Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.33.3 to 1.34. No sources, checksums, build steps, install scripts, permissions, or dependency metadata are altered here, so there is no new security-relevant behavior introduced by this diff alone. Risk is minimal.

@@ -1,6 +1,6 @@
 pkgbase = pikaur
 	pkgdesc = AUR helper which asks all questions before installing/building. Inspired by pacaur, yaourt and yay.
-	pkgver = 1.33.3
+	pkgver = 1.34
 	pkgrel = 1
 	url = https://github.com/actionless/pikaur
 	changelog = CHANGELOG

Comment

The .SRCINFO change is a straightforward upstream version bump from 1.33.3 to 1.34, with the source URL still using HTTPS on the official GitHub repository and the checksum updated accordingly. No new sources, scripts, install hooks, or packaging behavior are introduced in this diff. Based on the provided hunk alone, there are no obvious supply-chain or privilege-escalation concerns.

@@ -20,7 +20,7 @@ pkgbase = pikaur
 	optdepends = pacman-contrib: to use in pacman hook/systemd timer for cleaning up pikaur cache
 	provides = pikaur
 	conflicts = pikaur-git
-	source = pikaur-1.33.3.tar.gz::https://github.com/actionless/pikaur/archive/1.33.3.tar.gz
-	b2sums = 897f30a700cee167cf8ae92f7865871187485e211b1f5657caaa1e808eebab124b0d88914fa54f6ea9315adfffc292c3fa5b40a7c6d4c88566896e7358146733
+	source = pikaur-1.34.tar.gz::https://github.com/actionless/pikaur/archive/1.34.tar.gz
+	b2sums = 97c77a8bc36080cdbd4678f9a504afad6f6639f6996c05fc62d08b13c6f5100ef760fbb4c1b61ad3bdd1a7237f91228d3e975c4ca17fcf28386f5dd35d4cc17c
 
 pkgname = pikaur

Comment

This change only appends a changelog entry describing release notes and references to prior commits; it does not alter build logic, sources, install scripts, systemd units, permissions, or any executable packaging behavior. No security-relevant code paths are introduced in this diff hunk.

@@ -2533,3 +2533,14 @@ Sat Mar 7 17:17:50 2026 +0100
     *  2026-02-02 6be06c3b summoner Translation: Create hungarian hu.po (#907)
     *  2026-01-21 bdcdce04 actionless feat(config: PikaurConfigItem): improve error messages
     *  2026-01-21 4adf309a Wuzzy chore(locale): update German translation (#904)
+
+
+Mon Sep 7 08:23:54 2026 +0200
+-------------------------------------------------
+1.34            Release 1.34
+    
+    Notable changes:
+    *  2026-09-05 207f212f actionless fix(install_cli: _find_extra_aur_build_deps): regenerate srcinfo before reading, in case pkgbuild was edited outside (fixes: #920)
+    *  2026-09-03 4768ab9d actionless feat(help_cli): in --help output show <placeholder>s for args which allow values to be set
+    *  2026-09-03 b56378d4 actionless feat(privilege, config, args): allow `*` for preserving all env vars in --preserve-env flag and misc.PreserveEnv config
+    *  2026-09-03 b6fb48f8 actionless fix(install_cli: get_package_builds): index cloned pkgbuild by pkgbase instead of pkgname (fixes: #917, #918)

Comment

The change is a straightforward version bump in PKGBUILD from 1.33.3 to 1.34, with the corresponding source tarball checksum updated. The source remains the upstream GitHub archive over HTTPS, and there are no new build steps, scripts, dependencies, or packaging behaviors introduced by this diff. No security-relevant red flags are present in the reviewed hunk.

@@ -3,7 +3,7 @@
 
 _pkgname=pikaur
 pkgname="${_pkgname}"
-pkgver=1.33.3
+pkgver=1.34
 pkgrel=1
 pkgdesc="AUR helper which asks all questions before installing/building. Inspired by pacaur, yaourt and yay."
 arch=('any')

Comment

The change only updates the BLAKE2 checksum for the upstream source tarball in PKGBUILD. The source URL remains HTTPS and points to the project’s GitHub archive, with no new build steps, scripts, or packaging logic introduced. I did not find any added network fetches, privilege escalation, persistence mechanisms, or other suspicious behavior in this diff hunk. Security risk is minimal; the main effect is integrity verification of the same source artifact.

@@ -12,7 +12,7 @@ license=('GPL-3.0-or-later')
 source=(
 	"$pkgname-$pkgver.tar.gz"::${url}/archive/"$pkgver".tar.gz
 )
-b2sums=('897f30a700cee167cf8ae92f7865871187485e211b1f5657caaa1e808eebab124b0d88914fa54f6ea9315adfffc292c3fa5b40a7c6d4c88566896e7358146733')
+b2sums=('97c77a8bc36080cdbd4678f9a504afad6f6639f6996c05fc62d08b13c6f5100ef760fbb4c1b61ad3bdd1a7237f91228d3e975c4ca17fcf28386f5dd35d4cc17c')
 depends=(
 	'pyalpm'
 	'git'