Review Results

Comment

The change only updates a dependency in .SRCINFO from ffmpeg4.4 to ffmpeg. This is a metadata-only change and does not alter build scripts, install scripts, sources, or package contents. The main effect is to broaden the runtime dependency to the current ffmpeg package, which is normal maintenance and does not introduce an obvious security issue by itself. No signs of malicious persistence, privilege escalation, or integrity bypass are present in the provided diff.

@@ -13,7 +13,7 @@ pkgbase = zen-browser-bin
 	depends = nss
 	depends = ttf-font
 	depends = systemd
-	depends = ffmpeg4.4
+	depends = ffmpeg
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = libnotify: Notification integration
 	optdepends = pulse-native-provider: Audio support

Comment

This change only swaps the runtime dependency from `ffmpeg4.4` to `ffmpeg`. That is a packaging/compatibility adjustment, not a security-sensitive behavior change. It does not introduce new sources, build-time downloads, privilege changes, install scripts, or persistence mechanisms. The main effect is to track the current ffmpeg package name/version in Arch, which is not inherently risky from a security perspective.

@@ -16,7 +16,7 @@ pkgdesc="Performance oriented Firefox-based web browser"
 arch=('x86_64' 'aarch64')
 url="https://github.com/zen-browser/desktop"
 license=(MPL-2.0)
-depends=(gtk3 libxt mime-types dbus-glib nss ttf-font systemd ffmpeg4.4)
+depends=(gtk3 libxt mime-types dbus-glib nss ttf-font systemd ffmpeg)
 optdepends=('networkmanager: Location detection via available WiFi networks'
             'libnotify: Notification integration'
             'pulse-native-provider: Audio support'