Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.46.1 to 2.46.2. No source URLs, checksums, build steps, dependencies, install scripts, or packaging permissions are altered in the provided diff. Based on this change alone, there is no security-relevant behavior change to flag.

@@ -1,6 +1,6 @@
 pkgbase = spicetify-cli
 	pkgdesc = Command-line tool to customize Spotify client
-	pkgver = 2.46.1
+	pkgver = 2.46.2
 	pkgrel = 1
 	url = https://github.com/spicetify/cli
 	arch = x86_64

Comment

The change is limited to updating .SRCINFO metadata: pkgver advances from 2.46.1 to 2.46.2 and the source checksum changes accordingly. The source URL remains the official GitHub release archive over HTTPS, with no new sources, scripts, install hooks, or build logic introduced in this diff. No security-relevant red flags are present in the reviewed hunk.

@@ -12,6 +12,6 @@ pkgbase = spicetify-cli
         depends = glibc
 	optdepends = xdg-utils: Allows for opening directories in default file manager
 	source = spicetify-cli-2.43.2.tar.gz::https://github.com/spicetify/cli/archive/v2.43.2
-	sha256sums = 1be1f45edc166215e0601a6efe3a2cf311b3fa4e004d97df0405b30659da4eec
+	sha256sums = f4251e342851d2a9edf01c3cee6a66501ee9a29c58b4adf79a0ca548b1044da5
 
 pkgname = spicetify-cli

Comment

The change is a simple version bump in PKGBUILD from 2.46.1 to 2.46.2 with no other modifications. There are no new sources, build steps, install scripts, permissions changes, or other security-relevant alterations in the provided diff hunk. Based on this diff alone, I see no added supply-chain or privilege-escalation risk.

@@ -1,6 +1,6 @@
 ## Maintainer: khanhas <xuankhanh963@gmail.com>, itsmeow <itsmeow@itsmeow.dev>
 pkgname=spicetify-cli
-pkgver=2.46.1
+pkgver=2.46.2
 pkgrel=1
 pkgdesc='Command-line tool to customize Spotify client'
 arch=('x86_64' 'i686')

Comment

The change is a straightforward version bump from 2.46.1 to 2.46.2 with an updated source checksum. The source remains an HTTPS GitHub archive pinned to a release tag, and there are no new build steps, network fetches, install-script changes, or packaging red flags introduced by this diff. Based on the provided hunk, this looks low risk.

@@ -10,7 +10,7 @@ makedepends=('go' 'pnpm')
 depends=('glibc' 'bash')
 optdepends=('xdg-utils: Allows for opening directories in default file manager')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
-sha256sums=('1be1f45edc166215e0601a6efe3a2cf311b3fa4e004d97df0405b30659da4eec')
+sha256sums=('f4251e342851d2a9edf01c3cee6a66501ee9a29c58b4adf79a0ca548b1044da5')
 
 prepare() {
   mv "cli-${pkgver}" "${pkgname}-${pkgver}"