Review Results

Comment

The change is a simple version bump in .SRCINFO from 1.21.13b to 1.21.14b with no accompanying changes to sources, checksums, build logic, install scripts, or package metadata. On its face this does not introduce any new security-relevant behavior. Risk is minimal, though a full assessment of the actual PKGBUILD/source update would be needed to evaluate the new upstream release itself.

@@ -1,6 +1,6 @@
 pkgbase = zen-browser-bin
 	pkgdesc = Official package for Zen, a privacy-focused, feature packed Firefox-based web browser
-	pkgver = 1.21.13b
+	pkgver = 1.21.14b
 	pkgrel = 1
 	url = https://github.com/zen-browser/desktop
 	arch = x86_64

Comment

The change only updates the virtual provide version in .SRCINFO from zen-browser=1.21.13b to zen-browser=1.21.14b. This is metadata-only and does not alter sources, build steps, install scripts, permissions, or runtime behavior. No security-relevant issues are introduced by this diff hunk alone.

@@ -19,7 +19,7 @@ pkgbase = zen-browser-bin
 	optdepends = pulse-native-provider: Audio support
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = hunspell-en_US: Spell checking, American English
-	provides = zen-browser=1.21.13b
+	provides = zen-browser=1.21.14b
 	conflicts = zen-browser
 	options = !strip
 	source = zen-browser.sh

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Zen Browser binaries, updating the GitHub release URLs and corresponding SHA-256 checksums for x86_64 and aarch64. The sources remain on the official upstream GitHub release domain over HTTPS, and there are no new build-time commands, install-script changes, or privilege/persistence mechanisms introduced by this diff. No security red flags are evident in the reviewed hunk.

@@ -28,9 +28,9 @@ pkgbase = zen-browser-bin
 	sha256sums = 642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db
 	sha256sums = bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6
 	sha256sums = fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f
-	source_x86_64 = zen-browser-1.21.13b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.13b/zen.linux-x86_64.tar.xz
-	sha256sums_x86_64 = d54b0b826fcdfdfe631a873c7a408cdfef684213e8a68c0fc1310c6c2ff8a6e9
-	source_aarch64 = zen-browser-1.21.13b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.13b/zen.linux-aarch64.tar.xz
-	sha256sums_aarch64 = 72c9624d830f56dd5a46482bdc646daf36bec1a2186a4f5f0856bd6d723509ac
+	source_x86_64 = zen-browser-1.21.14b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.14b/zen.linux-x86_64.tar.xz
+	sha256sums_x86_64 = b3a5bb782d9403dce8cf4cde3d61daed64548568058862eaeb9e045c212b7ee0
+	source_aarch64 = zen-browser-1.21.14b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.14b/zen.linux-aarch64.tar.xz
+	sha256sums_aarch64 = e1495dbacfbdb9b942908a5d6d31158ec1a03e77d2f9d8cfa9a068e107de5729
 
 pkgname = zen-browser-bin

Comment

The change only bumps pkgver from 1.21.13b to 1.21.14b and updates the expected SHA-256 checksums for the upstream release tarballs on x86_64 and aarch64. No build logic, install scripts, permissions, dependencies, or source URLs changed. Based on the diff provided, this is a routine version/checksum refresh with no evident security impact.

@@ -10,7 +10,7 @@
 pkgname=zen-browser-bin
 _pkgname=zen-browser
 _desktopname=zen
-pkgver=1.21.13b
+pkgver=1.21.14b
 pkgrel=1
 pkgdesc="Official package for Zen, a privacy-focused, feature packed Firefox-based web browser"
 arch=('x86_64' 'aarch64')

Comment

The change only bumps the package version and updates the expected SHA-256 checksums for the architecture-specific upstream release tarballs. The source URLs remain HTTPS and pinned to the GitHub release for the exact version, and there are no new build steps, scripts, or privilege/network changes introduced in this diff. No security-relevant behavior changes are visible in the reviewed hunk.

@@ -35,8 +35,8 @@ source=("$_pkgname.sh"
 sha256sums=('642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db'
             'bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6'
             'fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f')
-sha256sums_x86_64=('d54b0b826fcdfdfe631a873c7a408cdfef684213e8a68c0fc1310c6c2ff8a6e9')
-sha256sums_aarch64=('72c9624d830f56dd5a46482bdc646daf36bec1a2186a4f5f0856bd6d723509ac')
+sha256sums_x86_64=('b3a5bb782d9403dce8cf4cde3d61daed64548568058862eaeb9e045c212b7ee0')
+sha256sums_aarch64=('e1495dbacfbdb9b942908a5d6d31158ec1a03e77d2f9d8cfa9a068e107de5729')
 
 
 package() {