Review Results

Comment

The change is a simple version bump in .SRCINFO from 2.46.3 to 2.46.4 with no accompanying changes to sources, build logic, install scripts, or metadata beyond pkgver. On its own this does not introduce any security-relevant behavior. I did not see any indicators of supply-chain risk in the provided diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = spicetify-cli
 	pkgdesc = Command-line tool to customize Spotify client
-	pkgver = 2.46.3
+	pkgver = 2.46.4
 	pkgrel = 1
 	url = https://github.com/spicetify/cli
 	arch = x86_64

Comment

The change only updates the recorded SHA-256 checksum for the upstream source tarball in .SRCINFO. The source URL remains the official GitHub release archive over HTTPS, and there are no new sources, scripts, or build steps introduced. This is a routine integrity metadata update with no security red flags in the diff shown.

@@ -12,6 +12,6 @@ pkgbase = spicetify-cli
         depends = glibc
 	optdepends = xdg-utils: Allows for opening directories in default file manager
 	source = spicetify-cli-2.43.2.tar.gz::https://github.com/spicetify/cli/archive/v2.43.2
-	sha256sums = f916bb9319b3d144cbe5b6b3f9a40e13b2d924c0598ca3c2c049ce3d80d7dfb8
+	sha256sums = d62b1e2316fa79a34b9283d5846b78b50f88f01b5de40052da94def8c2f97421
 
 pkgname = spicetify-cli

Comment

The change is a routine version bump in PKGBUILD from 2.46.3 to 2.46.4 with the corresponding source tarball checksum update. No new sources, build steps, install scripts, permissions changes, or other suspicious packaging behavior were introduced in the reviewed diff. Based on the provided hunk alone, this appears low risk.

@@ -1,6 +1,6 @@
 ## Maintainer: khanhas <xuankhanh963@gmail.com>, itsmeow <itsmeow@itsmeow.dev>
 pkgname=spicetify-cli
-pkgver=2.46.3
+pkgver=2.46.4
 pkgrel=1
 pkgdesc='Command-line tool to customize Spotify client'
 arch=('x86_64' 'i686')

Comment

The change only updates the SHA-256 checksum for the upstream source tarball in PKGBUILD. The source URL remains the same official GitHub archive over HTTPS, and there are no changes to build steps, install scripts, dependencies, or any added network/execution behavior. This is a routine integrity update and does not introduce a security concern by itself.

@@ -10,7 +10,7 @@ makedepends=('go' 'pnpm')
 depends=('glibc' 'bash')
 optdepends=('xdg-utils: Allows for opening directories in default file manager')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
-sha256sums=('f916bb9319b3d144cbe5b6b3f9a40e13b2d924c0598ca3c2c049ce3d80d7dfb8')
+sha256sums=('d62b1e2316fa79a34b9283d5846b78b50f88f01b5de40052da94def8c2f97421')
 
 prepare() {
   mv "cli-${pkgver}" "${pkgname}-${pkgver}"