Review Results

Comment

The change is a simple version bump in .SRCINFO from 26.9.5 to 26.9.6 with no accompanying changes to sources, build logic, install scripts, or metadata that would introduce new attack surface. On its face this is low risk; however, because only .SRCINFO is shown, I can only assess the diff itself, not the underlying PKGBUILD or upstream release contents. Based on the provided change alone, there are no security red flags.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.5
+	pkgver = 26.9.6
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball from 26.9.5 to 26.9.6. The source remains an HTTPS GitHub release asset from the project’s official repository, with no new build steps, scripts, or integrity red flags introduced by this diff. No evidence of malicious behavior or packaging hygiene regressions in the reviewed hunk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.5/qownnotes-26.9.5.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.6/qownnotes-26.9.6.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: pkgver/tag and the release tarball checksum were updated, with no new build steps, scripts, dependencies, or install-time behavior introduced. The source remains an HTTPS GitHub release tarball pinned by version, and the checksum update preserves integrity verification. No security red flags are visible in this diff.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.5
-tag="3b96198566312459595b82c2c337bd856e3a5c5b"
+pkgver=26.9.6
+tag="5a348174f6b63bc63ae47fdafc127dca13a91eac"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains HTTPS and points to the official GitHub release asset for the pinned version, with no new build-time downloads, scripts, or packaging behavior changes. This is a routine integrity update and does not introduce a security concern on its own.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('f2fdcc03bbfde6183b23118b15ba26a6d92c8a7512ffd14859a3ea8e61b49f8c')
+sha256sums=('a45ca225eca4717121a29aa349e8cd50f216daab2a4f7336decea691e342f830')
 
 prepare() {
     cd "${pkgname}-${pkgver}"