Review Results

Comment

The change only bumps the package version from 3.11-2 to 3.12-1 in .SRCINFO. No source URLs, checksums, build steps, install scripts, or permissions are altered in the reviewed diff, so there is no new security concern visible here. This is a metadata-only version update.

@@ -1,7 +1,7 @@
 pkgbase = pandoc-bin
 	pkgdesc = Conversion between documentation formats
-	pkgver = 3.11
-	pkgrel = 2
+	pkgver = 3.12
+	pkgrel = 1
 	url = https://pandoc.org
 	arch = x86_64
 	arch = aarch64

Comment

The change is a straightforward version bump in .SRCINFO from pandoc 3.11 to 3.12, updating the provided checksums and binary release URLs accordingly. The sources remain HTTPS GitHub release/archive URLs from the upstream project, with no new scripts, patches, install hooks, or build-time network behavior introduced by this diff. No integrity red flags are visible in the reviewed hunk.

@@ -15,16 +15,16 @@ pkgbase = pandoc-bin
 	optdepends = texlive-fontsrecommended: for pdf output using latex or xelatex engines
 	optdepends = texlive-latex: for pdf output using pdflatex engine
 	optdepends = texlive-xetex: for pdf output using xelatex engine
-	provides = pandoc=3.11
-	provides = pandoc-cli=3.11
+	provides = pandoc=3.12
+	provides = pandoc-cli=3.12
 	conflicts = pandoc-cli
 	options = !debug
 	options = !strip
-	source = pandoc-bin-3.11.tar.gz::https://github.com/jgm/pandoc/archive/3.11.tar.gz
-	sha256sums = 61d05e7fc57e995a61367bee1bb73a8bb278cda3c787b7e4e27b30037e17aeed
-	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.11/pandoc-3.11-linux-amd64.tar.gz
-	sha256sums_x86_64 = 37edb3bbcf722f921a009941bf5874e2e0c09263226c9b4a2d980788cb062ab6
-	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.11/pandoc-3.11-linux-arm64.tar.gz
-	sha256sums_aarch64 = 56ed5566ec41d22ec9ee0704e6ac0b98ba102e92384efd5306173a22d314c79a
+	source = pandoc-bin-3.12.tar.gz::https://github.com/jgm/pandoc/archive/3.12.tar.gz
+	sha256sums = b19c416525f00e2c35a75dc377c767a57084ac22a9f1f4f9c5f6448dabe9819e
+	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.12/pandoc-3.12-linux-amd64.tar.gz
+	sha256sums_x86_64 = 67d7d011fed8c8543306022b985b9b2499ab9b74818df91d8727c7e9ebc5ba06
+	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.12/pandoc-3.12-linux-arm64.tar.gz
+	sha256sums_aarch64 = 6cefcf7100e23a99447c26f89d1ff5b253f3407fcef99a9e27ae06f3ed16cb82
 
 pkgname = pandoc-bin

Comment

The change only bumps pkgver from 3.11 to 3.12 and resets pkgrel from 2 to 1 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or other packaging logic were modified in the provided diff hunk. On its face this is a routine version update with no security red flags in the reviewed change.

@@ -1,6 +1,6 @@
 pkgname=pandoc-bin
-pkgver=3.11
-pkgrel=2
+pkgver=3.12
+pkgrel=1
 pkgdesc="Conversion between documentation formats"
 url="https://pandoc.org"
 license=("GPL-2.0-or-later")

Comment

The change only updates SHA-256 checksums for the upstream source tarball and the prebuilt architecture-specific release archives. The URLs remain HTTPS and point to the official pandoc GitHub release assets, with no new build-time code execution, no added network fetches outside source=(), and no packaging/persistence changes. This is a routine integrity update with no obvious security impact beyond trusting the new upstream artifacts.

@@ -25,9 +25,9 @@ source=("$pkgname-$pkgver.tar.gz::https://github.com/jgm/pandoc/archive/${pkgver
 source_x86_64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-amd64.tar.gz")
 source_aarch64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-arm64.tar.gz")
 
-sha256sums=('61d05e7fc57e995a61367bee1bb73a8bb278cda3c787b7e4e27b30037e17aeed')
-sha256sums_x86_64=('37edb3bbcf722f921a009941bf5874e2e0c09263226c9b4a2d980788cb062ab6')
-sha256sums_aarch64=('56ed5566ec41d22ec9ee0704e6ac0b98ba102e92384efd5306173a22d314c79a')
+sha256sums=('b19c416525f00e2c35a75dc377c767a57084ac22a9f1f4f9c5f6448dabe9819e')
+sha256sums_x86_64=('67d7d011fed8c8543306022b985b9b2499ab9b74818df91d8727c7e9ebc5ba06')
+sha256sums_aarch64=('6cefcf7100e23a99447c26f89d1ff5b253f3407fcef99a9e27ae06f3ed16cb82')
 
 package() {
   cd "${srcdir}/pandoc-${pkgver}"