Review Results

Comment

The change is a straightforward version bump in .SRCINFO: it updates the upstream tarball URL and its checksum from 1.11.5 to 1.11.6, with no new sources, scripts, build logic, or packaging behavior introduced. The source remains HTTPS on the official XnView download domain, and there are no signs of suspicious mirrors, runtime downloads, or privilege-related changes in this diff. Based on the provided hunk alone, this appears low risk.

@@ -1,15 +1,15 @@
 pkgbase = xnviewmp
 	pkgdesc = An efficient multimedia viewer, browser and converter.
-	pkgver = 1.11.5
+	pkgver = 1.11.6
 	pkgrel = 1
 	url = https://www.xnview.com/en/xnviewmp/
 	arch = x86_64
 	license = custom
 	depends = qt5-multimedia
 	optdepends = glib2: support for moving files to trash
-	source = XnViewMP-linux-x64_1.11.5-rel1.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-1.11.5-linux-x64.tgz
+	source = XnViewMP-linux-x64_1.11.6-rel1.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-1.11.6-linux-x64.tgz
 	source = XnView.desktop
-	sha256sums = 736c272f3007a59d9247fb6786f7a4d34d442386c1ceb262fae090261e96a9b7
+	sha256sums = 3a4a9f80fbf4dcbef0681c78d42cfd52b22eb0129095822e49689452c6287b2c
 	sha256sums = f6b3a4aaa0a55b5f21d9b91ab6f3da3d6ee077ba7fdd17e7c4ab1c69ad2a9e3a
 
 pkgname = xnviewmp

Comment

The change is a simple version bump in PKGBUILD from 1.11.5 to 1.11.6 with no accompanying changes to source URLs, checksums, build steps, install scripts, or package metadata. Based on the provided diff hunk alone, there are no new security red flags such as added network fetches, privilege escalation, persistence mechanisms, or suspicious sources.

@@ -8,7 +8,7 @@
 # Contributor: Martin Poljak <martin 'at' poljak 'dot' cz>
 
 pkgname=xnviewmp
-pkgver=1.11.5
+pkgver=1.11.6
 srcrel=1 # Incremented when there is a new release for the same version number
 pkgrel=1
 pkgdesc="An efficient multimedia viewer, browser and converter."

Comment

The change is a routine version bump for a binary upstream release, with the source URL still using HTTPS on the official XnView domain and the checksum updated accordingly. No new build-time code execution, no added sources, and no packaging/install-script changes are introduced in this diff. Risk is low because the package still relies on an upstream prebuilt tarball, but this specific change does not add any new security red flags.

@@ -24,7 +24,7 @@ optdepends=('glib2: support for moving files to trash')
 
 source=("XnViewMP-linux-x64_${pkgver}-rel${srcrel}.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-${pkgver}-linux-x64.tgz"
         'XnView.desktop')
-sha256sums=('736c272f3007a59d9247fb6786f7a4d34d442386c1ceb262fae090261e96a9b7'
+sha256sums=('3a4a9f80fbf4dcbef0681c78d42cfd52b22eb0129095822e49689452c6287b2c'
             'f6b3a4aaa0a55b5f21d9b91ab6f3da3d6ee077ba7fdd17e7c4ab1c69ad2a9e3a')
 
 package() {