Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.8.7 to 2.8.8. No sources, checksums, build steps, install scripts, or packaging metadata affecting execution or privileges were modified in the reviewed diff. Based on this hunk alone, there is no security concern evident.

@@ -1,6 +1,6 @@
 pkgbase = python-fpdf2
 	pkgdesc = Simple PDF generation for Python
-	pkgver = 2.8.7
+	pkgver = 2.8.8
 	pkgrel = 1
 	url = https://pyfpdf.github.io/fpdf2/
 	arch = any

Comment

The change is a routine upstream version bump in .SRCINFO from fpdf2 2.8.7 to 2.8.8, with the source remaining on the official Python Package Index host over HTTPS and the checksum updated accordingly. No new sources, build steps, scripts, or packaging metadata that would introduce execution, persistence, or integrity risks are present in this diff hunk. Based on the provided change alone, this is low risk.

@@ -17,7 +17,7 @@ pkgbase = python-fpdf2
 	optdepends = python-uharfbuzz: text shaping support
 	optdepends = python-cryptography: encryption support
 	conflicts = python-fpdf
-	source = https://files.pythonhosted.org/packages/source/f/fpdf2/fpdf2-2.8.7.tar.gz
-	sha256sums = 7060ccee5a9c7ab0a271fb765a36a23639f83ef8996c34e3d46af0a17ede57f9
+	source = https://files.pythonhosted.org/packages/source/f/fpdf2/fpdf2-2.8.8.tar.gz
+	sha256sums = 9e94e155e85e8053329a9a1fce8b566fd7a7c5bb79e98a1a3952d379b947c5b9
 
 pkgname = python-fpdf2

Comment

The change is a routine version bump from 2.8.7 to 2.8.8 with the corresponding source tarball checksum update. The source remains an HTTPS URL on files.pythonhosted.org, there are no new build steps, no added scripts, and no packaging metadata changes that would suggest persistence, privilege escalation, or integrity bypass. Based on the diff provided, this looks low risk.

@@ -1,7 +1,7 @@
 # Maintainer: Guillaume Horel <guillaume.horel@gmail.com>
 pkgname=python-fpdf2
 _name=${pkgname#python-}
-pkgver=2.8.7
+pkgver=2.8.8
 pkgrel=1
 pkgdesc='Simple PDF generation for Python'
 arch=(any)

Comment

The change only updates the SHA-256 checksum for the upstream source tarball in PKGBUILD. The source URL remains HTTPS to the official PyPI files host, there are no new build steps, no added scripts, and no packaging logic changes. This is a routine integrity update with no evident security impact in the diff reviewed.

@@ -16,7 +16,7 @@ optdepends=(
 )
 makedepends=(python-build python-installer python-setuptools python-wheel)
 source=("https://files.pythonhosted.org/packages/source/${_name::1}/$_name/$_name-$pkgver.tar.gz")
-sha256sums=('7060ccee5a9c7ab0a271fb765a36a23639f83ef8996c34e3d46af0a17ede57f9')
+sha256sums=('9e94e155e85e8053329a9a1fce8b566fd7a7c5bb79e98a1a3952d379b947c5b9')
 
 build() {
     cd "$_name-$pkgver"