Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.11.1 to 2.12.0. No source URLs, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the provided diff. Based on this hunk alone, there is no evidence of a security issue.

@@ -1,6 +1,6 @@
 pkgbase = mongosh-bin
 	pkgdesc = An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.
-	pkgver = 2.11.1
+	pkgver = 2.12.0
 	pkgrel = 1
 	url = https://github.com/mongodb-js/mongosh.git
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for a binary package, updating GitHub release tarball URLs and their SHA256 checksums for x86_64 and aarch64. The sources are HTTPS, point to the upstream MongoDB JS mongosh release, and remain pinned to a specific release artifact rather than a floating branch. No new build-time code, install scripts, or privilege-related changes are introduced in this diff. Based on the provided hunk alone, this looks low risk.

@@ -9,9 +9,9 @@ pkgbase = mongosh-bin
 	depends = krb5
 	provides = mongosh
 	conflicts = mongosh
-	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.11.1/mongosh-2.11.1-linux-x64.tgz
-	sha256sums_x86_64 = 3cc12c23fcd1ad8da2663316966cfff6b0b6a99e764972e9e16771168a9f4c3a
-	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.11.1/mongosh-2.11.1-linux-arm64.tgz
-	sha256sums_aarch64 = d7e959963d263c0230114a5c4fa6b7562d6c70dd437641c9ae156e3ae9d969d0
+	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.12.0/mongosh-2.12.0-linux-x64.tgz
+	sha256sums_x86_64 = aa42cb826b7b8e655c5481293f5365ddaf1a23e43af07520326e5bbc957838ad
+	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.12.0/mongosh-2.12.0-linux-arm64.tgz
+	sha256sums_aarch64 = 99f8d38d41c510e7d4c685b71022ea1db113245968d5d933b5333fb3835e64ae
 
 pkgname = mongosh-bin

Comment

The change is a straightforward version bump in PKGBUILD from mongosh 2.11.1 to 2.12.0, with corresponding checksum updates for the official GitHub release tarballs. The source URLs remain HTTPS and point to the upstream mongodb-js/mongosh release assets, with no added build-time downloads, scripts, patches, or packaging logic changes. No new privilege, persistence, or integrity red flags are introduced by this diff alone.

@@ -3,7 +3,7 @@
 
 pkgname=mongosh-bin
 _pkgname=mongosh
-pkgver=2.11.1
+pkgver=2.12.0
 pkgrel=1
 pkgdesc='An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.'
 arch=('x86_64' 'aarch64')

Comment

The change only updates the SHA-256 checksums for the upstream release tarballs in PKGBUILD. The source URLs remain HTTPS and point to the official MongoDB JS GitHub release assets, with no new build steps, scripts, or packaging behavior introduced. This is a routine integrity pin update and does not add obvious supply-chain or privilege-escalation risk in the diff shown.

@@ -17,8 +17,8 @@ _mongosh_folder=mongosh-${pkgver}-linux
 source_x86_64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-x64.tgz")
 source_aarch64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64.tgz")
 
-sha256sums_x86_64=('3cc12c23fcd1ad8da2663316966cfff6b0b6a99e764972e9e16771168a9f4c3a')
-sha256sums_aarch64=('d7e959963d263c0230114a5c4fa6b7562d6c70dd437641c9ae156e3ae9d969d0')
+sha256sums_x86_64=('aa42cb826b7b8e655c5481293f5365ddaf1a23e43af07520326e5bbc957838ad')
+sha256sums_aarch64=('99f8d38d41c510e7d4c685b71022ea1db113245968d5d933b5333fb3835e64ae')
 
 package() {
 	if [ $CARCH = 'x86_64' ]; then