Review Results

Comment

The change is a simple version bump in .SRCINFO from 26.8.9 to 26.8.10 with no accompanying changes to sources, build logic, install scripts, or package metadata beyond pkgver. On its face this does not introduce any new attack surface or integrity concern. I did not see any suspicious source URLs, build-time downloads, privilege changes, or packaging behavior changes in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.8.9
+	pkgver = 26.8.10
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball URL from v26.8.9 to v26.8.10. No new sources, scripts, build steps, permissions, or packaging metadata were introduced, and the source remains an HTTPS GitHub release artifact. Based on the provided diff alone, this does not add any security risk beyond the usual trust in the upstream release and checksum verification already implied by the package metadata.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.9/qownnotes-26.8.9.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.10/qownnotes-26.8.10.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump for a source tarball and corresponding checksum update. The source remains an HTTPS GitHub release URL, the version is pinned to a specific release artifact, and there are no new build-time downloads, scripts, privilege changes, or packaging behavior changes in the diff. No security-relevant red flags are introduced by this hunk alone.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.8.9
-tag="75a2c592ae840b72ace6a7e405dd5963e0e5d5e0"
+pkgver=26.8.10
+tag="0c760589b9807418e14b8e7d2f2cf3232354b141"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in source=(). The source remains an HTTPS GitHub release URL pinned to the package version, with no new build steps, scripts, or privilege/network changes. I did not find any additional red flags in this diff hunk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('a13969fbc4869e813ad6e5db6bbd0b0a67dfb36e10ec3242985f91baeed70360')
+sha256sums=('169e9d6878c5fcf18a504cd16b81f9e37df0368147aecb68e1ddd2937710518d')
 
 prepare() {
     cd "${pkgname}-${pkgver}"