Review Results

Comment

The change only bumps pkgver in .SRCINFO from 26.9.3 to 26.9.4. No source URLs, checksums, build logic, install scripts, or packaging permissions are altered in this diff. On its face this is a routine metadata update with no security-relevant behavior change.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.3
+	pkgver = 26.9.4
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from v26.9.3 to v26.9.4. The source remains on the official GitHub releases domain over HTTPS, with no new build steps, scripts, dependencies, or packaging behavior introduced. Based on the provided diff, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.3/qownnotes-26.9.3.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.4/qownnotes-26.9.4.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

Low risk change. The diff only bumps qownnotes from 26.9.3 to 26.9.4, updates the pinned upstream release tag, and refreshes the source tarball checksum. The source remains an HTTPS GitHub release asset, there are no new build steps, no added scripts, no network access beyond the declared source, and no packaging/persistence red flags in the changed lines. I did not see evidence of typosquatting, floating VCS refs, or integrity regressions in this hunk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.3
-tag="636aa40489be6bd456e77aa4b56d0a963adf6d70"
+pkgver=26.9.4
+tag="8c3f9d14e1e57f4ab86b86f1deafe5f3988bc3a4"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball while keeping the source URL pinned to the GitHub release for the exact version. No build logic, install scripts, permissions, or additional sources were introduced. This is a routine integrity update with no obvious security impact in the diff itself.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('6bd10d3b70dda6131837ba427f10b71b8ec548b5d6646fef30f05eedeed3660d')
+sha256sums=('94905a5cd03f07d398d6ab6138b82a9d63e413f43243ce8e93ea7205cd1cce29')
 
 prepare() {
     cd "${pkgname}-${pkgver}"