Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.10.0 to 2.11.1. No source URLs, checksums, install scripts, or build logic are changed here, so there is no direct security impact visible in this diff. Based on the provided hunk alone, this appears low risk.

@@ -1,6 +1,6 @@
 pkgbase = mongosh-bin
 	pkgdesc = An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.
-	pkgver = 2.10.0
+	pkgver = 2.11.1
 	pkgrel = 1
 	url = https://github.com/mongodb-js/mongosh.git
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for a binary package, updating the release URLs and checksums from mongosh 2.10.0 to 2.11.1. The sources remain on the official GitHub release page over HTTPS, and the new hashes pin the downloaded artifacts. No new build-time execution, install-script, or privilege-related behavior is introduced by this metadata-only change. Risk is low.

@@ -9,9 +9,9 @@ pkgbase = mongosh-bin
 	depends = krb5
 	provides = mongosh
 	conflicts = mongosh
-	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.10.0/mongosh-2.10.0-linux-x64.tgz
-	sha256sums_x86_64 = 42034ba0fc9a48fd65ddcc5150b2e9d8a777965019220744baee42ee9669d543
-	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.10.0/mongosh-2.10.0-linux-arm64.tgz
-	sha256sums_aarch64 = 585da7587d862a2fc54f38e4db1d5bc17823cf29a51d3d73e5838b86778cb98a
+	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.11.1/mongosh-2.11.1-linux-x64.tgz
+	sha256sums_x86_64 = 3cc12c23fcd1ad8da2663316966cfff6b0b6a99e764972e9e16771168a9f4c3a
+	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.11.1/mongosh-2.11.1-linux-arm64.tgz
+	sha256sums_aarch64 = d7e959963d263c0230114a5c4fa6b7562d6c70dd437641c9ae156e3ae9d969d0
 
 pkgname = mongosh-bin

Comment

The change is a straightforward version bump of a prebuilt binary package from mongosh 2.10.0 to 2.11.1, with corresponding SHA-256 updates for the official GitHub release tarballs. The source URLs remain HTTPS and point to the upstream MongoDB JS GitHub releases, with no added scripts, patches, install hooks, or build-time network activity. I did not find any new supply-chain red flags in the diff itself.

@@ -3,7 +3,7 @@
 
 pkgname=mongosh-bin
 _pkgname=mongosh
-pkgver=2.10.0
+pkgver=2.11.1
 pkgrel=1
 pkgdesc='An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.'
 arch=('x86_64' 'aarch64')

Comment

The change only updates the SHA-256 checksums for the upstream release tarballs while keeping the source URLs pinned to the official GitHub release assets over HTTPS. No build logic, install scripts, permissions, or additional network-fetching behavior changed. On its face this is a routine integrity checksum refresh for a new upstream artifact, with no obvious supply-chain red flags in the diff itself.

@@ -17,8 +17,8 @@ _mongosh_folder=mongosh-${pkgver}-linux
 source_x86_64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-x64.tgz")
 source_aarch64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64.tgz")
 
-sha256sums_x86_64=('42034ba0fc9a48fd65ddcc5150b2e9d8a777965019220744baee42ee9669d543')
-sha256sums_aarch64=('585da7587d862a2fc54f38e4db1d5bc17823cf29a51d3d73e5838b86778cb98a')
+sha256sums_x86_64=('3cc12c23fcd1ad8da2663316966cfff6b0b6a99e764972e9e16771168a9f4c3a')
+sha256sums_aarch64=('d7e959963d263c0230114a5c4fa6b7562d6c70dd437641c9ae156e3ae9d969d0')
 
 package() {
 	if [ $CARCH = 'x86_64' ]; then