Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 9.0.19 to 9.0.21. No source URLs, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the provided diff. Based on this hunk alone, there is no evidence of a security issue.

@@ -1,6 +1,6 @@
 pkgbase = seafile-client
 	pkgdesc = GUI client for synchronizing your local files with seafile server
-	pkgver = 9.0.19
+	pkgver = 9.0.21
 	pkgrel = 1
 	url = https://github.com/haiwen/seafile-client
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO: it updates the upstream GitHub release tarball from v9.0.19 to v9.0.21, adjusts the seafile dependency floor accordingly, and refreshes the checksum. The source remains HTTPS and points to the official upstream repository, with no new build-time commands, scripts, or privilege-related artifacts introduced in this diff. No security-relevant red flags are visible in the provided hunk.

@@ -11,14 +11,14 @@ pkgbase = seafile-client
 	license = Apache
 	makedepends = cmake
 	makedepends = qt6-tools
-	depends = seafile>=9.0.19
+	depends = seafile>=9.0.21
 	depends = qt6-base
 	depends = qt6-webengine
 	depends = qt6-5compat
 	optdepends = gtk-update-icon-cache
-	source = seafile-client-9.0.19.tar.gz::https://github.com/haiwen/seafile-client/archive/v9.0.19.tar.gz
+	source = seafile-client-9.0.21.tar.gz::https://github.com/haiwen/seafile-client/archive/v9.0.21.tar.gz
 	source = fix_build_with_QT6.diff
-	sha256sums = 4f93fcd463039d4f4de3269e2d9270a727f00a890c18862a7282aa9d95d01ea8
+	sha256sums = a074031607c3a7948ff37fe2b4ac7d9653128a2f0edc5a1ba5797afb5870dd31
 	sha256sums = 3b07339e4cd5f453d4cbec400201daa35c5813761f241b56793aab553362c068
 
 pkgname = seafile-client

Comment

The change is a straightforward version bump in PKGBUILD from 9.0.19 to 9.0.21 with the corresponding source checksum updated. No new sources, no build-script changes, no network-at-build-time behavior, and no packaging/install logic changes are introduced by this diff. Based on the provided hunk alone, I see no security-relevant regression.

@@ -4,7 +4,7 @@
 # Contributor: Edvinas Valatka <edacval@gmail.com>
 
 pkgname=seafile-client
-pkgver=9.0.19
+pkgver=9.0.21
 pkgrel=1
 pkgdesc='GUI client for synchronizing your local files with seafile server'
 arch=('i686' 'x86_64' 'armv7h' 'armv6h' 'aarch64')

Comment

The change is limited to bumping pkgver from 9.0.19 to 9.0.21 and updating the corresponding source tarball checksum. The source is fetched over HTTPS from the upstream GitHub repository, and there are no new build steps, network fetches, privilege escalations, or packaging changes introduced by this diff. I did not see any suspicious metadata changes (dependencies, provides/conflicts, install scripts, or embedded binaries) in the reviewed hunk. Risk is low because this is a routine version/checksum update, though the actual tarball contents are not inspected here beyond the checksum update.

@@ -23,7 +23,7 @@ source=(
     'fix_build_with_QT6.diff'
 )
 sha256sums=(
-    '4f93fcd463039d4f4de3269e2d9270a727f00a890c18862a7282aa9d95d01ea8'
+    'a074031607c3a7948ff37fe2b4ac7d9653128a2f0edc5a1ba5797afb5870dd31'
     '3b07339e4cd5f453d4cbec400201daa35c5813761f241b56793aab553362c068'
 )