Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.98.60 to 1.98.62. No source URLs, checksums, install scripts, permissions, or packaging logic are changed here, so there is no new security concern visible in this diff. This is a routine metadata update.

@@ -1,6 +1,6 @@
 pkgbase = brave-bin
 	pkgdesc = Web browser that blocks ads and trackers by default (binary release)
-	pkgver = 1.98.60
+	pkgver = 1.98.62
 	pkgrel = 1
 	epoch = 1
 	url = https://brave.com

Comment

The change is a straightforward version bump in .SRCINFO for an existing binary package: it updates the provided version, noextract filenames, and pinned GitHub release URLs/checksums for the new Brave upstream release. The sources remain HTTPS and point to the official Brave GitHub release assets, with no new build logic, scripts, or privilege-related changes. I do not see any security-relevant red flags in this diff alone.

@@ -17,19 +17,19 @@ pkgbase = brave-bin
 	optdepends = cups: Printer support
 	optdepends = libgnome-keyring: Enable GNOME keyring support
 	optdepends = libnotify: Native notification support
-	provides = brave=1.98.60
+	provides = brave=1.98.62
 	provides = brave-browser
 	conflicts = brave
-	noextract = brave-bin-1.98.60-x86_64.zip
-	noextract = brave-bin-1.98.60-aarch64.zip
+	noextract = brave-bin-1.98.62-x86_64.zip
+	noextract = brave-bin-1.98.62-aarch64.zip
 	options = !strip
 	source = brave-bin.sh
 	source = brave-browser.desktop
 	sha256sums = 75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00
 	sha256sums = c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a
-	source_x86_64 = brave-bin-1.98.60-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.60/brave-browser-1.98.60-linux-amd64.zip
-	sha256sums_x86_64 = 0e49b5f84597fbbefdc8d791900d170d4f3792dc5d38056f6a3e35100706cdc7
-	source_aarch64 = brave-bin-1.98.60-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.60/brave-browser-1.98.60-linux-arm64.zip
-	sha256sums_aarch64 = f93bd3513ff0aae174edb5523002a9cb5e4923633d66a766c10db4dc30eab7df
+	source_x86_64 = brave-bin-1.98.62-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.62/brave-browser-1.98.62-linux-amd64.zip
+	sha256sums_x86_64 = c460c4aa2c472f31d7a38f09ed8ead9f95c6873621202ab74f2e626e8dcbc9c0
+	source_aarch64 = brave-bin-1.98.62-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.62/brave-browser-1.98.62-linux-arm64.zip
+	sha256sums_aarch64 = 78ad69aaf59aea76004ae055bf2cc8f8830cdba3165a69ea47dda543de88a0bc
 
 pkgname = brave-bin

Comment

The change is a simple version bump in PKGBUILD from 1.98.60 to 1.98.62 with no other modifications shown. There are no new sources, build steps, install scripts, permissions changes, or other security-relevant alterations in the provided diff hunk. Based on this diff alone, I see no evidence of malicious behavior or integrity regression.

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.98.60
+pkgver=1.98.62
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'

Comment

The change only updates Brave binary release version and the corresponding SHA-256 checksums for the x86_64 and aarch64 release archives. No build logic, install scripts, permissions, or network behavior changed. The sources remain HTTPS GitHub release URLs, and the package still verifies downloaded artifacts via checksums. Based on the diff provided, there are no new security red flags.

@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('0e49b5f84597fbbefdc8d791900d170d4f3792dc5d38056f6a3e35100706cdc7')
-sha256sums_aarch64=('f93bd3513ff0aae174edb5523002a9cb5e4923633d66a766c10db4dc30eab7df')
+sha256sums_x86_64=('c460c4aa2c472f31d7a38f09ed8ead9f95c6873621202ab74f2e626e8dcbc9c0')
+sha256sums_aarch64=('78ad69aaf59aea76004ae055bf2cc8f8830cdba3165a69ea47dda543de88a0bc')
 
 prepare() {
 	mkdir -p brave