Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.1.5 to 2.1.6. No sources, checksums, dependencies, install scripts, or build logic changed in the reviewed diff, so there is no new security-relevant behavior to assess from this hunk alone.

@@ -1,6 +1,6 @@
 pkgbase = syncthingtray
 	pkgdesc = Tray application for Syncthing
-	pkgver = 2.1.5
+	pkgver = 2.1.6
 	pkgrel = 1
 	url = https://github.com/Martchus/syncthingtray
 	arch = i686

Comment

The change is a routine upstream version bump in .SRCINFO from syncthingtray 2.1.5 to 2.1.6, with the source URL still using HTTPS to the official GitHub release archive and the checksum updated accordingly. No new sources, scripts, install hooks, or packaging behavior are introduced in this diff. Based on the provided hunk alone, there are no security red flags.

@@ -26,8 +26,8 @@ pkgbase = syncthingtray
 	depends = qt5-base
 	depends = qt5-declarative
 	optdepends = gnome-shell-extension-appindicator: tray icon support for GNOME Shell
-	source = syncthingtray-2.1.5.tar.gz::https://github.com/Martchus/syncthingtray/archive/v2.1.5.tar.gz
-	sha256sums = fc6439ecb4cb31ce253dd16586b522f3342eb66ece211b303a8a86ff10e1cee3
+	source = syncthingtray-2.1.6.tar.gz::https://github.com/Martchus/syncthingtray/archive/v2.1.6.tar.gz
+	sha256sums = aab82815261a5ef9688b944d6d1d4f8b41e178d39a5b69da56d719e3ec5b70cc
 
 pkgname = syncthingtray
 	depends = qtutilities

Comment

The change is a straightforward version bump in PKGBUILD from 2.1.5 to 2.1.6 with the corresponding source tarball checksum update. The source remains an HTTPS GitHub release archive from the upstream project, and there are no new build steps, scripts, dependencies, or packaging behaviors introduced by this diff. No security red flags are evident in the reviewed hunk.

@@ -24,7 +24,7 @@ _enable_plasmoid=${SYNCTHING_TRAY_ENABLE_PLASMOID:-0}
 
 _reponame=syncthingtray
 pkgname=syncthingtray
-pkgver=2.1.5
+pkgver=2.1.6
 pkgrel=1
 arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64')
 pkgdesc='Tray application for Syncthing'

Comment

The change only updates the SHA-256 checksum for the upstream source tarball in PKGBUILD. The source URL remains HTTPS and points to the official GitHub repository archive for the project, with no new build steps, scripts, or privilege/network changes introduced. I did not find any additional red flags in this hunk.

@@ -44,7 +44,7 @@ checkdepends=('cppunit' 'syncthing' 'iproute2')
 [[ $_enable_plasmoid ]] && makedepends+=('plasma-framework5' 'extra-cmake-modules')
 url="https://github.com/Martchus/${_reponame}"
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Martchus/${_reponame}/archive/v${pkgver}.tar.gz")
-sha256sums=('fc6439ecb4cb31ce253dd16586b522f3342eb66ece211b303a8a86ff10e1cee3')
+sha256sums=('aab82815261a5ef9688b944d6d1d4f8b41e178d39a5b69da56d719e3ec5b70cc')
 
 ephemeral_port() {
   comm -23 <(seq 49152 65535) <(ss -tan | awk '{print $4}' | cut -d':' -f2 | grep "[0-9]\{1,5\}" | sort | uniq) | shuf | head -n 1