Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 1.22.2b to 1.22.3b. No source URLs, checksums, dependencies, install scripts, or packaging logic changed, and there are no new integrity or execution red flags visible in this hunk. Based on the provided diff alone, this appears to be a routine upstream version update with minimal security risk.

@@ -1,6 +1,6 @@
 pkgbase = zen-browser-bin
 	pkgdesc = Official package for Zen, a privacy-focused, feature packed Firefox-based web browser
-	pkgver = 1.22.2b
+	pkgver = 1.22.3b
 	pkgrel = 1
 	url = https://github.com/zen-browser/desktop
 	arch = x86_64

Comment

The change is limited to bumping the package version and updating the corresponding upstream release URLs and checksums in .SRCINFO. The sources remain HTTPS GitHub release artifacts, pinned to a specific release tag, and there are no new build-time commands, install-script changes, or packaging behavior changes. No security-relevant red flags are introduced by this metadata-only update.

@@ -19,7 +19,7 @@ pkgbase = zen-browser-bin
 	optdepends = pulse-native-provider: Audio support
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = hunspell-en_US: Spell checking, American English
-	provides = zen-browser=1.22.2b
+	provides = zen-browser=1.22.3b
 	conflicts = zen-browser
 	options = !strip
 	source = zen-browser.sh

Comment

The change is a straightforward version bump in .SRCINFO from Zen Browser 1.22.2b to 1.22.3b, with corresponding GitHub release URLs and updated SHA-256 checksums for x86_64 and aarch64. The sources remain HTTPS and point to the official upstream release artifacts, with no new build-time code execution, no added scripts, and no packaging/persistence red flags in the diff shown. Risk is low because this only updates pinned release tarballs and their integrity hashes.

@@ -28,9 +28,9 @@ pkgbase = zen-browser-bin
 	sha256sums = 642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db
 	sha256sums = bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6
 	sha256sums = fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f
-	source_x86_64 = zen-browser-1.22.2b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.22.2b/zen.linux-x86_64.tar.xz
-	sha256sums_x86_64 = 163823cf56b068e81bb8a48d93c9dbda3993f54f03f8d37e684e380bfc11b892
-	source_aarch64 = zen-browser-1.22.2b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.22.2b/zen.linux-aarch64.tar.xz
-	sha256sums_aarch64 = 3255963c7d11ff8d3bb3080104a33f31efb41608d732688f938d05a9172957e5
+	source_x86_64 = zen-browser-1.22.3b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.22.3b/zen.linux-x86_64.tar.xz
+	sha256sums_x86_64 = 0aaee1b3f67f074aebf7fc6c2fe824441bcafd431e9991336479c16370519dd0
+	source_aarch64 = zen-browser-1.22.3b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.22.3b/zen.linux-aarch64.tar.xz
+	sha256sums_aarch64 = bffbf418881d46963c5ec00cb0de05e7a06f77b2aefc8710a503bcfb79086c7d
 
 pkgname = zen-browser-bin

Comment

The change is a straightforward version bump in PKGBUILD plus updated SHA-256 checksums for the upstream release tarballs. No build logic, install scripts, URLs, permissions, or package metadata beyond the version/checksums changed. The sources remain HTTPS from the official Zen Browser GitHub releases, and there are no new red flags such as network fetches in build(), shell execution, or persistence mechanisms. Low risk.

@@ -10,7 +10,7 @@
 pkgname=zen-browser-bin
 _pkgname=zen-browser
 _desktopname=zen
-pkgver=1.22.2b
+pkgver=1.22.3b
 pkgrel=1
 pkgdesc="Official package for Zen, a privacy-focused, feature packed Firefox-based web browser"
 arch=('x86_64' 'aarch64')

Comment

The change only updates the package version and replaces the architecture-specific SHA-256 checksums for the upstream binary artifacts. No new sources, scripts, install hooks, permissions changes, or build-time network behavior were introduced in the diff. Based on the provided hunk, this appears to be a routine upstream release checksum refresh with no evident security red flags.

@@ -35,8 +35,8 @@ source=("$_pkgname.sh"
 sha256sums=('642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db'
             'bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6'
             'fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f')
-sha256sums_x86_64=('163823cf56b068e81bb8a48d93c9dbda3993f54f03f8d37e684e380bfc11b892')
-sha256sums_aarch64=('3255963c7d11ff8d3bb3080104a33f31efb41608d732688f938d05a9172957e5')
+sha256sums_x86_64=('0aaee1b3f67f074aebf7fc6c2fe824441bcafd431e9991336479c16370519dd0')
+sha256sums_aarch64=('bffbf418881d46963c5ec00cb0de05e7a06f77b2aefc8710a503bcfb79086c7d')
 
 
 package() {