Review Results

Comment

The change only bumps pkgver in .SRCINFO from 150.0.7871.124 to 150.0.7871.128. No build logic, sources, checksums, install scripts, or packaging metadata beyond the version number changed. On its face this is a routine version update with no security-relevant red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 150.0.7871.124
+	pkgver = 150.0.7871.128
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for an AUR -bin package: it updates the provided Chromium/Chromedriver versions and the pinned GitHub release asset URL plus checksum. The source remains HTTPS and points to the upstream ungoogled-chromium-archlinux release, with no new build-time execution, install-script, or privilege-related behavior introduced by this diff. No suspicious metadata changes (conflicts/provides/replaces) beyond the expected version alignment are present. Risk is therefore very low.

@@ -62,11 +62,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=150.0.7871.124
-	provides = chromedriver=150.0.7871.124
+	provides = chromium=150.0.7871.128
+	provides = chromedriver=150.0.7871.128
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/150.0.7871.124-1/ungoogled-chromium-150.0.7871.124-1-x86_64.pkg.tar.zst
-	sha256sums = df9f4cac65ec35fcb22196f1ed8267d29f4723cab7d6bcc06995921f9e167f74
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/150.0.7871.128-1/ungoogled-chromium-150.0.7871.128-1-x86_64.pkg.tar.zst
+	sha256sums = 1d5d02c177eec2fb253d90a5c96bb2f4b581f5a6a93a36cb2365982d43c75b3a
 
 pkgname = ungoogled-chromium-bin

Comment

This change only bumps the packaged Chromium version from 150.0.7871.124 to 150.0.7871.128 and updates the corresponding SHA-256 for the prebuilt release tarball. The source remains an HTTPS GitHub release asset from the same upstream project, with no new build logic, scripts, or packaging behavior introduced. No additional integrity, persistence, or privilege-related concerns are visible in this diff.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=150.0.7871.124
+pkgver=150.0.7871.128
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

The change is a routine version bump in a binary package: pkgver advances from 150.0.7871.124 to 150.0.7871.128 and the SHA-256 checksum is updated accordingly. The source remains the same official GitHub release URL over HTTPS, with no new build steps, scripts, patches, or privilege-related changes. I don’t see any supply-chain red flags in this diff alone.

@@ -54,7 +54,7 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('df9f4cac65ec35fcb22196f1ed8267d29f4723cab7d6bcc06995921f9e167f74')
+sha256sums=('1d5d02c177eec2fb253d90a5c96bb2f4b581f5a6a93a36cb2365982d43c75b3a')
 
 declare -gA _system_libs=(
     [brotli]=brotli