Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.135.06055 to 1.140.06880. No sources, checksums, install scripts, build commands, or package metadata affecting trust boundaries were modified in the reviewed diff. On its face this is a routine upstream version update with no security red flags in the provided change.

@@ -1,6 +1,6 @@
 pkgbase = vscodium
 	pkgdesc = Free/Libre Open Source Software Binaries of VSCode (git build from latest release).
-	pkgver = 1.135.06055
+	pkgver = 1.140.06880
 	pkgrel = 1
 	url = https://github.com/VSCodium/vscodium.git
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: it updates the upstream VSCodium source tarball URL from one tagged release to another and refreshes the corresponding checksum. The source remains an HTTPS GitHub release artifact from the official project, with no new build-time commands, scripts, or packaging behavior introduced by this diff. No integrity red flags are visible in the provided hunk.

@@ -42,10 +42,10 @@ pkgbase = vscodium
 	source = vscodium.desktop
 	source = vscodium-wayland.desktop
 	source = vscodium-uri-handler.desktop
-	source = https://github.com/VSCodium/vscodium/releases/download/1.135.06055/VSCodium-1.135.06055-src.tar.gz
+	source = https://github.com/VSCodium/vscodium/releases/download/1.140.06880/VSCodium-1.140.06880-src.tar.gz
 	sha256sums = 7c6864be64a7cb698340c45b4cfc0091a1d9bb78b0e73d7e3a25d8a0b438beec
 	sha256sums = 74509d8ccb685a6d55e8bba8f4231963b766e1e3e38443bc1e72238519dcdeac
 	sha256sums = 3ad1e6bbd7cdc8833eff9afaa9f6ae39350d738678cafbe3437106f0cfe3d985
-	sha256sums = 73639a55ea72bb57f0134bf2d5228cc2f70e869a95fa7919a4da2c14c72dac74
+	sha256sums = 894ee123dba8533555c87e5c070ced9f595fdd880556612a3315708ee8be06cd
 
 pkgname = vscodium

Comment

The change only bumps pkgver from 1.135.06055 to 1.140.06880 in PKGBUILD. No build logic, sources, checksums, install scripts, or permissions are altered in the provided diff. On its face this is a routine version update with no new supply-chain or privilege-escalation risk visible in the reviewed hunk.

@@ -3,7 +3,7 @@
 
 pkgname=vscodium
 # Make sure the pkgver matches the git tags in vscodium and vscode git repo's!
-pkgver=1.135.06055
+pkgver=1.140.06880
 pkgrel=1
 pkgdesc="Free/Libre Open Source Software Binaries of VSCode (git build from latest release)."
 arch=('x86_64' 'aarch64' 'armv7h')

Comment

The change only updates the package version and the SHA-256 checksum for the corresponding upstream source tarball. I did not find any new code execution, network behavior, privilege changes, or packaging logic changes in the diff. The source remains an HTTPS GitHub release URL, and the checksum update is consistent with a legitimate upstream release refresh. No security concerns identified in this hunk.

@@ -49,7 +49,7 @@ source=(
 sha256sums=('7c6864be64a7cb698340c45b4cfc0091a1d9bb78b0e73d7e3a25d8a0b438beec'
             '74509d8ccb685a6d55e8bba8f4231963b766e1e3e38443bc1e72238519dcdeac'
             '3ad1e6bbd7cdc8833eff9afaa9f6ae39350d738678cafbe3437106f0cfe3d985'
-            '73639a55ea72bb57f0134bf2d5228cc2f70e869a95fa7919a4da2c14c72dac74')
+            '894ee123dba8533555c87e5c070ced9f595fdd880556612a3315708ee8be06cd')
 provides=(
     'codium'
     'vscodium'