Review Results

Comment

The change is a straightforward version bump in .SRCINFO: pkgver and the corresponding upstream tarball URL/checksum were updated from 28.8 to 28.9. The source remains HTTPS and points to the official OpenJDK/jfx GitHub release archive, with no new build steps, scripts, or privilege-related artifacts introduced in this diff. No security red flags are evident from this metadata-only update.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.8
+	pkgver = 28.9
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from OpenJFX 28+8 to 28+9, with the corresponding source tarball filename and BLAKE2 checksum updated. The source remains an HTTPS GitHub release archive from the upstream project, and there are no new build steps, scripts, dependencies, or packaging behaviors introduced in this diff. No security-relevant red flags are visible in the provided hunk.

@@ -28,13 +28,13 @@ pkgbase = java-openjfx
 	makedepends = zip
 	makedepends = gradle
 	options = !lto
-	source = java-openjfx-28.8.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+8.tar.gz
+	source = java-openjfx-28.9.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+9.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = 6e1343f0f44fdaa48752b134277e08f6b08abff63c94dec15d791893f1020cfe63dabfcaa69777235bd92e049c98ef0e16775af499ba8d6cc51be966bb9af8f5
+	b2sums = 04dfed3bdb73c97e206ae396ce7ced7828d14ca28fabf428023769574f01b769fe1cae4b99a60bdcf81122df8cef9ee5820721315c7ced95c4780a2b57ab3113
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change is a one-line version bump in PKGBUILD from _tag='28+8' to _tag='28+9'. This only updates the packaged upstream release identifier and does not introduce new sources, build steps, scripts, permissions changes, or network behavior. No security-relevant behavior is altered in the provided diff.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=26
 _java_run_ver=25
-_tag='28+8'
+_tag='28+9'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change only bumps the upstream OpenJFX tag from 28+8 to 28+9 and updates the corresponding b2sum for the source archive. I do not see any new code execution, network access, privilege changes, install-script behavior, or packaging red flags in this diff. This appears to be a routine integrity/version update, with the checksum change matching the new source artifact.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('6e1343f0f44fdaa48752b134277e08f6b08abff63c94dec15d791893f1020cfe63dabfcaa69777235bd92e049c98ef0e16775af499ba8d6cc51be966bb9af8f5'
+b2sums=('04dfed3bdb73c97e206ae396ce7ced7828d14ca28fabf428023769574f01b769fe1cae4b99a60bdcf81122df8cef9ee5820721315c7ced95c4780a2b57ab3113'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'