Review Results

Comment

The change only bumps pkgver in .SRCINFO from 1.22.3b to 1.23b. No source URLs, checksums, build steps, install scripts, or permissions are altered, and there are no new execution or persistence vectors introduced by this metadata-only update. Based on the provided diff, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = zen-browser-bin
 	pkgdesc = Official package for Zen, a privacy-focused, feature packed Firefox-based web browser
-	pkgver = 1.22.3b
+	pkgver = 1.23b
 	pkgrel = 1
 	url = https://github.com/zen-browser/desktop
 	arch = x86_64

Comment

The change only updates the virtual provide version in .SRCINFO from zen-browser=1.22.3b to zen-browser=1.23b. This is metadata-only and does not alter build steps, sources, install scripts, permissions, or runtime behavior. No security impact is evident from this diff alone.

@@ -19,7 +19,7 @@ pkgbase = zen-browser-bin
 	optdepends = pulse-native-provider: Audio support
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = hunspell-en_US: Spell checking, American English
-	provides = zen-browser=1.22.3b
+	provides = zen-browser=1.23b
 	conflicts = zen-browser
 	options = !strip
 	source = zen-browser.sh

Comment

The change is a straightforward version bump in .SRCINFO from Zen Browser 1.22.3b to 1.23b, with updated GitHub release tarball URLs and matching SHA-256 checksums for x86_64 and aarch64. The sources remain HTTPS on the official upstream GitHub release page, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Based on the provided hunk alone, this looks low risk.

@@ -28,9 +28,9 @@ pkgbase = zen-browser-bin
 	sha256sums = 642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db
 	sha256sums = bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6
 	sha256sums = fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f
-	source_x86_64 = zen-browser-1.22.3b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.22.3b/zen.linux-x86_64.tar.xz
-	sha256sums_x86_64 = 0aaee1b3f67f074aebf7fc6c2fe824441bcafd431e9991336479c16370519dd0
-	source_aarch64 = zen-browser-1.22.3b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.22.3b/zen.linux-aarch64.tar.xz
-	sha256sums_aarch64 = bffbf418881d46963c5ec00cb0de05e7a06f77b2aefc8710a503bcfb79086c7d
+	source_x86_64 = zen-browser-1.23b-1-x86_64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.23b/zen.linux-x86_64.tar.xz
+	sha256sums_x86_64 = 9ad79f50f52a60b85f1a0787de227235934ea0bd994f79b739fa806081b3fcf0
+	source_aarch64 = zen-browser-1.23b-1-aarch64.tar.xz::https://github.com/zen-browser/desktop/releases/download/1.23b/zen.linux-aarch64.tar.xz
+	sha256sums_aarch64 = 4774631868db53163bfecff457b9440e55cc04f24d4c3168df67722409a0bef2
 
 pkgname = zen-browser-bin

Comment

The change is a routine version bump in PKGBUILD with updated per-architecture checksums. I do not see any new sources, build-time network access, privilege escalation, install-script changes, or other suspicious packaging behavior in this diff. Risk is low because the only security-relevant effect is that the package will now fetch a newer upstream binary release, but the integrity is still pinned by updated SHA-256 sums.

@@ -10,7 +10,7 @@
 pkgname=zen-browser-bin
 _pkgname=zen-browser
 _desktopname=zen
-pkgver=1.22.3b
+pkgver=1.23b
 pkgrel=1
 pkgdesc="Official package for Zen, a privacy-focused, feature packed Firefox-based web browser"
 arch=('x86_64' 'aarch64')

Comment

The change only updates the package version and the per-architecture SHA-256 checksums for the upstream browser binaries. I do not see any new code execution, network fetches outside the declared sources, privilege changes, install-script behavior, or packaging logic changes in the reviewed hunk. This is a normal integrity update for a new release artifact, with no obvious security regression in the diff provided.

@@ -35,8 +35,8 @@ source=("$_pkgname.sh"
 sha256sums=('642bcde5b15fddb712d10ed53299781108a265432237ab27a96c5c5c489718db'
             'bfb347f0e0f6baccaf3b7b51b19a25e5b745d836734cec38611b32af842897f6'
             'fd9572d178ea1a5edf427ca85bad3fb2d83be2e250e62bad13951d70d977bd0f')
-sha256sums_x86_64=('0aaee1b3f67f074aebf7fc6c2fe824441bcafd431e9991336479c16370519dd0')
-sha256sums_aarch64=('bffbf418881d46963c5ec00cb0de05e7a06f77b2aefc8710a503bcfb79086c7d')
+sha256sums_x86_64=('9ad79f50f52a60b85f1a0787de227235934ea0bd994f79b739fa806081b3fcf0')
+sha256sums_aarch64=('4774631868db53163bfecff457b9440e55cc04f24d4c3168df67722409a0bef2')
 
 
 package() {