Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 13.0.2 to 13.2.0. No sources, checksums, install scripts, build logic, permissions, or package metadata beyond pkgver are altered in the provided diff. Based on this hunk alone, there is no evidence of supply-chain risk or malicious behavior.

@@ -1,6 +1,6 @@
 pkgbase = insomnia-bin
 	pkgdesc = API Client and Design Platform for GraphQL and REST
-	pkgver = 13.0.2
+	pkgver = 13.2.0
 	pkgrel = 1
 	epoch = 1
 	url = https://insomnia.rest

Comment

The change only updates the upstream release version in .SRCINFO from Insomnia 13.0.2 to 13.2.0 and refreshes the corresponding SHA-256 checksum. The sources remain HTTPS GitHub release artifacts and the LICENSE file from the same tagged release, with no new build-time code execution, no additional sources, and no packaging/script changes visible in this diff. On this diff alone, there are no obvious supply-chain or privilege-escalation concerns.

@@ -14,9 +14,9 @@ pkgbase = insomnia-bin
 	optdepends = xdg-utils: open URLs with desktop's default (xdg-email, xdg-open)
 	provides = insomnia
 	conflicts = insomnia
-	source = https://github.com/Kong/insomnia/releases/download/core@13.0.2/Insomnia.Core-13.0.2.deb
-	source = https://github.com/Kong/insomnia/raw/core@13.0.2/LICENSE
-	sha256sums = c0805c435f115c0820c4c0349384a4483752b46a9b4648e3068dc993c063a570
+	source = https://github.com/Kong/insomnia/releases/download/core@13.2.0/Insomnia.Core-13.2.0.deb
+	source = https://github.com/Kong/insomnia/raw/core@13.2.0/LICENSE
+	sha256sums = 176fdd5306fb0cd8c74195cc9ee7b5da4d390a909ffeb8b1e41681667e914a61
 	sha256sums = 4197d1eeea274289901dc8b68e16f538ceb535ce1ff592f6895c0a7439908ca2
 
 pkgname = insomnia-bin

Comment

The change is a straightforward version bump in PKGBUILD from 13.0.2 to 13.2.0 with the corresponding source checksum update. The source remains the upstream GitHub release .deb over HTTPS, there are no new build-time downloads, scripts, patches, privilege changes, or packaging logic changes in the diff. Based on the provided hunk alone, I do not see a security issue introduced by this update.

@@ -4,7 +4,7 @@
 _pkgname='insomnia'
 _upkgname='Insomnia'
 pkgname="${_pkgname}-bin"
-pkgver=13.0.2
+pkgver=13.2.0
 pkgrel=1
 epoch=1
 pkgdesc='API Client and Design Platform for GraphQL and REST'

Comment

The change is a routine version bump of a binary package from 13.0.2 to 13.2.0 with the corresponding upstream release tarball checksum updated. The source URLs remain HTTPS and point to the official Kong/insomnia GitHub release and license file, with no new build-time network access, scripts, patches, or packaging behavior changes. No additional supply-chain or privilege-escalation concerns are introduced by this diff alone.

@@ -21,7 +21,7 @@ conflicts=("${_pkgname}")
 source=("${_url_source}/releases/download/core@${pkgver}/${_upkgname}.Core-${pkgver}.deb"
         "${_url_source}/raw/core@${pkgver}/LICENSE")
 
-sha256sums=('c0805c435f115c0820c4c0349384a4483752b46a9b4648e3068dc993c063a570'
+sha256sums=('176fdd5306fb0cd8c74195cc9ee7b5da4d390a909ffeb8b1e41681667e914a61'
             '4197d1eeea274289901dc8b68e16f538ceb535ce1ff592f6895c0a7439908ca2')
 
 package() {