Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 3.13 to 3.14 for pandoc-bin. No source URLs, checksums, build steps, install scripts, permissions, or dependency metadata are altered in the reviewed diff. On its face this is a routine package update with no security-relevant indicators in the provided change.

@@ -1,6 +1,6 @@
 pkgbase = pandoc-bin
 	pkgdesc = Conversion between documentation formats
-	pkgver = 3.13
+	pkgver = 3.14
 	pkgrel = 1
 	url = https://pandoc.org
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from pandoc 3.13 to 3.14, updating the declared provides, source tarball URL, and checksums. The sources remain HTTPS GitHub release/archive URLs, there are no new build-time commands, no added scripts, and no suspicious metadata changes such as new conflicts/provides beyond the expected versioned package name. Based on the provided diff alone, this does not introduce an obvious security issue.

@@ -15,16 +15,16 @@ pkgbase = pandoc-bin
 	optdepends = texlive-fontsrecommended: for pdf output using latex or xelatex engines
 	optdepends = texlive-latex: for pdf output using pdflatex engine
 	optdepends = texlive-xetex: for pdf output using xelatex engine
-	provides = pandoc=3.13
-	provides = pandoc-cli=3.13
+	provides = pandoc=3.14
+	provides = pandoc-cli=3.14
 	conflicts = pandoc-cli
 	options = !debug
 	options = !strip
-	source = pandoc-bin-3.13.tar.gz::https://github.com/jgm/pandoc/archive/3.13.tar.gz
-	sha256sums = fbf6044766b0c9be5ccbf18ffe657124449e8563a177d85662ecb6f031f9c308
-	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.13/pandoc-3.13-linux-amd64.tar.gz
-	sha256sums_x86_64 = 38aa33b325a2bc96a4c39409631212db55702f564250bcdbead180b3bf646389
-	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.13/pandoc-3.13-linux-arm64.tar.gz
-	sha256sums_aarch64 = 21e1d4ba09bd0b334590d204580fd4f6629b21be4ab6a32b26cc98982e9e0c68
+	source = pandoc-bin-3.14.tar.gz::https://github.com/jgm/pandoc/archive/3.14.tar.gz
+	sha256sums = e4c4292642531b94793c2f5dea38f3b8d5424b2d048818a4d047f8b8320b999a
+	source_x86_64 = https://github.com/jgm/pandoc/releases/download/3.14/pandoc-3.14-linux-amd64.tar.gz
+	sha256sums_x86_64 = c5f4720cdefb3f7bdc5d07202ef579feef0d1370773c873804dd8fdaa8c4f1b8
+	source_aarch64 = https://github.com/jgm/pandoc/releases/download/3.14/pandoc-3.14-linux-arm64.tar.gz
+	sha256sums_aarch64 = c692f3d78a415741bbbac4cdbbbe26fa7edca1f43d2301b982fbf4009cc8cf7f
 
 pkgname = pandoc-bin

Comment

The change only bumps pkgver from 3.13 to 3.14 in PKGBUILD. No source URLs, build logic, install scripts, permissions, or packaging behavior changed in the provided diff hunk. Based on this diff alone, there are no new security concerns introduced.

@@ -1,5 +1,5 @@
 pkgname=pandoc-bin
-pkgver=3.13
+pkgver=3.14
 pkgrel=1
 pkgdesc="Conversion between documentation formats"
 url="https://pandoc.org"

Comment

The change only updates SHA-256 checksums for the upstream source tarball and the prebuilt architecture-specific release archives. The source URLs remain HTTPS and point to the official pandoc GitHub release/archive locations, with no new build steps, scripts, or packaging logic introduced. I do not see any integrity or execution red flags in this diff alone.

@@ -25,9 +25,9 @@ source=("$pkgname-$pkgver.tar.gz::https://github.com/jgm/pandoc/archive/${pkgver
 source_x86_64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-amd64.tar.gz")
 source_aarch64=("https://github.com/jgm/pandoc/releases/download/${pkgver}/pandoc-${pkgver}-linux-arm64.tar.gz")
 
-sha256sums=('fbf6044766b0c9be5ccbf18ffe657124449e8563a177d85662ecb6f031f9c308')
-sha256sums_x86_64=('38aa33b325a2bc96a4c39409631212db55702f564250bcdbead180b3bf646389')
-sha256sums_aarch64=('21e1d4ba09bd0b334590d204580fd4f6629b21be4ab6a32b26cc98982e9e0c68')
+sha256sums=('e4c4292642531b94793c2f5dea38f3b8d5424b2d048818a4d047f8b8320b999a')
+sha256sums_x86_64=('c5f4720cdefb3f7bdc5d07202ef579feef0d1370773c873804dd8fdaa8c4f1b8')
+sha256sums_aarch64=('c692f3d78a415741bbbac4cdbbbe26fa7edca1f43d2301b982fbf4009cc8cf7f')
 
 package() {
   cd "${srcdir}/pandoc-${pkgver}"