Review Results

Comment

The change only bumps pkgver in .SRCINFO from 2026.2.4 to 2026.3. No build logic, sources, checksums, install scripts, or package metadata beyond the version number are altered in the provided diff. On its face this is a routine version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = intellij-idea-ultimate-edition
 	pkgdesc = An intelligent IDE for Java, Groovy and other programming languages with advanced refactoring features intensely focused on developer productivity.
-	pkgver = 2026.2.4
+	pkgver = 2026.3
 	pkgrel = 1
 	url = https://www.jetbrains.com/idea/
 	arch = x86_64

Comment

The change only bumps the upstream IntelliJ IDEA Ultimate release from 2026.2.4 to 2026.3 and updates the corresponding checksums/filenames in .SRCINFO. The sources remain HTTPS and point to JetBrains-hosted artifacts, with no new build-time commands, scripts, or additional untrusted URLs introduced by this diff. I don’t see any supply-chain red flags in the metadata change itself.

@@ -11,12 +11,12 @@ pkgbase = intellij-idea-ultimate-edition
 	options = !strip
 	source = jetbrains-idea.desktop
 	sha256sums = 83af2ba8f9f14275a6684e79d6d4bd9b48cd852c047dacfc81324588fa2ff92b
-	source_x86_64 = https://download.jetbrains.com/idea/ideaIU-2026.2.4.tar.gz
-	sha256sums_x86_64 = cc6b29ddb82c7dcc656d5c728cefb2c917ac767eb4b8368f1208732846fbb5bd
-	source_aarch64 = https://download.jetbrains.com/idea/ideaIU-2026.2.4-aarch64.tar.gz
+	source_x86_64 = https://download.jetbrains.com/idea/ideaIU-2026.3.tar.gz
+	sha256sums_x86_64 = 6a53ff71f4a06add4c97edc4efe86c83119ff82e5b5e9f1db62fc95995bd6b25
+	source_aarch64 = https://download.jetbrains.com/idea/ideaIU-2026.3-aarch64.tar.gz
 	source_aarch64 = https://cache-redirector.jetbrains.com/intellij-jbr/jbr-25.0.3-linux-aarch64-b508.16.tar.gz
-	source_aarch64 = fsnotifier-2026.2.4::https://github.com/JetBrains/intellij-community/raw/master/bin/linux/aarch64/fsnotifier
-	sha256sums_aarch64 = 158b97dfbc3a88075fa14fcf5f9f2c17b339f4527e4245b3a33caf18050c2ae2
+	source_aarch64 = fsnotifier-2026.3::https://github.com/JetBrains/intellij-community/raw/master/bin/linux/aarch64/fsnotifier
+	sha256sums_aarch64 = 19c8ff6e144185ae4961080984a65b11c492f2820e975007b4276fe0deeffe52
 	sha256sums_aarch64 = 8704ffff0723bbe00992a02e455cda6a76697b40f9a5b833fc853e3c3b05dd14
 	sha256sums_aarch64 = aa812c5acac06435217b9018aa3e187a3546ea8d3cf136481a2d50aee4b9b23a
 

Comment

The change is a routine version bump in PKGBUILD from 2026.2.4 to 2026.3 with corresponding checksum updates for the upstream JetBrains tarballs. The source URLs remain HTTPS and point to JetBrains/GitHub, there are no new build-time downloads, scripts, privilege changes, or packaging logic changes in the diff. I do note that one source still references GitHub raw/master for fsnotifier, but that is pre-existing and unchanged in this commit. No security issue is introduced by this diff.

@@ -3,7 +3,7 @@
 
 
 pkgname=intellij-idea-ultimate-edition
-pkgver=2026.2.4
+pkgver=2026.3
 pkgrel=1
 jbr_ver=25.0.3
 jbr_build=aarch64-b508

Comment

The change only updates SHA-256 checksums for existing upstream sources in PKGBUILD. I did not see any new sources, build-time network fetches, privilege changes, install-script logic, or packaging behavior changes in the provided diff hunk. This is a routine integrity-pin update and does not introduce an obvious security concern by itself.

@@ -21,8 +21,8 @@ source_aarch64=("https://download.jetbrains.com/idea/ideaIU-$pkgver-aarch64.tar.
                 "https://cache-redirector.jetbrains.com/intellij-jbr/jbr-$jbr_ver-linux-$jbr_build.$jbr_minor.tar.gz"
                  "fsnotifier-${pkgver}::https://github.com/JetBrains/intellij-community/raw/master/bin/linux/aarch64/fsnotifier")
 sha256sums=('83af2ba8f9f14275a6684e79d6d4bd9b48cd852c047dacfc81324588fa2ff92b')
-sha256sums_x86_64=('cc6b29ddb82c7dcc656d5c728cefb2c917ac767eb4b8368f1208732846fbb5bd')
-sha256sums_aarch64=('158b97dfbc3a88075fa14fcf5f9f2c17b339f4527e4245b3a33caf18050c2ae2'
+sha256sums_x86_64=('6a53ff71f4a06add4c97edc4efe86c83119ff82e5b5e9f1db62fc95995bd6b25')
+sha256sums_aarch64=('19c8ff6e144185ae4961080984a65b11c492f2820e975007b4276fe0deeffe52'
                     '8704ffff0723bbe00992a02e455cda6a76697b40f9a5b833fc853e3c3b05dd14'
                     'aa812c5acac06435217b9018aa3e187a3546ea8d3cf136481a2d50aee4b9b23a')