Review Results

Comment

The change only bumps pkgver and updates the corresponding source URL and checksum in .SRCINFO. The source remains an HTTPS GitHub release tarball for the upstream Dropbox nautilus-dropbox repository, with no new build steps, scripts, or packaging behavior introduced. I did not find any security-relevant red flags in this diff alone.

@@ -1,6 +1,6 @@
 pkgbase = nautilus-dropbox
 	pkgdesc = Dropbox Nautilus Extension
-	pkgver = 2026.05.06
+	pkgver = 2026.09.28
 	pkgrel = 1
 	url = https://www.dropbox.com/
 	arch = x86_64

Comment

The change is limited to updating the upstream release tarball URL and its sha512 checksum in .SRCINFO. The source remains an HTTPS GitHub release archive from the official upstream repository, with no added build steps, scripts, or nonstandard fetches. I do not see any integrity or execution red flags in this diff alone.

@@ -14,7 +14,7 @@ pkgbase = nautilus-dropbox
 	depends = dropbox
 	options = !libtool
 	options = !emptydirs
-	source = nautilus-dropbox-2026.05.06.tar.gz::https://github.com/dropbox/nautilus-dropbox/archive/refs/tags/v2026.05.06.tar.gz
-	sha512sums = 64c9e02ddacb30ada8ac803a3f888494be91a7d56e83942fc4b0a96b9abc7a39023b689011d782fdcbb64ce481a4fc93ffd2fa1190a9731af2b1f432f25a6f3f
+	source = nautilus-dropbox-2026.09.28.tar.gz::https://github.com/dropbox/nautilus-dropbox/archive/refs/tags/v2026.09.28.tar.gz
+	sha512sums = 6063f6c650dede6a230cdf46bcf9207fecb2a6d2d7e5674b6c8e4dd16923bb7509028941562d5fb790d9102f9e93bcc6fdd29da7620d779397ed32a2b4bc6548
 
 pkgname = nautilus-dropbox

Comment

The change is a straightforward version bump in PKGBUILD: it updates pkgver and the corresponding source tarball checksum, while keeping the same official GitHub release URL over HTTPS. There are no new build steps, no added scripts, no network-fetching logic beyond the existing source array, and no packaging/persistence red flags introduced by this diff. Risk is low because the only security-relevant question is whether the new upstream tag is legitimate, and this review scope does not show any suspicious source or code changes.

@@ -10,7 +10,7 @@
 
 pkgname=nautilus-dropbox
 pkgdesc="Dropbox Nautilus Extension"
-pkgver=2026.05.06
+pkgver=2026.09.28
 pkgrel=1
 arch=(x86_64)
 url="https://www.dropbox.com/"

Comment

The change only updates the SHA-512 checksum for the upstream tarball source URL, which remains an HTTPS GitHub release/tag archive. No build logic, install scripts, or additional sources were introduced, and there are no signs of network fetches or code execution changes. Security impact is minimal and limited to integrity metadata for an existing source.

@@ -19,7 +19,7 @@ depends=(nautilus libnautilus-extension dropbox)
 makedepends=(python python-docutils python-gobject gnome-common)
 options=('!libtool' '!emptydirs')
 source=("$pkgname-$pkgver.tar.gz::https://github.com/dropbox/nautilus-dropbox/archive/refs/tags/v$pkgver.tar.gz")
-sha512sums=('64c9e02ddacb30ada8ac803a3f888494be91a7d56e83942fc4b0a96b9abc7a39023b689011d782fdcbb64ce481a4fc93ffd2fa1190a9731af2b1f432f25a6f3f')
+sha512sums=('6063f6c650dede6a230cdf46bcf9207fecb2a6d2d7e5674b6c8e4dd16923bb7509028941562d5fb790d9102f9e93bcc6fdd29da7620d779397ed32a2b4bc6548')
 
 build() {
     cd nautilus-dropbox-${pkgver}