Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 150.0.7871.124 to 150.0.7871.128 with no accompanying changes to sources, build logic, install scripts, or package metadata that would introduce new attack surface. On its face this is low risk and consistent with a routine upstream update. I did not see any indicators of supply-chain tampering, persistence, privilege escalation, or build-time network abuse in the provided diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 150.0.7871.124
+	pkgver = 150.0.7871.128
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: it updates the provided chromium/chromedriver version and the upstream tarball URL from 150.0.7871.124-1 to 150.0.7871.128-1. The source remains an HTTPS GitHub release archive, and there are no new build steps, scripts, permissions changes, or other suspicious artifacts introduced by this diff. Based on the provided hunk alone, I see no security concern beyond the usual trust in the upstream release tarball already present in the package.

@@ -81,13 +81,13 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=150.0.7871.124
-	provides = chromedriver=150.0.7871.124
+	provides = chromium=150.0.7871.128
+	provides = chromedriver=150.0.7871.128
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
 	source = fetch-chromium-release
-	source = ungoogled-chromium-150.0.7871.124-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/150.0.7871.124-1.tar.gz
+	source = ungoogled-chromium-150.0.7871.128-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/150.0.7871.128-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch

Comment

This is a routine version bump in .SRCINFO for ungoogled-chromium from 150.0.7871.124 to 150.0.7871.128, with the corresponding source tarball URL, provides entries, and checksum updated. No new sources, no build-script changes, and no suspicious packaging metadata were introduced in this diff. The change appears to be a standard integrity update for a new upstream release.

@@ -105,7 +105,7 @@ pkgbase = ungoogled-chromium
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
 	sha256sums = 2e2f36e3cd1ebc4ad57fd310774a5e5e9db77883d5f9374fedeaabd3c103b819
-	sha256sums = 3b6528ae81cbfacc48fc4764f629d78b0ad1bba6af9d121eac9487f14a767935
+	sha256sums = 05a29765278d46432619390857e0d119afe08e2a8c9f06cb0c5270badd241b71
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e
 	sha256sums = 4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e

Comment

The change is a straightforward version bump in PKGBUILD metadata only: pkgver and the corresponding upstream ungoogled-chromium version string were updated from 150.0.7871.124 to 150.0.7871.128. No source URLs, checksums, build steps, install scripts, permissions, or package relationships were altered in the provided diff, and there are no new execution or persistence red flags. Based on this hunk alone, the risk is minimal.

@@ -11,14 +11,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=150.0.7871.124
+pkgver=150.0.7871.128
 pkgrel=1
 _launcher_ver=8
 _manual_clone=1
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=150.0.7871.124-1
+_uc_ver=150.0.7871.128-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"

Comment

The change is a routine version bump for ungoogled-chromium from 150.0.7871.124 to 150.0.7871.128, with the corresponding checksum update for the Chromium source tarball. No new sources, no build-script logic changes, no added network fetches, and no install/systemd/persistence artifacts are introduced in this hunk. Risk is low.

@@ -105,7 +105,7 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
 sha256sums=('e2654fa7c37ddc20af98f91089ad580e347ca9c526f8de8e625fe1b1cf3d98c6'
-            '3b6528ae81cbfacc48fc4764f629d78b0ad1bba6af9d121eac9487f14a767935'
+            '05a29765278d46432619390857e0d119afe08e2a8c9f06cb0c5270badd241b71'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'