Review Results

Comment

The change is a simple version bump in .SRCINFO from 26.11.4 to 26.11.5 with no accompanying changes to sources, build logic, install scripts, or package metadata. On its face this does not introduce any new attack surface or integrity concern. I did not observe any suspicious URLs, build-time downloads, privilege changes, or packaging policy red flags in the provided diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.11.4
+	pkgver = 26.11.5
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the release tarball URL from v26.11.4 to v26.11.5. The source remains an HTTPS GitHub release artifact from the same upstream project, with no new build steps, scripts, patches, or packaging metadata changes that would introduce execution or persistence risks. Based on the provided diff alone, this is low risk.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.4/qownnotes-26.11.4.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.5/qownnotes-26.11.5.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a straightforward version bump in PKGBUILD: pkgver advances from 26.11.4 to 26.11.5 and the pinned upstream git tag/commit is updated accordingly. No new sources, build steps, install scripts, permissions changes, or packaging logic were introduced in the provided diff. Based on this hunk alone, there are no security red flags.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.11.4
-tag="d29e0ffad7edacce104ee1d12be6f6de9811ed18"
+pkgver=26.11.5
+tag="faa138e32eb1be930fe6dc684833d7f3fa3989e4"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in source=(). The source URL remains HTTPS and points to the official GitHub release asset for the same version, with no new build steps, scripts, or packaging logic introduced. I don't see any added network fetches, privilege changes, or other supply-chain red flags in this diff hunk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('722eeda61f94cdbfba1862a113b8a37def1d4c7efa285ae80c424d52d7f390dd')
+sha256sums=('3b73119356d47d07111928c1f418d1ec676d41d134d71f78f57916463705367a')
 
 prepare() {
     cd "${pkgname}-${pkgver}"