Review Results

Comment

The change only bumps the package version in .SRCINFO from 26.10.6 to 26.10.7. No sources, checksums, build steps, install scripts, or packaging metadata affecting execution or privileges were modified in the provided diff. Based on this hunk alone, there are no security concerns.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.6
+	pkgver = 26.10.7
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from 26.10.6 to 26.10.7. The source remains an HTTPS GitHub release asset from the same upstream project, with no new build steps, scripts, patches, or packaging logic introduced. No integrity or persistence red flags are present in this diff alone.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.6/qownnotes-26.10.6.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.7/qownnotes-26.10.7.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump in PKGBUILD: it updates pkgver/tag and the corresponding source tarball checksum for an upstream GitHub release. The source remains HTTPS and pinned to a release artifact, with no new build steps, scripts, or packaging logic introduced. I do not see any supply-chain red flags in this diff alone.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.6
-tag="2be81b902fb1857e128dd8a0f8ba2fd7eb560ef7"
+pkgver=26.10.7
+tag="c0cc0d0f282d22dc2b6f691391a87af3e2460023"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains an HTTPS GitHub release asset, there are no new build steps, no added scripts, and no packaging or privilege-related changes. This is a routine integrity update consistent with a versioned upstream release artifact.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('fc2637442a5c92178c33d199a61983e134c0f8d3d3d6e10298acd3d317cba135')
+sha256sums=('87789288a17e08c58a156ab3633577297c42a4e01cff880dbf2eb5cdad061af4')
 
 prepare() {
     cd "${pkgname}-${pkgver}"