prowlarr
LOW
maintainer txtsd
8 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The yarn install is part of the frontend build process for the project's own source code from a trusted GitHub repository, not an external unreviewed package.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The yarn install is part of the frontend build process for the project's own source code from a trusted GitHub repository, not an external unreviewed package.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:91
yarn install --frozen-lockfile --network-timeout 120000
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: txtsd <aur.archlinux@ihavea.quest>
2
# Maintainer: Donald Webster <fryfrog@gmail.com>
3
# Helpful URL: https://prowlarr.servarr.com/v1/update/master?version=0.0.0.0&os=linux&runtime=netcore&arch=x64&includeMajorVersion=true
4
5
pkgname=prowlarr
6
_pkgname=Prowlarr
7
pkgver=2.7.0.5723
8
pkgrel=1
9
pkgdesc='Indexer manager/proxy for usenet and torrent users.'
10
arch=(x86_64 aarch64 armv7h)
11
url='https://prowlarr.com'
12
license=('GPL-3.0-or-later')
13
groups=(servarr)
14
depends=(
15
aspnet-runtime-8.0
16
gcc-libs
17
glibc
18
sqlite
19
)
20
makedepends=(dotnet-sdk-8.0 yarn)
21
optdepends=(
22
'postgresql: postgresql database'
23
'sabnzbd: usenet downloader'
24
'nzbget: usenet downloader'
25
'qbittorrent: torrent downloader'
26
'deluge: torrent downloader'
27
'rtorrent: torrent downloader'
28
'nodejs-flood: torrent downloader'
29
'vuze: torrent downloader'
30
'aria2: torrent downloader'
31
'transmission-cli: torrent downloader (CLI and daemon)'
32
'transmission-gtk: torrent downloader (GTK+)'
33
'transmission-qt: torrent downloader (Qt)'
34
'jackett: torrent indexer proxy'
35
'nzbhydra2: torznab and usenet indexer proxy'
36
'flaresolverr: A proxy server to bypass Cloudflare protection'
37
'sonarr: automatically integrates with and syncs indexers'
38
'radarr: automatically integrates with and syncs indexers'
39
'lidarr: automatically integrates with and syncs indexers'
40
'readarr: automatically integrates with and syncs indexers'
41
'whisparr: automatically integrates with and syncs indexers'
42
'mylar3: automatically integrates with and syncs indexers'
43
'lazylibrarian: automatically integrates with and syncs indexers'
44
)
45
install=prowlarr.install
46
source=(
47
"${pkgname}-${pkgver}.tar.gz::https://github.com/Prowlarr/Prowlarr/archive/refs/tags/v${pkgver}.tar.gz"
48
package_info
49
prowlarr.service
50
prowlarr.sysusers
51
prowlarr.tmpfiles
52
)
53
sha256sums=('6c26e6cb9a57087e883b0afc4c8b9c0ffd57726f2595c89b02c68c1770a7f0e4'
54
'1f9f8018436bd1e29a36c203639083d614722b65a4db64e22bf0c3295fc03fb8'
55
'0c9d7cda701395a8ddb708c111de58437543485702de23e23a0164a162a53bbc'
56
'ee61f5621eae6ab932fb093a4f75a0ab11bf9e3ca829f0d34c25014f68aeff7d'
57
'75591d19518bafc60862c60848ecad84f92c7f2b47b2b4eeafcbbbd650a43043')
58
59
case ${CARCH} in
60
x86_64) _CARCH='x64' ;;
61
aarch64) _CARCH='arm64' ;;
62
armv7h) _CARCH='arm' ;;
63
esac
64
65
_framework='net8.0'
66
_runtime="linux-${_CARCH}"
67
_output='_output'
68
_artifacts="${_output}/${_framework}/${_runtime}/publish"
69
_branch='master'
70
71
prepare() {
72
cd "${_pkgname}-${pkgver}"
73
74
# Fix CVE-2026-41319
75
sed 's/MailKit" Version="4\.14\.0"/MailKit" Version="4\.16\.0"/' -i src/NzbDrone.Core/Prowlarr.Core.csproj
76
77
# Remove upstream dotnet version
78
rm global.json
79
80
export DOTNET_CLI_TELEMETRY_OPTOUT=1
81
export DOTNET_NOLOGO=1
82
export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
83
dotnet new globaljson --sdk-version 8.0.127 --roll-forward latestFeature
84
85
# Prepare backend
86
dotnet restore "src/${_pkgname}.sln" \
87
--runtime "${_runtime}" \
88
--locked-mode
89
90
# Prepare frontend
91
yarn install --frozen-lockfile --network-timeout 120000
92
}
93
94
build() {
95
cd "${_pkgname}-${pkgver}"
96
97
# Build backend
98
export DOTNET_CLI_TELEMETRY_OPTOUT=1
99
export DOTNET_NOLOGO=1
100
export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
101
dotnet build "src/${_pkgname}.sln" \
102
--framework "${_framework}" \
103
--runtime "${_runtime}" \
104
--no-self-contained \
105
--no-restore \
106
--configuration Release \
107
-p:Platform=Posix \
108
-p:AssemblyVersion=${pkgver} \
109
-p:AssemblyConfiguration=${_branch} \
110
-p:RuntimeIdentifiers=${_runtime} \
111
-t:PublishAllRids \
112
&& dotnet build-server shutdown # Build servers do not terminate automatically
113
114
# Build frontend
115
yarn run build --env production
116
}
117
118
package() {
119
cd "${_pkgname}-${pkgver}"
120
121
install -dm755 "${pkgdir}/usr/lib/prowlarr/bin/UI"
122
123
# Remove Service Helpers, Update, and Windows files
124
rm "${_artifacts}/ServiceInstall"*
125
rm "${_artifacts}/ServiceUninstall"*
126
rm "${_artifacts}/Prowlarr.Windows."*
127
128
# Copy backend
129
cp -dr "${_artifacts}/"* "${pkgdir}/usr/lib/prowlarr/bin"
130
# Copy frontend
131
cp -dr "${_output}/UI/"* "${pkgdir}/usr/lib/prowlarr/bin/UI"
132
133
# License
134
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}"
135
136
# Disable built in updater.
137
cd "${srcdir}"
138
install -Dm644 package_info "${pkgdir}/usr/lib/prowlarr"
139
echo "PackageVersion=${pkgver}-${pkgrel}" >> "${pkgdir}/usr/lib/prowlarr/package_info"
140
141
# Systemd
142
install -Dm644 prowlarr.service "${pkgdir}/usr/lib/systemd/system/prowlarr.service"
143
install -Dm644 prowlarr.sysusers "${pkgdir}/usr/lib/sysusers.d/prowlarr.conf"
144
install -Dm644 prowlarr.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/prowlarr.conf"
145
}
146
Changes since previous scan
--- PKGBUILD @ 2026-10-27 00:23+++ PKGBUILD @ 2026-11-01 00:21@@ -4,7 +4,7 @@ pkgname=prowlarr _pkgname=Prowlarr-pkgver=2.6.5.5623+pkgver=2.7.0.5723 pkgrel=1 pkgdesc='Indexer manager/proxy for usenet and torrent users.' arch=(x86_64 aarch64 armv7h)@@ -50,7 +50,7 @@ prowlarr.sysusers prowlarr.tmpfiles )-sha256sums=('1a88ca371ab9944845b0ded713c164bb9b6259fb925719185234dcc4f08d3908'+sha256sums=('6c26e6cb9a57087e883b0afc4c8b9c0ffd57726f2595c89b02c68c1770a7f0e4' '1f9f8018436bd1e29a36c203639083d614722b65a4db64e22bf0c3295fc03fb8' '0c9d7cda701395a8ddb708c111de58437543485702de23e23a0164a162a53bbc' 'ee61f5621eae6ab932fb093a4f75a0ab11bf9e3ca829f0d34c25014f68aeff7d'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 19:48:35 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |