Review Results

Comment

The change only bumps pkgver in .SRCINFO from 4.2.1 to 4.2.2. No sources, checksums, build steps, install scripts, or permissions are altered in the reviewed diff, so there is no new security concern visible here. This is a metadata-only version update.

@@ -1,6 +1,6 @@
 pkgbase = lcevcdec
 	pkgdesc = Low Complexity Enhancement Video Codec Decoder (LCEVC_DEC)
-	pkgver = 4.2.1
+	pkgver = 4.2.2
 	pkgrel = 1
 	url = https://github.com/v-novaltd/LCEVCdec/
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO from LCEVCdec 4.2.1 to 4.2.2, with the source still pinned to an HTTPS GitHub tag. No new sources, scripts, install hooks, or packaging behavior are introduced by this diff, and there are no obvious integrity red flags in the metadata change itself. Risk is therefore minimal.

@@ -14,7 +14,7 @@ pkgbase = lcevcdec
 	depends = libgcc
 	depends = libstdc++
 	options = !emptydirs
-	source = git+https://github.com/v-novaltd/LCEVCdec.git#tag=4.2.1
-	sha256sums = f9bb4b3e4c5fbc45a8b9816d595ee0afcb09dd6fe80b5c27d973ab2554799c96
+	source = git+https://github.com/v-novaltd/LCEVCdec.git#tag=4.2.2
+	sha256sums = 4f3fc9ba674c05a5a10e0db820094a51bbae0aef5924e148446187a4b3885a0a
 
 pkgname = lcevcdec

Comment

The change is a routine version bump from 4.2.1 to 4.2.2 with the corresponding source checksum update. The source remains pinned to an HTTPS GitHub tag, there are no new build steps, no added scripts, and no packaging or privilege-related changes. I did not find any security-relevant red flags in this diff.

@@ -1,7 +1,7 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=lcevcdec
-pkgver=4.2.1
+pkgver=4.2.2
 pkgrel=1
 pkgdesc='Low Complexity Enhancement Video Codec Decoder (LCEVC_DEC)'
 arch=('x86_64')

Comment

The change is a straightforward version bump from 4.2.1 to 4.2.2 with the corresponding checksum update for the same upstream GitHub source. The source remains HTTPS and points to the official upstream repository, and there are no added build-time downloads, scripts, privilege changes, or packaging behavior changes in this diff. No security-relevant red flags are introduced by this hunk.

@@ -19,7 +19,7 @@ makedepends=(
     'rapidjson')
 options=('!emptydirs')
 source=("git+https://github.com/v-novaltd/LCEVCdec.git#tag=${pkgver}")
-sha256sums=('f9bb4b3e4c5fbc45a8b9816d595ee0afcb09dd6fe80b5c27d973ab2554799c96')
+sha256sums=('4f3fc9ba674c05a5a10e0db820094a51bbae0aef5924e148446187a4b3885a0a')
 
 export GIT_LFS_SKIP_SMUDGE='1'