Review Results

Comment

The change is a simple version bump in .SRCINFO from 2.46.0 to 2.46.1 with no accompanying changes to sources, build logic, install scripts, or package metadata that would affect security. On its face this does not introduce any new attack surface or integrity concern.

@@ -1,6 +1,6 @@
 pkgbase = spicetify-cli
 	pkgdesc = Command-line tool to customize Spotify client
-	pkgver = 2.46.0
+	pkgver = 2.46.1
 	pkgrel = 1
 	url = https://github.com/spicetify/cli
 	arch = x86_64

Comment

The change only updates the SHA-256 checksum for the existing upstream source tarball URL. The source remains an HTTPS GitHub release archive pinned to a specific version tag, with no new build steps, scripts, or packaging behavior changes. I see no added supply-chain, persistence, or privilege-escalation risk in this .SRCINFO-only update.

@@ -12,6 +12,6 @@ pkgbase = spicetify-cli
         depends = glibc
 	optdepends = xdg-utils: Allows for opening directories in default file manager
 	source = spicetify-cli-2.43.2.tar.gz::https://github.com/spicetify/cli/archive/v2.43.2
-	sha256sums = 580b4aff8b26880c6312cc5f3039a1cc99ee500d3a261e2746f9f7c685a50c24
+	sha256sums = 1be1f45edc166215e0601a6efe3a2cf311b3fa4e004d97df0405b30659da4eec
 
 pkgname = spicetify-cli

Comment

The change is a simple version bump in PKGBUILD from 2.46.0 to 2.46.1 with no other modifications shown. There are no new sources, build steps, install scripts, permissions changes, or other security-relevant alterations in the provided diff hunk. Based on this diff alone, I see no evidence of supply-chain risk or malicious behavior.

@@ -1,6 +1,6 @@
 ## Maintainer: khanhas <xuankhanh963@gmail.com>, itsmeow <itsmeow@itsmeow.dev>
 pkgname=spicetify-cli
-pkgver=2.46.0
+pkgver=2.46.1
 pkgrel=1
 pkgdesc='Command-line tool to customize Spotify client'
 arch=('x86_64' 'i686')

Comment

The change is a routine upstream version bump from 2.46.0 to 2.46.1 with the corresponding source tarball checksum update. The source remains an HTTPS GitHub archive pinned to a specific release tag, and there are no new build steps, network fetches, install scripts, or packaging changes that would introduce obvious security risk. Based on the provided diff, this looks safe.

@@ -10,7 +10,7 @@ makedepends=('go' 'pnpm')
 depends=('glibc' 'bash')
 optdepends=('xdg-utils: Allows for opening directories in default file manager')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
-sha256sums=('580b4aff8b26880c6312cc5f3039a1cc99ee500d3a261e2746f9f7c685a50c24')
+sha256sums=('1be1f45edc166215e0601a6efe3a2cf311b3fa4e004d97df0405b30659da4eec')
 
 prepare() {
   mv "cli-${pkgver}" "${pkgname}-${pkgver}"