Review Results

Comment

The change only bumps pkgver in .SRCINFO from 26.9.11 to 26.9.12. No source URLs, checksums, build steps, install scripts, or packaging metadata affecting execution/persistence were changed in the provided diff. On its face this is a routine version update with no security red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.11
+	pkgver = 26.9.12
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball from v26.9.11 to v26.9.12. The source remains an HTTPS GitHub release artifact from the same upstream project, with no new build steps, scripts, patches, or packaging metadata changes that would introduce execution or integrity risks. Based on the provided diff, this is low risk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.11/qownnotes-26.9.11.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.12/qownnotes-26.9.12.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump in PKGBUILD: pkgver and the pinned upstream git tag were updated together. There are no new sources, no build-script changes, no install hooks, and no packaging behavior changes. The source remains pinned to a specific commit/tag rather than a floating branch, so integrity risk is low. I did not see any evidence of added network access, privilege escalation, or persistence mechanisms in this diff.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.11
-tag="caa888f98c199b13f3eaf194ff85e3187564fdf6"
+pkgver=26.9.12
+tag="ec59d40f2f07974405df572e58fde0f7efb29a8d"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains the official GitHub release over HTTPS, and there are no new build steps, scripts, or packaging changes that would introduce execution or persistence risks. This is a routine integrity update with no security red flags in the diff provided.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('8e2cc60e49636bf9d2700a2f400348d665d09ab7ca888a18bb031c1064c5ea74')
+sha256sums=('2dc7ab4ecd3c0952a0f94d7062ecc0417e92ca4d82c171131abdac7b839a977e')
 
 prepare() {
     cd "${pkgname}-${pkgver}"