Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 26.11.6 to 26.11.7. No sources, checksums, build steps, dependencies, install scripts, or packaging permissions changed in the reviewed hunk. Based on this diff alone, there are no security-relevant red flags.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.11.6
+	pkgver = 26.11.7
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward version bump in .SRCINFO from QOwnNotes 26.11.6 to 26.11.7, with the source URL updated accordingly. No new sources, scripts, build steps, permissions, or packaging metadata were introduced, and the source remains an HTTPS release tarball from the upstream GitHub project. Based on the provided diff alone, there are no security red flags.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.6/qownnotes-26.11.6.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.7/qownnotes-26.11.7.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a straightforward version bump in PKGBUILD: pkgver advances from 26.11.6 to 26.11.7 and the pinned upstream git tag/commit is updated accordingly. No new sources, build steps, install scripts, permissions changes, or network-fetching logic are introduced in the diff. Based on the provided hunk alone, this does not add any security risk beyond the normal trust in the upstream release being pinned.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.11.6
-tag="80f0c06b4528c4b378528e991e45ca16ff3affe5"
+pkgver=26.11.7
+tag="30cdafea0be061c3b258e90cbb09d6a65822e712"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains HTTPS and points to the official GitHub release asset for the pinned version, with no added build steps, scripts, or packaging logic changes. I did not find any new supply-chain, persistence, or privilege-escalation risk in this diff.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('f9dd6c76bdf155c793ad5957230b51d48cce110c1ab8f4f43e0854602b0145ca')
+sha256sums=('745da0355c38a15c2c6df5030e9787d3116c23f05c2808295b8354ec18bfe0d8')
 
 prepare() {
     cd "${pkgname}-${pkgver}"