Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 28.16 to 28.17. No sources, checksums, build steps, dependencies, install scripts, or packaging metadata were altered in the reviewed hunk, so there is no direct security impact visible here. Based on this diff alone, it appears safe.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.16
+	pkgver = 28.17
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The only change in this .SRCINFO hunk is a build dependency bump from jdk25-openjdk to jdk27-openjdk. This does not introduce new code execution paths, network fetches, privilege changes, or packaging/install-script behavior. It is a metadata-only dependency update, and while it may affect build compatibility or availability, it does not present an evident security issue in the reviewed diff.

@@ -16,7 +16,7 @@ pkgbase = java-openjfx
 	makedepends = glib2
 	makedepends = gperf
 	makedepends = gtk3
-	makedepends = jdk25-openjdk
+	makedepends = jdk27-openjdk
 	makedepends = libgl
 	makedepends = libx11
 	makedepends = libxtst

Comment

The change is a straightforward upstream version bump in .SRCINFO: the GitHub tarball source moves from 28+16 to 28+17 and the corresponding checksum is updated. The source remains HTTPS and pinned to a release tag, with no new build steps, scripts, or packaging behavior introduced. No security-relevant red flags are visible in this diff alone.

@@ -28,13 +28,13 @@ pkgbase = java-openjfx
 	makedepends = zip
 	makedepends = gradle
 	options = !lto
-	source = java-openjfx-28.16.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+16.tar.gz
+	source = java-openjfx-28.17.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+17.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = 28e6776449bfab4e98ef7128e85d943834beb4643218c6b57f13149f891b46fa19c86f377b5aa9d8931146e9ce2bdd5301f300093387ef61b73f9e5d6b5c0fae
+	b2sums = 50a12df750dd88527e7af344625e8d0032fca73e36f5a088509d6bdb83d9f91077bfda095aed1474f11ada292391e49c58dab5f6c10d30d1a2ccffa68bd92d30
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change is a straightforward version bump in PKGBUILD metadata: _java_build_ver 25->27, _tag 28+16->28+17, and the corresponding b2sum update. No new sources, scripts, install hooks, network fetches, privilege changes, or packaging logic changes are introduced in the reviewed hunk. Based on the diff shown, this is low risk.

@@ -19,9 +19,9 @@ pkgname=(
   java-openjfx-doc
   java-openjfx-src
 )
-_java_build_ver=25
+_java_build_ver=27
 _java_run_ver=25
-_tag='28+16'
+_tag='28+17'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change only updates the package to a newer upstream OpenJFX release and refreshes the corresponding b2sum for one source artifact. I do not see any new sources, build-time network access, script execution, privilege escalation, or packaging behavior changes in the reviewed diff. Based on the provided hunk, this appears to be a routine version/checksum bump with no obvious security impact.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('28e6776449bfab4e98ef7128e85d943834beb4643218c6b57f13149f891b46fa19c86f377b5aa9d8931146e9ce2bdd5301f300093387ef61b73f9e5d6b5c0fae'
+b2sums=('50a12df750dd88527e7af344625e8d0032fca73e36f5a088509d6bdb83d9f91077bfda095aed1474f11ada292391e49c58dab5f6c10d30d1a2ccffa68bd92d30'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'