Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2026.2.4 to 2026.3. No build logic, sources, checksums, install scripts, or packaging behavior changed in the reviewed diff. While the URL field still uses HTTP in the existing metadata, that is pre-existing and not introduced by this change. Based on the provided hunk alone, I see no new security risk.

@@ -1,6 +1,6 @@
 pkgbase = clion
 	pkgdesc = Cross-platform IDE for C and C++ from JetBrains.
-	pkgver = 2026.2.4
+	pkgver = 2026.3
 	pkgrel = 1
 	epoch = 1
 	url = http://www.jetbrains.com/clion

Comment

The change only bumps the CLion upstream release URLs and corresponding checksums in .SRCINFO. The sources remain on the official JetBrains HTTPS download domain, there are no new build-time commands, no added scripts, and no integrity red flags beyond the expected checksum updates for a version bump. No evidence of malicious behavior in this diff.

@@ -8,15 +8,15 @@ pkgbase = clion
 	arch = aarch64
 	license = custom
 	makedepends = rsync
-	noextract = CLion-2026.2.4.tar.gz
-	noextract = CLion-2026.2.4-aarch64.tar.gz
+	noextract = CLion-2026.3.tar.gz
+	noextract = CLion-2026.3-aarch64.tar.gz
 	options = !strip
 	source = jetbrains-clion.desktop
 	sha256sums = a7a3f9891f5d8e7e5650afe00819909413fa2ed911393dd0648fba91233974a2
-	source_x86_64 = https://download.jetbrains.com/cpp/CLion-2026.2.4.tar.gz
-	sha256sums_x86_64 = c1d1422450146fb749f18c201af272ef349dcba79a819cf4f72710e2324f0941
-	source_aarch64 = https://download.jetbrains.com/cpp/CLion-2026.2.4-aarch64.tar.gz
-	sha256sums_aarch64 = be7f7da3776838a346e86b1256610642dbea6b7a7fcb3d590a4fddeb46adc24b
+	source_x86_64 = https://download.jetbrains.com/cpp/CLion-2026.3.tar.gz
+	sha256sums_x86_64 = 136b6c22c984cc31734480ce4acf12f6af5b4838653af216601032f21cd35382
+	source_aarch64 = https://download.jetbrains.com/cpp/CLion-2026.3-aarch64.tar.gz
+	sha256sums_aarch64 = 680f05467148412fc80747311b535a0f4d11223e8550e0225fb8fb6973e947c4
 
 pkgname = clion
 	depends = libdbusmenu-glib

Comment

The change only bumps CLion to a new upstream release and updates the corresponding SHA256 checksums for the official JetBrains download URLs. The source remains HTTPS and pinned to a specific versioned tarball, with no new scripts, patches, build steps, or packaging logic introduced. No security red flags are evident in this diff alone.

@@ -9,7 +9,7 @@ pkgbase=clion
 pkgname=(clion clion-jre clion-cmake clion-gdb clion-lldb)
 _pkgname=clion
 _dlname=CLion
-pkgver=2026.2.4
+pkgver=2026.3
 pkgrel=1
 epoch=1
 pkgdesc="Cross-platform IDE for C and C++ from JetBrains."

Comment

The change only updates the package version and the corresponding SHA-256 checksums for the JetBrains release tarballs. The sources remain HTTPS from the official JetBrains download host, there are no new build-time commands, no added scripts, and no packaging/persistence changes. This looks like a routine upstream version bump with integrity hashes refreshed, so I do not see a security issue in the diff provided.

@@ -22,8 +22,8 @@ source=("jetbrains-${pkgbase}.desktop")
 source_x86_64=("https://download.jetbrains.com/cpp/${_dlname}-${pkgver}.tar.gz")
 source_aarch64=("https://download.jetbrains.com/cpp/${_dlname}-${pkgver}-aarch64.tar.gz")
 sha256sums=('a7a3f9891f5d8e7e5650afe00819909413fa2ed911393dd0648fba91233974a2')
-sha256sums_x86_64=('c1d1422450146fb749f18c201af272ef349dcba79a819cf4f72710e2324f0941')
-sha256sums_aarch64=('be7f7da3776838a346e86b1256610642dbea6b7a7fcb3d590a4fddeb46adc24b')
+sha256sums_x86_64=('136b6c22c984cc31734480ce4acf12f6af5b4838653af216601032f21cd35382')
+sha256sums_aarch64=('680f05467148412fc80747311b535a0f4d11223e8550e0225fb8fb6973e947c4')
 noextract=("${_dlname}-${pkgver}.tar.gz"
            "${_dlname}-${pkgver}-aarch64.tar.gz")