Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump from 1.126.04524 to 1.135.06055. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the reviewed diff. On its face this is a routine version update with no security-relevant red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = vscodium
 	pkgdesc = Free/Libre Open Source Software Binaries of VSCode (git build from latest release).
-	pkgver = 1.126.04524
+	pkgver = 1.135.06055
 	pkgrel = 1
 	url = https://github.com/VSCodium/vscodium.git
 	arch = x86_64

Comment

The change only updates the upstream VSCodium source tarball URL and its corresponding SHA-256 checksum in .SRCINFO, moving from one official GitHub release asset to a newer official GitHub release asset. There are no new build-time commands, no added scripts, no privilege changes, and no suspicious external hosts or integrity regressions visible in this diff. This appears to be a routine version bump with the expected checksum update.

@@ -42,10 +42,10 @@ pkgbase = vscodium
 	source = vscodium.desktop
 	source = vscodium-wayland.desktop
 	source = vscodium-uri-handler.desktop
-	source = https://github.com/VSCodium/vscodium/releases/download/1.126.04524/VSCodium-1.126.04524-src.tar.gz
+	source = https://github.com/VSCodium/vscodium/releases/download/1.135.06055/VSCodium-1.135.06055-src.tar.gz
 	sha256sums = 7c6864be64a7cb698340c45b4cfc0091a1d9bb78b0e73d7e3a25d8a0b438beec
 	sha256sums = 74509d8ccb685a6d55e8bba8f4231963b766e1e3e38443bc1e72238519dcdeac
 	sha256sums = 3ad1e6bbd7cdc8833eff9afaa9f6ae39350d738678cafbe3437106f0cfe3d985
-	sha256sums = 62a3775aa20d44e970ac62d9c243c6957c57679dac872c8088c5b22ba0d586e1
+	sha256sums = 73639a55ea72bb57f0134bf2d5228cc2f70e869a95fa7919a4da2c14c72dac74
 
 pkgname = vscodium

Comment

The change only bumps pkgver and updates the corresponding source checksum in PKGBUILD. I do not see any new sources, build steps, install scripts, privilege changes, or other behavior changes in this diff. The package still appears to fetch the same upstream release artifacts over HTTPS with integrity pinned by sha256. No security-relevant red flags are introduced by this version bump alone.

@@ -3,7 +3,7 @@
 
 pkgname=vscodium
 # Make sure the pkgver matches the git tags in vscodium and vscode git repo's!
-pkgver=1.126.04524
+pkgver=1.135.06055
 pkgrel=1
 pkgdesc="Free/Libre Open Source Software Binaries of VSCode (git build from latest release)."
 arch=('x86_64' 'aarch64' 'armv7h')

Comment

The change is a straightforward version bump in PKGBUILD plus an updated checksum for one source artifact. I did not see any new sources, build-time network fetches, privilege escalation, install-script changes, or packaging logic changes. The only security-relevant question is whether the new checksum corresponds to the expected upstream release asset, but within this diff there is no evidence of tampering or malicious behavior.

@@ -49,7 +49,7 @@ source=(
 sha256sums=('7c6864be64a7cb698340c45b4cfc0091a1d9bb78b0e73d7e3a25d8a0b438beec'
             '74509d8ccb685a6d55e8bba8f4231963b766e1e3e38443bc1e72238519dcdeac'
             '3ad1e6bbd7cdc8833eff9afaa9f6ae39350d738678cafbe3437106f0cfe3d985'
-            '62a3775aa20d44e970ac62d9c243c6957c57679dac872c8088c5b22ba0d586e1')
+            '73639a55ea72bb57f0134bf2d5228cc2f70e869a95fa7919a4da2c14c72dac74')
 provides=(
     'codium'
     'vscodium'