Review Results

Comment

The change is a straightforward version bump in .SRCINFO for a binary release package, updating the release URLs and checksums from 2.14.0 to 2.14.1. I do not see any new sources, build-time execution, privilege escalation, or packaging-policy red flags in this diff. Risk is low because the only change is metadata pointing to a newer upstream release, and the URLs remain on the official GitHub release domain over HTTPS.

@@ -1,6 +1,6 @@
 pkgbase = mongosh-bin
 	pkgdesc = An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.
-	pkgver = 2.14.0
+	pkgver = 2.14.1
 	pkgrel = 1
 	url = https://github.com/mongodb-js/mongosh.git
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt mongosh binary package, updating the GitHub release URLs from 2.14.0 to 2.14.1 and refreshing the corresponding SHA-256 checksums. The sources remain HTTPS and point to the official upstream release artifacts; there are no new build steps, scripts, or packaging behaviors introduced by this diff. No security red flags are evident in the provided hunk.

@@ -9,9 +9,9 @@ pkgbase = mongosh-bin
 	depends = krb5
 	provides = mongosh
 	conflicts = mongosh
-	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.14.0/mongosh-2.14.0-linux-x64.tgz
-	sha256sums_x86_64 = c1c5f1a9709e91c5eb1c6861a99c305c165fa564afb465fabfd2b2334c08a23c
-	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.14.0/mongosh-2.14.0-linux-arm64.tgz
-	sha256sums_aarch64 = 3c6a3631667f9caf0a7b5dfe87e433f973f0a82f2cf04130cd52115076e945e4
+	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.14.1/mongosh-2.14.1-linux-x64.tgz
+	sha256sums_x86_64 = 8d24940ebe3675959b518fd41ea16b4e2182d6a75c09777db09cfa64e18834a1
+	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.14.1/mongosh-2.14.1-linux-arm64.tgz
+	sha256sums_aarch64 = cd7f1ae986baa400b021a2c0688aa3b64d6afcc3f7ab07833417a049e0cbf98b
 
 pkgname = mongosh-bin

Comment

The change is a straightforward version bump from 2.14.0 to 2.14.1 with updated SHA-256 checksums for the official GitHub release tarballs. The source URLs remain HTTPS and point to the upstream project release assets, with no new build-time network access, scripts, patches, or packaging logic changes. No additional security concerns are introduced by this diff alone.

@@ -3,7 +3,7 @@
 
 pkgname=mongosh-bin
 _pkgname=mongosh
-pkgver=2.14.0
+pkgver=2.14.1
 pkgrel=1
 pkgdesc='An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.'
 arch=('x86_64' 'aarch64')

Comment

The change only updates pkgver from 2.14.0 to 2.14.1 and refreshes the SHA-256 checksums for the official GitHub release tarballs. The source URLs remain HTTPS and point to the upstream mongodb-js/mongosh release assets, with no new build-time network access, scripts, or packaging logic changes. No security red flags are introduced by this diff alone.

@@ -17,8 +17,8 @@ _mongosh_folder=mongosh-${pkgver}-linux
 source_x86_64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-x64.tgz")
 source_aarch64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64.tgz")
 
-sha256sums_x86_64=('c1c5f1a9709e91c5eb1c6861a99c305c165fa564afb465fabfd2b2334c08a23c')
-sha256sums_aarch64=('3c6a3631667f9caf0a7b5dfe87e433f973f0a82f2cf04130cd52115076e945e4')
+sha256sums_x86_64=('8d24940ebe3675959b518fd41ea16b4e2182d6a75c09777db09cfa64e18834a1')
+sha256sums_aarch64=('cd7f1ae986baa400b021a2c0688aa3b64d6afcc3f7ab07833417a049e0cbf98b')
 
 package() {
 	if [ $CARCH = 'x86_64' ]; then