Review Results

Comment

The only change in this .SRCINFO hunk is a routine version bump for vivaldi-snapshot (8.3.4185.3 -> 8.3.4190.36) and an updated generated timestamp. No sources, checksums, dependencies, install scripts, or build logic are changed here, so there is no new security-relevant behavior to assess from this diff alone.

@@ -1,8 +1,8 @@
 # Generated by makepkg 7.1.0
-# Thu Oct  8 09:13:07 UTC 2026
+# Mon Oct 19 15:16:32 UTC 2026
 pkgbase = vivaldi-snapshot
 	pkgdesc = An advanced browser made with the power user in mind. Snapshot
-	pkgver = 8.3.4185.3
+	pkgver = 8.3.4190.36
 	pkgrel = 1
 	url = https://vivaldi.com
 	arch = x86_64

Comment

The change only bumps the upstream Vivaldi snapshot RPM URL and its corresponding SHA-512 checksum in .SRCINFO. The source remains an HTTPS download from the official Vivaldi domain, there are no new build-time commands, no added scripts, and no packaging behavior changes beyond updating the pinned release artifact. I did not find any integrity or persistence red flags in this diff.

@@ -36,9 +36,9 @@ pkgbase = vivaldi-snapshot
 	optdepends = upower: Battery Status API support
 	options = !strip
 	options = !zipman
-	source = https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-8.3.4185.3-1.x86_64.rpm
+	source = https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-8.3.4190.36-1.x86_64.rpm
 	source = 0001-add-support-for-user-flags.patch
-	sha512sums = ecb7a523099a9397f5eca0241d9d5ede3d39852db11030c7649d2b9fa3cb31b3a8e9a16ab3a352cf2ea9fcf3b4fced072a95d3e8233875b74c34dab1b17a29be
+	sha512sums = d57e3e944229943a41a116ca829d6aadd29e0592eaf43c44b6d614143f269d9d44bf6dfe54e91d6b255e0323d2ef87690010e73fc6f0ce02526cedb4e1dce6a4
 	sha512sums = 6b230614419416c44adf8fc2a677f8b1f1aca16949d20b7499417737001a6e9e314fc5841afaf402ad55b09910fca4c70fa7b6d38509b0546959bdbefb036726
 
 pkgname = vivaldi-snapshot

Comment

The change is a routine version bump in PKGBUILD: it updates the upstream Vivaldi snapshot RPM version and the corresponding SHA-512 checksum for the downloaded release artifact. No new sources, scripts, build steps, privilege changes, or packaging behavior were introduced, and the existing patch/source structure is unchanged. Based on the diff alone, there are no security red flags beyond the usual trust in the upstream binary release.

@@ -2,8 +2,8 @@
 # Contributor: TZ86
 
 pkgname=vivaldi-snapshot
-_rpmversion=8.3.4185.3-1
-pkgver=8.3.4185.3
+_rpmversion=8.3.4190.36-1
+pkgver=8.3.4190.36
 pkgrel=1
 pkgdesc='An advanced browser made with the power user in mind. Snapshot'
 url="https://vivaldi.com"

Comment

The change only updates the SHA-512 checksum for the upstream Vivaldi snapshot RPM source. The source URL remains HTTPS and unchanged, and there are no new build steps, scripts, or packaging behaviors introduced by this diff. I did not find any evidence in the reviewed hunk of added network access, privilege escalation, persistence, or other malicious behavior. This is a routine integrity checksum refresh, so risk is minimal.

@@ -42,7 +42,7 @@ optdepends=(
 )
 source=("https://downloads.vivaldi.com/snapshot/vivaldi-snapshot-${_rpmversion}.x86_64.rpm"
         '0001-add-support-for-user-flags.patch')
-sha512sums=('ecb7a523099a9397f5eca0241d9d5ede3d39852db11030c7649d2b9fa3cb31b3a8e9a16ab3a352cf2ea9fcf3b4fced072a95d3e8233875b74c34dab1b17a29be'
+sha512sums=('d57e3e944229943a41a116ca829d6aadd29e0592eaf43c44b6d614143f269d9d44bf6dfe54e91d6b255e0323d2ef87690010e73fc6f0ce02526cedb4e1dce6a4'
             '6b230614419416c44adf8fc2a677f8b1f1aca16949d20b7499417737001a6e9e314fc5841afaf402ad55b09910fca4c70fa7b6d38509b0546959bdbefb036726')
 
 package() {