Review Results

Comment

The change only bumps the generated pkgver in .SRCINFO from one upstream git snapshot to a newer one. No build logic, sources, install scripts, permissions, or dependencies are modified in this diff, and the upstream URL remains the official GitHub repository. On the provided evidence this is a routine version refresh with no security red flags.

@@ -1,6 +1,6 @@
 pkgbase = hyprland-git
 	pkgdesc = Hyprland is an independent, highly customizable, dynamic tiling Wayland compositor that doesn't sacrifice on its looks
-	pkgver = 0.56.2.r128.g86c24e2
+	pkgver = 0.56.2.r130.g4a4a527
 	pkgrel = 1
 	url = https://github.com/hyprwm/Hyprland
 	arch = x86_64

Comment

The change only adds a new makedepends entry in .SRCINFO for hyprwayland-scanner-git and updates the generated pkgver. This is a metadata-only change with no evidence of malicious behavior, privilege escalation, network fetching outside declared sources, or packaging/install-script changes. The new dependency name is consistent with the Hyprland ecosystem and does not by itself introduce a security concern in the reviewed diff.

@@ -10,6 +10,7 @@ pkgbase = hyprland-git
 	makedepends = git
 	makedepends = glaze
 	makedepends = hyprland-protocols-git
+	makedepends = hyprwayland-scanner-git
 	makedepends = ninja
 	makedepends = xorgproto
 	depends = aquamarine-git

Comment

The change only bumps the VCS pkgver string in PKGBUILD from 0.56.2.r128.g86c24e2 to 0.56.2.r130.g4a4a527. No source URLs, build steps, install scripts, permissions, or packaging logic changed, and there are no new integrity or execution concerns visible in this diff. This is a routine version update with negligible security risk.

@@ -5,7 +5,7 @@
 
 _pkgname="hyprland"
 pkgname="$_pkgname-git"
-pkgver=0.56.2.r128.g86c24e2
+pkgver=0.56.2.r130.g4a4a527
 pkgrel=1
 pkgdesc="Hyprland is an independent, highly customizable, dynamic tiling Wayland compositor that doesn't sacrifice on its looks"
 arch=('x86_64' 'aarch64')

Comment

The change only adds a new makedependency, `hyprwayland-scanner-git`, to build Hyprland from source. This does not alter runtime behavior, install scripts, permissions, or introduce any direct network fetches beyond the existing VCS-based build flow. The added dependency is consistent with the project’s Wayland build tooling and does not by itself indicate a supply-chain or privilege-escalation issue. No suspicious sources, scripts, or packaging actions are introduced in this diff.

@@ -69,6 +69,7 @@ makedepends=(
   git
   glaze
   hyprland-protocols-git
+  hyprwayland-scanner-git
   ninja
   #patch
   #pkgconf