Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 150.0.7871.100 to 150.0.7871.114. There are no new sources, scripts, build steps, permissions, or metadata changes visible here, so this diff alone does not introduce an obvious security concern. Risk is low, though a full package review would still need to confirm the corresponding PKGBUILD/source integrity for the new release.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 150.0.7871.100
+	pkgver = 150.0.7871.114
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

This is a routine version bump in .SRCINFO for a binary package: the provided version, source URL, and checksum were updated consistently from 150.0.7871.100 to 150.0.7871.114. The source remains an HTTPS GitHub release asset from the same upstream project, and there are no new build steps, scripts, permissions changes, or other suspicious metadata in the diff. No security issue is evident from this change alone.

@@ -62,11 +62,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=150.0.7871.100
-	provides = chromedriver=150.0.7871.100
+	provides = chromium=150.0.7871.114
+	provides = chromedriver=150.0.7871.114
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/150.0.7871.100-1/ungoogled-chromium-150.0.7871.100-1-x86_64.pkg.tar.zst
-	sha256sums = 63c21b2661d42df4a817a5d91c78cbf4b850c6076e3fcd2d4ce0bd55903ca4fd
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/150.0.7871.114-1/ungoogled-chromium-150.0.7871.114-1-x86_64.pkg.tar.zst
+	sha256sums = fc788c968503cf10b1ffc27f80e570f4d504a7bd7683d94774a12cf28609ceaa
 
 pkgname = ungoogled-chromium-bin

Comment

The change only bumps pkgver in PKGBUILD from 150.0.7871.100 to 150.0.7871.114. No build logic, sources, checksums, install scripts, permissions, or dependencies are modified in the provided diff hunk. On its face this is a routine version update with no new security red flags visible in the reviewed change.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=150.0.7871.100
+pkgver=150.0.7871.114
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

The change only updates the SHA-256 checksum for the prebuilt upstream release artifact in source=(). The download URL remains HTTPS and pinned to the specific package version/release, with no new build steps, scripts, or privilege-related changes. I did not find any additional suspicious behavior in this hunk. The main security property here is integrity verification of the same binary blob, and the new checksum appears to be a straightforward refresh rather than a trust boundary change.

@@ -54,7 +54,7 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('63c21b2661d42df4a817a5d91c78cbf4b850c6076e3fcd2d4ce0bd55903ca4fd')
+sha256sums=('fc788c968503cf10b1ffc27f80e570f4d504a7bd7683d94774a12cf28609ceaa')
 
 declare -gA _system_libs=(
     [brotli]=brotli