Review Results

Comment

The change is a straightforward version bump in .SRCINFO from Burp Suite 2026.8 to 2026.9, updating the pinned upstream JAR URL, noextract entry, and checksum. The source remains HTTPS on the official PortSwigger CDN, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Risk is low.

@@ -1,18 +1,18 @@
 pkgbase = burpsuite
 	pkgdesc = An integrated platform for performing security testing of web applications (free edition)
-	pkgver = 2026.8
+	pkgver = 2026.9
 	pkgrel = 1
 	url = https://portswigger.net/burp/
 	install = burpsuite.install
 	arch = any
 	license = custom
 	depends = java-runtime>=21
-	noextract = burpsuite-2026.8.jar
-	source = burpsuite-2026.8.jar::https://portswigger-cdn.net/burp/releases/download?product=desktop&version=2026.8&type=Jar
+	noextract = burpsuite-2026.9.jar
+	source = burpsuite-2026.9.jar::https://portswigger-cdn.net/burp/releases/download?product=desktop&version=2026.9&type=Jar
 	source = LICENSE
 	source = burpsuite.desktop
 	source = icon64.png
-	sha256sums = 888f0588cf82a3b70d508dcbf07591184a26249e38cda8ea8b5a68f4b5a30789
+	sha256sums = d6c80be60575b59a3097e939b1cf4acf2efd104c0f6ed05166753180365fc7fc
 	sha256sums = a1146672de7084a1cddc5b7dab4d18b3530c194bd6e45a2b0ac04b579751ca30
 	sha256sums = 950c61d7ce1257c21a4152abebb8da320d0206ceb59247d6c912903d1ed39fc8
 	sha256sums = d31232a7dbdab9d5723f12aa25c52d13fd46ef2e8837a85fb9a08c3a7f151541

Comment

The change is a trivial version bump in PKGBUILD from 2026.8 to 2026.9 with no accompanying changes to sources, checksums, build logic, install scripts, or packaging behavior. Based on the provided diff, there are no new supply-chain, persistence, privilege-escalation, or integrity concerns introduced by this commit.

@@ -7,7 +7,7 @@
 # Contributor: kageurufu
 
 pkgname=burpsuite
-pkgver=2026.8
+pkgver=2026.9
 pkgrel=1
 pkgdesc="An integrated platform for performing security testing of web applications (free edition)"
 url="https://portswigger.net/burp/"

Comment

The change only updates the SHA-256 checksum for the upstream Burp Suite JAR in PKGBUILD. The source URL remains the official HTTPS PortSwigger CDN, there are no new sources, no build-script changes, and no evidence of added execution, persistence, or privilege escalation. This is a routine integrity update consistent with an upstream release refresh.

@@ -23,7 +23,7 @@ source=("${pkgname}-${pkgver}.jar::https://portswigger-cdn.net/burp/releases/dow
         burpsuite.desktop
         icon64.png)
 install=burpsuite.install
-sha256sums=('888f0588cf82a3b70d508dcbf07591184a26249e38cda8ea8b5a68f4b5a30789'
+sha256sums=('d6c80be60575b59a3097e939b1cf4acf2efd104c0f6ed05166753180365fc7fc'
             'a1146672de7084a1cddc5b7dab4d18b3530c194bd6e45a2b0ac04b579751ca30'
             '950c61d7ce1257c21a4152abebb8da320d0206ceb59247d6c912903d1ed39fc8'
             'd31232a7dbdab9d5723f12aa25c52d13fd46ef2e8837a85fb9a08c3a7f151541')