Review Results

Comment

The change only bumps pkgver from 2026.2.4 to 2026.3 and resets pkgrel from 2 to 1 in .SRCINFO. No source URLs, checksums, install scripts, build logic, permissions, or other packaging metadata are altered in the provided diff. On its face this is a routine version update with no security-relevant red flags in the reviewed hunk.

@@ -1,7 +1,7 @@
 pkgbase = pycharm
 	pkgdesc = The only Python IDE you need. Bundled with the official JetBrains Runtime (JBR)
-	pkgver = 2026.2.4
-	pkgrel = 2
+	pkgver = 2026.3
+	pkgrel = 1
 	url = https://www.jetbrains.com/pycharm/
 	arch = x86_64
 	arch = aarch64

Comment

The change only bumps the upstream JetBrains PyCharm release tarballs from 2026.2.4 to 2026.3 for x86_64 and aarch64, with corresponding checksum updates. The URLs remain HTTPS on the official JetBrains download domain, and there are no new build steps, scripts, or packaging behaviors introduced in this .SRCINFO-only diff. No obvious supply-chain or persistence risk is evident from the provided hunk.

@@ -37,9 +37,9 @@ pkgbase = pycharm
 	source = ltedit.desktop
 	sha256sums = 444611514a2e2e168d20ec866af0102fbdd0472af00925847471609578b187b7
 	sha256sums = 944d01526dcc0e6d4c321873bd42d2c7885973e929f3b363c31019f642af0101
-	source_x86_64 = https://download.jetbrains.com/python/pycharm-2026.2.4.tar.gz
-	sha256sums_x86_64 = 87d39ae1125f7298e8f8c4b96aac836043eb15053f8dc5d7c52356eaab5762a8
-	source_aarch64 = https://download.jetbrains.com/python/pycharm-2026.2.4-aarch64.tar.gz
-	sha256sums_aarch64 = 9ce06a9551e17c68a5741ee70ae4203dcc530935fa5e105df171d600e55a2bbf
+	source_x86_64 = https://download.jetbrains.com/python/pycharm-2026.3.tar.gz
+	sha256sums_x86_64 = 70d448ee1aa2a60234a6135b7ef9af6403fb691c26446113d587ccee06f6b813
+	source_aarch64 = https://download.jetbrains.com/python/pycharm-2026.3-aarch64.tar.gz
+	sha256sums_aarch64 = 113b773179905bd5413a437cda1e489cfb2794edfe9245381fd2df65fa76a213
 
 pkgname = pycharm

Comment

The change only bumps pkgver from 2026.2.4-2 to 2026.3-1 and leaves provides/replaces/conflicts unchanged. No build logic, sources, install scripts, or permissions are altered in the reviewed hunk, so there is no new security concern visible here. This is a routine version update with no evidence of added persistence, privilege escalation, or supply-chain risk in the diff provided.

@@ -5,8 +5,8 @@
 # Contributor: Juan Francisco Miranda <aurarchlinux.sleek355 at passfwd dot com>
 
 pkgname=pycharm
-pkgver=2026.2.4
-pkgrel=2
+pkgver=2026.3
+pkgrel=1
 provides=("pycharm")
 replaces=("pycharm-professional")
 conflicts=('pycharm-professional' 'pycharm-community-edition')

Comment

The change only updates the SHA-256 checksums for the upstream PyCharm archives on x86_64 and aarch64. The source URLs remain HTTPS and point to JetBrains' official download host, with no new build steps, scripts, or packaging logic introduced. I don't see any added supply-chain, persistence, or privilege-escalation risk in this diff alone; the impact is limited to accepting a newer upstream release artifact under a new verified checksum.

@@ -34,8 +34,8 @@ source_aarch64=("https://download.jetbrains.com/python/${pkgname}-${pkgver}-aarc
 
 sha256sums=('444611514a2e2e168d20ec866af0102fbdd0472af00925847471609578b187b7'
             '944d01526dcc0e6d4c321873bd42d2c7885973e929f3b363c31019f642af0101')
-sha256sums_x86_64=('87d39ae1125f7298e8f8c4b96aac836043eb15053f8dc5d7c52356eaab5762a8')
-sha256sums_aarch64=('9ce06a9551e17c68a5741ee70ae4203dcc530935fa5e105df171d600e55a2bbf')
+sha256sums_x86_64=('70d448ee1aa2a60234a6135b7ef9af6403fb691c26446113d587ccee06f6b813')
+sha256sums_aarch64=('113b773179905bd5413a437cda1e489cfb2794edfe9245381fd2df65fa76a213')
 
 makedepends=('python-setuptools' 'cython')
 optdepends=(