Review Results

Comment

This is a straightforward version bump in .SRCINFO for ungoogled-chromium from 150.0.7871.100 to 150.0.7871.114, with matching provides/source checksum updates. The change does not introduce new sources, network fetches, scripts, privilege changes, or packaging behavior; it only tracks an upstream release and updates the recorded checksum for the tarball. Based on the diff provided, there are no security red flags in this hunk.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 150.0.7871.100
+	pkgver = 150.0.7871.114
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is limited to bumping the package version in .SRCINFO from 150.0.7871.100 to 150.0.7871.114 and updating the corresponding source tarball URL/provides entries. This is a routine metadata refresh with no new sources, no change in trust model, and no evidence of added execution, persistence, or privilege escalation behavior. The source remains an HTTPS GitHub release tarball from the same upstream project, and the rest of the package metadata is unchanged. Risk is therefore very low.

@@ -81,13 +81,13 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=150.0.7871.100
-	provides = chromedriver=150.0.7871.100
+	provides = chromium=150.0.7871.114
+	provides = chromedriver=150.0.7871.114
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
 	source = fetch-chromium-release
-	source = ungoogled-chromium-150.0.7871.100-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/150.0.7871.100-1.tar.gz
+	source = ungoogled-chromium-150.0.7871.114-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/150.0.7871.114-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch

Comment

The only change is a SHA-256 checksum update in .SRCINFO for an existing source artifact. This does not introduce new sources, code execution, privilege changes, or packaging behavior changes by itself. I did not see any indication in the provided hunk of a new network fetch, script, or binary being added. Risk is therefore very low; the main impact is integrity metadata alignment with the package sources, which is expected for a legitimate source update.

@@ -105,7 +105,7 @@ pkgbase = ungoogled-chromium
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
 	sha256sums = 2e2f36e3cd1ebc4ad57fd310774a5e5e9db77883d5f9374fedeaabd3c103b819
-	sha256sums = 891db0f063c012036a95619c35526881e2d02ef8a3735054ce62cf7a1fd74326
+	sha256sums = 626e7854f4cded52740ee337c5dd6840880bbbe61c0e40d722c385dc372f2f31
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e
 	sha256sums = 4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e

Comment

This change is a straightforward version bump in PKGBUILD metadata from 150.0.7871.100 to 150.0.7871.114, with the corresponding upstream version variable updated as well. No build logic, source URLs, integrity checks, install scripts, permissions, or packaging behavior changed in the provided hunk. Based on this diff alone, I see no security-relevant regression or new attack surface.

@@ -11,14 +11,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=150.0.7871.100
+pkgver=150.0.7871.114
 pkgrel=1
 _launcher_ver=8
 _manual_clone=1
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=150.0.7871.100-1
+_uc_ver=150.0.7871.114-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"

Comment

The only change in this hunk is an updated SHA-256 checksum for an existing source archive in `source=()`. This is a normal integrity metadata update and does not introduce new sources, network fetches, execution, privilege changes, or packaging behavior. I did not see any evidence in the provided diff of malicious content or supply-chain risk beyond the usual need to trust the new checksum matches the intended upstream tarball.

@@ -105,7 +105,7 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
 sha256sums=('e2654fa7c37ddc20af98f91089ad580e347ca9c526f8de8e625fe1b1cf3d98c6'
-            '891db0f063c012036a95619c35526881e2d02ef8a3735054ce62cf7a1fd74326'
+            '626e7854f4cded52740ee337c5dd6840880bbbe61c0e40d722c385dc372f2f31'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'