Review Results

Comment

The change is a simple version bump in .SRCINFO from 9.49 to 9.50 with no accompanying changes to sources, build steps, install scripts, or package metadata beyond pkgver. On its own this does not introduce any new attack surface or supply-chain risk. I did not see any indicators of malicious behavior in the provided diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = perl-mojolicious
 	pkgdesc = Real-time web framework
-	pkgver = 9.49
+	pkgver = 9.50
 	pkgrel = 1
 	url = https://metacpan.org/release/Mojolicious
 	arch = any

Comment

The change is a straightforward upstream version bump in .SRCINFO from Mojolicious 9.49 to 9.50, with corresponding checksum updates. The source remains an HTTPS CPAN tarball from the expected upstream author path, and there are no new build steps, scripts, binaries, or metadata changes that would suggest a supply-chain or privilege issue. Based on the provided diff alone, this looks low risk.

@@ -10,8 +10,8 @@ pkgbase = perl-mojolicious
 	optdepends = perl-cpanel-json-xs>=4.09: Faster JSON encoding and decoding
 	optdepends = perl-role-tiny>=2.000001: Role support
 	options = !emptydirs
-	source = https://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-9.49.tar.gz
-	md5sums = cfd3b41597f228c945f6b25215410cc2
-	sha512sums = c2319fc25298863c8cc01bed85767d8676d1e42053b6448907d9c2e03ef53070360a71046a457a2de3d82eb659dee8031773ee4793e1e44faa25278b37194e01
+	source = https://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-9.50.tar.gz
+	md5sums = 3168863643ba9508531a785e669dc3e3
+	sha512sums = dfc2eb9e8d200a68ab09fdd8d8d18d4234e71eaa82b37a5b22fc849f637db4441d2b21961c8d2770fb5b03921f722bda493a26585446caf6ddf5e070d38bfa35
 
 pkgname = perl-mojolicious

Comment

The change is a simple version bump in PKGBUILD from 9.49 to 9.50 with no modifications to source URLs, checksums, build steps, dependencies, install scripts, or packaging behavior. Based on the provided diff, there are no security red flags such as network fetches, privilege escalation, persistence mechanisms, or integrity issues introduced by this change.

@@ -3,7 +3,7 @@
 # Generator  : CPANPLUS::Dist::Arch 1.32
 
 pkgname='perl-mojolicious'
-pkgver='9.49'
+pkgver='9.50'
 pkgrel='1'
 pkgdesc="Real-time web framework"
 arch=('any')

Comment

The change is a routine upstream version bump from 9.49 to 9.50 with corresponding checksum updates for the same official CPAN source URL. No new sources, build steps, install scripts, or packaging logic were introduced, and there are no signs of network fetches, privilege escalation, or persistence mechanisms in the reviewed diff. Risk is therefore minimal.

@@ -14,8 +14,8 @@ makedepends=()
 optdepends=('perl-cpanel-json-xs>=4.09: Faster JSON encoding and decoding' 'perl-role-tiny>=2.000001: Role support')
 url='https://metacpan.org/release/Mojolicious'
 source=("https://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-${pkgver}.tar.gz")
-md5sums=('cfd3b41597f228c945f6b25215410cc2')
-sha512sums=('c2319fc25298863c8cc01bed85767d8676d1e42053b6448907d9c2e03ef53070360a71046a457a2de3d82eb659dee8031773ee4793e1e44faa25278b37194e01')
+md5sums=('3168863643ba9508531a785e669dc3e3')
+sha512sums=('dfc2eb9e8d200a68ab09fdd8d8d18d4234e71eaa82b37a5b22fc849f637db4441d2b21961c8d2770fb5b03921f722bda493a26585446caf6ddf5e070d38bfa35')
 _distdir="Mojolicious-${pkgver}"
 
 build() {