Review Results

Comment

The change only bumps pkgver in .SRCINFO from 2.45.0 to 2.45.1. No source URLs, checksums, build steps, install scripts, or packaging logic are altered in the provided diff hunk, so there is no new security concern visible here. This is a metadata-only version update.

@@ -1,6 +1,6 @@
 pkgbase = spicetify-cli
 	pkgdesc = Command-line tool to customize Spotify client
-	pkgver = 2.45.0
+	pkgver = 2.45.1
 	pkgrel = 1
 	url = https://github.com/spicetify/cli
 	arch = x86_64

Comment

The change is limited to .SRCINFO metadata: pkgver is bumped from 2.45.0 to 2.45.1 and the source tarball checksum is updated. The source URL remains the official GitHub release archive over HTTPS, with no new sources, scripts, build steps, or packaging behavior introduced in this diff. I do note that the source filename still references 2.43.2 while the URL/tag and pkgver indicate a newer release, but that appears to be a pre-existing packaging inconsistency rather than a security issue in this change. No evidence of malicious behavior or integrity regression is present here.

@@ -12,6 +12,6 @@ pkgbase = spicetify-cli
         depends = glibc
 	optdepends = xdg-utils: Allows for opening directories in default file manager
 	source = spicetify-cli-2.43.2.tar.gz::https://github.com/spicetify/cli/archive/v2.43.2
-	sha256sums = 2e17c15a92093c62d011acd863f36148f8d5880292cadf41949eda320fd033c3
+	sha256sums = b20a6aa0e2e54491fb4b39a2329a793ec745a068071c4a1644cae61a4307cfa1
 
 pkgname = spicetify-cli

Comment

The change is a version bump in PKGBUILD from 2.45.0 to 2.45.1 with no other modifications shown. Based on the provided diff, there are no new sources, build steps, install scripts, permissions changes, or other security-relevant alterations. This appears to be a routine upstream version update and does not introduce an obvious supply-chain or privilege-escalation risk in the reviewed hunk.

@@ -1,6 +1,6 @@
 ## Maintainer: khanhas <xuankhanh963@gmail.com>, itsmeow <itsmeow@itsmeow.dev>
 pkgname=spicetify-cli
-pkgver=2.45.0
+pkgver=2.45.1
 pkgrel=1
 pkgdesc='Command-line tool to customize Spotify client'
 arch=('x86_64' 'i686')

Comment

The change is a routine upstream version bump from 2.45.0 to 2.45.1 with the corresponding source tarball checksum update. The source is still fetched over HTTPS from the upstream GitHub archive, there are no new build steps, no added scripts, and no changes to package install behavior or permissions. Based on the diff provided, I do not see any security-relevant regression.

@@ -10,7 +10,7 @@ makedepends=('go' 'pnpm')
 depends=('glibc' 'bash')
 optdepends=('xdg-utils: Allows for opening directories in default file manager')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
-sha256sums=('2e17c15a92093c62d011acd863f36148f8d5880292cadf41949eda320fd033c3')
+sha256sums=('b20a6aa0e2e54491fb4b39a2329a793ec745a068071c4a1644cae61a4307cfa1')
 
 prepare() {
   mv "cli-${pkgver}" "${pkgname}-${pkgver}"