Review Results

Comment

The change only bumps the package version in .SRCINFO from 26.9.7 to 26.9.8. No source URLs, checksums, build steps, install scripts, permissions, or other packaging metadata changed in the reviewed hunk. On its face this is a routine version update with no security-relevant indicators in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.7
+	pkgver = 26.9.8
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from v26.9.7 to v26.9.8. The source remains an HTTPS GitHub release artifact from the official project, with no new build steps, scripts, patches, or dependency changes introduced in this diff. No obvious supply-chain or packaging red flags are present in the reviewed hunk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.7/qownnotes-26.9.7.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.8/qownnotes-26.9.8.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: it updates pkgver, the pinned VCS tag, and the release tarball checksum to match the new upstream release. The source remains an HTTPS GitHub release tarball, there are no new build-time network fetches, no added scripts, and no packaging/persistence red flags in the diff. Based on the provided hunk alone, this looks low risk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.7
-tag="39316deefa67391e51437f4910c8e5d403f99ebb"
+pkgver=26.9.8
+tag="23d12a4cb64e2e53a6e60000349195e91432f8ee"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball while keeping the source URL pinned to the official GitHub release asset over HTTPS. No build logic, install scripts, or additional sources were introduced, and there are no signs of network fetches, privilege escalation, or persistence mechanisms in this diff hunk. This is a routine integrity checksum refresh with low security risk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('2676c90912ddfe9c2485d55b87cd4ae021cb4592c5711737da35c029fa018399')
+sha256sums=('3cfa6ba2ccc5a346ab1e22a99a1142863a3fccd4609a63751d2af0451167cd17')
 
 prepare() {
     cd "${pkgname}-${pkgver}"