Review Results

Comment

The change is limited to metadata in .SRCINFO: it updates the nightly version and changes the homepage URL from Mozilla's official Firefox Nightly page to firefox.com. The version bump itself is expected for a nightly package, but the URL change is a supply-chain red flag because it moves from the established Mozilla domain to a different domain that could be used for typosquatting or redirection. I did not see any code execution, install-script, or packaging behavior changes in this diff, so the risk is low, but the homepage metadata should be verified against upstream packaging conventions.

@@ -1,8 +1,8 @@
 pkgbase = firefox-nightly
 	pkgdesc = Fast, Private & Safe Web Browser (Nightly version)
-	pkgver = 154.0a1+20260718.1+h1daac5fa8f14
+	pkgver = 155.0a1+20260722.1+h396bd39825d0
 	pkgrel = 1
-	url = https://www.mozilla.org/firefox/channel/desktop/#nightly
+	url = https://www.firefox.com/channel/desktop/#nightly
 	arch = x86_64
 	license = MPL-2.0
 	makedepends = cbindgen

Comment

The change is limited to .SRCINFO metadata for a routine Firefox Nightly version bump and checksum refresh. The only notable non-checksum change is the homepage URL moving from mozilla.org to firefox.com, which is still an official Mozilla domain and does not introduce a supply-chain or execution risk by itself. No build logic, install scripts, or shipped artifacts are changed here, and the updated hashes are expected for the new upstream tarballs.

@@ -77,12 +77,12 @@ pkgbase = firefox-nightly
 	sha256sums = SKIP
 	sha256sums = cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8
 	sha256sums = 4304902899987928ea51b7020fb1298b01fa77e327ef66ab00b061f767042b9f
-	sha256sums = 9649563e8703b4f4b43469029fe20e3bd0c1209dbaa4c2d664c00e089abd7fa0
+	sha256sums = 3e8161b00492e2b2a1e86c54497ba87e38af1a48ae13b97e471f9d7c2089a5d2
 	sha256sums = 844423079aa1ffc5f6ee66df2f43d27879d2a761073939747945da5409bec191
 	b2sums = SKIP
 	b2sums = f2a9cfb758692584dd8057ab30d0ed9d22f5356d0021e1c8111a061866ee66d6b2d891351e11064f904fe8c90032e78f9def61ed54ae4208c8be4de6b4226277
 	b2sums = 9c748d4c330d37d10862c73b3092c0d4308030fb62ca80da56ba9b3c3350ba4d779570308d1dd8e2c7d873f269654b72030702c5abc772aabfdfe7f39320a8b9
-	b2sums = 561d6fd3b394eee3242c1db12c0520e865488b3e5c1943a398994857b1fcad520ed4387ea93bc9402356649a0b3db6911bcd3a9f8d388bbe88a58a2efec0aa14
+	b2sums = 75669773bcbdd27bad02f7e32e9c42fa9ffad89d7d614ad3ea35bb57a21d659dabe0cf6ae3e3007fc37954c7eec3d3f5a11be1a24b9fe3655e8547e29f31f2cd
 	b2sums = 70e8bfd40bf23afa3f6de2d975aa69043cb88ae14b625702b754cd3de56215be159cf69ba4ed522ca7122b8bbdb50cfe763694e7c7595f2fdcec40bab5e2739f
 
 pkgname = firefox-nightly

Comment

The change is a routine Firefox Nightly version bump plus checksum updates and a URL metadata correction from mozilla.org to firefox.com. I do not see any new build logic, network fetches, install scripts, privilege changes, or suspicious sources introduced in this diff. The only substantive security-relevant change is the source/version update, which is expected for a nightly package and is still pinned by checksums. Risk is low.

@@ -3,10 +3,10 @@
 # Contributor: Jakub Schmidtke <sjakub@gmail.com>
 
 pkgname=firefox-nightly
-pkgver=154.0a1+20260718.1+h1daac5fa8f14
+pkgver=155.0a1+20260722.1+h396bd39825d0
 pkgrel=1
 pkgdesc="Fast, Private & Safe Web Browser (Nightly version)"
-url="https://www.mozilla.org/firefox/channel/desktop/#nightly"
+url="https://www.firefox.com/channel/desktop/#nightly"
 arch=(x86_64)
 license=(MPL-2.0)
 depends=(

Comment

The change is low risk. It updates the package version, switches the project homepage from mozilla.org to firefox.com, and refreshes checksums for one source artifact. There are no new build steps, no added network fetches, no script changes, and no evidence of malicious payloads or privilege/persistence mechanisms. The only thing to note is that the URL change is cosmetic and the checksum updates should be consistent with the new upstream nightly release.

@@ -98,12 +98,12 @@ validpgpkeys=(
 sha256sums=('SKIP'
             'cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8'
             '4304902899987928ea51b7020fb1298b01fa77e327ef66ab00b061f767042b9f'
-            '9649563e8703b4f4b43469029fe20e3bd0c1209dbaa4c2d664c00e089abd7fa0'
+            '3e8161b00492e2b2a1e86c54497ba87e38af1a48ae13b97e471f9d7c2089a5d2'
             '844423079aa1ffc5f6ee66df2f43d27879d2a761073939747945da5409bec191')
 b2sums=('SKIP'
         'f2a9cfb758692584dd8057ab30d0ed9d22f5356d0021e1c8111a061866ee66d6b2d891351e11064f904fe8c90032e78f9def61ed54ae4208c8be4de6b4226277'
         '9c748d4c330d37d10862c73b3092c0d4308030fb62ca80da56ba9b3c3350ba4d779570308d1dd8e2c7d873f269654b72030702c5abc772aabfdfe7f39320a8b9'
-        '561d6fd3b394eee3242c1db12c0520e865488b3e5c1943a398994857b1fcad520ed4387ea93bc9402356649a0b3db6911bcd3a9f8d388bbe88a58a2efec0aa14'
+        '75669773bcbdd27bad02f7e32e9c42fa9ffad89d7d614ad3ea35bb57a21d659dabe0cf6ae3e3007fc37954c7eec3d3f5a11be1a24b9fe3655e8547e29f31f2cd'
         '70e8bfd40bf23afa3f6de2d975aa69043cb88ae14b625702b754cd3de56215be159cf69ba4ed522ca7122b8bbdb50cfe763694e7c7595f2fdcec40bab5e2739f')
 
 # Google API keys (see https://www.chromium.org/developers/how-tos/api-keys)

Comment

The change only updates the metainfo homepage URL from Mozilla's official Nightly page to firefox.com/channel/desktop/#nightly. This is still an HTTPS URL and does not affect build logic, package contents, permissions, or runtime behavior. The new domain appears to be a Mozilla-controlled marketing/domain alias rather than an obviously malicious or typosquatted host, and the rest of the metadata remains unchanged. No security-relevant issue is evident from this diff alone.

@@ -46,7 +46,7 @@
     <keyword>web</keyword>
   </keywords>
   <content_rating type="oars-1.1" />
-  <url type="homepage">https://www.mozilla.org/firefox/channel/desktop/#nightly</url>
+  <url type="homepage">https://www.firefox.com/channel/desktop/#nightly</url>
   <url type="donation">https://donate.mozilla.org/</url>
   <url type="bugtracker">https://bugzilla.mozilla.org/</url>
   <url type="help">https://support.mozilla.org/</url>