Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.10.4 to 26.10.5. No sources, checksums, build steps, dependencies, install scripts, or packaging metadata were altered in the reviewed diff. Based on this hunk alone there are no security red flags.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.4
+	pkgver = 26.10.5
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball URL from 26.10.4 to 26.10.5. No new sources, scripts, build steps, permissions, or packaging metadata were introduced, and the source remains an HTTPS GitHub release artifact. Based on this diff alone, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.4/qownnotes-26.10.4.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.5/qownnotes-26.10.5.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: it updates pkgver/tag and the release tarball checksum to match the new GitHub release. The source remains an HTTPS GitHub release artifact, there are no new build-time network fetches, no added scripts, and no packaging/persistence red flags in the diff. Based on the provided hunk alone, this looks low risk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.4
-tag="5dadb1151d42f796cd45fa5eae86ce78337e84a3"
+pkgver=26.10.5
+tag="e71c12c951d918ca201ef0002ab5ed7a22c89e07"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains the official GitHub release over HTTPS, there are no new build steps, no additional sources, and no install-script or packaging behavior changes. This is a routine integrity hash refresh with no evident security impact in the diff provided.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('aea2236356cf5ca64fc73e908e3715e48a8357bc85a5ba3193ba91a69440109f')
+sha256sums=('c1214862254ae9661c8c0b120a5a5b370ad8f1030ec2b54fce29e556892652a2')
 
 prepare() {
     cd "${pkgname}-${pkgver}"