Review Results

Comment

The change is a simple version bump in .SRCINFO from 1.94.119 to 1.94.121 with no other metadata, source, checksum, dependency, or install-script changes shown. On its face this is low risk and does not introduce any new execution paths or packaging concerns. I did not see evidence in the provided diff of suspicious sources, privilege escalation, or persistence mechanisms.

@@ -1,6 +1,6 @@
 pkgbase = brave-bin
 	pkgdesc = Web browser that blocks ads and trackers by default (binary release)
-	pkgver = 1.94.119
+	pkgver = 1.94.121
 	pkgrel = 1
 	epoch = 1
 	url = https://brave.com

Comment

The change is a routine version bump in .SRCINFO for the prebuilt Brave browser package: it updates the provided version, noextract filenames, and source URLs/checksums to the new upstream GitHub release. The sources remain HTTPS and point to the official Brave release artifacts, with no added scripts, patches, install hooks, or build-time execution changes in this diff. No supply-chain red flags are introduced by this metadata-only update.

@@ -17,19 +17,19 @@ pkgbase = brave-bin
 	optdepends = cups: Printer support
 	optdepends = libgnome-keyring: Enable GNOME keyring support
 	optdepends = libnotify: Native notification support
-	provides = brave=1.94.119
+	provides = brave=1.94.121
 	provides = brave-browser
 	conflicts = brave
-	noextract = brave-bin-1.94.119-x86_64.zip
-	noextract = brave-bin-1.94.119-aarch64.zip
+	noextract = brave-bin-1.94.121-x86_64.zip
+	noextract = brave-bin-1.94.121-aarch64.zip
 	options = !strip
 	source = brave-bin.sh
 	source = brave-browser.desktop
 	sha256sums = 75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00
 	sha256sums = c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a
-	source_x86_64 = brave-bin-1.94.119-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.94.119/brave-browser-1.94.119-linux-amd64.zip
-	sha256sums_x86_64 = 93382e3c7e81583ec7923b8b02d2962952e3be829a83828b5fe408c1e63563d9
-	source_aarch64 = brave-bin-1.94.119-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.94.119/brave-browser-1.94.119-linux-arm64.zip
-	sha256sums_aarch64 = b50a997d18972819304f103b4f75dbe5f6030d8d6f7a7fc302ddb51c08e9b5d2
+	source_x86_64 = brave-bin-1.94.121-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.94.121/brave-browser-1.94.121-linux-amd64.zip
+	sha256sums_x86_64 = 33a0c940037d97844c1848907b81de4418b98d07287f46220d07d88543b8a4b5
+	source_aarch64 = brave-bin-1.94.121-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.94.121/brave-browser-1.94.121-linux-arm64.zip
+	sha256sums_aarch64 = 23be774849966e7de35429bde652cb0e583237d803fb8f596422419fdea1be8d
 
 pkgname = brave-bin

Comment

This is a routine version bump for a binary package. The only changes are pkgver and the corresponding upstream SHA-256 checksums for the Brave release archives. The source URLs remain HTTPS and point to the official Brave GitHub release assets, with no new build-time code execution, no install-script changes, and no packaging/persistence red flags in the reviewed hunk. Risk is therefore minimal.

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.94.119
+pkgver=1.94.121
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'

Comment

This change is limited to updating the Brave binary package version and its per-architecture SHA-256 checksums. The source URLs remain HTTPS and still point to the official Brave GitHub release artifacts, with no new build-time network access, scripts, or packaging logic introduced. I do not see any integrity or execution red flags in the diff itself; the main effect is to pin the new release archives to their updated hashes.

@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('93382e3c7e81583ec7923b8b02d2962952e3be829a83828b5fe408c1e63563d9')
-sha256sums_aarch64=('b50a997d18972819304f103b4f75dbe5f6030d8d6f7a7fc302ddb51c08e9b5d2')
+sha256sums_x86_64=('33a0c940037d97844c1848907b81de4418b98d07287f46220d07d88543b8a4b5')
+sha256sums_aarch64=('23be774849966e7de35429bde652cb0e583237d803fb8f596422419fdea1be8d')
 
 prepare() {
 	mkdir -p brave