Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.45.3 to 2.46.0. No sources, checksums, build steps, install scripts, dependencies, or permissions are altered in the reviewed diff, so there is no new security-relevant behavior introduced by this change alone.

@@ -1,6 +1,6 @@
 pkgbase = spicetify-cli
 	pkgdesc = Command-line tool to customize Spotify client
-	pkgver = 2.45.3
+	pkgver = 2.46.0
 	pkgrel = 1
 	url = https://github.com/spicetify/cli
 	arch = x86_64

Comment

The change only updates the SHA-256 checksum for the existing upstream source tarball URL (GitHub release archive for v2.43.2). No new sources, build steps, install scripts, or packaging behavior are introduced. This is a routine integrity metadata update and does not by itself indicate a security issue.

@@ -12,6 +12,6 @@ pkgbase = spicetify-cli
         depends = glibc
 	optdepends = xdg-utils: Allows for opening directories in default file manager
 	source = spicetify-cli-2.43.2.tar.gz::https://github.com/spicetify/cli/archive/v2.43.2
-	sha256sums = f9620d6fdc1fabed82912b2e77042b14896b53de19a2a73d7565ebfd13082bfd
+	sha256sums = 580b4aff8b26880c6312cc5f3039a1cc99ee500d3a261e2746f9f7c685a50c24
 
 pkgname = spicetify-cli

Comment

The change only bumps pkgver from 2.45.3 to 2.46.0 in PKGBUILD. No source URLs, checksums, build steps, install scripts, or packaging logic were modified, so there is no new security-relevant behavior to assess in this diff hunk. Based on the provided change alone, risk is minimal.

@@ -1,6 +1,6 @@
 ## Maintainer: khanhas <xuankhanh963@gmail.com>, itsmeow <itsmeow@itsmeow.dev>
 pkgname=spicetify-cli
-pkgver=2.45.3
+pkgver=2.46.0
 pkgrel=1
 pkgdesc='Command-line tool to customize Spotify client'
 arch=('x86_64' 'i686')

Comment

The change only updates the SHA-256 checksum for the upstream tarball source in PKGBUILD. The source URL remains the official GitHub archive over HTTPS, there are no new build steps, no added network access, and no packaging/install-script changes. This is a routine integrity pin update with no security red flags in the diff provided.

@@ -10,7 +10,7 @@ makedepends=('go' 'pnpm')
 depends=('glibc' 'bash')
 optdepends=('xdg-utils: Allows for opening directories in default file manager')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
-sha256sums=('f9620d6fdc1fabed82912b2e77042b14896b53de19a2a73d7565ebfd13082bfd')
+sha256sums=('580b4aff8b26880c6312cc5f3039a1cc99ee500d3a261e2746f9f7c685a50c24')
 
 prepare() {
   mv "cli-${pkgver}" "${pkgname}-${pkgver}"