Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.10.13 to 26.10.14. No source URLs, checksums, build steps, install scripts, permissions, or package metadata were altered in the reviewed diff. Based on this hunk alone, there is no security concern evident.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.13
+	pkgver = 26.10.14
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The only change is a version bump in .SRCINFO source URL from QOwnNotes v26.10.13 to v26.10.14 on the official GitHub releases page. The source remains HTTPS, pinned to a specific release tarball, and there are no new build steps, scripts, or integrity red flags introduced by this diff. No security issue is evident from this metadata-only update.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.13/qownnotes-26.10.13.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.14/qownnotes-26.10.14.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump: it updates pkgver, the pinned VCS tag, and the release tarball checksum. The source remains the official GitHub release URL over HTTPS, and there are no new build-time commands, install scripts, patches, or packaging changes that would introduce execution, persistence, or integrity risks. No suspicious dependencies or metadata changes were introduced in this diff.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.13
-tag="fd6b4935cbc3175959e5ff26fba8056bd25a460a"
+pkgver=26.10.14
+tag="6bed9a023e62beae65f5bae7cd67086313ec3ce1"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball while keeping the source URL pinned to the official GitHub release asset over HTTPS. No build logic, install scripts, dependencies, or packaging behavior changed, and there are no new network fetches or execution paths introduced. Security impact is limited to integrity verification of the same upstream source, so this appears safe.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('34b20c9954d01857b05edddcdbbdc4931d106b1211a8f2fe8aeea884d9b5ec3f')
+sha256sums=('8d383778c6643a570cabd23f94331921ee8140fde255c9f60c83f8a8817794cd')
 
 prepare() {
     cd "${pkgname}-${pkgver}"