Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.1.4 to 2.1.5. No sources, checksums, build steps, dependencies, install scripts, or packaging permissions are altered in the provided diff, so there is no new security concern visible here.

@@ -1,6 +1,6 @@
 pkgbase = syncthingtray
 	pkgdesc = Tray application for Syncthing
-	pkgver = 2.1.4
+	pkgver = 2.1.5
 	pkgrel = 1
 	url = https://github.com/Martchus/syncthingtray
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from syncthingtray 2.1.4 to 2.1.5, with the source URL still using HTTPS on the upstream GitHub release archive and the checksum updated accordingly. No new sources, build steps, install scripts, or privilege-related metadata were introduced in this diff. Based on the provided hunk alone, there are no evident security concerns.

@@ -26,8 +26,8 @@ pkgbase = syncthingtray
 	depends = qt5-base
 	depends = qt5-declarative
 	optdepends = gnome-shell-extension-appindicator: tray icon support for GNOME Shell
-	source = syncthingtray-2.1.4.tar.gz::https://github.com/Martchus/syncthingtray/archive/v2.1.4.tar.gz
-	sha256sums = 935143ffe94365551345ae5cf5b710539925bf48168b17360e94243a6e1a32d7
+	source = syncthingtray-2.1.5.tar.gz::https://github.com/Martchus/syncthingtray/archive/v2.1.5.tar.gz
+	sha256sums = fc6439ecb4cb31ce253dd16586b522f3342eb66ece211b303a8a86ff10e1cee3
 
 pkgname = syncthingtray
 	depends = qtutilities

Comment

The change is a routine version bump from 2.1.4 to 2.1.5 with a corresponding source tarball checksum update. The source remains an HTTPS GitHub release archive from the upstream project, and there are no new build-time downloads, scripts, privilege changes, or packaging behavior changes in the diff. No security concerns are evident from this hunk alone.

@@ -24,7 +24,7 @@ _enable_plasmoid=${SYNCTHING_TRAY_ENABLE_PLASMOID:-0}
 
 _reponame=syncthingtray
 pkgname=syncthingtray
-pkgver=2.1.4
+pkgver=2.1.5
 pkgrel=1
 arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64')
 pkgdesc='Tray application for Syncthing'

Comment

The change is a straightforward version bump in PKGBUILD from 2.1.4 to 2.1.5 with an updated SHA-256 checksum for the upstream GitHub release tarball. No new sources, build steps, install scripts, or privilege/network-related logic were introduced in the diff. Based on the provided hunk, there are no obvious security concerns.

@@ -44,7 +44,7 @@ checkdepends=('cppunit' 'syncthing' 'iproute2')
 [[ $_enable_plasmoid ]] && makedepends+=('plasma-framework5' 'extra-cmake-modules')
 url="https://github.com/Martchus/${_reponame}"
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Martchus/${_reponame}/archive/v${pkgver}.tar.gz")
-sha256sums=('935143ffe94365551345ae5cf5b710539925bf48168b17360e94243a6e1a32d7')
+sha256sums=('fc6439ecb4cb31ce253dd16586b522f3342eb66ece211b303a8a86ff10e1cee3')
 
 ephemeral_port() {
   comm -23 <(seq 49152 65535) <(ss -tan | awk '{print $4}' | cut -d':' -f2 | grep "[0-9]\{1,5\}" | sort | uniq) | shuf | head -n 1