Review Results

Comment

The change is a routine version bump in .SRCINFO from 1.92.138 to 1.92.139 with no alterations to sources, checksums, dependencies, install scripts, or build logic. On its face this does not introduce any new security risk; it simply tracks a newer upstream binary release. I did not see any suspicious metadata changes in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = brave-bin
 	pkgdesc = Web browser that blocks ads and trackers by default (binary release)
-	pkgver = 1.92.138
+	pkgver = 1.92.139
 	pkgrel = 1
 	epoch = 1
 	url = https://brave.com

Comment

The change is a routine version bump in .SRCINFO for the prebuilt Brave binary package: it updates the provided version, noextract filenames, and GitHub release URLs/checksums from 1.92.138 to 1.92.139. The sources remain HTTPS on the official upstream GitHub release page, and there are no new scripts, build steps, permissions changes, or persistence mechanisms introduced in this diff hunk. Based on the provided change alone, I see no security concern beyond the normal trust inherent in a -bin package.

@@ -17,19 +17,19 @@ pkgbase = brave-bin
 	optdepends = cups: Printer support
 	optdepends = libgnome-keyring: Enable GNOME keyring support
 	optdepends = libnotify: Native notification support
-	provides = brave=1.92.138
+	provides = brave=1.92.139
 	provides = brave-browser
 	conflicts = brave
-	noextract = brave-bin-1.92.138-x86_64.zip
-	noextract = brave-bin-1.92.138-aarch64.zip
+	noextract = brave-bin-1.92.139-x86_64.zip
+	noextract = brave-bin-1.92.139-aarch64.zip
 	options = !strip
 	source = brave-bin.sh
 	source = brave-browser.desktop
 	sha256sums = 75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00
 	sha256sums = c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a
-	source_x86_64 = brave-bin-1.92.138-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.92.138/brave-browser-1.92.138-linux-amd64.zip
-	sha256sums_x86_64 = 97c744e4ded05373176fa611bf454cffae8f76a51a0e9e01930730a33c0176a1
-	source_aarch64 = brave-bin-1.92.138-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.92.138/brave-browser-1.92.138-linux-arm64.zip
-	sha256sums_aarch64 = a601d2305c47d1fe76d023ac56ad3be160ba756b4994651da4d58a9ee0f540af
+	source_x86_64 = brave-bin-1.92.139-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.92.139/brave-browser-1.92.139-linux-amd64.zip
+	sha256sums_x86_64 = 6d1f8338ec0de06cdfbd7af8caf6722566d7768a805a1cc673a155a51a3a62d0
+	source_aarch64 = brave-bin-1.92.139-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.92.139/brave-browser-1.92.139-linux-arm64.zip
+	sha256sums_aarch64 = bb8a87897da73e9acb190805d5184bdf1a161dd5a0a4857d25a084ddd838f996
 
 pkgname = brave-bin

Comment

The change is a simple pkgver bump from 1.92.138 to 1.92.139 with no accompanying logic changes. I did not find any new sources, build steps, install scripts, permissions changes, or other security-relevant modifications in this hunk. Risk is therefore minimal and limited to the usual trust in the upstream Brave binary release already present in the package.

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.92.138
+pkgver=1.92.139
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'

Comment

The change only updates the pinned SHA-256 checksums for the upstream Brave release archives on the existing GitHub HTTPS source URLs. There is no new source, no build-time network access, no script execution, and no packaging logic change. This is a normal integrity update to match a new upstream artifact and does not introduce an obvious security concern in the reviewed hunk.

@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('97c744e4ded05373176fa611bf454cffae8f76a51a0e9e01930730a33c0176a1')
-sha256sums_aarch64=('a601d2305c47d1fe76d023ac56ad3be160ba756b4994651da4d58a9ee0f540af')
+sha256sums_x86_64=('6d1f8338ec0de06cdfbd7af8caf6722566d7768a805a1cc673a155a51a3a62d0')
+sha256sums_aarch64=('bb8a87897da73e9acb190805d5184bdf1a161dd5a0a4857d25a084ddd838f996')
 
 prepare() {
 	mkdir -p brave