Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.126.04524-2 to 1.135.06055-1 and a pkgrel reset. No source URLs, checksums, build logic, install scripts, or packaging permissions are changed here, so this diff does not introduce any new security-relevant behavior by itself. The risk is therefore minimal and limited to the usual trust in the upstream binary release already implied by the package.

@@ -1,7 +1,7 @@
 pkgbase = vscodium-bin
 	pkgdesc = Binary releases of VS Code without MS branding/telemetry/licensing.
-	pkgver = 1.126.04524
-	pkgrel = 2
+	pkgver = 1.135.06055
+	pkgrel = 1
 	url = https://github.com/VSCodium/vscodium
 	install = vscodium-bin.install
 	arch = x86_64

Comment

The change only updates VSCodium release URLs and their corresponding SHA256 checksums in .SRCINFO. The sources remain HTTPS and point to the official upstream GitHub/VSCodium release artifacts, with no new build-time code execution, install-script changes, or packaging behavior changes. This is a routine version bump with no evident security red flags in the provided diff.

@@ -33,16 +33,16 @@ pkgbase = vscodium-bin
 	source = vscodium-bin.install
 	source = vscodium-bin.sh
 	source = LICENSE
-	source = https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/1.126.04524/src/stable/resources/linux/code.svg
+	source = https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/1.135.06055/src/stable/resources/linux/code.svg
 	sha256sums = 3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e
 	sha256sums = 121f2db8a65cfc74c10d3e7c3135b62b66297cf27f8f7f00c3ad29d412e968b7
 	sha256sums = 01ba3d33e76804e2346d08f4eda256a29610c9eb59432e4b016d05ad93d901ba
 	sha256sums = 73d4cfae90bc64e37c6471e60c3c5c881c78ae7126ebac83eb9d5bb9d721a1d8
 	sha256sums = 2fa3f8948a0a17ea30b62845caf1ee8aae8b55b5417273920ca2df2642209e0e
 	sha256sums = e622e6bdb70b0cfec57ad9df8717ea023b87e5e215003119b5a1a4d059fcd347
-	source_x86_64 = https://github.com/VSCodium/vscodium/releases/download/1.126.04524/VSCodium-linux-x64-1.126.04524.tar.gz
-	sha256sums_x86_64 = adf3548df055d18e476cdee887488ba7486b879ad99a31a546c6b5c5ff296c24
-	source_aarch64 = https://github.com/VSCodium/vscodium/releases/download/1.126.04524/VSCodium-linux-arm64-1.126.04524.tar.gz
-	sha256sums_aarch64 = 73d87d46d4dc208fe12c0497dc607aab0a6e2bf332f54a0b6826a3a1aa32bc34
+	source_x86_64 = https://github.com/VSCodium/vscodium/releases/download/1.135.06055/VSCodium-linux-x64-1.135.06055.tar.gz
+	sha256sums_x86_64 = c09d8ac8dd7f52b09ee159ee24b440541dfd8f937a0f6f88cc428c78e48ee1f2
+	source_aarch64 = https://github.com/VSCodium/vscodium/releases/download/1.135.06055/VSCodium-linux-arm64-1.135.06055.tar.gz
+	sha256sums_aarch64 = 9765cea4f707ff7dc83a40be408a7318a59abb6996b359631639d9aab2f48a90
 
 pkgname = vscodium-bin

Comment

The change only bumps pkgver/pkgrel and refreshes the pinned SHA256 checksums for the upstream release tarballs and icon asset. I did not see any new sources, build-time network fetches, install-script changes, privilege escalation, or packaging logic changes. The package still uses HTTPS GitHub/VSCodium release URLs and the existing .install script is benign. Risk is low and limited to the usual trust in upstream release artifacts.

@@ -7,8 +7,8 @@
 
 pkgname=vscodium-bin
 _pkgname=VSCodium
-pkgver=1.126.04524
-pkgrel=2
+pkgver=1.135.06055
+pkgrel=1
 pkgdesc="Binary releases of VS Code without MS branding/telemetry/licensing."
 arch=('x86_64' 'aarch64')
 url="https://github.com/VSCodium/vscodium"

Comment

This change only updates the package version and the architecture-specific SHA256 checksums in PKGBUILD. The source list, URLs, build steps, and packaging logic are unchanged, and there are no new network fetches, scripts, privilege changes, or install-time behaviors introduced by this diff. The main security property affected is integrity verification of the upstream binary artifacts, and the new checksums appear to be a routine version bump rather than a suspicious source substitution. No high-confidence security issue is evident from this hunk alone.

@@ -32,8 +32,8 @@ sha256sums=('3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e'
             '73d4cfae90bc64e37c6471e60c3c5c881c78ae7126ebac83eb9d5bb9d721a1d8'
             '2fa3f8948a0a17ea30b62845caf1ee8aae8b55b5417273920ca2df2642209e0e')
 sha256sums+=('e622e6bdb70b0cfec57ad9df8717ea023b87e5e215003119b5a1a4d059fcd347')
-sha256sums_x86_64=('adf3548df055d18e476cdee887488ba7486b879ad99a31a546c6b5c5ff296c24')
-sha256sums_aarch64=('73d87d46d4dc208fe12c0497dc607aab0a6e2bf332f54a0b6826a3a1aa32bc34')
+sha256sums_x86_64=('c09d8ac8dd7f52b09ee159ee24b440541dfd8f937a0f6f88cc428c78e48ee1f2')
+sha256sums_aarch64=('9765cea4f707ff7dc83a40be408a7318a59abb6996b359631639d9aab2f48a90')
 
 source=('vscodium-bin.desktop'
         'vscodium-bin-url-handler.desktop'