Review Results

Comment

The change is a straightforward version bump in .SRCINFO for a binary package, updating the release URLs and checksums from 2.12.0 to 2.13.0. The sources remain HTTPS GitHub release tarballs, there are no new build-time commands, scripts, or privilege-related artifacts in this diff, and the package metadata (provides/conflicts/dependencies) is unchanged. No security red flags are evident from this .SRCINFO-only update.

@@ -1,6 +1,6 @@
 pkgbase = mongosh-bin
 	pkgdesc = An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.
-	pkgver = 2.12.0
+	pkgver = 2.13.0
 	pkgrel = 1
 	url = https://github.com/mongodb-js/mongosh.git
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt mongosh binary package, updating the GitHub release URLs and corresponding SHA-256 checksums for x86_64 and aarch64. The sources remain on HTTPS and point to the official upstream release artifacts, with no new scripts, build steps, or privilege-related changes introduced in this diff. No obvious supply-chain red flags are present in the reviewed hunk.

@@ -9,9 +9,9 @@ pkgbase = mongosh-bin
 	depends = krb5
 	provides = mongosh
 	conflicts = mongosh
-	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.12.0/mongosh-2.12.0-linux-x64.tgz
-	sha256sums_x86_64 = aa42cb826b7b8e655c5481293f5365ddaf1a23e43af07520326e5bbc957838ad
-	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.12.0/mongosh-2.12.0-linux-arm64.tgz
-	sha256sums_aarch64 = 99f8d38d41c510e7d4c685b71022ea1db113245968d5d933b5333fb3835e64ae
+	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.13.0/mongosh-2.13.0-linux-x64.tgz
+	sha256sums_x86_64 = b2089e67641a28aa621476c4d62c69f66b9a41484baba24d8a8b1f5f96e92d0b
+	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.13.0/mongosh-2.13.0-linux-arm64.tgz
+	sha256sums_aarch64 = a124ec6680c70ceabc61696bbd110f0da05d7c52524ed402ae9511b5aec7fe32
 
 pkgname = mongosh-bin

Comment

The change is a simple version bump in PKGBUILD from 2.12.0 to 2.13.0 with no accompanying changes to sources, build logic, install scripts, or permissions. Based on the provided diff alone, there are no new security red flags introduced by this update. I did not see evidence of added network fetches, privilege escalation, persistence mechanisms, or packaging hygiene regressions in the hunk under review.

@@ -3,7 +3,7 @@
 
 pkgname=mongosh-bin
 _pkgname=mongosh
-pkgver=2.12.0
+pkgver=2.13.0
 pkgrel=1
 pkgdesc='An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.'
 arch=('x86_64' 'aarch64')

Comment

The change is a straightforward version bump of a prebuilt upstream release tarball from 2.12.0 to 2.13.0 with updated SHA-256 checksums. The sources remain HTTPS GitHub release URLs, there are no new build-time downloads, scripts, patches, install hooks, or privilege-related changes in the diff. Risk is low; the only residual concern is the usual trust in upstream binary releases, but nothing in this change suggests tampering or a supply-chain red flag.

@@ -17,8 +17,8 @@ _mongosh_folder=mongosh-${pkgver}-linux
 source_x86_64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-x64.tgz")
 source_aarch64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64.tgz")
 
-sha256sums_x86_64=('aa42cb826b7b8e655c5481293f5365ddaf1a23e43af07520326e5bbc957838ad')
-sha256sums_aarch64=('99f8d38d41c510e7d4c685b71022ea1db113245968d5d933b5333fb3835e64ae')
+sha256sums_x86_64=('b2089e67641a28aa621476c4d62c69f66b9a41484baba24d8a8b1f5f96e92d0b')
+sha256sums_aarch64=('a124ec6680c70ceabc61696bbd110f0da05d7c52524ed402ae9511b5aec7fe32')
 
 package() {
 	if [ $CARCH = 'x86_64' ]; then