Review Results

Comment

The change only bumps pkgver in .SRCINFO from 106 to 109. No source URLs, checksums, build logic, install scripts, or packaging metadata beyond the version number are altered in the provided diff. On its face this is a routine version update with no security-relevant behavior change visible in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = gnome-shell-extension-dash-to-dock
 	pkgdesc = Move the dash out of the overview transforming it in a dock
-	pkgver = 106
+	pkgver = 109
 	pkgrel = 1
 	epoch = 1
 	url = https://micheleg.github.io/dash-to-dock/

Comment

The change only updates the pinned git commit in .SRCINFO for the upstream GitHub source. The source remains HTTPS and points to the same official repository, with no new build steps, scripts, or packaging logic introduced. From the diff alone there are no obvious supply-chain red flags beyond the normal trust in the new upstream commit, which cannot be assessed here without the corresponding PKGBUILD/source content. Risk is low.

@@ -10,7 +10,7 @@ pkgbase = gnome-shell-extension-dash-to-dock
 	makedepends = git
 	makedepends = sassc
 	depends = gnome-shell
-	source = git+https://github.com/micheleg/dash-to-dock.git#commit=a7b19816b7277e41c18ea5c3ff165e493a14e0d4
+	source = git+https://github.com/micheleg/dash-to-dock.git#commit=36529d37c0eb805b04dfd647e5295860771b23ea
 	sha256sums = SKIP
 
 pkgname = gnome-shell-extension-dash-to-dock

Comment

The change is a simple version bump in PKGBUILD from 106 to 109 with no other modifications shown. There are no new sources, scripts, install hooks, dependency changes, or packaging behavior changes in the provided diff. Based on this hunk alone, I see no security-relevant issue.

@@ -6,7 +6,7 @@
 
 pkgname=gnome-shell-extension-dash-to-dock
 _pkgname=dash-to-dock
-pkgver=106
+pkgver=109
 pkgrel=1
 epoch=1
 pkgdesc="Move the dash out of the overview transforming it in a dock"

Comment

The change only updates the pinned git commit used as the source for the package, while keeping the source on HTTPS and still pinned to an explicit commit hash. No new build steps, scripts, binaries, permissions changes, or install-time behavior are introduced in this diff. From the provided hunk alone, this is a routine upstream revision bump with no evident security red flags.

@@ -15,7 +15,7 @@ url="https://micheleg.github.io/dash-to-dock/"
 license=('GPL-2.0-or-later')
 depends=('gnome-shell')
 makedepends=('gettext' 'git' 'sassc')
-_commit=a7b19816b7277e41c18ea5c3ff165e493a14e0d4
+_commit=36529d37c0eb805b04dfd647e5295860771b23ea
 source=("git+https://github.com/micheleg/dash-to-dock.git#commit=$_commit")
 sha256sums=('SKIP')