Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.3.18.3 to 1.3.18.6. No source URLs, checksums, build logic, install scripts, or packaging permissions are altered in the reviewed hunk. On its face this is a routine version metadata update with no security impact visible in the diff provided.

@@ -1,6 +1,6 @@
 pkgbase = aseprite
 	pkgdesc = Create animated sprites and pixel art
-	pkgver = 1.3.18.3
+	pkgver = 1.3.18.6
 	pkgrel = 1
 	url = https://www.aseprite.org/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball from Aseprite v1.3.18.3 to v1.3.18.6. The source remains HTTPS and points to the official upstream GitHub release asset; no new sources, scripts, build steps, or packaging behavior are introduced by this diff. I do not see any integrity or persistence red flags in the metadata change itself.

@@ -32,9 +32,9 @@ pkgbase = aseprite
 	depends = fontconfig
 	depends = libxcursor
 	depends = libxrandr
-	noextract = Aseprite-v1.3.18.3-Source.zip
+	noextract = Aseprite-v1.3.18.6-Source.zip
 	noextract = skia-m124.tar.gz
-	source = https://github.com/aseprite/aseprite/releases/download/v1.3.18.3/Aseprite-v1.3.18.3-Source.zip
+	source = https://github.com/aseprite/aseprite/releases/download/v1.3.18.6/Aseprite-v1.3.18.6-Source.zip
 	source = skia-m124.tar.gz::https://github.com/aseprite/skia/archive/refs/tags/m124-08a5439a6b.tar.gz
 	source = skia-m124-icu::git+https://chromium.googlesource.com/chromium/deps/icu.git#commit=a0718d4f121727e30b8d52c7a189ebf5ab52421f
 	source = aseprite-strings::git+https://github.com/aseprite/strings.git#commit=b43be33343efa40c1c4bda00f985b8cd83bddf2a

Comment

Low risk. The change only updates .SRCINFO metadata for a new upstream release (1.3.18.6) and refreshes the checksum for the corresponding source archive. The sources remain HTTPS GitHub release assets and pinned git commits for auxiliary deps; no new build-time network fetches, scripts, privilege changes, or packaging behavior are introduced in this diff. The only security-relevant aspect is that the package now trusts a different upstream tarball checksum, but that is expected for a version bump and does not by itself indicate tampering.

@@ -50,7 +50,7 @@ pkgbase = aseprite
 	source = shared_libjpeg-turbo.patch
 	source = change_use_of_removed_intrinsic.patch
 	source = fmt-12.2.0-include-format.patch
-	sha256sums = 268693d1750c4f9f61c9c866f10b993ddfc88424c9dead2a2f66ebb7576b192e
+	sha256sums = fa9dd07a0c2a5ec91a4166333296bbb9e5c237933b59875d0cfee849d2358306
 	sha256sums = c2a567d6b8bb933a92615cbdee0de268d02c3a06863337ee8822eedab9ed66ba
 	sha256sums = b52f179a687ef2f91a52b696ab6581f4a37df5e88cb22040fa1ec6567cf0ebb1
 	sha256sums = 80471354d55d785291bb719596d37ec785e01e94a322f127c0f91d2d8b01be0f

Comment

The change is a straightforward version bump in PKGBUILD from 1.3.18.3 to 1.3.18.6, with the corresponding source checksum updated. No new sources, scripts, build steps, permissions, or install-time behavior were introduced in this diff. Based on the provided hunk, there are no security red flags.

@@ -10,7 +10,7 @@
 # Contributor: Jomar Milan <jomarm@jomarm.com>
 
 pkgname=aseprite
-pkgver=1.3.18.3
+pkgver=1.3.18.6
 _skiaver=m124
 _skiahash=08a5439a6b
 pkgrel=1

Comment

The change only updates the SHA-256 checksum for one declared source archive in PKGBUILD. I did not find any new sources, build-time network access, script execution, privilege escalation, or packaging behavior changes. This is a routine integrity-pin update and does not itself introduce security risk, assuming the new checksum corresponds to the intended upstream release artifact.

@@ -63,7 +63,7 @@ source=("https://github.com/aseprite/aseprite/releases/download/v$pkgver/Aseprit
         fmt-12.2.0-include-format.patch)
 noextract=("Aseprite-v$pkgver-Source.zip"
            "skia-$_skiaver.tar.gz") # Don't extract Aseprite or skia sources at the root
-sha256sums=('268693d1750c4f9f61c9c866f10b993ddfc88424c9dead2a2f66ebb7576b192e'
+sha256sums=('fa9dd07a0c2a5ec91a4166333296bbb9e5c237933b59875d0cfee849d2358306'
             'c2a567d6b8bb933a92615cbdee0de268d02c3a06863337ee8822eedab9ed66ba'
             'b52f179a687ef2f91a52b696ab6581f4a37df5e88cb22040fa1ec6567cf0ebb1'
             '80471354d55d785291bb719596d37ec785e01e94a322f127c0f91d2d8b01be0f'