Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 4.3.0 to 4.3.1. No source URLs, checksums, build steps, dependencies, install scripts, or packaging behavior changed, so there is no new security concern visible in this diff. Based on the provided hunk alone, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = lcevcdec
 	pkgdesc = Low Complexity Enhancement Video Codec Decoder (LCEVC_DEC)
-	pkgver = 4.3.0
+	pkgver = 4.3.1
 	pkgrel = 1
 	url = https://github.com/v-novaltd/LCEVCdec/
 	arch = x86_64

Comment

The change only bumps the pinned upstream tag in .SRCINFO from 4.3.0 to 4.3.1 and updates the corresponding source checksum/pkgver metadata. The source remains an HTTPS GitHub URL to the official upstream repository, with no new build steps, scripts, patches, or privilege-related artifacts introduced by this diff. Based on the reviewed hunk alone, there are no obvious security red flags.

@@ -14,7 +14,7 @@ pkgbase = lcevcdec
 	depends = libgcc
 	depends = libstdc++
 	options = !emptydirs
-	source = git+https://github.com/v-novaltd/LCEVCdec.git#tag=4.3.0
-	sha256sums = 0512dc1dfb53a2d8e1c81aa75803cfc331ec289f8ee56a9cb7ec6aaa92810d0b
+	source = git+https://github.com/v-novaltd/LCEVCdec.git#tag=4.3.1
+	sha256sums = 31690ba04b261159f4db020299856dd48f42def0acbe907a466d82c3f954a62c
 
 pkgname = lcevcdec

Comment

The change is a trivial version bump in PKGBUILD from 4.3.0 to 4.3.1 with no accompanying changes to sources, build logic, install scripts, or package metadata. Based on the provided diff, there are no new security-relevant behaviors introduced.

@@ -1,7 +1,7 @@
 # Maintainer: Daniel Bermond <dbermond@archlinux.org>
 
 pkgname=lcevcdec
-pkgver=4.3.0
+pkgver=4.3.1
 pkgrel=1
 pkgdesc='Low Complexity Enhancement Video Codec Decoder (LCEVC_DEC)'
 arch=('x86_64')

Comment

The change is a straightforward version bump from 4.3.0 to 4.3.1 with an updated checksum for the same upstream GitHub source. The source remains pinned to a tag over HTTPS, there are no new build-time network fetches, no added scripts or patches, and no packaging/install logic changes. I do not see any new supply-chain or privilege-escalation risk in this diff.

@@ -19,7 +19,7 @@ makedepends=(
     'rapidjson')
 options=('!emptydirs')
 source=("git+https://github.com/v-novaltd/LCEVCdec.git#tag=${pkgver}")
-sha256sums=('0512dc1dfb53a2d8e1c81aa75803cfc331ec289f8ee56a9cb7ec6aaa92810d0b')
+sha256sums=('31690ba04b261159f4db020299856dd48f42def0acbe907a466d82c3f954a62c')
 
 export GIT_LFS_SKIP_SMUDGE='1'