Review Results

Comment

Risk is low. The change only bumps vivaldi-snapshot to a newer upstream snapshot version and updates the corresponding SHA-512 checksum for the official HTTPS download URL. No new sources, scripts, patches, install hooks, or packaging behavior changed in this .SRCINFO diff. The package still points to the upstream Vivaldi download host and retains the existing patch source. I don’t see an integrity or privilege-escalation issue in this metadata-only update.

@@ -1,8 +1,8 @@
 # Generated by makepkg 7.1.0
-# Thu Jul 16 16:11:40 UTC 2026
+# Tue Jul 28 10:12:51 UTC 2026
 pkgbase = vivaldi-snapshot
 	pkgdesc = An advanced browser made with the power user in mind. Snapshot
-	pkgver = 8.2.4106.4
+	pkgver = 8.2.4116.3
 	pkgrel = 1
 	url = https://vivaldi.com
 	arch = x86_64

Comment

The change only updates the upstream Vivaldi snapshot RPM version and its corresponding SHA-512 checksum in .SRCINFO. This is a routine version bump with no new sources, no build-script changes, no install hooks, and no indication of added network access or privilege escalation. The source remains the official HTTPS Vivaldi download host, and the patch source/checksum entry is unchanged. Based on the provided diff, this looks safe.

@@ -36,9 +36,9 @@ pkgbase = vivaldi-snapshot
 	optdepends = upower: Battery Status API support
 	options = !strip
 	options = !zipman
-	source = https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-8.2.4106.4-1.x86_64.rpm
+	source = https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-8.2.4116.3-1.x86_64.rpm
 	source = 0001-add-support-for-user-flags.patch
-	sha512sums = 2612e5e88a30bc6122a28ae17311ce9b66d2fe03016145548decb2f275558241e9654084fc27c284beec9c988d5054b488635a9ce7228733e2eab64a0d28303c
+	sha512sums = 2e47be694ca187b160492f312efa96540d4f145bd6106279f2300a1fbd9abbefd033fbb02d6872da7694539f1d85849c2a6af69221ba9d5a69c66945a5986feb
 	sha512sums = a9bdab0fb0f394af17d1b126bae2d0cdc55e63eaa6eaf36eb994735047d3d7bc5000d75ab930f74b76b283c5addefbd4e4e63c5e4f2908bd53c270e73641c19d
 
 pkgname = vivaldi-snapshot

Comment

The change is a routine version bump in PKGBUILD: it updates the upstream Vivaldi snapshot RPM version and corresponding SHA-512 checksum, while leaving the source URL, patch list, and packaging logic unchanged. I do not see any new execution paths, network fetches beyond the existing official HTTPS upstream RPM, privilege escalation, or suspicious metadata changes. Risk is low and limited to the usual trust in the upstream binary package already present before this change.

@@ -2,8 +2,8 @@
 # Contributor: TZ86
 
 pkgname=vivaldi-snapshot
-_rpmversion=8.2.4106.4-1
-pkgver=8.2.4106.4
+_rpmversion=8.2.4116.3-1
+pkgver=8.2.4116.3
 pkgrel=1
 pkgdesc='An advanced browser made with the power user in mind. Snapshot'
 url="https://vivaldi.com"

Comment

Risk is low. The only change is an updated upstream RPM version and matching SHA-512 checksum in PKGBUILD; no new build logic, sources, permissions, or install-time behavior were introduced. The package still fetches the browser RPM over HTTPS from the official Vivaldi download host, and the patch file is unchanged. I do note the existing patch in this package allows user-controlled flags via a config file and expands them unquoted into the browser launch command, but that behavior predates this diff and is not part of the reviewed change.

@@ -42,7 +42,7 @@ optdepends=(
 )
 source=("https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-${_rpmversion}.x86_64.rpm"
         '0001-add-support-for-user-flags.patch')
-sha512sums=('2612e5e88a30bc6122a28ae17311ce9b66d2fe03016145548decb2f275558241e9654084fc27c284beec9c988d5054b488635a9ce7228733e2eab64a0d28303c'
+sha512sums=('2e47be694ca187b160492f312efa96540d4f145bd6106279f2300a1fbd9abbefd033fbb02d6872da7694539f1d85849c2a6af69221ba9d5a69c66945a5986feb'
             'a9bdab0fb0f394af17d1b126bae2d0cdc55e63eaa6eaf36eb994735047d3d7bc5000d75ab930f74b76b283c5addefbd4e4e63c5e4f2908bd53c270e73641c19d')
 
 package() {