Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 26.10.0 to 26.10.1 with no accompanying changes to sources, build logic, install scripts, or package metadata that would introduce new security concerns. Based on the provided diff alone, there are no indicators of malicious behavior, integrity issues, or privilege/persistence mechanisms.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.0
+	pkgver = 26.10.1
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from v26.10.0 to v26.10.1. The source remains an HTTPS GitHub release artifact from the same upstream project, with no new build steps, scripts, dependencies, or integrity red flags introduced by this diff. Based on the provided hunk alone, this is low risk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.0/qownnotes-26.10.0.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.1/qownnotes-26.10.1.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a straightforward upstream version bump for qownnotes, updating the pinned release tag and matching source tarball checksum. The source remains an HTTPS GitHub release URL, there are no new build-time downloads, no added scripts, and no packaging/permission changes. I did not find any security-relevant red flags in this diff.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.0
-tag="8b3c425246ec87148edd7f9195563df1338aff1b"
+pkgver=26.10.1
+tag="1463955fdbec65c5e4bcd75a557b761d16d60294"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change is a routine version bump for a release tarball: the source remains an HTTPS GitHub release URL, the package is still pinned to a specific upstream tag/commit, and the only substantive change is the expected checksum update for the new upstream archive. I do not see any added build-time network access, install-script behavior, privilege escalation, or other suspicious packaging changes in this diff.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('46d5aca536d4ae4def90df9940aa7c5c008bf1df44133557ff0dee68bbe0b318')
+sha256sums=('ed0d1e712e7a9734d0ef91e48c5872d90b8b8a62b8de2a6d12a008f111f79699')
 
 prepare() {
     cd "${pkgname}-${pkgver}"