Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.94.117 to 1.94.119. No sources, checksums, install scripts, build logic, permissions, or package metadata affecting trust boundaries were changed in the provided diff. On its face this is a routine upstream version update with no security red flags visible in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = brave-bin
 	pkgdesc = Web browser that blocks ads and trackers by default (binary release)
-	pkgver = 1.94.117
+	pkgver = 1.94.119
 	pkgrel = 1
 	epoch = 1
 	url = https://brave.com

Comment

The change is a routine version bump in .SRCINFO for an AUR binary package. The source URLs remain on the official Brave GitHub release domain over HTTPS, and the checksums were updated accordingly. No new sources, scripts, install hooks, or packaging behavior changes are introduced by this diff. Based on the provided hunk alone, there is no evidence of supply-chain risk beyond the normal trust in the upstream binary release.

@@ -17,19 +17,19 @@ pkgbase = brave-bin
 	optdepends = cups: Printer support
 	optdepends = libgnome-keyring: Enable GNOME keyring support
 	optdepends = libnotify: Native notification support
-	provides = brave=1.94.117
+	provides = brave=1.94.119
 	provides = brave-browser
 	conflicts = brave
-	noextract = brave-bin-1.94.117-x86_64.zip
-	noextract = brave-bin-1.94.117-aarch64.zip
+	noextract = brave-bin-1.94.119-x86_64.zip
+	noextract = brave-bin-1.94.119-aarch64.zip
 	options = !strip
 	source = brave-bin.sh
 	source = brave-browser.desktop
 	sha256sums = 75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00
 	sha256sums = c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a
-	source_x86_64 = brave-bin-1.94.117-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.94.117/brave-browser-1.94.117-linux-amd64.zip
-	sha256sums_x86_64 = 865ff352311c57ba4639b5198bc89e92a838a57bff44182e3b9bb3980913a84d
-	source_aarch64 = brave-bin-1.94.117-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.94.117/brave-browser-1.94.117-linux-arm64.zip
-	sha256sums_aarch64 = fca88277fefc4deb24c6974810466c6be5363caf4a6f03c78de3f6db3eb654d5
+	source_x86_64 = brave-bin-1.94.119-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.94.119/brave-browser-1.94.119-linux-amd64.zip
+	sha256sums_x86_64 = 93382e3c7e81583ec7923b8b02d2962952e3be829a83828b5fe408c1e63563d9
+	source_aarch64 = brave-bin-1.94.119-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.94.119/brave-browser-1.94.119-linux-arm64.zip
+	sha256sums_aarch64 = b50a997d18972819304f103b4f75dbe5f6030d8d6f7a7fc302ddb51c08e9b5d2
 
 pkgname = brave-bin

Comment

The change is a simple version bump in PKGBUILD from 1.94.117 to 1.94.119 with no other modifications shown. There are no new sources, scripts, install hooks, permissions changes, or build logic changes in the reviewed hunk, so this does not introduce an obvious security risk by itself. Any risk would depend on the upstream binary release, which is outside the scope of this diff.

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.94.117
+pkgver=1.94.119
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'

Comment

The change only updates the packaged Brave browser version and refreshes the corresponding upstream ZIP checksums for x86_64 and aarch64. No new sources, scripts, install logic, permissions, or packaging behavior were introduced in this diff. The package still downloads from the official Brave GitHub release URLs over HTTPS and remains pinned to a specific release version. Based on the provided hunk, this is a routine integrity update with no evident security regression.

@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('865ff352311c57ba4639b5198bc89e92a838a57bff44182e3b9bb3980913a84d')
-sha256sums_aarch64=('fca88277fefc4deb24c6974810466c6be5363caf4a6f03c78de3f6db3eb654d5')
+sha256sums_x86_64=('93382e3c7e81583ec7923b8b02d2962952e3be829a83828b5fe408c1e63563d9')
+sha256sums_aarch64=('b50a997d18972819304f103b4f75dbe5f6030d8d6f7a7fc302ddb51c08e9b5d2')
 
 prepare() {
 	mkdir -p brave