Review Results

Comment

Low risk change. The diff only moves `hyprwayland-scanner-git` from runtime `depends` to `makedepends`, which is the correct packaging classification for a build-time code generator and reduces unnecessary runtime dependency surface. No new sources, scripts, permissions, or execution paths are introduced, and there is no indication of malicious behavior in this metadata-only change.

@@ -8,6 +8,7 @@ pkgbase = hyprtoolkit-git
 	license = BSD-3-Clause
 	makedepends = cmake
 	makedepends = git
+	makedepends = hyprwayland-scanner-git
 	makedepends = ninja
 	depends = abseil-cpp
 	depends = aquamarine-git

Comment

Low risk change. The diff only moves `hyprwayland-scanner-git` from runtime `depends` to `makedepends`, which is consistent with a build-time code generator and reduces the installed dependency set. No new sources, scripts, permissions, or execution paths are introduced in this `.SRCINFO`-only change.

@@ -16,7 +17,6 @@ pkgbase = hyprtoolkit-git
 	depends = hyprgraphics-git
 	depends = hyprlang-git
 	depends = hyprutils-git
-	depends = hyprwayland-scanner-git
 	depends = libdrm
 	depends = libxkbcommon
 	depends = pango

Comment

The change only moves hyprwayland-scanner-git from depends() to makedepends(). That is a packaging metadata adjustment, not a code-execution or integrity change. The package still uses an HTTPS git source pinned by the VCS checkout, and there are no added install scripts, patches, binaries, or build-time network fetches in this diff. Security impact is negligible.

@@ -17,7 +17,6 @@ depends=(
   hyprgraphics-git
   hyprlang-git
   hyprutils-git
-  hyprwayland-scanner-git
   libdrm
   libxkbcommon
   pango

Comment

The change only moves `hyprwayland-scanner-git` from `depends` to `makedepends`. That reduces runtime dependency surface and does not introduce any new code execution, network fetches, privilege changes, or packaging red flags. The package still sources from the official upstream GitHub repo over HTTPS and builds in the normal CMake/Ninja flow. No security concern is apparent from this diff alone.

@@ -27,6 +26,7 @@ depends=(
 makedepends=(
   cmake
   git
+  hyprwayland-scanner-git
   ninja
 )