Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 3 to 4. No sources, checksums, build logic, install scripts, permissions, or dependencies changed, so there is no new security-relevant behavior to assess from this diff alone. This appears to be a metadata-only rebuild/release bump.

@@ -1,7 +1,7 @@
 pkgbase = vesktop-bin
 	pkgdesc = A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed.
 	pkgver = 1.6.7
-	pkgrel = 3
+	pkgrel = 4
 	url = https://vesktop.dev/
 	arch = aarch64
 	arch = x86_64

Comment

The change only updates .SRCINFO metadata: pkgrel is incremented from 3 to 4 and the sha256 checksum for the upstream icon.svg source is changed. There is no evidence of new sources, build-time execution, privilege escalation, or packaging logic changes in the provided diff. Based on the diff alone, this appears to be a routine checksum refresh/metadata update with no security impact.

@@ -20,7 +20,7 @@ pkgbase = vesktop-bin
 	source = vesktop.sh
 	source = vesktop.desktop
 	source = https://raw.githubusercontent.com/Vencord/Vesktop/refs/heads/main/build/icon.svg
-	sha256sums = 49d5f14ead3caa2b5ec11ae2496c053866d873eedcb14c1424b32132b0cd109b
+	sha256sums = db901fa9af0ce812f48ecba9c338162bd5b12f6586fefca2bc6b6509430ea351
 	sha256sums = 455c00b862aa0a7e18ca8e23d65d5c5ee4506cdfb15f1bf6f622cce39827de46
 	sha256sums = 7d0f9dbdb3c86f800577d7fb26a22defeb7025d10c405f634d3c2b939a75be7f
 	source_aarch64 = vesktop-1.6.7.tar.gz::https://github.com/Vencord/Vesktop/releases/download/v1.6.7/vesktop-1.6.7-arm64.tar.gz

Comment

The change only bumps pkgrel from 3 to 4 in PKGBUILD without altering sources, build steps, dependencies, install scripts, or packaging behavior. No security-relevant content changed in the reviewed hunk.

@@ -7,7 +7,7 @@ pkgname=vesktop-bin
 _pkgname=vesktop
 _appname=vencord-desktop
 pkgver=1.6.7
-pkgrel=3
+pkgrel=4
 pkgdesc="A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed."
 arch=(
     'aarch64'

Comment

The change only bumps pkgrel and updates the SHA256 checksum for the main upstream tarball in PKGBUILD. There are no new sources, no build-script changes, no added network fetches, and no packaging logic changes. The source URL remains the same HTTPS GitHub raw URL, and the diff does not introduce any suspicious execution or persistence behavior. This looks like a routine integrity checksum refresh for a repackaged upstream artifact.

@@ -39,7 +39,7 @@ source=(
     "https://raw.githubusercontent.com/Vencord/Vesktop/refs/heads/main/build/icon.svg"
 )
 noextract=("${_pkgname}-${pkgver}.tar.gz")
-sha256sums=('49d5f14ead3caa2b5ec11ae2496c053866d873eedcb14c1424b32132b0cd109b'
+sha256sums=('db901fa9af0ce812f48ecba9c338162bd5b12f6586fefca2bc6b6509430ea351'
             '455c00b862aa0a7e18ca8e23d65d5c5ee4506cdfb15f1bf6f622cce39827de46'
             '7d0f9dbdb3c86f800577d7fb26a22defeb7025d10c405f634d3c2b939a75be7f')
 sha256sums_aarch64=('152786c72cf97f510b3a527829568083dd5c79b723cf459c13d430b6ca385b66')

Comment

The change is low risk. It only adds a default assignment for XDG_CONFIG_HOME and simplifies comments; there is no new execution path, network access, privilege change, or packaging behavior. One minor concern is that the fallback uses a literal '~/.config' in shell parameter expansion, which is not expanded in POSIX sh when quoted/assigned this way, so it may cause the script to look for a path containing a tilde rather than the user's config directory if XDG_CONFIG_HOME is unset. That is a functional bug, not a security issue.

@@ -1,11 +1,9 @@
 #!/bin/sh
 set -e
 
-# 2. Load user-defined flags
-# The script checks for flags in the following order (later files override/append to earlier ones):
-# 1. System-wide Electron flags: $XDG_CONFIG_HOME/electron-flags.conf
-# 2. App-specific global flags: $XDG_CONFIG_HOME/@appname@-flags.conf
-# 3. App-specific directory flags: $XDG_CONFIG_HOME/@cfgdirname@/@appname@-flags.conf
+XDG_CONFIG_HOME=${XDG_CONFIG_HOME:-~/.config}
+
+# Load user-defined flags
 flags=""
 for _FLAGS_FILE in \
     "${XDG_CONFIG_HOME}/electron-flags.conf" \