Review Results

Comment

The change only bumps pkgver in .SRCINFO from 2026.2.2 to 2026.2.3. No build logic, sources, checksums, install scripts, or packaging behavior are altered in the reviewed diff. On its own this is a routine metadata update with no security impact visible in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = clion
 	pkgdesc = Cross-platform IDE for C and C++ from JetBrains.
-	pkgver = 2026.2.2
+	pkgver = 2026.2.3
 	pkgrel = 1
 	epoch = 1
 	url = http://www.jetbrains.com/clion

Comment

The change is a straightforward version bump in .SRCINFO from CLion 2026.2.2 to 2026.2.3, with matching updated noextract entries, source URLs, and SHA256 checksums. The sources remain HTTPS on the official JetBrains download domain, and there are no new build-time commands, scripts, or packaging changes introduced in this diff. No obvious supply-chain or persistence risk is present in the reviewed hunk.

@@ -8,15 +8,15 @@ pkgbase = clion
 	arch = aarch64
 	license = custom
 	makedepends = rsync
-	noextract = CLion-2026.2.2.tar.gz
-	noextract = CLion-2026.2.2-aarch64.tar.gz
+	noextract = CLion-2026.2.3.tar.gz
+	noextract = CLion-2026.2.3-aarch64.tar.gz
 	options = !strip
 	source = jetbrains-clion.desktop
 	sha256sums = a7a3f9891f5d8e7e5650afe00819909413fa2ed911393dd0648fba91233974a2
-	source_x86_64 = https://download-cf.jetbrains.com/cpp/CLion-2026.2.2.tar.gz
-	sha256sums_x86_64 = 4e0ab3b0710a23c8b6cba8c72301a52282365edd7506db61b4586abc21ea6dfe
-	source_aarch64 = https://download-cf.jetbrains.com/cpp/CLion-2026.2.2-aarch64.tar.gz
-	sha256sums_aarch64 = 2fe65958061fcb3f99a411ce941547af513b9a573c780863cfacae32202713a0
+	source_x86_64 = https://download-cf.jetbrains.com/cpp/CLion-2026.2.3.tar.gz
+	sha256sums_x86_64 = dbb7d298392bbe471153af98f6f3393173da897eaff1c1c79f2eade6e26d3860
+	source_aarch64 = https://download-cf.jetbrains.com/cpp/CLion-2026.2.3-aarch64.tar.gz
+	sha256sums_aarch64 = 97db7e50101b63c64f81f8dcf80b14c4ace42cba697a6b091d9bb2237e22ceb0
 
 pkgname = clion
 	depends = libdbusmenu-glib

Comment

The change is a straightforward version bump in PKGBUILD: it updates pkgver from 2026.2.2 to 2026.2.3 and refreshes the corresponding upstream tarball checksums for x86_64 and aarch64. The source URLs remain HTTPS and point to JetBrains' official download host, with no new build steps, scripts, patches, or privilege-related changes. I do not see any supply-chain or packaging red flags in this diff.

@@ -9,7 +9,7 @@ pkgbase=clion
 pkgname=(clion clion-jre clion-cmake clion-gdb clion-lldb)
 _pkgname=clion
 _dlname=CLion
-pkgver=2026.2.2
+pkgver=2026.2.3
 pkgrel=1
 epoch=1
 pkgdesc="Cross-platform IDE for C and C++ from JetBrains."

Comment

The change is a routine version bump from 2026.2.2 to 2026.2.3 with corresponding updated SHA-256 checksums for the official JetBrains download URLs. No new sources, no build-script changes, no added execution paths, and no packaging/persistence red flags are introduced by this diff. Risk is low because integrity hashes changed, but the URLs remain HTTPS and point to the vendor site.

@@ -22,8 +22,8 @@ source=("jetbrains-${pkgbase}.desktop")
 source_x86_64=("https://download-cf.jetbrains.com/cpp/${_dlname}-${pkgver}.tar.gz")
 source_aarch64=("https://download-cf.jetbrains.com/cpp/${_dlname}-${pkgver}-aarch64.tar.gz")
 sha256sums=('a7a3f9891f5d8e7e5650afe00819909413fa2ed911393dd0648fba91233974a2')
-sha256sums_x86_64=('4e0ab3b0710a23c8b6cba8c72301a52282365edd7506db61b4586abc21ea6dfe')
-sha256sums_aarch64=('2fe65958061fcb3f99a411ce941547af513b9a573c780863cfacae32202713a0')
+sha256sums_x86_64=('dbb7d298392bbe471153af98f6f3393173da897eaff1c1c79f2eade6e26d3860')
+sha256sums_aarch64=('97db7e50101b63c64f81f8dcf80b14c4ace42cba697a6b091d9bb2237e22ceb0')
 noextract=("${_dlname}-${pkgver}.tar.gz"
            "${_dlname}-${pkgver}-aarch64.tar.gz")