Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.10.5 to 26.10.6. No source URLs, checksums, build steps, install scripts, permissions, or package metadata affecting trust were changed in the provided diff. Based on this hunk alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.5
+	pkgver = 26.10.6
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from 26.10.5 to 26.10.6. It does not introduce new sources, scripts, build steps, permissions changes, or packaging logic. Based on the provided diff, there are no security red flags in this change itself.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.5/qownnotes-26.10.5.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.6/qownnotes-26.10.6.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a straightforward version bump in PKGBUILD: pkgver advances from 26.10.5 to 26.10.6 and the pinned upstream git tag/commit is updated accordingly. No new sources, build steps, install scripts, permissions changes, or network-fetching logic were introduced in the reviewed hunk. This does not add any obvious supply-chain or privilege-escalation risk beyond the normal trust in the upstream commit being pinned.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.5
-tag="e71c12c951d918ca201ef0002ab5ed7a22c89e07"
+pkgver=26.10.6
+tag="2be81b902fb1857e128dd8a0f8ba2fd7eb560ef7"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball while keeping the source URL pinned to the official GitHub release asset over HTTPS. No build logic, install scripts, permissions, or additional sources were introduced. This is a routine integrity-update change with no obvious security red flags in the provided diff.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('c1214862254ae9661c8c0b120a5a5b370ad8f1030ec2b54fce29e556892652a2')
+sha256sums=('fc2637442a5c92178c33d199a61983e134c0f8d3d3d6e10298acd3d317cba135')
 
 prepare() {
     cd "${pkgname}-${pkgver}"