Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 13.3.0 to 13.4.0. No source URLs, checksums, install scripts, build commands, permissions, or dependency metadata are changed here, so there is no direct security impact visible in this diff. Based on the provided hunk alone, this looks like a routine package update.

@@ -1,6 +1,6 @@
 pkgbase = insomnia-bin
 	pkgdesc = API Client and Design Platform for GraphQL and REST
-	pkgver = 13.3.0
+	pkgver = 13.4.0
 	pkgrel = 1
 	epoch = 1
 	url = https://insomnia.rest

Comment

The change only bumps the upstream Insomnia binary package from 13.3.0 to 13.4.0 and updates the corresponding LICENSE URL and checksums in .SRCINFO. The sources remain HTTPS GitHub release artifacts, pinned to a specific release tag, with no new build-time code execution, no added external fetches, and no packaging/script changes visible in this diff. Based on the provided hunk alone, this is a routine version update with low security risk.

@@ -14,9 +14,9 @@ pkgbase = insomnia-bin
 	optdepends = xdg-utils: open URLs with desktop's default (xdg-email, xdg-open)
 	provides = insomnia
 	conflicts = insomnia
-	source = https://github.com/Kong/insomnia/releases/download/core@13.3.0/Insomnia.Core-13.3.0.deb
-	source = https://github.com/Kong/insomnia/raw/core@13.3.0/LICENSE
-	sha256sums = 96776cea5dffcb6c81557c157d0e788197248ab3f1d2932c611f502411f06d8f
+	source = https://github.com/Kong/insomnia/releases/download/core@13.4.0/Insomnia.Core-13.4.0.deb
+	source = https://github.com/Kong/insomnia/raw/core@13.4.0/LICENSE
+	sha256sums = b566d3d6b5a59d4baf0e705f156889f5bcbcfc9822930dcb5b5a180b8e5e9d4d
 	sha256sums = 4197d1eeea274289901dc8b68e16f538ceb535ce1ff592f6895c0a7439908ca2
 
 pkgname = insomnia-bin

Comment

This is a routine version bump in a binary package: pkgver updated from 13.3.0 to 13.4.0 and the corresponding source checksum changed. The source remains the upstream HTTPS release asset and license file, with no new build logic, no added scripts, no privilege changes, and no suspicious metadata changes in the reviewed hunk. Based on this diff alone, I see no security issue.

@@ -4,7 +4,7 @@
 _pkgname='insomnia'
 _upkgname='Insomnia'
 pkgname="${_pkgname}-bin"
-pkgver=13.3.0
+pkgver=13.4.0
 pkgrel=1
 epoch=1
 pkgdesc='API Client and Design Platform for GraphQL and REST'

Comment

The change is a routine version bump in PKGBUILD from 13.3.0 to 13.4.0 with an updated SHA256 for the upstream .deb. The source URLs remain HTTPS and point to the upstream project release assets, with no new build-time network access, scripts, patches, or packaging logic changes. I do not see any added persistence, privilege escalation, or integrity red flags in this diff alone.

@@ -21,7 +21,7 @@ conflicts=("${_pkgname}")
 source=("${_url_source}/releases/download/core@${pkgver}/${_upkgname}.Core-${pkgver}.deb"
         "${_url_source}/raw/core@${pkgver}/LICENSE")
 
-sha256sums=('96776cea5dffcb6c81557c157d0e788197248ab3f1d2932c611f502411f06d8f'
+sha256sums=('b566d3d6b5a59d4baf0e705f156889f5bcbcfc9822930dcb5b5a180b8e5e9d4d'
             '4197d1eeea274289901dc8b68e16f538ceb535ce1ff592f6895c0a7439908ca2')
 
 package() {