Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.10.7 to 26.10.8. No sources, checksums, build steps, dependencies, install scripts, or packaging metadata were altered in the reviewed diff, so there is no new security concern visible here.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.7
+	pkgver = 26.10.8
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from 26.10.7 to 26.10.8. No new sources, scripts, patches, build steps, permissions, or packaging metadata were introduced. Based on the provided diff alone, there are no security red flags in this change.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.7/qownnotes-26.10.7.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.8/qownnotes-26.10.8.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change only bumps qownnotes from 26.10.7 to 26.10.8 and updates the pinned upstream tag and source checksum accordingly. The source remains an HTTPS GitHub release tarball, there are no new build-time downloads, scripts, patches, privilege changes, or packaging behavior changes in the diff. No security-relevant red flags are introduced by this version bump alone.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.7
-tag="c0cc0d0f282d22dc2b6f691391a87af3e2460023"
+pkgver=26.10.8
+tag="3be0bec174e0155ab30cad50fb88b157c32eb549"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains the official GitHub release over HTTPS, there are no new build steps, no added scripts, and no packaging behavior changes. This is a routine integrity update and does not introduce security risk by itself.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('87789288a17e08c58a156ab3633577297c42a4e01cff880dbf2eb5cdad061af4')
+sha256sums=('68b582f3cc94ff8efd8add87b778ab4de5d15bced4de0055225d1886aa787dd2')
 
 prepare() {
     cd "${pkgname}-${pkgver}"