AUR AI Reviewer

Review Results

Version #1845 of firefox-nightly · commit 9b67fb603f43 · status Reviewed

Risk 0/5 · Safe .SRCINFO
Result #1172

Comment

The only change in this .SRCINFO diff is a pkgver bump from one Firefox Nightly snapshot to a newer Nightly snapshot. There are no changes to source URLs, checksums, build steps, install scripts, permissions, or package metadata that would introduce a new security concern. Based on the provided hunk alone, this is a routine version update with no evident supply-chain or privilege-escalation risk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-nightly
 	pkgdesc = Fast, Private & Safe Web Browser (Nightly version)
-	pkgver = 155.0a1+20260722.1+h396bd39825d0
+	pkgver = 155.0a1+20260724.2+hdc7f12a8cbce
 	pkgrel = 1
 	url = https://www.firefox.com/channel/desktop/#nightly
 	arch = x86_64
Risk 0/5 · Safe .SRCINFO
Result #1173

Comment

The change only updates .SRCINFO metadata to add a new upstream patch and refresh checksums/pkgver. The added patch is a small Mozilla/Arch maintenance fix that restores a dummy gdk_display_get_default() call to keep a linker dependency under --as-needed; it does not introduce network access, privilege escalation, persistence, or packaging behavior changes. No suspicious sources or install scripts are involved in this diff.

@@ -73,16 +73,19 @@ pkgbase = firefox-nightly
 	source = firefox-nightly.desktop
 	source = org.mozilla.firefox-nightly.metainfo.xml
 	source = 0001-Install-under-remoting-name.patch
+	source = 0002-Bug-2057594-Restore-dummy-call-to-gdk_display_get_de.patch
 	validpgpkeys = 14F26682D0916CDD81E37B6D61B7B526D98F0353
 	sha256sums = SKIP
 	sha256sums = cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8
 	sha256sums = 4304902899987928ea51b7020fb1298b01fa77e327ef66ab00b061f767042b9f
 	sha256sums = 3e8161b00492e2b2a1e86c54497ba87e38af1a48ae13b97e471f9d7c2089a5d2
-	sha256sums = 844423079aa1ffc5f6ee66df2f43d27879d2a761073939747945da5409bec191
+	sha256sums = 582fa099e402827bbe8aa98fac5d0cdc0e26baef9af22852cf6b2a6bcc96a1d0
+	sha256sums = 2cca2f6b9b1299bc27edbfdfb1dcae28e95f92e86a52ebb4a72bbf1addc3aa3d
 	b2sums = SKIP
 	b2sums = f2a9cfb758692584dd8057ab30d0ed9d22f5356d0021e1c8111a061866ee66d6b2d891351e11064f904fe8c90032e78f9def61ed54ae4208c8be4de6b4226277
 	b2sums = 9c748d4c330d37d10862c73b3092c0d4308030fb62ca80da56ba9b3c3350ba4d779570308d1dd8e2c7d873f269654b72030702c5abc772aabfdfe7f39320a8b9
 	b2sums = 75669773bcbdd27bad02f7e32e9c42fa9ffad89d7d614ad3ea35bb57a21d659dabe0cf6ae3e3007fc37954c7eec3d3f5a11be1a24b9fe3655e8547e29f31f2cd
-	b2sums = 70e8bfd40bf23afa3f6de2d975aa69043cb88ae14b625702b754cd3de56215be159cf69ba4ed522ca7122b8bbdb50cfe763694e7c7595f2fdcec40bab5e2739f
+	b2sums = ac75481b855e521f94a2539bf617bab037428ba176b492ba9e81a2ee75bed9f0db59109ea06b8510ca214acfdddac420f520e940053e61cbe977c67fd7f801ce
+	b2sums = 7e07d1bc98bfe83593166495cc10ec0c222e0fffcf163eb743ea98fe07dede870e2cfe181a158f7a8e15b45eecc3b571e3f1336b4a40f2e2937b268b57ef45d1
 
 pkgname = firefox-nightly
Risk 0/5 · Safe 0001-Install-under-remoting-name.patch
Result #1174

Comment

The patch only changes Firefox Nightly’s install/remoting naming: it installs under MOZ_APP_REMOTINGNAME, updates the symlink target, and uses remotingName for DBus app naming. This is a narrow packaging/branding change with no added network access, privilege escalation, persistence, or executable payloads. I don’t see any malicious behavior in the diff or surrounding patch content.

@@ -12,7 +12,7 @@ causes conflicts between the channels.
  3 files changed, 4 insertions(+), 5 deletions(-)
 
 diff --git a/config/baseconfig.mk b/config/baseconfig.mk
-index 428beef48e14..13a609c1cfe9 100644
+index 7e5d947de6ee..204e13cb7c83 100644
 --- a/config/baseconfig.mk
 +++ b/config/baseconfig.mk
 @@ -2,7 +2,7 @@
Risk 0/5 · Safe 0002-Bug-2057594-Restore-dummy-call-to-gdk_display_get_de.patch
Result #1175

Comment

The patch is a small build/linkage fix in Firefox’s gfx test code: it restores a dummy gdk call under MOZ_WAYLAND so the linker keeps the mozgtk dependency with --as-needed, and removes an այժմ-unneeded include from glxtest.cpp. There are no signs of network access, privilege escalation, persistence, or packaging integrity issues in this change. The code path is only reached for the help option and does not introduce new runtime behavior beyond a no-op symbol reference.

@@ -0,0 +1,51 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Jan Alexander Steffens (heftig)" <heftig@archlinux.org>
+Date: Fri, 24 Jul 2026 17:40:20 +0200
+Subject: [PATCH] Bug 2057594: Restore dummy call to gdk_display_get_default
+ r?emilio
+
+---
+ toolkit/xre/gfxtest/gfxtest.cpp | 10 ++++++++++
+ toolkit/xre/gfxtest/glxtest.cpp |  1 -
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/toolkit/xre/gfxtest/gfxtest.cpp b/toolkit/xre/gfxtest/gfxtest.cpp
+index d0d519eec538..12866f126329 100644
+--- a/toolkit/xre/gfxtest/gfxtest.cpp
++++ b/toolkit/xre/gfxtest/gfxtest.cpp
+@@ -11,6 +11,10 @@
+ #  include <signal.h>
+ #endif
+ 
++#ifdef MOZ_WAYLAND
++#  include <gdk/gdk.h>
++#endif
++
+ int glxtest(bool aWayland, int aOutputFd);
+ 
+ #ifdef MOZ_ENABLE_VAAPI
+@@ -64,6 +68,12 @@ static int RunGlx(int argc, char** argv) {
+         outputFd = atoi(optarg);
+         break;
+       case 'h':
++#ifdef MOZ_WAYLAND
++        // Dummy call to mozgtk to prevent the linker from removing
++        // the dependency with --as-needed.
++        // see toolkit/library/moz.build for details.
++        gdk_display_get_default();
++#endif
+         PrintUsage();
+         return 0;
+       default:
+diff --git a/toolkit/xre/gfxtest/glxtest.cpp b/toolkit/xre/gfxtest/glxtest.cpp
+index 78263769774c..17709c0e9a3a 100644
+--- a/toolkit/xre/gfxtest/glxtest.cpp
++++ b/toolkit/xre/gfxtest/glxtest.cpp
+@@ -24,7 +24,6 @@
+ #include <stdint.h>
+ #include <inttypes.h>
+ #include <string.h>
+-#include <gdk/gdk.h>
+ 
+ #ifdef MOZ_X11
+ #  include "X11/Xlib.h"
Risk 0/5 · Safe PKGBUILD
Result #1176

Comment

The change only bumps pkgver in PKGBUILD from one Firefox Nightly snapshot to a newer Nightly snapshot. No build logic, sources, checksums, install scripts, or packaging behavior changed in the provided diff. This is a routine version update with no security-relevant red flags visible in the reviewed hunk.

@@ -3,7 +3,7 @@
 # Contributor: Jakub Schmidtke <sjakub@gmail.com>
 
 pkgname=firefox-nightly
-pkgver=155.0a1+20260722.1+h396bd39825d0
+pkgver=155.0a1+20260724.2+hdc7f12a8cbce
 pkgrel=1
 pkgdesc="Fast, Private & Safe Web Browser (Nightly version)"
 url="https://www.firefox.com/channel/desktop/#nightly"
Risk 0/5 · Safe PKGBUILD
Result #1177

Comment

The PKGBUILD change only adds a new upstream patch and updates the corresponding checksums. I reviewed the patch content: it is a small Mozilla Wayland fix that restores a dummy gdk_display_get_default() call to keep the mozgtk dependency from being dropped under --as-needed, and removes an unused include from another file. There are no signs of network fetches, privilege escalation, persistence, or packaging-time execution. The source remains an upstream bugfix patch with integrity pinned by checksums, so this looks low risk.

@@ -89,6 +89,10 @@ source=(
 
   # Make different channels installable in parallel
   0001-Install-under-remoting-name.patch
+
+  # Fix hardware rendering on Wayland
+  # https://bugzilla.mozilla.org/show_bug.cgi?id=2057594
+  0002-Bug-2057594-Restore-dummy-call-to-gdk_display_get_de.patch
 )
 validpgpkeys=(
   # Mozilla Software Releases <release@mozilla.com>
Risk 0/5 · Safe PKGBUILD
Result #1178

Comment

The change only updates the PKGBUILD to add a new upstream patch and refresh the corresponding checksums/pkgver. The patch itself is a small source-level fix for Firefox Nightly's Wayland hardware rendering, removing an include from one file and adding a dummy call to preserve a linker dependency. I do not see any supply-chain red flags: sources remain HTTPS/hg.mozilla.org, no new build-time network fetches, no privilege escalation, no install-script changes, and no suspicious binaries or obfuscated content. Risk is low.

@@ -99,12 +103,14 @@ sha256sums=('SKIP'
             'cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8'
             '4304902899987928ea51b7020fb1298b01fa77e327ef66ab00b061f767042b9f'
             '3e8161b00492e2b2a1e86c54497ba87e38af1a48ae13b97e471f9d7c2089a5d2'
-            '844423079aa1ffc5f6ee66df2f43d27879d2a761073939747945da5409bec191')
+            '582fa099e402827bbe8aa98fac5d0cdc0e26baef9af22852cf6b2a6bcc96a1d0'
+            '2cca2f6b9b1299bc27edbfdfb1dcae28e95f92e86a52ebb4a72bbf1addc3aa3d')
 b2sums=('SKIP'
         'f2a9cfb758692584dd8057ab30d0ed9d22f5356d0021e1c8111a061866ee66d6b2d891351e11064f904fe8c90032e78f9def61ed54ae4208c8be4de6b4226277'
         '9c748d4c330d37d10862c73b3092c0d4308030fb62ca80da56ba9b3c3350ba4d779570308d1dd8e2c7d873f269654b72030702c5abc772aabfdfe7f39320a8b9'
         '75669773bcbdd27bad02f7e32e9c42fa9ffad89d7d614ad3ea35bb57a21d659dabe0cf6ae3e3007fc37954c7eec3d3f5a11be1a24b9fe3655e8547e29f31f2cd'
-        '70e8bfd40bf23afa3f6de2d975aa69043cb88ae14b625702b754cd3de56215be159cf69ba4ed522ca7122b8bbdb50cfe763694e7c7595f2fdcec40bab5e2739f')
+        'ac75481b855e521f94a2539bf617bab037428ba176b492ba9e81a2ee75bed9f0db59109ea06b8510ca214acfdddac420f520e940053e61cbe977c67fd7f801ce'
+        '7e07d1bc98bfe83593166495cc10ec0c222e0fffcf163eb743ea98fe07dede870e2cfe181a158f7a8e15b45eecc3b571e3f1336b4a40f2e2937b268b57ef45d1')
 
 # Google API keys (see https://www.chromium.org/developers/how-tos/api-keys)
 # Note: These are for Arch Linux use ONLY. For your own distribution, please