Review Results

Comment

The change only bumps pkgver in .SRCINFO from 150.0.7871.114 to 150.0.7871.124. No sources, checksums, build logic, install scripts, or package metadata beyond the version string are altered, so there is no new security-relevant behavior to assess in this diff. Risk is minimal.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 150.0.7871.114
+	pkgver = 150.0.7871.124
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for a binary package: updated provides entries, source URL, and checksum to match the new upstream release artifact. The source remains HTTPS and points to the project’s GitHub release asset, with no new scripts, patches, install hooks, or build logic introduced. No obvious supply-chain red flags are present in this diff alone.

@@ -62,11 +62,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=150.0.7871.114
-	provides = chromedriver=150.0.7871.114
+	provides = chromium=150.0.7871.124
+	provides = chromedriver=150.0.7871.124
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/150.0.7871.114-1/ungoogled-chromium-150.0.7871.114-1-x86_64.pkg.tar.zst
-	sha256sums = fc788c968503cf10b1ffc27f80e570f4d504a7bd7683d94774a12cf28609ceaa
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/150.0.7871.124-1/ungoogled-chromium-150.0.7871.124-1-x86_64.pkg.tar.zst
+	sha256sums = df9f4cac65ec35fcb22196f1ed8267d29f4723cab7d6bcc06995921f9e167f74
 
 pkgname = ungoogled-chromium-bin

Comment

The change is a simple version bump in PKGBUILD from 150.0.7871.114 to 150.0.7871.124 with no accompanying changes to sources, build logic, install scripts, or permissions. On its face this does not introduce new attack surface or suspicious behavior. I did not see evidence in the provided diff of network fetches, script execution, privilege changes, or integrity regressions.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=150.0.7871.114
+pkgver=150.0.7871.124
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

The change only bumps the package version and updates the SHA256 for a prebuilt release artifact fetched over HTTPS from the project’s GitHub releases page. There are no new build steps, scripts, hooks, privilege changes, or additional sources. The integrity check remains pinned to a specific release asset, so this diff does not introduce an obvious supply-chain or execution risk beyond the usual trust in the upstream binary release.

@@ -54,7 +54,7 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('fc788c968503cf10b1ffc27f80e570f4d504a7bd7683d94774a12cf28609ceaa')
+sha256sums=('df9f4cac65ec35fcb22196f1ed8267d29f4723cab7d6bcc06995921f9e167f74')
 
 declare -gA _system_libs=(
     [brotli]=brotli