Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.11.5 to 26.11.6. No source URLs, checksums, build steps, dependencies, install scripts, or packaging behavior changed in the reviewed diff. Based on this hunk alone, there is no security-relevant modification to assess.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.11.5
+	pkgver = 26.11.6
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The only change in this .SRCINFO hunk is a versioned upstream release tarball bump from QOwnNotes 26.11.5 to 26.11.6 over HTTPS on the official GitHub releases page. There are no new sources, no build-script changes, no added install hooks, and no integrity red flags visible in this diff. Based on the provided hunk alone, this is a routine upstream version update with no apparent security impact.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.5/qownnotes-26.11.5.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.6/qownnotes-26.11.6.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

Low risk. The change only bumps qownnotes from 26.11.5 to 26.11.6 and updates the pinned upstream release tag and tarball checksum accordingly. The source remains an HTTPS GitHub release URL, there are no new build-time downloads, scripts, privilege changes, or packaging logic changes in the diff. No security-relevant red flags are introduced by this version bump alone.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.11.5
-tag="faa138e32eb1be930fe6dc684833d7f3fa3989e4"
+pkgver=26.11.6
+tag="80f0c06b4528c4b378528e991e45ca16ff3affe5"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in source integrity metadata. The source URL remains the official GitHub release over HTTPS, and there are no new build steps, scripts, patches, or packaging logic changes. On its face this is a routine checksum refresh for a new upstream tarball and does not introduce an obvious security concern in the PKGBUILD diff itself.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('3b73119356d47d07111928c1f418d1ec676d41d134d71f78f57916463705367a')
+sha256sums=('f9dd6c76bdf155c793ad5957230b51d48cce110c1ab8f4f43e0854602b0145ca')
 
 prepare() {
     cd "${pkgname}-${pkgver}"