Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.98.62 to 1.98.63. No sources, checksums, build logic, install scripts, or package metadata affecting trust boundaries were changed in the provided diff. On its face this is a routine upstream version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = brave-bin
 	pkgdesc = Web browser that blocks ads and trackers by default (binary release)
-	pkgver = 1.98.62
+	pkgver = 1.98.63
 	pkgrel = 1
 	epoch = 1
 	url = https://brave.com

Comment

The .SRCINFO change is a routine version bump for the Brave binary package: it updates the provided version, noextract filenames, and the official GitHub release URLs/checksums for x86_64 and aarch64. The sources remain HTTPS and point to the upstream Brave release artifacts, with no new scripts, build steps, or packaging behavior introduced. No security-relevant red flags are present in this diff alone.

@@ -17,19 +17,19 @@ pkgbase = brave-bin
 	optdepends = cups: Printer support
 	optdepends = libgnome-keyring: Enable GNOME keyring support
 	optdepends = libnotify: Native notification support
-	provides = brave=1.98.62
+	provides = brave=1.98.63
 	provides = brave-browser
 	conflicts = brave
-	noextract = brave-bin-1.98.62-x86_64.zip
-	noextract = brave-bin-1.98.62-aarch64.zip
+	noextract = brave-bin-1.98.63-x86_64.zip
+	noextract = brave-bin-1.98.63-aarch64.zip
 	options = !strip
 	source = brave-bin.sh
 	source = brave-browser.desktop
 	sha256sums = 75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00
 	sha256sums = c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a
-	source_x86_64 = brave-bin-1.98.62-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.62/brave-browser-1.98.62-linux-amd64.zip
-	sha256sums_x86_64 = c460c4aa2c472f31d7a38f09ed8ead9f95c6873621202ab74f2e626e8dcbc9c0
-	source_aarch64 = brave-bin-1.98.62-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.62/brave-browser-1.98.62-linux-arm64.zip
-	sha256sums_aarch64 = 78ad69aaf59aea76004ae055bf2cc8f8830cdba3165a69ea47dda543de88a0bc
+	source_x86_64 = brave-bin-1.98.63-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.63/brave-browser-1.98.63-linux-amd64.zip
+	sha256sums_x86_64 = 2473a889dc41cadf43a2401a442ac0cf9dfb1b0343e7fad88d505749565fca4e
+	source_aarch64 = brave-bin-1.98.63-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.63/brave-browser-1.98.63-linux-arm64.zip
+	sha256sums_aarch64 = 898aa0d04e544849abaf6ad15ea29b29bda5c851c64e8f5e302f6e371a82592c
 
 pkgname = brave-bin

Comment

The only change in this diff is a version bump in PKGBUILD from 1.98.62 to 1.98.63. No build logic, sources, checksums, install scripts, permissions, or dependencies were modified, so there is no new security-relevant behavior to assess in this hunk.

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.98.62
+pkgver=1.98.63
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'

Comment

This change only bumps brave-bin from 1.98.62 to 1.98.63 and updates the per-architecture SHA-256 checksums for the upstream GitHub release archives. The source URLs remain HTTPS and pinned to a specific release version, and there are no new build steps, scripts, or packaging behaviors introduced. I do not see any added supply-chain or privilege-escalation risk in this diff alone.

@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('c460c4aa2c472f31d7a38f09ed8ead9f95c6873621202ab74f2e626e8dcbc9c0')
-sha256sums_aarch64=('78ad69aaf59aea76004ae055bf2cc8f8830cdba3165a69ea47dda543de88a0bc')
+sha256sums_x86_64=('2473a889dc41cadf43a2401a442ac0cf9dfb1b0343e7fad88d505749565fca4e')
+sha256sums_aarch64=('898aa0d04e544849abaf6ad15ea29b29bda5c851c64e8f5e302f6e371a82592c')
 
 prepare() {
 	mkdir -p brave