Review Results

Comment

The only change in this .SRCINFO hunk is a routine version bump from 26.10.11 to 26.10.12. No source URLs, checksums, build steps, install scripts, dependencies, or packaging metadata were altered in the reviewed diff, so there is no new security concern visible here.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.11
+	pkgver = 26.10.12
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from QOwnNotes 26.10.11 to 26.10.12, with the source still coming from the official GitHub releases URL over HTTPS and no new build steps, scripts, or dependencies introduced. No security-relevant red flags are visible in this diff hunk alone.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.11/qownnotes-26.10.11.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.12/qownnotes-26.10.12.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump for qownnotes, updating the release tag and source checksum to match the new tarball. The source remains an HTTPS GitHub release asset, pinned to a specific release version, with no added build-time network access, scripts, patches, privilege changes, or packaging logic changes. No security-relevant red flags are introduced by this diff alone.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.11
-tag="185671f5587514ca5dcc970a01abb6a4106fb203"
+pkgver=26.10.12
+tag="3ba6f03ead1b0b7e4587380050ea44a001829d8a"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains the official GitHub release over HTTPS, there are no new build steps, no added network fetches, and no packaging/script changes. This is a routine integrity update with no security red flags in the diff provided.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('c460df4cd4ca58cfd1436d9884b8f23bbc3fa5785b91dad2a39c557dbeda4524')
+sha256sums=('1f4109308916ba4b856166ecc5f9e923ea55241797f8fe8efe1a772db7dd74f0')
 
 prepare() {
     cd "${pkgname}-${pkgver}"