Review Results

Comment

The change only bumps the package version and resets pkgrel in .SRCINFO. No source URLs, checksums, build steps, dependencies, install scripts, or other packaging metadata changed in a way that introduces new security risk. Based on the provided diff hunk alone, this is a routine version update with no evident supply-chain or privilege-escalation concerns.

@@ -1,7 +1,7 @@
 pkgbase = protonup-qt
 	pkgdesc = Install and manage GE-Proton, Luxtorpeda & more for Steam, Lutris and Heroic
-	pkgver = 2.15.1
-	pkgrel = 2
+	pkgver = 2.16.0
+	pkgrel = 1
 	url = https://davidotek.github.io/protonup-qt
 	arch = any
 	license = GPL-3.0-or-later

Comment

The .SRCINFO update is a routine version bump from 2.15.1 to 2.16.0 with the corresponding source tarball and checksum refresh. The dependency change from python-pyaml to python-yaml appears to be a package rename/adjustment, and the removed GitHub patch source is no longer present in the new release packaging. The source remains an HTTPS GitHub release tarball, with no added build-time downloads, scripts, or other suspicious artifacts in this diff. No security issues are evident from the change shown.

@@ -13,12 +13,11 @@ pkgbase = protonup-qt
 	makedepends = python-wheel
 	depends = pyside6
 	depends = python-inputs
-	depends = python-psutil
-	depends = python-pyaml
 	depends = python-pyxdg
 	depends = python-requests
 	depends = python-steam
 	depends = python-vdf
+	depends = python-yaml
 	depends = python-zstandard
 	depends = qt6-tools
 	depends = which

Comment

The change is a straightforward version bump in .SRCINFO from ProtonUp-Qt 2.15.1 to 2.16.0 and removes an upstream GitHub pull-request patch source. The remaining source is an HTTPS GitHub release tarball for the official upstream repository, with a pinned tag and updated checksum. No new build-time network fetches, scripts, privilege changes, or suspicious metadata were introduced in this diff. Based on the provided hunk alone, this looks low risk.

@@ -35,9 +34,7 @@ pkgbase = protonup-qt
 	optdepends = xorg-xwininfo: required for SteamTinkerLaunch
 	optdepends = xxd: required for SteamTinkerLaunch
 	optdepends = yad: required for SteamTinkerLaunch
-	source = protonup-qt-2.15.1.tar.gz::https://github.com/DavidoTek/ProtonUp-Qt/archive/refs/tags/v2.15.1.tar.gz
-	source = https://github.com/DavidoTek/ProtonUp-Qt/pull/647.patch
-	sha256sums = 7028c0f3451fcb69f384ba0687b58a973b35fab2b0a64d5435eb1f782f09ea08
-	sha256sums = 9cbbea6c9e600ebe2ecb85ec4ebf5d00a48fdaf3d8c2fc88288d26e9a206280d
+	source = protonup-qt-2.16.0.tar.gz::https://github.com/DavidoTek/ProtonUp-Qt/archive/refs/tags/v2.16.0.tar.gz
+	sha256sums = e09435bdec57818af41fedbe17eac4a838bb33915eeff95c13302de37df5ab89
 
 pkgname = protonup-qt

Comment

The change is low risk. It only bumps the package version, updates the source tarball checksum, and replaces the old patch-based dependency on a GitHub pull-request patch with the upstream 2.16.0 release, which also changes one Python dependency from python-pyaml to python-yaml. There are no new build-time network fetches, no added scripts, no privilege escalation, and no suspicious install-time behavior in the PKGBUILD diff. The source remains an HTTPS GitHub release tarball pinned to a specific tag, so integrity properties are unchanged or improved by removing the external patch source.

@@ -1,8 +1,8 @@
 # Maintainer: Mark Wagie <mark dot wagie at proton dot me>
 pkgname=protonup-qt
 _app_id=net.davidotek.pupgui2
-pkgver=2.15.1
-pkgrel=2
+pkgver=2.16.0
+pkgrel=1
 pkgdesc="Install and manage GE-Proton, Luxtorpeda & more for Steam, Lutris and Heroic"
 arch=('any')
 url="https://davidotek.github.io/protonup-qt"

Comment

The change is low risk. It removes an out-of-tree patch download from GitHub and the associated prepare() patch application, which reduces supply-chain exposure rather than adding it. The remaining source is the upstream GitHub release tarball over HTTPS with a pinned version and checksum. The dependency swap from python-pyaml to python-yaml is a normal packaging update and does not introduce build-time network access, privilege escalation, or suspicious install-time behavior. No new scripts, services, or elevated operations are added.

@@ -10,12 +10,11 @@ license=('GPL-3.0-or-later')
 depends=(
   'pyside6'
   'python-inputs'
-  'python-psutil'
-  'python-pyaml'
   'python-pyxdg'
   'python-requests'
   'python-steam'
   'python-vdf'
+  'python-yaml'
   'python-zstandard'
   'qt6-tools'
   'which'

Comment

The change is low risk. It removes an external patch source from GitHub and the associated prepare() patch application, leaving only the upstream tagged tarball as the source. The remaining source is HTTPS and pinned to a release tag, with an updated checksum. No new build-time network access, privilege escalation, or packaging red flags are introduced by this diff. The only notable effect is that a previously applied patch is no longer included, which is a functional change but not a security concern in itself based on the diff reviewed.

@@ -45,17 +44,8 @@ optdepends=(
   'xxd: required for SteamTinkerLaunch'
   'yad: required for SteamTinkerLaunch'
 )
-source=("$pkgname-$pkgver.tar.gz::https://github.com/DavidoTek/ProtonUp-Qt/archive/refs/tags/v$pkgver.tar.gz"
-        'https://github.com/DavidoTek/ProtonUp-Qt/pull/647.patch')
-sha256sums=('7028c0f3451fcb69f384ba0687b58a973b35fab2b0a64d5435eb1f782f09ea08'
-            '9cbbea6c9e600ebe2ecb85ec4ebf5d00a48fdaf3d8c2fc88288d26e9a206280d')
-
-prepare() {
-  cd "ProtonUp-Qt-$pkgver"
-
-  # Support proton-wineland
-  patch -Np1 -i ../647.patch
-}
+source=("$pkgname-$pkgver.tar.gz::https://github.com/DavidoTek/ProtonUp-Qt/archive/refs/tags/v$pkgver.tar.gz")
+sha256sums=('e09435bdec57818af41fedbe17eac4a838bb33915eeff95c13302de37df5ab89')
 
 build() {
   cd "ProtonUp-Qt-$pkgver"