prowlarr

maintainer txtsd · 7 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged 'npm/yarn install' is part of the project's own build process from its official source, using a locked dependency tree via --frozen-lockfile, posing no supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged 'npm/yarn install' is part of the project's own build process from its official source, using a locked dependency tree via --frozen-lockfile, posing no supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:91 yarn install --frozen-lockfile --network-timeout 120000

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: txtsd <aur.archlinux@ihavea.quest>
    
      2# Maintainer: Donald Webster <fryfrog@gmail.com>
    
      3# Helpful URL: https://prowlarr.servarr.com/v1/update/master?version=0.0.0.0&os=linux&runtime=netcore&arch=x64&includeMajorVersion=true
    
      4
    
      5pkgname=prowlarr
    
      6_pkgname=Prowlarr
    
      7pkgver=2.5.2.5491
    
      8pkgrel=1
    
      9pkgdesc='Indexer manager/proxy for usenet and torrent users.'
    
      10arch=(x86_64 aarch64 armv7h)
    
      11url='https://prowlarr.com'
    
      12license=('GPL-3.0-or-later')
    
      13groups=(servarr)
    
      14depends=(
    
      15  aspnet-runtime-8.0
    
      16  gcc-libs
    
      17  glibc
    
      18  sqlite
    
      19)
    
      20makedepends=(dotnet-sdk-8.0 yarn)
    
      21optdepends=(
    
      22  'postgresql: postgresql database'
    
      23  'sabnzbd: usenet downloader'
    
      24  'nzbget: usenet downloader'
    
      25  'qbittorrent: torrent downloader'
    
      26  'deluge: torrent downloader'
    
      27  'rtorrent: torrent downloader'
    
      28  'nodejs-flood: torrent downloader'
    
      29  'vuze: torrent downloader'
    
      30  'aria2: torrent downloader'
    
      31  'transmission-cli: torrent downloader (CLI and daemon)'
    
      32  'transmission-gtk: torrent downloader (GTK+)'
    
      33  'transmission-qt: torrent downloader (Qt)'
    
      34  'jackett: torrent indexer proxy'
    
      35  'nzbhydra2: torznab and usenet indexer proxy'
    
      36  'flaresolverr: A proxy server to bypass Cloudflare protection'
    
      37  'sonarr: automatically integrates with and syncs indexers'
    
      38  'radarr: automatically integrates with and syncs indexers'
    
      39  'lidarr: automatically integrates with and syncs indexers'
    
      40  'readarr: automatically integrates with and syncs indexers'
    
      41  'whisparr: automatically integrates with and syncs indexers'
    
      42  'mylar3: automatically integrates with and syncs indexers'
    
      43  'lazylibrarian: automatically integrates with and syncs indexers'
    
      44)
    
      45install=prowlarr.install
    
      46source=(
    
      47  "${pkgname}-${pkgver}.tar.gz::https://github.com/Prowlarr/Prowlarr/archive/refs/tags/v${pkgver}.tar.gz"
    
      48  package_info
    
      49  prowlarr.service
    
      50  prowlarr.sysusers
    
      51  prowlarr.tmpfiles
    
      52)
    
      53sha256sums=('99564425246f3e04de2c305695aa78ad7ce904d8da58432a4feca609b8093a2f'
    
      54            '1f9f8018436bd1e29a36c203639083d614722b65a4db64e22bf0c3295fc03fb8'
    
      55            '0c9d7cda701395a8ddb708c111de58437543485702de23e23a0164a162a53bbc'
    
      56            'ee61f5621eae6ab932fb093a4f75a0ab11bf9e3ca829f0d34c25014f68aeff7d'
    
      57            '75591d19518bafc60862c60848ecad84f92c7f2b47b2b4eeafcbbbd650a43043')
    
      58
    
      59case ${CARCH} in
    
      60  x86_64) _CARCH='x64' ;;
    
      61  aarch64) _CARCH='arm64' ;;
    
      62  armv7h) _CARCH='arm' ;;
    
      63esac
    
      64
    
      65_framework='net8.0'
    
      66_runtime="linux-${_CARCH}"
    
      67_output='_output'
    
      68_artifacts="${_output}/${_framework}/${_runtime}/publish"
    
      69_branch='master'
    
      70
    
      71prepare() {
    
      72  cd "${_pkgname}-${pkgver}"
    
      73
    
      74  # Fix  CVE-2026-41319
    
      75  sed 's/MailKit" Version="4\.14\.0"/MailKit" Version="4\.16\.0"/' -i src/NzbDrone.Core/Prowlarr.Core.csproj
    
      76
    
      77  # Remove upstream dotnet version
    
      78  rm global.json
    
      79
    
      80  export DOTNET_CLI_TELEMETRY_OPTOUT=1
    
      81  export DOTNET_NOLOGO=1
    
      82  export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
    
      83  dotnet new globaljson --sdk-version 8.0.127 --roll-forward latestFeature
    
      84
    
      85  # Prepare backend
    
      86  dotnet restore "src/${_pkgname}.sln" \
    
      87    --runtime "${_runtime}" \
    
      88    --locked-mode
    
      89
    
      90  # Prepare frontend
    
      91  yarn install --frozen-lockfile --network-timeout 120000
    
      92}
    
      93
    
      94build() {
    
      95  cd "${_pkgname}-${pkgver}"
    
      96
    
      97  # Build backend
    
      98  export DOTNET_CLI_TELEMETRY_OPTOUT=1
    
      99  export DOTNET_NOLOGO=1
    
      100  export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
    
      101  dotnet build "src/${_pkgname}.sln" \
    
      102    --framework "${_framework}" \
    
      103    --runtime "${_runtime}" \
    
      104    --no-self-contained \
    
      105    --no-restore \
    
      106    --configuration Release \
    
      107    -p:Platform=Posix \
    
      108    -p:AssemblyVersion=${pkgver} \
    
      109    -p:AssemblyConfiguration=${_branch} \
    
      110    -p:RuntimeIdentifiers=${_runtime} \
    
      111    -t:PublishAllRids \
    
      112    && dotnet build-server shutdown # Build servers do not terminate automatically
    
      113
    
      114  # Build frontend
    
      115  yarn run build --env production
    
      116}
    
      117
    
      118package() {
    
      119  cd "${_pkgname}-${pkgver}"
    
      120
    
      121  install -dm755 "${pkgdir}/usr/lib/prowlarr/bin/UI"
    
      122
    
      123  # Remove Service Helpers, Update, and Windows files
    
      124  rm "${_artifacts}/ServiceInstall"*
    
      125  rm "${_artifacts}/ServiceUninstall"*
    
      126  rm "${_artifacts}/Prowlarr.Windows."*
    
      127
    
      128  # Copy backend
    
      129  cp -dr "${_artifacts}/"* "${pkgdir}/usr/lib/prowlarr/bin"
    
      130  # Copy frontend
    
      131  cp -dr "${_output}/UI/"* "${pkgdir}/usr/lib/prowlarr/bin/UI"
    
      132
    
      133  # License
    
      134  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}"
    
      135
    
      136  # Disable built in updater.
    
      137  cd "${srcdir}"
    
      138  install -Dm644 package_info "${pkgdir}/usr/lib/prowlarr"
    
      139  echo "PackageVersion=${pkgver}-${pkgrel}" >> "${pkgdir}/usr/lib/prowlarr/package_info"
    
      140
    
      141  # Systemd
    
      142  install -Dm644 prowlarr.service "${pkgdir}/usr/lib/systemd/system/prowlarr.service"
    
      143  install -Dm644 prowlarr.sysusers "${pkgdir}/usr/lib/sysusers.d/prowlarr.conf"
    
      144  install -Dm644 prowlarr.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/prowlarr.conf"
    
      145}
    
      146

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,8 +4,8 @@
 
 pkgname=prowlarr
 _pkgname=Prowlarr
-pkgver=2.4.0.5397
-pkgrel=2
+pkgver=2.5.2.5491
+pkgrel=1
 pkgdesc='Indexer manager/proxy for usenet and torrent users.'
 arch=(x86_64 aarch64 armv7h)
 url='https://prowlarr.com'
@@ -50,7 +50,7 @@
   prowlarr.sysusers
   prowlarr.tmpfiles
 )
-sha256sums=('a01acf8f69b5233d63f3a9bbeceda3664a14a168fdac5993326ec3f2657f3347'
+sha256sums=('99564425246f3e04de2c305695aa78ad7ce904d8da58432a4feca609b8093a2f'
             '1f9f8018436bd1e29a36c203639083d614722b65a4db64e22bf0c3295fc03fb8'
             '0c9d7cda701395a8ddb708c111de58437543485702de23e23a0164a162a53bbc'
             'ee61f5621eae6ab932fb093a4f75a0ab11bf9e3ca829f0d34c25014f68aeff7d'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 13:20:28	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2