Review Results

Comment

This is a routine version bump in .SRCINFO for the official Visual Studio Code binary package. The sources remain HTTPS URLs on the official Microsoft update domain, and the only changes are the package version and corresponding checksums for the new release artifacts. No new build logic, install script, or packaging behavior is introduced by this diff, so there is no evident security concern in the reviewed change.

@@ -1,6 +1,6 @@
 pkgbase = visual-studio-code-bin
 	pkgdesc = Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)
-	pkgver = 1.143.0
+	pkgver = 1.143.1
 	pkgrel = 1
 	url = https://code.visualstudio.com/
 	install = visual-studio-code-bin.install

Comment

The change is a straightforward version bump in .SRCINFO from VS Code 1.143.0 to 1.143.1, with corresponding SHA256 updates for the official Microsoft download URLs over HTTPS. There are no new sources, no build-script changes, no added install hooks, and no signs of persistence or privilege escalation in this diff. Risk is low because the package still relies on upstream binary releases, but this specific change does not introduce additional security concerns beyond the existing trust model.

@@ -33,11 +33,11 @@ pkgbase = visual-studio-code-bin
 	options = !strip
 	source = visual-studio-code-bin.sh
 	sha256sums = bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad
-	source_x86_64 = code_1.143.0_amd64.deb::https://update.code.visualstudio.com/1.143.0/linux-deb-x64/stable
-	sha256sums_x86_64 = f045a886dbfd1aa47ec49dd6880d79a95570c9afde627510897b5cf692db5f2a
-	source_aarch64 = code_1.143.0_arm64.deb::https://update.code.visualstudio.com/1.143.0/linux-deb-arm64/stable
-	sha256sums_aarch64 = f2e0ffb9f370b46b8ddbe49fa099f436e9f6344579ddd15a534bc7825ab4ed98
-	source_armv7h = code_1.143.0_armhf.deb::https://update.code.visualstudio.com/1.143.0/linux-deb-armhf/stable
-	sha256sums_armv7h = 92f66d304dd526ccadf63c6d2098347e23a2dcfa2f2e334915612f5787d2845a
+	source_x86_64 = code_1.143.1_amd64.deb::https://update.code.visualstudio.com/1.143.1/linux-deb-x64/stable
+	sha256sums_x86_64 = e459729dee13758960924be07157da44f0ba69503ab5edf4586fcde936bac9b9
+	source_aarch64 = code_1.143.1_arm64.deb::https://update.code.visualstudio.com/1.143.1/linux-deb-arm64/stable
+	sha256sums_aarch64 = b5163fe68935a3d11c954de08c2ca953532f1ba70204df1bc95e736c1eea31ff
+	source_armv7h = code_1.143.1_armhf.deb::https://update.code.visualstudio.com/1.143.1/linux-deb-armhf/stable
+	sha256sums_armv7h = ee4f0d3da5ff9487733edef736aecfa258af1a8216c090e25f1545ec82928863
 
 pkgname = visual-studio-code-bin

Comment

The change is a routine version bump for the official VS Code binary package, with updated per-architecture SHA256 checksums for the upstream .deb artifacts. The source URLs remain HTTPS and point to the official Microsoft update endpoint, and there are no new build steps, scripts, or packaging behaviors introduced. No security-relevant red flags are present in this diff.

@@ -2,7 +2,7 @@
 
 pkgname=visual-studio-code-bin
 _pkgname=visual-studio-code
-pkgver=1.143.0
+pkgver=1.143.1
 pkgrel=1
 pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)"
 arch=('x86_64' 'aarch64' 'armv7h')

Comment

The change is a routine version bump from 1.143.0 to 1.143.1 with updated SHA-256 checksums for the official Microsoft-hosted .deb artifacts. The source URLs remain HTTPS and point to the upstream update endpoint, and there are no new build steps, scripts, privilege changes, or packaging behavior changes in the diff. No security red flags are introduced by this patch.

@@ -30,9 +30,9 @@ source_x86_64=(code_${pkgver}_amd64.deb::https://update.code.visualstudio.com/${
 source_aarch64=(code_${pkgver}_arm64.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-arm64/stable)
 source_armv7h=(code_${pkgver}_armhf.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-armhf/stable)
 sha256sums=('bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad')
-sha256sums_x86_64=('f045a886dbfd1aa47ec49dd6880d79a95570c9afde627510897b5cf692db5f2a')
-sha256sums_aarch64=('f2e0ffb9f370b46b8ddbe49fa099f436e9f6344579ddd15a534bc7825ab4ed98')
-sha256sums_armv7h=('92f66d304dd526ccadf63c6d2098347e23a2dcfa2f2e334915612f5787d2845a')
+sha256sums_x86_64=('e459729dee13758960924be07157da44f0ba69503ab5edf4586fcde936bac9b9')
+sha256sums_aarch64=('b5163fe68935a3d11c954de08c2ca953532f1ba70204df1bc95e736c1eea31ff')
+sha256sums_armv7h=('ee4f0d3da5ff9487733edef736aecfa258af1a8216c090e25f1545ec82928863')
 
 package() {
   bsdtar -xf data.tar.xz -C "${pkgdir}/"