Review Results

Comment

The change is a routine version bump in PKGBUILD: pkgver/_pkgver and the source checksum were updated to a new upstream release tarball on GitHub over HTTPS. I do not see any added build-time network access, script execution, privilege escalation, suspicious mirrors, or packaging changes beyond the version/hash refresh. Based on the provided diff, this looks low risk.

@@ -3,8 +3,8 @@
 # Contributor: Christoph Drexler <chrdr at gmx dot at>
 # Contributor: me at oguzkaganeren dot com dot tr
 pkgname=grisbi
-pkgver=3.90.1
-_pkgver=upstream_version_3_90_1
+pkgver=3.92.0
+_pkgver=upstream_version_3_92_0
 pkgrel=1
 pkgdesc="Shared files for the finance management program Grisbi."
 arch=('x86_64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball source URL, with no changes to the source location, build steps, install scripts, or packaging logic. The source is still fetched over HTTPS from the official GitHub release archive for the project, and there are no new red flags such as additional downloads, command execution, privilege escalation, or persistence mechanisms. This appears to be a routine integrity checksum refresh, so I see no security issue in the diff provided.

@@ -15,7 +15,7 @@ makedepends=('imagemagick' 'libgsf' 'meson')
 conflicts=('grisbi-git')
 options=(!libtool !debug)
 source=(https://github.com/grisbi/grisbi/archive/refs/tags/$_pkgver.tar.gz)
-sha256sums=('da7c431601c273481bf606249a834fc40c362b10f8e44f2b3021fe9267a17f1c')
+sha256sums=('fbffd7eae1362419555d4511f7f26b852913880dba1ce203ab076575ce9ed5dc')
 
 prepare() {
 	cd "${srcdir}/grisbi-${_pkgver}"