Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.21.8b to 1.21.9b. No build logic, sources, checksums, install scripts, or packaging behavior changed in the provided diff. On its face this is a routine version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = zen-browser-bin
 	pkgdesc = Performance oriented Firefox-based web browser
-	pkgver = 1.21.8b
+	pkgver = 1.21.9b
 	pkgrel = 1
 	url = https://github.com/zen-browser/desktop
 	arch = x86_64

Comment

The change only updates the virtual provide version in .SRCINFO from zen-browser=1.21.8b to zen-browser=1.21.9b. This is metadata-only and does not alter sources, build steps, install scripts, permissions, or package contents. No security-relevant behavior is introduced by this diff hunk.

@@ -19,7 +19,7 @@ pkgbase = zen-browser-bin
 	optdepends = pulse-native-provider: Audio support
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = hunspell-en_US: Spell checking, American English
-	provides = zen-browser=1.21.8b
+	provides = zen-browser=1.21.9b
 	conflicts = zen-browser
 	options = !strip
 	source = zen-browser.sh

Comment

The change only updates the pinned upstream release artifacts in .SRCINFO from Zen Browser 1.21.8b to 1.21.9b for x86_64 and aarch64, along with their SHA-256 checksums. The sources remain HTTPS GitHub release URLs, there is no new build-time code execution, no added scripts, and no integrity regression visible in this diff. This looks like a routine version bump with updated hashes.

@@ -28,9 +28,9 @@ pkgbase = zen-browser-bin
 	sha256sums = 642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db
 	sha256sums = bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6
 	sha256sums = fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f
-	source_x86_64 = zen-browser-1.21.8b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.8b/zen.linux-x86_64.tar.xz
-	sha256sums_x86_64 = 05a36657e4c9dbe700e54a2e3941f7af4656abbe330690aa74d8cf793af396f4
-	source_aarch64 = zen-browser-1.21.8b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.8b/zen.linux-aarch64.tar.xz
-	sha256sums_aarch64 = 0586ff279d7a1f93207fdb195c5586ef0d6813bd4f4318badcd0984adc39db39
+	source_x86_64 = zen-browser-1.21.9b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.9b/zen.linux-x86_64.tar.xz
+	sha256sums_x86_64 = f83b1467c421a2d0d53eebd2c24c747b1836f02a0d043dd8b8862392adbf6e01
+	source_aarch64 = zen-browser-1.21.9b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.9b/zen.linux-aarch64.tar.xz
+	sha256sums_aarch64 = 5b0669ae8ce40bf94ff9dec831a7bac135d6f7d2dd5f18cc8fdad86c6b3fc959
 
 pkgname = zen-browser-bin

Comment

The change only bumps pkgver from 1.21.8b to 1.21.9b in PKGBUILD. No sources, checksums, build steps, install scripts, permissions, or package metadata beyond the version string were altered. On its face this is a routine version update with no security-relevant red flags in the provided diff.

@@ -10,7 +10,7 @@
 pkgname=zen-browser-bin
 _pkgname=zen-browser
 _desktopname=zen
-pkgver=1.21.8b
+pkgver=1.21.9b
 pkgrel=1
 pkgdesc="Performance oriented Firefox-based web browser"
 arch=('x86_64' 'aarch64')

Comment

The change only bumps the package version and updates the expected SHA-256 checksums for the upstream release tarballs on x86_64 and aarch64. The source URLs remain HTTPS and pinned to a specific release tag/version, and there are no new build steps, scripts, or privilege/network changes in the PKGBUILD diff. I did not see any security-relevant regression in this hunk.

@@ -35,8 +35,8 @@ source=("$_pkgname.sh"
 sha256sums=('642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db'
             'bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6'
             'fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f')
-sha256sums_x86_64=('05a36657e4c9dbe700e54a2e3941f7af4656abbe330690aa74d8cf793af396f4')
-sha256sums_aarch64=('0586ff279d7a1f93207fdb195c5586ef0d6813bd4f4318badcd0984adc39db39')
+sha256sums_x86_64=('f83b1467c421a2d0d53eebd2c24c747b1836f02a0d043dd8b8862392adbf6e01')
+sha256sums_aarch64=('5b0669ae8ce40bf94ff9dec831a7bac135d6f7d2dd5f18cc8fdad86c6b3fc959')
 
 
 package() {