Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 3.6.16 to 3.7.18. No source URLs, checksums, build steps, install scripts, permissions, or package metadata beyond pkgver are altered in the provided diff. On its face this is a routine upstream version update with no direct security red flags in the reviewed change.

@@ -1,6 +1,6 @@
 pkgbase = joplin
 	pkgdesc = A note taking and to-do application with synchronization capabilities
-	pkgver = 3.6.16
+	pkgver = 3.7.18
 	pkgrel = 1
 	url = https://joplinapp.org/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: it updates the upstream tarball URL from Joplin 3.6.16 to 3.7.18 and raises the Node.js dependency floor from >20 to >=22. The source remains an HTTPS GitHub release archive, and there are no new scripts, patches, binaries, or install-time behaviors introduced in this diff. I do not see any supply-chain or privilege-escalation concern in the metadata change itself. The only potential risk is compatibility breakage from the higher Node requirement, but that is not a security issue.

@@ -14,15 +14,15 @@ pkgbase = joplin
 	makedepends = libxcrypt-compat
 	makedepends = corepack
 	depends = electron42
-	depends = nodejs>20
+	depends = nodejs>=22
 	depends = libvips
 	optdepends = libappindicator-gtk3: for tray icon
 	source = joplin-desktop.sh
 	source = joplin-desktop.desktop
-	source = joplin-3.6.16.tar.gz::https://github.com/laurent22/joplin/archive/v3.6.16.tar.gz
+	source = joplin-3.7.18.tar.gz::https://github.com/laurent22/joplin/archive/v3.7.18.tar.gz
 	sha256sums = 9223cc816f8175ddaf8839f9357d2bd1c4831692504927c98d8e1eefa7df796e
 	sha256sums = f485c089904d91750d137d4413297676446e0068892cb08e20bee928bcac516c
-	sha256sums = f88de7ccc464dcab925966e35ffa4a061551593749589ef74ce4683977df8c35
+	sha256sums = 60eb34872a61efce325034ab1a052a0d37f9f0028b037d5482b1e649d8d63c4f
 
 pkgname = joplin
 	pkgdesc = A note taking and to-do application with synchronization capabilities - CLI App

Comment

The change is low risk. It updates the package to a newer upstream release, bumps the Node.js minimum version, refreshes the source checksum, adds a local symlink to work around a build/test MODULE_NOT_FOUND issue, and adjusts desktop packaging for aarch64 by copying the correct Electron output directory. I do not see any new network fetches, privilege escalation, persistence mechanisms, or suspicious install-script/unit changes in this diff. The only notable concern is the added build-time symlink, but it is confined to the source tree and appears to be a benign workaround rather than code execution or packaging compromise.

@@ -8,11 +8,11 @@
 pkgbase=joplin
 pkgname=('joplin' 'joplin-desktop')
 pkgdesc="A note taking and to-do application with synchronization capabilities"
-pkgver=3.6.16
+pkgver=3.7.18
 groups=('joplin')
 pkgrel=1
 _electronVersion=42
-depends=("electron${_electronVersion}" "nodejs>20" "libvips")
+depends=("electron${_electronVersion}" "nodejs>=22" "libvips")
 optdepends=('libappindicator-gtk3: for tray icon')
 arch=('x86_64' 'aarch64')
 makedepends=('npm' 'git' 'rsync' 'python-setuptools' 'libxcrypt-compat' 'corepack')

Comment

The change is low risk. It only updates the source checksum for the upstream tarball, bumps the package version, raises the Node.js dependency to match upstream requirements, adds a local symlink to work around a build-time MODULE_NOT_FOUND issue, and adjusts desktop packaging to copy the correct Electron resources directory on aarch64. I do not see any new network fetches, privilege escalation, persistence mechanisms, or suspicious install-time behavior introduced by this diff. The symlink is confined to the build tree and does not affect installed files.

@@ -25,7 +25,7 @@ source=(
 )
 sha256sums=('9223cc816f8175ddaf8839f9357d2bd1c4831692504927c98d8e1eefa7df796e'
             'f485c089904d91750d137d4413297676446e0068892cb08e20bee928bcac516c'
-            'f88de7ccc464dcab925966e35ffa4a061551593749589ef74ce4683977df8c35')
+            '60eb34872a61efce325034ab1a052a0d37f9f0028b037d5482b1e649d8d63c4f')
 
 _setup_env() {
     export YARN_CACHE_FOLDER="${srcdir}/yarn-cache"

Comment

The added symlink in build() is low risk. It only creates a local link inside the package source tree to satisfy tests after an upstream change; it does not introduce network access, privilege escalation, or writes outside the build directory. The rest of the diff is version/dependency updates and an architecture-specific resource path fix, both of which are routine packaging changes. No suspicious sources, scripts, or install-time persistence mechanisms are introduced in this hunk.

@@ -67,6 +67,8 @@ build() {
     # Pack the app-cli package
     cd "${srcdir}/joplin-${pkgver}/packages/app-cli"
     npx gulp build
+    # Fix: MODULE_NOT_FOUND error in tests after commit 25a93ff
+    ln -s ../build app/build
 
     # Pack the app-desktop electron package
     cd "${srcdir}/joplin-${pkgver}/packages/app-desktop"

Comment

Risk is low. The change only adds an architecture check in package_joplin-desktop() to copy the correct Electron resources directory on aarch64, which is a packaging fix and does not introduce new network access, privilege escalation, or persistence behavior. The rest of the diff (version/dependency bumps and a symlink in build()) is outside the provided hunk and does not affect this reviewed change. No suspicious commands or install-script/systemd changes are present in the hunk.

@@ -120,7 +122,11 @@ package_joplin-desktop() {
 
     cd "${srcdir}/joplin-${pkgver}/packages/app-desktop"
     mkdir -p "${pkgdir}/usr/lib"
-    cp -vr dist/linux-unpacked/resources "${pkgdir}/usr/lib/${pkgname}"
+    if [[ "$CARCH" == "aarch64" ]]; then
+        cp -vr dist/linux-arm64-unpacked/resources "${pkgdir}/usr/lib/${pkgname}"
+    else
+        cp -vr dist/linux-unpacked/resources "${pkgdir}/usr/lib/${pkgname}"
+    fi
 
     # Install icons
     while read -r size; do