Review Results

Comment

The change is a simple version bump in .SRCINFO from 26.9.6 to 26.9.7 with no accompanying changes to sources, build logic, install scripts, or package metadata beyond pkgver. On its face this does not introduce any new security-relevant behavior or integrity risk in the reviewed diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.6
+	pkgver = 26.9.7
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from qownnotes 26.9.6 to 26.9.7, updating the release tarball URL accordingly. No new sources, scripts, build steps, permissions, or packaging metadata were introduced, and the source remains an HTTPS GitHub release archive. Based on the provided diff alone, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.6/qownnotes-26.9.6.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.7/qownnotes-26.9.7.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in a PKGBUILD: it updates pkgver, the pinned upstream commit/tag, and the source tarball checksum. The source remains an HTTPS release artifact from the official GitHub upstream, and there are no new build-time commands, network fetches, privilege changes, install-script changes, or packaging red flags introduced by this diff. No security issue is evident from the reviewed hunk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.6
-tag="5a348174f6b63bc63ae47fdafc127dca13a91eac"
+pkgver=26.9.7
+tag="39316deefa67391e51437f4910c8e5d403f99ebb"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball source URL. The source remains an HTTPS GitHub release asset pinned to the package version, with no new build steps, scripts, network fetches, or packaging behavior changes. I did not find any additional red flags in this diff hunk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('a45ca225eca4717121a29aa349e8cd50f216daab2a4f7336decea691e342f830')
+sha256sums=('2676c90912ddfe9c2485d55b87cd4ae021cb4592c5711737da35c029fa018399')
 
 prepare() {
     cd "${pkgname}-${pkgver}"