Review Results

Comment

This .SRCINFO-only update is a routine version bump for a binary Firefox ESR package: it updates pkgver/pkgrel, the Mozilla release tarball URL, the provided virtual package version, and the corresponding checksum. The source remains the official Mozilla HTTPS release host, and there are no new build-time commands, install-script changes, or packaging red flags in the diff. One minor note is that the pkgdesc still says ESR while the version is 153.0, but that is consistent with Firefox ESR release numbering and not a security issue in itself.

@@ -1,7 +1,7 @@
 pkgbase = firefox-esr-bin
 	pkgdesc = Standalone web browser from mozilla.org - Extended Support Release
-	pkgver = 140.13.0
-	pkgrel = 2
+	pkgver = 153.0
+	pkgrel = 1
 	url = http://www.mozilla.org/en-US/firefox/organizations/
 	install = firefox-esr.install
 	arch = i686

Comment

This is a routine version bump in .SRCINFO for an AUR binary package: the Firefox ESR tarball URL is updated from 140.13.0esr to 153.0esr and the corresponding checksum/provides entry is changed. The source remains the official Mozilla HTTPS release URL, there are no new build-time commands, scripts, privileges, or packaging behaviors introduced in the diff hunk. No security red flags are evident from this change alone.

@@ -14,12 +14,12 @@ pkgbase = firefox-esr-bin
 	depends = dbus-glib
 	depends = nss
 	depends = ffmpeg4.4
-	provides = firefox=140.13.0
-	source = https://ftp.mozilla.org/pub/firefox/releases/140.13.0esr/linux-x86_64/en-US/firefox-140.13.0esr.tar.xz
+	provides = firefox=153.0
+	source = https://ftp.mozilla.org/pub/firefox/releases/153.0esr/linux-x86_64/en-US/firefox-153.0esr.tar.xz
 	source = firefox-esr.desktop
 	source = firefox-esr-safe.desktop
 	source = policies.json
-	sha512sums = 3a12a13a9f2f49224e847adeaf3032478e68d7e1d393039d9aab1016088d2068b87e99bb80d4135ed0eadc73a82c91cad62eebaea31e9c863603cd4abadf3f4d
+	sha512sums = eea6a3ca2fdd93ae8f2a7e21c8792372faccb8591588cc983aacdebb34b0735f8d26eff54b6a6185dce9160add27052bef05a6a635ec286f184579d75cbcd6db
 	sha512sums = c585f6e8ac7abfc96ad4571940b6f0dcc3f7331a18a518b4fe5d19b45e4c2d96c394524ea5c115c8fdd256c9229ea2fabeb1fc04ca7102f1626fd20728aef47d
 	sha512sums = ab2fa2e08c7a65ac0bfe169a4b579e54b038bddabf838cd3df5ab341bd77be7c101092d0123598944d2174ab3a8fbc70dfbd692b2944016efdb7a69216a74428
 	sha512sums = 5ed67bde39175d4d10d50ba5b12063961e725e94948eadb354c0588b30d3f97d2178b66c1af466a6e7bd208ab694227a1391c4141f88d3da1a1178454eba5308

Comment

The only change in this diff is a version bump from 140.13.0 to 153.0 with a corresponding checksum update. The source remains the official Mozilla HTTPS release tarball, and there are no new build steps, scripts, patches, or privilege/network red flags introduced by this hunk. I did note the PKGBUILD still uses an HTTP homepage URL, but that is pre-existing and unchanged in this diff. Overall this change looks like a routine upstream version update with no added security risk.

@@ -7,8 +7,8 @@
 
 pkgname=firefox-esr-bin
 _pkgname=${pkgname/-bin/}
-pkgver=140.13.0
-pkgrel=2
+pkgver=153.0
+pkgrel=1
 pkgdesc='Standalone web browser from mozilla.org - Extended Support Release'
 url='http://www.mozilla.org/en-US/firefox/organizations/'
 arch=('i686' 'x86_64')

Comment

The change is limited to updating the Firefox ESR version and its source checksum in PKGBUILD. The source remains the official Mozilla HTTPS FTP mirror, and there are no new build steps, scripts, or privilege-related changes. I did note the package still uses an HTTP homepage URL in metadata, but that predates this change and is not part of the diff. No security-relevant regression is introduced by this hunk.

@@ -18,7 +18,7 @@ provides=(firefox=${pkgver})
 license=('MPL' 'GPL' 'LGPL')
 install=$_pkgname.install
 
-sha512sums=('3a12a13a9f2f49224e847adeaf3032478e68d7e1d393039d9aab1016088d2068b87e99bb80d4135ed0eadc73a82c91cad62eebaea31e9c863603cd4abadf3f4d'
+sha512sums=('eea6a3ca2fdd93ae8f2a7e21c8792372faccb8591588cc983aacdebb34b0735f8d26eff54b6a6185dce9160add27052bef05a6a635ec286f184579d75cbcd6db'
             'c585f6e8ac7abfc96ad4571940b6f0dcc3f7331a18a518b4fe5d19b45e4c2d96c394524ea5c115c8fdd256c9229ea2fabeb1fc04ca7102f1626fd20728aef47d'
             'ab2fa2e08c7a65ac0bfe169a4b579e54b038bddabf838cd3df5ab341bd77be7c101092d0123598944d2174ab3a8fbc70dfbd692b2944016efdb7a69216a74428'
             '5ed67bde39175d4d10d50ba5b12063961e725e94948eadb354c0588b30d3f97d2178b66c1af466a6e7bd208ab694227a1391c4141f88d3da1a1178454eba5308')