Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 13.2.0 to 13.3.0. No build logic, sources, checksums, install scripts, or packaging metadata affecting execution/persistence were modified in the reviewed hunk. On its face this is a routine upstream version update with no security-relevant indicators in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = insomnia-bin
 	pkgdesc = API Client and Design Platform for GraphQL and REST
-	pkgver = 13.2.0
+	pkgver = 13.3.0
 	pkgrel = 1
 	epoch = 1
 	url = https://insomnia.rest

Comment

The change is a straightforward version bump in .SRCINFO for an AUR binary package, updating the upstream GitHub release URL and matching LICENSE URL from 13.2.0 to 13.3.0 with a new checksum. The sources remain HTTPS and point to the official upstream repository/release assets, with no added scripts, build logic, or privilege-related changes. No obvious supply-chain or persistence red flags are introduced by this diff alone.

@@ -14,9 +14,9 @@ pkgbase = insomnia-bin
 	optdepends = xdg-utils: open URLs with desktop's default (xdg-email, xdg-open)
 	provides = insomnia
 	conflicts = insomnia
-	source = https://github.com/Kong/insomnia/releases/download/core@13.2.0/Insomnia.Core-13.2.0.deb
-	source = https://github.com/Kong/insomnia/raw/core@13.2.0/LICENSE
-	sha256sums = 176fdd5306fb0cd8c74195cc9ee7b5da4d390a909ffeb8b1e41681667e914a61
+	source = https://github.com/Kong/insomnia/releases/download/core@13.3.0/Insomnia.Core-13.3.0.deb
+	source = https://github.com/Kong/insomnia/raw/core@13.3.0/LICENSE
+	sha256sums = 96776cea5dffcb6c81557c157d0e788197248ab3f1d2932c611f502411f06d8f
 	sha256sums = 4197d1eeea274289901dc8b68e16f538ceb535ce1ff592f6895c0a7439908ca2
 
 pkgname = insomnia-bin

Comment

The change is a version bump in PKGBUILD from 13.2.0 to 13.3.0 only. No source URLs, checksums, build steps, install scripts, permissions, or package metadata beyond pkgver were altered in the provided diff. On its face this is low risk, with no direct security red flags visible in the reviewed hunk.

@@ -4,7 +4,7 @@
 _pkgname='insomnia'
 _upkgname='Insomnia'
 pkgname="${_pkgname}-bin"
-pkgver=13.2.0
+pkgver=13.3.0
 pkgrel=1
 epoch=1
 pkgdesc='API Client and Design Platform for GraphQL and REST'

Comment

The change is a straightforward version bump of a binary package from 13.2.0 to 13.3.0 with an updated SHA-256 for the upstream .deb. The source URLs remain on the official GitHub release/raw endpoints over HTTPS, there are no new build-time downloads, scripts, patches, privilege changes, or packaging logic changes in the reviewed hunk. Risk is low because the only security-relevant effect is trusting a new upstream binary release, which is expected for a -bin package and is still pinned by checksum.

@@ -21,7 +21,7 @@ conflicts=("${_pkgname}")
 source=("${_url_source}/releases/download/core@${pkgver}/${_upkgname}.Core-${pkgver}.deb"
         "${_url_source}/raw/core@${pkgver}/LICENSE")
 
-sha256sums=('176fdd5306fb0cd8c74195cc9ee7b5da4d390a909ffeb8b1e41681667e914a61'
+sha256sums=('96776cea5dffcb6c81557c157d0e788197248ab3f1d2932c611f502411f06d8f'
             '4197d1eeea274289901dc8b68e16f538ceb535ce1ff592f6895c0a7439908ca2')
 
 package() {