Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.93.137 to 1.93.138. No new sources, build steps, install scripts, permissions, or metadata changes are introduced in the reviewed diff. On its face this is a routine upstream version update with no security red flags visible in the provided change.

@@ -1,6 +1,6 @@
 pkgbase = brave-bin
 	pkgdesc = Web browser that blocks ads and trackers by default (binary release)
-	pkgver = 1.93.137
+	pkgver = 1.93.138
 	pkgrel = 1
 	epoch = 1
 	url = https://brave.com

Comment

The change is a straightforward version bump in .SRCINFO for the Brave binary package: updated provides/noextract/source URLs and checksums from 1.93.137 to 1.93.138. The sources remain official HTTPS GitHub release artifacts, and there are no new scripts, install hooks, privilege changes, or other suspicious packaging behaviors introduced in this diff. No security issue is evident from the reviewed hunk alone.

@@ -17,19 +17,19 @@ pkgbase = brave-bin
 	optdepends = cups: Printer support
 	optdepends = libgnome-keyring: Enable GNOME keyring support
 	optdepends = libnotify: Native notification support
-	provides = brave=1.93.137
+	provides = brave=1.93.138
 	provides = brave-browser
 	conflicts = brave
-	noextract = brave-bin-1.93.137-x86_64.zip
-	noextract = brave-bin-1.93.137-aarch64.zip
+	noextract = brave-bin-1.93.138-x86_64.zip
+	noextract = brave-bin-1.93.138-aarch64.zip
 	options = !strip
 	source = brave-bin.sh
 	source = brave-browser.desktop
 	sha256sums = 75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00
 	sha256sums = c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a
-	source_x86_64 = brave-bin-1.93.137-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.93.137/brave-browser-1.93.137-linux-amd64.zip
-	sha256sums_x86_64 = 9661795c4b961ac1697fe4fa8cadf958b9c30e39e4c8db8f3bb747679c86c2ef
-	source_aarch64 = brave-bin-1.93.137-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.93.137/brave-browser-1.93.137-linux-arm64.zip
-	sha256sums_aarch64 = bc16f5ed247670f268f502bd4624cee311381a262e8ebf65f7a187123f3b6dd8
+	source_x86_64 = brave-bin-1.93.138-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.93.138/brave-browser-1.93.138-linux-amd64.zip
+	sha256sums_x86_64 = 8c4038e3956088cbf8f658a5e39e1a88b9f710478a8449c94d1c356d8bddc82c
+	source_aarch64 = brave-bin-1.93.138-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.93.138/brave-browser-1.93.138-linux-arm64.zip
+	sha256sums_aarch64 = 4d657f1ef0f2a4b234eb37bd5c7e941317e8f20a6e274756560fb5fd0e091df7
 
 pkgname = brave-bin

Comment

The change is a simple version bump in PKGBUILD from 1.93.137 to 1.93.138 with no other modifications. Based on the provided diff hunk, there are no new sources, build steps, install scripts, permissions changes, or other security-relevant alterations to assess. This appears low risk and consistent with a routine upstream binary package update.

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.93.137
+pkgver=1.93.138
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'

Comment

The change only updates the pinned SHA-256 checksums for the prebuilt Brave ZIPs on x86_64 and aarch64. The source URLs remain HTTPS and point to the official Brave GitHub release assets, with no new build-time network access, scripts, or packaging logic changes. I did not find any indication of added persistence, privilege escalation, or integrity bypass in this hunk. Risk is low because the change is limited to expected upstream artifact refreshes, though as with any binary package the trust boundary remains the upstream release itself.

@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('9661795c4b961ac1697fe4fa8cadf958b9c30e39e4c8db8f3bb747679c86c2ef')
-sha256sums_aarch64=('bc16f5ed247670f268f502bd4624cee311381a262e8ebf65f7a187123f3b6dd8')
+sha256sums_x86_64=('8c4038e3956088cbf8f658a5e39e1a88b9f710478a8449c94d1c356d8bddc82c')
+sha256sums_aarch64=('4d657f1ef0f2a4b234eb37bd5c7e941317e8f20a6e274756560fb5fd0e091df7')
 
 prepare() {
 	mkdir -p brave