Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump from 150.0.7871.128 to 150.0.7871.181. No sources, checksums, build logic, install scripts, or permissions are changed here, so there is no direct security signal in the diff itself. This is a routine version update and appears low risk based on the provided hunk alone.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 150.0.7871.128
+	pkgver = 150.0.7871.181
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

Risk is low. This change only bumps the package version and updates the corresponding source tarball URL and checksum in .SRCINFO. The source remains an HTTPS GitHub release archive from the same upstream project, with no new scripts, build logic, permissions changes, or install-time behavior. I do not see any supply-chain or privilege-escalation concern in this diff alone.

@@ -81,13 +81,13 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=150.0.7871.128
-	provides = chromedriver=150.0.7871.128
+	provides = chromium=150.0.7871.181
+	provides = chromedriver=150.0.7871.181
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
 	source = fetch-chromium-release
-	source = ungoogled-chromium-150.0.7871.128-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/150.0.7871.128-1.tar.gz
+	source = ungoogled-chromium-150.0.7871.181-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/150.0.7871.181-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch

Comment

The change is a routine version bump in .SRCINFO: pkgver/provides and the pinned source tarball URL/hash are updated from 150.0.7871.128 to 150.0.7871.181. The source remains HTTPS and still points to the upstream GitHub release archive, with the checksum updated accordingly. No new sources, scripts, build steps, or privilege-related metadata were introduced in this diff. Risk is low and limited to the usual trust in the new upstream release artifact.

@@ -105,7 +105,7 @@ pkgbase = ungoogled-chromium
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
 	sha256sums = 2e2f36e3cd1ebc4ad57fd310774a5e5e9db77883d5f9374fedeaabd3c103b819
-	sha256sums = 05a29765278d46432619390857e0d119afe08e2a8c9f06cb0c5270badd241b71
+	sha256sums = eda41e7953d0202f5d3d2872a9f13cb699e76b1fc957a91723eaeb3bec946e27
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e
 	sha256sums = 4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e

Comment

The change is a straightforward version bump in PKGBUILD: pkgver/_uc_ver are updated and the source checksum for the ungoogled-chromium tarball is refreshed. The source URLs remain HTTPS and pinned to a specific release tarball, with no new build steps, scripts, or privilege/network changes introduced by this diff. I did not see any security-relevant packaging behavior altered here beyond fetching a newer upstream release, so the risk is low.

@@ -11,14 +11,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=150.0.7871.128
+pkgver=150.0.7871.181
 pkgrel=1
 _launcher_ver=8
 _manual_clone=1
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=150.0.7871.128-1
+_uc_ver=150.0.7871.181-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"

Comment

Risk score 0/5. The change only updates the pkgver/_uc_ver fields and the SHA-256 checksum for the corresponding ungoogled-chromium source tarball. No build logic, install scripts, permissions, dependencies, or network behavior changed. The source URLs remain HTTPS and pinned to specific release artifacts, and there are no new red flags such as added patches, binaries, or execution steps.

@@ -105,7 +105,7 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
 sha256sums=('e2654fa7c37ddc20af98f91089ad580e347ca9c526f8de8e625fe1b1cf3d98c6'
-            '05a29765278d46432619390857e0d119afe08e2a8c9f06cb0c5270badd241b71'
+            'eda41e7953d0202f5d3d2872a9f13cb699e76b1fc957a91723eaeb3bec946e27'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'