Review Results

Comment

The change only bumps pkgver in .SRCINFO from 2.13.0 to 2.14.0. No source URLs, build logic, install scripts, or packaging metadata affecting execution/persistence were altered in the provided diff hunk. On its face this is a routine version update with no security-relevant red flags in the reviewed change.

@@ -1,6 +1,6 @@
 pkgbase = todotxt
 	pkgdesc = Simple and extensible shell script for managing your todo.txt file
-	pkgver = 2.13.0
+	pkgver = 2.14.0
 	pkgrel = 1
 	url = https://github.com/todotxt/todo.txt-cli
 	install = todotxt.install

Comment

The change is a straightforward upstream version bump in .SRCINFO from todotxt 2.13.0 to 2.14.0, with the source URL remaining on GitHub over HTTPS and the checksum updated accordingly. No new sources, scripts, build steps, or packaging metadata that would suggest privilege escalation, persistence, or integrity bypass were introduced in this diff. Based on the provided hunk alone, this appears low risk.

@@ -8,7 +8,7 @@ pkgbase = todotxt
 	license = GPL-3.0-or-later
 	makedepends = git
 	optdepends = bash-completion: tab completion
-	source = todotxt-2.13.0.tar.gz::https://github.com/todotxt/todo.txt-cli//archive/refs/tags/v2.13.0.tar.gz
-	sha256sums = 848a07b7dc9a156bea372922a0cfafc9e761c9b18d8b0809703bc1bc98363605
+	source = todotxt-2.14.0.tar.gz::https://github.com/todotxt/todo.txt-cli/archive/refs/tags/v2.14.0.tar.gz
+	sha256sums = fb1a783a24c908419f3b43f855ef5749db7e90ed55ba4cd4cbd9cea2b1537e8c
 
 pkgname = todotxt

Comment

Risk is low. The change only bumps pkgver from 2.13.0 to 2.14.0 and updates the source checksum accordingly. The source remains the official GitHub release tarball over HTTPS, pinned to a tag, with no new build steps, scripts, patches, or privilege/network red flags introduced by this diff. I did not see any packaging behavior changes beyond the version/hash refresh.

@@ -4,7 +4,7 @@
 
 _srcname=todo.txt-cli
 pkgname=todotxt
-pkgver=2.13.0
+pkgver=2.14.0
 pkgrel=1
 pkgdesc='Simple and extensible shell script for managing your todo.txt file'
 arch=(any)

Comment

The change is a straightforward upstream version bump from 2.13.0 to 2.14.0 with the corresponding source tarball checksum update. The source remains an HTTPS GitHub release archive pinned to a tag, and there are no new build-time downloads, scripts, privilege changes, or packaging red flags in the diff. No security concerns are evident from this change alone.

@@ -14,7 +14,7 @@ makedepends=(git)
 optdepends=('bash-completion: tab completion')
 install=$pkgname.install
 source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('848a07b7dc9a156bea372922a0cfafc9e761c9b18d8b0809703bc1bc98363605')
+sha256sums=('fb1a783a24c908419f3b43f855ef5749db7e90ed55ba4cd4cbd9cea2b1537e8c')
 
 prepare() {
   # Rename completion file to "todo.sh"