Review Results

Comment

The change only bumps the package version in .SRCINFO from 154.0.8037.97 to 155.0.8059.79. No source URLs, checksums, build steps, install scripts, or packaging metadata affecting execution/persistence were changed in the provided hunk. On its own this is a routine version update with no evident security impact.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 154.0.8037.97
+	pkgver = 155.0.8059.79
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for a binary package: it updates the provided Chromium/Chromedriver versions, the GitHub release URL, and the checksum to match the new upstream release. The source remains HTTPS and points to the project’s GitHub releases, with no added scripts, build steps, or privilege-related metadata. No suspicious dependencies, install hooks, or packaging behavior are introduced in this diff. Risk is low.

@@ -62,11 +62,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=154.0.8037.97
-	provides = chromedriver=154.0.8037.97
+	provides = chromium=155.0.8059.79
+	provides = chromedriver=155.0.8059.79
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/154.0.8037.97-1/ungoogled-chromium-154.0.8037.97-1-x86_64.pkg.tar.zst
-	sha256sums = f22b37274378455fb4366396d762e0ec5bb2394b63f9de25db1a9ba005fb0716
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/155.0.8059.79-1/ungoogled-chromium-155.0.8059.79-1-x86_64.pkg.tar.zst
+	sha256sums = 337bc4a46bc8a290444f40adf888898dc817517ae6c6dc8624a670a81e979de5
 
 pkgname = ungoogled-chromium-bin

Comment

The change only bumps pkgver in PKGBUILD from 154.0.8037.97 to 155.0.8059.79. No build logic, sources, checksums, install scripts, permissions, or systemd-related artifacts are modified in the provided diff hunk. Based on the reviewed change alone, there is no evidence of a security issue.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=154.0.8037.97
+pkgver=155.0.8059.79
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

The change only updates the package version and the SHA256 checksum for a prebuilt release artifact fetched over HTTPS from the project’s GitHub releases page. I did not find any new build-time code execution, network fetches outside source=(), privilege escalation, install scripts, or other packaging red flags in this diff. The main residual risk is the inherent trust in a binary package release, but that risk existed before and is not introduced by this change.

@@ -54,7 +54,7 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('f22b37274378455fb4366396d762e0ec5bb2394b63f9de25db1a9ba005fb0716')
+sha256sums=('337bc4a46bc8a290444f40adf888898dc817517ae6c6dc8624a670a81e979de5')
 
 declare -gA _system_libs=(
     [brotli]=brotli