Review Results

Version #2994 of megasync · commit b522807802e0 · status Reviewed

Risk 0/5 · Safe .SRCINFO

Result #5768

Comment

The only change in this .SRCINFO hunk is a pkgver bump from 6.6.2.0 to 6.7.0.3. No sources, checksums, install scripts, dependencies, or build logic are altered here, so there is no direct security impact visible in this diff. Based on the provided change alone, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = megasync
 	pkgdesc = Official MEGA desktop application for syncing with MEGA Cloud Drive
-	pkgver = 6.6.2.0
+	pkgver = 6.7.0.3
 	pkgrel = 1
 	url = https://github.com/meganz/MEGAsync/
 	arch = x86_64

Risk 0/5 · Safe .SRCINFO

Result #5769

Comment

The change only bumps the pinned upstream MEGAsync release tag from v6.6.2.0_Linux to v6.7.0.3_Linux and updates the corresponding source checksum in .SRCINFO. The source remains an HTTPS GitHub tag pin, with no new sources, scripts, build-time downloads, or packaging logic changes visible in this diff. On its face this is a routine version update with no added security red flags in the reviewed hunk.

@@ -30,12 +30,12 @@ pkgbase = megasync
 	depends = qt5-x11extras
 	depends = sqlite
 	depends = zlib
-	source = git+https://github.com/meganz/MEGAsync.git#tag=v6.6.2.0_Linux
+	source = git+https://github.com/meganz/MEGAsync.git#tag=v6.7.0.3_Linux
 	source = meganz-sdk::git+https://github.com/meganz/sdk.git
 	source = 010-megasync-sdk-fix-cmake-dependencies-detection.patch
 	source = 020-megasync-app-fix-cmake-dependencies-detection.patch
 	source = 030-megasync-app-disable-isolated-gfx-for-disabling-freeimage-in-sdk.patch
-	sha256sums = 38c77c93f124acd418f599029333b519e0ade311fc8e6e05b892855c2658be5f
+	sha256sums = 6cf74790916b5a7d5a85fed903dac176ff260121fbee53973ff842900dfa26fd
 	sha256sums = SKIP
 	sha256sums = 5219537875385e9399b1a76a5775722053880cdfc0c33b5726504e020e11ad70
 	sha256sums = a5883be2d00dbacaacf78231bfeeac27f4e8a471c3256370e94fec3e55b1d171

Risk 0/5 · Safe PKGBUILD

Result #5770

Comment

The change is a simple version bump in PKGBUILD from 6.6.2.0 to 6.7.0.3 with no other modifications to sources, build steps, install scripts, dependencies, or packaging logic. Based on the provided diff, there are no new security red flags such as added network fetches, scripts, privilege changes, or integrity issues. Risk is minimal.

@@ -7,7 +7,7 @@
 # Contributor: Hexchain Tong <i at hexchain dot org>
 
 pkgname=megasync
-pkgver=6.6.2.0
+pkgver=6.7.0.3
 pkgrel=1
 pkgdesc='Official MEGA desktop application for syncing with MEGA Cloud Drive'
 arch=('x86_64')

Risk 0/5 · Safe PKGBUILD

Result #5771

Comment

The change only bumps pkgver and updates the checksum for the upstream git tag source. The source remains pinned to an HTTPS GitHub tag, and there are no new build steps, downloads, scripts, or packaging changes introduced by this diff. I did not find any added supply-chain or privilege-escalation risk in the reviewed hunk.

@@ -45,7 +45,7 @@ source=("git+https://github.com/meganz/MEGAsync.git#tag=v${pkgver}_Linux"
         '010-megasync-sdk-fix-cmake-dependencies-detection.patch'
         '020-megasync-app-fix-cmake-dependencies-detection.patch'
         '030-megasync-app-disable-isolated-gfx-for-disabling-freeimage-in-sdk.patch')
-sha256sums=('38c77c93f124acd418f599029333b519e0ade311fc8e6e05b892855c2658be5f'
+sha256sums=('6cf74790916b5a7d5a85fed903dac176ff260121fbee53973ff842900dfa26fd'
             'SKIP'
             '5219537875385e9399b1a76a5775722053880cdfc0c33b5726504e020e11ad70'
             'a5883be2d00dbacaacf78231bfeeac27f4e8a471c3256370e94fec3e55b1d171'