Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump from 1.140.06880 to 1.143.17183. No source URLs, checksums, install scripts, permissions, or packaging logic changed in the reviewed diff, so there is no new security concern visible here. This appears to be a routine version update metadata change only.

@@ -1,6 +1,6 @@
 pkgbase = vscodium-bin
 	pkgdesc = Binary releases of VS Code without MS branding/telemetry/licensing.
-	pkgver = 1.140.06880
+	pkgver = 1.143.17183
 	pkgrel = 1
 	url = https://github.com/VSCodium/vscodium
 	install = vscodium-bin.install

Comment

The change only bumps the pinned upstream release artifacts in .SRCINFO: the icon SVG and the prebuilt x86_64/aarch64 tarballs now point to a newer VSCodium release on the official GitHub/VSCodium repositories, with corresponding SHA-256 updates. There are no new build-time commands, no added scripts, no privilege/persistence mechanisms, and no suspicious hosts or unpinned VCS sources introduced in this diff. From the provided hunk alone, this is a routine version update with intact integrity pinning.

@@ -33,16 +33,16 @@ pkgbase = vscodium-bin
 	source = vscodium-bin.install
 	source = vscodium-bin.sh
 	source = LICENSE
-	source = https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/1.140.06880/src/stable/resources/linux/code.svg
+	source = https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/1.143.17183/src/stable/resources/linux/code.svg
 	sha256sums = 3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e
 	sha256sums = 121f2db8a65cfc74c10d3e7c3135b62b66297cf27f8f7f00c3ad29d412e968b7
 	sha256sums = 01ba3d33e76804e2346d08f4eda256a29610c9eb59432e4b016d05ad93d901ba
 	sha256sums = 73d4cfae90bc64e37c6471e60c3c5c881c78ae7126ebac83eb9d5bb9d721a1d8
 	sha256sums = 2fa3f8948a0a17ea30b62845caf1ee8aae8b55b5417273920ca2df2642209e0e
 	sha256sums = e622e6bdb70b0cfec57ad9df8717ea023b87e5e215003119b5a1a4d059fcd347
-	source_x86_64 = https://github.com/VSCodium/vscodium/releases/download/1.140.06880/VSCodium-linux-x64-1.140.06880.tar.gz
-	sha256sums_x86_64 = 61223b74f9e40834117311ec4177cb386d09b84c1aae4f9e674c96580569cef3
-	source_aarch64 = https://github.com/VSCodium/vscodium/releases/download/1.140.06880/VSCodium-linux-arm64-1.140.06880.tar.gz
-	sha256sums_aarch64 = a57be0d528adf7d6508318e37dbd982d695bf91501e324c37e97e11d5b375811
+	source_x86_64 = https://github.com/VSCodium/vscodium/releases/download/1.143.17183/VSCodium-linux-x64-1.143.17183.tar.gz
+	sha256sums_x86_64 = b113c7cc55624f0779fe194169bb6c049785bfaac2033c84b8a4da68445d72af
+	source_aarch64 = https://github.com/VSCodium/vscodium/releases/download/1.143.17183/VSCodium-linux-arm64-1.143.17183.tar.gz
+	sha256sums_aarch64 = 570fd1947f957bbdc11b164b69a0a6d8bb1173e447faeac0dba5d01cc9bfea06
 
 pkgname = vscodium-bin

Comment

The change only bumps pkgver in PKGBUILD from 1.140.06880 to 1.143.17183. No source URLs, checksums, build steps, install scripts, permissions, or packaging logic are modified in the provided diff hunk. Based on this hunk alone, there are no new security concerns introduced.

@@ -7,7 +7,7 @@
 
 pkgname=vscodium-bin
 _pkgname=VSCodium
-pkgver=1.140.06880
+pkgver=1.143.17183
 pkgrel=1
 pkgdesc="Binary releases of VS Code without MS branding/telemetry/licensing."
 arch=('x86_64' 'aarch64')

Comment

The change only updates the architecture-specific SHA-256 checksums for the prebuilt upstream release artifacts in PKGBUILD. There are no new sources, no build-script execution changes, no install-script changes, and no privilege/persistence mechanisms introduced. Security impact is limited to integrity verification of the downloaded binaries, and the new checksums appear to be a straightforward version bump rather than a trust boundary change.

@@ -32,8 +32,8 @@ sha256sums=('3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e'
             '73d4cfae90bc64e37c6471e60c3c5c881c78ae7126ebac83eb9d5bb9d721a1d8'
             '2fa3f8948a0a17ea30b62845caf1ee8aae8b55b5417273920ca2df2642209e0e')
 sha256sums+=('e622e6bdb70b0cfec57ad9df8717ea023b87e5e215003119b5a1a4d059fcd347')
-sha256sums_x86_64=('61223b74f9e40834117311ec4177cb386d09b84c1aae4f9e674c96580569cef3')
-sha256sums_aarch64=('a57be0d528adf7d6508318e37dbd982d695bf91501e324c37e97e11d5b375811')
+sha256sums_x86_64=('b113c7cc55624f0779fe194169bb6c049785bfaac2033c84b8a4da68445d72af')
+sha256sums_aarch64=('570fd1947f957bbdc11b164b69a0a6d8bb1173e447faeac0dba5d01cc9bfea06')
 
 source=('vscodium-bin.desktop'
         'vscodium-bin-url-handler.desktop'