Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 156.0.8078.73 to 156.0.8078.79. No source URLs, checksums, build steps, install scripts, or packaging metadata were altered, and there are no new execution, persistence, or integrity red flags visible in the provided diff. Based on this hunk alone, the change appears to be a routine upstream version update with no security impact.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 156.0.8078.73
+	pkgver = 156.0.8078.79
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The .SRCINFO change is a straightforward version bump for the package metadata: it updates the provided chromium/chromedriver versions and the corresponding upstream source tarball URLs from 156.0.8078.73 to 156.0.8078.79. The sources remain HTTPS and point to the expected upstream Chromium and ungoogled-chromium release artifacts, with no new build-time commands, no added scripts, and no suspicious metadata changes (e.g. no new conflicts/provides, no privilege-related files). Based on the diff shown, this is low risk and appears to be a routine release update.

@@ -84,13 +84,13 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=156.0.8078.73
-	provides = chromedriver=156.0.8078.73
+	provides = chromium=156.0.8078.79
+	provides = chromedriver=156.0.8078.79
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
-	source = https://commondatastorage.googleapis.com/chromium-browser-official/chromium-156.0.8078.73-lite.tar.xz
-	source = ungoogled-chromium-156.0.8078.73-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/156.0.8078.73-1.tar.gz
+	source = https://commondatastorage.googleapis.com/chromium-browser-official/chromium-156.0.8078.79-lite.tar.xz
+	source = ungoogled-chromium-156.0.8078.79-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/156.0.8078.79-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch

Comment

The .SRCINFO change is a routine version bump from 156.0.8078.73 to 156.0.8078.79, updating the corresponding source URLs, provides entries, and checksums. There are no new sources, no protocol changes, no added build steps, and no signs of malicious packaging behavior in this diff. Risk is minimal.

@@ -113,8 +113,8 @@ pkgbase = ungoogled-chromium
 	source = enable-widevine-arm64.patch
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
-	sha256sums = cfdf8def1207b81af1231e5170bf849896cd353e72220ca05d93432e31551d59
-	sha256sums = d93b1e40e3ce0a1a3a96d107240f1367fe5336b87fbe55a18af82e337d7cc85c
+	sha256sums = d9e8b637dbdd3a1cccb4966e81a66e3f3c4c29f5ce9732a70f5a4f949cd03923
+	sha256sums = 6d77c1e7430737937a3a4b63c130a7b4623344482c9b2979a91dfad716414e82
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e
 	sha256sums = 4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e

Comment

The change is a routine version bump in PKGBUILD: pkgver/_uc_ver updated from 156.0.8078.73 to 156.0.8078.79 and the corresponding source checksums were refreshed. No new sources, no build-script logic changes, no added network fetches, and no packaging/persistence behavior changes are introduced by this diff. Based on the provided hunk alone, this is low risk.

@@ -12,14 +12,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=156.0.8078.73
+pkgver=156.0.8078.79
 pkgrel=1
 _launcher_ver=8
 _manual_clone=0
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=156.0.8078.73-1
+_uc_ver=156.0.8078.79-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"

Comment

The change only bumps the Chromium/ungoogled-chromium version and updates the corresponding source checksums. The source remains the official Chromium tarball over HTTPS, and there are no new build steps, network fetches, privilege changes, or packaging/install-script modifications in this diff. I did not see any suspicious new sources or execution paths introduced by this hunk.

@@ -116,8 +116,8 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         enable-widevine-arm64.patch
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
-sha256sums=('cfdf8def1207b81af1231e5170bf849896cd353e72220ca05d93432e31551d59'
-            'd93b1e40e3ce0a1a3a96d107240f1367fe5336b87fbe55a18af82e337d7cc85c'
+sha256sums=('d9e8b637dbdd3a1cccb4966e81a66e3f3c4c29f5ce9732a70f5a4f949cd03923'
+            '6d77c1e7430737937a3a4b63c130a7b4623344482c9b2979a91dfad716414e82'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'