Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.135.06055 to 1.140.06880. This is metadata-only and does not introduce new build logic, sources, install scripts, or packaging behavior. No security-relevant issues are visible in the provided diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = vscodium-bin
 	pkgdesc = Binary releases of VS Code without MS branding/telemetry/licensing.
-	pkgver = 1.135.06055
+	pkgver = 1.140.06880
 	pkgrel = 1
 	url = https://github.com/VSCodium/vscodium
 	install = vscodium-bin.install

Comment

The change only updates .SRCINFO to point at a newer upstream VSCodium release tarball and matching icon asset, with corresponding checksum updates. The sources remain HTTPS and on the official VSCodium GitHub/Raw GitHub locations, and there is no evidence in this diff of added build-time code execution, post-install persistence, or other packaging red flags. This is a routine version bump in metadata only.

@@ -33,16 +33,16 @@ pkgbase = vscodium-bin
 	source = vscodium-bin.install
 	source = vscodium-bin.sh
 	source = LICENSE
-	source = https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/1.135.06055/src/stable/resources/linux/code.svg
+	source = https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/1.140.06880/src/stable/resources/linux/code.svg
 	sha256sums = 3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e
 	sha256sums = 121f2db8a65cfc74c10d3e7c3135b62b66297cf27f8f7f00c3ad29d412e968b7
 	sha256sums = 01ba3d33e76804e2346d08f4eda256a29610c9eb59432e4b016d05ad93d901ba
 	sha256sums = 73d4cfae90bc64e37c6471e60c3c5c881c78ae7126ebac83eb9d5bb9d721a1d8
 	sha256sums = 2fa3f8948a0a17ea30b62845caf1ee8aae8b55b5417273920ca2df2642209e0e
 	sha256sums = e622e6bdb70b0cfec57ad9df8717ea023b87e5e215003119b5a1a4d059fcd347
-	source_x86_64 = https://github.com/VSCodium/vscodium/releases/download/1.135.06055/VSCodium-linux-x64-1.135.06055.tar.gz
-	sha256sums_x86_64 = c09d8ac8dd7f52b09ee159ee24b440541dfd8f937a0f6f88cc428c78e48ee1f2
-	source_aarch64 = https://github.com/VSCodium/vscodium/releases/download/1.135.06055/VSCodium-linux-arm64-1.135.06055.tar.gz
-	sha256sums_aarch64 = 9765cea4f707ff7dc83a40be408a7318a59abb6996b359631639d9aab2f48a90
+	source_x86_64 = https://github.com/VSCodium/vscodium/releases/download/1.140.06880/VSCodium-linux-x64-1.140.06880.tar.gz
+	sha256sums_x86_64 = 61223b74f9e40834117311ec4177cb386d09b84c1aae4f9e674c96580569cef3
+	source_aarch64 = https://github.com/VSCodium/vscodium/releases/download/1.140.06880/VSCodium-linux-arm64-1.140.06880.tar.gz
+	sha256sums_aarch64 = a57be0d528adf7d6508318e37dbd982d695bf91501e324c37e97e11d5b375811
 
 pkgname = vscodium-bin

Comment

The change only bumps pkgver in PKGBUILD from 1.135.06055 to 1.140.06880. No source URLs, build steps, install scripts, permissions, or packaging logic were modified in the provided diff hunk. On its face this is a routine version update with no security red flags in the reviewed change.

@@ -7,7 +7,7 @@
 
 pkgname=vscodium-bin
 _pkgname=VSCodium
-pkgver=1.135.06055
+pkgver=1.140.06880
 pkgrel=1
 pkgdesc="Binary releases of VS Code without MS branding/telemetry/licensing."
 arch=('x86_64' 'aarch64')

Comment

This change is a routine version bump in PKGBUILD with updated SHA-256 checksums for the architecture-specific upstream artifacts. The source list, build steps, package actions, and metadata are otherwise unchanged, and there are no signs of added network fetches, scripts, privilege escalation, or suspicious dependencies in the diff. Risk is low because the only security-relevant effect is trusting new upstream binaries, which is expected for a -bin package and is covered by checksum pinning.

@@ -32,8 +32,8 @@ sha256sums=('3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e'
             '73d4cfae90bc64e37c6471e60c3c5c881c78ae7126ebac83eb9d5bb9d721a1d8'
             '2fa3f8948a0a17ea30b62845caf1ee8aae8b55b5417273920ca2df2642209e0e')
 sha256sums+=('e622e6bdb70b0cfec57ad9df8717ea023b87e5e215003119b5a1a4d059fcd347')
-sha256sums_x86_64=('c09d8ac8dd7f52b09ee159ee24b440541dfd8f937a0f6f88cc428c78e48ee1f2')
-sha256sums_aarch64=('9765cea4f707ff7dc83a40be408a7318a59abb6996b359631639d9aab2f48a90')
+sha256sums_x86_64=('61223b74f9e40834117311ec4177cb386d09b84c1aae4f9e674c96580569cef3')
+sha256sums_aarch64=('a57be0d528adf7d6508318e37dbd982d695bf91501e324c37e97e11d5b375811')
 
 source=('vscodium-bin.desktop'
         'vscodium-bin-url-handler.desktop'