Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 153.5.1 to 153.6.0. No sources, checksums, build steps, install scripts, or permissions are modified here, so there is no new security-relevant behavior introduced by this diff alone. I did not see any indication of typosquatting, network fetches, or privilege-related changes in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = icecat
 	pkgdesc = GNU version of the Firefox ESR browser
-	pkgver = 153.5.1
+	pkgver = 153.6.0
 	pkgrel = 1
 	url = https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git
 	arch = x86_64

Comment

The change is limited to updating upstream source references in .SRCINFO: a new gnuzilla commit pin, a new Firefox ESR source tarball URL, and the corresponding checksum/noextract filename. The sources remain HTTPS and pinned to a specific commit/version, with no new build-time execution, install-script, or packaging-logic changes visible in this diff. I do note the gnuzilla URL still uses the unusual `https://https.git.savannah.gnu.org/...` host string, but that was already present before and is not introduced by this change. Overall this looks like a routine version bump with no clear security regression in the metadata itself.

@@ -55,17 +55,17 @@ pkgbase = icecat
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = xdg-desktop-portal: Screensharing with Wayland
-	noextract = firefox-esr-153.5.1-1-source.tar.xz
+	noextract = firefox-esr-153.6.0-2-source.tar.xz
 	options = !debug
 	options = !emptydirs
 	options = !lto
 	options = !makeflags
 	options = !strip
-	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=a3ef38e25706f0d05a6d860b44f2772e59c7c9e4
-	source = firefox-esr-153.5.1-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/153.5.1esr-candidates/build1/source/firefox-153.5.1esr.source.tar.xz
+	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=06bc11d237bb1dd0d556cbb5b83b77c99fbf9b4d
+	source = firefox-esr-153.6.0-2-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/153.6.0esr-candidates/build2/source/firefox-153.6.0esr.source.tar.xz
 	source = 0000-parallelize-makeicecat.diff
 	sha256sums = SKIP
-	sha256sums = c6888848f90e7ebeacad38725b9bbbfe7c9bea7078098d47a2cf2c1ff3e18b83
+	sha256sums = 91cb675ddfc678255f57ecd7aad498501961577686d19c1947a82b14edea7f25
 	sha256sums = 27e3e298e59788156b180f8b4e5f9e91d0ad7c4cf74fb396f5e65c7d291ef94c
 
 pkgname = icecat

Comment

The change only bumps the IceCat version/commit and updates the corresponding source checksum. No build logic, install scripts, permissions, or network behavior changed in the reviewed hunk. Based on this diff alone, there are no new security red flags.

@@ -25,9 +25,9 @@
 : ${_build_limit_cores:=auto} # number of cores for parallelism; or auto, limited by RAM
 
 ## update
-_icver="153.5.1-1"
-_commit="a3ef38e25706f0d05a6d860b44f2772e59c7c9e4"
-_ffsum="c6888848f90e7ebeacad38725b9bbbfe7c9bea7078098d47a2cf2c1ff3e18b83"
+_icver="153.6.0-2"
+_commit="06bc11d237bb1dd0d556cbb5b83b77c99fbf9b4d"
+_ffsum="91cb675ddfc678255f57ecd7aad498501961577686d19c1947a82b14edea7f25"
 
 ## package
 _pkgname="icecat"