Review Results

Comment

The only change in this diff is a version bump in .SRCINFO from 2.14.1 to 2.14.2. No sources, checksums, build logic, install scripts, or package metadata affecting trust boundaries were changed in the reviewed hunk. Based on this diff alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = mongosh-bin
 	pkgdesc = An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.
-	pkgver = 2.14.1
+	pkgver = 2.14.2
 	pkgrel = 1
 	url = https://github.com/mongodb-js/mongosh.git
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from mongosh 2.14.1 to 2.14.2, with updated SHA-256 checksums for the official GitHub release tarballs on both x86_64 and aarch64. No new sources, scripts, build steps, or packaging behavior are introduced in this diff, and the URLs remain HTTPS and point to the upstream release artifacts. Based on the provided hunk alone, there are no evident security concerns.

@@ -9,9 +9,9 @@ pkgbase = mongosh-bin
 	depends = krb5
 	provides = mongosh
 	conflicts = mongosh
-	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.14.1/mongosh-2.14.1-linux-x64.tgz
-	sha256sums_x86_64 = 8d24940ebe3675959b518fd41ea16b4e2182d6a75c09777db09cfa64e18834a1
-	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.14.1/mongosh-2.14.1-linux-arm64.tgz
-	sha256sums_aarch64 = cd7f1ae986baa400b021a2c0688aa3b64d6afcc3f7ab07833417a049e0cbf98b
+	source_x86_64 = https://github.com/mongodb-js/mongosh/releases/download/v2.14.2/mongosh-2.14.2-linux-x64.tgz
+	sha256sums_x86_64 = 1523e16da7c6902333b681bf65d83bbef59bff558c46ac5636371d13beb4de53
+	source_aarch64 = https://github.com/mongodb-js/mongosh/releases/download/v2.14.2/mongosh-2.14.2-linux-arm64.tgz
+	sha256sums_aarch64 = 20f89386f74c14cb63a163eea5491dc14759bcd64229b1c099c2390585a01fd3
 
 pkgname = mongosh-bin

Comment

The change is a simple version bump in PKGBUILD from 2.14.1 to 2.14.2 with no other modifications shown. There are no new sources, build steps, install scripts, permissions changes, or other security-relevant alterations in the provided diff hunk. Based on this diff alone, I see no evidence of supply-chain risk or malicious behavior.

@@ -3,7 +3,7 @@
 
 pkgname=mongosh-bin
 _pkgname=mongosh
-pkgver=2.14.1
+pkgver=2.14.2
 pkgrel=1
 pkgdesc='An interactive shell to connect with MongoDB with syntax highlighting, autocomplete, contextual help and error messages.'
 arch=('x86_64' 'aarch64')

Comment

The change is a straightforward version bump in PKGBUILD from 2.14.1 to 2.14.2 with updated SHA-256 checksums for the official GitHub release tarballs on both supported architectures. No new sources, scripts, build steps, or packaging logic were introduced, and the download URLs remain HTTPS and pinned to the release version. Based on the diff shown, there are no obvious security red flags.

@@ -17,8 +17,8 @@ _mongosh_folder=mongosh-${pkgver}-linux
 source_x86_64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-x64.tgz")
 source_aarch64=("https://github.com/mongodb-js/mongosh/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64.tgz")
 
-sha256sums_x86_64=('8d24940ebe3675959b518fd41ea16b4e2182d6a75c09777db09cfa64e18834a1')
-sha256sums_aarch64=('cd7f1ae986baa400b021a2c0688aa3b64d6afcc3f7ab07833417a049e0cbf98b')
+sha256sums_x86_64=('1523e16da7c6902333b681bf65d83bbef59bff558c46ac5636371d13beb4de53')
+sha256sums_aarch64=('20f89386f74c14cb63a163eea5491dc14759bcd64229b1c099c2390585a01fd3')
 
 package() {
 	if [ $CARCH = 'x86_64' ]; then