Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 2 to 3. This is metadata-only and does not alter sources, build logic, dependencies, install scripts, or shipped artifacts. No security impact is evident from the provided diff.

@@ -1,7 +1,7 @@
 pkgbase = freetube
 	pkgdesc = An open source desktop YouTube player built with privacy in mind.
 	pkgver = 0.25.3
-	pkgrel = 2
+	pkgrel = 3
 	url = https://freetubeapp.io
 	arch = x86_64
 	arch = i686

Comment

The change only adds a makedepends entry for nodejs>=20.0.0 in .SRCINFO. This is metadata-only and does not introduce new sources, scripts, install actions, or packaging behavior. It slightly changes the build environment requirement but does not itself indicate a security issue in the reviewed diff.

@@ -11,6 +11,7 @@ pkgbase = freetube
 	arch = aarch64
 	license = AGPL-3.0-or-later
 	makedepends = pnpm
+	makedepends = nodejs>=20.0.0
 	depends = electron42
 	source = https://github.com/FreeTubeApp/FreeTube/archive/v0.25.3-beta.tar.gz
 	source = freetube.desktop

Comment

The change only bumps pkgrel and adds an explicit build dependency on nodejs>=20.0.0. This does not introduce new code execution paths, network sources, privilege changes, or packaging/install-time behavior. The package still fetches its upstream tarball over HTTPS and the rest of the PKGBUILD is unchanged. No security concern is evident from this diff alone.

@@ -5,12 +5,12 @@ pkgname=freetube
 _pkgname=FreeTube
 pkgver=0.25.3
 _electron=electron42
-pkgrel=2
+pkgrel=3
 pkgdesc='An open source desktop YouTube player built with privacy in mind.'
 arch=('x86_64' 'i686' 'arm' 'armv6h' 'armv7h' 'aarch64')
 license=('AGPL-3.0-or-later')
 depends=($_electron)
-makedepends=('pnpm')
+makedepends=('pnpm' 'nodejs>=20.0.0')
 url=https://freetubeapp.io
 source=(https://github.com/FreeTubeApp/FreeTube/archive/v$pkgver-beta.tar.gz
         freetube.desktop