Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.25.0 to 2.26.0. No source URLs, checksums, build steps, install scripts, permissions, or package metadata with security impact were altered in the provided diff. Based on this change alone, there is no evidence of a supply-chain or packaging security issue.

@@ -1,6 +1,6 @@
 pkgbase = teams-for-linux
 	pkgdesc = Unofficial Microsoft Teams client for Linux using Electron.
-	pkgver = 2.25.0
+	pkgver = 2.26.0
 	pkgrel = 1
 	url = https://github.com/IsmaelMartinez/teams-for-linux
 	arch = aarch64

Comment

The .SRCINFO change is a routine upstream version bump from 2.25.0 to 2.26.0 with the corresponding tarball checksum update. The source remains an HTTPS GitHub release archive from the same upstream project, and there are no new sources, build-time fetches, install-script changes, or other suspicious metadata changes in this hunk. Based on this diff alone, I see no security concern.

@@ -15,9 +15,9 @@ pkgbase = teams-for-linux
 	depends = libxss
 	depends = nss
 	optdepends = libfido2: WebAuthn with FIDO2 devices
-	source = teams-for-linux-2.25.0.tar.gz::https://github.com/IsmaelMartinez/teams-for-linux/archive/v2.25.0.tar.gz
+	source = teams-for-linux-2.26.0.tar.gz::https://github.com/IsmaelMartinez/teams-for-linux/archive/v2.26.0.tar.gz
 	source = teams-for-linux.desktop
-	sha256sums = 2b689746c2acbbce7c8425bd9fccaee0022b0d0b7947db83213502661ca29c6d
+	sha256sums = c2273777f044eb1ce0debd3252945f15fe09623fab9e82272a3b2d3c4a37aa6d
 	sha256sums = e67c98084736f797c575970935dd773b5c348ea3d9522bc5db733a92361fc05e
 
 pkgname = teams-for-linux

Comment

The change is a routine version bump from 2.25.0 to 2.26.0 with the corresponding source checksum update. No new sources, scripts, build steps, permissions changes, or install-time behavior are introduced in the diff hunk. Based on the provided change alone, there are no obvious security concerns.

@@ -3,7 +3,7 @@
 # Contributor: Ivelin Velkov <ivelin dot velkov at gmail dot com>
 
 pkgname=teams-for-linux
-pkgver=2.25.0
+pkgver=2.26.0
 pkgrel=1
 pkgdesc="Unofficial Microsoft Teams client for Linux using Electron."
 arch=("aarch64" "armv7h" "i686" "x86_64")

Comment

The change only updates the pinned SHA-256 checksum for the upstream GitHub tarball source in PKGBUILD. The source URL remains HTTPS and points to the official upstream repository, and there are no new build steps, network fetches, scripts, or packaging changes introduced by this diff. This is a routine integrity update with no evident security impact in the reviewed hunk.

@@ -16,7 +16,7 @@ source=(
   "${pkgname}-${pkgver}.tar.gz::https://github.com/IsmaelMartinez/${pkgname}/archive/v${pkgver}.tar.gz"
   "${pkgname}.desktop"
 )
-sha256sums=('2b689746c2acbbce7c8425bd9fccaee0022b0d0b7947db83213502661ca29c6d'
+sha256sums=('c2273777f044eb1ce0debd3252945f15fe09623fab9e82272a3b2d3c4a37aa6d'
             'e67c98084736f797c575970935dd773b5c348ea3d9522bc5db733a92361fc05e')
 
 build() {