Review Results

Comment

The change is a simple version bump in .SRCINFO from 26.10.8 to 26.10.9 with no other metadata changes. There are no new sources, build steps, dependencies, install scripts, or packaging behavior introduced by this diff, so it does not add observable security risk on its own.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.8
+	pkgver = 26.10.9
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO from QOwnNotes 26.10.8 to 26.10.9, with the source URL still using HTTPS and pointing to the official GitHub releases page. No new sources, scripts, build steps, or packaging behavior are introduced by this diff, and there are no signs of integrity or privilege-related issues in the reviewed hunk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.8/qownnotes-26.10.8.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.9/qownnotes-26.10.9.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a straightforward version bump in PKGBUILD, updating pkgver and the pinned upstream git tag. There are no new sources, build steps, install scripts, permissions changes, or other packaging logic modifications in the provided diff. Based on the reviewed hunk alone, I do not see any security-relevant regression or supply-chain red flag.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.8
-tag="3be0bec174e0155ab30cad50fb88b157c32eb549"
+pkgver=26.10.9
+tag="00145f3cb800a62fa9664c6143e9cfaa46c8dcab"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball while keeping the same HTTPS GitHub release URL and no other build logic changes. I don’t see any new network fetches, execution, install-script behavior, or packaging red flags introduced by this diff. Security impact is limited to trust in the new upstream tarball contents, which is expected for a versioned source update.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('68b582f3cc94ff8efd8add87b778ab4de5d15bced4de0055225d1886aa787dd2')
+sha256sums=('e4682ca7de7a8a98cf5bf48242511f8925edfb8bb31ac4af40b35c480e5fefef')
 
 prepare() {
     cd "${pkgname}-${pkgver}"