Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.9.2 to 26.9.3. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust were modified in the provided diff. On its face this is a routine upstream version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.2
+	pkgver = 26.9.3
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from 26.9.2 to 26.9.3. The source remains an HTTPS GitHub release artifact from the same upstream project, with no new build steps, scripts, or packaging metadata changes that would introduce execution, persistence, or integrity risks. No suspicious sources or privilege-related changes are present in this diff hunk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.2/qownnotes-26.9.2.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.3/qownnotes-26.9.3.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump for qownnotes: it updates the upstream release tag, source tarball URL version, and the corresponding SHA-256 checksum. The source is fetched over HTTPS from the official GitHub releases page, and there are no added build steps, scripts, patches, or privilege/network red flags in this diff. No security concerns are evident from the reviewed hunk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.2
-tag="f922dab099fa0dbbf386a431613aa8d4fae385c8"
+pkgver=26.9.3
+tag="636aa40489be6bd456e77aa4b56d0a963adf6d70"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains HTTPS and points to the official GitHub release asset for the pinned version, with no new build steps, scripts, or packaging behavior introduced. I see no evidence of added network access, privilege escalation, persistence, or other supply-chain red flags in this diff hunk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('6bb08e8e9852ceb184d8f5490bcba50d0891f1a6965b31fc956d5b3f781c3b74')
+sha256sums=('6bd10d3b70dda6131837ba427f10b71b8ec548b5d6646fef30f05eedeed3660d')
 
 prepare() {
     cd "${pkgname}-${pkgver}"