Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 26.9.4 to 26.9.5 with no accompanying changes to sources, checksums, build logic, install scripts, or package metadata. On its face this does not introduce any new security-relevant behavior. I did not see evidence of suspicious URLs, build-time downloads, privilege escalation, or persistence mechanisms in the provided diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.4
+	pkgver = 26.9.5
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO from QOwnNotes 26.9.4 to 26.9.5, with the source URL still using HTTPS and pointing to the official GitHub release asset. No new sources, scripts, build steps, permissions, or packaging metadata were introduced. Based on the provided diff alone, this does not add any security risk beyond the normal trust in the upstream release artifact.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.4/qownnotes-26.9.4.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.5/qownnotes-26.9.5.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a straightforward version bump in PKGBUILD, updating pkgver and the pinned upstream git tag. No new sources, build steps, install scripts, permissions changes, or other execution paths are introduced by this diff. Based on the provided hunk alone, there are no security red flags.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.4
-tag="8c3f9d14e1e57f4ab86b86f1deafe5f3988bc3a4"
+pkgver=26.9.5
+tag="3b96198566312459595b82c2c337bd856e3a5c5b"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball while keeping the source URL pinned to the GitHub release for the same version. No build logic, install scripts, or additional sources were introduced, and there are no signs of network fetches or code execution changes in the diff. Security impact is limited to integrity verification of the expected upstream artifact.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('94905a5cd03f07d398d6ab6138b82a9d63e413f43243ce8e93ea7205cd1cce29')
+sha256sums=('f2fdcc03bbfde6183b23118b15ba26a6d92c8a7512ffd14859a3ea8e61b49f8c')
 
 prepare() {
     cd "${pkgname}-${pkgver}"