Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 4.2.2 to 4.3.0. No source URLs, checksums, build steps, install scripts, or permissions are altered here, so there is no new security concern visible in this diff alone. This appears to be a routine package version update.

@@ -1,6 +1,6 @@
 pkgbase = lcevcdec
 	pkgdesc = Low Complexity Enhancement Video Codec Decoder (LCEVC_DEC)
-	pkgver = 4.2.2
+	pkgver = 4.3.0
 	pkgrel = 1
 	url = https://github.com/v-novaltd/LCEVCdec/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from 4.2.2 to 4.3.0, with the source remaining the official GitHub repository over HTTPS and pinned to a specific tag. No new sources, scripts, install hooks, or packaging directives were introduced in this diff. Based on the provided change alone, there are no obvious security red flags.

@@ -14,7 +14,7 @@ pkgbase = lcevcdec
 	depends = libgcc
 	depends = libstdc++
 	options = !emptydirs
-	source = git+https://github.com/v-novaltd/LCEVCdec.git#tag=4.2.2
-	sha256sums = 4f3fc9ba674c05a5a10e0db820094a51bbae0aef5924e148446187a4b3885a0a
+	source = git+https://github.com/v-novaltd/LCEVCdec.git#tag=4.3.0
+	sha256sums = 0512dc1dfb53a2d8e1c81aa75803cfc331ec289f8ee56a9cb7ec6aaa92810d0b
 
 pkgname = lcevcdec

Comment

The change only bumps pkgver from 4.2.2 to 4.3.0 in PKGBUILD. No source URLs, checksums, build steps, install scripts, or packaging logic are modified in the provided diff hunk, so there is no new security-relevant behavior to assess from this change alone.

@@ -1,7 +1,7 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=lcevcdec
-pkgver=4.2.2
+pkgver=4.3.0
 pkgrel=1
 pkgdesc='Low Complexity Enhancement Video Codec Decoder (LCEVC_DEC)'
 arch=('x86_64')

Comment

The change is low risk. It updates the package version and the expected source checksum for the upstream git tag, and the source remains pinned to an HTTPS GitHub tag rather than a floating branch. I did not find any new network fetches, install-script changes, privilege escalation, or suspicious packaging behavior. The only other modification is a CMake warning flag change from -Wno-dev to -Wno-author, which is not security-relevant.

@@ -19,7 +19,7 @@ makedepends=(
     'rapidjson')
 options=('!emptydirs')
 source=("git+https://github.com/v-novaltd/LCEVCdec.git#tag=${pkgver}")
-sha256sums=('4f3fc9ba674c05a5a10e0db820094a51bbae0aef5924e148446187a4b3885a0a')
+sha256sums=('0512dc1dfb53a2d8e1c81aa75803cfc331ec289f8ee56a9cb7ec6aaa92810d0b')
 
 export GIT_LFS_SKIP_SMUDGE='1'
 

Comment

The change only replaces a CMake warning-suppression flag in PKGBUILD build() from -Wno-dev to -Wno-author. This does not introduce network access, privilege escalation, persistence, or packaging changes, and it does not affect what gets installed. It is a build-configuration tweak with no security impact visible in the diff.

@@ -32,7 +32,7 @@ build() {
         -DVN_SDK_EXECUTABLES:BOOL='OFF' \
         -DVN_SDK_SIMD:BOOL='OFF' \
         -DVN_SDK_UNIT_TESTS:BOOL='OFF' \
-        -Wno-dev
+        -Wno-author
     cmake --build build
 }