Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.8.10 to 26.8.11. No source URLs, checksums, build steps, install scripts, permissions, or package metadata were altered, so there is no new security-relevant behavior introduced by this diff alone.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.8.10
+	pkgver = 26.8.11
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from v26.8.10 to v26.8.11. The source remains an HTTPS GitHub release asset from the same upstream project, with no new build steps, scripts, patches, or dependency changes introduced in this diff. No security red flags are visible in the provided hunk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.10/qownnotes-26.8.10.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.11/qownnotes-26.8.11.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: pkgver/tag and the release tarball checksum were updated. Source remains an HTTPS GitHub release URL pinned to a specific versioned tarball, with no new build steps, scripts, patches, or privilege/network red flags introduced. I did not find any evidence of supply-chain or packaging abuse in this diff.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.8.10
-tag="0c760589b9807418e14b8e7d2f2cf3232354b141"
+pkgver=26.8.11
+tag="7c7a6cc27273c108835a7d3188da60c45e0a0bf5"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in source=(). The download URL remains HTTPS and points to the official GitHub release asset for the pinned version, with no new build steps, scripts, or packaging behavior introduced. This is a low-risk integrity metadata update, assuming the new checksum matches the same upstream tarball.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('169e9d6878c5fcf18a504cd16b81f9e37df0368147aecb68e1ddd2937710518d')
+sha256sums=('d80aae760e20fb092b406cbc76f3f7fc2bd946c5597df6a3f132d31107f56a87')
 
 prepare() {
     cd "${pkgname}-${pkgver}"