Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 26.10.12 to 26.10.13. No sources, checksums, build steps, install scripts, permissions, or dependencies are altered, and there are no new integrity or execution red flags visible in the reviewed hunk. Based on this diff alone, the change appears low risk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.12
+	pkgver = 26.10.13
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO, updating the upstream release tarball URL from v26.10.12 to v26.10.13. No new sources, scripts, build steps, permissions, or install-time behavior are introduced by this diff. Based on the provided hunk alone, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.12/qownnotes-26.10.12.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.13/qownnotes-26.10.13.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

Low risk change: this is a routine version bump in PKGBUILD that updates the upstream release tag, source tarball URL via pkgver, and the corresponding sha256 checksum. The source remains an HTTPS GitHub release asset from the official upstream project, with no new build steps, scripts, patches, or privilege-related changes introduced. No suspicious network fetches or packaging behavior changes are present in the diff.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.12
-tag="3ba6f03ead1b0b7e4587380050ea44a001829d8a"
+pkgver=26.10.13
+tag="fd6b4935cbc3175959e5ff26fba8056bd25a460a"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in source=(). The download remains an HTTPS GitHub release asset from the project’s official repository, and there are no added build steps, scripts, or packaging changes that would introduce execution or persistence risks. This is a routine integrity update and does not by itself indicate malicious behavior.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('1f4109308916ba4b856166ecc5f9e923ea55241797f8fe8efe1a772db7dd74f0')
+sha256sums=('34b20c9954d01857b05edddcdbbdc4931d106b1211a8f2fe8aeea884d9b5ec3f')
 
 prepare() {
     cd "${pkgname}-${pkgver}"