Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 3.10.2 to 3.11. No source URLs, checksums, build steps, install scripts, permissions, or dependency metadata are changed here. On its face this is a routine upstream version update with no direct security red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = pandoc-bin
 	pkgdesc = Conversion between documentation formats
-	pkgver = 3.10.2
+	pkgver = 3.11
 	pkgrel = 1
 	url = https://pandoc.org
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for pandoc-bin, updating provides and source/checksum entries from 3.10.2 to 3.11. The sources remain HTTPS GitHub release/archive URLs, there are no new build-time downloads, scripts, privilege changes, or suspicious metadata additions. No security-relevant behavior is introduced by this diff alone.

@@ -15,16 +15,16 @@ pkgbase = pandoc-bin
 	optdepends = texlive-fontsrecommended: for pdf output using latex or xelatex engines
 	optdepends = texlive-latex: for pdf output using pdflatex engine
 	optdepends = texlive-xetex: for pdf output using xelatex engine
-	provides = pandoc=3.10.2
-	provides = pandoc-cli=3.10.2
+	provides = pandoc=3.11
+	provides = pandoc-cli=3.11
 	conflicts = pandoc-cli
 	options = !debug
 	options = !strip
-	source = pandoc-bin-3.10.2.tar.gz::https://github.com/jgm/pandoc/archive/3.10.2.tar.gz
-	sha256sums = ec4c5d36e355785802601986637369ada24079ac20af6c0ee85c79502d77b3f0
-	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.10.2/pandoc-3.10.2-linux-amd64.tar.gz
-	sha256sums_x86_64 = c7edd535941c48be6a362081a748272837de81ae11777202d9c341d3d8261c9a
-	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.10.2/pandoc-3.10.2-linux-arm64.tar.gz
-	sha256sums_aarch64 = 1c4d69f2a092bd47cb180e58a4aab7b9637101ced928252458c7d41a7f7fa71d
+	source = pandoc-bin-3.11.tar.gz::https://github.com/jgm/pandoc/archive/3.11.tar.gz
+	sha256sums = 61d05e7fc57e995a61367bee1bb73a8bb278cda3c787b7e4e27b30037e17aeed
+	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.11/pandoc-3.11-linux-amd64.tar.gz
+	sha256sums_x86_64 = 37edb3bbcf722f921a009941bf5874e2e0c09263226c9b4a2d980788cb062ab6
+	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.11/pandoc-3.11-linux-arm64.tar.gz
+	sha256sums_aarch64 = 56ed5566ec41d22ec9ee0704e6ac0b98ba102e92384efd5306173a22d314c79a
 
 pkgname = pandoc-bin

Comment

The change only bumps pkgver from 3.10.2 to 3.11 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or dependency logic were modified in the provided diff, so there is no new security concern visible from this change alone.

@@ -1,5 +1,5 @@
 pkgname=pandoc-bin
-pkgver=3.10.2
+pkgver=3.11
 pkgrel=1
 pkgdesc="Conversion between documentation formats"
 url="https://pandoc.org"

Comment

Low risk change. The update bumps pandoc-bin from 3.10.2 to 3.11 and refreshes the pinned SHA-256 checksums for the upstream source tarball and prebuilt architecture-specific release archives. The only code change is switching the completion-generation flag from `--bash-completion` to the newer `--completion=bash`, which is a benign CLI compatibility update. Sources remain HTTPS on the official GitHub upstream, and there are no new build-time downloads, privilege escalations, install-script changes, or suspicious packaging behaviors introduced by this diff.

@@ -25,9 +25,9 @@ source=("$pkgname-$pkgver.tar.gz::https://github.com/jgm/pandoc/archive/${pkgver
 source_x86_64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-amd64.tar.gz")
 source_aarch64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-arm64.tar.gz")
 
-sha256sums=('ec4c5d36e355785802601986637369ada24079ac20af6c0ee85c79502d77b3f0')
-sha256sums_x86_64=('c7edd535941c48be6a362081a748272837de81ae11777202d9c341d3d8261c9a')
-sha256sums_aarch64=('1c4d69f2a092bd47cb180e58a4aab7b9637101ced928252458c7d41a7f7fa71d')
+sha256sums=('61d05e7fc57e995a61367bee1bb73a8bb278cda3c787b7e4e27b30037e17aeed')
+sha256sums_x86_64=('37edb3bbcf722f921a009941bf5874e2e0c09263226c9b4a2d980788cb062ab6')
+sha256sums_aarch64=('56ed5566ec41d22ec9ee0704e6ac0b98ba102e92384efd5306173a22d314c79a')
 
 package() {
   cd "${srcdir}/pandoc-${pkgver}"

Comment

The change is a one-line packaging fix that switches pandoc’s completion generation from the deprecated `--bash-completion` flag to the current `--completion=bash` form. It does not introduce new sources, network access, privilege changes, filesystem writes outside `$pkgdir`, or any other security-relevant behavior. The package still only runs the locally built `bin/pandoc` during packaging to generate a completion file, which is expected.

@@ -36,7 +36,7 @@ package() {
   cp -R bin share "${pkgdir}/usr"
   cp -R data citeproc "${pkgdir}/usr/share/pandoc/"
   cp COPYRIGHT MANUAL.txt "${pkgdir}/usr/share/pandoc/"
-  bin/pandoc --bash-completion | \
+  bin/pandoc --completion=bash | \
     install -Dm644 /dev/stdin "$pkgdir"/usr/share/bash-completion/completions/pandoc
 }