Review Results

Comment

The change only bumps pkgver in .SRCINFO from 155.0.8059.79 to 155.0.8059.84. No sources, build logic, install scripts, permissions, or dependencies are altered in the reviewed hunk, so there is no new security concern visible here. This is a routine version update in metadata only.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 155.0.8059.79
+	pkgver = 155.0.8059.84
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The .SRCINFO update is consistent with a routine upstream binary package refresh: pkgver/provides/source/sha256 were bumped to 155.0.8059.84, and the added runtime dependencies (simdutf, highway, double-conversion) are plausible Chromium library dependencies. The source remains an HTTPS GitHub release artifact from the project’s own release namespace, with a matching checksum. No suspicious install scripts, build-time network fetches, or privilege-related changes are introduced in this diff hunk.

@@ -45,6 +45,8 @@ pkgbase = ungoogled-chromium-bin
 	depends = brotli
 	depends = libjpeg-turbo
 	depends = openh264
+	depends = simdutf
+	depends = highway
 	depends = dav1d
 	depends = flac
 	depends = libdrm

Comment

The change is a straightforward version bump in .SRCINFO for a binary package: it updates the provided Chromium/chromedriver version, the upstream release URL, and adds three runtime dependencies (simdutf, highway, double-conversion) that are consistent with Chromium's dependency set. The source remains HTTPS and points to the project's GitHub release artifact, with a new SHA256 checksum. I don't see any new build-time code execution, persistence mechanism, privilege escalation, or suspicious external source introduced by this metadata-only change.

@@ -53,6 +55,7 @@ pkgbase = ungoogled-chromium-bin
 	depends = libwebp
 	depends = minizip
 	depends = opus
+	depends = double-conversion
 	depends = libxslt
 	depends = harfbuzz
 	depends = freetype2

Comment

The change is a straightforward version bump in .SRCINFO: it updates the provided chromium/chromedriver versions and the GitHub release URL plus checksum to the new upstream binary release. The source remains HTTPS and points to the same official project release location, with no new scripts, build logic, or privilege-related artifacts introduced. No security-relevant red flags are visible in this diff alone.

@@ -62,11 +65,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=155.0.8059.79
-	provides = chromedriver=155.0.8059.79
+	provides = chromium=155.0.8059.84
+	provides = chromedriver=155.0.8059.84
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/155.0.8059.79-1/ungoogled-chromium-155.0.8059.79-1-x86_64.pkg.tar.zst
-	sha256sums = 337bc4a46bc8a290444f40adf888898dc817517ae6c6dc8624a670a81e979de5
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/155.0.8059.84-1/ungoogled-chromium-155.0.8059.84-1-x86_64.pkg.tar.zst
+	sha256sums = a1e534e519916d6df1efbf6b897b9efa1f28080794c80676a019327ce08030a6
 
 pkgname = ungoogled-chromium-bin

Comment

The change is a routine version bump for a prebuilt Chromium binary package, plus an updated SHA256 for the new release artifact and a few added runtime dependencies. I did not find any new build-time code execution, network fetches outside the declared source array, privilege escalation, or suspicious install scripts. The source remains an HTTPS GitHub release asset from the expected upstream project, and the package still only installs files from the downloaded archive into $pkgdir. Risk is low because the trust boundary is the upstream binary release itself, but this diff does not introduce additional security red flags beyond that existing model.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=155.0.8059.79
+pkgver=155.0.8059.84
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

The change is low risk. It only updates the pinned upstream binary package version/checksum and expands the list of system libraries used by the package metadata. There are no new build-time downloads, no script execution, no install hooks, and no privilege/persistence mechanisms introduced. The source remains an HTTPS GitHub release asset, and the checksum update is consistent with a version bump. I don’t see any security-relevant red flags in this diff.

@@ -54,16 +54,18 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('337bc4a46bc8a290444f40adf888898dc817517ae6c6dc8624a670a81e979de5')
+sha256sums=('a1e534e519916d6df1efbf6b897b9efa1f28080794c80676a019327ce08030a6')
 
 declare -gA _system_libs=(
     [brotli]=brotli
     [dav1d]=dav1d
+    [double-conversion]=double-conversion
     #[ffmpeg]=ffmpeg    # YouTube playback stopped working in Chromium 120
     [flac]=flac
     [fontconfig]=fontconfig
     [freetype]=freetype2
     [harfbuzz]=harfbuzz
+    [highway]=highway
     #[icu]=icu
     #[jsoncpp]=jsoncpp  # needs libstdc++
     #[libaom]=aom

Comment

The change only adds three runtime dependencies (double-conversion, highway, simdutf) to the packaged Chromium binary and updates the release checksum/pkgver. There is no new code execution, no install script, no network fetch at build time, and no privilege/persistence mechanism introduced. The source remains an HTTPS GitHub release artifact with a pinned checksum. This looks like a routine dependency metadata update for a new upstream binary release, with no obvious security regression in the diff provided.

@@ -78,6 +80,7 @@ declare -gA _system_libs=(
     [openh264]=openh264
     [opus]=opus
     #[re2]=re2          # needs libstdc++
+    [simdutf]=simdutf
     #[snappy]=snappy    # needs libstdc++
     #[woff2]=woff2      # needs libstdc++
     [zlib]=minizip