Review Results

Comment

The only change in the provided .SRCINFO hunk is a version bump from 153.4.0 to 153.5.0. No new sources, checksums, build steps, install scripts, or metadata affecting trust boundaries were introduced in this diff. While the URL remains HTTP in the existing metadata, that is pre-existing and not changed by this commit. Based on the reviewed hunk alone, I see no new security issue.

@@ -1,6 +1,6 @@
 pkgbase = firefox-esr-bin
 	pkgdesc = Standalone web browser from mozilla.org - Extended Support Release
-	pkgver = 153.4.0
+	pkgver = 153.5.0
 	pkgrel = 0
 	url = http://www.mozilla.org/en-US/firefox/organizations/
 	install = firefox-esr.install

Comment

The change is a routine upstream version bump in .SRCINFO: it updates the Firefox ESR release URL from 153.4.0esr to 153.5.0esr and refreshes the corresponding checksum/provides metadata. The source remains the official Mozilla HTTPS release host, there are no new build steps, no added scripts, and no suspicious dependencies or packaging directives. I do not see any security-relevant regression in this diff.

@@ -13,12 +13,12 @@ pkgbase = firefox-esr-bin
 	depends = dbus-glib
 	depends = nss
 	depends = ffmpeg4.4
-	provides = firefox=153.4.0
-	source = https://ftp.mozilla.org/pub/firefox/releases/153.4.0esr/linux-x86_64/en-US/firefox-153.4.0esr.tar.xz
+	provides = firefox=153.5.0
+	source = https://ftp.mozilla.org/pub/firefox/releases/153.5.0esr/linux-x86_64/en-US/firefox-153.5.0esr.tar.xz
 	source = firefox-esr.desktop
 	source = firefox-esr-safe.desktop
 	source = policies.json
-	sha512sums = ddc705a71bce6d9a8dbed50a99427cb76c2115f94d6d62cfbaa3d37ec009beeb28da293bbbe838ebf663cfe8876ab80d699086717911fc18d7cd8c722c84431b
+	sha512sums = 322c4c9f1768e1406bac8ae12b407c504727f3747c2d462ee4c7ab1aee4e308caf837c6d516ba72c40b9f3bb3ec07bf22431bfb2f3e3f0abf08a797baeae01c1
 	sha512sums = c585f6e8ac7abfc96ad4571940b6f0dcc3f7331a18a518b4fe5d19b45e4c2d96c394524ea5c115c8fdd256c9229ea2fabeb1fc04ca7102f1626fd20728aef47d
 	sha512sums = ab2fa2e08c7a65ac0bfe169a4b579e54b038bddabf838cd3df5ab341bd77be7c101092d0123598944d2174ab3a8fbc70dfbd692b2944016efdb7a69216a74428
 	sha512sums = 5ed67bde39175d4d10d50ba5b12063961e725e94948eadb354c0588b30d3f97d2178b66c1af466a6e7bd208ab694227a1391c4141f88d3da1a1178454eba5308

Comment

The change only bumps pkgver from 153.4.0 to 153.5.0 and updates the corresponding source checksum. No new sources, scripts, install logic, permissions, or packaging behavior were introduced. The package still fetches the official Mozilla tarball over HTTPS and installs it under $pkgdir as before. Low risk.

@@ -7,7 +7,7 @@
 
 pkgname=firefox-esr-bin
 _pkgname=${pkgname/-bin/}
-pkgver=153.4.0
+pkgver=153.5.0
 pkgrel=0
 pkgdesc='Standalone web browser from mozilla.org - Extended Support Release'
 url='http://www.mozilla.org/en-US/firefox/organizations/'

Comment

The change only updates firefox-esr-bin from 153.4.0 to 153.5.0 and refreshes the corresponding SHA-512 checksum for the upstream tarball. No new sources, scripts, install logic, permissions changes, or packaging behavior were introduced. The package still downloads from the official Mozilla FTP over HTTPS and installs the prebuilt upstream release as before. This looks like a routine version bump with integrity metadata update only.

@@ -18,7 +18,7 @@ provides=(firefox=${pkgver})
 license=('MPL' 'GPL' 'LGPL')
 install=$_pkgname.install
 
-sha512sums=('ddc705a71bce6d9a8dbed50a99427cb76c2115f94d6d62cfbaa3d37ec009beeb28da293bbbe838ebf663cfe8876ab80d699086717911fc18d7cd8c722c84431b'
+sha512sums=('322c4c9f1768e1406bac8ae12b407c504727f3747c2d462ee4c7ab1aee4e308caf837c6d516ba72c40b9f3bb3ec07bf22431bfb2f3e3f0abf08a797baeae01c1'
             'c585f6e8ac7abfc96ad4571940b6f0dcc3f7331a18a518b4fe5d19b45e4c2d96c394524ea5c115c8fdd256c9229ea2fabeb1fc04ca7102f1626fd20728aef47d'
             'ab2fa2e08c7a65ac0bfe169a4b579e54b038bddabf838cd3df5ab341bd77be7c101092d0123598944d2174ab3a8fbc70dfbd692b2944016efdb7a69216a74428'
             '5ed67bde39175d4d10d50ba5b12063961e725e94948eadb354c0588b30d3f97d2178b66c1af466a6e7bd208ab694227a1391c4141f88d3da1a1178454eba5308')