Review Results

Comment

The change only bumps pkgver in .SRCINFO from 9.4.0 to 10.0.0. No build logic, sources, install scripts, permissions, or packaging metadata beyond the version string are altered in the provided diff. By itself this does not introduce a security issue; any risk would depend on the corresponding PKGBUILD/source changes, which are not part of this reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = onlyoffice-bin
 	pkgdesc = An office suite that combines text, spreadsheet and presentation editors
-	pkgver = 9.4.0
+	pkgver = 10.0.0
 	pkgrel = 1
 	url = https://www.onlyoffice.com/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from ONLYOFFICE 9.4.0 to 10.0.0, updating the package metadata, source URL, noextract filename, provides version, and checksum accordingly. The source remains an HTTPS GitHub release asset from the upstream project, with no new build-time code execution, no added scripts, and no suspicious extra sources or privilege-related changes in this diff. Based on the provided hunk alone, there are no obvious security red flags.

@@ -51,15 +51,15 @@ pkgbase = onlyoffice-bin
 	optdepends = libreoffice: for OpenSymbol fonts
 	optdepends = otf-takao: for japanese Takao fonts
 	optdepends = ttf-ms-fonts: for Microsoft fonts
-	provides = onlyoffice=9.4.0
+	provides = onlyoffice=10.0.0
 	conflicts = onlyoffice
-	noextract = onlyoffice-desktopeditors-x86_64-9.4.0.deb
+	noextract = onlyoffice-desktopeditors-x86_64-10.0.0.deb
 	options = !debug
 	options = !emptydirs
 	options = !strip
-	source = onlyoffice-desktopeditors-x86_64-9.4.0.deb::https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v9.4.0/onlyoffice-desktopeditors_amd64.deb
+	source = onlyoffice-desktopeditors-x86_64-10.0.0.deb::https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v10.0.0/onlyoffice-desktopeditors_amd64.deb
 	source = 010-onlyoffice-bin-fix-document-opening.patch
-	sha256sums = 4271434e81be42b1559fd989d24bf6d413482f278dc6a5e328202a4fc1a18649
+	sha256sums = 2190edb4022a2ac2f6eee0f78815520f0e4ece1e8a1097c645a6f9b225c8b59c
 	sha256sums = 670de5f8b72679a54ff41a96ba1bdba9231a93260d1a8eaf304f66c8e40efdb7
 
 pkgname = onlyoffice-bin

Comment

The change only bumps pkgver from 9.4.0 to 10.0.0 and updates the corresponding source checksum. The source remains the official ONLYOFFICE GitHub release asset over HTTPS, with no new build logic, no added scripts, and no packaging behavior changes. I did not find any new integrity, persistence, or privilege-escalation concerns in this diff.

@@ -3,7 +3,7 @@
 # Contributor: Mikalai Ramanovich < narod.ru: nikolay.romanovich >
 
 pkgname=onlyoffice-bin
-pkgver=9.4.0
+pkgver=10.0.0
 pkgrel=1
 pkgdesc='An office suite that combines text, spreadsheet and presentation editors'
 arch=('x86_64')

Comment

The change is a straightforward version bump of a binary package source from ONLYOFFICE’s official GitHub release URL, with the corresponding SHA-256 updated. No new build-time network fetches, scripts, privilege changes, or packaging logic changes are introduced in this diff. The source remains pinned to a specific release artifact over HTTPS, and the checksum update is expected for the new upstream release. Based on the provided hunk, I don’t see a security issue.

@@ -63,7 +63,7 @@ options=('!debug' '!emptydirs' '!strip')
 source=("onlyoffice-desktopeditors-${CARCH}-${pkgver}.deb"::"https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v${pkgver}/onlyoffice-desktopeditors_amd64.deb"
         '010-onlyoffice-bin-fix-document-opening.patch')
 noextract=("onlyoffice-desktopeditors-${CARCH}-${pkgver}.deb")
-sha256sums=('4271434e81be42b1559fd989d24bf6d413482f278dc6a5e328202a4fc1a18649'
+sha256sums=('2190edb4022a2ac2f6eee0f78815520f0e4ece1e8a1097c645a6f9b225c8b59c'
             '670de5f8b72679a54ff41a96ba1bdba9231a93260d1a8eaf304f66c8e40efdb7')
 
 prepare() {