Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.9.8 to 26.9.9. No source URLs, checksums, build steps, dependencies, install scripts, or packaging permissions are changed here, so there is no new security concern visible in this diff. Based on the provided hunk alone, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.8
+	pkgver = 26.9.9
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball from v26.9.8 to v26.9.9 on the official GitHub releases URL. The source remains HTTPS, points to the same upstream project, and there are no added build steps, scripts, or integrity red flags in this diff. No security concerns are introduced by this metadata-only update.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.8/qownnotes-26.9.8.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.9/qownnotes-26.9.9.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump in PKGBUILD: pkgver advances from 26.9.8 to 26.9.9 and the pinned VCS tag is updated to a new commit. No new sources, scripts, install hooks, permissions changes, or build-time network behavior are introduced in the diff hunk. Based on the provided change alone, there are no security red flags.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.8
-tag="23d12a4cb64e2e53a6e60000349195e91432f8ee"
+pkgver=26.9.9
+tag="e240b370e311b2300c4e4c56d36b409a5b918106"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains HTTPS and points to the official GitHub release asset for the same version, with no new build steps, scripts, or privilege-bearing artifacts introduced. I do not see any supply-chain red flags in this diff hunk itself.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('3cfa6ba2ccc5a346ab1e22a99a1142863a3fccd4609a63751d2af0451167cd17')
+sha256sums=('5ada41f55c5303e9c5debe84628af14f492207d9e3df319ccd02f53b69aed2f7')
 
 prepare() {
     cd "${pkgname}-${pkgver}"