Do some basic static analysis of package update diffs

[martindemello]

Have you checked the readme and man page for this feature?
yes

Have you checked previous issues for this feature?
yes

The aurpocalypse has definitely woken people up to not blindly accepting updates to AUR packages, but the fact remains that the diffs are difficult and tedious to read, and that most users are not really qualified to notice something malicious being slipped into an update. It would be super useful if paru had some ability to scan diffs and highlight potentially dangerous features (and likewise have the option to hide known-safe diffs like version and hash updates so that it's easier to focus on the meaningful diffs when reviewing).

I'd be interested in helping with this if people think it's a good idea.

[KogasaPls]

No change is really "known safe" and static analysis can't replace human review. The main goal should be to reduce friction for human review: improve visibility/readability of change details. Static analysis can be part of that.

have the option to hide known-safe diffs like version and hash updates so that it's easier to focus on the meaningful diffs when reviewing

I don't think this option should exist. Instead, flag interesting details of changes (maintainer changed, package update is recent, source array changed, binary file hash changed, etc.) to facilitate review.

--

One option worth considering is using the .diff info Paru already outputs during review. A wrapper script can parse and display it however you like, including flagging interesting changes. This approach may be sufficient without requiring paru changes.