Review Results

Comment

This is a routine version bump in .SRCINFO for the official Visual Studio Code binary package. The source URLs remain HTTPS and point to the upstream Microsoft update endpoint, and the checksums were updated accordingly. No new sources, scripts, install hooks, or packaging behavior changed in this diff, so there is no evident security regression in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = visual-studio-code-bin
 	pkgdesc = Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)
-	pkgver = 1.136.0
+	pkgver = 1.136.1
 	pkgrel = 1
 	url = https://code.visualstudio.com/
 	install = visual-studio-code-bin.install

Comment

The change is a routine version bump in .SRCINFO from VS Code 1.136.0 to 1.136.1, with corresponding updated SHA-256 checksums for the official Microsoft download URLs. The sources remain HTTPS and point to the expected upstream update endpoint, with no new scripts, patches, or build logic introduced. No security-relevant red flags are present in this diff alone.

@@ -31,11 +31,11 @@ pkgbase = visual-studio-code-bin
 	options = !strip
 	source = visual-studio-code-bin.sh
 	sha256sums = bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad
-	source_x86_64 = code_1.136.0_amd64.deb::https://update.code.visualstudio.com/1.136.0/linux-deb-x64/stable
-	sha256sums_x86_64 = 7cc48f2cd51640c7c098740fa3f566dcbdbe5b47e91e86aaecec9d109e3631d3
-	source_aarch64 = code_1.136.0_arm64.deb::https://update.code.visualstudio.com/1.136.0/linux-deb-arm64/stable
-	sha256sums_aarch64 = f92d9cf4602efe15107bca44b47e9a16765829c755b60c3c1f3975e551798618
-	source_armv7h = code_1.136.0_armhf.deb::https://update.code.visualstudio.com/1.136.0/linux-deb-armhf/stable
-	sha256sums_armv7h = aabb727fa1914c90dd8f50aa90d3079a63d3fac09fe4219ccf634b3867644eb1
+	source_x86_64 = code_1.136.1_amd64.deb::https://update.code.visualstudio.com/1.136.1/linux-deb-x64/stable
+	sha256sums_x86_64 = 4463c4e249a19d7746603f2ec3745c345d3cd55b009d36e824158d15c35509ef
+	source_aarch64 = code_1.136.1_arm64.deb::https://update.code.visualstudio.com/1.136.1/linux-deb-arm64/stable
+	sha256sums_aarch64 = baa72f92d3feaa76d015202c57271475ea15809e635587279171a972cdd612a4
+	source_armv7h = code_1.136.1_armhf.deb::https://update.code.visualstudio.com/1.136.1/linux-deb-armhf/stable
+	sha256sums_armv7h = 02ddb5c5cbc2d5f4db25a3d7bb365c60eef0a017fa64b1994b131544677319e3
 
 pkgname = visual-studio-code-bin

Comment

The change is a routine version bump for the official Visual Studio Code binary package, with updated per-architecture SHA256 checksums for the new upstream release. The source URLs remain HTTPS and point to the official Microsoft update endpoint, and there are no new build steps, scripts, or privilege/persistence mechanisms introduced in this diff. No security issues are evident from the reviewed hunk.

@@ -2,7 +2,7 @@
 
 pkgname=visual-studio-code-bin
 _pkgname=visual-studio-code
-pkgver=1.136.0
+pkgver=1.136.1
 pkgrel=1
 pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)"
 arch=('x86_64' 'aarch64' 'armv7h')

Comment

The change only updates the SHA-256 checksums for the prebuilt upstream .deb payloads in source_x86_64/aarch64/armv7h. The download URLs remain the official HTTPS Visual Studio Code update endpoints, and there are no new build-time commands, install-script changes, or packaging behavior changes in this hunk. This is a normal integrity update to track a new upstream release artifact, with no obvious security red flags in the diff itself.

@@ -27,9 +27,9 @@ source_x86_64=(code_${pkgver}_amd64.deb::https://update.code.visualstudio.com/${
 source_aarch64=(code_${pkgver}_arm64.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-arm64/stable)
 source_armv7h=(code_${pkgver}_armhf.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-armhf/stable)
 sha256sums=('bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad')
-sha256sums_x86_64=('7cc48f2cd51640c7c098740fa3f566dcbdbe5b47e91e86aaecec9d109e3631d3')
-sha256sums_aarch64=('f92d9cf4602efe15107bca44b47e9a16765829c755b60c3c1f3975e551798618')
-sha256sums_armv7h=('aabb727fa1914c90dd8f50aa90d3079a63d3fac09fe4219ccf634b3867644eb1')
+sha256sums_x86_64=('4463c4e249a19d7746603f2ec3745c345d3cd55b009d36e824158d15c35509ef')
+sha256sums_aarch64=('baa72f92d3feaa76d015202c57271475ea15809e635587279171a972cdd612a4')
+sha256sums_armv7h=('02ddb5c5cbc2d5f4db25a3d7bb365c60eef0a017fa64b1994b131544677319e3')
 
 package() {
   bsdtar -xf data.tar.xz -C "${pkgdir}/"