Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.43.3.10896 to 1.43.4.10903. No source URLs, checksums, build logic, install scripts, or packaging metadata beyond the version string are altered in the reviewed hunk. On its own this is not a security concern.

@@ -1,6 +1,6 @@
 pkgbase = plex-media-server
 	pkgdesc = The back-end media server component of Plex.
-	pkgver = 1.43.3.10896
+	pkgver = 1.43.4.10903
 	pkgrel = 1
 	url = https://plex.tv/
 	install = plex-media-server.install

Comment

The change is a straightforward version bump in .SRCINFO from Plex Media Server 1.43.3.10896 to 1.43.4.10903, with corresponding checksum updates for the official downloads. The source URLs remain HTTPS and point to plex.tv, there are no new build-time commands, scripts, or packaging changes, and no signs of added persistence or privilege escalation. Based on the provided diff alone, this is low risk.

@@ -26,13 +26,13 @@ pkgbase = plex-media-server
 	sha256sums = c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557
 	sha256sums = b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad
 	sha256sums = dbfb5a9a7146a975863c0932f1a68c4b040ec5d7e693361f39ddfbf60885e631
-	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10896-cb3ebc72d/redhat/plexmediaserver-1.43.3.10896-cb3ebc72d.x86_64.rpm
-	sha256sums_x86_64 = ea678ff32fc7d42f9105d28ada1495f00ef5139c05550f37a68bacfefe1f4c31
-	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10896-cb3ebc72d/redhat/plexmediaserver-1.43.3.10896-cb3ebc72d.i686.rpm
-	sha256sums_i686 = 565394c842ca75c171e89ed753d1fb15db5855e60d6bd467afd5ae6561e0e361
-	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.3.10896-cb3ebc72d/debian/plexmediaserver_1.43.3.10896-cb3ebc72d_armhf.deb
-	sha256sums_armv7h = 59a8f5ee5bcb64b8827e1d759855d5eca35b2f76eb8055df75cbbc3d01f09567
-	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.3.10896-cb3ebc72d/debian/plexmediaserver_1.43.3.10896-cb3ebc72d_arm64.deb
-	sha256sums_aarch64 = 2a7ad1306795d391551d778eec21e6426fcfefd95f0bb288771611f62d8e7d2d
+	source_x86_64 = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/redhat/plexmediaserver-1.43.4.10903-e5521bd8c.x86_64.rpm
+	sha256sums_x86_64 = 391598ee0e495794ad60a596eb7386435d4ce4bf5ff8e922cf1f686bee91467b
+	source_i686 = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/redhat/plexmediaserver-1.43.4.10903-e5521bd8c.i686.rpm
+	sha256sums_i686 = 51bb10dfedd829f6fd067e5ba62dd94e49f138f2b22dcff962b2c5eeac3fb726
+	source_armv7h = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/debian/plexmediaserver_1.43.4.10903-e5521bd8c_armhf.deb
+	sha256sums_armv7h = 908f716cebaf053500427ff132e56b59f4a69bfda5da927e8439bbf009cb1212
+	source_aarch64 = https://downloads.plex.tv/plex-media-server-new/1.43.4.10903-e5521bd8c/debian/plexmediaserver_1.43.4.10903-e5521bd8c_arm64.deb
+	sha256sums_aarch64 = 945e86d0514f61492b5169bbeac6e91892b336f6895d78632bec017b5908e5ab
 
 pkgname = plex-media-server

Comment

The change only bumps Plex Media Server to a newer upstream release and updates the corresponding per-architecture checksums. No build logic, install script, systemd unit, or packaging behavior changed. The sources remain HTTPS from the official Plex download domain, and there are no new red flags such as extra fetches, scripts, or privilege-related changes in this diff. Risk is low and limited to the usual trust in upstream binary release integrity, which is already covered by the checksum update.

@@ -10,8 +10,8 @@
 # Contributor: Praekon <praekon@googlemail.com>
 
 pkgname=plex-media-server
-pkgver=1.43.3.10896
-_pkgsum=cb3ebc72d
+pkgver=1.43.4.10903
+_pkgsum=e5521bd8c
 pkgrel=1
 pkgdesc='The back-end media server component of Plex.'
 arch=('x86_64' 'i686' 'armv7h' 'aarch64')

Comment

The change is a straightforward version bump in PKGBUILD: pkgver/_pkgsum and per-architecture sha256 sums were updated to match new upstream release artifacts. No new sources, scripts, install hooks, privilege changes, or build-time network behavior were introduced in the reviewed hunk. Based on the diff shown, this does not add an obvious security risk.

@@ -39,10 +39,10 @@ sha256sums=('398ba7958598609453f5289b3d5f2389d2756158b340cf28e83c39d9ed60280b'
             'c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557'
             'b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad'
             'dbfb5a9a7146a975863c0932f1a68c4b040ec5d7e693361f39ddfbf60885e631')
-sha256sums_x86_64=('ea678ff32fc7d42f9105d28ada1495f00ef5139c05550f37a68bacfefe1f4c31')
-sha256sums_i686=('565394c842ca75c171e89ed753d1fb15db5855e60d6bd467afd5ae6561e0e361')
-sha256sums_armv7h=('59a8f5ee5bcb64b8827e1d759855d5eca35b2f76eb8055df75cbbc3d01f09567')
-sha256sums_aarch64=('2a7ad1306795d391551d778eec21e6426fcfefd95f0bb288771611f62d8e7d2d')
+sha256sums_x86_64=('391598ee0e495794ad60a596eb7386435d4ce4bf5ff8e922cf1f686bee91467b')
+sha256sums_i686=('51bb10dfedd829f6fd067e5ba62dd94e49f138f2b22dcff962b2c5eeac3fb726')
+sha256sums_armv7h=('908f716cebaf053500427ff132e56b59f4a69bfda5da927e8439bbf009cb1212')
+sha256sums_aarch64=('945e86d0514f61492b5169bbeac6e91892b336f6895d78632bec017b5908e5ab')
 
 prepare() {
   if [[ $CARCH = armv7h ]] || [[ $CARCH = aarch64 ]]; then