Review Results

Comment

The change only bumps pkgver in .SRCINFO from 26.9.1 to 26.9.2. No build logic, sources, checksums, install scripts, or systemd/persistence-related artifacts are modified in the provided diff. This is a routine version metadata update with no evident security impact.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.1
+	pkgver = 26.9.2
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from v26.9.1 to v26.9.2. The source remains an HTTPS GitHub release asset from the official upstream project, with no new build steps, scripts, dependencies, or packaging behavior introduced. No security red flags are present in this diff alone.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.1/qownnotes-26.9.1.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.2/qownnotes-26.9.2.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump in PKGBUILD: it updates pkgver, the upstream git tag, and the source tarball checksum. The source remains an HTTPS GitHub release URL, there are no new build-time network fetches, no added scripts, and no packaging/persistence red flags in the diff. Based on the provided hunk alone, this looks low risk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.1
-tag="984ea5caabcb0edef2acfc7e028d5c9b895ecec3"
+pkgver=26.9.2
+tag="f922dab099fa0dbbf386a431613aa8d4fae385c8"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in source=(). The download remains HTTPS from the official GitHub release URL, with no new build steps, scripts, or packaging behavior changes. I see no added supply-chain, persistence, or privilege-escalation risk in this diff.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('3d3683cd5c1aa23a12d38c26150e739952ffd6e45058ffe6cb329eda861a0873')
+sha256sums=('6bb08e8e9852ceb184d8f5490bcba50d0891f1a6965b31fc956d5b3f781c3b74')
 
 prepare() {
     cd "${pkgname}-${pkgver}"