Review Results

Comment

The only change in this diff is a version bump in .SRCINFO from 1.95.104 to 1.96.59. No source URLs, build logic, install scripts, permissions, or packaging metadata beyond pkgver changed. By itself this does not introduce a security issue; it simply tracks a newer upstream Brave binary release. I did not see evidence in the provided hunk of malicious sources, build-time downloads, privilege escalation, or persistence mechanisms.

@@ -1,6 +1,6 @@
 pkgbase = brave-bin
 	pkgdesc = Web browser that blocks ads and trackers by default (binary release)
-	pkgver = 1.95.104
+	pkgver = 1.96.59
 	pkgrel = 1
 	epoch = 1
 	url = https://brave.com

Comment

The change is a straightforward version bump in .SRCINFO for the Brave binary package: updated provides/noextract/source URLs and checksums to 1.96.59 for x86_64 and aarch64. The sources remain official GitHub release assets over HTTPS, there are no new build-time commands, no install-script or systemd changes, and no suspicious metadata additions (e.g., new conflicts/provides beyond the expected package version). Based on the provided diff, I do not see a security issue introduced by this change.

@@ -17,19 +17,19 @@ pkgbase = brave-bin
 	optdepends = cups: Printer support
 	optdepends = libgnome-keyring: Enable GNOME keyring support
 	optdepends = libnotify: Native notification support
-	provides = brave=1.95.104
+	provides = brave=1.96.59
 	provides = brave-browser
 	conflicts = brave
-	noextract = brave-bin-1.95.104-x86_64.zip
-	noextract = brave-bin-1.95.104-aarch64.zip
+	noextract = brave-bin-1.96.59-x86_64.zip
+	noextract = brave-bin-1.96.59-aarch64.zip
 	options = !strip
 	source = brave-bin.sh
 	source = brave-browser.desktop
 	sha256sums = 75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00
 	sha256sums = c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a
-	source_x86_64 = brave-bin-1.95.104-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.95.104/brave-browser-1.95.104-linux-amd64.zip
-	sha256sums_x86_64 = 1d2a6fc3e32ad7b62bb2aeae6d1ba4ba01acbec12a8a7a8310ea6ae1293816cc
-	source_aarch64 = brave-bin-1.95.104-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.95.104/brave-browser-1.95.104-linux-arm64.zip
-	sha256sums_aarch64 = 9f2dab1cd328cdaa88302be319bd269d59a8a84c8dfc6ccaa71287b8c0629ac2
+	source_x86_64 = brave-bin-1.96.59-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.96.59/brave-browser-1.96.59-linux-amd64.zip
+	sha256sums_x86_64 = ee36d0fb939ebdf1922d47d7b4cb8879507733b2a76605a31bfe9dede3297139
+	source_aarch64 = brave-bin-1.96.59-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.96.59/brave-browser-1.96.59-linux-arm64.zip
+	sha256sums_aarch64 = faa8a26f1e7c0c3b8632633503f82e571a798212d8e6fe9baba77f0c73509867
 
 pkgname = brave-bin

Comment

The change is a routine version bump in a binary package: pkgver is updated and the corresponding upstream archive checksums are refreshed. The source URLs remain HTTPS GitHub release assets, there are no new build steps, scripts, or privilege-related changes, and no additional sources or patches were introduced. Based on the provided diff, I see no security-relevant regression.

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.95.104
+pkgver=1.96.59
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'

Comment

The change only updates the pinned SHA-256 checksums for the prebuilt Brave ZIP artifacts in PKGBUILD. I did not find any new sources, build-time network fetches, script execution, privilege escalation, or packaging logic changes. The risk is limited to the integrity of the newly accepted upstream binaries, which is expected for a -bin package and is mitigated by checksum pinning rather than weakened by this diff.

@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('1d2a6fc3e32ad7b62bb2aeae6d1ba4ba01acbec12a8a7a8310ea6ae1293816cc')
-sha256sums_aarch64=('9f2dab1cd328cdaa88302be319bd269d59a8a84c8dfc6ccaa71287b8c0629ac2')
+sha256sums_x86_64=('ee36d0fb939ebdf1922d47d7b4cb8879507733b2a76605a31bfe9dede3297139')
+sha256sums_aarch64=('faa8a26f1e7c0c3b8632633503f82e571a798212d8e6fe9baba77f0c73509867')
 
 prepare() {
 	mkdir -p brave