Review Results

Comment

The change only bumps pkgver from 4.1.13.23 to 4.1.13.26 and resets pkgrel from 2 to 1 in .SRCINFO. No sources, checksums, build steps, install scripts, or packaging logic are modified in the reviewed hunk, so there is no direct security impact visible here. The risk is low because .SRCINFO is metadata-only and this diff does not introduce new attack surface or persistence behavior.

@@ -1,7 +1,7 @@
 pkgbase = wechat-universal-bwrap
 	pkgdesc = WeChat (Universal) with bwrap sandbox
-	pkgver = 4.1.13.23
-	pkgrel = 2
+	pkgver = 4.1.13.26
+	pkgrel = 1
 	url = https://linux.weixin.qq.com/
 	install = wechat-universal.install
 	arch = x86_64

Comment

The change only bumps the packaged upstream WeChat .deb version from 4.1.13.23 to 4.1.13.26 and updates the corresponding noextract filenames and SHA-256 checksums in .SRCINFO. The source URLs remain the same official HTTPS QQ download endpoints, there are no new sources, scripts, or build steps introduced, and no packaging behavior changes are visible in this diff. This is a routine version/checksum refresh with no evident security impact.

@@ -34,9 +34,9 @@ pkgbase = wechat-universal-bwrap
 	conflicts = wechat-universal
 	replaces = wechat-beta
 	replaces = wechat-beta-bwrap
-	noextract = wechat-universal-4.1.13.23-x86_64.deb
-	noextract = wechat-universal-4.1.13.23-aarch64.deb
-	noextract = wechat-universal-4.1.13.23-loong64.deb
+	noextract = wechat-universal-4.1.13.26-x86_64.deb
+	noextract = wechat-universal-4.1.13.26-aarch64.deb
+	noextract = wechat-universal-4.1.13.26-loong64.deb
 	options = !strip
 	options = !debug
 	options = emptydirs

Comment

The change is a straightforward version bump in .SRCINFO for three architecture-specific upstream .deb sources, with HTTPS URLs and updated SHA-256 checksums. There are no new sources, no build-script changes, no added install hooks, and no signs of privilege escalation or persistence mechanisms in this diff. Security impact is limited to trusting the same upstream binary release at a newer version, which is normal for this package.

@@ -50,11 +50,11 @@ pkgbase = wechat-universal-bwrap
 	sha256sums = fc3ce9eb8dee3ee149233ebdb844d3733b2b2a8664422d068cf39b7fb08138f8
 	sha256sums = f05f6f907898740dab9833c1762e56dbc521db3c612dd86d2e2cd4b81eb257bf
 	sha256sums = 898ebc397583d111db9a337e9d09aaee2f795fcd720e65cab5ce0e92efcd8f10
-	source_x86_64 = wechat-universal-4.1.13.23-x86_64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb
-	sha256sums_x86_64 = b7d0f8d53e9f648bc2c77a6096a04100d008f2d9f0d3988a2a4859b5992aca0a
-	source_aarch64 = wechat-universal-4.1.13.23-aarch64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb
-	sha256sums_aarch64 = 51784a262c725ef1595dd833f456190e913583dd81c24dd8fe587532bc91c0dc
-	source_loong64 = wechat-universal-4.1.13.23-loong64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_LoongArch.deb
-	sha256sums_loong64 = c4fa465e9d861e11057bdd0f320947be506a1d40785b171882e42c1e9dee3107
+	source_x86_64 = wechat-universal-4.1.13.26-x86_64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb
+	sha256sums_x86_64 = a0db8caeee8d1e6cfe0aa5ce58710270f8d74a90ff4920f53a3fc22aa0956fe9
+	source_aarch64 = wechat-universal-4.1.13.26-aarch64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb
+	sha256sums_aarch64 = 374732eda88a6f3a7e4eb315e64e5fac73ef17923d504d242964f19ed1b80c75
+	source_loong64 = wechat-universal-4.1.13.26-loong64.deb::https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_LoongArch.deb
+	sha256sums_loong64 = ec580793cced556aadc236e8935750ce1489ba8f796092ba39d3d1822309cdc2
 
 pkgname = wechat-universal-bwrap

Comment

The change only bumps pkgver/pkgrel and refreshes the SHA-256 checksums for the architecture-specific upstream .deb sources. No new sources, scripts, patches, permissions, or install-time behavior were introduced, and the package still fetches from the same HTTPS upstream URLs. I don’t see any security-relevant regression in this diff alone.

@@ -4,8 +4,8 @@
 
 _pkgname=wechat-universal
 pkgname=${_pkgname}-bwrap
-pkgver=4.1.13.23
-pkgrel=2
+pkgver=4.1.13.26
+pkgrel=1
 pkgdesc="WeChat (Universal) with bwrap sandbox"
 arch=('x86_64' 'aarch64' 'loong64')
 url='https://linux.weixin.qq.com/'

Comment

The change only updates sha256 checksums for the architecture-specific source artifacts in PKGBUILD. No URLs, build commands, install scripts, or package metadata changed, and there is no evidence of added network access, privilege escalation, or persistence behavior. This looks like a routine upstream artifact refresh or repackaging checksum update, with no security red flags in the provided hunk.

@@ -75,13 +75,13 @@ sha256sums=(
 )
 
 sha256sums_x86_64=(
-    'b7d0f8d53e9f648bc2c77a6096a04100d008f2d9f0d3988a2a4859b5992aca0a'
+    'a0db8caeee8d1e6cfe0aa5ce58710270f8d74a90ff4920f53a3fc22aa0956fe9'
 )
 sha256sums_aarch64=(
-    '51784a262c725ef1595dd833f456190e913583dd81c24dd8fe587532bc91c0dc'
+    '374732eda88a6f3a7e4eb315e64e5fac73ef17923d504d242964f19ed1b80c75'
 )
 sha256sums_loong64=(
-    'c4fa465e9d861e11057bdd0f320947be506a1d40785b171882e42c1e9dee3107'
+    'ec580793cced556aadc236e8935750ce1489ba8f796092ba39d3d1822309cdc2'
 )
 
 prepare() {