Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.21.7b to 1.21.8b. No build logic, sources, checksums, install scripts, or permissions are altered in the reviewed diff, so there is no direct security impact visible here. Risk is minimal.

@@ -1,6 +1,6 @@
 pkgbase = zen-browser-bin
 	pkgdesc = Performance oriented Firefox-based web browser
-	pkgver = 1.21.7b
+	pkgver = 1.21.8b
 	pkgrel = 1
 	url = https://github.com/zen-browser/desktop
 	arch = x86_64

Comment

This is a minimal metadata-only update in .SRCINFO, changing the provided virtual package version from 1.21.7b to 1.21.8b. No build logic, sources, install scripts, permissions, or systemd/persistence-related artifacts are affected. I see no security-relevant behavior introduced by this change.

@@ -19,7 +19,7 @@ pkgbase = zen-browser-bin
 	optdepends = pulse-native-provider: Audio support
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = hunspell-en_US: Spell checking, American English
-	provides = zen-browser=1.21.7b
+	provides = zen-browser=1.21.8b
 	conflicts = zen-browser
 	options = !strip
 	source = zen-browser.sh

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Zen Browser binaries, updating the GitHub release URLs and corresponding SHA-256 checksums for x86_64 and aarch64. I do not see any new red flags such as added build-time network fetches, suspicious mirrors, privilege escalation, or install-script changes in this diff. The package remains pinned to an official GitHub release asset and the integrity hashes were updated accordingly. Risk is low because this is metadata-only and consistent with a normal upstream release update.

@@ -28,9 +28,9 @@ pkgbase = zen-browser-bin
 	sha256sums = 642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db
 	sha256sums = bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6
 	sha256sums = fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f
-	source_x86_64 = zen-browser-1.21.7b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.7b/zen.linux-x86_64.tar.xz
-	sha256sums_x86_64 = fcc3a1fd55e854bbe7daeb77bca00506792b1977ca16e8670f9923bc273bf370
-	source_aarch64 = zen-browser-1.21.7b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.7b/zen.linux-aarch64.tar.xz
-	sha256sums_aarch64 = 48d913a6ca7946061fdc7c5bcf730d71adda5b813d0200b8402da5fec0a7548e
+	source_x86_64 = zen-browser-1.21.8b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.8b/zen.linux-x86_64.tar.xz
+	sha256sums_x86_64 = 05a36657e4c9dbe700e54a2e3941f7af4656abbe330690aa74d8cf793af396f4
+	source_aarch64 = zen-browser-1.21.8b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.8b/zen.linux-aarch64.tar.xz
+	sha256sums_aarch64 = 0586ff279d7a1f93207fdb195c5586ef0d6813bd4f4318badcd0984adc39db39
 
 pkgname = zen-browser-bin

Comment

The change only bumps pkgver from 1.21.7b to 1.21.8b in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or packaging logic changed in the provided diff, so there is no new security concern visible in this hunk. Risk is minimal.

@@ -10,7 +10,7 @@
 pkgname=zen-browser-bin
 _pkgname=zen-browser
 _desktopname=zen
-pkgver=1.21.7b
+pkgver=1.21.8b
 pkgrel=1
 pkgdesc="Performance oriented Firefox-based web browser"
 arch=('x86_64' 'aarch64')

Comment

The change only updates the pinned upstream release version and the expected SHA-256 checksums for the architecture-specific release tarballs. The source URLs remain HTTPS and point to the official GitHub release assets for the project, with no new build-time execution, network fetches, or packaging logic changes. I do not see any new supply-chain or privilege-escalation risk in this diff alone.

@@ -35,8 +35,8 @@ source=("$_pkgname.sh"
 sha256sums=('642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db'
             'bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6'
             'fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f')
-sha256sums_x86_64=('fcc3a1fd55e854bbe7daeb77bca00506792b1977ca16e8670f9923bc273bf370')
-sha256sums_aarch64=('48d913a6ca7946061fdc7c5bcf730d71adda5b813d0200b8402da5fec0a7548e')
+sha256sums_x86_64=('05a36657e4c9dbe700e54a2e3941f7af4656abbe330690aa74d8cf793af396f4')
+sha256sums_aarch64=('0586ff279d7a1f93207fdb195c5586ef0d6813bd4f4318badcd0984adc39db39')
 
 
 package() {