Review Results

Comment

The change is limited to metadata in .SRCINFO: pkgrel bump, homepage URL update from the upstream GitHub repo to the project site, and a license identifier correction from GPL-3.0-only to GPL-3.0-or-later. No build logic, sources, install scripts, or shipped artifacts are changed, and there are no new network, privilege, or persistence concerns introduced by this diff. Low risk.

@@ -1,11 +1,11 @@
 pkgbase = vesktop-bin
 	pkgdesc = A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed.(Prebuilt version.Use system-wide electron)
 	pkgver = 1.6.7
-	pkgrel = 1
-	url = https://github.com/Vencord/Vesktop
+	pkgrel = 2
+	url = https://vesktop.dev/
 	arch = aarch64
 	arch = x86_64
-	license = GPL-3.0-only
+	license = GPL-3.0-or-later
 	depends = electron43
 	depends = debugedit
 	optdepends = speech-dispatcher: High-level device independent layer for speech synthesis interface

Comment

The change is low risk. It only updates pkgrel, switches the homepage URL to the project site, adds a separate _ghurl variable for the actual GitHub release download source, and relaxes the declared license from GPL-3.0-only to GPL-3.0-or-later. The download URLs still point to the official upstream GitHub release assets over HTTPS, with no new build-time network access, scripts, or privilege-related changes. No suspicious sources, execution, or packaging behavior were introduced.

@@ -6,14 +6,15 @@ _pkgname=Vesktop
 _appname=vencord-desktop
 pkgver=1.6.7
 _electronversion=43
-pkgrel=1
+pkgrel=2
 pkgdesc="A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed.(Prebuilt version.Use system-wide electron)"
 arch=(
     'aarch64'
     'x86_64'
 )
-url="https://github.com/Vencord/Vesktop"
-license=('GPL-3.0-only')
+url="https://vesktop.dev/"
+_ghurl="https://github.com/Vencord/Vesktop"
+license=('GPL-3.0-or-later')
 provides=(
     "${pkgname%-bin}=${pkgver}"
     "${_appname}=${pkgver}"

Comment

The change only switches the RPM source URLs from `${url}` to a new `_ghurl` variable that still points to the official GitHub upstream, while also updating the project homepage/license metadata and bumping pkgrel. There is no new code execution, no new network behavior beyond the existing pinned release downloads, and no suspicious install script or packaging logic introduced in this hunk. Risk is low.

@@ -29,8 +30,8 @@ depends=(
 optdepends=(
     'speech-dispatcher: High-level device independent layer for speech synthesis interface'
 )
-source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}.aarch64.rpm")
-source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}.x86_64.rpm")
+source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::${_ghurl}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}.aarch64.rpm")
+source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::${_ghurl}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}.x86_64.rpm")
 source=("${pkgname%-bin}.sh")
 sha256sums=('a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
 sha256sums_aarch64=('642473098904feb424aafc0d97d33d20d8c2596186cdfc6e9866fa6bfc6d531d')

Comment

The diff is non-functional: it only removes the trailing newline at end of PKGBUILD. No build logic, sources, install scripts, permissions, or packaging behavior changed. This does not introduce any security risk.

@@ -70,4 +71,4 @@ package() {
 		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
 		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
 	done
-}
+}
\ No newline at end of file