Review Results

Comment

The change only bumps pkgver in .SRCINFO from 2026.804.2 to 2026.920.0. No source URLs, checksums, install scripts, build commands, or packaging metadata beyond the version number are altered in the provided diff. On its face this is a routine version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = osu-lazer-bin
 	pkgdesc = The future of osu! and the beginning of an open era! Commonly known by the codename osu!lazer. Pew pew.
-	pkgver = 2026.804.2
+	pkgver = 2026.920.0
 	pkgrel = 1
 	url = https://osu.ppy.sh
 	arch = x86_64

Comment

The change is a straightforward upstream version bump for the AppImage source in .SRCINFO, with the corresponding checksum updated. The source remains the official GitHub release URL over HTTPS, and there are no new build steps, scripts, or privilege-related artifacts introduced by this diff. No security red flags are evident in the provided hunk.

@@ -15,13 +15,13 @@ pkgbase = osu-lazer-bin
 	noextract = osu.AppImage
 	options = !strip
 	options = !debug
-	source = osu-lazer-2026.804.2.AppImage::https://github.com/ppy/osu/releases/download/2026.804.2-lazer/osu.AppImage
+	source = osu-lazer-2026.920.0.AppImage::https://github.com/ppy/osu/releases/download/2026.920.0-lazer/osu.AppImage
 	source = icon.png
 	source = https://raw.githubusercontent.com/ppy/osu-resources/master/LICENCE.md
 	source = osu-lazer.desktop
 	source = osu-lazer-uri-handler.desktop
 	source = osu-lazer
-	sha256sums = d0afddcaf230ae507371ec580c20a294d92725d1198dad4e4df028b4fe8cbe36
+	sha256sums = 0fe8853a6051c7fc137c51ef83cdecb6897e865e123444b60e20b82f9a56606c
 	sha256sums = 30cf4df3fd76006b08a0bcb6a325fb2fdcf6a4371f77001da3c38cbce871bd51
 	sha256sums = 30b914824784b6ba6b30a44b22bea4f3c6fbc10f3f0e74fde5ca76a92ef57244
 	sha256sums = 7e80497273890b3f0729898921d61258138cc29d3d074cd50dd7813c3b083932

Comment

The change is a routine version bump in PKGBUILD: pkgver and the corresponding source checksum were updated, with no new sources, scripts, install hooks, or build logic changes. I did not find any supply-chain red flags in this diff hunk itself.

@@ -6,7 +6,7 @@
 
 pkgname=osu-lazer-bin
 _pkgname=${pkgname%-bin}
-pkgver=2026.804.2
+pkgver=2026.920.0
 _pkgtag=$pkgver-lazer
 pkgrel=1
 pkgdesc="The future of osu! and the beginning of an open era! Commonly known by the codename osu!lazer. Pew pew."

Comment

The change is a routine version bump for a prebuilt AppImage package, with only the expected SHA-256 checksum updated to match the new upstream release. No new sources, scripts, install hooks, privilege changes, or build-time network behavior were introduced in the diff. The package still downloads the binary from the official GitHub releases URL over HTTPS and installs it under $pkgdir only. Risk is low, though as with any -bin package the trust boundary remains upstream-provided binaries.

@@ -31,7 +31,7 @@ source=(
   "osu-lazer"
 )
 noextract=("osu.AppImage")
-sha256sums=('d0afddcaf230ae507371ec580c20a294d92725d1198dad4e4df028b4fe8cbe36'
+sha256sums=('0fe8853a6051c7fc137c51ef83cdecb6897e865e123444b60e20b82f9a56606c'
             '30cf4df3fd76006b08a0bcb6a325fb2fdcf6a4371f77001da3c38cbce871bd51'
             '30b914824784b6ba6b30a44b22bea4f3c6fbc10f3f0e74fde5ca76a92ef57244'
             '7e80497273890b3f0729898921d61258138cc29d3d074cd50dd7813c3b083932'