Review Results

Comment

The change only bumps the package version in .SRCINFO from 153.0b9 to 153.0b12. No build logic, sources, checksums, install scripts, or package metadata beyond the version string are altered. For an -bin package, this is a routine upstream release update and does not introduce any new security-relevant behavior in the reviewed diff.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 153.0b9
+	pkgver = 153.0b12
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

This is a routine version bump in .SRCINFO for the Firefox beta binary package: the provided version, source tarball URL, and checksum were updated from 153.0b9 to 153.0b12. The source remains the official Mozilla archive over HTTPS, and there are no new scripts, build steps, permissions changes, or other suspicious artifacts in the diff. No security issue is evident from this metadata-only change.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=153.0b9
+	provides = firefox=153.0b12
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/153.0b9/linux-x86_64/en-US/firefox-153.0b9.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/153.0b12/linux-x86_64/en-US/firefox-153.0b12.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = cbcc93967752b01a9eb80b15206596a4d4ffd047ac12d4578fbb34947d18461c
+	sha256sums = 0ee0eb60f5c8a84434d1bb577e42f7e4a1e0666028fd3ea72830cb6cacf69792
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a straightforward version bump from Firefox Beta 153.0b9 to 153.0b12, with the source URL and checksum updated accordingly. I do not see any new build-time execution, network fetches outside the declared source array, privilege escalation, persistence mechanisms, or packaging changes beyond the expected upstream tarball refresh. The package still pulls from Mozilla’s official archive over HTTPS and remains pinned to a specific release tarball. Risk is low.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=153.0b9
+pkgver=153.0b12
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

Risk score 0. This change is a routine version bump for a Firefox binary package: it updates the upstream Mozilla archive URL from 153.0b9 to 153.0b12 and refreshes the corresponding SHA-256 checksum. The source remains HTTPS from the official Mozilla archive, there are no new build-time commands, no added scripts, no privilege changes, and no packaging/install logic changes. I see no security red flags in this diff alone.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/153.0b9/linux-x86_64/en-US/firefox-153.0b9.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/153.0b12/linux-x86_64/en-US/firefox-153.0b12.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('cbcc93967752b01a9eb80b15206596a4d4ffd047ac12d4578fbb34947d18461c'
+sha256sums=('0ee0eb60f5c8a84434d1bb577e42f7e4a1e0666028fd3ea72830cb6cacf69792'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')