Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 13.0.1 to 13.1.0. No sources, checksums, build steps, install scripts, or package metadata affecting trust boundaries were modified in the provided diff. Based on this hunk alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = yay
 	pkgdesc = Yet another yogurt. Pacman wrapper and AUR helper written in go.
-	pkgver = 13.0.1
+	pkgver = 13.1.0
 	pkgrel = 1
 	url = https://github.com/Jguer/yay
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO: it updates the upstream tarball URL and checksum from 13.0.1 to 13.1.0 and raises the Go build dependency from >=1.24 to >=1.26. The source remains HTTPS on the official upstream GitHub repo, there are no new scripts, patches, binaries, or install-time behaviors introduced in this diff, and no packaging metadata suggests privilege escalation or persistence. The only notable risk is the higher Go minimum, which is a normal build requirement change rather than a security concern.

@@ -12,13 +12,13 @@ pkgbase = yay
 	arch = aarch64
 	arch = riscv64
 	license = GPL-3.0-or-later
-	makedepends = go>=1.24
+	makedepends = go>=1.26
 	depends = pacman>6.1
 	depends = git
 	optdepends = sudo: privilege elevation
 	optdepends = doas: privilege elevation
 	options = !lto
-	source = yay-13.0.1.tar.gz::https://github.com/Jguer/yay/archive/v13.0.1.tar.gz
-	sha256sums = b77454bce87110180a1b6664c2d260de78124c9894b71101610ba84f551eb0d0
+	source = yay-13.1.0.tar.gz::https://github.com/Jguer/yay/archive/v13.1.0.tar.gz
+	sha256sums = acd3c97fac52449ba3589fefc076b90f42fa5072ef274f5bcbcd381f50b2701a
 
 pkgname = yay

Comment

The change is a routine version bump in PKGBUILD from 13.0.1 to 13.1.0, with the source URL still using HTTPS and pinned to the upstream GitHub release tarball for that exact version. The checksum was updated accordingly, and the only other change is raising the Go build dependency to a newer minimum version. No new build-time network access, no suspicious scripts, no privilege-related changes, and no packaging/install logic changes are introduced by this diff. Based on the provided hunk, this appears low risk.

@@ -1,6 +1,6 @@
 # Maintainer: Jguer <pkgbuilds at jguer.space>
 pkgname=yay
-pkgver=13.0.1
+pkgver=13.1.0
 pkgrel=1
 pkgdesc="Yet another yogurt. Pacman wrapper and AUR helper written in go."
 arch=('i686' 'pentium4' 'x86_64' 'arm' 'armv7h' 'armv6h' 'aarch64' 'riscv64')

Comment

The change is low risk. It only bumps the Go build dependency from 1.24 to 1.26 and updates the source tarball checksum for the same upstream GitHub release archive. The source remains HTTPS and pinned to a versioned release tarball, with no new build steps, network fetches, scripts, or packaging behavior changes. No suspicious install-time or privilege-related artifacts are introduced by this diff.

@@ -15,9 +15,9 @@ optdepends=(
   'sudo: privilege elevation'
   'doas: privilege elevation'
 )
-makedepends=('go>=1.24')
+makedepends=('go>=1.26')
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Jguer/yay/archive/v${pkgver}.tar.gz")
-sha256sums=('b77454bce87110180a1b6664c2d260de78124c9894b71101610ba84f551eb0d0')
+sha256sums=('acd3c97fac52449ba3589fefc076b90f42fa5072ef274f5bcbcd381f50b2701a')
 
 build() {
   export GOPATH="$srcdir"/gopath