Review Results

Comment

The change only bumps pkgver in .SRCINFO from 150.0.7871.114 to 150.0.7871.124. No build logic, sources, checksums, dependencies, install scripts, or packaging behavior changed in the reviewed hunk. On its face this is a routine version update with no security-relevant red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 150.0.7871.114
+	pkgver = 150.0.7871.124
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a routine version bump in .SRCINFO: pkgver/provides and the upstream release tarball URL/checksum were updated from 150.0.7871.114 to 150.0.7871.124. The source remains an HTTPS GitHub release archive from the expected upstream project, with no new build-time code execution, no added sources, and no packaging/persistence changes. On its face this is low risk and consistent with a normal upstream update.

@@ -81,13 +81,13 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=150.0.7871.114
-	provides = chromedriver=150.0.7871.114
+	provides = chromium=150.0.7871.124
+	provides = chromedriver=150.0.7871.124
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
 	source = fetch-chromium-release
-	source = ungoogled-chromium-150.0.7871.114-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/150.0.7871.114-1.tar.gz
+	source = ungoogled-chromium-150.0.7871.124-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/150.0.7871.124-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch

Comment

The change is a routine version bump in .SRCINFO: pkgver/provides/source tarball name and one corresponding sha256sum were updated to match the new upstream release. The source remains an HTTPS GitHub release tarball from the same project, with no new build-time code execution, no added sources, and no packaging/persistence changes. Based on the diff shown, this is low risk.

@@ -105,7 +105,7 @@ pkgbase = ungoogled-chromium
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
 	sha256sums = 2e2f36e3cd1ebc4ad57fd310774a5e5e9db77883d5f9374fedeaabd3c103b819
-	sha256sums = 626e7854f4cded52740ee337c5dd6840880bbbe61c0e40d722c385dc372f2f31
+	sha256sums = 3b6528ae81cbfacc48fc4764f629d78b0ad1bba6af9d121eac9487f14a767935
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e
 	sha256sums = 4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e

Comment

The change is a straightforward version bump in PKGBUILD from 150.0.7871.114 to 150.0.7871.124, with the corresponding internal ungoogled-chromium version updated as well. No new sources, build steps, patches, install scripts, permissions, or privilege-related changes are introduced in the provided diff. Based on this hunk alone, there are no security red flags beyond the usual need to trust the upstream release being referenced.

@@ -11,14 +11,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=150.0.7871.114
+pkgver=150.0.7871.124
 pkgrel=1
 _launcher_ver=8
 _manual_clone=1
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=150.0.7871.114-1
+_uc_ver=150.0.7871.124-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"

Comment

The change is a straightforward version bump for ungoogled-chromium and an updated checksum for the corresponding upstream Chromium source tarball. No new sources, scripts, patches, or build logic were introduced, and the source remains HTTPS from the official Chromium storage endpoint. I do not see any supply-chain or privilege-escalation concerns in this diff hunk.

@@ -105,7 +105,7 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
 sha256sums=('e2654fa7c37ddc20af98f91089ad580e347ca9c526f8de8e625fe1b1cf3d98c6'
-            '626e7854f4cded52740ee337c5dd6840880bbbe61c0e40d722c385dc372f2f31'
+            '3b6528ae81cbfacc48fc4764f629d78b0ad1bba6af9d121eac9487f14a767935'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'