Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 0.25.3 to 0.26.0. No source URLs, checksums, build steps, dependencies, install scripts, or packaging permissions are altered here, so there is no direct security impact visible in this diff. I did not see any evidence in the provided hunk of supply-chain risk or malicious packaging behavior.

@@ -1,6 +1,6 @@
 pkgbase = freetube
 	pkgdesc = An open source desktop YouTube player built with privacy in mind.
-	pkgver = 0.25.3
+	pkgver = 0.26.0
 	pkgrel = 3
 	url = https://freetubeapp.io
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: it updates the upstream tarball from v0.25.3-beta to v0.26.0-beta, refreshes the checksum, and raises the Electron dependency from 42 to 44. The source remains an HTTPS GitHub release archive, there are no new sources, no build-time network fetches, no install-script or unit changes, and no signs of obfuscation or privilege escalation in this diff. Based on the provided hunk alone, this does not introduce an obvious security issue.

@@ -12,11 +12,11 @@ pkgbase = freetube
 	license = AGPL-3.0-or-later
 	makedepends = pnpm
 	makedepends = nodejs>=20.0.0
-	depends = electron42
-	source = https://github.com/FreeTubeApp/FreeTube/archive/v0.25.3-beta.tar.gz
+	depends = electron44
+	source = https://github.com/FreeTubeApp/FreeTube/archive/v0.26.0-beta.tar.gz
 	source = freetube.desktop
 	source = freetube.sh
-	sha256sums = 70fdf96406ca699d1919d189efe8e8ec901c88a6721e40a4cce6770ffbc3409b
+	sha256sums = 6732e4092bebf351b77a7eb946b05a19f2d0c3856b3473db3118fe5538f06704
 	sha256sums = ada2b4b8f6a1e8896acbce4f4d311228d2c86026c273ffa00afa3247294f8b1e
 	sha256sums = 1b202a62d3ba821df518926bdea76f6a4532f6c30a5c21d44cb9b9b374e543f7
 

Comment

The change is a straightforward version bump of the upstream FreeTube release and corresponding Electron runtime, plus an updated source checksum. The source remains an HTTPS GitHub release tarball, there are no new build-time downloads, scripts, privilege changes, or packaging logic changes in this diff. No obvious supply-chain or persistence red flags are introduced by this hunk alone.

@@ -3,8 +3,8 @@
 
 pkgname=freetube
 _pkgname=FreeTube
-pkgver=0.25.3
-_electron=electron42
+pkgver=0.26.0
+_electron=electron44
 pkgrel=3
 pkgdesc='An open source desktop YouTube player built with privacy in mind.'
 arch=('x86_64' 'i686' 'arm' 'armv6h' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream FreeTube source tarball. No build logic, install scripts, permissions, or additional sources were introduced. This is a routine integrity update and does not itself add security risk. The only caveat is that the review scope is limited to the checksum line; assuming the new checksum matches the intended upstream release, this is safe.

@@ -15,7 +15,7 @@ url=https://freetubeapp.io
 source=(https://github.com/FreeTubeApp/FreeTube/archive/v$pkgver-beta.tar.gz
         freetube.desktop
         freetube.sh)
-sha256sums=('70fdf96406ca699d1919d189efe8e8ec901c88a6721e40a4cce6770ffbc3409b'
+sha256sums=('6732e4092bebf351b77a7eb946b05a19f2d0c3856b3473db3118fe5538f06704'
             'ada2b4b8f6a1e8896acbce4f4d311228d2c86026c273ffa00afa3247294f8b1e'
             '1b202a62d3ba821df518926bdea76f6a4532f6c30a5c21d44cb9b9b374e543f7')