Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.11.3 to 26.11.4. No source URLs, checksums, build steps, dependencies, install scripts, or packaging behavior changed in the reviewed diff. Based on this hunk alone, there is no evidence of a security issue.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.11.3
+	pkgver = 26.11.4
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from 26.11.3 to 26.11.4. The source remains an HTTPS GitHub release artifact from the same upstream project, with no new build steps, scripts, patches, or packaging metadata changes that would introduce execution or integrity risks. Based on the provided diff alone, this is low risk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.3/qownnotes-26.11.3.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.4/qownnotes-26.11.4.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

This is a routine upstream version bump for qownnotes: the source URL remains HTTPS and points to the official GitHub release asset, the VCS tag is pinned to a specific commit, and the only other change is the expected checksum update for the new tarball. No new build steps, network fetches, install-script changes, or packaging red flags are introduced in the reviewed hunk.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.11.3
-tag="79132e159723581d92ce70a36ccfac364cb85897"
+pkgver=26.11.4
+tag="d29e0ffad7edacce104ee1d12be6f6de9811ed18"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change is a straightforward checksum refresh for an upstream release tarball fetched over HTTPS from the project's official GitHub releases page. No build logic, install scripts, permissions, dependencies, or additional sources were altered, and there are no signs of code execution or persistence mechanisms introduced by this diff. Risk is minimal and limited to the usual trust in the upstream release artifact already pinned by version and checksum.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('bcf25a722f7fdd8384b9450c85e5fc9708942244108b75ff57139df5ee671410')
+sha256sums=('722eeda61f94cdbfba1862a113b8a37def1d4c7efa285ae80c424d52d7f390dd')
 
 prepare() {
     cd "${pkgname}-${pkgver}"