Review Results

Comment

The change only bumps pkgver in .SRCINFO from 153.0.8010.52 to 154.0.8037.97. No build logic, sources, install scripts, permissions, or metadata affecting trust boundaries changed in the provided hunk. On its face this is a routine version update with no security red flags in the diff shown.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 153.0.8010.52
+	pkgver = 154.0.8037.97
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for a binary package: updated provides entries and the GitHub release URL/checksum to the new upstream release. The source remains HTTPS on the official ungoogled-software GitHub release page, and there are no added scripts, build steps, or privilege-related changes in this diff. No obvious supply-chain or persistence risk is introduced by this metadata-only update.

@@ -62,11 +62,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=153.0.8010.52
-	provides = chromedriver=153.0.8010.52
+	provides = chromium=154.0.8037.97
+	provides = chromedriver=154.0.8037.97
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/153.0.8010.52-1/ungoogled-chromium-153.0.8010.52-1-x86_64.pkg.tar.zst
-	sha256sums = 514a32e2596ebbd6f9e4c7b5bfc348093f8e5a603610ddd9e42631747e3d16f2
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/154.0.8037.97-1/ungoogled-chromium-154.0.8037.97-1-x86_64.pkg.tar.zst
+	sha256sums = f22b37274378455fb4366396d762e0ec5bb2394b63f9de25db1a9ba005fb0716
 
 pkgname = ungoogled-chromium-bin

Comment

The change only bumps pkgver and the corresponding source checksum for the prebuilt upstream release tarball. I did not find any new build logic, network behavior, privilege escalation, or packaging changes in this diff. The package still sources a release artifact over HTTPS from the project’s GitHub releases and installs it under $pkgdir, with the existing setuid chrome-sandbox behavior unchanged from before. No security regression is introduced by this version bump alone.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=153.0.8010.52
+pkgver=154.0.8037.97
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

The change is a straightforward version bump of a prebuilt binary package and a corresponding checksum update. The source remains an HTTPS GitHub release asset from the project’s own release repository, with no new build-time code execution, no added scripts, and no changes to package install logic or permissions. I don’t see evidence of typosquatting, network fetches outside source=(), or persistence mechanisms introduced by this diff. Risk is low, though as with any -bin package the trust boundary is the upstream binary release itself rather than local compilation.

@@ -54,7 +54,7 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('514a32e2596ebbd6f9e4c7b5bfc348093f8e5a603610ddd9e42631747e3d16f2')
+sha256sums=('f22b37274378455fb4366396d762e0ec5bb2394b63f9de25db1a9ba005fb0716')
 
 declare -gA _system_libs=(
     [brotli]=brotli