Review Results

Comment

The only change in the provided diff is a version bump in .SRCINFO from 26.8.11 to 26.9.0. No source URLs, build logic, install scripts, permissions, or package metadata beyond pkgver are changed in the reviewed hunk. Based on this diff alone, there are no security red flags.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.8.11
+	pkgver = 26.9.0
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change only updates the upstream release tarball URL in .SRCINFO from v26.8.11 to v26.9.0. The source remains an HTTPS GitHub release asset from the official upstream project, with no added build-time commands, scripts, or integrity regressions visible in this diff. No suspicious new dependencies, install hooks, or privilege-related changes are introduced here. Based on the provided hunk alone, this is low risk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.8.11/qownnotes-26.8.11.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.0/qownnotes-26.9.0.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change only bumps qownnotes from 26.8.11 to 26.9.0 and updates the pinned upstream tag and source checksum accordingly. The source remains an HTTPS GitHub release tarball, there are no new build-time downloads, scripts, privilege changes, or packaging logic changes in the reviewed hunk. No security red flags are introduced by this version bump alone.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.8.11
-tag="7c7a6cc27273c108835a7d3188da60c45e0a0bf5"
+pkgver=26.9.0
+tag="5206718b3f8acb0f3161b5e6733622d7f795730e"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains HTTPS and points to the official GitHub release asset for the pinned version, with no new build steps, scripts, or network-fetching behavior introduced. I did not find any indication of malicious packaging changes in this diff hunk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('d80aae760e20fb092b406cbc76f3f7fc2bd946c5597df6a3f132d31107f56a87')
+sha256sums=('1669336f29b00533ad78cc193fe5e197edcffdc14a636d3a4320e7eb017571fa')
 
 prepare() {
     cd "${pkgname}-${pkgver}"