Review Results

Comment

The change only updates the pinned upstream commit tag and the corresponding source tarball checksum for the same official GitHub release asset. The download remains HTTPS from the project’s release page, there are no new build steps, scripts, or privilege/network changes, and no suspicious additional sources were introduced. This is a routine version-pin refresh with no evident security impact.

@@ -3,7 +3,7 @@
 
 pkgname=qownnotes
 pkgver=26.9.11
-tag="13ee3f7162c765fe0a1c5149033c09fcb7e6cb74"
+tag="caa888f98c199b13f3eaf194ff85e3187564fdf6"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in source=(). The download remains HTTPS from the official GitHub release URL, there are no new build steps, scripts, patches, or packaging changes, and no evidence of added network access or privilege escalation. This is a routine integrity update and does not introduce security risk by itself.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('03de0c38235ad25cb14510f4fbebb226427acb9753db7536fa3942aac08da47e')
+sha256sums=('8e2cc60e49636bf9d2700a2f400348d665d09ab7ca888a18bb031c1064c5ea74')
 
 prepare() {
     cd "${pkgname}-${pkgver}"