Review Results

Comment

The change only bumps pkgver in .SRCINFO from 153.0.0_3 to 153.0.1_1, with no accompanying source, build, install-script, or metadata changes shown. On its face this is a routine version update and does not introduce any new security-relevant behavior in the reviewed diff. No red flags are visible in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = librewolf
 	pkgdesc = Community-maintained fork of Firefox, focused on privacy, security and freedom.
-	pkgver = 153.0.0_3
+	pkgver = 153.0.1_1
 	pkgrel = 1
 	epoch = 1
 	url = https://librewolf.net/

Comment

The change only updates the Librewolf source tarball URL and its SHA-256 checksum for a new upstream release (153.0-3 -> 153.0.1-1). The source remains on HTTPS from the same upstream Codeberg package endpoint, and there are no new build-time commands, scripts, permissions changes, or integrity regressions visible in this .SRCINFO-only diff. No obvious security issue is introduced by this metadata update alone.

@@ -73,12 +73,12 @@ pkgbase = librewolf
 	options = !makeflags
 	backup = usr/lib/librewolf/librewolf.cfg
 	backup = usr/lib/librewolf/distribution/policies.json
-	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/153.0-3/librewolf-153.0-3.source.tar.gz
-	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/153.0-3/librewolf-153.0-3.source.tar.gz.sig
+	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/153.0.1-1/librewolf-153.0.1-1.source.tar.gz
+	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/153.0.1-1/librewolf-153.0.1-1.source.tar.gz.sig
 	source = librewolf.desktop
 	source = default192x192.png
 	validpgpkeys = 662E3CDD6FE329002D0CA5BB40339DD82B12EF16
-	sha256sums = 48ace24a1d6af6c65e3a663402e7b0af154ff7206ab76fbe5c08311a745e39e3
+	sha256sums = 4c0c110b08b71375db967ebab583ad03d9d659fe1f4a42e14f9f4dbbf8e04c9d
 	sha256sums = SKIP
 	sha256sums = 3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae
 	sha256sums = 959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1

Comment

Low risk. The change is a routine version bump in PKGBUILD from 153.0.0_3 to 153.0.1_1 with the corresponding source checksum update. I do not see any new sources, build-time network access, privilege escalation, install-script changes, or other suspicious packaging behavior in this diff. The only security-relevant effect is that the package will now build a newer upstream release, which is expected.

@@ -7,7 +7,7 @@
 pkgname=librewolf
 _pkgname=LibreWolf
 epoch=1
-pkgver=153.0.0_3
+pkgver=153.0.1_1
 _fixedfirefoxver="${pkgver%_*}" # Version of Firefox this LibreWolf version is based on, but the Firefox patch number is always included
 _librewolfver="${pkgver#*_}"
 _firefoxver="${_fixedfirefoxver%.0}" # Removes ".0" from the end. For "136.0.0" this will result in "136.0" but for "136.0.1" won't do anything.

Comment

Risk is low. The change only updates the package version and the SHA-256 checksum for the corresponding source tarball in PKGBUILD. There are no new sources, no build-script logic changes, no network or privilege-related additions, and no suspicious packaging metadata changes. This looks like a routine upstream release refresh with integrity verification updated accordingly.

@@ -111,7 +111,7 @@ source=(
   "default192x192.png"
 )
 
-sha256sums=('48ace24a1d6af6c65e3a663402e7b0af154ff7206ab76fbe5c08311a745e39e3'
+sha256sums=('4c0c110b08b71375db967ebab583ad03d9d659fe1f4a42e14f9f4dbbf8e04c9d'
             'SKIP'
             '3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae'
             '959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1')