sha256sums=('a13969fbc4869e813ad6e5db6bbd0b0a67dfb36e10ec3242985f91baeed70360')
 
 prepare() {
     cd "${pkgname}-${pkgver}"