Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.10.14 to 26.10.15. No source URLs, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries changed in the reviewed diff. Based on this hunk alone, there is no security-relevant issue to flag.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.14
+	pkgver = 26.10.15
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from QOwnNotes 26.10.14 to 26.10.15, with the source URL updated accordingly. No new sources, scripts, build steps, permissions, or install-time behavior are introduced by this diff. Based on the provided hunk alone, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.14/qownnotes-26.10.14.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.15/qownnotes-26.10.15.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump: it updates pkgver, the pinned upstream commit tag, and the release tarball checksum. The source remains an HTTPS GitHub release asset, and there are no new build-time network fetches, scripts, patches, privilege changes, or packaging logic changes in the diff. No security red flags are introduced by this hunk alone.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.14
-tag="6bed9a023e62beae65f5bae7cd67086313ec3ce1"
+pkgver=26.10.15
+tag="aca33f72a504f1f4d3f1704474b747e283083580"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source remains an HTTPS GitHub release URL pinned to the package version, with no new build steps, scripts, patches, or privilege-related changes. I did not find any security-relevant behavior introduced by this diff.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('8d383778c6643a570cabd23f94331921ee8140fde255c9f60c83f8a8817794cd')
+sha256sums=('a73ca04c21eb19d3cafdc82ed2f39ec7373d3420276d560b691f44a9d393598a')
 
 prepare() {
     cd "${pkgname}-${pkgver}"