Review Results

Comment

The change only bumps pkgver in .SRCINFO from 3.12 to 3.12.1. No build logic, sources, checksums, install scripts, or package metadata beyond the version string are altered in the provided diff. On its face this is a routine version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = pandoc-bin
 	pkgdesc = Conversion between documentation formats
-	pkgver = 3.12
+	pkgver = 3.12.1
 	pkgrel = 1
 	url = https://pandoc.org
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for pandoc-bin from 3.12 to 3.12.1, updating the declared provides and checksums/source URLs accordingly. No new build logic, scripts, or packaging behavior is introduced, and the sources remain HTTPS GitHub release/archive URLs consistent with upstream. I do not see any security-relevant red flags in this diff alone.

@@ -15,16 +15,16 @@ pkgbase = pandoc-bin
 	optdepends = texlive-fontsrecommended: for pdf output using latex or xelatex engines
 	optdepends = texlive-latex: for pdf output using pdflatex engine
 	optdepends = texlive-xetex: for pdf output using xelatex engine
-	provides = pandoc=3.12
-	provides = pandoc-cli=3.12
+	provides = pandoc=3.12.1
+	provides = pandoc-cli=3.12.1
 	conflicts = pandoc-cli
 	options = !debug
 	options = !strip
-	source = pandoc-bin-3.12.tar.gz::https://github.com/jgm/pandoc/archive/3.12.tar.gz
-	sha256sums = b19c416525f00e2c35a75dc377c767a57084ac22a9f1f4f9c5f6448dabe9819e
-	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.12/pandoc-3.12-linux-amd64.tar.gz
-	sha256sums_x86_64 = 67d7d011fed8c8543306022b985b9b2499ab9b74818df91d8727c7e9ebc5ba06
-	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.12/pandoc-3.12-linux-arm64.tar.gz
-	sha256sums_aarch64 = 6cefcf7100e23a99447c26f89d1ff5b253f3407fcef99a9e27ae06f3ed16cb82
+	source = pandoc-bin-3.12.1.tar.gz::https://github.com/jgm/pandoc/archive/3.12.1.tar.gz
+	sha256sums = cf9b3725b90e471aa70c99ac3b351adcb6e40cd904d36fcbb0f70d712e135686
+	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.12.1/pandoc-3.12.1-linux-amd64.tar.gz
+	sha256sums_x86_64 = d0c90410e90204c9ca83b8539fac5c7aed01fd537207e4585849f8abc5df20b8
+	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.12.1/pandoc-3.12.1-linux-arm64.tar.gz
+	sha256sums_aarch64 = 445d96fd08801fe636cab1158b4f017ee320ac3b7446328b4fe2f902117b19b9
 
 pkgname = pandoc-bin

Comment

The change only bumps pkgver from 3.12 to 3.12.1 in PKGBUILD. No source URLs, checksums, build steps, install scripts, or packaging logic are altered, so there is no new security-relevant behavior introduced by this diff.

@@ -1,5 +1,5 @@
 pkgname=pandoc-bin
-pkgver=3.12
+pkgver=3.12.1
 pkgrel=1
 pkgdesc="Conversion between documentation formats"
 url="https://pandoc.org"

Comment

The change only updates SHA-256 checksums for the upstream source tarball and prebuilt release archives. The URLs remain HTTPS and point to the official jgm/pandoc GitHub release assets, with no new build steps, scripts, or packaging logic introduced. This is a routine integrity update with no obvious security red flags in the diff shown.

@@ -25,9 +25,9 @@ source=("$pkgname-$pkgver.tar.gz::https://github.com/jgm/pandoc/archive/${pkgver
 source_x86_64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-amd64.tar.gz")
 source_aarch64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-arm64.tar.gz")
 
-sha256sums=('b19c416525f00e2c35a75dc377c767a57084ac22a9f1f4f9c5f6448dabe9819e')
-sha256sums_x86_64=('67d7d011fed8c8543306022b985b9b2499ab9b74818df91d8727c7e9ebc5ba06')
-sha256sums_aarch64=('6cefcf7100e23a99447c26f89d1ff5b253f3407fcef99a9e27ae06f3ed16cb82')
+sha256sums=('cf9b3725b90e471aa70c99ac3b351adcb6e40cd904d36fcbb0f70d712e135686')
+sha256sums_x86_64=('d0c90410e90204c9ca83b8539fac5c7aed01fd537207e4585849f8abc5df20b8')
+sha256sums_aarch64=('445d96fd08801fe636cab1158b4f017ee320ac3b7446328b4fe2f902117b19b9')
 
 package() {
   cd "${srcdir}/pandoc-${pkgver}"