Review Results

Comment

The change only bumps pkgver in .SRCINFO from 151.0.7922.169 to 151.0.7922.173. No sources, build logic, install scripts, permissions, or package metadata beyond the version string changed. This is a routine upstream version update with no security-relevant red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 151.0.7922.169
+	pkgver = 151.0.7922.173
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

This is a metadata-only version bump in .SRCINFO, updating the advertised Chromium/chromedriver version and matching source tarball URL from 151.0.7922.169 to 151.0.7922.173. The source remains HTTPS on the official upstream GitHub release archive, and there are no new scripts, binaries, privilege changes, or build-time network behaviors introduced by this diff. Based on the provided hunk alone, I see no security-relevant regression.

@@ -82,13 +82,13 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=151.0.7922.169
-	provides = chromedriver=151.0.7922.169
+	provides = chromium=151.0.7922.173
+	provides = chromedriver=151.0.7922.173
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
 	source = fetch-chromium-release
-	source = ungoogled-chromium-151.0.7922.169-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/151.0.7922.169-1.tar.gz
+	source = ungoogled-chromium-151.0.7922.173-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/151.0.7922.173-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch

Comment

The change only updates a SHA-256 checksum entry in .SRCINFO for an existing patch source. There is no evidence of new sources, network fetches, privilege changes, install-script behavior, or packaging logic changes. On its face this is a metadata integrity update, likely reflecting a modified patch file content, and does not itself introduce a security issue. I did not find any red flags in the provided diff hunk.

@@ -105,7 +105,7 @@ pkgbase = ungoogled-chromium
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
 	sha256sums = 2e2f36e3cd1ebc4ad57fd310774a5e5e9db77883d5f9374fedeaabd3c103b819
-	sha256sums = c770dc1a486f2ff0d2f3873496265609a287758147c882e96f2c96733c58a741
+	sha256sums = 82478f1fabf0d56a5fe9784fe342a7a62ea2cbe3226b32fc23fba4ba89160af1
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e
 	sha256sums = 4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e

Comment

The change is a straightforward version bump in PKGBUILD metadata from 151.0.7922.169 to 151.0.7922.173, including the matching upstream ungoogled-chromium version string. No new sources, build steps, patches, install scripts, permissions changes, or network-fetching logic are introduced in this diff hunk. Based on the provided change alone, there are no security red flags.

@@ -11,14 +11,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=151.0.7922.169
+pkgver=151.0.7922.173
 pkgrel=1
 _launcher_ver=8
 _manual_clone=1
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=151.0.7922.169-1
+_uc_ver=151.0.7922.173-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"

Comment

The change is a straightforward version bump in PKGBUILD: pkgver/_uc_ver and the corresponding SHA-256 for the ungoogled-chromium source tarball were updated. No new sources, scripts, build steps, privilege changes, or packaging behavior were introduced. The only security-relevant effect is that the package now fetches a newer upstream release and verifies it with a new checksum, which is normal and low risk. I did not see any indication of malicious content in the diffed hunk.

@@ -105,7 +105,7 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
 sha256sums=('3fa13440c0c99145f6628b2cd62438da05c989469c7113b19d11425f9853f645'
-            'c770dc1a486f2ff0d2f3873496265609a287758147c882e96f2c96733c58a741'
+            '82478f1fabf0d56a5fe9784fe342a7a62ea2cbe3226b32fc23fba4ba89160af1'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'