Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 12.32.4 to 12.33.3. No source URLs, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the reviewed diff. Based on this hunk alone, there is no evidence of a security issue.

@@ -1,6 +1,6 @@
 pkgbase = postman-bin
 	pkgdesc = Build, test, and document your APIs faster
-	pkgver = 12.32.4
+	pkgver = 12.33.3
 	pkgrel = 1
 	url = https://www.getpostman.com
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Postman tarballs, with updated checksums and no new sources, scripts, or packaging logic. The download URLs remain HTTPS and point to the official Postman distribution host. No additional attack surface is introduced by this metadata-only update.

@@ -38,9 +38,9 @@ pkgbase = postman-bin
 	options = !strip
 	source = postman.desktop
 	sha256sums = d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d
-	source_x86_64 = postman-12.32.4-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.32.4/linux64
-	sha256sums_x86_64 = c95f619c8ee3459358ea2a1369d48d70842fdf65f99e2e8741737a2d9948237d
-	source_aarch64 = postman-12.32.4-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.32.4/linux_arm64
-	sha256sums_aarch64 = ec5b565599af777d091b07630dd2b853277fe8481bbeb0aaff357c2c80f6fc92
+	source_x86_64 = postman-12.33.3-linux-x86_64.tar.gz::https://dl.pstmn.io/download/version/12.33.3/linux64
+	sha256sums_x86_64 = 624cd12d7bb3e4246702411ce80560eec1d3892f398aad6778a76ce4fc8a6825
+	source_aarch64 = postman-12.33.3-linux-aarch64.tar.gz::https://dl.pstmn.io/download/version/12.33.3/linux_arm64
+	sha256sums_aarch64 = cea59a9ccd5cc9b492c005706636fcb08a7201637d76237b00c6d1a1871ab8d6
 
 pkgname = postman-bin

Comment

The change is a straightforward version bump of a binary package from 12.32.4 to 12.33.3, with updated SHA-256 checksums for the upstream tarballs. The source URLs remain HTTPS and point to the official Postman download host, and there are no new build steps, scripts, patches, or privilege-related changes in the diff. No additional supply-chain or persistence risks are introduced by this hunk.

@@ -4,7 +4,7 @@
 # Contributor: Juan Francisco Miranda <aurarchlinux.sleek355 at passfwd dot com>
 
 pkgname=postman-bin
-pkgver=12.32.4
+pkgver=12.33.3
 pkgrel=1
 pkgdesc="Build, test, and document your APIs faster"
 provides=('postman')

Comment

The change only bumps postman-bin from 12.32.4 to 12.33.3 and updates the expected SHA-256 checksums for the official HTTPS downloads from dl.pstmn.io. No new sources, scripts, install hooks, privilege changes, or build-time network behavior were introduced. This looks like a routine upstream version/hash refresh with no obvious security red flags in the diff reviewed.

@@ -20,8 +20,8 @@ source_x86_64=("postman-${pkgver}-linux-${arch[0]}.tar.gz::https://dl.pstmn.io/d
 source_aarch64=("postman-${pkgver}-linux-${arch[1]}.tar.gz::https://dl.pstmn.io/download/version/${pkgver}/linux_arm64")
 
 sha256sums=('d87542ac18455ff341da7c5efd01db96a01f659b1bf546840aa4ac8bd085802d')
-sha256sums_x86_64=('c95f619c8ee3459358ea2a1369d48d70842fdf65f99e2e8741737a2d9948237d')
-sha256sums_aarch64=('ec5b565599af777d091b07630dd2b853277fe8481bbeb0aaff357c2c80f6fc92')
+sha256sums_x86_64=('624cd12d7bb3e4246702411ce80560eec1d3892f398aad6778a76ce4fc8a6825')
+sha256sums_aarch64=('cea59a9ccd5cc9b492c005706636fcb08a7201637d76237b00c6d1a1871ab8d6')
 
 package() {
   install -dm755 "${pkgdir}/opt/"