Review Results

Comment

The change only bumps pkgver in .SRCINFO from 151.0.7922.137 to 151.0.7922.169. No build logic, sources, checksums, install scripts, or package metadata affecting execution/persistence were changed. On its face this is a routine version update with no security-relevant red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 151.0.7922.137
+	pkgver = 151.0.7922.169
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for a binary package: it updates the provided chromium/chromedriver versions, the GitHub release asset URL, and the corresponding SHA-256 checksum. The source remains HTTPS and points to the same official upstream release location, with no new scripts, build steps, or privilege-related artifacts introduced. I do not see any security-relevant regression in this diff alone.

@@ -62,11 +62,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=151.0.7922.137
-	provides = chromedriver=151.0.7922.137
+	provides = chromium=151.0.7922.169
+	provides = chromedriver=151.0.7922.169
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/151.0.7922.137-1/ungoogled-chromium-151.0.7922.137-1-x86_64.pkg.tar.zst
-	sha256sums = 8347f39b2eb69955bbff249cb8d894c4383fd8f06ffd8cfd506c9e80c0dd12cc
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/151.0.7922.169-1/ungoogled-chromium-151.0.7922.169-1-x86_64.pkg.tar.zst
+	sha256sums = c0a30148e99ac7ed304f4bfdd8c3ecdd08879b121041cc8c1ed5399dc833ef5e
 
 pkgname = ungoogled-chromium-bin

Comment

The change only bumps pkgver from 151.0.7922.137 to 151.0.7922.169 in PKGBUILD. No source URLs, checksums, build logic, install scripts, permissions, or dependency changes are shown in the reviewed hunk, so there is no evidence of new security risk in this diff alone. This appears to be a routine version update.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=151.0.7922.137
+pkgver=151.0.7922.169
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

The change only bumps the package version and updates the SHA256 for a prebuilt release artifact downloaded over HTTPS from the project's GitHub releases page. No new sources, scripts, install hooks, or build-time execution were introduced in the diff. The main residual risk is the inherent trust in a prebuilt binary package, but this change itself does not add suspicious behavior or integrity regressions beyond replacing one verified release tarball with another.

@@ -54,7 +54,7 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('8347f39b2eb69955bbff249cb8d894c4383fd8f06ffd8cfd506c9e80c0dd12cc')
+sha256sums=('c0a30148e99ac7ed304f4bfdd8c3ecdd08879b121041cc8c1ed5399dc833ef5e')
 
 declare -gA _system_libs=(
     [brotli]=brotli