Review Results

Comment

The change is low risk. It only updates .SRCINFO metadata for a newer Firefox Nightly snapshot and adjusts an optional spellchecking dependency from a locale-specific hunspell package to a generic dictionary package. There are no new sources, build steps, scripts, permissions changes, or install-time actions introduced here, and no evidence of malicious behavior in this diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-nightly
 	pkgdesc = Fast, Private & Safe Web Browser (Nightly version)
-	pkgver = 155.0a1+20260725.1+hdb59e73163ec
+	pkgver = 155.0a1+20260731.1+h1c497fb70742
 	pkgrel = 1
 	url = https://www.firefox.com/channel/desktop/#nightly
 	arch = x86_64

Comment

The change is limited to .SRCINFO metadata and only alters an optional dependency description from `hunspell-en_US` to `hunspell-dictionary`. This does not affect build inputs, installed files, scripts, permissions, or runtime behavior of the package itself. No security-relevant red flags are introduced by this metadata-only update.

@@ -58,7 +58,7 @@ pkgbase = firefox-nightly
 	depends = nss
 	depends = pango
 	depends = ttf-font
-	optdepends = hunspell-en_US: Spell checking, American English
+	optdepends = hunspell-dictionary: Spell checking
 	optdepends = libnotify: Notification integration
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = onnxruntime: Local machine learning features such as smart tab groups

Comment

The change is a routine version bump of the Firefox Nightly package from one upstream hg revision/date to a newer one, plus an optdepends wording update from a specific hunspell package to the generic dictionary virtual package. I do not see any new sources, build-time network fetches, privilege escalation, install scripts, systemd units, or other packaging behavior changes in the reviewed hunk. The PKGBUILD still points to the official Mozilla hg repository over HTTPS and remains pinned to a specific revision via the pkgver. Risk is therefore minimal.

@@ -3,7 +3,7 @@
 # Contributor: Jakub Schmidtke <sjakub@gmail.com>
 
 pkgname=firefox-nightly
-pkgver=155.0a1+20260725.1+hdb59e73163ec
+pkgver=155.0a1+20260731.1+h1c497fb70742
 pkgrel=1
 pkgdesc="Fast, Private & Safe Web Browser (Nightly version)"
 url="https://www.firefox.com/channel/desktop/#nightly"

Comment

The change only adjusts an optdepends entry from 'hunspell-en_US' to the generic 'hunspell-dictionary'. This is a metadata-only packaging change with no code execution, no new sources, no privilege changes, and no install-script or systemd impact. It does not introduce a supply-chain or persistence risk by itself.

@@ -67,7 +67,7 @@ makedepends=(
   zip
 )
 optdepends=(
-  'hunspell-en_US: Spell checking, American English'
+  'hunspell-dictionary: Spell checking'
   'libnotify: Notification integration'
   'networkmanager: Location detection via available WiFi networks'
   'onnxruntime: Local machine learning features such as smart tab groups'