Review Results

Comment

The change only bumps pkgver in .SRCINFO from 26.2 to 26.3. This is metadata-only and does not alter sources, build steps, install scripts, dependencies, or shipped artifacts. No security-relevant behavior is introduced by this diff hunk alone.

@@ -1,6 +1,6 @@
 pkgbase = minecraft-server
 	pkgdesc = Minecraft server unit files, script, and jar
-	pkgver = 26.2
+	pkgver = 26.3
 	pkgrel = 1
 	url = https://minecraft.net/
 	install = minecraft-server.install

Comment

The change is a routine metadata refresh in .SRCINFO: it updates the pinned Minecraft server JAR version/hash from 26.2 to 26.3 and keeps the source on Mojang’s HTTPS launcher URL. No new sources, scripts, build steps, permissions, or install-time behavior are introduced by this diff. Risk is minimal and limited to the usual trust in the upstream binary already present in the package.

@@ -16,11 +16,11 @@ pkgbase = minecraft-server
 	optdepends = netcat: required in order to suspend an idle server
 	conflicts = minecraft-server-systemd
 	conflicts = minecraft-canary
-	noextract = minecraft_server.26.2.jar
+	noextract = minecraft_server.26.3.jar
 	backup = etc/conf.d/minecraft
-	source = minecraft_server.26.2n823e2250.jar::https://launcher.mojang.com/v1/objects/823e2250d24b3ddac457a60c92a6a941943fcd6a/server.jar
+	source = minecraft_server.26.3n33680f5f.jar::https://launcher.mojang.com/v1/objects/33680f5f2ac32864d6d7cf5e56a705fdb3e05f4c/server.jar
 	source = minecraft-server-1.0.4.tar.gz::https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v1.0.4.tar.gz
-	sha512sums = a7d6df49426295102c6ae8fc1453af64d463e4dd8523c870466dd0410d12a998aec464fdb7bbf99889c80fc72aaac26a55bc675d2e32f49ede0e1839ecaf4592
+	sha512sums = b72752ccbf9be62d4ec6aa9c7c2f53c6842a8f1eb0ce418256150f5993abea65f859af7d7c30df12c5a1f2831250458df06831e1db10501015501452ad260968
 	sha512sums = dd4d68ca061c97a1e3cb5c0bb68439f7d8d45b15092344f3c4dbd4f7f39fef433d566670ad440970061007d93055183b570c7bf98f09c111ecdf8ab0f208f556
 
 pkgname = minecraft-server

Comment

The change is a routine version bump in PKGBUILD: it updates the Minecraft server upstream object ID (_nonce) and the corresponding checksum for the downloaded server.jar, while leaving the source hosts unchanged (HTTPS Mojang/GitHub) and not introducing any new build-time execution, install-script behavior, or privilege/persistence mechanisms. No suspicious new sources or packaging logic were added in this diff.

@@ -3,8 +3,8 @@
 # Contributer: sowieso <sowieso@dukun.de>
 
 pkgname=minecraft-server
-pkgver=26.2
-_nonce=823e2250d24b3ddac457a60c92a6a941943fcd6a
+pkgver=26.3
+_nonce=33680f5f2ac32864d6d7cf5e56a705fdb3e05f4c
 pkgrel=1
 _mng_ver=1.0.4
 pkgdesc="Minecraft server unit files, script, and jar"

Comment

The change is a straightforward checksum update for the Mojang server JAR source in PKGBUILD. The source URLs remain HTTPS and pinned to a specific object hash/tag, there are no new build-time downloads, scripts, or packaging behavior changes, and the only modified field is the integrity hash corresponding to the upstream artifact. No privilege, persistence, or supply-chain red flags are introduced by this diff alone.

@@ -21,7 +21,7 @@ install="${pkgname}.install"
 source=("minecraft_server.${pkgver}n${_nonce:0:8}.jar"::"https://launcher.mojang.com/v1/objects/${_nonce}/server.jar"
 	"minecraft-server-${_mng_ver}.tar.gz"::"https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz")
 noextract=("minecraft_server.${pkgver}.jar")
-sha512sums=('a7d6df49426295102c6ae8fc1453af64d463e4dd8523c870466dd0410d12a998aec464fdb7bbf99889c80fc72aaac26a55bc675d2e32f49ede0e1839ecaf4592'
+sha512sums=('b72752ccbf9be62d4ec6aa9c7c2f53c6842a8f1eb0ce418256150f5993abea65f859af7d7c30df12c5a1f2831250458df06831e1db10501015501452ad260968'
             'dd4d68ca061c97a1e3cb5c0bb68439f7d8d45b15092344f3c4dbd4f7f39fef433d566670ad440970061007d93055183b570c7bf98f09c111ecdf8ab0f208f556')
 
 _game="minecraft"