Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.10.15 to 26.11.0. No source URLs, checksums, build steps, install scripts, permissions, or package metadata affecting trust were changed in the reviewed diff. Based on this hunk alone, there is no security concern evident.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.10.15
+	pkgver = 26.11.0
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The only change in this .SRCINFO hunk is a version bump of the upstream release tarball from v26.10.15 to v26.11.0 on the official GitHub releases URL. The source remains HTTPS and pinned to a specific release artifact, with no new build-time commands, scripts, patches, or packaging logic introduced by this diff. Based on the provided hunk alone, there are no obvious supply-chain or privilege-escalation concerns.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.10.15/qownnotes-26.10.15.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.0/qownnotes-26.11.0.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump in PKGBUILD: it updates pkgver, the pinned upstream tag, and the source tarball checksum. The source remains an HTTPS GitHub release tarball, and there are no new build steps, scripts, patches, network fetches, privilege changes, or packaging behavior changes. Based on the diff provided, there are no security red flags.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.10.15
-tag="aca33f72a504f1f4d3f1704474b747e283083580"
+pkgver=26.11.0
+tag="b655d40702a5fbaf80a1731659ce48b3afb7fc20"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball while keeping the source URL pinned to the official GitHub release asset over HTTPS. No build logic, install scripts, or additional sources were introduced, and there are no signs of network fetches, privilege escalation, or packaging behavior changes. Security impact is limited to source integrity verification for the same upstream artifact.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('a73ca04c21eb19d3cafdc82ed2f39ec7373d3420276d560b691f44a9d393598a')
+sha256sums=('96d1b01fcc3726a7e7b6cb17f245e03f1a7afce9a840d19cf4caac9577cca9c4')
 
 prepare() {
     cd "${pkgname}-${pkgver}"