Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.11.0 to 26.11.1. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the reviewed diff. Based on this hunk alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.11.0
+	pkgver = 26.11.1
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from QOwnNotes 26.11.0 to 26.11.1, with the source URL still using HTTPS and pointing to the upstream GitHub release tarball. No new sources, scripts, build steps, permissions, or packaging logic are introduced by this diff. Based on the provided hunk alone, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.0/qownnotes-26.11.0.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.1/qownnotes-26.11.1.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: it updates pkgver, the pinned release tag, and the source tarball checksum. The source remains an HTTPS GitHub release tarball, there are no new build steps, no added scripts, and no changes to dependencies, install hooks, or packaging behavior. I do not see any supply-chain or privilege-related risk introduced by this diff.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.11.0
-tag="b655d40702a5fbaf80a1731659ce48b3afb7fc20"
+pkgver=26.11.1
+tag="f120e5d8ee223a17d9a29c2636ece2144361a2e7"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in source=(). The download URL remains HTTPS and points to the official GitHub releases page for QOwnNotes, with no new build steps, scripts, patches, or packaging logic introduced. This is a routine integrity update and does not add any security risk by itself.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('96d1b01fcc3726a7e7b6cb17f245e03f1a7afce9a840d19cf4caac9577cca9c4')
+sha256sums=('2b2109e8dee5b4eea6e9265a8e1a49a314c0e3ca2165e88d9655312d6bd07631')
 
 prepare() {
     cd "${pkgname}-${pkgver}"