Review Results

Comment

The change only bumps pkgver in .SRCINFO from 150.0.7871.181 to 150.0.7871.186. .SRCINFO is metadata used by AUR helpers and does not itself introduce build logic, network access, or privilege changes. No suspicious sources, scripts, or packaging directives are altered in the provided diff hunk. Based on this hunk alone, the risk is minimal.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 150.0.7871.181
+	pkgver = 150.0.7871.186
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

This .SRCINFO-only change is a routine version bump from 150.0.7871.181 to 150.0.7871.186, updating the pkgver/provides fields, the upstream tarball URL, and the corresponding checksum entry. The source remains an HTTPS GitHub release archive from the same upstream project, with no new sources, scripts, patches, or build logic introduced. I do not see any integrity or execution red flags in this diff alone.

@@ -81,13 +81,13 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=150.0.7871.181
-	provides = chromedriver=150.0.7871.181
+	provides = chromium=150.0.7871.186
+	provides = chromedriver=150.0.7871.186
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
 	source = fetch-chromium-release
-	source = ungoogled-chromium-150.0.7871.181-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/150.0.7871.181-1.tar.gz
+	source = ungoogled-chromium-150.0.7871.186-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/150.0.7871.186-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch

Comment

The change is a routine version bump in .SRCINFO: pkgver/provides/source filename and one corresponding SHA-256 checksum were updated to match the new upstream release tarball. There are no new sources, no build-script changes, no added execution paths, and no signs of integrity weakening beyond the expected checksum refresh for the renamed release archive. Based on the diff alone, this is low risk.

@@ -105,7 +105,7 @@ pkgbase = ungoogled-chromium
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
 	sha256sums = 2e2f36e3cd1ebc4ad57fd310774a5e5e9db77883d5f9374fedeaabd3c103b819
-	sha256sums = eda41e7953d0202f5d3d2872a9f13cb699e76b1fc957a91723eaeb3bec946e27
+	sha256sums = f40444c3f7ecf63ed5bfe01944e23ebe9d0d6246ce99f5d2adad0728dc35164f
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e
 	sha256sums = 4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e

Comment

The change is a routine version bump in PKGBUILD: pkgver/_uc_ver are updated from 150.0.7871.181 to 150.0.7871.186, and the corresponding source tarball checksum is refreshed. No new sources, URLs, build steps, permissions, or install-time behavior were introduced. The package still fetches from the same HTTPS upstream locations and the diff does not add any suspicious execution or persistence mechanisms. Risk is therefore very low.

@@ -11,14 +11,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=150.0.7871.181
+pkgver=150.0.7871.186
 pkgrel=1
 _launcher_ver=8
 _manual_clone=1
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=150.0.7871.181-1
+_uc_ver=150.0.7871.186-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"

Comment

The change only updates the package version and the checksum for an existing source tarball. I did not see any new source URLs, build steps, install scripts, privilege changes, or other behavior changes. The modified checksum corresponds to the ungoogled-chromium release archive, so this appears to be a routine upstream version bump with no security red flags in the diff provided.

@@ -105,7 +105,7 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
 sha256sums=('e2654fa7c37ddc20af98f91089ad580e347ca9c526f8de8e625fe1b1cf3d98c6'
-            'eda41e7953d0202f5d3d2872a9f13cb699e76b1fc957a91723eaeb3bec946e27'
+            'f40444c3f7ecf63ed5bfe01944e23ebe9d0d6246ce99f5d2adad0728dc35164f'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'