Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 34.9.0 to 34.9.1, updating the GitHub release ZIP and matching LICENSE.md URL plus checksums. The sources remain HTTPS and point to the upstream Iosevka release assets, with no new build steps, scripts, or packaging behavior introduced. No security-relevant red flags are present in this diff alone.

@@ -1,13 +1,13 @@
 pkgbase = ttf-iosevka
 	pkgdesc = Typeface family designed for coding, terminal use and technical documents.
-	pkgver = 34.9.0
+	pkgver = 34.9.1
 	pkgrel = 1
 	url = https://typeof.net/Iosevka/
 	arch = any
 	license = OFL
-	source = https://github.com/be5invis/Iosevka/releases/download/v34.9.0/PkgTTF-Iosevka-34.9.0.zip
-	source = ttf-iosevka-34.9.0-1-LICENSE.md::https://raw.githubusercontent.com/be5invis/Iosevka/v34.9.0/LICENSE.md
-	sha256sums = c61a10b880bf3087f982217423fa2876a93803bd2a1901fbc52ab80c7329f716
+	source = https://github.com/be5invis/Iosevka/releases/download/v34.9.1/PkgTTF-Iosevka-34.9.1.zip
+	source = ttf-iosevka-34.9.1-1-LICENSE.md::https://raw.githubusercontent.com/be5invis/Iosevka/v34.9.1/LICENSE.md
+	sha256sums = 7a77a3dfa0e2d713a8920a30624863e23df2867a1f55a5e3d6d23dad07c14c65
 	sha256sums = 4ba53c7c1cb39279aae5f8d7d22054c485c71169920e5a36ed098b115e2e3c5d
 
 pkgname = ttf-iosevka

Comment

The change is a straightforward version bump for a font package, with the source URL still using HTTPS and pinned to the upstream release/tag. The only substantive modification is the updated checksum for the new release artifact. No build logic, install scripts, permissions, or additional sources were introduced, so there are no new security concerns in this diff.

@@ -1,6 +1,6 @@
 # Maintainer: Markus Weimar <mail@markusweimar.de>
 pkgname=ttf-iosevka
-pkgver=34.9.0
+pkgver=34.9.1
 pkgrel=1
 pkgdesc='Typeface family designed for coding, terminal use and technical documents.'
 arch=('any')

Comment

The change is a straightforward upstream version bump for a font package, with the release ZIP checksum updated accordingly. The sources are HTTPS and pinned to a specific release tag/version, and there are no added build steps, scripts, patches, or install-time actions. No supply-chain or privilege-escalation concerns are introduced by this diff.

@@ -8,7 +8,7 @@ url='https://typeof.net/Iosevka/'
 license=('OFL')
 source=("https://github.com/be5invis/Iosevka/releases/download/v${pkgver}/PkgTTF-Iosevka-${pkgver}.zip"
         "${pkgname}-${pkgver}-${pkgrel}-LICENSE.md::https://raw.githubusercontent.com/be5invis/Iosevka/v${pkgver}/LICENSE.md")
-sha256sums=('c61a10b880bf3087f982217423fa2876a93803bd2a1901fbc52ab80c7329f716'
+sha256sums=('7a77a3dfa0e2d713a8920a30624863e23df2867a1f55a5e3d6d23dad07c14c65'
             '4ba53c7c1cb39279aae5f8d7d22054c485c71169920e5a36ed098b115e2e3c5d')
 
 package() {