Review Results

Comment

The change only bumps pkgver in .SRCINFO from 4.1.13.9 to 4.1.13.23. No build logic, sources, checksums, install scripts, or packaging behavior changed in the reviewed diff. On its face this is a routine version metadata update with no security-relevant indicators.

@@ -1,6 +1,6 @@
 pkgbase = wechat-universal-bwrap
 	pkgdesc = WeChat (Universal) with bwrap sandbox
-	pkgver = 4.1.13.9
+	pkgver = 4.1.13.23
 	pkgrel = 1
 	url = https://linux.weixin.qq.com/
 	install = wechat-universal.install

Comment

The change is a routine version bump in .SRCINFO for an AUR package. The source URLs remain HTTPS and still point to the official Tencent download host, and the only substantive changes are updated filenames and SHA-256 checksums for the new release artifacts. No new execution paths, install-script changes, privilege escalation, or suspicious sources are introduced by this diff. Risk is therefore minimal.

@@ -31,9 +31,9 @@ pkgbase = wechat-universal-bwrap
 	conflicts = wechat-universal
 	replaces = wechat-beta
 	replaces = wechat-beta-bwrap
-	noextract = wechat-universal-4.1.13.9-x86_64.deb
-	noextract = wechat-universal-4.1.13.9-aarch64.deb
-	noextract = wechat-universal-4.1.13.9-loong64.deb
+	noextract = wechat-universal-4.1.13.23-x86_64.deb
+	noextract = wechat-universal-4.1.13.23-aarch64.deb
+	noextract = wechat-universal-4.1.13.23-loong64.deb
 	options = !strip
 	options = !debug
 	options = emptydirs

Comment

The change only updates the pinned upstream WeChat .deb version and corresponding SHA256 checksums in .SRCINFO for three architectures. The download URLs remain HTTPS and point to the same official Tencent host, with no new sources, scripts, or build logic introduced. This is a routine version bump with no evident security regression in the diff reviewed.

@@ -47,11 +47,11 @@ pkgbase = wechat-universal-bwrap
 	sha256sums = fc3ce9eb8dee3ee149233ebdb844d3733b2b2a8664422d068cf39b7fb08138f8
 	sha256sums = f05f6f907898740dab9833c1762e56dbc521db3c612dd86d2e2cd4b81eb257bf
 	sha256sums = 898ebc397583d111db9a337e9d09aaee2f795fcd720e65cab5ce0e92efcd8f10
-	source_x86_64 = wechat-universal-4.1.13.9-x86_64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb
-	sha256sums_x86_64 = 096865e050ba0d3c1a23887227e2400bf343037b1d7d658c84c88ff26bfdc17f
-	source_aarch64 = wechat-universal-4.1.13.9-aarch64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb
-	sha256sums_aarch64 = a6d115d24dfe3ed1b7e7de16cf6cc02acef8df5668150f702ac8d8c5256405fa
-	source_loong64 = wechat-universal-4.1.13.9-loong64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_LoongArch.deb
-	sha256sums_loong64 = 2d13aad578bb6e2d66ef3d71cfcfc0ad59fc34fc6e6e8f1eb3091f063cd12ece
+	source_x86_64 = wechat-universal-4.1.13.23-x86_64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb
+	sha256sums_x86_64 = b7d0f8d53e9f648bc2c77a6096a04100d008f2d9f0d3988a2a4859b5992aca0a
+	source_aarch64 = wechat-universal-4.1.13.23-aarch64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb
+	sha256sums_aarch64 = 51784a262c725ef1595dd833f456190e913583dd81c24dd8fe587532bc91c0dc
+	source_loong64 = wechat-universal-4.1.13.23-loong64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_LoongArch.deb
+	sha256sums_loong64 = c4fa465e9d861e11057bdd0f320947be506a1d40785b171882e42c1e9dee3107
 
 pkgname = wechat-universal-bwrap

Comment

The change only bumps pkgver and updates the per-architecture sha256 checksums in PKGBUILD. I did not find any new sources, build steps, scripts, or packaging logic changes, and there are no signs of network fetches, privilege escalation, or persistence mechanisms introduced by this diff. Based on the provided hunk alone, this is a routine version/checksum update with low security risk.

@@ -4,7 +4,7 @@
 
 _pkgname=wechat-universal
 pkgname=${_pkgname}-bwrap
-pkgver=4.1.13.9
+pkgver=4.1.13.23
 pkgrel=1
 pkgdesc="WeChat (Universal) with bwrap sandbox"
 arch=('x86_64' 'aarch64' 'loong64')

Comment

The change only bumps pkgver and updates the per-architecture sha256 checksums in PKGBUILD. I do not see any new code execution, network fetches, privilege changes, install-script behavior, or packaging logic changes in the reviewed hunk. The risk is low, though the new checksums should still be trusted only insofar as they correspond to the expected upstream release artifacts.

@@ -70,13 +70,13 @@ sha256sums=(
 )
 
 sha256sums_x86_64=(
-    '096865e050ba0d3c1a23887227e2400bf343037b1d7d658c84c88ff26bfdc17f'
+    'b7d0f8d53e9f648bc2c77a6096a04100d008f2d9f0d3988a2a4859b5992aca0a'
 )
 sha256sums_aarch64=(
-    'a6d115d24dfe3ed1b7e7de16cf6cc02acef8df5668150f702ac8d8c5256405fa'
+    '51784a262c725ef1595dd833f456190e913583dd81c24dd8fe587532bc91c0dc'
 )
 sha256sums_loong64=(
-    '2d13aad578bb6e2d66ef3d71cfcfc0ad59fc34fc6e6e8f1eb3091f063cd12ece'
+    'c4fa465e9d861e11057bdd0f320947be506a1d40785b171882e42c1e9dee3107'
 )
 
 prepare() {