Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 28.13 to 28.14. No source URLs, checksums, build commands, install scripts, or packaging metadata changed in a way that introduces execution, persistence, or integrity risk. Based on the provided diff alone, this is a routine upstream version update with no security red flags.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.13
+	pkgver = 28.14
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is a straightforward source version bump in .SRCINFO from OpenJFX 28+13 to 28+14, with the corresponding checksum updated. The source remains the official upstream GitHub release tarball over HTTPS, and there are no new build steps, scripts, or privilege-related artifacts introduced by this diff. No security red flags are evident in the provided hunk.

@@ -28,13 +28,13 @@ pkgbase = java-openjfx
 	makedepends = zip
 	makedepends = gradle
 	options = !lto
-	source = java-openjfx-28.13.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+13.tar.gz
+	source = java-openjfx-28.14.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+14.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = d07056ca4b25c06767ff15dc20512aa9bd137456c47189509a68477110da8e1b5bb90ad1dc5ccfd685e80253aebdf04e94fceae41d9602d6984810dea89dba66
+	b2sums = d68e7315cd5325945a119804180b625115a5d315787c700e3db2c1d5cb9f3c510fc6519a1711dc215a480d4f6915092c108fd2683ca0c0229d6341dceb1cead7
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change only bumps the upstream tag from 28+13 to 28+14 in PKGBUILD metadata. No build logic, sources, checksums, install scripts, or packaging behavior changed. This is a low-risk version update with no security-relevant red flags visible in the provided diff.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+13'
+_tag='28+14'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change only bumps the upstream OpenJFX tag from 28+13 to 28+14 and updates the corresponding b2sum for the first source tarball. No new sources, scripts, patches, install hooks, or build steps were introduced, and the package still relies on pinned HTTPS sources with checksum verification. I don’t see any security-relevant regression in this diff.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('d07056ca4b25c06767ff15dc20512aa9bd137456c47189509a68477110da8e1b5bb90ad1dc5ccfd685e80253aebdf04e94fceae41d9602d6984810dea89dba66'
+b2sums=('d68e7315cd5325945a119804180b625115a5d315787c700e3db2c1d5cb9f3c510fc6519a1711dc215a480d4f6915092c108fd2683ca0c0229d6341dceb1cead7'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'