Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 26.9.9 to 26.9.11 with no accompanying changes to sources, build logic, install scripts, or metadata that would introduce security concerns. Based on the provided diff alone, there are no red flags such as new network fetches, privilege changes, or suspicious dependencies.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.9
+	pkgver = 26.9.11
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from v26.9.9 to v26.9.11. The source remains an HTTPS GitHub release asset from the same upstream project, with no new build steps, scripts, or integrity regressions introduced by this diff. No security concerns are evident from this change alone.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.9/qownnotes-26.9.9.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.11/qownnotes-26.9.11.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a straightforward version bump in PKGBUILD: pkgver and the pinned upstream git tag are updated. There are no new build steps, no added sources, no install scripts, and no packaging logic changes. I did not see any integrity or supply-chain red flags in the provided diff hunk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.9
-tag="e240b370e311b2300c4e4c56d36b409a5b918106"
+pkgver=26.9.11
+tag="13ee3f7162c765fe0a1c5149033c09fcb7e6cb74"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains an HTTPS GitHub release asset pinned to the package version, and there are no new build steps, network fetches, privilege changes, or packaging logic changes. This is a routine integrity update with no evident security impact in the diff reviewed.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('5ada41f55c5303e9c5debe84628af14f492207d9e3df319ccd02f53b69aed2f7')
+sha256sums=('03de0c38235ad25cb14510f4fbebb226427acb9753db7536fa3942aac08da47e')
 
 prepare() {
     cd "${pkgname}-${pkgver}"