Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 26.11.7 to 26.11.8. No source URLs, checksums, build steps, dependencies, install scripts, or packaging permissions are altered in the provided diff, so there is no new security-relevant behavior to assess from this change alone.

@@ -1,6 +1,6 @@
 pkgbase = qownnotes
 	pkgdesc = Plain-text file markdown note taking with Nextcloud/ownCloud integration
-	pkgver = 26.11.7
+	pkgver = 26.11.8
 	pkgrel = 1
 	url = https://www.qownnotes.org/
 	arch = i686

Comment

The change is a straightforward upstream version bump in .SRCINFO from QOwnNotes 26.11.7 to 26.11.8, with the source still fetched over HTTPS from the official GitHub releases page. No new sources, scripts, patches, build steps, or packaging metadata were introduced, and there are no signs of privilege escalation or persistence mechanisms in this diff. Risk is minimal.

@@ -19,7 +19,7 @@ pkgbase = qownnotes
 	depends = botan
 	depends = libgit2
 	depends = libsecret
-	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.7/qownnotes-26.11.7.tar.xz
+	source = https://github.com/pbek/QOwnNotes/releases/download/v26.11.8/qownnotes-26.11.8.tar.xz
 	sha256sums = ARCHIVE-SHA256
 
 pkgname = qownnotes

Comment

The change is a routine version bump in PKGBUILD: it updates pkgver/tag and the corresponding source checksum to a new upstream release tarball on GitHub over HTTPS. There are no new build steps, no added scripts, no network fetches outside source=(), and no packaging or privilege-related changes. Based on the diff provided, I do not see any security-relevant regression.

@@ -2,8 +2,8 @@
 # https://wiki.archlinux.org/title/PKGBUILD
 
 pkgname=qownnotes
-pkgver=26.11.7
-tag="30cdafea0be061c3b258e90cbb09d6a65822e712"
+pkgver=26.11.8
+tag="425c39f0d2f2e82d1e855dd3dbc2dd4169ffbe96"
 pkgrel=1
 pkgdesc="Plain-text file markdown note taking with Nextcloud/ownCloud integration"
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')

Comment

The change only updates the SHA-256 checksum for the upstream release tarball source URL, which remains an HTTPS GitHub release asset. No build logic, install scripts, permissions, or additional sources were introduced. This is a routine integrity pin update and does not add new attack surface in the reviewed hunk.

@@ -13,7 +13,7 @@ groups=('qownnotes')
 depends=('qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-websockets' 'aspell' 'botan' 'libgit2' 'libsecret')
 makedepends=('qt6-tools' 'cmake')
 source=("https://github.com/pbek/QOwnNotes/releases/download/v${pkgver}/qownnotes-${pkgver}.tar.xz")
-sha256sums=('745da0355c38a15c2c6df5030e9787d3116c23f05c2808295b8354ec18bfe0d8')
+sha256sums=('57bc672873e09853ba17b0143e3f0891223b4da4c2c30b56650321dcb2df7563')
 
 prepare() {
     cd "${pkgname}-${pkgver}"