Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2026.2.1 to 2026.2.2. No source URLs, checksums, build steps, install scripts, permissions, or packaging metadata were altered in the reviewed diff. On its face this is a routine upstream version update with no new security red flags in the provided change.

@@ -1,6 +1,6 @@
 pkgbase = rider
 	pkgdesc = A cross-platform .NET IDE by JetBrains.
-	pkgver = 2026.2.1
+	pkgver = 2026.2.2
 	pkgrel = 1
 	epoch = 1
 	url = https://www.jetbrains.com/rider/

Comment

The change is a straightforward version bump in .SRCINFO, updating JetBrains Rider release tarball URLs and their corresponding SHA256 checksums for x86_64 and aarch64. The sources remain HTTPS on the official JetBrains download domain, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in the diff provided. Based on this hunk alone, I see no security issue.

@@ -15,9 +15,9 @@ pkgbase = rider
 	options = staticlibs
 	source = jetbrains-rider.desktop
 	sha256sums = 4d5438fd52380ccd09deef98cb82707f296ebb27a3faed2fceb1b68eba335ec8
-	source_x86_64 = https://download-cf.jetbrains.com/rider/JetBrains.Rider-2026.2.1.tar.gz
-	sha256sums_x86_64 = f7a485d26b133daea3e6ebc1257dd4e55aacbf48ca8b4b47dffaef3e1905ebe2
-	source_aarch64 = https://download-cf.jetbrains.com/rider/JetBrains.Rider-2026.2.1-aarch64.tar.gz
-	sha256sums_aarch64 = 8ac97ca180c1a3d988bdccd608bf52989913e04725eb7a28b625563c8c39174f
+	source_x86_64 = https://download-cf.jetbrains.com/rider/JetBrains.Rider-2026.2.2.tar.gz
+	sha256sums_x86_64 = 33b5c46a850a19af3c45736634295ec37ac104fccc8356d215dfb94398bd0211
+	source_aarch64 = https://download-cf.jetbrains.com/rider/JetBrains.Rider-2026.2.2-aarch64.tar.gz
+	sha256sums_aarch64 = f85e41baf9571a16806c596b99b44012b7b9c4df5ced77411bc881f28ca18fe9
 
 pkgname = rider

Comment

The change only bumps pkgver from 2026.2.1 to 2026.2.2 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or dependency metadata are altered in the provided diff, so there is no new security concern visible in this change alone.

@@ -1,7 +1,7 @@
 # Maintainer: Tim Hellhake
 
 pkgname=rider
-pkgver='2026.2.1'
+pkgver='2026.2.2'
 pkgrel=1
 epoch=1
 pkgdesc='A cross-platform .NET IDE by JetBrains.'

Comment

The change only updates the SHA-256 checksums for the upstream Rider tarballs on x86_64 and aarch64. The source URLs remain HTTPS and point to JetBrains' official download host, with no new build steps, scripts, or packaging behavior introduced. This is a routine integrity-update change and does not add obvious supply-chain or persistence risk in the diff shown.

@@ -18,9 +18,9 @@ _srcfile="JetBrains.Rider-${pkgver}"
 source=('jetbrains-rider.desktop')
 sha256sums=('4d5438fd52380ccd09deef98cb82707f296ebb27a3faed2fceb1b68eba335ec8')
 source_x86_64=("https://download-cf.jetbrains.com/rider/${_srcfile}.tar.gz")
-sha256sums_x86_64=('f7a485d26b133daea3e6ebc1257dd4e55aacbf48ca8b4b47dffaef3e1905ebe2')
+sha256sums_x86_64=('33b5c46a850a19af3c45736634295ec37ac104fccc8356d215dfb94398bd0211')
 source_aarch64=("https://download-cf.jetbrains.com/rider/${_srcfile}-aarch64.tar.gz")
-sha256sums_aarch64=('8ac97ca180c1a3d988bdccd608bf52989913e04725eb7a28b625563c8c39174f')
+sha256sums_aarch64=('f85e41baf9571a16806c596b99b44012b7b9c4df5ced77411bc881f28ca18fe9')
 
 package() {
     install_base="/opt"