Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 153.0.8010.47 to 153.0.8010.52. No sources, checksums, install scripts, build commands, permissions, or package metadata affecting trust boundaries were changed in the provided diff. On its face this is a routine upstream version update with no security red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 153.0.8010.47
+	pkgver = 153.0.8010.52
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a routine version bump in .SRCINFO for ungoogled-chromium: pkgver, provides, source tarball URL, and the corresponding checksum were updated to the new upstream release. The source remains HTTPS on the official GitHub project, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Based on the provided hunk alone, this appears low risk.

@@ -85,13 +85,13 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=153.0.8010.47
-	provides = chromedriver=153.0.8010.47
+	provides = chromium=153.0.8010.52
+	provides = chromedriver=153.0.8010.52
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
 	source = fetch-chromium-release
-	source = ungoogled-chromium-153.0.8010.47-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/153.0.8010.47-1.tar.gz
+	source = ungoogled-chromium-153.0.8010.52-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/153.0.8010.52-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch

Comment

The change is a routine version bump in .SRCINFO: pkgver/provides/source tarball name and the corresponding checksum were updated to match the new upstream release. The source remains HTTPS from the official GitHub project, and there are no new build-time commands, install-script changes, privilege escalations, or suspicious extra sources introduced in this diff. No security issue is evident from the metadata-only update.

@@ -113,7 +113,7 @@ pkgbase = ungoogled-chromium
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
 	sha256sums = 2e2f36e3cd1ebc4ad57fd310774a5e5e9db77883d5f9374fedeaabd3c103b819
-	sha256sums = 922a6c884a0842c3c0e7fcd30a873acae00f439843c63ea7332d2fe04eef8aec
+	sha256sums = c98a3a5c243471522d8aefc079f62bdcbc7b953e34dc6187197e4abff03a0a94
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e
 	sha256sums = 4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e

Comment

The change is a routine version bump in PKGBUILD: pkgver/_uc_ver and the corresponding source checksum were updated. I did not see any new sources, build-time network access, privilege escalation, install-script changes, or other packaging red flags in the reviewed diff hunk. No security-relevant behavior appears to have changed beyond fetching a newer upstream release.

@@ -11,14 +11,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=153.0.8010.47
+pkgver=153.0.8010.52
 pkgrel=1
 _launcher_ver=8
 _manual_clone=1
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=153.0.8010.47-1
+_uc_ver=153.0.8010.52-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"

Comment

The change is a routine version bump in PKGBUILD from 153.0.8010.47 to 153.0.8010.52, with the corresponding checksum update for the Chromium source tarball. No new sources, no build-time network fetches, no privilege escalation, and no packaging logic changes are introduced in this diff hunk. Based on the provided change alone, this looks low risk.

@@ -112,7 +112,7 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
 sha256sums=('645f64566cfbb780747430d53ff3656f03639f89fed9544c1eadd4c17e7b1c82'
-            '922a6c884a0842c3c0e7fcd30a873acae00f439843c63ea7332d2fe04eef8aec'
+            'c98a3a5c243471522d8aefc079f62bdcbc7b953e34dc6187197e4abff03a0a94'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'