Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 153.5.0 to 153.5.1. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the reviewed diff. On its face this is a routine upstream version update with no security red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = icecat
 	pkgdesc = GNU version of the Firefox ESR browser
-	pkgver = 153.5.0
+	pkgver = 153.5.1
 	pkgrel = 1
 	url = https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git
 	arch = x86_64

Comment

The change is a routine source/version bump in .SRCINFO: it updates the pinned gnuzilla commit and the Firefox ESR source tarball URL/checksum from 153.5.0 to 153.5.1. The sources remain HTTPS, the VCS source is still pinned to an explicit commit, and there are no new build-time commands, install-script changes, or suspicious extra sources introduced in this diff. No security red flags are evident from this metadata-only update.

@@ -55,17 +55,17 @@ pkgbase = icecat
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = xdg-desktop-portal: Screensharing with Wayland
-	noextract = firefox-esr-153.5.0-1-source.tar.xz
+	noextract = firefox-esr-153.5.1-1-source.tar.xz
 	options = !debug
 	options = !emptydirs
 	options = !lto
 	options = !makeflags
 	options = !strip
-	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=ac1ff821a67463e277853820109d56f7a2daf44d
-	source = firefox-esr-153.5.0-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/153.5.0esr-candidates/build1/source/firefox-153.5.0esr.source.tar.xz
+	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=a3ef38e25706f0d05a6d860b44f2772e59c7c9e4
+	source = firefox-esr-153.5.1-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/153.5.1esr-candidates/build1/source/firefox-153.5.1esr.source.tar.xz
 	source = 0000-parallelize-makeicecat.diff
 	sha256sums = SKIP
-	sha256sums = 28714a7d4f9b38c7aafbe38022de7775a3d9cb3c1ebf19a567c26eb761e3410b
+	sha256sums = c6888848f90e7ebeacad38725b9bbbfe7c9bea7078098d47a2cf2c1ff3e18b83
 	sha256sums = 27e3e298e59788156b180f8b4e5f9e91d0ad7c4cf74fb396f5e65c7d291ef94c
 
 pkgname = icecat

Comment

The change only bumps the IceCat version metadata and pins a new upstream commit/hash in PKGBUILD. There are no new sources, scripts, build steps, privilege changes, or packaging behavior changes in the diff. Based on the provided hunk alone, this is a routine version update with no evident security impact.

@@ -25,9 +25,9 @@
 : ${_build_limit_cores:=auto} # number of cores for parallelism; or auto, limited by RAM
 
 ## update
-_icver="153.5.0-1"
-_commit="ac1ff821a67463e277853820109d56f7a2daf44d"
-_ffsum="28714a7d4f9b38c7aafbe38022de7775a3d9cb3c1ebf19a567c26eb761e3410b"
+_icver="153.5.1-1"
+_commit="a3ef38e25706f0d05a6d860b44f2772e59c7c9e4"
+_ffsum="c6888848f90e7ebeacad38725b9bbbfe7c9bea7078098d47a2cf2c1ff3e18b83"
 
 ## package
 _pkgname="icecat"