Review Results

Comment

The change only bumps pkgver in .SRCINFO from 2.45.1 to 2.45.2. No sources, checksums, build steps, install scripts, or packaging logic are altered, so there is no new security-relevant behavior in this diff. This is a routine metadata update with negligible risk.

@@ -1,6 +1,6 @@
 pkgbase = spicetify-cli
 	pkgdesc = Command-line tool to customize Spotify client
-	pkgver = 2.45.1
+	pkgver = 2.45.2
 	pkgrel = 1
 	url = https://github.com/spicetify/cli
 	arch = x86_64

Comment

The change only updates the SHA-256 checksum for the existing upstream release tarball URL (GitHub HTTPS archive for v2.43.2). No new sources, build steps, install scripts, or packaging behavior are introduced, and the source remains pinned to a specific tag. This is a routine integrity metadata update with no apparent security impact in the diff reviewed.

@@ -12,6 +12,6 @@ pkgbase = spicetify-cli
         depends = glibc
 	optdepends = xdg-utils: Allows for opening directories in default file manager
 	source = spicetify-cli-2.43.2.tar.gz::https://github.com/spicetify/cli/archive/v2.43.2
-	sha256sums = b20a6aa0e2e54491fb4b39a2329a793ec745a068071c4a1644cae61a4307cfa1
+	sha256sums = 4789c03e035297a2b338309bdbbd69a7de2b7b09b58cd41495ea4ef44f240719
 
 pkgname = spicetify-cli

Comment

The change is a simple version bump in PKGBUILD from 2.45.1 to 2.45.2 with no other modifications shown. There are no new sources, build steps, install scripts, permissions changes, or other suspicious packaging behaviors in the provided diff hunk. Based on this hunk alone, I see no security concern.

@@ -1,6 +1,6 @@
 ## Maintainer: khanhas <xuankhanh963@gmail.com>, itsmeow <itsmeow@itsmeow.dev>
 pkgname=spicetify-cli
-pkgver=2.45.1
+pkgver=2.45.2
 pkgrel=1
 pkgdesc='Command-line tool to customize Spotify client'
 arch=('x86_64' 'i686')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source remains an HTTPS GitHub archive URL pinned to the version tag, with no new build steps, network fetches, privilege changes, or packaging logic changes. I did not find any additional red flags in this diff hunk.

@@ -10,7 +10,7 @@ makedepends=('go' 'pnpm')
 depends=('glibc' 'bash')
 optdepends=('xdg-utils: Allows for opening directories in default file manager')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
-sha256sums=('b20a6aa0e2e54491fb4b39a2329a793ec745a068071c4a1644cae61a4307cfa1')
+sha256sums=('4789c03e035297a2b338309bdbbd69a7de2b7b09b58cd41495ea4ef44f240719')
 
 prepare() {
   mv "cli-${pkgver}" "${pkgname}-${pkgver}"