Review Results

Comment

The change is a straightforward version bump in .SRCINFO, updating the package version and matching upstream release tarball URL from 26.9.14 to 26.10.0. The source remains an HTTPS GitHub release asset, with no new build steps, scripts, patches, or packaging behavior introduced in this diff. No integrity or persistence red flags are present in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.9.14
+	pkgver = 26.10.0
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from v26.9.14 to v26.10.0 on the official GitHub releases page. The source remains HTTPS and points to the same upstream project, with no new scripts, patches, binaries, or packaging logic introduced. No integrity or persistence red flags are present in this diff hunk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.9.14/qownnotes-26.9.14.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.0/qownnotes-26.10.0.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: pkgver/tag updated together and the source tarball checksum was updated accordingly. The source remains an HTTPS GitHub release tarball, pinned to a specific release version, with no new build-time network access, scripts, patches, privilege changes, or packaging behavior changes introduced by this diff. I don’t see any supply-chain or persistence red flags in the reviewed hunk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.9.14
-tag="48ceb373c9c9dc759ca8ac633c338dcc3b949c42"
+pkgver=26.10.0
+tag="8b3c425246ec87148edd7f9195563df1338aff1b"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains the official GitHub release over HTTPS, there are no new build steps, no added network access, and no packaging/script changes. This is a routine integrity update with no evident security impact in the diff provided.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('0eed3eae1c1694e04a9724823681f446f4fe9dacdd491296ea7672f71d959dc2')
+sha256sums=('46d5aca536d4ae4def90df9940aa7c5c008bf1df44133557ff0dee68bbe0b318')
 
 prepare() {
     cd "${pkgname}-${pkgver}"