Review Results

Comment

The change is a routine version bump in .SRCINFO for microsoft-edge-stable-bin, updating the package version, Microsoft-hosted .deb URL, and corresponding checksum. The source remains HTTPS on the official Microsoft package repository, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Risk is low because the only security-relevant aspect is trusting the upstream binary release, which is already inherent to this -bin package and unchanged in kind.

@@ -1,6 +1,6 @@
 pkgbase = microsoft-edge-stable-bin
 	pkgdesc = A browser that combines a minimal design with sophisticated technology to make the web faster, safer, and easier
-	pkgver = 151.0.4129.107
+	pkgver = 152.0.4191.53
 	pkgrel = 1
 	url = https://www.microsoftedgeinsider.com/en-us/download
 	arch = x86_64

Comment

Risk is low. This change only bumps the packaged Microsoft Edge stable version in .SRCINFO and updates the corresponding SHA-256 for the upstream .deb source. The source remains an HTTPS URL on Microsoft’s official package repository, with no new sources, scripts, install hooks, or build logic introduced. No evidence of privilege escalation, persistence, or integrity bypass in this diff.

@@ -29,10 +29,10 @@ pkgbase = microsoft-edge-stable-bin
 	conflicts = edge
 	options = !strip
 	options = !zipman
-	source = https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_151.0.4129.107-1_amd64.deb
+	source = https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_152.0.4191.53-1_amd64.deb
 	source = microsoft-edge-stable.sh
 	source = Microsoft Standard Application License Terms - Standalone (free) Use Terms.pdf
-	sha256sums = 1193e2de1588c14aff86704cb479f512955cfd6c5f2d5c2bb54ff536a77f624c
+	sha256sums = b3322445fbe6ce1e0bcff84ebbe0edea365e0eaf498b1ef6136dda52dea6e3a7
 	sha256sums = dc3765d2de6520b13f105b8001aa0e40291bc9457ac508160b23eea8811e26af
 	sha256sums = edf2ed596eb068f168287fc76aa713ad5e0afb59f0a0a47a4f29c0c124ade15e
 

Comment

This is a routine version bump of a binary package from Microsoft’s official HTTPS repository, with the corresponding SHA-256 updated for the new .deb. No new sources, scripts, build steps, privilege changes, or packaging logic were introduced. The change does increase trust in a new upstream binary release, but there is no evidence in this diff of supply-chain tampering or malicious behavior.

@@ -10,7 +10,7 @@ pkgname=microsoft-edge-stable-bin
 _pkgname=microsoft-edge
 _pkgshortname=msedge
 _channel=stable
-pkgver=151.0.4129.107
+pkgver=152.0.4191.53
 pkgrel=1
 pkgdesc="A browser that combines a minimal design with sophisticated technology to make the web faster, safer, and easier"
 arch=('x86_64')

Comment

The change only updates the pinned upstream Edge version and the corresponding SHA-256 for the Microsoft-hosted .deb source. The source remains HTTPS and still points to the official Microsoft package repository, with no new build-time downloads, scripts, privilege changes, or packaging logic changes. I don’t see any new supply-chain or persistence risk introduced by this diff alone.

@@ -33,7 +33,7 @@ options=(!strip !zipman)
 source=("https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/${_pkgname}-${_channel}_${pkgver}-1_amd64.deb"
 	"microsoft-edge-stable.sh"
 	"Microsoft Standard Application License Terms - Standalone (free) Use Terms.pdf")
-sha256sums=('1193e2de1588c14aff86704cb479f512955cfd6c5f2d5c2bb54ff536a77f624c'
+sha256sums=('b3322445fbe6ce1e0bcff84ebbe0edea365e0eaf498b1ef6136dda52dea6e3a7'
             'dc3765d2de6520b13f105b8001aa0e40291bc9457ac508160b23eea8811e26af'
             'edf2ed596eb068f168287fc76aa713ad5e0afb59f0a0a47a4f29c0c124ade15e')