Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 5.35.0 to 5.36.0. No source URLs, checksums, build steps, install scripts, permissions, or other packaging metadata changed in the provided diff. On its face this is a routine upstream version update with no direct security red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = c++utilities
 	pkgdesc = Common C++ classes and routines such as argument parser, IO and conversion utilities
-	pkgver = 5.35.0
+	pkgver = 5.36.0
 	pkgrel = 1
 	url = https://github.com/Martchus/cpp-utilities
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO from 5.35.0 to 5.36.0, with the source URL still using HTTPS on the official GitHub repository and the checksum updated accordingly. No new sources, build steps, install scripts, or packaging directives are introduced by this diff, so there is no evident security impact from the metadata change alone.

@@ -17,7 +17,7 @@ pkgbase = c++utilities
 	depends = libgcc
 	optdepends = c++utilities-doc: API documentation
 	provides = libc++utilities.so
-	source = c++utilities-5.35.0.tar.gz::https://github.com/Martchus/cpp-utilities/archive/v5.35.0.tar.gz
-	sha256sums = f9e2171ba59a6588afac03b7a8f019ea3170522e96786b2ade5f8f2c9a9157bb
+	source = c++utilities-5.36.0.tar.gz::https://github.com/Martchus/cpp-utilities/archive/v5.36.0.tar.gz
+	sha256sums = 364d43b7cf0ac9225300231d1c3da1f87b9c4a8cb03c24594df505ecb55594d2
 
 pkgname = c++utilities

Comment

The change is a straightforward version bump from 5.35.0 to 5.36.0 with the corresponding source tarball checksum update. The source remains an HTTPS GitHub release archive from the upstream project, and there are no added build-time commands, install scripts, patches, or packaging changes that would introduce supply-chain or privilege-escalation risk. No red flags are visible in this diff.

@@ -5,7 +5,7 @@
 
 _reponame=cpp-utilities
 pkgname=c++utilities
-pkgver=5.35.0
+pkgver=5.36.0
 pkgrel=1
 arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64')
 pkgdesc='Common C++ classes and routines such as argument parser, IO and conversion utilities'

Comment

The change only updates the SHA-256 checksum for the upstream source tarball in PKGBUILD. The source URL remains HTTPS and points to the official GitHub repository, with no new build steps, scripts, dependencies, or packaging behavior introduced. This is a routine integrity update consistent with a new upstream release or repackaged source archive, and I see no security red flags in the diff provided.

@@ -17,7 +17,7 @@ checkdepends=('cppunit')
 provides=(libc++utilities.so)
 url="https://github.com/Martchus/${_reponame}"
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Martchus/${_reponame}/archive/v${pkgver}.tar.gz")
-sha256sums=('f9e2171ba59a6588afac03b7a8f019ea3170522e96786b2ade5f8f2c9a9157bb')
+sha256sums=('364d43b7cf0ac9225300231d1c3da1f87b9c4a8cb03c24594df505ecb55594d2')
 
 build() {
   cd "$srcdir/${PROJECT_DIR_NAME:-$_reponame-$pkgver}"