Review Results

Comment

The only change in this .SRCINFO hunk is a minor version bump from 26.10.10 to 26.10.11. No sources, checksums, build steps, dependencies, install scripts, or packaging permissions changed in the reviewed diff, so there is no new security concern visible here.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.10
+	pkgver = 26.10.11
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball URL from v26.10.10 to v26.10.11. The source remains an HTTPS GitHub release artifact, with no new build steps, scripts, patches, or metadata changes that would introduce execution, persistence, or integrity risks. Based on the provided diff alone, this is low risk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.10/qownnotes-26.10.10.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.11/qownnotes-26.10.11.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: pkgver/tag updated to a new release commit and the source checksum updated accordingly. The source is still fetched over HTTPS from the official GitHub releases page, and there are no new build-time downloads, scripts, privilege changes, or packaging behavior changes in this diff. No security red flags are introduced by this hunk alone.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.10
-tag="21b4d8554828bf77f89be5b25da7a6722ebc7b8f"
+pkgver=26.10.11
+tag="185671f5587514ca5dcc970a01abb6a4106fb203"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains an HTTPS GitHub release asset pinned to the package version, and there are no new build steps, scripts, or privilege-related changes. This is a routine integrity update with no obvious security impact in the diff itself.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('4ab0e54b9b1556252d6dbc7a300aa5d3ee20bae8806c0c085f1411e734ac72b7')
+sha256sums=('c460df4cd4ca58cfd1436d9884b8f23bbc3fa5785b91dad2a39c557dbeda4524')
 
 prepare() {
     cd "${pkgname}-${pkgver}"