Review Results

Comment

The change only bumps the pkgver in .SRCINFO to a newer Firefox Nightly snapshot. No build logic, sources, checksums, install scripts, or permissions changed, and there are no new red flags such as network fetches, privilege escalation, or persistence mechanisms in the provided diff. Based on the diff alone, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-nightly
 	pkgdesc = Fast, Private & Safe Web Browser (Nightly version)
-	pkgver = 155.0a1+20260731.1+h1c497fb70742
+	pkgver = 155.0a1+20260808.2+h0a80cb09a671
 	pkgrel = 1
 	url = https://www.firefox.com/channel/desktop/#nightly
 	arch = x86_64

Comment

The change only adds `npm` to makedepends in .SRCINFO. By itself this does not introduce a new source, script, or privilege/persistence mechanism; it only reflects a build dependency likely needed by the package’s existing build process. I did not see any direct security red flags in this diff hunk alone.

@@ -17,6 +17,7 @@ pkgbase = firefox-nightly
 	makedepends = mesa
 	makedepends = nasm
 	makedepends = nodejs
+	makedepends = npm
 	makedepends = onnxruntime
 	makedepends = python
 	makedepends = rust

Comment

The change is a routine version bump plus adding `npm` to makedepends. I don’t see any new source URLs, build-time network fetches, install scripts, or privilege/persistence mechanisms introduced by this diff. The added dependency is a standard build tool and, by itself, is not suspicious in this context. No security issue is evident from the reviewed hunk.

@@ -3,7 +3,7 @@
 # Contributor: Jakub Schmidtke <sjakub@gmail.com>
 
 pkgname=firefox-nightly
-pkgver=155.0a1+20260731.1+h1c497fb70742
+pkgver=155.0a1+20260808.2+h0a80cb09a671
 pkgrel=1
 pkgdesc="Fast, Private & Safe Web Browser (Nightly version)"
 url="https://www.firefox.com/channel/desktop/#nightly"

Comment

The change only adds `npm` to `makedepends` in PKGBUILD. This does not alter runtime behavior, install scripts, sources, or packaging logic, and it is a normal build dependency for a Firefox Nightly package that may need Node tooling during build. No suspicious network fetches, privilege changes, persistence mechanisms, or integrity issues are introduced by this diff hunk alone.

@@ -54,6 +54,7 @@ makedepends=(
   mesa
   nasm
   nodejs
+  npm
   onnxruntime
   python
   rust