Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.13.0 to 2.14.0. No source URLs, checksums, build steps, install scripts, or packaging metadata affecting trust boundaries were modified in the reviewed diff. Based on this hunk alone, there is no evidence of malicious behavior or integrity regression.

@@ -1,6 +1,6 @@
 pkgbase = mongosh-bin
 	pkgdesc = An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.
-	pkgver = 2.13.0
+	pkgver = 2.14.0
 	pkgrel = 1
 	url = https://github.com/mongodb-js/mongosh.git
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for an existing binary package, updating the GitHub release URLs and corresponding SHA-256 checksums for x86_64 and aarch64. The sources remain HTTPS on the official upstream release page, there are no new build steps, scripts, or privilege-related artifacts introduced, and the package continues to reference pinned release tarballs with checksums. No security red flags are evident in this diff alone.

@@ -9,9 +9,9 @@ pkgbase = mongosh-bin
 	depends = krb5
 	provides = mongosh
 	conflicts = mongosh
-	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.13.0/mongosh-2.13.0-linux-x64.tgz
-	sha256sums_x86_64 = b2089e67641a28aa621476c4d62c69f66b9a41484baba24d8a8b1f5f96e92d0b
-	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.13.0/mongosh-2.13.0-linux-arm64.tgz
-	sha256sums_aarch64 = a124ec6680c70ceabc61696bbd110f0da05d7c52524ed402ae9511b5aec7fe32
+	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.14.0/mongosh-2.14.0-linux-x64.tgz
+	sha256sums_x86_64 = c1c5f1a9709e91c5eb1c6861a99c305c165fa564afb465fabfd2b2334c08a23c
+	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.14.0/mongosh-2.14.0-linux-arm64.tgz
+	sha256sums_aarch64 = 3c6a3631667f9caf0a7b5dfe87e433f973f0a82f2cf04130cd52115076e945e4
 
 pkgname = mongosh-bin

Comment

This change is a routine version bump from mongosh 2.13.0 to 2.14.0 with corresponding updated SHA-256 checksums for the official GitHub release tarballs. No new sources, scripts, build logic, or packaging behavior were introduced, and the download URLs remain HTTPS and pinned to the release version. I see no security-relevant regression in the diff itself.

@@ -3,7 +3,7 @@
 
 pkgname=mongosh-bin
 _pkgname=mongosh
-pkgver=2.13.0
+pkgver=2.14.0
 pkgrel=1
 pkgdesc='An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.'
 arch=('x86_64' 'aarch64')

Comment

The change only bumps mongosh-bin from 2.13.0 to 2.14.0 and updates the corresponding SHA-256 checksums for the official GitHub release tarballs. Source URLs remain HTTPS and point to the upstream MongoDB JS GitHub release assets, with no new build-time code execution, no added scripts, and no packaging logic changes. Based on the diff shown, this is a routine version/checksum refresh with no obvious security red flags.

@@ -17,8 +17,8 @@ _mongosh_folder=mongosh-${pkgver}-linux
 source_x86_64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-x64.tgz")
 source_aarch64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64.tgz")
 
-sha256sums_x86_64=('b2089e67641a28aa621476c4d62c69f66b9a41484baba24d8a8b1f5f96e92d0b')
-sha256sums_aarch64=('a124ec6680c70ceabc61696bbd110f0da05d7c52524ed402ae9511b5aec7fe32')
+sha256sums_x86_64=('c1c5f1a9709e91c5eb1c6861a99c305c165fa564afb465fabfd2b2334c08a23c')
+sha256sums_aarch64=('3c6a3631667f9caf0a7b5dfe87e433f973f0a82f2cf04130cd52115076e945e4')
 
 package() {
 	if [ $CARCH = 'x86_64' ]; then