Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.46.5 to 2.46.7. No source URLs, checksums, build steps, dependencies, install scripts, or packaging behavior are altered here, so there is no new security-relevant risk visible in this diff alone.

@@ -1,6 +1,6 @@
 pkgbase = spicetify-cli
 	pkgdesc = Command-line tool to customize Spotify client
-	pkgver = 2.46.5
+	pkgver = 2.46.7
 	pkgrel = 1
 	url = https://github.com/spicetify/cli
 	arch = x86_64

Comment

The change only updates the SHA-256 checksum for the existing upstream source tarball URL (GitHub release archive for v2.43.2). The source location, version pinning, and package metadata are otherwise unchanged, and there are no new build steps, scripts, or privilege-related artifacts introduced by this diff. This is a low-risk integrity metadata update, assuming the new checksum matches the same upstream tarball.

@@ -12,6 +12,6 @@ pkgbase = spicetify-cli
         depends = glibc
 	optdepends = xdg-utils: Allows for opening directories in default file manager
 	source = spicetify-cli-2.43.2.tar.gz::https://github.com/spicetify/cli/archive/v2.43.2
-	sha256sums = 9f9a1b37ff3423b30215b5e195ab401fe24a390dfc9d4aee13ca5082c9c604d0
+	sha256sums = b6609b1f62cd2ee6bd8a6c4512d010f9ef041a219ae615cfa1d2c0904bb74729
 
 pkgname = spicetify-cli

Comment

The change is a straightforward version bump in PKGBUILD from 2.46.5 to 2.46.7 with the corresponding source tarball checksum update. No new sources, build steps, install scripts, permissions changes, or other packaging behavior were introduced in this diff. Based on the provided hunk, there are no security red flags.

@@ -1,6 +1,6 @@
 ## Maintainer: khanhas <xuankhanh963@gmail.com>, itsmeow <itsmeow@itsmeow.dev>
 pkgname=spicetify-cli
-pkgver=2.46.5
+pkgver=2.46.7
 pkgrel=1
 pkgdesc='Command-line tool to customize Spotify client'
 arch=('x86_64' 'i686')

Comment

The change only updates the source tarball checksum for the existing HTTPS GitHub archive source. No new sources, build steps, install scripts, or packaging behavior were introduced, and the package still builds from the upstream release archive. This is a routine integrity pin update with no apparent security impact in the diff reviewed.

@@ -10,7 +10,7 @@ makedepends=('go' 'pnpm')
 depends=('glibc' 'bash')
 optdepends=('xdg-utils: Allows for opening directories in default file manager')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
-sha256sums=('9f9a1b37ff3423b30215b5e195ab401fe24a390dfc9d4aee13ca5082c9c604d0')
+sha256sums=('b6609b1f62cd2ee6bd8a6c4512d010f9ef041a219ae615cfa1d2c0904bb74729')
 
 prepare() {
   mv "cli-${pkgver}" "${pkgname}-${pkgver}"