Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.92.139 to 1.92.140. No sources, checksums, install scripts, permissions, or build logic are changed here, and there are no new integrity or execution red flags visible in the provided diff. On its face this is a routine upstream binary update with low security risk, though the actual package contents are not altered in this hunk.

@@ -1,6 +1,6 @@
 pkgbase = brave-bin
 	pkgdesc = Web browser that blocks ads and trackers by default (binary release)
-	pkgver = 1.92.139
+	pkgver = 1.92.140
 	pkgrel = 1
 	epoch = 1
 	url = https://brave.com

Comment

The change is a routine version bump in .SRCINFO for the Brave binary package: it updates the provided version, noextract filenames, source URLs, and checksums to the new upstream release 1.92.140. The sources remain HTTPS GitHub release assets, there are no new build-time commands, scripts, or privilege-related changes, and no suspicious metadata changes beyond the expected package update. Risk is low.

@@ -17,19 +17,19 @@ pkgbase = brave-bin
 	optdepends = cups: Printer support
 	optdepends = libgnome-keyring: Enable GNOME keyring support
 	optdepends = libnotify: Native notification support
-	provides = brave=1.92.139
+	provides = brave=1.92.140
 	provides = brave-browser
 	conflicts = brave
-	noextract = brave-bin-1.92.139-x86_64.zip
-	noextract = brave-bin-1.92.139-aarch64.zip
+	noextract = brave-bin-1.92.140-x86_64.zip
+	noextract = brave-bin-1.92.140-aarch64.zip
 	options = !strip
 	source = brave-bin.sh
 	source = brave-browser.desktop
 	sha256sums = 75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00
 	sha256sums = c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a
-	source_x86_64 = brave-bin-1.92.139-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.92.139/brave-browser-1.92.139-linux-amd64.zip
-	sha256sums_x86_64 = 6d1f8338ec0de06cdfbd7af8caf6722566d7768a805a1cc673a155a51a3a62d0
-	source_aarch64 = brave-bin-1.92.139-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.92.139/brave-browser-1.92.139-linux-arm64.zip
-	sha256sums_aarch64 = bb8a87897da73e9acb190805d5184bdf1a161dd5a0a4857d25a084ddd838f996
+	source_x86_64 = brave-bin-1.92.140-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.92.140/brave-browser-1.92.140-linux-amd64.zip
+	sha256sums_x86_64 = 7935abc3349424ecd7d8752ae5b0dc123afda484f90e954f02e057095feff581
+	source_aarch64 = brave-bin-1.92.140-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.92.140/brave-browser-1.92.140-linux-arm64.zip
+	sha256sums_aarch64 = f1f41b811ad33bef32f74d584c5a1b806abd029ccf15fdd45edbbbd2efd2836b
 
 pkgname = brave-bin

Comment

The change is a simple version bump in PKGBUILD from 1.92.139 to 1.92.140 with no accompanying changes to sources, build steps, install scripts, permissions, or package metadata. On its face this does not introduce any new attack surface or supply-chain risk beyond the usual trust in the upstream Brave binary release already implied by brave-bin.

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.92.139
+pkgver=1.92.140
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'

Comment

The change only updates the SHA-256 checksums for the upstream Brave release ZIPs on x86_64 and aarch64. The source URLs remain HTTPS and point to the official Brave GitHub release artifacts, with no new build-time downloads, scripts, patches, privilege changes, or packaging logic changes. This is a routine integrity update and does not introduce an obvious security concern in the reviewed hunk.

@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('6d1f8338ec0de06cdfbd7af8caf6722566d7768a805a1cc673a155a51a3a62d0')
-sha256sums_aarch64=('bb8a87897da73e9acb190805d5184bdf1a161dd5a0a4857d25a084ddd838f996')
+sha256sums_x86_64=('7935abc3349424ecd7d8752ae5b0dc123afda484f90e954f02e057095feff581')
+sha256sums_aarch64=('f1f41b811ad33bef32f74d584c5a1b806abd029ccf15fdd45edbbbd2efd2836b')
 
 prepare() {
 	mkdir -p brave