Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.6.8 to 1.6.9. No source URLs, checksums, build commands, install scripts, permissions, or package metadata affecting trust were changed in the reviewed diff. Based on this hunk alone, there is no security-relevant issue to flag.

@@ -1,6 +1,6 @@
 pkgbase = vesktop-bin
 	pkgdesc = A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed.
-	pkgver = 1.6.8
+	pkgver = 1.6.9
 	pkgrel = 1
 	url = https://vesktop.dev/
 	arch = aarch64

Comment

The change is a routine version bump in .SRCINFO for an AUR binary package: it updates provides/noextract/source URLs and checksums from Vesktop v1.6.8 to v1.6.9. The sources remain HTTPS and point to the official upstream GitHub release/tag, with pinned release artifacts and matching checksums. No new build steps, scripts, or privilege-related metadata were introduced in this diff. Based on the provided hunk alone, I see no security red flags.

@@ -12,21 +12,21 @@ pkgbase = vesktop-bin
 	optdepends = speech-dispatcher: High-level device independent layer for speech synthesis interface
 	optdepends = libnotify: Notifications
 	optdepends = xdg-utils: Open links, files, etc
-	provides = vesktop=1.6.8
-	provides = vencord-desktop=1.6.8
+	provides = vesktop=1.6.9
+	provides = vencord-desktop=1.6.9
 	conflicts = vesktop
 	conflicts = vencord-desktop
-	noextract = vesktop-1.6.8.tar.gz
-	noextract = vesktop-1.6.8-arm64.tar.gz
+	noextract = vesktop-1.6.9.tar.gz
+	noextract = vesktop-1.6.9-arm64.tar.gz
 	source = vesktop.sh
 	source = vesktop.desktop
-	source = https://github.com/Vencord/Vesktop/raw/refs/tags/v1.6.8/build/icon.svg
+	source = https://github.com/Vencord/Vesktop/raw/refs/tags/v1.6.9/build/icon.svg
 	sha256sums = db901fa9af0ce812f48ecba9c338162bd5b12f6586fefca2bc6b6509430ea351
 	sha256sums = 455c00b862aa0a7e18ca8e23d65d5c5ee4506cdfb15f1bf6f622cce39827de46
 	sha256sums = 7d0f9dbdb3c86f800577d7fb26a22defeb7025d10c405f634d3c2b939a75be7f
-	source_aarch64 = https://github.com/Vencord/Vesktop/releases/download/v1.6.8/vesktop-1.6.8-arm64.tar.gz
-	sha256sums_aarch64 = 2aecdb99058ea7c2e8295feda80f72e199416bf29a27adae0f9ac4855ad737ad
-	source_x86_64 = https://github.com/Vencord/Vesktop/releases/download/v1.6.8/vesktop-1.6.8.tar.gz
-	sha256sums_x86_64 = 477dc07e9da85cf3f86b890f00cebe328d82ef62a40790bb515f18de38845a46
+	source_aarch64 = https://github.com/Vencord/Vesktop/releases/download/v1.6.9/vesktop-1.6.9-arm64.tar.gz
+	sha256sums_aarch64 = f099fab284a7319ad42c6ae28dc7a8e503db0570ccfcaefebd615dd7700a2f93
+	source_x86_64 = https://github.com/Vencord/Vesktop/releases/download/v1.6.9/vesktop-1.6.9.tar.gz
+	sha256sums_x86_64 = c9eabe5e0a6dc1ee3f48a32f9b876ecbf938738fef1a76bc2350eb82f3bc8517
 
 pkgname = vesktop-bin

Comment

The change only bumps pkgver from 1.6.8 to 1.6.9 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or packaging logic were modified in the reviewed hunk, so there is no new security-relevant behavior to flag from this diff alone.

@@ -6,7 +6,7 @@
 pkgname=vesktop-bin
 _pkgname=vesktop
 _appname=vencord-desktop
-pkgver=1.6.8
+pkgver=1.6.9
 pkgrel=1
 pkgdesc="A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed."
 arch=(

Comment

The change only bumps vesktop-bin from 1.6.8 to 1.6.9 and updates the SHA-256 checksums for the architecture-specific upstream tarballs. No new sources, scripts, build steps, or packaging logic were introduced, and the package still appears to rely on pinned release artifacts with integrity verification. I did not find any security-relevant red flags in this diff hunk.

@@ -42,8 +42,8 @@ noextract=("${_pkgname}-${pkgver}.tar.gz" "${_pkgname}-${pkgver}-arm64.tar.gz")
 sha256sums=('db901fa9af0ce812f48ecba9c338162bd5b12f6586fefca2bc6b6509430ea351'
             '455c00b862aa0a7e18ca8e23d65d5c5ee4506cdfb15f1bf6f622cce39827de46'
             '7d0f9dbdb3c86f800577d7fb26a22defeb7025d10c405f634d3c2b939a75be7f')
-sha256sums_aarch64=('2aecdb99058ea7c2e8295feda80f72e199416bf29a27adae0f9ac4855ad737ad')
-sha256sums_x86_64=('477dc07e9da85cf3f86b890f00cebe328d82ef62a40790bb515f18de38845a46')
+sha256sums_aarch64=('f099fab284a7319ad42c6ae28dc7a8e503db0570ccfcaefebd615dd7700a2f93')
+sha256sums_x86_64=('c9eabe5e0a6dc1ee3f48a32f9b876ecbf938738fef1a76bc2350eb82f3bc8517')
 
 prepare() {
     sed -i -e "