Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.11.2 to 26.11.3. No source URLs, checksums, build logic, install scripts, or packaging metadata affecting execution/persistence were modified in the reviewed diff. Based on this hunk alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.11.2
+	pkgver = 26.11.3
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO from qownnotes 26.11.2 to 26.11.3, with the source URL updated accordingly. No new sources, scripts, build steps, permissions, or packaging metadata were introduced, and the download remains on GitHub over HTTPS. Based on the provided diff alone, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.2/qownnotes-26.11.2.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.3/qownnotes-26.11.3.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine upstream version bump in PKGBUILD: pkgver/tag and the corresponding release tarball checksum were updated. The source remains an HTTPS GitHub release URL, and there are no new build-time network fetches, scripts, privilege changes, or packaging behavior changes in the diff. No security red flags are introduced by this hunk alone.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.11.2
-tag="b0f511114705bd62206afa58365d4e02381b801e"
+pkgver=26.11.3
+tag="79132e159723581d92ce70a36ccfac364cb85897"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains the official GitHub release over HTTPS, with no added build steps, scripts, patches, or packaging logic changes. I did not see any new integrity, execution, or persistence risks introduced by this diff alone. The main effect is to accept a different upstream tarball for the same version, which is normal when upstream re-rolls a release or the package was previously out of date, but by itself it does not indicate malicious behavior in the PKGBUILD change.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('b2673e25378ad01b685eee9b89221eb47eae7eb53cbec862220e8a823deb86ec')
+sha256sums=('bcf25a722f7fdd8384b9450c85e5fc9708942244108b75ff57139df5ee671410')
 
 prepare() {
     cd "${pkgname}-${pkgver}"