Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 156.0.8078.47 to 156.0.8078.73. There are no changes to source URLs, checksums, build steps, dependencies, install scripts, or packaging metadata that would introduce a security concern. On its face this is a routine upstream version update with no evidence of malicious behavior in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 156.0.8078.47
+	pkgver = 156.0.8078.73
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: it updates the declared Chromium/Chromedriver provides and source URLs from 156.0.8078.47 to 156.0.8078.73. The sources remain HTTPS and point to the expected upstream Chromium and ungoogled-chromium release artifacts, with no new scripts, patches, or build logic introduced. No security-relevant behavior changes are visible in this diff alone.

@@ -84,13 +84,13 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=156.0.8078.47
-	provides = chromedriver=156.0.8078.47
+	provides = chromium=156.0.8078.73
+	provides = chromedriver=156.0.8078.73
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
-	source = https://commondatastorage.googleapis.com/chromium-browser-official/chromium-156.0.8078.47-lite.tar.xz
-	source = ungoogled-chromium-156.0.8078.47-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/156.0.8078.47-1.tar.gz
+	source = https://commondatastorage.googleapis.com/chromium-browser-official/chromium-156.0.8078.73-lite.tar.xz
+	source = ungoogled-chromium-156.0.8078.73-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/156.0.8078.73-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch

Comment

The change is a routine version bump in .SRCINFO: pkgver/provides and the Chromium source tarball URL were updated from 156.0.8078.47 to 156.0.8078.73, along with matching checksum updates. The source URLs remain HTTPS and point to the expected upstream Chromium/ungoogled-chromium locations; there are no new build-time downloads, scripts, privilege changes, or packaging behavior changes in this diff. No security issue is evident from this metadata-only update.

@@ -113,8 +113,8 @@ pkgbase = ungoogled-chromium
 	source = enable-widevine-arm64.patch
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
-	sha256sums = 28432028890ef70e1f2e9db880c500907ad1b04f5ae6b655a3f394b9f2eaa705
-	sha256sums = acf73f8fab3fa7a4977f54e4e51b206eaf6cc425c2294ecc4dc8023fd093bd2d
+	sha256sums = cfdf8def1207b81af1231e5170bf849896cd353e72220ca05d93432e31551d59
+	sha256sums = d93b1e40e3ce0a1a3a96d107240f1367fe5336b87fbe55a18af82e337d7cc85c
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e
 	sha256sums = 4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e

Comment

The change is a routine version bump for ungoogled-chromium from 156.0.8078.47 to 156.0.8078.73, with corresponding checksum updates for the upstream Chromium tarball and the ungoogled-chromium source bundle. I do not see any new sources, build-time network fetches, privilege escalation, install-script changes, or other suspicious packaging behavior in this diff. The source URL remains the official Chromium storage endpoint and the package metadata changes are consistent with a normal upstream update.

@@ -12,14 +12,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=156.0.8078.47
+pkgver=156.0.8078.73
 pkgrel=1
 _launcher_ver=8
 _manual_clone=0
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=156.0.8078.47-1
+_uc_ver=156.0.8078.73-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"

Comment

The change only bumps pkgver/_uc_ver and refreshes the SHA256 checksums for the Chromium source tarball and one patch. No new sources, no build-script logic changes, and no suspicious network or privilege-related behavior is introduced by this diff. Based on the provided hunk, this is a routine version/update checksum refresh with low security risk.

@@ -116,8 +116,8 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         enable-widevine-arm64.patch
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
-sha256sums=('28432028890ef70e1f2e9db880c500907ad1b04f5ae6b655a3f394b9f2eaa705'
-            'acf73f8fab3fa7a4977f54e4e51b206eaf6cc425c2294ecc4dc8023fd093bd2d'
+sha256sums=('cfdf8def1207b81af1231e5170bf849896cd353e72220ca05d93432e31551d59'
+            'd93b1e40e3ce0a1a3a96d107240f1367fe5336b87fbe55a18af82e337d7cc85c'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'