Review Results

Comment

The change is a straightforward version bump in .SRCINFO for the official Visual Studio Code binary package. The source URLs remain HTTPS and point to the upstream Microsoft update endpoint, and the checksums were updated accordingly. No new scripts, patches, install hooks, or packaging behavior changed in this diff, so there is no evident security regression in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = visual-studio-code-bin
 	pkgdesc = Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)
-	pkgver = 1.144.1
+	pkgver = 1.145.0
 	pkgrel = 1
 	url = https://code.visualstudio.com/
 	install = visual-studio-code-bin.install

Comment

The change only bumps the pinned upstream Visual Studio Code release artifacts in .SRCINFO from 1.144.1 to 1.145.0 for all architectures, while keeping HTTPS update.code.visualstudio.com URLs and matching SHA-256 checksums. No new sources, scripts, install hooks, or packaging behavior are introduced by this diff, so there is no evident security regression in the reviewed change.

@@ -33,11 +33,11 @@ pkgbase = visual-studio-code-bin
 	options = !strip
 	source = visual-studio-code-bin.sh
 	sha256sums = bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad
-	source_x86_64 = code_1.144.1_amd64.deb::https://update.code.visualstudio.com/1.144.1/linux-deb-x64/stable
-	sha256sums_x86_64 = 6ea99a41d03b62a5c6658bab66f12210322ebe4214dfa5f0bf1a3ca97501b848
-	source_aarch64 = code_1.144.1_arm64.deb::https://update.code.visualstudio.com/1.144.1/linux-deb-arm64/stable
-	sha256sums_aarch64 = 799be313359c09cb91dd32b2b7c951497a6cb5d423a0950d074a870828ca3465
-	source_armv7h = code_1.144.1_armhf.deb::https://update.code.visualstudio.com/1.144.1/linux-deb-armhf/stable
-	sha256sums_armv7h = b9370f4963b9b653aa4906d3ec4d3f1c044531dba2210632b89929266a7bda9d
+	source_x86_64 = code_1.145.0_amd64.deb::https://update.code.visualstudio.com/1.145.0/linux-deb-x64/stable
+	sha256sums_x86_64 = 64cb445811a347df1b5118a17117cfd5ac0ab7e2cc41832351b938364d17cacd
+	source_aarch64 = code_1.145.0_arm64.deb::https://update.code.visualstudio.com/1.145.0/linux-deb-arm64/stable
+	sha256sums_aarch64 = da4c873ae450a5da60c55e409a15672c01baacfe5d36e2d4b56b06ea0db14c41
+	source_armv7h = code_1.145.0_armhf.deb::https://update.code.visualstudio.com/1.145.0/linux-deb-armhf/stable
+	sha256sums_armv7h = e1ac7767c1941eb551cf838aef2eaccd6715410bc3516873cf38a11a8974cd71
 
 pkgname = visual-studio-code-bin

Comment

The change is a routine version bump for an official binary package. The source URLs remain HTTPS and point to the upstream Visual Studio Code download endpoint, and the only other changes are updated SHA-256 checksums for the new release artifacts. No new build logic, scripts, network behavior, privilege escalation, or packaging scope changes were introduced in this diff.

@@ -2,7 +2,7 @@
 
 pkgname=visual-studio-code-bin
 _pkgname=visual-studio-code
-pkgver=1.144.1
+pkgver=1.145.0
 pkgrel=1
 pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)"
 arch=('x86_64' 'aarch64' 'armv7h')

Comment

The change only updates the per-architecture SHA-256 checksums for the upstream .deb payloads in source arrays. The download URLs remain HTTPS and unchanged, and there is no added build logic, script execution, privilege escalation, or packaging behavior change. This is a routine integrity-pin update, not a security concern by itself.

@@ -30,9 +30,9 @@ source_x86_64=(code_${pkgver}_amd64.deb::https://update.code.visualstudio.com/${
 source_aarch64=(code_${pkgver}_arm64.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-arm64/stable)
 source_armv7h=(code_${pkgver}_armhf.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-armhf/stable)
 sha256sums=('bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad')
-sha256sums_x86_64=('6ea99a41d03b62a5c6658bab66f12210322ebe4214dfa5f0bf1a3ca97501b848')
-sha256sums_aarch64=('799be313359c09cb91dd32b2b7c951497a6cb5d423a0950d074a870828ca3465')
-sha256sums_armv7h=('b9370f4963b9b653aa4906d3ec4d3f1c044531dba2210632b89929266a7bda9d')
+sha256sums_x86_64=('64cb445811a347df1b5118a17117cfd5ac0ab7e2cc41832351b938364d17cacd')
+sha256sums_aarch64=('da4c873ae450a5da60c55e409a15672c01baacfe5d36e2d4b56b06ea0db14c41')
+sha256sums_armv7h=('e1ac7767c1941eb551cf838aef2eaccd6715410bc3516873cf38a11a8974cd71')
 
 package() {
   bsdtar -xf data.tar.xz -C "${pkgdir}/"