Can't this package depend on normal ffmpeg and dbus?

Same for me, but looking at my ~/.cache/yay/firefox-esr-bin it actually wasn't up to date. I suppose the pkgrel should have been updated to 2 when the checksum was fixed, for yay to notice the update (?)

Anyway, running git fetch there (not even git pull) was enough for Yay to notice and actually do the pull/merge and build the new commit.

at least for me it is still showing that the files did not pass the validity check

@cb474 should be working now

==> Validating source files with sha512sums...
    firefox-140.11.0esr.tar.xz ... FAILED
    firefox-esr.desktop ... Passed
    firefox-esr-safe.desktop ... Passed
    policies.json ... Passed
==> ERROR: One or more files did not pass the validity check!
Error: Failed to build firefox-esr-bin

Getting this error.

ffmpeg4.4 could be a new required package, since Arch upgraded ffmpeg from 7 to 8 and Firefox seems unable to use it. Perhaps it would be a good idea to add it, since without it Firefox cannot play some video formats (like everything on twitch for example). Official Arch Firefox package also switched from requiring ffmpeg to ffmpeg4.4.

Must be a mistake. Nothing about it is a script or a binary.

I cloned this package's repo then...

$ ll .SRCINFO

-rwxr-x--- 1 me me 1194 Aug 7 00:01 .SRCINFO*

Any reason why .SRCINFO is an executable file?

Last firefox-esr and last firefox are same version, thats's why its' confusing. Firefox pages communication about versions are very bad. The best way to understand what happens about firefox versions is here:
https://ftp.mozilla.org/pub/firefox/releases/