Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 8.3.4 to 8.3.8, updating the declared source URLs, noextract entries, and checksums to match the new upstream MongoDB release artifacts. The sources remain HTTPS from the official MongoDB repository, and there are no new build-time commands, scripts, or privilege/persistence mechanisms introduced by this diff. Based on the provided hunk alone, this looks like a routine metadata update with no evident security regression.

@@ -1,6 +1,6 @@
 pkgbase = mongodb-bin
 	pkgdesc = A high-performance, open source, schema-free document-oriented database
-	pkgver = 8.3.4
+	pkgver = 8.3.8
 	pkgrel = 1
 	url = https://www.mongodb.com/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from 8.3.4 to 8.3.8, updating the provided virtual package version and the noextract Debian package filenames accordingly. No new sources, scripts, commands, permissions, or install-time behavior are introduced by this diff. Based on the provided hunk alone, this is low risk and appears to be routine metadata synchronization with the package version.

@@ -11,11 +11,11 @@ pkgbase = mongodb-bin
 	depends = curl
 	depends = openssl
 	optdepends = mongodb-tools: The MongoDB tools provide import, export, and diagnostic capabilities.
-	provides = mongodb=8.3.4
+	provides = mongodb=8.3.8
 	conflicts = mongodb
 	conflicts = mongodb-shell-bin
-	noextract = mongodb-org-server_8.3.4_x86_64.deb
-	noextract = mongodb-org-mongos_8.3.4_x86_64.deb
+	noextract = mongodb-org-server_8.3.8_x86_64.deb
+	noextract = mongodb-org-mongos_8.3.8_x86_64.deb
 	backup = etc/mongodb.conf
 	source = mongodb.sysusers
 	source = mongodb.tmpfiles

Comment

The change is a straightforward version bump in .SRCINFO from MongoDB 8.3.4 to 8.3.8, with corresponding SHA-256 updates for the official MongoDB HTTPS package URLs. There are no new sources, no build-script changes, no install scripts, and no signs of added execution or persistence behavior in this diff. Risk is low and limited to the usual trust in upstream binary packages already present in this AUR package.

@@ -23,13 +23,13 @@ pkgbase = mongodb-bin
 	sha256sums = 47b884569102f7c79017ee78ef2e98204a25aa834c0ee7d5d62c270ab05d4e2b
 	sha256sums = 51ee1e1f71598aad919db79a195778e6cb6cfce48267565e88a401ebc64497ac
 	sha256sums = 09d99ca61eb07873d5334077acba22c33e7f7d0a9fa08c92734e0ac8430d6e27
-	source_x86_64 = mongodb-org-server_8.3.4_x86_64.deb::https://repo.mongodb.org/apt/ubuntu/dists/noble/mongodb-org/8.3/multiverse/binary-amd64/mongodb-org-server_8.3.4_amd64.deb
-	source_x86_64 = mongodb-org-mongos_8.3.4_x86_64.deb::https://repo.mongodb.org/apt/ubuntu/dists/noble/mongodb-org/8.3/multiverse/binary-amd64/mongodb-org-mongos_8.3.4_amd64.deb
-	sha256sums_x86_64 = d44818c8e98bd4012e2cd1bcdef5b0b4a939b5315433097c0f3cb5183ca54c81
-	sha256sums_x86_64 = 7c1159dfdfbd5e010e1fb00268ca79fed1bcda91cb011c61ae7db8f9e033c237
-	source_aarch64 = mongodb-org-server_8.3.4_aarch64.deb::https://repo.mongodb.org/apt/ubuntu/dists/noble/mongodb-org/8.3/multiverse/binary-arm64/mongodb-org-server_8.3.4_arm64.deb
-	source_aarch64 = mongodb-org-mongos_8.3.4_aarch64.deb::https://repo.mongodb.org/apt/ubuntu/dists/noble/mongodb-org/8.3/multiverse/binary-arm64/mongodb-org-mongos_8.3.4_arm64.deb
-	sha256sums_aarch64 = 7bb282f2855108fa1a47164f43428f64b6688e6c771a0bebd5b95e7a9f0b6a70
-	sha256sums_aarch64 = 2ab96d1cfd66ba831474224142cc914b5a95a949faef08cde90d8c88fbdcce5d
+	source_x86_64 = mongodb-org-server_8.3.8_x86_64.deb::https://repo.mongodb.org/apt/ubuntu/dists/noble/mongodb-org/8.3/multiverse/binary-amd64/mongodb-org-server_8.3.8_amd64.deb
+	source_x86_64 = mongodb-org-mongos_8.3.8_x86_64.deb::https://repo.mongodb.org/apt/ubuntu/dists/noble/mongodb-org/8.3/multiverse/binary-amd64/mongodb-org-mongos_8.3.8_amd64.deb
+	sha256sums_x86_64 = e504a87fb0e9e31f9261c9610a2be03de1a6f9842413c260c2a33aa3e3e1c06d
+	sha256sums_x86_64 = 4d7a44fabc676f69bd6dc6fcce03417f6f5a2c184dfb3e3c07a1c2a7b9117f4d
+	source_aarch64 = mongodb-org-server_8.3.8_aarch64.deb::https://repo.mongodb.org/apt/ubuntu/dists/noble/mongodb-org/8.3/multiverse/binary-arm64/mongodb-org-server_8.3.8_arm64.deb
+	source_aarch64 = mongodb-org-mongos_8.3.8_aarch64.deb::https://repo.mongodb.org/apt/ubuntu/dists/noble/mongodb-org/8.3/multiverse/binary-arm64/mongodb-org-mongos_8.3.8_arm64.deb
+	sha256sums_aarch64 = 11f300e7e250a163e3b27c83635d704f505db69c77e78e80b4297b62c44d451f
+	sha256sums_aarch64 = a9c2a9c31813296388e24ad7af46e548bd0f76f5d6dafdda54869017bca198a4
 
 pkgname = mongodb-bin

Comment

The change only bumps pkgver from 8.3.4 to 8.3.8 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or packaging logic were modified in the provided diff hunk. On its face this is a routine version update with no new security red flags visible in the reviewed change.

@@ -2,7 +2,7 @@
 #Maintainer: Rafael Fontenelle <rafaelff at gnome dot org>
 
 pkgname="mongodb-bin"
-pkgver="8.3.4"
+pkgver="8.3.8"
 _basever="8.3"
 _basedist="noble"
 pkgrel=1

Comment

The change is a straightforward version bump from 8.3.4 to 8.3.8 with updated SHA-256 checksums for the architecture-specific source artifacts. No new sources, URLs, build steps, install scripts, or packaging logic were introduced in the diff, and there are no signs of network fetches, privilege escalation, or persistence mechanisms. Risk is low and limited to the usual trust in upstream release artifacts already pinned by checksum.

@@ -39,10 +39,10 @@ noextract=(
 sha256sums=('47b884569102f7c79017ee78ef2e98204a25aa834c0ee7d5d62c270ab05d4e2b'
             '51ee1e1f71598aad919db79a195778e6cb6cfce48267565e88a401ebc64497ac'
             '09d99ca61eb07873d5334077acba22c33e7f7d0a9fa08c92734e0ac8430d6e27')
-sha256sums_x86_64=('d44818c8e98bd4012e2cd1bcdef5b0b4a939b5315433097c0f3cb5183ca54c81'
-                   '7c1159dfdfbd5e010e1fb00268ca79fed1bcda91cb011c61ae7db8f9e033c237')
-sha256sums_aarch64=('7bb282f2855108fa1a47164f43428f64b6688e6c771a0bebd5b95e7a9f0b6a70'
-                    '2ab96d1cfd66ba831474224142cc914b5a95a949faef08cde90d8c88fbdcce5d')
+sha256sums_x86_64=('e504a87fb0e9e31f9261c9610a2be03de1a6f9842413c260c2a33aa3e3e1c06d'
+                   '4d7a44fabc676f69bd6dc6fcce03417f6f5a2c184dfb3e3c07a1c2a7b9117f4d')
+sha256sums_aarch64=('11f300e7e250a163e3b27c83635d704f505db69c77e78e80b4297b62c44d451f'
+                    'a9c2a9c31813296388e24ad7af46e548bd0f76f5d6dafdda54869017bca198a4')
 
 prepare() {
 	mkdir -p output