Review Results

Comment

The change only bumps the package version in .SRCINFO from 26.9.13 to 26.9.14. No source URLs, checksums, build steps, install scripts, permissions, or other packaging metadata changed in the provided diff. Based on this hunk alone there is no security-relevant behavior change.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.13
+	pkgver = 26.9.14
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball from v26.9.13 to v26.9.14. The source remains an HTTPS GitHub release asset from the same upstream project, with no new build steps, scripts, patches, binaries, or privilege-related metadata introduced. Based on the provided diff alone, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.13/qownnotes-26.9.13.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.14/qownnotes-26.9.14.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump: pkgver and the pinned VCS tag were updated, and the release tarball checksum was refreshed. The source remains an HTTPS GitHub release asset, there are no new build steps, no added scripts, and no changes to dependencies, install logic, or packaging behavior. I do not see any supply-chain or privilege-related red flags in this diff.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.13
-tag="666c4e848164d94816312c235adf04ce0e928b5e"
+pkgver=26.9.14
+tag="48ceb373c9c9dc759ca8ac633c338dcc3b949c42"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains the official GitHub release over HTTPS, there are no new build steps, no added network fetches, and no packaging/script changes. This is a routine integrity update with no security red flags in the diff provided.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('0a017596de225309757728d38255ef9427eade4be0596d1eab642dc70773478d')
+sha256sums=('0eed3eae1c1694e04a9724823681f446f4fe9dacdd491296ea7672f71d959dc2')
 
 prepare() {
     cd "${pkgname}-${pkgver}"