Review Results

Comment

The change only bumps pkgver from 153.6.0 to 153.7.0 and resets pkgrel from 2 to 1 in .SRCINFO. No sources, checksums, build steps, install scripts, or packaging metadata affecting execution/persistence were altered in the reviewed hunk. On its face this is a routine version update with no security red flags in the provided diff.

@@ -1,7 +1,7 @@
 pkgbase = icecat
 	pkgdesc = GNU version of the Firefox ESR browser
-	pkgver = 153.6.0
-	pkgrel = 2
+	pkgver = 153.7.0
+	pkgrel = 1
 	url = https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git
 	arch = x86_64
 	license = MPL-2.0

Comment

The change is a routine upstream version bump in .SRCINFO: it updates the pinned gnuzilla commit and the Firefox ESR source tarball URL/checksum to newer upstream release artifacts. The sources remain HTTPS, the VCS source is still pinned to an explicit commit, and there are no new build-time commands, install-script changes, or suspicious extra sources introduced by this diff. No security red flags are evident from the metadata-only update.

@@ -55,17 +55,17 @@ pkgbase = icecat
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = xdg-desktop-portal: Screensharing with Wayland
-	noextract = firefox-esr-153.6.0-2-source.tar.xz
+	noextract = firefox-esr-153.7.0-1-source.tar.xz
 	options = !debug
 	options = !emptydirs
 	options = !lto
 	options = !makeflags
 	options = !strip
-	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=06bc11d237bb1dd0d556cbb5b83b77c99fbf9b4d
-	source = firefox-esr-153.6.0-2-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/153.6.0esr-candidates/build2/source/firefox-153.6.0esr.source.tar.xz
+	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=6e1dcc3e2b75cb650324ff3d4754361b5c00cd88
+	source = firefox-esr-153.7.0-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/153.7.0esr-candidates/build1/source/firefox-153.7.0esr.source.tar.xz
 	source = 0000-parallelize-makeicecat.diff
 	sha256sums = SKIP
-	sha256sums = 91cb675ddfc678255f57ecd7aad498501961577686d19c1947a82b14edea7f25
+	sha256sums = 7f8715ee7de2cf36a156216a9b1c7f26d1653010e65793bb2fce66e12edb6ea0
 	sha256sums = 27e3e298e59788156b180f8b4e5f9e91d0ad7c4cf74fb396f5e65c7d291ef94c
 
 pkgname = icecat

Comment

The diff only bumps IceCat to a new upstream release/commit and resets pkgrel. No new build steps, scripts, permissions changes, or source-fetching mechanisms were introduced in this hunk. The source URLs remain HTTPS and pinned to a specific git commit, and the checksum was updated accordingly. Based on the provided change alone, I don’t see a security regression.

@@ -25,15 +25,15 @@
 : ${_build_limit_cores:=auto} # number of cores for parallelism; or auto, limited by RAM
 
 ## update
-_icver="153.6.0-2"
-_commit="06bc11d237bb1dd0d556cbb5b83b77c99fbf9b4d"
-_ffsum="91cb675ddfc678255f57ecd7aad498501961577686d19c1947a82b14edea7f25"
+_icver="153.7.0-1"
+_commit="6e1dcc3e2b75cb650324ff3d4754361b5c00cd88"
+_ffsum="7f8715ee7de2cf36a156216a9b1c7f26d1653010e65793bb2fce66e12edb6ea0"
 
 ## package
 _pkgname="icecat"
 pkgname="$_pkgname"
 pkgver="${_icver%%-*}"
-pkgrel=2
+pkgrel=1
 pkgdesc="GNU version of the Firefox ESR browser"
 url="https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git"
 license=('MPL-2.0')