Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump from 2026.08.2.200 to 2026.09.0.174. There are no added sources, scripts, install hooks, permissions changes, or dependency changes in the reviewed diff, so this does not introduce an obvious security concern by itself. Any risk would depend on the upstream binary release contents, which are not altered here.

@@ -1,6 +1,6 @@
 pkgbase = rstudio-desktop-bin
 	pkgdesc = An integrated development environment (IDE) for R (binary from RStudio official repository)
-	pkgver = 2026.08.2.200
+	pkgver = 2026.09.0.174
 	pkgrel = 1
 	url = https://posit.co/products/open-source/rstudio/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the x86_64 binary source, with the source still using HTTPS from the official RStudio download host and a matching updated SHA-256 checksum. No new sources, scripts, install actions, or packaging behavior are introduced by this diff. Based on the provided hunk alone, there are no evident security red flags.

@@ -15,7 +15,7 @@ pkgbase = rstudio-desktop-bin
 	conflicts = rstudio-desktop-git
 	conflicts = rstudio-desktop-preview-bin
 	options = !strip
-	source_x86_64 = https://download1.rstudio.org/electron/jammy/amd64/rstudio-2026.08.2-200-amd64.deb
-	sha256sums_x86_64 = 8e728f6e09745d194b83e1d090f8350e33d01e27e4135cccfb4af57936a39631
+	source_x86_64 = https://download1.rstudio.org/electron/jammy/amd64/rstudio-2026.09.0-174-amd64.deb
+	sha256sums_x86_64 = 73bd2dd75e7dcbe368825d37917176a78261c8f5e7fc2aa451f5ea178614a69f
 
 pkgname = rstudio-desktop-bin

Comment

The change only bumps pkgver and updates the corresponding SHA-256 for the official HTTPS download URL from RStudio’s repository. No new sources, build steps, scripts, or packaging logic were introduced, and the package remains a straightforward binary repackaging. I don’t see any added supply-chain, persistence, or privilege-escalation risk in this diff.

@@ -1,6 +1,6 @@
 # Maintainer: Clemens Brunner < clemens dot brunner at gmail dot com >
 pkgname=rstudio-desktop-bin
-pkgver=2026.08.2.200
+pkgver=2026.09.0.174
 _pkgver=${pkgver%.*}-${pkgver##*.}
 pkgrel=1
 pkgdesc="An integrated development environment (IDE) for R (binary from RStudio official repository)"

Comment

The change is a routine version bump for a binary package: it updates pkgver and the corresponding SHA-256 for the official RStudio .deb downloaded over HTTPS from download1.rstudio.org. I did not see any new build-time code execution, extra sources, privilege escalation, or packaging logic changes. The package still pins a single upstream release artifact and verifies it with a checksum, so this diff does not introduce an obvious security regression.

@@ -14,7 +14,7 @@ conflicts=('rstudio-desktop' 'rstudio-desktop-git' 'rstudio-desktop-preview-bin'
 provides=("rstudio-desktop=${pkgver}")
 options=(!strip)
 
-sha256sums_x86_64=('8e728f6e09745d194b83e1d090f8350e33d01e27e4135cccfb4af57936a39631')
+sha256sums_x86_64=('73bd2dd75e7dcbe368825d37917176a78261c8f5e7fc2aa451f5ea178614a69f')
 
 source_x86_64=("https://download1.rstudio.org/electron/jammy/amd64/rstudio-${_pkgver}-amd64.deb")