Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 3.7.21 to 3.7.22. No sources, checksums, build steps, dependencies, install scripts, or packaging permissions were altered in the reviewed hunk, so there is no new security concern visible here.

@@ -1,6 +1,6 @@
 pkgbase = joplin
 	pkgdesc = A note taking and to-do application with synchronization capabilities
-	pkgver = 3.7.21
+	pkgver = 3.7.22
 	pkgrel = 1
 	url = https://joplinapp.org/
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO from joplin 3.7.21 to 3.7.22, with the corresponding source tarball URL and checksum updated. No new sources, scripts, build steps, permissions, or install-time behavior are introduced by this diff. Based on the provided hunk alone, this does not present an obvious security concern.

@@ -19,10 +19,10 @@ pkgbase = joplin
 	optdepends = libappindicator-gtk3: for tray icon
 	source = joplin-desktop.sh
 	source = joplin-desktop.desktop
-	source = joplin-3.7.21.tar.gz::https://github.com/laurent22/joplin/archive/v3.7.21.tar.gz
+	source = joplin-3.7.22.tar.gz::https://github.com/laurent22/joplin/archive/v3.7.22.tar.gz
 	sha256sums = 3f87fe0167806c86495fab78483cce83d60262bc2289e5ff24a9a9039e8454b2
 	sha256sums = fb9a5185e3b523a5f52b0eeec6def781782ad0e6b64e5db13300396b835a55b4
-	sha256sums = d868a2f9a48937c514b6b39486e88f473b4477085035f75d22542800c1fdd083
+	sha256sums = c298af99981f1c470057205fbc85e596790f099d04c0518f1d56641c6bd26afa
 
 pkgname = joplin
 	pkgdesc = A note taking and to-do application with synchronization capabilities - CLI App

Comment

The change is a simple version bump in PKGBUILD from 3.7.21 to 3.7.22 with no accompanying changes to sources, build logic, install scripts, dependencies, or packaging behavior. Based on the provided diff hunk alone, there are no security-relevant modifications.

@@ -8,7 +8,7 @@
 pkgbase=joplin
 pkgname=('joplin' 'joplin-desktop')
 pkgdesc="A note taking and to-do application with synchronization capabilities"
-pkgver=3.7.21
+pkgver=3.7.22
 groups=('joplin')
 pkgrel=1
 _electronVersion=42

Comment

The change only bumps pkgver from 3.7.21 to 3.7.22 and updates the corresponding sha256 checksum for one source artifact. No new sources, build steps, install scripts, permissions, or network-fetching behavior were introduced in the reviewed hunk. Based on this diff alone, there are no security red flags.

@@ -25,7 +25,7 @@ source=(
 )
 sha256sums=('3f87fe0167806c86495fab78483cce83d60262bc2289e5ff24a9a9039e8454b2'
             'fb9a5185e3b523a5f52b0eeec6def781782ad0e6b64e5db13300396b835a55b4'
-            'd868a2f9a48937c514b6b39486e88f473b4477085035f75d22542800c1fdd083')
+            'c298af99981f1c470057205fbc85e596790f099d04c0518f1d56641c6bd26afa')
 
 _setup_env() {
     export YARN_CACHE_FOLDER="${srcdir}/yarn-cache"