AUR AI Reviewer

Review Results

Version #2847 of ungoogled-chromium · commit e66e70717e72 · status Reviewed

Risk 0/5 · Safe .SRCINFO
Result #5160

Comment

The only change in this .SRCINFO hunk is a version bump from 155.0.8059.79 to 155.0.8059.84. No sources, checksums, build steps, install scripts, or packaging metadata were altered, so there is no new security-relevant behavior introduced by this diff alone. This appears to be a routine upstream version update.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 155.0.8059.79
+	pkgver = 155.0.8059.84
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64
Risk 0/5 · Safe .SRCINFO
Result #5161

Comment

The change only adds a runtime dependency entry for simdutf in .SRCINFO. This is metadata-only and does not introduce any build-time execution, network access, privilege changes, or packaging behavior changes by itself. I did not see any security-relevant red flags in this diff hunk alone.

@@ -64,6 +64,7 @@ pkgbase = ungoogled-chromium
 	depends = brotli
 	depends = libjpeg-turbo
 	depends = openh264
+	depends = simdutf
 	depends = highway
 	depends = dav1d
 	depends = flac
Risk 0/5 · Safe .SRCINFO
Result #5162

Comment

The change only adds a runtime dependency entry for double-conversion in .SRCINFO. This is a metadata-only update with no code execution, no new sources, no install script changes, and no packaging behavior changes visible in the diff. I see no security impact from this modification alone.

@@ -73,6 +74,7 @@ pkgbase = ungoogled-chromium
 	depends = libwebp
 	depends = minizip
 	depends = opus
+	depends = double-conversion
 	depends = libxslt
 	depends = harfbuzz
 	depends = freetype2
Risk 0/5 · Safe .SRCINFO
Result #5163

Comment

The .SRCINFO update is a routine version bump: it advances the declared Chromium/ungoogled-chromium version from 155.0.8059.79 to 155.0.8059.84 and adds one additional patch reference. The sources remain HTTPS and point to the expected upstream Chromium tarball and ungoogled-chromium release archive; there are no new build-time downloads, scripts, privilege changes, or suspicious metadata such as replaces/provides hijacking beyond the normal chromium/chromedriver virtual provides. Based on this diff alone, I do not see a security issue.

@@ -82,17 +84,18 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=155.0.8059.79
-	provides = chromedriver=155.0.8059.79
+	provides = chromium=155.0.8059.84
+	provides = chromedriver=155.0.8059.84
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
-	source = https://commondatastorage.googleapis.com/chromium-browser-official/chromium-155.0.8059.79-lite.tar.xz
-	source = ungoogled-chromium-155.0.8059.79-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/155.0.8059.79-1.tar.gz
+	source = https://commondatastorage.googleapis.com/chromium-browser-official/chromium-155.0.8059.84-lite.tar.xz
+	source = ungoogled-chromium-155.0.8059.84-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/155.0.8059.84-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch
 	source = chromium-147-rust-1.95-bytemuck.patch
+	source = chromium-147-simdutf-8.0-base-char.patch
 	source = chromium-149-use-of-undeclared-identifier-ERROR.patch
 	source = chromium-150-revert-avx-flag-change.patch
 	source = chromium-152-unbundle-minizip-undo-unicode.patch
Risk 0/5 · Safe .SRCINFO
Result #5164

Comment

The change only removes one patch entry from .SRCINFO: chromium-155-fix-gn-no-public_inputs.patch. By itself this is a metadata update, not an execution path, and there is no evidence here of added network access, privilege escalation, or packaging of suspicious binaries/scripts. The only potential concern is that the corresponding patch may no longer be applied, but that is a build correctness issue rather than a security issue based on the provided diff alone.

@@ -100,7 +103,6 @@ pkgbase = ungoogled-chromium
 	source = chromium-153-hermetic-python.patch
 	source = chromium-153-iamf-tools-unbundled-opus.patch
 	source = chromium-154-typescript.patch
-	source = chromium-155-fix-gn-no-public_inputs.patch
 	source = chromium-155-crubit.patch
 	source = chromium-155-remove-private_verification_tokens.patch
 	source = chromium-155-isolatedDeclarations.patch
Risk 0/5 · Safe .SRCINFO
Result #5165

Comment

The change is a routine version bump in .SRCINFO for ungoogled-chromium: pkgver/provides/source checksums are updated, one patch is added and one removed, and two dependency entries are added. I do not see any signs of malicious behavior in this metadata-only diff: sources remain HTTPS and point to the expected upstream GitHub/Chromium locations, there are no new build-time downloads or execution hooks, and no install scripts or systemd/persistence artifacts are involved in the reviewed hunk. Risk is low, though the actual patch contents were not part of this diff and would need separate inspection if they were changed elsewhere.

@@ -110,12 +112,13 @@ pkgbase = ungoogled-chromium
 	source = enable-widevine-arm64.patch
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
-	sha256sums = fcb5be44f1f5916ac23309c706146819c792c0d0e9c1a8220b7fbc046d79f15e
-	sha256sums = 22040dedc442fa21c44b73bf5ac5cf9d191d1e1802eca3a60b6f9abb52659d28
+	sha256sums = 2063834f528029ad02a6a3de6d229c3e8b19bc43864be397944cbda18d7ee680
+	sha256sums = 555c7547de4d7f82dbe54d943b7f47d7b6e693b7b92a6e86dec0eac98e8092a5
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e
 	sha256sums = 4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e
 	sha256sums = b9e6339221efe03540ffb360c161d93604a1fc93a5a1c53e5e9849066f987d05
+	sha256sums = 80e445d7a5cbd61d1252ecf46c5eaf0fb4a5e63bd1b9c976261df778a4586640
 	sha256sums = 951514535be65f0e2f84e82305d96292be1da353c1427ba1048ea24be70003c4
 	sha256sums = 5f6ccb7b945c8a13c690493723bad816b36f2f25792d47e677b56f8200907e60
 	sha256sums = 890e5d98088ef1c7c075a551442f03385d1db266cad8a65576704a22720683f9
Risk 0/5 · Safe .SRCINFO
Result #5166

Comment

The change only removes one sha256 checksum entry from .SRCINFO. By itself this does not introduce new sources, code execution, privilege changes, or packaging behavior; it appears to be a metadata synchronization/edit. I see no security impact from the diff hunk provided.

@@ -123,7 +126,6 @@ pkgbase = ungoogled-chromium
 	sha256sums = ebf74154266d0b6d6cc957c413f845052c5fcfce7745befb8821595cdf3f7d49
 	sha256sums = 2ab9fbe653829ce692f83ee780aad07e8c83a6686e51ab9459ad736cfa2850ee
 	sha256sums = d061cf4aeba21b1d2edabc28afd38106246b99aa5ec699e1b9ee5ca8b76d8a23
-	sha256sums = 81a9014afff7e2a836c2ba2da69a9023d42d2f69a46cb91a0504642c480f6cc7
 	sha256sums = 85217fbc43f075068167643f0357e3df19a46805efd81a3eae00f966e04290eb
 	sha256sums = d42a5a72c1b085d2623b00caad958f18a6970dbed27558ce7b564e0468f3e252
 	sha256sums = c5aaccfb1f5d6738bfe7e360d6af0bd22f0a1cf4104c28b66cb78e0ff3e9ae08
Risk 0/5 · Safe PKGBUILD
Result #5167

Comment

The change is a straightforward version bump in PKGBUILD from 155.0.8059.79 to 155.0.8059.84, with the corresponding internal ungoogled-chromium version updated as well. No new sources, build steps, install scripts, permissions, or other packaging logic changed in the provided diff. Based on this hunk alone, there are no security red flags.

@@ -11,14 +11,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=155.0.8059.79
+pkgver=155.0.8059.84
 pkgrel=1
 _launcher_ver=8
 _manual_clone=0
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=155.0.8059.79-1
+_uc_ver=155.0.8059.84-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"
Risk 0/5 · Safe PKGBUILD
Result #5168

Comment

The change is a routine package update: it bumps Chromium from 155.0.8059.79 to .84, adds a new upstream patch to support simdutf >= 8.0, and adjusts the unbundling logic to account for double-conversion living under base/third_party. The new patch is small and local, only changing a type cast in base/simdutf_shim.cc to satisfy the simdutf API, with no signs of network access, privilege escalation, embedded binaries, or suspicious install-time behavior. I did note that one old patch was removed from the source list, but based on the diff shown this appears to be a normal patch refresh accompanying the version bump rather than a security concern.

@@ -97,6 +97,7 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         chromium-138-nodejs-version-check.patch
         chromium-145-fix-SYS_SECCOMP.patch
         chromium-147-rust-1.95-bytemuck.patch
+        chromium-147-simdutf-8.0-base-char.patch
         chromium-149-use-of-undeclared-identifier-ERROR.patch
         chromium-150-revert-avx-flag-change.patch
         chromium-152-unbundle-minizip-undo-unicode.patch
Risk 0/5 · Safe PKGBUILD
Result #5169

Comment

The PKGBUILD change is low risk. It updates the package version, adds a new local patch to support simdutf >= 8.0, removes an obsolete Chromium patch, and adjusts bundled-library cleanup to handle double-conversion under base/third_party. I checked the added patch: it is a small type-cast fix in base/simdutf_shim.cc and does not introduce network access, privilege escalation, persistence, or suspicious build-time behavior. The new source entry is a local patch with a pinned checksum, and the rest of the diff is dependency/cleanup bookkeeping.

@@ -104,7 +105,6 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         chromium-153-hermetic-python.patch
         chromium-153-iamf-tools-unbundled-opus.patch
         chromium-154-typescript.patch
-        chromium-155-fix-gn-no-public_inputs.patch
         chromium-155-crubit.patch
         chromium-155-remove-private_verification_tokens.patch
         chromium-155-isolatedDeclarations.patch
Risk 0/5 · Safe PKGBUILD
Result #5170

Comment

The change is a routine version bump plus patch/source checksum updates and a small packaging adjustment to handle unbundling `double-conversion` from `base/third_party`. I do not see any new network fetches, privilege escalation, install-script changes, or suspicious execution paths. The removed GN patch and added simdutf patch are normal upstream maintenance artifacts, and the checksum updates correspond to the new/renamed patch set. Overall this looks like a low-risk maintenance update with no obvious security red flags in the reviewed hunk.

@@ -114,12 +114,13 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         enable-widevine-arm64.patch
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
-sha256sums=('fcb5be44f1f5916ac23309c706146819c792c0d0e9c1a8220b7fbc046d79f15e'
-            '22040dedc442fa21c44b73bf5ac5cf9d191d1e1802eca3a60b6f9abb52659d28'
+sha256sums=('2063834f528029ad02a6a3de6d229c3e8b19bc43864be397944cbda18d7ee680'
+            '555c7547de4d7f82dbe54d943b7f47d7b6e693b7b92a6e86dec0eac98e8092a5'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'
             'b9e6339221efe03540ffb360c161d93604a1fc93a5a1c53e5e9849066f987d05'
+            '80e445d7a5cbd61d1252ecf46c5eaf0fb4a5e63bd1b9c976261df778a4586640'
             '951514535be65f0e2f84e82305d96292be1da353c1427ba1048ea24be70003c4'
             '5f6ccb7b945c8a13c690493723bad816b36f2f25792d47e677b56f8200907e60'
             '890e5d98088ef1c7c075a551442f03385d1db266cad8a65576704a22720683f9'
Risk 0/5 · Safe PKGBUILD
Result #5171

Comment

The change only removes one SHA-256 entry from the PKGBUILD source integrity list. By itself this does not introduce executable code, network access, privilege changes, or packaging behavior changes. It may indicate a source list adjustment, but without the corresponding source removal/addition in the reviewed hunk there is no direct security impact visible here.

@@ -127,7 +128,6 @@ sha256sums=('fcb5be44f1f5916ac23309c706146819c792c0d0e9c1a8220b7fbc046d79f15e'
             'ebf74154266d0b6d6cc957c413f845052c5fcfce7745befb8821595cdf3f7d49'
             '2ab9fbe653829ce692f83ee780aad07e8c83a6686e51ab9459ad736cfa2850ee'
             'd061cf4aeba21b1d2edabc28afd38106246b99aa5ec699e1b9ee5ca8b76d8a23'
-            '81a9014afff7e2a836c2ba2da69a9023d42d2f69a46cb91a0504642c480f6cc7'
             '85217fbc43f075068167643f0357e3df19a46805efd81a3eae00f966e04290eb'
             'd42a5a72c1b085d2623b00caad958f18a6970dbed27558ce7b564e0468f3e252'
             'c5aaccfb1f5d6738bfe7e360d6af0bd22f0a1cf4104c28b66cb78e0ff3e9ae08'
Risk 0/5 · Safe PKGBUILD
Result #5172

Comment

The change only adds `double-conversion` to the `_system_libs` mapping in PKGBUILD, which affects how the package links against a system library. This is a normal dependency/configuration update with no evidence of network access, code execution, privilege escalation, or packaging integrity issues. I did not find any suspicious source changes or install-time behavior in the provided hunk.

@@ -149,6 +149,7 @@ fi
 declare -gA _system_libs=(
   [brotli]=brotli
   [dav1d]=dav1d
+  [double-conversion]=double-conversion
   #[ffmpeg]=ffmpeg    # YouTube playback stopped working in Chromium 120
   [flac]=flac
   [fontconfig]=fontconfig
Risk 0/5 · Safe PKGBUILD
Result #5173

Comment

The PKGBUILD change is low risk. It adds a new unbundling patch for simdutf and updates the system library mapping so Chromium links against the packaged simdutf/double-conversion instead of bundled copies. I checked the patch content: it is a small type-cast fix in base/simdutf_shim.cc to accommodate simdutf >= 8.0, with no network access, privilege changes, or suspicious install-time behavior. The removed GN patch appears to be a normal upstream maintenance adjustment, not a security concern. No high-risk supply-chain or persistence issues are evident in this diff.

@@ -169,6 +170,7 @@ declare -gA _system_libs=(
   [openh264]=openh264
   [opus]=opus
   #[re2]=re2          # needs libstdc++
+  [simdutf]=simdutf
   #[snappy]=snappy    # needs libstdc++
   #[woff2]=woff2      # needs libstdc++
   [zlib]=minizip
Risk 0/5 · Safe PKGBUILD
Result #5174

Comment

The change adds a small patch to adapt Chromium’s simdutf shim for simdutf >= 8.0, and updates the package metadata to use the corresponding upstream release and patch checksum. The patch is narrowly scoped to a type conversion in base/simdutf_shim.cc and does not introduce new execution paths, network access, privilege changes, or packaging behavior. I did note the PKGBUILD also switches the bundled-lib cleanup logic to handle double-conversion’s different path, but that is a straightforward packaging fix and not a security concern. No high-risk issues are evident in this diff.

@@ -231,6 +233,9 @@ prepare() {
   # Credit: https://github.com/ungoogled-software/ungoogled-chromium/pull/3837
   patch -Np1 -i ../chromium-150-revert-avx-flag-change.patch
 
+  # To unbundle simdutf
+  patch -Np1 -i ../chromium-147-simdutf-8.0-base-char.patch
+
   patch -Np1 -i ../chromium-152-unbundle-minizip-undo-unicode.patch
 
   patch -Np1 -i ../chromium-152-unbundle-opus-devtools.patch
Risk 0/5 · Safe PKGBUILD
Result #5175

Comment

The change is low risk. It removes one patch application from prepare() and updates the package version/checksums accordingly, while adding a new simdutf patch and system library entry. I did not see any new network fetches, privilege escalation, install-script changes, or suspicious build-time execution in the reviewed hunk. The only notable behavior change is switching the bundled-library cleanup logic to handle double-conversion under base/third_party, which is consistent with the new unbundling work and does not appear malicious.

@@ -249,8 +254,6 @@ prepare() {
   # https://github.com/ungoogled-software/ungoogled-chromium/pull/3966
   patch -Np1 -i ../chromium-154-typescript.patch
 
-  patch -Np1 -i ../chromium-155-fix-gn-no-public_inputs.patch
-
   patch -Np1 -i ../chromium-155-crubit.patch
 
   patch -Np1 -i ../chromium-155-isolatedDeclarations.patch
Risk 0/5 · Safe PKGBUILD
Result #5176

Comment

The change only broadens the cleanup logic in prepare() to handle the double-conversion library being located under base/third_party/double_conversion instead of third_party/<lib>. It does not add any new network access, privilege escalation, install-time actions, or suspicious execution. The path fallback is deterministic and still only deletes bundled source files under the source tree, so I see no security issue in this diff.

@@ -300,9 +303,16 @@ prepare() {
   # added benefit of not having to list all the remaining libraries
   local _lib
   for _lib in ${_unwanted_bundled_libs[@]}; do
-    find "third_party/$_lib" -type f \
-      \! -path "third_party/$_lib/chromium/*" \
-      \! -path "third_party/$_lib/google/*" \
+    # Most bundled libraries live under `third_party/<lib>`, but
+    # `double-conversion` is located under `base/third_party/double_conversion`
+    local _dir="third_party/$_lib"
+    if [[ ! -d "${_dir}" ]]; then
+      _dir="base/third_party/${_lib//-/_}"
+    fi
+
+    find "$_dir" -type f \
+      \! -path "$_dir/chromium/*" \
+      \! -path "$_dir/google/*" \
       \! -path "third_party/harfbuzz-ng/utils/hb_scoped.h" \
       \! -regex '.*\.\(gn\|gni\|isolate\)' \
       -delete
Risk 0/5 · Safe REUSE.toml
Result #5177

Comment

The change only updates REUSE.toml license annotations for patch filenames: it adds chromium-147-simdutf-8.0-base-char.patch to the Chromium-contributed group and removes chromium-154-fix-gn-no-public_inputs.patch / chromium-155-fix-gn-no-public_inputs.patch from their previous annotation blocks. This is metadata-only and does not affect build logic, source fetching, or installed artifacts. No security-relevant behavior is introduced by this diff.

@@ -47,11 +47,11 @@ path = [
     "chromium-138-nodejs-version-check.patch",
     "chromium-144-fix-hdr-issue.patch",
     "chromium-145-fix-SYS_SECCOMP.patch",
+    "chromium-147-simdutf-8.0-base-char.patch",
     "compiler-rt-adjust-paths.patch",
     "increase-fortify-level.patch",
     "use-oauth2-client-switches-as-default.patch",
     "chromium-150-revert-avx-flag-change.patch",
-    "chromium-154-fix-gn-no-public_inputs.patch",
     "chromium-152-unbundle-minizip-undo-unicode.patch",
     "chromium-152-unbundle-opus-devtools.patch",
 ]
Risk 0/5 · Safe REUSE.toml
Result #5178

Comment

The change only removes one patch filename from REUSE.toml's SPDX inventory. This is a metadata-only update and does not alter build logic, package contents, or introduce any execution path. I did not see any security-relevant effect from this diff alone.

@@ -62,7 +62,6 @@ SPDX-License-Identifier = "BSD-3-Clause"
 path = [
     "chromium-153-hermetic-python.patch",
     "chromium-154-typescript.patch",
-    "chromium-155-fix-gn-no-public_inputs.patch",
     "chromium-155-crubit.patch",
     "chromium-155-remove-private_verification_tokens.patch",
     "chromium-155-isolatedDeclarations.patch",
Risk 0/5 · Safe chromium-147-simdutf-8.0-base-char.patch
Result #5179

Comment

The patch is a small type-cast adjustment in Chromium’s simdutf shim to accommodate simdutf >= 8.0. It does not introduce new sources, network access, privilege changes, install-script behavior, or packaging changes. The reinterpret_cast only changes the view of existing input bytes for an API signature mismatch and stays within the same function scope. No obvious security regression is apparent from this diff alone.

@@ -0,0 +1,26 @@
+From a2f732bb38e4cfd18b768d08ef1f2d9ce6f230c5 Mon Sep 17 00:00:00 2001
+From: LN Liberda <lauren@selfisekai.rocks>
+Date: Sun, 15 Mar 2026 05:30:36 +0100
+Subject: [PATCH] base: cast uint8_t into char for simdutf
+
+This is needed to build with simdutf >=8.0
+---
+ base/simdutf_shim.cc | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/base/simdutf_shim.cc b/base/simdutf_shim.cc
+index 81c5cc6aff5c8..88262066e53a0 100644
+--- a/base/simdutf_shim.cc
++++ b/base/simdutf_shim.cc
+@@ -14,7 +14,10 @@ size_t simdutf_base64_length_from_binary(size_t length) {
+ 
+ size_t simdutf_binary_to_base64(std::span<const uint8_t> input,
+                                 std::span<char> binary_output) {
+-  return simdutf::binary_to_base64(input, binary_output);
++  return simdutf::binary_to_base64(
++      std::span<const char>(reinterpret_cast<const char*>(input.data()),
++                            input.size()),
++      binary_output);
+ }
+ 
+ }  // namespace base::internal