Review Results

Comment

The change only updates the generated .SRCINFO pkgver from one git snapshot to a newer git snapshot. No source URLs, build commands, install scripts, permissions, or packaging logic changed, and there are no new integrity or execution red flags in the provided diff. On its face this is a routine version bump with no security impact visible in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = aquamarine-git
 	pkgdesc = Aquamarine is a very light linux rendering backend library
-	pkgver = 0.11.0.r10.gab2b0af
+	pkgver = 0.15.0.r0.g783bfd9
 	pkgrel = 1
 	url = https://github.com/hyprwm/aquamarine
 	arch = x86_64

Comment

The change only moves `hyprwayland-scanner-git` from `depends` to `makedepends` in `.SRCINFO`. This is a packaging metadata correction: the scanner is needed at build time, not runtime. It does not introduce new sources, scripts, permissions, or execution paths, and it reduces runtime dependency surface rather than increasing it. No security concern is evident from this diff alone.

@@ -8,11 +8,11 @@ pkgbase = aquamarine-git
 	license = BSD-3-Clause
 	makedepends = cmake
 	makedepends = git
+	makedepends = hyprwayland-scanner-git
 	makedepends = ninja
 	depends = gcc-libs
 	depends = glibc
 	depends = hyprutils-git
-	depends = hyprwayland-scanner-git
 	depends = libdisplay-info
 	depends = libdrm
 	depends = libglvnd

Comment

The change only updates the virtual provide version from aquamarine=0.11.0 to aquamarine=0.15.0 in .SRCINFO. This is metadata-only and does not alter sources, build steps, install scripts, permissions, or runtime behavior. No security-relevant issue is introduced by this diff alone.

@@ -25,7 +25,7 @@ pkgbase = aquamarine-git
 	depends = systemd-libs
 	depends = wayland
 	depends = wayland-protocols
-	provides = aquamarine=0.11.0
+	provides = aquamarine=0.15.0
 	provides = libaquamarine.so
 	conflicts = aquamarine
 	source = aquamarine::git+https://github.com/hyprwm/aquamarine.git

Comment

The change only bumps the VCS snapshot version string in PKGBUILD from 0.11.0.r10.gab2b0af to 0.15.0.r0.g783bfd9. No source URLs, build steps, install scripts, permissions, or packaging logic are modified, and there are no new integrity or execution red flags in the provided diff. This appears to be a routine version update with no security impact visible from the change shown.

@@ -4,7 +4,7 @@
 
 _pkgname="aquamarine"
 pkgname="$_pkgname-git"
-pkgver=0.11.0.r10.gab2b0af
+pkgver=0.15.0.r0.g783bfd9
 pkgrel=1
 pkgdesc="Aquamarine is a very light linux rendering backend library"
 arch=('x86_64' 'aarch64')

Comment

The change only moves hyprwayland-scanner-git from runtime depends to makedepends. That is a packaging dependency correction and does not introduce any new code execution, network access, privilege escalation, or integrity risk. The rest of the PKGBUILD remains unchanged and still sources from the upstream GitHub repository over HTTPS with SKIP checksums as expected for a -git package.

@@ -15,7 +15,6 @@ depends=(
   gcc-libs
   glibc
   hyprutils-git
-  hyprwayland-scanner-git
   libdisplay-info
   libdrm
   libglvnd

Comment

The change only moves `hyprwayland-scanner-git` from `depends` to `makedepends`, which is a normal packaging correction for a build-time code generator. The source remains a pinned git URL to the official upstream repository, there are no new network fetches, scripts, privilege changes, or install-time persistence mechanisms. No security concern is evident from this diff.

@@ -32,6 +31,7 @@ depends=(
 makedepends=(
   cmake
   git
+  hyprwayland-scanner-git
   ninja
 )