Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump from 1.143.17183 to 1.143.17232. No source URLs, checksums, build logic, install scripts, or permissions are changed here, so there is no new security-relevant behavior introduced by this diff alone. This is a routine version update with no evident red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = vscodium-bin
 	pkgdesc = Binary releases of VS Code without MS branding/telemetry/licensing.
-	pkgver = 1.143.17183
+	pkgver = 1.143.17232
 	pkgrel = 1
 	url = https://github.com/VSCodium/vscodium
 	install = vscodium-bin.install

Comment

The change only bumps VSCodium release asset URLs and their corresponding checksums in .SRCINFO. The sources remain HTTPS and point to the upstream VSCodium GitHub release/tag, with no new build-time code execution, install-script changes, or suspicious extra sources introduced. This is a routine version update with no evident security impact from the diff shown.

@@ -33,16 +33,16 @@ pkgbase = vscodium-bin
 	source = vscodium-bin.install
 	source = vscodium-bin.sh
 	source = LICENSE
-	source = https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/1.143.17183/src/stable/resources/linux/code.svg
+	source = https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/1.143.17232/src/stable/resources/linux/code.svg
 	sha256sums = 3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e
 	sha256sums = 121f2db8a65cfc74c10d3e7c3135b62b66297cf27f8f7f00c3ad29d412e968b7
 	sha256sums = 01ba3d33e76804e2346d08f4eda256a29610c9eb59432e4b016d05ad93d901ba
 	sha256sums = 73d4cfae90bc64e37c6471e60c3c5c881c78ae7126ebac83eb9d5bb9d721a1d8
 	sha256sums = 2fa3f8948a0a17ea30b62845caf1ee8aae8b55b5417273920ca2df2642209e0e
 	sha256sums = e622e6bdb70b0cfec57ad9df8717ea023b87e5e215003119b5a1a4d059fcd347
-	source_x86_64 = https://github.com/VSCodium/vscodium/releases/download/1.143.17183/VSCodium-linux-x64-1.143.17183.tar.gz
-	sha256sums_x86_64 = b113c7cc55624f0779fe194169bb6c049785bfaac2033c84b8a4da68445d72af
-	source_aarch64 = https://github.com/VSCodium/vscodium/releases/download/1.143.17183/VSCodium-linux-arm64-1.143.17183.tar.gz
-	sha256sums_aarch64 = 570fd1947f957bbdc11b164b69a0a6d8bb1173e447faeac0dba5d01cc9bfea06
+	source_x86_64 = https://github.com/VSCodium/vscodium/releases/download/1.143.17232/VSCodium-linux-x64-1.143.17232.tar.gz
+	sha256sums_x86_64 = ca1895aa040bd91a09c709d79eac7862d8c1aa0237fdc25b503deeb8bcd87efd
+	source_aarch64 = https://github.com/VSCodium/vscodium/releases/download/1.143.17232/VSCodium-linux-arm64-1.143.17232.tar.gz
+	sha256sums_aarch64 = 9f270ae242561812acd02be9cf5c13c848da359b356327adfe44b815a9532309
 
 pkgname = vscodium-bin

Comment

The change is a simple version bump in PKGBUILD from 1.143.17183 to 1.143.17232 with no other modifications. Based on the provided diff, there are no new sources, build steps, install scripts, permissions changes, or other security-relevant alterations. This appears to be a routine upstream release update with no evident supply-chain or packaging risk in the reviewed hunk.

@@ -7,7 +7,7 @@
 
 pkgname=vscodium-bin
 _pkgname=VSCodium
-pkgver=1.143.17183
+pkgver=1.143.17232
 pkgrel=1
 pkgdesc="Binary releases of VS Code without MS branding/telemetry/licensing."
 arch=('x86_64' 'aarch64')

Comment

The change is a routine version bump in PKGBUILD with updated per-architecture SHA-256 checksums for the new upstream binaries. No new sources, scripts, install hooks, privilege changes, or build-time network behavior are introduced by this diff. The only security-relevant effect is trusting a different upstream release artifact, which is normal for a binary package and is still pinned by checksum.

@@ -32,8 +32,8 @@ sha256sums=('3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e'
             '73d4cfae90bc64e37c6471e60c3c5c881c78ae7126ebac83eb9d5bb9d721a1d8'
             '2fa3f8948a0a17ea30b62845caf1ee8aae8b55b5417273920ca2df2642209e0e')
 sha256sums+=('e622e6bdb70b0cfec57ad9df8717ea023b87e5e215003119b5a1a4d059fcd347')
-sha256sums_x86_64=('b113c7cc55624f0779fe194169bb6c049785bfaac2033c84b8a4da68445d72af')
-sha256sums_aarch64=('570fd1947f957bbdc11b164b69a0a6d8bb1173e447faeac0dba5d01cc9bfea06')
+sha256sums_x86_64=('ca1895aa040bd91a09c709d79eac7862d8c1aa0237fdc25b503deeb8bcd87efd')
+sha256sums_aarch64=('9f270ae242561812acd02be9cf5c13c848da359b356327adfe44b815a9532309')
 
 source=('vscodium-bin.desktop'
         'vscodium-bin-url-handler.desktop'