Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 26.9.0 to 26.9.1 with no other metadata, source, dependency, or build-script changes shown. On its face this does not introduce any new security risk; it only updates the recorded package version. No suspicious URLs, scripts, or packaging behavior are present in the reviewed diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.0
+	pkgver = 26.9.1
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from 26.9.0 to 26.9.1. The source remains an HTTPS GitHub release artifact from the same upstream project, with no new build steps, scripts, dependencies, or packaging behavior introduced by this diff. No security red flags are evident in the provided hunk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.0/qownnotes-26.9.0.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.1/qownnotes-26.9.1.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: pkgver/tag and the release tarball checksum were updated to match a new GitHub release. The source remains an HTTPS download from the official upstream project, with no new build steps, no added scripts, no network-at-build behavior, and no packaging/persistence red flags in the diff. Based on the provided hunk alone, this looks low risk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.0
-tag="5206718b3f8acb0f3161b5e6733622d7f795730e"
+pkgver=26.9.1
+tag="984ea5caabcb0edef2acfc7e028d5c9b895ecec3"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in source=(). The download remains on the official GitHub release URL over HTTPS, there are no new build steps, scripts, patches, or packaging changes, and no evidence of added network access or privilege escalation. This is a routine integrity update for a new upstream tarball and does not introduce security concerns by itself.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('1669336f29b00533ad78cc193fe5e197edcffdc14a636d3a4320e7eb017571fa')
+sha256sums=('3d3683cd5c1aa23a12d38c26150e739952ffd6e45058ffe6cb329eda861a0873')
 
 prepare() {
     cd "${pkgname}-${pkgver}"