Review Results

Comment

The change only bumps pkgver in .SRCINFO from 153.1.0 to 153.3.0. No build logic, sources, install scripts, permissions, or system integration artifacts are modified in the reviewed hunk. While the URL remains HTTP in .SRCINFO, that is pre-existing and unchanged here, so this diff does not introduce a new security issue. Based on the provided change alone, risk is minimal.

@@ -1,6 +1,6 @@
 pkgbase = firefox-esr-bin
 	pkgdesc = Standalone web browser from mozilla.org - Extended Support Release
-	pkgver = 153.1.0
+	pkgver = 153.3.0
 	pkgrel = 2
 	url = http://www.mozilla.org/en-US/firefox/organizations/
 	install = firefox-esr.install

Comment

The change only bumps the packaged Firefox ESR version from 153.1.0 to 153.3.0 in .SRCINFO, updating the corresponding official Mozilla HTTPS release URL and checksum, plus the provided virtual version. No new sources, scripts, build steps, or privilege-related artifacts are introduced. This is a routine metadata refresh with no evident security impact.

@@ -14,12 +14,12 @@ pkgbase = firefox-esr-bin
 	depends = dbus-glib
 	depends = nss
 	depends = ffmpeg4.4
-	provides = firefox=153.1.0
-	source = https://ftp.mozilla.org/pub/firefox/releases/153.1.0esr/linux-x86_64/en-US/firefox-153.1.0esr.tar.xz
+	provides = firefox=153.3.0
+	source = https://ftp.mozilla.org/pub/firefox/releases/153.3.0esr/linux-x86_64/en-US/firefox-153.3.0esr.tar.xz
 	source = firefox-esr.desktop
 	source = firefox-esr-safe.desktop
 	source = policies.json
-	sha512sums = e4dc39977cec9dd3c6fba76decf9da05f5b8aa3d1d6cfe3507851a10e46075a3fa0a46e2e78d9246e1fae79661ea223eeebae405558ec3e98ab0802be2a6d06a
+	sha512sums = 8514dda74bc79228f073e89afdd93e6f69bbb5c38ae3f8ebd4e0e58c1cef20c6a792815534f3fcc371018792541a396949bce396fbbfea31ea2bcebaeef65448
 	sha512sums = c585f6e8ac7abfc96ad4571940b6f0dcc3f7331a18a518b4fe5d19b45e4c2d96c394524ea5c115c8fdd256c9229ea2fabeb1fc04ca7102f1626fd20728aef47d
 	sha512sums = ab2fa2e08c7a65ac0bfe169a4b579e54b038bddabf838cd3df5ab341bd77be7c101092d0123598944d2174ab3a8fbc70dfbd692b2944016efdb7a69216a74428
 	sha512sums = 5ed67bde39175d4d10d50ba5b12063961e725e94948eadb354c0588b30d3f97d2178b66c1af466a6e7bd208ab694227a1391c4141f88d3da1a1178454eba5308

Comment

The change is a routine version bump of an AUR binary package from 153.1.0 to 153.3.0, with the corresponding source checksum updated. No new build steps, scripts, privileges, network fetches beyond the existing Mozilla release tarball, or packaging behavior changes were introduced. The only notable issue visible in the surrounding PKGBUILD is the pre-existing HTTP homepage URL, but this diff does not modify it and it is not used for fetching artifacts. Overall this looks low risk.

@@ -7,7 +7,7 @@
 
 pkgname=firefox-esr-bin
 _pkgname=${pkgname/-bin/}
-pkgver=153.1.0
+pkgver=153.3.0
 pkgrel=2
 pkgdesc='Standalone web browser from mozilla.org - Extended Support Release'
 url='http://www.mozilla.org/en-US/firefox/organizations/'

Comment

The change only updates the SHA-512 checksum for the primary Firefox ESR tarball and removes the old i686-specific checksum override. There are no new sources, scripts, build steps, privilege changes, or network-fetching logic introduced. Security impact is limited to integrity verification of an upstream release artifact; the new checksum should be validated against the expected upstream tarball, but the diff itself does not add a backdoor or weaken packaging hygiene beyond a checksum maintenance change.

@@ -18,11 +18,10 @@ provides=(firefox=${pkgver})
 license=('MPL' 'GPL' 'LGPL')
 install=$_pkgname.install
 
-sha512sums=('e4dc39977cec9dd3c6fba76decf9da05f5b8aa3d1d6cfe3507851a10e46075a3fa0a46e2e78d9246e1fae79661ea223eeebae405558ec3e98ab0802be2a6d06a'
+sha512sums=('8514dda74bc79228f073e89afdd93e6f69bbb5c38ae3f8ebd4e0e58c1cef20c6a792815534f3fcc371018792541a396949bce396fbbfea31ea2bcebaeef65448'
             'c585f6e8ac7abfc96ad4571940b6f0dcc3f7331a18a518b4fe5d19b45e4c2d96c394524ea5c115c8fdd256c9229ea2fabeb1fc04ca7102f1626fd20728aef47d'
             'ab2fa2e08c7a65ac0bfe169a4b579e54b038bddabf838cd3df5ab341bd77be7c101092d0123598944d2174ab3a8fbc70dfbd692b2944016efdb7a69216a74428'
             '5ed67bde39175d4d10d50ba5b12063961e725e94948eadb354c0588b30d3f97d2178b66c1af466a6e7bd208ab694227a1391c4141f88d3da1a1178454eba5308')
-[[ "$CARCH" == "i686" ]] && sha512sums[0]='73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574'
 
 source=(https://ftp.mozilla.org/pub/firefox/releases/${pkgver}esr/linux-$CARCH/en-US/firefox-${pkgver}esr.tar.xz
         $_pkgname.desktop