Review Results

Comment

The change only bumps pkgver in .SRCINFO from 3.7.16 to 3.7.21. No build logic, sources, install scripts, permissions, or package metadata beyond the version number changed. On its face this is a routine version update with no security-relevant red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = joplin-appimage
 	pkgdesc = The latest stable AppImage of Joplin - a cross-platform note taking and to-do app
-	pkgver = 3.7.16
+	pkgver = 3.7.21
 	pkgrel = 1
 	url = https://github.com/laurent22/joplin
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for an AppImage package, updating the upstream GitHub release URL and LICENSE URL from v3.7.16 to v3.7.21 and refreshing the checksum. There are no new sources, no build-script changes, no added network or privilege-related behavior, and no suspicious metadata changes in this diff. Risk is low because the package still fetches a prebuilt upstream AppImage from the official project release page, and the integrity hash was updated accordingly.

@@ -9,9 +9,9 @@ pkgbase = joplin-appimage
 	conflicts = joplin-desktop
 	options = !strip
 	options = !debug
-	source = https://github.com/laurent22/joplin/releases/download/v3.7.16/Joplin-3.7.16.AppImage
-	source = https://github.com/laurent22/joplin/raw/v3.7.16/LICENSE
-	sha512sums = 4c8a1ffaf2082241f8d3bc99e72b5640df1dacdf04e1dc7022ca5fd6f884d52fa778476e513990daa236921100e817c8aa8b8ba3f099956a200f65713a7db0a4
+	source = https://github.com/laurent22/joplin/releases/download/v3.7.21/Joplin-3.7.21.AppImage
+	source = https://github.com/laurent22/joplin/raw/v3.7.21/LICENSE
+	sha512sums = 0e8568bb0a5432ffda0d99e85007ad68cd33774bded74f846290c3a41c6ed5fb6dcdb136299759249bd7a3fe443739307ad749cccb67c4c80c345b4cc0495cd5
 	sha512sums = SKIP
 
 pkgname = joplin-appimage

Comment

The change is a simple version bump in PKGBUILD from 3.7.16 to 3.7.21 with no other modifications shown. There are no new sources, build steps, install scripts, permissions changes, or other suspicious packaging behaviors in the provided diff hunk. Based on the reviewed change alone, this appears low risk.

@@ -1,7 +1,7 @@
 # Maintainer: thynkon <thynkon at protonmail dot com>
 
 pkgname=joplin-appimage
-pkgver=3.7.16
+pkgver=3.7.21
 pkgrel=1
 pkgdesc="The latest stable AppImage of Joplin - a cross-platform note taking and to-do app"
 arch=('x86_64')

Comment

The change is a straightforward version bump in PKGBUILD from 3.7.16 to 3.7.21 with the corresponding SHA-512 checksum update for the AppImage source. The source remains an HTTPS GitHub release URL pinned to a specific tag, and there are no added build steps, scripts, privilege changes, or new external fetches. No security red flags are introduced by this diff alone.

@@ -15,7 +15,7 @@ source=(
   ${url}/raw/v${pkgver}/LICENSE
 )
 sha512sums=(
-  4c8a1ffaf2082241f8d3bc99e72b5640df1dacdf04e1dc7022ca5fd6f884d52fa778476e513990daa236921100e817c8aa8b8ba3f099956a200f65713a7db0a4
+  0e8568bb0a5432ffda0d99e85007ad68cd33774bded74f846290c3a41c6ed5fb6dcdb136299759249bd7a3fe443739307ad749cccb67c4c80c345b4cc0495cd5
   SKIP
 )
 _filename="Joplin-${pkgver}.AppImage"