Review Results

Comment

Risk is low. The change only updates .SRCINFO metadata for a new upstream release: pkgver and the corresponding source URLs/checksum were bumped from 5.2.3 to 5.3.0. There are no changes to build logic, install scripts, permissions, or added execution paths in this diff. The sources remain HTTPS and the package continues to use the same PGP key verification. No obvious supply-chain or persistence concerns are introduced by this metadata-only update.

@@ -1,6 +1,6 @@
 pkgbase = filebot
 	pkgdesc = The ultimate TV and Movie Renamer
-	pkgver = 5.2.3
+	pkgver = 5.3.0
 	pkgrel = 1
 	url = https://www.filebot.net/
 	install = filebot.install

Comment

The change is a straightforward upstream version bump in .SRCINFO from FileBot 5.2.3 to 5.3.0, with the source URL and checksum updated accordingly. No new sources, scripts, install hooks, privilege-related metadata, or packaging behavior are introduced by this diff. The package still uses HTTPS and a pinned release artifact with PGP verification. Based on the provided hunk alone, I do not see a security issue.

@@ -19,11 +19,11 @@ pkgbase = filebot
 	provides = filebot
 	conflicts = filebot47
 	conflicts = filebot-git
-	source = https://get.filebot.net/filebot/FileBot_5.2.3/FileBot_5.2.3-aur.tar.xz
-	source = https://get.filebot.net/filebot/FileBot_5.2.3/FileBot_5.2.3-aur.tar.xz.asc
+	source = https://get.filebot.net/filebot/FileBot_5.3.0/FileBot_5.3.0-aur.tar.xz
+	source = https://get.filebot.net/filebot/FileBot_5.3.0/FileBot_5.3.0-aur.tar.xz.asc
 	source = filebot.sh
 	validpgpkeys = B0976E51E5C047AD0FD051294E402EBF7C3C6A71
-	b2sums = ffa89dbb30d3435f28ba0ff9ee8a76805b37eb7cfa75642f81091fad269e09db86d6ca8c9f052ef4fd3d1cf95a4bad2d469d46863f9b1d2947ec0272ba76ca1d
+	b2sums = 1ddefbdaf288ff8b3ca0513b77d1b37ed409cd47dc843e8ea953b0245db58790a246b6f89318fcdb2243b6ea919f183e8ce71ee4ee05dd144306646f47000bad
 	b2sums = SKIP
 	b2sums = ef7d2169f2a71925835678a481b1a063f4d11a49ce741affd70d59dd1ef940f17090dd60383de2da4008e08823117796dc3b4c7e4805dd4de2a89d4c4805f66f
 

Comment

The change is a straightforward version bump from 5.2.3 to 5.3.0 with the corresponding source checksum updated. The PKGBUILD still uses HTTPS sources from the official FileBot site, includes a detached signature, and pins the signing key via validpgpkeys. No new build steps, scripts, network fetches, privilege changes, or packaging behavior were introduced by this diff hunk. Based on the provided change alone, I do not see a security regression.

@@ -8,7 +8,7 @@
 # Contributor: mithrial <mithrial@mailbox.org>
 
 pkgname=filebot
-pkgver=5.2.3
+pkgver=5.3.0
 pkgrel=1
 pkgdesc="The ultimate TV and Movie Renamer"
 arch=('i686' 'x86_64' 'aarch64' 'armv7l' 'armv7h')

Comment

The change is a routine upstream version bump from 5.2.3 to 5.3.0 with the corresponding BLAKE2 checksum update for the signed release tarball. The source URLs remain HTTPS and pinned to the versioned release path, and there are no new build-time downloads, scripts, privilege changes, or packaging logic changes in this diff. No security issues are evident from the provided hunk.

@@ -30,7 +30,7 @@ source=("https://get.filebot.net/filebot/FileBot_${pkgver}/FileBot_${pkgver}-aur
         "https://get.filebot.net/filebot/FileBot_${pkgver}/FileBot_${pkgver}-aur.tar.xz.asc"
         "filebot.sh")
 
-b2sums=('ffa89dbb30d3435f28ba0ff9ee8a76805b37eb7cfa75642f81091fad269e09db86d6ca8c9f052ef4fd3d1cf95a4bad2d469d46863f9b1d2947ec0272ba76ca1d'
+b2sums=('1ddefbdaf288ff8b3ca0513b77d1b37ed409cd47dc843e8ea953b0245db58790a246b6f89318fcdb2243b6ea919f183e8ce71ee4ee05dd144306646f47000bad'
         'SKIP'
         'ef7d2169f2a71925835678a481b1a063f4d11a49ce741affd70d59dd1ef940f17090dd60383de2da4008e08823117796dc3b4c7e4805dd4de2a89d4c4805f66f')
 validpgpkeys=('B0976E51E5C047AD0FD051294E402EBF7C3C6A71')