Review Results

Comment

The change is limited to .SRCINFO metadata: it bumps the pkgver to a newer git snapshot and adds a new runtime dependency on xxhash. There are no signs of malicious build steps, network fetches, privilege escalation, or packaging-policy red flags in this diff. Since .SRCINFO is generated metadata and the actual build logic is not changed here, the security impact appears negligible based on the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = zathura-git
 	pkgdesc = Minimalistic document viewer
-	pkgver = 2026.07.08.r6.gedc0ca7e
+	pkgver = 2026.10.23.r1.g99f5d0d9
 	pkgrel = 1
 	url = https://pwmt.org/projects/zathura
 	arch = x86_64

Comment

The change is limited to adding a new runtime dependency, xxhash, in .SRCINFO. There are no signs of malicious behavior, network access, privilege escalation, or packaging integrity issues in this diff. The dependency addition is plausible for upstream feature support and does not by itself introduce a security concern.

@@ -19,6 +19,7 @@ pkgbase = zathura-git
 	depends = libseccomp
 	depends = libsynctex
 	depends = sqlite
+	depends = xxhash
 	optdepends = zathura-djvu-git: DjVu support
 	optdepends = zathura-pdf-poppler-git: PDF support using Poppler
 	optdepends = zathura-pdf-mupdf-git: PDF support using MuPDF

Comment

The change is a straightforward version bump plus one new runtime dependency (`xxhash`). There are no added build steps, no network-fetching logic, no install scripts, and no suspicious packaging directives in the diff. The new dependency is plausible for upstream functionality and does not by itself indicate a security issue. Based on the provided hunk alone, this looks low risk.

@@ -2,13 +2,13 @@
 # Contributor: Moritz Lipp <mlq@pwmt.org>
 
 pkgname=zathura-git
-pkgver=2026.07.08.r6.gedc0ca7e
+pkgver=2026.10.23.r1.g99f5d0d9
 pkgrel=1
 pkgdesc="Minimalistic document viewer"
 arch=('x86_64')
 url="https://pwmt.org/projects/zathura"
 license=('Zlib')
-depends=('cairo' 'file' 'girara-git' 'glibc' 'glib2' 'gtk4' 'json-glib' 'libseccomp' 'libsynctex' 'sqlite')
+depends=('cairo' 'file' 'girara-git' 'glibc' 'glib2' 'gtk4' 'json-glib' 'libseccomp' 'libsynctex' 'sqlite' 'xxhash')
 makedepends=('git' 'meson' 'ninja' 'python-sphinx')
 conflicts=('zathura')
 provides=('zathura')