Review Results

Comment

The only change in this diff is a version bump in .SRCINFO from 3.6.15 to 3.6.16. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were modified in the provided hunk. On its face this is a routine upstream version update with no security-relevant red flags in the reviewed change.

@@ -1,6 +1,6 @@
 pkgbase = joplin
 	pkgdesc = A note taking and to-do application with synchronization capabilities
-	pkgver = 3.6.15
+	pkgver = 3.6.16
 	pkgrel = 1
 	url = https://joplinapp.org/
 	arch = x86_64

Comment

The change is a routine version bump in .SRCINFO: it updates the upstream tarball from 3.6.15 to 3.6.16 and aligns the Electron dependency from 41 to 42. The source remains the official GitHub release archive over HTTPS, with a matching checksum update. No new sources, scripts, install hooks, or packaging behavior are introduced in this diff, so there is no evident security concern in the reviewed hunk.

@@ -13,16 +13,16 @@ pkgbase = joplin
 	makedepends = python-setuptools
 	makedepends = libxcrypt-compat
 	makedepends = corepack
-	depends = electron41
+	depends = electron42
 	depends = nodejs>20
 	depends = libvips
 	optdepends = libappindicator-gtk3: for tray icon
 	source = joplin-desktop.sh
 	source = joplin-desktop.desktop
-	source = joplin-3.6.15.tar.gz::https://github.com/laurent22/joplin/archive/v3.6.15.tar.gz
+	source = joplin-3.6.16.tar.gz::https://github.com/laurent22/joplin/archive/v3.6.16.tar.gz
 	sha256sums = 9223cc816f8175ddaf8839f9357d2bd1c4831692504927c98d8e1eefa7df796e
 	sha256sums = f485c089904d91750d137d4413297676446e0068892cb08e20bee928bcac516c
-	sha256sums = 8ed300da2e71effb5550cee66e5e77d082d8dcf93c2914c5d1cb6fac58e6ffbc
+	sha256sums = f88de7ccc464dcab925966e35ffa4a061551593749589ef74ce4683977df8c35
 
 pkgname = joplin
 	pkgdesc = A note taking and to-do application with synchronization capabilities - CLI App

Comment

The change is a one-line dependency bump in .SRCINFO from electron41 to electron42 for the desktop package. This is metadata only and does not introduce new sources, scripts, permissions, or install-time behavior. No security red flags are present in the provided diff hunk.

@@ -31,7 +31,7 @@ pkgname = joplin
 
 pkgname = joplin-desktop
 	pkgdesc = A note taking and to-do application with synchronization capabilities - Desktop
-	depends = electron41
+	depends = electron42
 	depends = nodejs
 	depends = libvips
 	optdepends = libappindicator-gtk3: for tray icon

Comment

The change is a routine version bump of the upstream tarball from 3.6.15 to 3.6.16, along with the corresponding Electron major version bump from 41 to 42 and updated source checksum. The source remains an HTTPS GitHub release archive from the official upstream project, and there are no new build-time network calls, privilege changes, install-script additions, or packaging red flags introduced by this diff. No security issue is evident in the reviewed hunk.

@@ -8,10 +8,10 @@
 pkgbase=joplin
 pkgname=('joplin' 'joplin-desktop')
 pkgdesc="A note taking and to-do application with synchronization capabilities"
-pkgver=3.6.15
+pkgver=3.6.16
 groups=('joplin')
 pkgrel=1
-_electronVersion=41
+_electronVersion=42
 depends=("electron${_electronVersion}" "nodejs>20" "libvips")
 optdepends=('libappindicator-gtk3: for tray icon')
 arch=('x86_64' 'aarch64')

Comment

The change is a straightforward version bump for joplin/joplin-desktop and an updated checksum for the corresponding source tarball. The diff does not introduce new sources, network fetches, build commands, privilege changes, or packaging/install-script behavior. I did not see any security-relevant red flags in the reviewed hunk.

@@ -25,7 +25,7 @@ source=(
 )
 sha256sums=('9223cc816f8175ddaf8839f9357d2bd1c4831692504927c98d8e1eefa7df796e'
             'f485c089904d91750d137d4413297676446e0068892cb08e20bee928bcac516c'
-            '8ed300da2e71effb5550cee66e5e77d082d8dcf93c2914c5d1cb6fac58e6ffbc')
+            'f88de7ccc464dcab925966e35ffa4a061551593749589ef74ce4683977df8c35')
 
 _setup_env() {
     export YARN_CACHE_FOLDER="${srcdir}/yarn-cache"