Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 3.12.1 to 3.13. No source URLs, checksums, build steps, install scripts, permissions, or other packaging metadata are altered here. On its face this is a routine upstream version update with no security-relevant red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = pandoc-bin
 	pkgdesc = Conversion between documentation formats
-	pkgver = 3.12.1
+	pkgver = 3.13
 	pkgrel = 1
 	url = https://pandoc.org
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for pandoc-bin, updating provided virtual package versions and source/checksum URLs from 3.12.1 to 3.13. All sources remain HTTPS and point to the official upstream GitHub repository/releases, with no new scripts, patches, or build-time execution introduced in this diff. No integrity or packaging red flags are visible in the provided hunk.

@@ -15,16 +15,16 @@ pkgbase = pandoc-bin
 	optdepends = texlive-fontsrecommended: for pdf output using latex or xelatex engines
 	optdepends = texlive-latex: for pdf output using pdflatex engine
 	optdepends = texlive-xetex: for pdf output using xelatex engine
-	provides = pandoc=3.12.1
-	provides = pandoc-cli=3.12.1
+	provides = pandoc=3.13
+	provides = pandoc-cli=3.13
 	conflicts = pandoc-cli
 	options = !debug
 	options = !strip
-	source = pandoc-bin-3.12.1.tar.gz::https://github.com/jgm/pandoc/archive/3.12.1.tar.gz
-	sha256sums = cf9b3725b90e471aa70c99ac3b351adcb6e40cd904d36fcbb0f70d712e135686
-	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.12.1/pandoc-3.12.1-linux-amd64.tar.gz
-	sha256sums_x86_64 = d0c90410e90204c9ca83b8539fac5c7aed01fd537207e4585849f8abc5df20b8
-	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.12.1/pandoc-3.12.1-linux-arm64.tar.gz
-	sha256sums_aarch64 = 445d96fd08801fe636cab1158b4f017ee320ac3b7446328b4fe2f902117b19b9
+	source = pandoc-bin-3.13.tar.gz::https://github.com/jgm/pandoc/archive/3.13.tar.gz
+	sha256sums = fbf6044766b0c9be5ccbf18ffe657124449e8563a177d85662ecb6f031f9c308
+	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.13/pandoc-3.13-linux-amd64.tar.gz
+	sha256sums_x86_64 = 38aa33b325a2bc96a4c39409631212db55702f564250bcdbead180b3bf646389
+	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.13/pandoc-3.13-linux-arm64.tar.gz
+	sha256sums_aarch64 = 21e1d4ba09bd0b334590d204580fd4f6629b21be4ab6a32b26cc98982e9e0c68
 
 pkgname = pandoc-bin

Comment

The change only bumps pkgver from 3.12.1 to 3.13 in PKGBUILD. No source URLs, checksums, build steps, install scripts, or packaging logic are modified in the provided diff, so there is no new security-relevant behavior to flag from this change alone.

@@ -1,5 +1,5 @@
 pkgname=pandoc-bin
-pkgver=3.12.1
+pkgver=3.13
 pkgrel=1
 pkgdesc="Conversion between documentation formats"
 url="https://pandoc.org"

Comment

The change only updates the pinned SHA-256 checksums for the upstream source tarball and the prebuilt architecture-specific release archives. The source URLs remain HTTPS and point to the official upstream GitHub project/release assets, with no new build steps, scripts, or privilege-related changes. I did not find any evidence of added network access, code execution, or packaging behavior changes beyond integrity pin updates. Risk is low because the trust boundary is unchanged and the diff is limited to checksum refreshes.

@@ -25,9 +25,9 @@ source=("$pkgname-$pkgver.tar.gz::https://github.com/jgm/pandoc/archive/${pkgver
 source_x86_64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-amd64.tar.gz")
 source_aarch64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-arm64.tar.gz")
 
-sha256sums=('cf9b3725b90e471aa70c99ac3b351adcb6e40cd904d36fcbb0f70d712e135686')
-sha256sums_x86_64=('d0c90410e90204c9ca83b8539fac5c7aed01fd537207e4585849f8abc5df20b8')
-sha256sums_aarch64=('445d96fd08801fe636cab1158b4f017ee320ac3b7446328b4fe2f902117b19b9')
+sha256sums=('fbf6044766b0c9be5ccbf18ffe657124449e8563a177d85662ecb6f031f9c308')
+sha256sums_x86_64=('38aa33b325a2bc96a4c39409631212db55702f564250bcdbead180b3bf646389')
+sha256sums_aarch64=('21e1d4ba09bd0b334590d204580fd4f6629b21be4ab6a32b26cc98982e9e0c68')
 
 package() {
   cd "${srcdir}/pandoc-${pkgver}"