Review Results

Comment

The change only bumps pkgver in .SRCINFO from 140.12.0 to 140.13.0. No build logic, sources, checksums, install scripts, or permissions are altered in this diff. On its face this is a routine version update with no new security red flags visible in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-esr-bin
 	pkgdesc = Standalone web browser from mozilla.org - Extended Support Release
-	pkgver = 140.12.0
+	pkgver = 140.13.0
 	pkgrel = 2
 	url = http://www.mozilla.org/en-US/firefox/organizations/
 	install = firefox-esr.install

Comment

The change is a routine version bump in .SRCINFO for the Firefox ESR binary package: it updates the upstream tarball URL, provided version, and checksum to the new official Mozilla release. The source remains HTTPS on ftp.mozilla.org, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Risk is low.

@@ -14,12 +14,12 @@ pkgbase = firefox-esr-bin
 	depends = dbus-glib
 	depends = nss
 	depends = ffmpeg4.4
-	provides = firefox=140.12.0
-	source = https://ftp.mozilla.org/pub/firefox/releases/140.12.0esr/linux-x86_64/en-US/firefox-140.12.0esr.tar.xz
+	provides = firefox=140.13.0
+	source = https://ftp.mozilla.org/pub/firefox/releases/140.13.0esr/linux-x86_64/en-US/firefox-140.13.0esr.tar.xz
 	source = firefox-esr.desktop
 	source = firefox-esr-safe.desktop
 	source = policies.json
-	sha512sums = 71cbb52c78187a96034df19d1ac57a4f68316335d7918f130588b26cf93308a212f2f946510fdd8f02a8c76a1a211246a6af1d899e0c131f13bc567e33259557
+	sha512sums = 3a12a13a9f2f49224e847adeaf3032478e68d7e1d393039d9aab1016088d2068b87e99bb80d4135ed0eadc73a82c91cad62eebaea31e9c863603cd4abadf3f4d
 	sha512sums = c585f6e8ac7abfc96ad4571940b6f0dcc3f7331a18a518b4fe5d19b45e4c2d96c394524ea5c115c8fdd256c9229ea2fabeb1fc04ca7102f1626fd20728aef47d
 	sha512sums = ab2fa2e08c7a65ac0bfe169a4b579e54b038bddabf838cd3df5ab341bd77be7c101092d0123598944d2174ab3a8fbc70dfbd692b2944016efdb7a69216a74428
 	sha512sums = 5ed67bde39175d4d10d50ba5b12063961e725e94948eadb354c0588b30d3f97d2178b66c1af466a6e7bd208ab694227a1391c4141f88d3da1a1178454eba5308

Comment

The change is a simple version bump in PKGBUILD from 140.12.0 to 140.13.0 with no other build logic, source, checksum, dependency, or install-script changes in the provided hunk. By itself this does not introduce any new security risk; it only tracks a newer upstream ESR release. The only minor note is that the package metadata still uses an HTTP homepage URL, but that predates this change and is not modified here.

@@ -7,7 +7,7 @@
 
 pkgname=firefox-esr-bin
 _pkgname=${pkgname/-bin/}
-pkgver=140.12.0
+pkgver=140.13.0
 pkgrel=2
 pkgdesc='Standalone web browser from mozilla.org - Extended Support Release'
 url='http://www.mozilla.org/en-US/firefox/organizations/'

Comment

The change only updates SHA-512 checksums for the Firefox ESR source tarball (including the i686-specific checksum) while leaving the HTTPS Mozilla source URL unchanged. This is a normal integrity-update for a new upstream release and does not introduce new sources, build steps, or packaging behavior. No security red flags are evident in the provided hunk.

@@ -18,11 +18,11 @@ provides=(firefox=${pkgver})
 license=('MPL' 'GPL' 'LGPL')
 install=$_pkgname.install
 
-sha512sums=('71cbb52c78187a96034df19d1ac57a4f68316335d7918f130588b26cf93308a212f2f946510fdd8f02a8c76a1a211246a6af1d899e0c131f13bc567e33259557'
+sha512sums=('3a12a13a9f2f49224e847adeaf3032478e68d7e1d393039d9aab1016088d2068b87e99bb80d4135ed0eadc73a82c91cad62eebaea31e9c863603cd4abadf3f4d'
             'c585f6e8ac7abfc96ad4571940b6f0dcc3f7331a18a518b4fe5d19b45e4c2d96c394524ea5c115c8fdd256c9229ea2fabeb1fc04ca7102f1626fd20728aef47d'
             'ab2fa2e08c7a65ac0bfe169a4b579e54b038bddabf838cd3df5ab341bd77be7c101092d0123598944d2174ab3a8fbc70dfbd692b2944016efdb7a69216a74428'
             '5ed67bde39175d4d10d50ba5b12063961e725e94948eadb354c0588b30d3f97d2178b66c1af466a6e7bd208ab694227a1391c4141f88d3da1a1178454eba5308')
-[[ "$CARCH" == "i686" ]] && sha512sums[0]='27a3009e9667d58723b219511d9c727a128d761e20f7226fbd2dc28e9ee851234919b3a5c78e34ca308a7dcda7d72aa034f648a1fa5c5908113d265eadccf565'
+[[ "$CARCH" == "i686" ]] && sha512sums[0]='439b8829a98ec5c5c7c47f1b5815160f20748fb1166711df14888dc663e945311c7a1085fa2e44c4a5da590dcfc034774a8bd46c6b78f4f195d9e8924acc2893'
 
 source=(https://ftp.mozilla.org/pub/firefox/releases/${pkgver}esr/linux-$CARCH/en-US/firefox-${pkgver}esr.tar.xz
         $_pkgname.desktop