Review Results

Comment

The change is a straightforward version bump in .SRCINFO from XnViewMP 1.11.6 to 1.12.1, with the source URL and checksum updated accordingly. The source is still HTTPS and points to the vendor’s download host, with no new build-time fetches, scripts, patches, or packaging behavior changes visible in this diff. Based on this hunk alone, I don’t see a security issue.

@@ -1,15 +1,15 @@
 pkgbase = xnviewmp
 	pkgdesc = An efficient multimedia viewer, browser and converter.
-	pkgver = 1.11.6
+	pkgver = 1.12.1
 	pkgrel = 1
 	url = https://www.xnview.com/en/xnviewmp/
 	arch = x86_64
 	license = custom
 	depends = qt5-multimedia
 	optdepends = glib2: support for moving files to trash
-	source = XnViewMP-linux-x64_1.11.6-rel1.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-1.11.6-linux-x64.tgz
+	source = XnViewMP-linux-x64_1.12.1-rel1.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-1.12.1-linux-x64.tgz
 	source = XnView.desktop
-	sha256sums = 3a4a9f80fbf4dcbef0681c78d42cfd52b22eb0129095822e49689452c6287b2c
+	sha256sums = 76c9dac7c003033faf941641060cbd83b96edeb142e90b30b5968fd8960b1775
 	sha256sums = f6b3a4aaa0a55b5f21d9b91ab6f3da3d6ee077ba7fdd17e7c4ab1c69ad2a9e3a
 
 pkgname = xnviewmp

Comment

The change is a straightforward version bump from 1.11.6 to 1.12.1 with an updated SHA256 for the upstream tarball. The source remains an HTTPS download from the official XnView domain, there are no new build-time network fetches, scripts, patches, privilege changes, or packaging logic changes. No security red flags are introduced by this diff alone.

@@ -8,7 +8,7 @@
 # Contributor: Martin Poljak <martin 'at' poljak 'dot' cz>
 
 pkgname=xnviewmp
-pkgver=1.11.6
+pkgver=1.12.1
 srcrel=1 # Incremented when there is a new release for the same version number
 pkgrel=1
 pkgdesc="An efficient multimedia viewer, browser and converter."

Comment

The change is a straightforward version bump in PKGBUILD from 1.11.6 to 1.12.1 with an updated SHA-256 checksum for the upstream tarball. The source remains an HTTPS download from the official XnView domain, there are no new build-time downloads, scripts, patches, privilege changes, or packaging behavior changes. No security red flags are introduced by this diff alone.

@@ -24,7 +24,7 @@ optdepends=('glib2: support for moving files to trash')
 
 source=("XnViewMP-linux-x64_${pkgver}-rel${srcrel}.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-${pkgver}-linux-x64.tgz"
         'XnView.desktop')
-sha256sums=('3a4a9f80fbf4dcbef0681c78d42cfd52b22eb0129095822e49689452c6287b2c'
+sha256sums=('76c9dac7c003033faf941641060cbd83b96edeb142e90b30b5968fd8960b1775'
             'f6b3a4aaa0a55b5f21d9b91ab6f3da3d6ee077ba7fdd17e7c4ab1c69ad2a9e3a')
 
 package() {