Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.21.16b to 1.22b. No source URLs, checksums, install scripts, build commands, permissions, or package metadata beyond the version string are altered in the provided diff. On its face this is a routine version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = zen-browser-bin
 	pkgdesc = Official package for Zen, a privacy-focused, feature packed Firefox-based web browser
-	pkgver = 1.21.16b
+	pkgver = 1.22b
 	pkgrel = 1
 	url = https://github.com/zen-browser/desktop
 	arch = x86_64

Comment

The change only updates the virtual provide version in .SRCINFO from zen-browser=1.21.16b to zen-browser=1.22b. This is metadata-only and does not introduce new sources, scripts, permissions, or build-time behavior. No security-relevant issue is evident from this diff hunk alone.

@@ -19,7 +19,7 @@ pkgbase = zen-browser-bin
 	optdepends = pulse-native-provider: Audio support
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = hunspell-en_US: Spell checking, American English
-	provides = zen-browser=1.21.16b
+	provides = zen-browser=1.22b
 	conflicts = zen-browser
 	options = !strip
 	source = zen-browser.sh

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Zen Browser binaries, updating the GitHub release URLs and corresponding SHA-256 checksums for x86_64 and aarch64. The sources remain HTTPS on the official upstream repository, there are no new build-time commands, no install-script or systemd changes, and no signs of typosquatting or integrity bypass in this diff. Risk is low because the package still relies on upstream release artifacts, but this specific change does not introduce additional security concerns beyond the normal trust in the new release and checksums.

@@ -28,9 +28,9 @@ pkgbase = zen-browser-bin
 	sha256sums = 642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db
 	sha256sums = bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6
 	sha256sums = fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f
-	source_x86_64 = zen-browser-1.21.16b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.16b/zen.linux-x86_64.tar.xz
-	sha256sums_x86_64 = 1e4c3c391d10a82239d35afad84658fa3b3856b8ff72f93bbff7f57392acb942
-	source_aarch64 = zen-browser-1.21.16b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.21.16b/zen.linux-aarch64.tar.xz
-	sha256sums_aarch64 = 7aa0c251c1dad6cbea374b3d5892d4c1948465479232c318aef89aa1cf183654
+	source_x86_64 = zen-browser-1.22b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.22b/zen.linux-x86_64.tar.xz
+	sha256sums_x86_64 = 41e725c82a2bee91a351c5fe8f8771f8e2748c7f323ebbb0138dbeaae84afbb8
+	source_aarch64 = zen-browser-1.22b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.22b/zen.linux-aarch64.tar.xz
+	sha256sums_aarch64 = a717fa3b01fa32123b410fe0da4b0f862e553c7c22343322ca40c8dc50fb4bfe
 
 pkgname = zen-browser-bin

Comment

The change only bumps pkgver from 1.21.16b to 1.22b in PKGBUILD. No source URLs, build steps, install scripts, permissions, or packaging logic are modified in the provided diff, so there is no new security concern visible in this change alone. I did not see evidence of added network fetches, privilege escalation, persistence, or integrity weakening in the hunk reviewed.

@@ -10,7 +10,7 @@
 pkgname=zen-browser-bin
 _pkgname=zen-browser
 _desktopname=zen
-pkgver=1.21.16b
+pkgver=1.22b
 pkgrel=1
 pkgdesc="Official package for Zen, a privacy-focused, feature packed Firefox-based web browser"
 arch=('x86_64' 'aarch64')

Comment

The change only updates the SHA-256 checksums for the architecture-specific upstream release artifacts in PKGBUILD. No build logic, install scripts, URLs, permissions, or package metadata were altered. This is a normal integrity update and does not by itself introduce a security concern, assuming the new checksums correspond to the intended upstream binaries.

@@ -35,8 +35,8 @@ source=("$_pkgname.sh"
 sha256sums=('642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db'
             'bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6'
             'fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f')
-sha256sums_x86_64=('1e4c3c391d10a82239d35afad84658fa3b3856b8ff72f93bbff7f57392acb942')
-sha256sums_aarch64=('7aa0c251c1dad6cbea374b3d5892d4c1948465479232c318aef89aa1cf183654')
+sha256sums_x86_64=('41e725c82a2bee91a351c5fe8f8771f8e2748c7f323ebbb0138dbeaae84afbb8')
+sha256sums_aarch64=('a717fa3b01fa32123b410fe0da4b0f862e553c7c22343322ca40c8dc50fb4bfe')
 
 
 package() {