Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 156.0.8078.47 to 156.0.8078.73. No source URLs, checksums, build steps, install scripts, permissions, or package metadata that would affect security were changed in the provided diff. On its face this is a routine upstream version update with no evident supply-chain or privilege-escalation risk in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 156.0.8078.47
+	pkgver = 156.0.8078.73
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for a binary package: it updates the provided chromium/chromedriver versions and the GitHub release URL plus checksum to the newer upstream release. The source remains an HTTPS GitHub release artifact from the project’s official release namespace, and there are no new build steps, scripts, or privilege-related changes introduced by this diff. No security red flags are evident in the reviewed hunk.

@@ -65,11 +65,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=156.0.8078.47
-	provides = chromedriver=156.0.8078.47
+	provides = chromium=156.0.8078.73
+	provides = chromedriver=156.0.8078.73
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/156.0.8078.47-1/ungoogled-chromium-156.0.8078.47-1-x86_64.pkg.tar.zst
-	sha256sums = f770a4826715a9939ced2d8667644038990619f84014aa724b64368436833107
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/156.0.8078.73-1/ungoogled-chromium-156.0.8078.73-1-x86_64.pkg.tar.zst
+	sha256sums = 95fb56c2e7d1bc3eea3a247f1e0dddd8ca562f0b4bd45da99b667e223f1f3eb2
 
 pkgname = ungoogled-chromium-bin

Comment

The change only bumps pkgver and updates the source checksum for the prebuilt upstream release artifact. The source remains an HTTPS GitHub release URL from the project’s own repository, with no new build logic, scripts, or packaging behavior changes. I did not find any added integrity, execution, or persistence risks in this diff.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=156.0.8078.47
+pkgver=156.0.8078.73
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

The change only updates the SHA-256 checksum for an existing HTTPS GitHub release asset in source=(). The source URL remains pinned to the package version/release and there are no new build steps, scripts, or privilege-related changes. I did not find any indication of added network fetches, code execution, or packaging behavior changes in this diff hunk. Risk is low because this is an integrity metadata update, though checksum changes always warrant verifying the upstream artifact provenance.

@@ -54,7 +54,7 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('f770a4826715a9939ced2d8667644038990619f84014aa724b64368436833107')
+sha256sums=('95fb56c2e7d1bc3eea3a247f1e0dddd8ca562f0b4bd45da99b667e223f1f3eb2')
 
 declare -gA _system_libs=(
     [brotli]=brotli