Review Results

Comment

The change is a simple version bump in .SRCINFO from 2.46.4 to 2.46.5 with no accompanying changes to sources, build logic, install scripts, or metadata beyond pkgver. On its face this does not introduce any new attack surface or integrity concern in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = spicetify-cli
 	pkgdesc = Command-line tool to customize Spotify client
-	pkgver = 2.46.4
+	pkgver = 2.46.5
 	pkgrel = 1
 	url = https://github.com/spicetify/cli
 	arch = x86_64

Comment

The only change is an updated SHA-256 checksum for the existing upstream tarball source URL. The source remains the official GitHub release archive over HTTPS, with no new sources, build steps, scripts, or packaging behavior changes. This is a routine integrity metadata update and does not introduce a security concern by itself.

@@ -12,6 +12,6 @@ pkgbase = spicetify-cli
         depends = glibc
 	optdepends = xdg-utils: Allows for opening directories in default file manager
 	source = spicetify-cli-2.43.2.tar.gz::https://github.com/spicetify/cli/archive/v2.43.2
-	sha256sums = d62b1e2316fa79a34b9283d5846b78b50f88f01b5de40052da94def8c2f97421
+	sha256sums = 9f9a1b37ff3423b30215b5e195ab401fe24a390dfc9d4aee13ca5082c9c604d0
 
 pkgname = spicetify-cli

Comment

The change is a simple version bump in PKGBUILD from 2.46.4 to 2.46.5 with no other modifications shown. There are no new sources, build steps, install scripts, permissions changes, or packaging logic introduced in this diff hunk, so no security issue is evident from the reviewed change alone.

@@ -1,6 +1,6 @@
 ## Maintainer: khanhas <xuankhanh963@gmail.com>, itsmeow <itsmeow@itsmeow.dev>
 pkgname=spicetify-cli
-pkgver=2.46.4
+pkgver=2.46.5
 pkgrel=1
 pkgdesc='Command-line tool to customize Spotify client'
 arch=('x86_64' 'i686')

Comment

The change only updates the pinned SHA-256 checksum for the upstream release tarball in PKGBUILD. The source URL remains HTTPS and points to the upstream GitHub archive, with no new build steps, scripts, network fetches, or packaging behavior changes. This is a normal integrity update and does not introduce an obvious security risk on its own.

@@ -10,7 +10,7 @@ makedepends=('go' 'pnpm')
 depends=('glibc' 'bash')
 optdepends=('xdg-utils: Allows for opening directories in default file manager')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
-sha256sums=('d62b1e2316fa79a34b9283d5846b78b50f88f01b5de40052da94def8c2f97421')
+sha256sums=('9f9a1b37ff3423b30215b5e195ab401fe24a390dfc9d4aee13ca5082c9c604d0')
 
 prepare() {
   mv "cli-${pkgver}" "${pkgname}-${pkgver}"