chore: bump node to v22.22.1 (39-x-y) (#50100)

* chore: bump node in DEPS to v22.22.1

* chore: update patches

* chore: fixup remove_obsolete_noarraybufferzerofillscope.patch

* deps: update simdjson to 4.2.4

 https://github.com/nodejs/node/pull/61056

* fix: generate_config_gypi needs to generate valid JSON

https: //github.com/nodejs/node/pull/60794
(cherry picked from commit a1d06cdd8a)
Co-Authored-By: Shelley Vohr <shelley.vohr@gmail.com>

* src: fix off-thread cert loading in bundled cert mode

https://github.com/nodejs/node/pull/60764
(cherry picked from commit cb4deec8f0)

This test fails on boringssl incompatibilities:
https://github.com/electron/electron/pull/49744/changes#r2799802487

Co-Authored-By: Shelley Vohr <shelley.vohr@gmail.com>

* test: move sea tests into test/sea

https://github.com/nodejs/node/pull/60250
(cherry picked from commit 695929b66a)

* src: fix off-thread cert loading in bundled cert mode

nodejs/node#60764

The Node.js cli flag --use-bundled-ca is not supported in Electron

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: John Kleinschmidt <kleinschmidtorama@gmail.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

DEPS

@@ -4,7 +4,7 @@ vars = {
   'chromium_version':
     '142.0.7444.265',
   'node_version':
-    'v22.22.0',
+    'v22.22.1',
   'nan_version':
     'e14bdcd1f72d62bca1d541b66da43130384ec213',
   'squirrel.mac_version':

patches/node/.patches

@@ -43,7 +43,6 @@ cli_move_--trace-atomics-wait_to_eol.patch
 fix_cppgc_initializing_twice.patch
 fix_task_starvation_in_inspector_context_test.patch
 fix_expose_readfilesync_override_for_modules.patch
-fix_array_out-of-bounds_read_in_boyer-moore_search.patch
 chore_add_missing_include_of_iterator.patch
 test_accomodate_v8_thenable_stack_trace_change_in_snapshot.patch
 chore_exclude_electron_node_folder_from_exit-time-destructors.patch
@@ -53,7 +52,6 @@ fix_replace_deprecated_setprototype.patch
 fix_redefined_macos_sdk_header_symbols.patch
 src_use_cp_utf8_for_wide_file_names_on_win32.patch
 fix_ensure_traverseparent_bails_on_resource_path_exit.patch
-src_handle_der_decoding_errors_from_system_certificates.patch
 remove_obsolete_noarraybufferzerofillscope.patch
 src_prepare_for_v8_sandboxing.patch
-test_correct_conditional_secure_heap_flags_test.patch
+fix_generate_config_gypi_needs_to_generate_valid_json.patch

patches/node/api_remove_deprecated_getisolate.patch

@@ -6,10 +6,10 @@ Subject: Remove deprecated `GetIsolate`
 https://chromium-review.googlesource.com/c/v8/v8/+/6905244
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index ceac508418f489a8077c1bc85a2feaf85bf60480..33827edce63c9fe08b52aea59571391a83853443 100644
+index d2614bba9463056e931b6d5c1f3153e2f576b779..f3a992b634e9532cba34ec4d54b3a1d0f68a8545 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -646,7 +646,7 @@ std::unique_ptr<MultiIsolatePlatform> MultiIsolatePlatform::Create(
+@@ -651,7 +651,7 @@ std::unique_ptr<MultiIsolatePlatform> MultiIsolatePlatform::Create(
  
  MaybeLocal<Object> GetPerContextExports(Local<Context> context,
                                          IsolateData* isolate_data) {
@@ -18,7 +18,7 @@ index ceac508418f489a8077c1bc85a2feaf85bf60480..33827edce63c9fe08b52aea59571391a
    EscapableHandleScope handle_scope(isolate);
  
    Local<Object> global = context->Global();
-@@ -692,7 +692,7 @@ void ProtoThrower(const FunctionCallbackInfo<Value>& info) {
+@@ -697,7 +697,7 @@ void ProtoThrower(const FunctionCallbackInfo<Value>& info) {
  // This runs at runtime, regardless of whether the context
  // is created from a snapshot.
  Maybe<void> InitializeContextRuntime(Local<Context> context) {
@@ -27,7 +27,7 @@ index ceac508418f489a8077c1bc85a2feaf85bf60480..33827edce63c9fe08b52aea59571391a
    HandleScope handle_scope(isolate);
  
    // When `IsCodeGenerationFromStringsAllowed` is true, V8 takes the fast path
-@@ -771,7 +771,7 @@ Maybe<void> InitializeContextRuntime(Local<Context> context) {
+@@ -776,7 +776,7 @@ Maybe<void> InitializeContextRuntime(Local<Context> context) {
  }
  
  Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
@@ -36,7 +36,7 @@ index ceac508418f489a8077c1bc85a2feaf85bf60480..33827edce63c9fe08b52aea59571391a
    HandleScope handle_scope(isolate);
  
    // Delete `Intl.v8BreakIterator`
-@@ -796,7 +796,7 @@ Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
+@@ -801,7 +801,7 @@ Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
  }
  
  Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
@@ -45,7 +45,7 @@ index ceac508418f489a8077c1bc85a2feaf85bf60480..33827edce63c9fe08b52aea59571391a
    HandleScope handle_scope(isolate);
  
    // Initialize the default values.
-@@ -814,7 +814,7 @@ Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
+@@ -819,7 +819,7 @@ Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
  MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
                                              IsolateData* isolate_data) {
    CHECK(isolate_data);
@@ -54,7 +54,7 @@ index ceac508418f489a8077c1bc85a2feaf85bf60480..33827edce63c9fe08b52aea59571391a
    EscapableHandleScope scope(isolate);
    Context::Scope context_scope(context);
  
-@@ -838,7 +838,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
+@@ -843,7 +843,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
  MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
                                                 IsolateData* isolate_data) {
    CHECK(isolate_data);
@@ -63,7 +63,7 @@ index ceac508418f489a8077c1bc85a2feaf85bf60480..33827edce63c9fe08b52aea59571391a
    EscapableHandleScope scope(isolate);
    Context::Scope context_scope(context);
  
-@@ -864,7 +864,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
+@@ -869,7 +869,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
  Maybe<void> InitializePrimordials(Local<Context> context,
                                    IsolateData* isolate_data) {
    // Run per-context JS files.
@@ -85,10 +85,10 @@ index 6f731b17fe0b84dd3d2c9bc9cfef1f8062a2c5f7..71a1072ed2decbee08d40eda7c47456b
  
    return handle;
 diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index 8f50d0cc132ac65fa74cf1fc2172247b5ad42962..0c6b12f8e17b4a7e86ebc836a4e1cc77333f211a 100644
+index 2cd7cd67c1c480eb9ec549a12bc2b9584d5a53b3..081a4ccdee718afc63b55da90a60ef9758dcc96a 100644
 --- a/src/crypto/crypto_context.cc
 +++ b/src/crypto/crypto_context.cc
-@@ -1020,7 +1020,7 @@ bool ArrayOfStringsToX509s(Local<Context> context,
+@@ -1043,7 +1043,7 @@ bool ArrayOfStringsToX509s(Local<Context> context,
                             Local<Array> cert_array,
                             std::vector<X509*>* certs) {
    ClearErrorOnReturn clear_error_on_return;
@@ -144,7 +144,7 @@ index eb6dad44a49d997097c8fb5009eeb60a7305da27..fd29d17de195017970856ce30d7a9c57
                             NewStringType::kNormal,
                             mem->length)
 diff --git a/src/encoding_binding.cc b/src/encoding_binding.cc
-index 31ed995714bb99ab534f26ba9ebc6051c258a1c9..5ace688bb7ffc86eedf5aff11ab0ab487ad9440e 100644
+index cddc88f1e0309072d22aa76d4a17115e4d9159e2..22eecffa437a9e0f4a0e170953aa35fa527511b5 100644
 --- a/src/encoding_binding.cc
 +++ b/src/encoding_binding.cc
 @@ -73,7 +73,7 @@ void BindingData::Deserialize(Local<Context> context,
@@ -183,10 +183,10 @@ index c6209cc7cf317de1bb9217e39dd760e5a83303e2..161d577e0ea6a251c83ba1903b1ec9a5
    } else {
      info.js_execution_async_resources = 0;
 diff --git a/src/inspector/network_agent.cc b/src/inspector/network_agent.cc
-index 3b5d9615021101ad03d9dfef83e0c56b462b59ad..823e7b8d3d07eb2afa1cc62d3d9e2af20f4e2e89 100644
+index 57ea5afd56a4e3c4c5826a263ce498448effbb84..c2c17760022ab669188a774e91ca96c9a5d7f57e 100644
 --- a/src/inspector/network_agent.cc
 +++ b/src/inspector/network_agent.cc
-@@ -29,31 +29,31 @@ using v8::Value;
+@@ -31,31 +31,31 @@ constexpr size_t kDefaultMaxTotalBufferSize = 100 * 1024 * 1024;  // 100MB
  Maybe<protocol::String> ObjectGetProtocolString(v8::Local<v8::Context> context,
                                                  Local<Object> object,
                                                  Local<v8::String> property) {
@@ -224,7 +224,7 @@ index 3b5d9615021101ad03d9dfef83e0c56b462b59ad..823e7b8d3d07eb2afa1cc62d3d9e2af2
             .ToLocal(&value) ||
        !value->IsNumber()) {
      return Nothing<double>();
-@@ -65,9 +65,9 @@ Maybe<double> ObjectGetDouble(v8::Local<v8::Context> context,
+@@ -67,9 +67,9 @@ Maybe<double> ObjectGetDouble(v8::Local<v8::Context> context,
  Maybe<int> ObjectGetInt(v8::Local<v8::Context> context,
                          Local<Object> object,
                          const char* property) {
@@ -236,7 +236,7 @@ index 3b5d9615021101ad03d9dfef83e0c56b462b59ad..823e7b8d3d07eb2afa1cc62d3d9e2af2
             .ToLocal(&value) ||
        !value->IsInt32()) {
      return Nothing<int>();
-@@ -79,9 +79,9 @@ Maybe<int> ObjectGetInt(v8::Local<v8::Context> context,
+@@ -81,9 +81,9 @@ Maybe<int> ObjectGetInt(v8::Local<v8::Context> context,
  Maybe<bool> ObjectGetBool(v8::Local<v8::Context> context,
                            Local<Object> object,
                            const char* property) {
@@ -248,7 +248,7 @@ index 3b5d9615021101ad03d9dfef83e0c56b462b59ad..823e7b8d3d07eb2afa1cc62d3d9e2af2
             .ToLocal(&value) ||
        !value->IsBoolean()) {
      return Nothing<bool>();
-@@ -93,9 +93,9 @@ Maybe<bool> ObjectGetBool(v8::Local<v8::Context> context,
+@@ -95,9 +95,9 @@ Maybe<bool> ObjectGetBool(v8::Local<v8::Context> context,
  MaybeLocal<v8::Object> ObjectGetObject(v8::Local<v8::Context> context,
                                         Local<Object> object,
                                         const char* property) {
@@ -260,7 +260,7 @@ index 3b5d9615021101ad03d9dfef83e0c56b462b59ad..823e7b8d3d07eb2afa1cc62d3d9e2af2
             .ToLocal(&value) ||
        !value->IsObject()) {
      return {};
-@@ -106,7 +106,7 @@ MaybeLocal<v8::Object> ObjectGetObject(v8::Local<v8::Context> context,
+@@ -108,7 +108,7 @@ MaybeLocal<v8::Object> ObjectGetObject(v8::Local<v8::Context> context,
  // Create a protocol::Network::Headers from the v8 object.
  std::unique_ptr<protocol::Network::Headers> createHeadersFromObject(
      v8::Local<v8::Context> context, Local<Object> headers_obj) {
@@ -269,7 +269,7 @@ index 3b5d9615021101ad03d9dfef83e0c56b462b59ad..823e7b8d3d07eb2afa1cc62d3d9e2af2
  
    std::unique_ptr<protocol::DictionaryValue> dict =
        protocol::DictionaryValue::create();
-@@ -127,7 +127,7 @@ std::unique_ptr<protocol::Network::Headers> createHeadersFromObject(
+@@ -129,7 +129,7 @@ std::unique_ptr<protocol::Network::Headers> createHeadersFromObject(
               .To(&property_value)) {
        return {};
      }
@@ -278,7 +278,7 @@ index 3b5d9615021101ad03d9dfef83e0c56b462b59ad..823e7b8d3d07eb2afa1cc62d3d9e2af2
                      property_value);
    }
  
-@@ -137,7 +137,7 @@ std::unique_ptr<protocol::Network::Headers> createHeadersFromObject(
+@@ -139,7 +139,7 @@ std::unique_ptr<protocol::Network::Headers> createHeadersFromObject(
  // Create a protocol::Network::Request from the v8 object.
  std::unique_ptr<protocol::Network::Request> createRequestFromObject(
      v8::Local<v8::Context> context, Local<Object> request) {
@@ -287,7 +287,7 @@ index 3b5d9615021101ad03d9dfef83e0c56b462b59ad..823e7b8d3d07eb2afa1cc62d3d9e2af2
    protocol::String url;
    if (!ObjectGetProtocolString(context, request, "url").To(&url)) {
      return {};
-@@ -169,7 +169,7 @@ std::unique_ptr<protocol::Network::Request> createRequestFromObject(
+@@ -171,7 +171,7 @@ std::unique_ptr<protocol::Network::Request> createRequestFromObject(
  // Create a protocol::Network::Response from the v8 object.
  std::unique_ptr<protocol::Network::Response> createResponseFromObject(
      v8::Local<v8::Context> context, Local<Object> response) {
@@ -359,10 +359,10 @@ index 4a35e41e78a22993f87ab9d5919f401a7b742438..327d7b77bc306db8193fa68bc7129c33
    CHECK(!env->temporary_required_module_facade_original.IsEmpty());
    return env->temporary_required_module_facade_original.Get(isolate);
 diff --git a/src/node.h b/src/node.h
-index 16a0c71aef949b0ddd27def9dc843298f9a6b75f..28fa4cb3e7a621480a5ff11c48666c0de1363375 100644
+index fe44369dff7519ea0d960ae478d5caf524e17366..bba7393e7378fa7468837319af7b7f643b68167e 100644
 --- a/src/node.h
 +++ b/src/node.h
-@@ -1050,7 +1050,7 @@ NODE_DEPRECATED("Use v8::Date::ValueOf() directly",
+@@ -1049,7 +1049,7 @@ NODE_DEPRECATED("Use v8::Date::ValueOf() directly",
  
  #define NODE_DEFINE_CONSTANT(target, constant)                                 \
    do {                                                                         \
@@ -371,7 +371,7 @@ index 16a0c71aef949b0ddd27def9dc843298f9a6b75f..28fa4cb3e7a621480a5ff11c48666c0d
      v8::Local<v8::Context> context = isolate->GetCurrentContext();             \
      v8::Local<v8::String> constant_name = v8::String::NewFromUtf8Literal(      \
          isolate, #constant, v8::NewStringType::kInternalized);                 \
-@@ -1066,7 +1066,7 @@ NODE_DEPRECATED("Use v8::Date::ValueOf() directly",
+@@ -1065,7 +1065,7 @@ NODE_DEPRECATED("Use v8::Date::ValueOf() directly",
  
  #define NODE_DEFINE_HIDDEN_CONSTANT(target, constant)                          \
    do {                                                                         \
@@ -539,10 +539,10 @@ index 36a21b9523351fe2f225ffe7fca184d737640b62..c6e9e2c00064348c435ae10871a4013c
    READONLY_PROPERTY(target, "exitCodes", exit_codes);
  
 diff --git a/src/node_file.cc b/src/node_file.cc
-index 5de3ebb04b12286a07e3041d0a6dd1cc9072e76a..75be21c9e8b413f522240a906da06d26c44d5b71 100644
+index 9f888b28ecb05f3496c0b18fdd6a2c1cc9b068fd..57c8dc35dc86efed6e8736e4649b90905a8da54b 100644
 --- a/src/node_file.cc
 +++ b/src/node_file.cc
-@@ -3755,7 +3755,7 @@ void BindingData::Deserialize(Local<Context> context,
+@@ -3761,7 +3761,7 @@ void BindingData::Deserialize(Local<Context> context,
                                int index,
                                InternalFieldInfoBase* info) {
    DCHECK_IS_SNAPSHOT_SLOT(index);
@@ -627,7 +627,7 @@ index 9dcca7509f37f239b8442201b086df428415dcd1..b0cf8c3a8e1c3e89d621a865390b1bdb
    // Recreate the buffer in the constructor.
    InternalFieldInfo* casted_info = static_cast<InternalFieldInfo*>(info);
 diff --git a/src/node_realm.cc b/src/node_realm.cc
-index 66a8ee48fc68b22eaf6c9d9209cc5cb2439e55ff..b31e244f8af7d37c35319853a478776c609b9bca 100644
+index b6461c7bb009fa3f44cb0225eec49dbb161d81fd..5ffe23beb7b33f8becf5ba997fea2119e9aa23cf 100644
 --- a/src/node_realm.cc
 +++ b/src/node_realm.cc
 @@ -19,7 +19,7 @@ using v8::String;
@@ -740,7 +740,7 @@ index 9b5ada71c174567498c4902259d97f9d11fefb91..1134856a202bac0a4ff1957d5ecc5600
    if (wasi->memory_.IsEmpty()) {
      THROW_ERR_WASI_NOT_STARTED(isolate);
 diff --git a/src/node_webstorage.cc b/src/node_webstorage.cc
-index e3c3223789032badbab56a558148da67e99ca9b2..9a7b7db881a564a68683c55cb10919454e80edbf 100644
+index a442a479b8732ef793aaf3bf57decc4f324eb816..d6dee522023a4e65d948b1554e9ae472f1e96e40 100644
 --- a/src/node_webstorage.cc
 +++ b/src/node_webstorage.cc
 @@ -58,7 +58,7 @@ using v8::Value;
@@ -752,7 +752,7 @@ index e3c3223789032badbab56a558148da67e99ca9b2..9a7b7db881a564a68683c55cb1091945
    auto dom_exception_str = FIXED_ONE_BYTE_STRING(isolate, "DOMException");
    auto err_name = FIXED_ONE_BYTE_STRING(isolate, "QuotaExceededError");
    auto err_message =
-@@ -434,7 +434,7 @@ Maybe<void> Storage::Store(Local<Name> key, Local<Value> value) {
+@@ -438,7 +438,7 @@ Maybe<void> Storage::Store(Local<Name> key, Local<Value> value) {
  }
  
  static MaybeLocal<String> Uint32ToName(Local<Context> context, uint32_t index) {
@@ -762,10 +762,10 @@ index e3c3223789032badbab56a558148da67e99ca9b2..9a7b7db881a564a68683c55cb1091945
  
  static void Clear(const FunctionCallbackInfo<Value>& info) {
 diff --git a/src/node_worker.cc b/src/node_worker.cc
-index 8555ab556b5b74a1cf9cf30747f1f417bfe4e4d9..1a2532337504444d59098304b87e0d65f16e838c 100644
+index ddfea91272d03d4ef1d4ac1b982ada5dcd24b601..7b4335475cc70369a1e868de70c749465a5bdfbd 100644
 --- a/src/node_worker.cc
 +++ b/src/node_worker.cc
-@@ -1289,8 +1289,6 @@ void GetEnvMessagePort(const FunctionCallbackInfo<Value>& args) {
+@@ -1288,8 +1288,6 @@ void GetEnvMessagePort(const FunctionCallbackInfo<Value>& args) {
    Local<Object> port = env->message_port();
    CHECK_IMPLIES(!env->is_main_thread(), !port.IsEmpty());
    if (!port.IsEmpty()) {

patches/node/build_add_gn_build_files.patch

@@ -11,7 +11,7 @@ really in 20/21. We have to wait until 22 is released to be able to
 build with upstream GN files.
 
 diff --git a/configure.py b/configure.py
-index 91283ca577f580dbf1e0c4e2dbf851a9ceaa38ed..e8eaff30ec947677db2d45425f9180759d0c55de 100755
+index 77c87f5a9539714f68278d95ec79878cc52dc18b..ff93eebd4714ac8d9c9abe9c53e3636f02e0baac 100755
 --- a/configure.py
 +++ b/configure.py
 @@ -1728,7 +1728,7 @@ def configure_v8(o, configs):
@@ -93,7 +93,7 @@ index f9426599f2d5dc6ad061407f0c4eb2c9203a4433..302030f610965f07dd6998d282275c1b
  // Handles compilation and caching of built-in JavaScript modules and
  // bootstrap scripts, whose source are bundled into the binary as static data.
 diff --git a/tools/install.py b/tools/install.py
-index 8797b59e59c85a8877b977fa3281e50165e6f6b2..0af01e075616195f38fb242626dcab770ec1eb57 100755
+index a619fd17b16e404cf8deb5b91f7dbd980895f760..2b981b23e724120f69a5f7ef655e5f648aa310e9 100755
 --- a/tools/install.py
 +++ b/tools/install.py
 @@ -222,6 +222,7 @@ def headers(options, action):
@@ -115,7 +115,7 @@ index 8797b59e59c85a8877b977fa3281e50165e6f6b2..0af01e075616195f38fb242626dcab77
 diff --git a/tools/js2c.cc b/tools/js2c.cc
 old mode 100644
 new mode 100755
-index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2e9dfb0f0
+index 9c2f70de4e00834ff448e573743898072dc14c5d..71a12c606f4da7165cc41a295a278b2e504af1b6
 --- a/tools/js2c.cc
 +++ b/tools/js2c.cc
 @@ -28,6 +28,7 @@ namespace js2c {
@@ -210,7 +210,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
                     static_cast<int>(def_buf.size()),
                     def_buf.data(),
                     static_cast<int>(init_buf.size()),
-@@ -846,12 +890,15 @@ int JS2C(const FileList& js_files,
+@@ -836,12 +880,15 @@ int JS2C(const FileList& js_files,
      }
    }
  
@@ -226,7 +226,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
    Fragment out = Format(definitions, initializers, registrations);
    return WriteIfChanged(out, dest);
  }
-@@ -877,6 +924,8 @@ int Main(int argc, char* argv[]) {
+@@ -867,6 +914,8 @@ int Main(int argc, char* argv[]) {
      std::string arg(argv[i]);
      if (arg == "--verbose") {
        is_verbose = true;
@@ -235,7 +235,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
      } else if (arg == "--root") {
        if (i == argc - 1) {
          fprintf(stderr, "--root must be followed by a path\n");
-@@ -925,6 +974,14 @@ int Main(int argc, char* argv[]) {
+@@ -915,6 +964,14 @@ int Main(int argc, char* argv[]) {
      }
    }
  
@@ -250,7 +250,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
    // Should have exactly 3 types: `.js`, `.mjs` and `.gypi`.
    assert(file_map.size() == 3);
    auto gypi_it = file_map.find(".gypi");
-@@ -951,6 +1008,7 @@ int Main(int argc, char* argv[]) {
+@@ -941,6 +998,7 @@ int Main(int argc, char* argv[]) {
    std::sort(mjs_it->second.begin(), mjs_it->second.end());
  
    return JS2C(js_it->second, mjs_it->second, gypi_it->second[0], output);

patches/node/build_compile_with_c_20_support.patch

@@ -10,10 +10,10 @@ V8 requires C++20 support as of https://chromium-review.googlesource.com/c/v8/v8
 This can be removed when Electron upgrades to a version of Node.js containing the required V8 version.
 
 diff --git a/common.gypi b/common.gypi
-index c28d6f5fe2c922f0b1e3f7e56289c78e7b91c294..95c56305926fc3e0e46e4cf99ec86d3d1b5576a7 100644
+index 4cb925480961ae88eb423559ab34ac0ee91239e4..bbfc0f4ec293df19662e57fa4890c4c53cd79d75 100644
 --- a/common.gypi
 +++ b/common.gypi
-@@ -539,7 +539,7 @@
+@@ -536,7 +536,7 @@
            '-fno-rtti',
            '-fno-exceptions',
            '-fno-strict-aliasing',
@@ -22,7 +22,7 @@ index c28d6f5fe2c922f0b1e3f7e56289c78e7b91c294..95c56305926fc3e0e46e4cf99ec86d3d
          ],
          'defines': [ '__STDC_FORMAT_MACROS' ],
          'ldflags': [ '-rdynamic' ],
-@@ -719,7 +719,7 @@
+@@ -716,7 +716,7 @@
            ['clang==1', {
              'xcode_settings': {
                'GCC_VERSION': 'com.apple.compilers.llvm.clang.1_0',

patches/node/build_enable_perfetto.patch

@@ -33,7 +33,7 @@ index 8d7204f6cb48f783adc4d1c1eb2de0c83b7fffe2..a154559a56bf383d3c26af523c9bb07b
  
    // Non-alphabetic chars.
 diff --git a/lib/internal/http.js b/lib/internal/http.js
-index 4f250a2e70a20fddeeb7886e0c269822883f7ccf..4e5c2dd1f13e6818576c3c4c88200b5cf5fb1257 100644
+index 78010bd8f23512073430008742479b655e936314..12b6430cadc31dbfa6907ed0b904ce81bd333a05 100644
 --- a/lib/internal/http.js
 +++ b/lib/internal/http.js
 @@ -10,8 +10,8 @@ const {
@@ -64,7 +64,7 @@ index 4f250a2e70a20fddeeb7886e0c269822883f7ccf..4e5c2dd1f13e6818576c3c4c88200b5c
  
  function ipToInt(ip) {
 diff --git a/node.gyp b/node.gyp
-index 0e0071b508f605bb9b7722f8304814dc176d907e..bcb9f371c4e4d8c665058115dc39eaa65125d679 100644
+index f9ee71dd9a395fa1de99a6f62ba60acdf8be12a1..e3b308ca079aab6e672a1cfa9b12d49ef64b3816 100644
 --- a/node.gyp
 +++ b/node.gyp
 @@ -174,7 +174,6 @@

patches/node/build_ensure_native_module_compilation_fails_if_not_using_a_new.patch

@@ -7,7 +7,7 @@ Subject: build: ensure native module compilation fails if not using a new
 This should not be upstreamed, it is a quality-of-life patch for downstream module builders.
 
 diff --git a/common.gypi b/common.gypi
-index 6b79de07be3f839af5b0644f19bfef9c33de590e..c28d6f5fe2c922f0b1e3f7e56289c78e7b91c294 100644
+index 79bd0879cd5d9408d45aae150d9ace4e1bf43d36..4cb925480961ae88eb423559ab34ac0ee91239e4 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -89,6 +89,8 @@
@@ -42,7 +42,7 @@ index 6b79de07be3f839af5b0644f19bfef9c33de590e..c28d6f5fe2c922f0b1e3f7e56289c78e
        # list in v8/BUILD.gn.
        ['v8_enable_v8_checks == 1', {
 diff --git a/configure.py b/configure.py
-index e8eaff30ec947677db2d45425f9180759d0c55de..dc2d9d80059e845b33444f8bdc29e82d0fe0e26b 100755
+index ff93eebd4714ac8d9c9abe9c53e3636f02e0baac..04d484071821af1afc07d5a0081c6ad7f2e59ab5 100755
 --- a/configure.py
 +++ b/configure.py
 @@ -1710,6 +1710,7 @@ def configure_library(lib, output, pkgname=None):
@@ -54,7 +54,7 @@ index e8eaff30ec947677db2d45425f9180759d0c55de..dc2d9d80059e845b33444f8bdc29e82d
    o['variables']['v8_enable_javascript_promise_hooks'] = 1
    o['variables']['v8_enable_lite_mode'] = 1 if options.v8_lite_mode else 0
 diff --git a/src/node.h b/src/node.h
-index a336f44dc1e785ea237865077216d41ab032c0af..96c599aa6448e2aa8e57e84f811564a5281c139a 100644
+index 67bef5f7d8a08c4dd37ad72073537f1d2b4cb2ee..4e66924e4ca5b5d787fc6259de940a3fb40bff38 100644
 --- a/src/node.h
 +++ b/src/node.h
 @@ -22,6 +22,12 @@

patches/node/build_restore_clang_as_default_compiler_on_macos.patch

@@ -11,7 +11,7 @@ node-gyp will use the result of `process.config` that reflects the environment
 in which the binary got built.
 
 diff --git a/common.gypi b/common.gypi
-index 95c56305926fc3e0e46e4cf99ec86d3d1b5576a7..45bb2c4ff94ceac377c9117da4497cdc5ac41171 100644
+index bbfc0f4ec293df19662e57fa4890c4c53cd79d75..23ac608d9fc3cd4b8b8381492d609051127cd755 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -128,6 +128,7 @@

patches/node/chore_allow_the_node_entrypoint_to_be_a_builtin_module.patch

@@ -8,10 +8,10 @@ they use themselves as the entry point. We should try to upstream some form
 of this.
 
 diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
-index 15443a710ccf53fae333da3b1fbb52a970c658d5..464b34829c1a566836bfca6bbc2b87fcf5e50016 100644
+index 3546544ad0d4542917d0dfe7634bd6ec1e25476b..3eabcb05f1d370693ade51ac794852725767ad85 100644
 --- a/lib/internal/process/pre_execution.js
 +++ b/lib/internal/process/pre_execution.js
-@@ -265,12 +265,14 @@ function patchProcessObject(expandArgv1) {
+@@ -268,12 +268,14 @@ function patchProcessObject(expandArgv1) {
    // the entry point.
    if (expandArgv1 && process.argv[1] && process.argv[1][0] !== '-') {
      // Expand process.argv[1] into a full path.

patches/node/chore_disable_deprecation_ftbfs_in_simdjson_header.patch

@@ -8,13 +8,16 @@ Without this patch, building with simdjson fails with
 > error: identifier '_padded' preceded by whitespace in a literal operator
 > declaration is deprecated [-Werror,-Wdeprecated-literal-operator]
 
+and
+> error: declaration requires an exit-time destructor [-Werror,-Wexit-time-destructors]
+
 This patch can be removed once this is fixed upstream in simdjson.
 
 diff --git a/deps/simdjson/simdjson.h b/deps/simdjson/simdjson.h
-index 8f52a4331d59996786450eec982659da9244cac1..74729673d87b068dff5f24166bbb77d844f15f42 100644
+index 1d6560e80fab0458b22f0ac2437056bce4873e8f..c3dbe2b6fc08c36a07ced5e29a814f7bcd85b748 100644
 --- a/deps/simdjson/simdjson.h
 +++ b/deps/simdjson/simdjson.h
-@@ -3899,12 +3899,17 @@ inline std::ostream& operator<<(std::ostream& out, simdjson_result<padded_string
+@@ -4215,12 +4215,17 @@ inline std::ostream& operator<<(std::ostream& out, simdjson_result<padded_string
  
  } // namespace simdjson
  
@@ -32,7 +35,7 @@ index 8f52a4331d59996786450eec982659da9244cac1..74729673d87b068dff5f24166bbb77d8
  namespace simdjson {
  namespace internal {
  
-@@ -4304,6 +4309,9 @@ inline simdjson_result<padded_string> padded_string::load(std::string_view filen
+@@ -4729,6 +4734,9 @@ inline simdjson_result<padded_string> padded_string::load(std::wstring_view file
  
  } // namespace simdjson
  
@@ -42,8 +45,8 @@ index 8f52a4331d59996786450eec982659da9244cac1..74729673d87b068dff5f24166bbb77d8
  inline simdjson::padded_string operator ""_padded(const char *str, size_t len) {
    return simdjson::padded_string(str, len);
  }
-@@ -4312,6 +4320,8 @@ inline simdjson::padded_string operator ""_padded(const char8_t *str, size_t len
-   return simdjson::padded_string(reinterpret_cast<const char8_t *>(str), len);
+@@ -4737,6 +4745,8 @@ inline simdjson::padded_string operator ""_padded(const char8_t *str, size_t len
+   return simdjson::padded_string(reinterpret_cast<const char *>(str), len);
  }
  #endif
 +#pragma clang diagnostic pop
@@ -51,3 +54,37 @@ index 8f52a4331d59996786450eec982659da9244cac1..74729673d87b068dff5f24166bbb77d8
  #endif // SIMDJSON_PADDED_STRING_INL_H
  /* end file simdjson/padded_string-inl.h */
  /* skipped duplicate #include "simdjson/padded_string_view.h" */
+@@ -44745,12 +44755,16 @@ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::
+   return parser_instance;
+ }
+ 
++#pragma clang diagnostic push
++#pragma clang diagnostic ignored "-Wexit-time-destructors"
++
+ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::get_threadlocal_parser_if_exists() {
+   // @the-moisrex points out that this could be implemented with std::optional (C++17).
+   thread_local std::unique_ptr<ondemand::parser> parser_instance = nullptr;
+   return parser_instance;
+ }
+ 
++#pragma clang diagnostic pop
+ 
+ } // namespace ondemand
+ } // namespace arm64
+@@ -59221,12 +59235,16 @@ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::
+   return parser_instance;
+ }
+ 
++#pragma clang diagnostic push
++#pragma clang diagnostic ignored "-Wexit-time-destructors"
++
+ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::get_threadlocal_parser_if_exists() {
+   // @the-moisrex points out that this could be implemented with std::optional (C++17).
+   thread_local std::unique_ptr<ondemand::parser> parser_instance = nullptr;
+   return parser_instance;
+ }
+ 
++#pragma clang diagnostic pop
+ 
+ } // namespace ondemand
+ } // namespace fallback

patches/node/cli_move_--trace-atomics-wait_to_eol.patch

@@ -15,10 +15,10 @@ Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index a97053929c81ac18bcb3beda7cecb69621b6e70c..a54d0e46c8e4e3aa6be433fba73ef9a3228fa175 100644
+index 2133555fd05f0c4f4b03c1d76ae8e33c14b621fa..1f93fa0fa56b27cb176d06231b9f2c8854c3c009 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -2749,39 +2749,6 @@ added: v12.0.0
+@@ -2755,39 +2755,6 @@ added: v12.0.0
  Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.3'. Use to disable support
  for TLSv1.2, which is not as secure as TLSv1.3.
  
@@ -58,7 +58,7 @@ index a97053929c81ac18bcb3beda7cecb69621b6e70c..a54d0e46c8e4e3aa6be433fba73ef9a3
  ### `--trace-deprecation`
  
  <!-- YAML
-@@ -3483,7 +3450,6 @@ one is included in the list below.
+@@ -3489,7 +3456,6 @@ one is included in the list below.
  * `--tls-min-v1.1`
  * `--tls-min-v1.2`
  * `--tls-min-v1.3`
@@ -83,7 +83,7 @@ index fed2c77c2afed665be7aa17c2d53824f049a909e..7a3c09a40fca9458f83be1e7d8eec930
  Print stack traces for deprecations.
  .
 diff --git a/src/node.cc b/src/node.cc
-index f012b365455bb111cddea44fcff020804086ab72..b99b5170553af51466fd1ee69af3be5026f3fada 100644
+index f85b5ed687180d7a12648b87398a734fb321f346..0bc4aff4573ccd0e53de5f288b5bccdb6063652a 100644
 --- a/src/node.cc
 +++ b/src/node.cc
 @@ -232,44 +232,6 @@ void Environment::WaitForInspectorFrontendByOptions() {
@@ -150,7 +150,7 @@ index f012b365455bb111cddea44fcff020804086ab72..b99b5170553af51466fd1ee69af3be50
      isolate_->SetPromiseHook(TracePromises);
    }
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 4bbace2f702777fa12ba9246984894721df99b50..b067685822dc056e446e1a9402a5a6cba86cc722 100644
+index acd747ff5d853a920a66c27d421ae9ddfc7bcd82..5a1675f2b4448e5da71f0badee8ac5f2d2a9c6ee 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -827,10 +827,6 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
@@ -165,7 +165,7 @@ index 4bbace2f702777fa12ba9246984894721df99b50..b067685822dc056e446e1a9402a5a6cb
              "show stack traces on deprecations",
              &EnvironmentOptions::trace_deprecation,
 diff --git a/src/node_options.h b/src/node_options.h
-index d8751a6ee734233e2fc24866ed87d9cd516072ae..e12abb55e43068e8446eaabc65deb63cc469f554 100644
+index b7d9b429f0b498dfd70301074948a13a2d35532e..31b5e51ec8ac3061778b723f59cef606fac7c924 100644
 --- a/src/node_options.h
 +++ b/src/node_options.h
 @@ -205,7 +205,6 @@ class EnvironmentOptions : public Options {

patches/node/cli_remove_deprecated_v8_flag.patch

@@ -18,10 +18,10 @@ Reviewed-By: Michaël Zasso <targos@protonmail.com>
 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index 7ff68d28f1c80d8a852f649e2c39216a2f4bdb16..a97053929c81ac18bcb3beda7cecb69621b6e70c 100644
+index 0dfbe4b4fe0e4113e5e6c0cbe8a5d3ec4ff97e5a..2133555fd05f0c4f4b03c1d76ae8e33c14b621fa 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -3522,7 +3522,6 @@ V8 options that are allowed are:
+@@ -3528,7 +3528,6 @@ V8 options that are allowed are:
  * `--disallow-code-generation-from-strings`
  * `--enable-etw-stack-walking`
  * `--expose-gc`
@@ -30,7 +30,7 @@ index 7ff68d28f1c80d8a852f649e2c39216a2f4bdb16..a97053929c81ac18bcb3beda7cecb696
  * `--jitless`
  * `--max-old-space-size`
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 3026b3d814ae652a9996c1dcba62b4fa678ac871..4bbace2f702777fa12ba9246984894721df99b50 100644
+index 41de3936265f0544831521fe753d2050e91b58e1..acd747ff5d853a920a66c27d421ae9ddfc7bcd82 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -1060,11 +1060,6 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(

patches/node/expose_get_builtin_module_function.patch

@@ -9,7 +9,7 @@ modules to sandboxed renderers.
 TODO(codebytere): remove and replace with a public facing API.
 
 diff --git a/src/node_binding.cc b/src/node_binding.cc
-index aa4213c3622eab077fa8d764775c1f95c6313e34..11f722d2d7c21079cbc65033429086231a786ca7 100644
+index 75d2f649a76583b7c965871131147b9f451234c4..b7fa9b8e48ffcd1e80d890b127b5ffb52152838b 100644
 --- a/src/node_binding.cc
 +++ b/src/node_binding.cc
 @@ -652,6 +652,10 @@ void GetInternalBinding(const FunctionCallbackInfo<Value>& args) {
@@ -24,10 +24,10 @@ index aa4213c3622eab077fa8d764775c1f95c6313e34..11f722d2d7c21079cbc6503342908623
    Environment* env = Environment::GetCurrent(args);
  
 diff --git a/src/node_binding.h b/src/node_binding.h
-index 611f38ef5e21cc303127326d50c648fbb557b4da..3d95ad2733dc83d0b7d37d57c337732c8a0e83d7 100644
+index bf931994d31ab6f6c400eecd36ff09cb655a67f2..7e839bafd2b2b0b07aa216d317f0ab0d89108979 100644
 --- a/src/node_binding.h
 +++ b/src/node_binding.h
-@@ -154,6 +154,8 @@ void GetInternalBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
+@@ -153,6 +153,8 @@ void GetInternalBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
  void GetLinkedBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
  void DLOpen(const v8::FunctionCallbackInfo<v8::Value>& args);
  

patches/node/fix_add_default_values_for_variables_in_common_gypi.patch

@@ -7,7 +7,7 @@ common.gypi is a file that's included in the node header bundle, despite
 the fact that we do not build node with gyp.
 
 diff --git a/common.gypi b/common.gypi
-index ae31b372b96358a156761ec7e9c39c9530d1abd1..6b79de07be3f839af5b0644f19bfef9c33de590e 100644
+index d71df903c125e4b5daf1184604c627b82272d3cc..79bd0879cd5d9408d45aae150d9ace4e1bf43d36 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -91,6 +91,23 @@

patches/node/fix_allow_passing_fileexists_fn_to_legacymainresolve.patch

@@ -11,7 +11,7 @@ We can fix this by allowing the C++ implementation of legacyMainResolve to use
 a fileExists function that does take Asar into account.
 
 diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
-index e3afd30ba1f591d0298793bc42fd7166a4219bce..408dc96307d7f52f92db41004b358051a81c627c 100644
+index 4216e136d01a119264de1523ed466efb783311c3..a7e9c8eb1084c9d5a0c27f0fca840fc47ce12dd1 100644
 --- a/lib/internal/modules/esm/resolve.js
 +++ b/lib/internal/modules/esm/resolve.js
 @@ -28,14 +28,13 @@ const { BuiltinModule } = require('internal/bootstrap/realm');
@@ -31,7 +31,7 @@ index e3afd30ba1f591d0298793bc42fd7166a4219bce..408dc96307d7f52f92db41004b358051
  const {
    ERR_INPUT_TYPE_NOT_ALLOWED,
    ERR_INVALID_ARG_TYPE,
-@@ -183,6 +182,11 @@ const legacyMainResolveExtensionsIndexes = {
+@@ -184,6 +183,11 @@ const legacyMainResolveExtensionsIndexes = {
    kResolvedByPackageAndNode: 9,
  };
  
@@ -43,7 +43,7 @@ index e3afd30ba1f591d0298793bc42fd7166a4219bce..408dc96307d7f52f92db41004b358051
  /**
   * Legacy CommonJS main resolution:
   * 1. let M = pkg_url + (json main field)
-@@ -201,7 +205,7 @@ function legacyMainResolve(packageJSONUrl, packageConfig, base) {
+@@ -202,7 +206,7 @@ function legacyMainResolve(packageJSONUrl, packageConfig, base) {
  
    const baseStringified = isURL(base) ? base.href : base;
  
@@ -53,10 +53,10 @@ index e3afd30ba1f591d0298793bc42fd7166a4219bce..408dc96307d7f52f92db41004b358051
    const maybeMain = resolvedOption <= legacyMainResolveExtensionsIndexes.kResolvedByMainIndexNode ?
      packageConfig.main || './' : '';
 diff --git a/src/node_file.cc b/src/node_file.cc
-index 77f8f1bd4e8294f2ebc7e0724aea5902eb0f95ab..5de3ebb04b12286a07e3041d0a6dd1cc9072e76a 100644
+index 6ed00e0c173ecc37d09e5d1420fbf5451b6fd906..9f888b28ecb05f3496c0b18fdd6a2c1cc9b068fd 100644
 --- a/src/node_file.cc
 +++ b/src/node_file.cc
-@@ -3504,13 +3504,25 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
+@@ -3510,13 +3510,25 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
  }
  
  BindingData::FilePathIsFileReturnType BindingData::FilePathIsFile(
@@ -83,7 +83,7 @@ index 77f8f1bd4e8294f2ebc7e0724aea5902eb0f95ab..5de3ebb04b12286a07e3041d0a6dd1cc
    uv_fs_t req;
  
    int rc = uv_fs_stat(env->event_loop(), &req, file_path.c_str(), nullptr);
-@@ -3568,6 +3580,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3574,6 +3586,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
    std::optional<std::string> initial_file_path;
    std::string file_path;
  
@@ -95,7 +95,7 @@ index 77f8f1bd4e8294f2ebc7e0724aea5902eb0f95ab..5de3ebb04b12286a07e3041d0a6dd1cc
    if (args.Length() >= 2 && args[1]->IsString()) {
      auto package_config_main = Utf8Value(isolate, args[1]).ToString();
  
-@@ -3588,7 +3605,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3594,7 +3611,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
        BufferValue buff_file_path(isolate, local_file_path);
        ToNamespacedPath(env, &buff_file_path);
  
@@ -104,7 +104,7 @@ index 77f8f1bd4e8294f2ebc7e0724aea5902eb0f95ab..5de3ebb04b12286a07e3041d0a6dd1cc
          case BindingData::FilePathIsFileReturnType::kIsFile:
            return args.GetReturnValue().Set(i);
          case BindingData::FilePathIsFileReturnType::kIsNotFile:
-@@ -3625,7 +3642,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3631,7 +3648,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
      BufferValue buff_file_path(isolate, local_file_path);
      ToNamespacedPath(env, &buff_file_path);
  

patches/node/fix_array_out-of-bounds_read_in_boyer-moore_search.patch

@@ -1,127 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Shelley Vohr <shelley.vohr@gmail.com>
-Date: Thu, 10 Jul 2025 08:36:12 +0000
-Subject: fix: array out-of-bounds read in Boyer-Moore search
-
-Refs https://chromium-review.googlesource.com/c/chromium/src/+/6703757
-
-The above CL enabled array bounds sanitization, which triggered a crash in a Node.js
-test which exposed an issue in Node.js implementation of Boyer-Moore string search.
-
-Some Boyer-Moore search impl functions were using "biased pointer" arithmetic to
-create array pointers that point outside the actual array bounds.
-
-When start_ is large this creates pointers far outside the valid memory range.
-While this worked by accident in practice, it's undefined behavior that the CL
-correctly prohibits.
-
-diff --git a/deps/nbytes/include/nbytes.h b/deps/nbytes/include/nbytes.h
-index b012729c6cca8e42c94fd9b6a9c72301b4370de4..bb2e2e5fd2781f9e3db7f0b0699e1b0513e6782d 100644
---- a/deps/nbytes/include/nbytes.h
-+++ b/deps/nbytes/include/nbytes.h
-@@ -4,6 +4,7 @@
- #include <cmath>
- #include <cstddef>
- #include <cstdint>
-+#include <cstdlib>
- #include <cstring>
- #include <string>
- 
-@@ -548,7 +549,11 @@ size_t StringSearch<Char>::BoyerMooreSearch(Vector subject,
-   size_t start = start_;
- 
-   int *bad_char_occurrence = bad_char_shift_table_;
--  int *good_suffix_shift = good_suffix_shift_table_ - start_;
-+
-+  auto good_suffix_get = [&](size_t idx) -> int {
-+    if (idx < start || idx - start > kBMMaxShift) return 0;
-+    return good_suffix_shift_table_[idx - start];
-+  };
- 
-   Char last_char = pattern_[pattern_length - 1];
-   size_t index = start_index;
-@@ -575,7 +580,7 @@ size_t StringSearch<Char>::BoyerMooreSearch(Vector subject,
-       index +=
-           pattern_length - 1 - CharOccurrence(bad_char_occurrence, last_char);
-     } else {
--      int gs_shift = good_suffix_shift[j + 1];
-+      int gs_shift = good_suffix_get(j + 1);
-       int bc_occ = CharOccurrence(bad_char_occurrence, c);
-       int shift = j - bc_occ;
-       if (gs_shift > shift) {
-@@ -596,17 +601,22 @@ void StringSearch<Char>::PopulateBoyerMooreTable() {
-   const size_t start = start_;
-   const size_t length = pattern_length - start;
- 
--  // Biased tables so that we can use pattern indices as table indices,
--  // even if we only cover the part of the pattern from offset start.
--  int *shift_table = good_suffix_shift_table_ - start_;
--  int *suffix_table = suffix_table_ - start_;
-+  auto shift_get = [&](size_t idx) -> int& {
-+    if (idx < start) abort();
-+    return good_suffix_shift_table_[idx - start];
-+  };
-+
-+  auto suffix_get = [&](size_t idx) -> int& {
-+    if (idx < start) abort();
-+    return suffix_table_[idx - start];
-+  };
- 
-   // Initialize table.
-   for (size_t i = start; i < pattern_length; i++) {
--    shift_table[i] = length;
-+    shift_get(i) = length;
-   }
--  shift_table[pattern_length] = 1;
--  suffix_table[pattern_length] = pattern_length + 1;
-+  shift_get(pattern_length) = 1;
-+  suffix_get(pattern_length) = pattern_length + 1;
- 
-   if (pattern_length <= start) {
-     return;
-@@ -620,22 +630,22 @@ void StringSearch<Char>::PopulateBoyerMooreTable() {
-     while (i > start) {
-       Char c = pattern_[i - 1];
-       while (suffix <= pattern_length && c != pattern_[suffix - 1]) {
--        if (static_cast<size_t>(shift_table[suffix]) == length) {
--          shift_table[suffix] = suffix - i;
-+        if (static_cast<size_t>(shift_get(suffix)) == length) {
-+          shift_get(suffix) = suffix - i;
-         }
--        suffix = suffix_table[suffix];
-+        suffix = suffix_get(suffix);
-       }
--      suffix_table[--i] = --suffix;
-+      suffix_get(--i) = --suffix;
-       if (suffix == pattern_length) {
-         // No suffix to extend, so we check against last_char only.
-         while ((i > start) && (pattern_[i - 1] != last_char)) {
--          if (static_cast<size_t>(shift_table[pattern_length]) == length) {
--            shift_table[pattern_length] = pattern_length - i;
-+          if (static_cast<size_t>(shift_get(pattern_length)) == length) {
-+            shift_get(pattern_length) = pattern_length - i;
-           }
--          suffix_table[--i] = pattern_length;
-+          suffix_get(--i) = pattern_length;
-         }
-         if (i > start) {
--          suffix_table[--i] = --suffix;
-+          suffix_get(--i) = --suffix;
-         }
-       }
-     }
-@@ -643,11 +653,11 @@ void StringSearch<Char>::PopulateBoyerMooreTable() {
-   // Build shift table using suffixes.
-   if (suffix < pattern_length) {
-     for (size_t i = start; i <= pattern_length; i++) {
--      if (static_cast<size_t>(shift_table[i]) == length) {
--        shift_table[i] = suffix - start;
-+      if (static_cast<size_t>(shift_get(i)) == length) {
-+        shift_get(i) = suffix - start;
-       }
-       if (i == suffix) {
--        suffix = suffix_table[suffix];
-+        suffix = suffix_get(suffix);
-       }
-     }
-   }

patches/node/fix_cppgc_initializing_twice.patch

@@ -12,7 +12,7 @@ This can be removed/refactored once Node.js upgrades to a version of V8
 containing the above CL.
 
 diff --git a/src/node.cc b/src/node.cc
-index b99b5170553af51466fd1ee69af3be5026f3fada..ccb644007b8ebbf3899e64d8097d97208c0de182 100644
+index 0bc4aff4573ccd0e53de5f288b5bccdb6063652a..e1b195f25fe6069ececf3b8c516c5e27f3bf39ab 100644
 --- a/src/node.cc
 +++ b/src/node.cc
 @@ -1239,7 +1239,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,

patches/node/fix_expose_the_built-in_electron_module_via_the_esm_loader.patch

@@ -77,10 +77,10 @@ index 78985575beb3df7722ba90968e8f085574b5afdf..e032c016efe227c26364e81804ad183c
        // Check if the ESM initiating import CJS is being required by the same CJS module.
        if (cjsModule?.[kIsExecuting]) {
 diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
-index 859b6bfedac4bbee2df054f9ebca7cbaaed45f18..5aa946f66c71beff0b7a43c30638ab28a1a5dfc0 100644
+index ec28ea021909071557277c2c98600afb203dfaa1..cb44ec468edb22adc7a159cabec528cc135c9ec5 100644
 --- a/lib/internal/modules/esm/resolve.js
 +++ b/lib/internal/modules/esm/resolve.js
-@@ -750,6 +750,9 @@ function packageImportsResolve(name, base, conditions) {
+@@ -751,6 +751,9 @@ function packageImportsResolve(name, base, conditions) {
    throw importNotDefined(name, packageJSONUrl, base);
  }
  
@@ -90,7 +90,7 @@ index 859b6bfedac4bbee2df054f9ebca7cbaaed45f18..5aa946f66c71beff0b7a43c30638ab28
  
  /**
   * Resolves a package specifier to a URL.
-@@ -764,6 +767,11 @@ function packageResolve(specifier, base, conditions) {
+@@ -765,6 +768,11 @@ function packageResolve(specifier, base, conditions) {
      return new URL('node:' + specifier);
    }
  
@@ -138,10 +138,10 @@ index 757f093becd112002f3422302f4c29bb464f1a6c..c8cea2117080930105b33e4e50586a2c
  // This translator function must be sync, as `require` is sync.
  translators.set('require-commonjs-typescript', (url, source, isMain) => {
 diff --git a/lib/internal/url.js b/lib/internal/url.js
-index ad1c2c9966085b8febd261b2fc776ce49bc1bd36..96fdce31168ae70ce20f3bfb81931705b2d55f31 100644
+index 62e240a8a0488c826339b92eb62e78162e0a32b8..f4019eeb831423f9fc1249ed9581ba9492b6c738 100644
 --- a/lib/internal/url.js
 +++ b/lib/internal/url.js
-@@ -1608,6 +1608,8 @@ function fileURLToPath(path, options = kEmptyObject) {
+@@ -1603,6 +1603,8 @@ function fileURLToPath(path, options = kEmptyObject) {
      path = new URL(path);
    else if (!isURL(path))
      throw new ERR_INVALID_ARG_TYPE('path', ['string', 'URL'], path);

patches/node/fix_generate_config_gypi_needs_to_generate_valid_json.patch

@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shelley Vohr <shelley.vohr@gmail.com>
+Date: Tue, 10 Feb 2026 16:48:47 +0100
+Subject: fix: generate_config_gypi needs to generate valid JSON
+
+Node.js added new process.config.variables entries, which the GN generator
+emitted with Python repr (single quotes). This made the JSON parse blow
+up. Fix this by switching to json.dumps.
+
+This should be upstreamed.
+
+diff --git a/tools/generate_config_gypi.py b/tools/generate_config_gypi.py
+index abd11e1dbda8d400cb900343c6e8d2d6e84fe944..436767e633e1f492fa858645e25ce9b904a5fccb 100755
+--- a/tools/generate_config_gypi.py
++++ b/tools/generate_config_gypi.py
+@@ -58,7 +58,7 @@ def translate_config(out_dir, config, v8_config):
+       'llvm_version': 13,
+       'napi_build_version': config['napi_build_version'],
+       'node_builtin_shareable_builtins':
+-          eval(config['node_builtin_shareable_builtins']),
++          json.loads(config['node_builtin_shareable_builtins']),
+       'node_module_version': int(config['node_module_version']),
+       'node_use_openssl': config['node_use_openssl'],
+       'node_use_amaro': config['node_use_amaro'],
+@@ -102,7 +102,8 @@ def main():
+ 
+   # Write output.
+   with open(args.target, 'w') as f:
+-    f.write(repr(translate_config(args.out_dir, config, v8_config)))
++    f.write(json.dumps(translate_config(args.out_dir, config, v8_config),
++                       sort_keys=True))
+ 
+   # Write depfile. Force regenerating config.gypi when GN configs change.
+   if args.dep_file:

patches/node/fix_handle_boringssl_and_openssl_incompatibilities.patch

@@ -185,10 +185,10 @@ index e2407027ab05e59b2f0f1c213b98ea469db7a91b..c64761b730e61edcdc0e46a48699f2fd
    # The location of simdutf - use the one from node's deps by default.
    node_simdutf_path = "//third_party/simdutf"
 diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
-index 2176fb6982484e2c42538478eeb4dd81c9d50ee1..c00d3616e08b00b1e0a3a29b2dbb5278e1e14fcc 100644
+index 07eb79acdf5e2d236b36daa1b314ed1afa19a545..c862f91bf1f9494b747b2950e8e37547ba08b6b8 100644
 --- a/src/crypto/crypto_cipher.cc
 +++ b/src/crypto/crypto_cipher.cc
-@@ -1027,7 +1027,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
+@@ -1026,7 +1026,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
      if (EVP_PKEY_decrypt_init(ctx.get()) <= 0) {
        return ThrowCryptoError(env, ERR_get_error());
      }
@@ -197,7 +197,7 @@ index 2176fb6982484e2c42538478eeb4dd81c9d50ee1..c00d3616e08b00b1e0a3a29b2dbb5278
      int rsa_pkcs1_implicit_rejection =
          EVP_PKEY_CTX_ctrl_str(ctx.get(), "rsa_pkcs1_implicit_rejection", "1");
      // From the doc -2 means that the option is not supported.
-@@ -1042,6 +1042,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
+@@ -1041,6 +1041,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
            env,
            "RSA_PKCS1_PADDING is no longer supported for private decryption");
      }
@@ -228,7 +228,7 @@ index d94f6e1c82c4a62547b3b395f375c86ce4deb5de..b81b9005365272217c77e2b9289bd9f8
        X509View ca(sk_X509_value(peer_certs.get(), i));
        if (!cert->view().isIssuedBy(ca)) continue;
 diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index d1430cd66dd045dcb52dd166e1eabc7202d1bd94..8f50d0cc132ac65fa74cf1fc2172247b5ad42962 100644
+index 8028f6db70f481e291aca2b8e0e6129900fbf67e..2cd7cd67c1c480eb9ec549a12bc2b9584d5a53b3 100644
 --- a/src/crypto/crypto_context.cc
 +++ b/src/crypto/crypto_context.cc
 @@ -141,7 +141,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
@@ -240,7 +240,7 @@ index d1430cd66dd045dcb52dd166e1eabc7202d1bd94..8f50d0cc132ac65fa74cf1fc2172247b
        X509* ca = sk_X509_value(extra_certs, i);
  
        // NOTE: Increments reference count on `ca`
-@@ -1831,11 +1831,12 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
+@@ -1854,11 +1854,12 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
    // If the user specified "auto" for dhparams, the JavaScript layer will pass
    // true to this function instead of the original string. Any other string
    // value will be interpreted as custom DH parameters below.
@@ -254,7 +254,7 @@ index d1430cd66dd045dcb52dd166e1eabc7202d1bd94..8f50d0cc132ac65fa74cf1fc2172247b
    DHPointer dh;
    {
      BIOPointer bio(LoadBIO(env, args[0]));
-@@ -2061,7 +2062,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
+@@ -2084,7 +2085,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
    }
  
    // Add CA certs too
@@ -519,7 +519,7 @@ index 9c2360df7150571377eff37fc5e958d17900da30..4505786745c54a529f904d5e7813a862
  }  // namespace
  
 diff --git a/src/env.h b/src/env.h
-index 874e5f4d15a75307e45cf70c06fc104fed843a6a..35e16159a94bb97f19d17767e3ad4bb798660f44 100644
+index 7a63acde77d28c0f11c7f2563c8c3cb2ebdce780..723e4738dd1c32710e521775d66e0d957334344c 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -51,7 +51,7 @@
@@ -554,7 +554,7 @@ index d9c533f100d25aeab1fe8589932a8ddead431258..2acab8786a8a752b17961445edeb872c
  #if NODE_OPENSSL_HAS_QUIC
  #include <openssl/quic.h>
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 31fc23fdbfabceab3cffd81a3e6650dde1ccd13a..3026b3d814ae652a9996c1dcba62b4fa678ac871 100644
+index 5b74045886e91a27e766a7f0a8f2dddfacaa1d46..41de3936265f0544831521fe753d2050e91b58e1 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -8,7 +8,7 @@
@@ -567,7 +567,7 @@ index 31fc23fdbfabceab3cffd81a3e6650dde1ccd13a..3026b3d814ae652a9996c1dcba62b4fa
  #endif
  
 diff --git a/src/node_options.h b/src/node_options.h
-index 2e73fd2a05e329910d4c064474880f770c9f5957..d8751a6ee734233e2fc24866ed87d9cd516072ae 100644
+index c1bcc063a001194bb76efe9a202fb4ab271ba834..b7d9b429f0b498dfd70301074948a13a2d35532e 100644
 --- a/src/node_options.h
 +++ b/src/node_options.h
 @@ -11,7 +11,7 @@

patches/node/fix_lazyload_fs_in_esm_loaders_to_apply_asar_patches.patch

@@ -28,7 +28,7 @@ index 3676a9852bcd42de0a3a380de117de58035f757b..eaecfcfd8b922908957c3fefea65fb9d
      const result = dataURLProcessor(url);
      if (result === 'failure') {
 diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
-index 5aa946f66c71beff0b7a43c30638ab28a1a5dfc0..e3afd30ba1f591d0298793bc42fd7166a4219bce 100644
+index cb44ec468edb22adc7a159cabec528cc135c9ec5..4216e136d01a119264de1523ed466efb783311c3 100644
 --- a/lib/internal/modules/esm/resolve.js
 +++ b/lib/internal/modules/esm/resolve.js
 @@ -25,7 +25,7 @@ const {
@@ -40,7 +40,7 @@ index 5aa946f66c71beff0b7a43c30638ab28a1a5dfc0..e3afd30ba1f591d0298793bc42fd7166
  const { getOptionValue } = require('internal/options');
  // Do not eagerly grab .manifest, it may be in TDZ
  const { sep, posix: { relative: relativePosixPath }, resolve } = require('path');
-@@ -276,7 +276,7 @@ function finalizeResolution(resolved, base, preserveSymlinks) {
+@@ -277,7 +277,7 @@ function finalizeResolution(resolved, base, preserveSymlinks) {
    }
  
    if (!preserveSymlinks) {

patches/node/fix_remove_fastapitypedarray_usage.patch

@@ -48,7 +48,7 @@ index fe669d40c31a29334b047b9cfee3067f64ef0a7b..9e5de7bbe574add017cd12ee091304d0
  
  static CFunction fast_timing_safe_equal(CFunction::Make(FastTimingSafeEqual));
 diff --git a/src/node_buffer.cc b/src/node_buffer.cc
-index b9f0c97938203b4652780a7d707c5e83319330b0..8a5b6b57321c2843a965a7e51b2ebed991a1e424 100644
+index 2fdada446c5d1ffa460f483a3360aeca658d9eef..b87b53843c3369832e561b9ffd40ca7c2134e74c 100644
 --- a/src/node_buffer.cc
 +++ b/src/node_buffer.cc
 @@ -44,6 +44,14 @@

patches/node/fix_remove_outdated_v8_flags_from_node_cc.patch

@@ -15,7 +15,7 @@ This patch can be removed when we upgrade to a V8 version that
 contains the above CLs.
 
 diff --git a/src/node.cc b/src/node.cc
-index 2d8d0000d52411992d2bd513cc7dd96b2292bab9..0ffc69d54631fa3dbac20337b26f7a0679560b96 100644
+index db0011b429f25cab296ca425564effe87383f506..152a9d9b17f9b14922421e2fe9866b6056f13ec7 100644
 --- a/src/node.cc
 +++ b/src/node.cc
 @@ -816,7 +816,7 @@ static ExitCode ProcessGlobalArgsInternal(std::vector<std::string>* args,

patches/node/fix_replace_deprecated_setprototype.patch

@@ -9,10 +9,10 @@ This is already applied in newer versions of Node so we can drop
 this patch once we upgrade to v23.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 79327877b0f34cbafb3efcc21617027d4011f806..8a12475857135bd3e904610b7eb887c397c8e73c 100644
+index 6034b779fe05850cfc4e7f7af221489be9369b54..d19cae298147f1b310506eec49b6fbd036fb1195 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -827,7 +827,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
+@@ -832,7 +832,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
  
    Local<Object> private_symbols_object;
    if (!private_symbols->NewInstance(context).ToLocal(&private_symbols_object) ||
@@ -21,7 +21,7 @@ index 79327877b0f34cbafb3efcc21617027d4011f806..8a12475857135bd3e904610b7eb887c3
            .IsNothing()) {
      return MaybeLocal<Object>();
    }
-@@ -853,7 +853,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
+@@ -858,7 +858,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
    Local<Object> per_isolate_symbols_object;
    if (!per_isolate_symbols->NewInstance(context).ToLocal(
            &per_isolate_symbols_object) ||

patches/node/pass_all_globals_through_require.patch

@@ -6,7 +6,7 @@ Subject: Pass all globals through "require"
 (cherry picked from commit 7d015419cb7a0ecfe6728431a4ed2056cd411d62)
 
 diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
-index a7d8fa1139c82054ac37a4e11cfb68605dc21f31..589c239aa544e118b7d9b7fff86d7deefe903896 100644
+index b87f557c16820ea52eece22813a8a218587a62dc..21730d32e0dd16065ae15ad6a0aae90e81a4c9b2 100644
 --- a/lib/internal/modules/cjs/loader.js
 +++ b/lib/internal/modules/cjs/loader.js
 @@ -202,6 +202,13 @@ const {
@@ -23,7 +23,7 @@ index a7d8fa1139c82054ac37a4e11cfb68605dc21f31..589c239aa544e118b7d9b7fff86d7dee
  const {
    isProxy,
  } = require('internal/util/types');
-@@ -1701,10 +1708,12 @@ Module.prototype._compile = function(content, filename, format) {
+@@ -1700,10 +1707,12 @@ Module.prototype._compile = function(content, filename, format) {
    if (this[kIsMainSymbol] && getOptionValue('--inspect-brk')) {
      const { callAndPauseOnStart } = internalBinding('inspector');
      result = callAndPauseOnStart(compiledWrapper, thisValue, exports,

patches/node/refactor_attach_cppgc_heap_on_v8_isolate_creation.patch

@@ -18,10 +18,10 @@ This can be removed when Node.js upgrades to a version of V8 containing CLs
 from the above issue.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index fd71ceac65ccef1d2832b45b0b5612877cee22c1..ceac508418f489a8077c1bc85a2feaf85bf60480 100644
+index 8356e588659d2208700659f3e3ce5438fba9462f..d2614bba9463056e931b6d5c1f3153e2f576b779 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -308,6 +308,10 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
+@@ -313,6 +313,10 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
                      MultiIsolatePlatform* platform,
                      const SnapshotData* snapshot_data,
                      const IsolateSettings& settings) {
@@ -32,7 +32,7 @@ index fd71ceac65ccef1d2832b45b0b5612877cee22c1..ceac508418f489a8077c1bc85a2feaf8
    Isolate* isolate = Isolate::Allocate();
    if (isolate == nullptr) return nullptr;
  
-@@ -351,9 +355,12 @@ Isolate* NewIsolate(ArrayBufferAllocator* allocator,
+@@ -356,9 +360,12 @@ Isolate* NewIsolate(ArrayBufferAllocator* allocator,
                      uv_loop_t* event_loop,
                      MultiIsolatePlatform* platform,
                      const EmbedderSnapshotData* snapshot_data,
@@ -82,7 +82,7 @@ index 85641b68b1e6f6dd4149f33ba13f76bccc8bf47d..c6209cc7cf317de1bb9217e39dd760e5
  void SetCppgcReference(Isolate* isolate,
                         Local<Object> object,
 diff --git a/src/env.h b/src/env.h
-index 2d5fa8dbd75851bca30453548f6cbe0159509f26..c346e3a9c827993036438685d758a734f9ce8c05 100644
+index 888f0a5572254d775cbf672dcf07b789782292ea..2af2846af6ba7d8ad6e0edca5e2f6279e4c672a3 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -157,7 +157,6 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
@@ -102,7 +102,7 @@ index 2d5fa8dbd75851bca30453548f6cbe0159509f26..c346e3a9c827993036438685d758a734
    worker::Worker* worker_context_ = nullptr;
    PerIsolateWrapperData* wrapper_data_;
 diff --git a/src/node.cc b/src/node.cc
-index 0ffc69d54631fa3dbac20337b26f7a0679560b96..f012b365455bb111cddea44fcff020804086ab72 100644
+index 152a9d9b17f9b14922421e2fe9866b6056f13ec7..f85b5ed687180d7a12648b87398a734fb321f346 100644
 --- a/src/node.cc
 +++ b/src/node.cc
 @@ -1288,6 +1288,14 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
@@ -136,10 +136,10 @@ index 0ffc69d54631fa3dbac20337b26f7a0679560b96..f012b365455bb111cddea44fcff02080
    bool use_wasm_trap_handler =
        !per_process::cli_options->disable_wasm_trap_handler;
 diff --git a/src/node.h b/src/node.h
-index d3a965661d068db359bb1bb4b14e59c28bb615f9..16a0c71aef949b0ddd27def9dc843298f9a6b75f 100644
+index 91468bfd755db6adde5cc8cecb184312db90a654..fe44369dff7519ea0d960ae478d5caf524e17366 100644
 --- a/src/node.h
 +++ b/src/node.h
-@@ -590,7 +590,8 @@ NODE_EXTERN v8::Isolate* NewIsolate(
+@@ -589,7 +589,8 @@ NODE_EXTERN v8::Isolate* NewIsolate(
      struct uv_loop_s* event_loop,
      MultiIsolatePlatform* platform,
      const EmbedderSnapshotData* snapshot_data = nullptr,
@@ -174,7 +174,7 @@ index 4119ac1b002681d39711eac810ca2fcc2702ffc7..790347056cde949ffe6cf8498a7eca0c
  
  ExitCode NodeMainInstance::Run() {
 diff --git a/src/node_worker.cc b/src/node_worker.cc
-index 29c4b1de42b3127a98871d200c80197bf974b31f..8555ab556b5b74a1cf9cf30747f1f417bfe4e4d9 100644
+index 083abea7d744e552dd349e5e1ceb75dfaaa79eaa..ddfea91272d03d4ef1d4ac1b982ada5dcd24b601 100644
 --- a/src/node_worker.cc
 +++ b/src/node_worker.cc
 @@ -177,6 +177,9 @@ class WorkerThreadData {

patches/node/remove_obsolete_noarraybufferzerofillscope.patch

@@ -16,24 +16,28 @@ that is exposed to JS
 Refs https://github.com/nodejs/node/commit/3cdb1cd437f63dd256ae2ab3b7e9016257326cb4
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 8a12475857135bd3e904610b7eb887c397c8e73c..3702672f4e2c3b1bff9f9f5c66ca251af447826a 100644
+index d19cae298147f1b310506eec49b6fbd036fb1195..ecd2d481d97e5dab934481b085b949f47904a6c4 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -107,11 +107,7 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,
+@@ -108,14 +108,8 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,
  }
  
  void* NodeArrayBufferAllocator::Allocate(size_t size) {
 -  void* ret;
--  if (zero_fill_field_ || per_process::cli_options->zero_fill_all_buffers)
+-  if (zero_fill_field_ || per_process::cli_options->zero_fill_all_buffers) {
+-    COUNT_GENERIC_USAGE("NodeArrayBufferAllocator.Allocate.ZeroFilled");
 -    ret = allocator_->Allocate(size);
--  else
+-  } else {
+-    COUNT_GENERIC_USAGE("NodeArrayBufferAllocator.Allocate.Uninitialized");
 -    ret = allocator_->AllocateUninitialized(size);
+-  }
 +  void* ret = allocator_->Allocate(size);
++  COUNT_GENERIC_USAGE("NodeArrayBufferAllocator.Allocate.Uninitialized");
    if (ret != nullptr) [[likely]] {
      total_mem_usage_.fetch_add(size, std::memory_order_relaxed);
    }
 diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
-index c00d3616e08b00b1e0a3a29b2dbb5278e1e14fcc..8939c5e5085d00b098f66074b9ee033f5be55d08 100644
+index c862f91bf1f9494b747b2950e8e37547ba08b6b8..9fd48697845fca304e1dabf7c57ab208d9649a73 100644
 --- a/src/crypto/crypto_cipher.cc
 +++ b/src/crypto/crypto_cipher.cc
 @@ -20,6 +20,7 @@ using ncrypto::SSLPointer;
@@ -44,7 +48,7 @@ index c00d3616e08b00b1e0a3a29b2dbb5278e1e14fcc..8939c5e5085d00b098f66074b9ee033f
  using v8::Context;
  using v8::FunctionCallbackInfo;
  using v8::FunctionTemplate;
-@@ -774,10 +775,10 @@ CipherBase::UpdateResult CipherBase::Update(
+@@ -773,10 +774,10 @@ CipherBase::UpdateResult CipherBase::Update(
      return kErrorState;
    }
  
@@ -59,7 +63,7 @@ index c00d3616e08b00b1e0a3a29b2dbb5278e1e14fcc..8939c5e5085d00b098f66074b9ee033f
  
    buffer = {
        .data = reinterpret_cast<const unsigned char*>(data),
-@@ -852,11 +853,10 @@ bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
+@@ -851,11 +852,10 @@ bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
  
    const int mode = ctx_.getMode();
  
@@ -75,7 +79,7 @@ index c00d3616e08b00b1e0a3a29b2dbb5278e1e14fcc..8939c5e5085d00b098f66074b9ee033f
  
    if (kind_ == kDecipher &&
        Cipher::FromCtx(ctx_).isSupportedAuthenticatedMode()) {
-@@ -972,10 +972,10 @@ bool PublicKeyCipher::Cipher(
+@@ -971,10 +971,10 @@ bool PublicKeyCipher::Cipher(
      return false;
    }
  
@@ -359,7 +363,7 @@ index fd29d17de195017970856ce30d7a9c5785b0b8ee..7fe3d09851d4476fa3f77ea0a0b49e8a
    unsigned char* serialized = reinterpret_cast<unsigned char*>(bs->Data());
    CHECK_GE(i2d_RSA_PUBKEY(rsa, &serialized), 0);
 diff --git a/src/encoding_binding.cc b/src/encoding_binding.cc
-index 5ace688bb7ffc86eedf5aff11ab0ab487ad9440e..31058543a164bb45ba989e8c433994e0857a98b9 100644
+index 22eecffa437a9e0f4a0e170953aa35fa527511b5..5b45f2223cece766bd7d27ac0d3a853c82f8ce07 100644
 --- a/src/encoding_binding.cc
 +++ b/src/encoding_binding.cc
 @@ -15,6 +15,7 @@ namespace encoding_binding {
@@ -383,7 +387,7 @@ index 5ace688bb7ffc86eedf5aff11ab0ab487ad9440e..31058543a164bb45ba989e8c433994e0
      CHECK(bs);
  
 diff --git a/src/env-inl.h b/src/env-inl.h
-index 98e1e1e75bae94038bba0049447ab48b0acfb8cc..fe395bf89f9c1e5bb2dabc8fceda7b9b2b877415 100644
+index d1a7e1212da46a8e5c2fffee46542ac8bec828ee..97018f2378fe4848944f26f51684b21ac118d1b3 100644
 --- a/src/env-inl.h
 +++ b/src/env-inl.h
 @@ -44,16 +44,6 @@
@@ -432,7 +436,7 @@ index 161d577e0ea6a251c83ba1903b1ec9a582a5317c..52713421465c23c959afac1955168294
    released_allocated_buffers_.emplace(buf.base, std::move(bs));
    return buf;
 diff --git a/src/env.h b/src/env.h
-index c346e3a9c827993036438685d758a734f9ce8c05..28c8df87c8e2f06e2ed8c554260bfdedb860bb4a 100644
+index 2af2846af6ba7d8ad6e0edca5e2f6279e4c672a3..87cff857bbe65c32e1931886b953c5e32deba193 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -114,19 +114,6 @@ class ModuleWrap;
@@ -456,7 +460,7 @@ index c346e3a9c827993036438685d758a734f9ce8c05..28c8df87c8e2f06e2ed8c554260bfded
    std::vector<SnapshotIndex> primitive_values;
    std::vector<PropInfo> template_values;
 diff --git a/src/node_buffer.cc b/src/node_buffer.cc
-index e844fe6cb33acefd075516e675075421ad5c3cff..06c84eb6ec097e3cb39502116135a7802aed13ce 100644
+index 0cf2a07deb382dfd96607f84b583ffbd62447769..f2943d5ceca106564e421c668ec8815c43c21085 100644
 --- a/src/node_buffer.cc
 +++ b/src/node_buffer.cc
 @@ -66,6 +66,7 @@ namespace Buffer {
@@ -525,7 +529,7 @@ index e844fe6cb33acefd075516e675075421ad5c3cff..06c84eb6ec097e3cb39502116135a780
        return env->ThrowRangeError("Array buffer allocation failed");
      }
 diff --git a/src/node_http2.cc b/src/node_http2.cc
-index 8237c9b7d325dd925ae8798d7795fcd94eeb13d0..a22cf6c4e33e5cf2d3168ce03dc35af8a9584af7 100644
+index 7c070ae09e77afc7773724a516217059189138a7..bb761c0a201cbed568258d07d8ec0d6a80de8b3b 100644
 --- a/src/node_http2.cc
 +++ b/src/node_http2.cc
 @@ -27,6 +27,7 @@ using v8::Array;

patches/node/src_handle_der_decoding_errors_from_system_certificates.patch

@@ -1,74 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Joyee Cheung <joyeec9h3@gmail.com>
-Date: Thu, 20 Nov 2025 13:50:28 +0900
-Subject: src: handle DER decoding errors from system certificates
-
-When decoding certificates from the system store, it's not actually
-guaranteed to succeed. In case the system returns a certificate
-that cannot be decoded (might be related to SSL implementation issues),
-skip them.
-
-diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index 0c6b12f8e17b4a7e86ebc836a4e1cc77333f211a..dacf10c3c2e663b03a251c86d69276d0be0dff9d 100644
---- a/src/crypto/crypto_context.cc
-+++ b/src/crypto/crypto_context.cc
-@@ -505,7 +505,11 @@ void ReadMacOSKeychainCertificates(
-   CFRelease(search);
- 
-   if (ortn) {
--    fprintf(stderr, "ERROR: SecItemCopyMatching failed %d\n", ortn);
-+    per_process::Debug(DebugCategory::CRYPTO,
-+                       "Cannot read certificates from system because "
-+                       "SecItemCopyMatching failed %d\n",
-+                       ortn);
-+    return;
-   }
- 
-   CFIndex count = CFArrayGetCount(curr_anchors);
-@@ -516,7 +520,9 @@ void ReadMacOSKeychainCertificates(
- 
-     CFDataRef der_data = SecCertificateCopyData(cert_ref);
-     if (!der_data) {
--      fprintf(stderr, "ERROR: SecCertificateCopyData failed\n");
-+      per_process::Debug(DebugCategory::CRYPTO,
-+                         "Skipping read of a system certificate "
-+                         "because SecCertificateCopyData failed\n");
-       continue;
-     }
-     auto data_buffer_pointer = CFDataGetBytePtr(der_data);
-@@ -524,9 +530,19 @@ void ReadMacOSKeychainCertificates(
-     X509* cert =
-         d2i_X509(nullptr, &data_buffer_pointer, CFDataGetLength(der_data));
-     CFRelease(der_data);
-+
-+    if (cert == nullptr) {
-+      per_process::Debug(DebugCategory::CRYPTO,
-+                         "Skipping read of a system certificate "
-+                         "because decoding failed\n");
-+      continue;
-+    }
-+
-     bool is_valid = IsCertificateTrustedForPolicy(cert, cert_ref);
-     if (is_valid) {
-       system_root_certificates_X509->emplace_back(cert);
-+    } else {
-+      X509_free(cert);
-     }
-   }
-   CFRelease(curr_anchors);
-@@ -636,7 +652,14 @@ void GatherCertsForLocation(std::vector<X509*>* vector,
-         reinterpret_cast<const unsigned char*>(cert_from_store->pbCertEncoded);
-     const size_t cert_size = cert_from_store->cbCertEncoded;
- 
--    vector->emplace_back(d2i_X509(nullptr, &cert_data, cert_size));
-+    X509* x509 = d2i_X509(nullptr, &cert_data, cert_size);
-+    if (x509 == nullptr) {
-+      per_process::Debug(DebugCategory::CRYPTO,
-+                         "Skipping read of a system certificate "
-+                         "because decoding failed\n");
-+    } else {
-+      vector->emplace_back(x509);
-+    }
-   }
- }
- 

patches/node/src_prepare_for_v8_sandboxing.patch

@@ -212,10 +212,10 @@ index 7fe3d09851d4476fa3f77ea0a0b49e8af13fae4f..b60ad6b1cdb0b923ba2de1b7205ed5ce
    Local<Value> ret;
    if (!Buffer::New(env, ab, 0, ab->ByteLength()).ToLocal(&ret)) return {};
 diff --git a/src/js_native_api_v8.cc b/src/js_native_api_v8.cc
-index 413db3ed9b88d7b7fb2ac6dd1153dade9ff830fd..6da93b8569a34841e846c320ec0a6ca7f1ea0da6 100644
+index e62dce7a3e5f32ebb926ad2ffe57887ab1887b8d..878d9764e072f0b0105508541beff205bf97b1ab 100644
 --- a/src/js_native_api_v8.cc
 +++ b/src/js_native_api_v8.cc
-@@ -114,7 +114,7 @@ napi_status NewExternalString(napi_env env,
+@@ -116,7 +116,7 @@ napi_status NewExternalString(napi_env env,
    CHECK_NEW_STRING_ARGS(env, str, length, result);
  
    napi_status status;
@@ -225,10 +225,10 @@ index 413db3ed9b88d7b7fb2ac6dd1153dade9ff830fd..6da93b8569a34841e846c320ec0a6ca7
    if (status == napi_ok) {
      if (copied != nullptr) {
 diff --git a/src/node_api.cc b/src/node_api.cc
-index 2769997f0ede0e921fcb8826942609e497e5f9cb..d9b17780f6143f1c3f8488a20144376963e43fbc 100644
+index 26583f964edadef46ee65e52844a4d9a0ddacc2f..9086dd9d6f409f266a1e9ae603733ecfd0fb8d72 100644
 --- a/src/node_api.cc
 +++ b/src/node_api.cc
-@@ -1056,7 +1056,7 @@ napi_create_external_buffer(napi_env env,
+@@ -1058,7 +1058,7 @@ napi_create_external_buffer(napi_env env,
    NAPI_PREAMBLE(env);
    CHECK_ARG(env, result);
  
@@ -238,7 +238,7 @@ index 2769997f0ede0e921fcb8826942609e497e5f9cb..d9b17780f6143f1c3f8488a201443769
  #else
    v8::Isolate* isolate = env->isolate;
 diff --git a/src/node_options.cc b/src/node_options.cc
-index e93e8684e518b30a2514768a269be6d32d1f5b94..547cda780376f578b0f78eb9158dc14a3faf874d 100644
+index 1ebc7bfca2d89f78898873e8b6f838f3f4c2e576..bec62634d153e2311959ad2fb56f54dfbbb80f09 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -83,6 +83,8 @@ void PerProcessOptions::CheckOptions(std::vector<std::string>* errors,

patches/node/src_remove_dependency_on_wrapper-descriptor-based_cppheap.patch

@@ -16,7 +16,7 @@ patch:
 (cherry picked from commit 30329d06235a9f9733b1d4da479b403462d1b326)
 
 diff --git a/src/env-inl.h b/src/env-inl.h
-index da2c468f11cdc320cfec794b1b8b24904b93491e..98e1e1e75bae94038bba0049447ab48b0acfb8cc 100644
+index bcf5fb6104ccf937304d109f1c0f5d07ca54acd4..d1a7e1212da46a8e5c2fffee46542ac8bec828ee 100644
 --- a/src/env-inl.h
 +++ b/src/env-inl.h
 @@ -62,31 +62,6 @@ inline uv_loop_t* IsolateData::event_loop() const {
@@ -146,7 +146,7 @@ index 926645dc647fe7ca01165462f08eac1ade71ac4e..85641b68b1e6f6dd4149f33ba13f76bc
  
  void IsolateData::MemoryInfo(MemoryTracker* tracker) const {
 diff --git a/src/env.h b/src/env.h
-index 35e16159a94bb97f19d17767e3ad4bb798660f44..2d5fa8dbd75851bca30453548f6cbe0159509f26 100644
+index 723e4738dd1c32710e521775d66e0d957334344c..888f0a5572254d775cbf672dcf07b789782292ea 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -177,10 +177,6 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
@@ -161,10 +161,10 @@ index 35e16159a94bb97f19d17767e3ad4bb798660f44..2d5fa8dbd75851bca30453548f6cbe01
    inline MultiIsolatePlatform* platform() const;
    inline const SnapshotData* snapshot_data() const;
 diff --git a/src/node.h b/src/node.h
-index 96c599aa6448e2aa8e57e84f811564a5281c139a..d3a965661d068db359bb1bb4b14e59c28bb615f9 100644
+index 4e66924e4ca5b5d787fc6259de940a3fb40bff38..91468bfd755db6adde5cc8cecb184312db90a654 100644
 --- a/src/node.h
 +++ b/src/node.h
-@@ -1576,24 +1576,14 @@ void RegisterSignalHandler(int signal,
+@@ -1575,24 +1575,14 @@ void RegisterSignalHandler(int signal,
                             bool reset_handler = false);
  #endif  // _WIN32
  

patches/node/src_switch_from_get_setprototype_to_get_setprototypev2.patch

@@ -10,10 +10,10 @@ Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 Reviewed-By: James M Snell <jasnell@gmail.com>
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 33827edce63c9fe08b52aea59571391a83853443..79327877b0f34cbafb3efcc21617027d4011f806 100644
+index f3a992b634e9532cba34ec4d54b3a1d0f68a8545..6034b779fe05850cfc4e7f7af221489be9369b54 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -878,7 +878,7 @@ Maybe<void> InitializePrimordials(Local<Context> context,
+@@ -882,7 +882,7 @@ Maybe<void> InitializePrimordials(Local<Context> context,
    CHECK(!exports->Has(context, primordials_string).FromJust());
  
    Local<Object> primordials = Object::New(isolate);
@@ -38,10 +38,10 @@ index 487b8b7adfd35646d20fdb15be5fd6f2bee9315b..6a3c4e6952a8f3250bf1b57652a1622e
      }
      return false;
 diff --git a/src/js_native_api_v8.cc b/src/js_native_api_v8.cc
-index 7b2efa49468c0bed2f5935552addd3ab37d0a50b..413db3ed9b88d7b7fb2ac6dd1153dade9ff830fd 100644
+index 4a748957431da4b3a55ecaa5db9c45e2061f76f1..e62dce7a3e5f32ebb926ad2ffe57887ab1887b8d 100644
 --- a/src/js_native_api_v8.cc
 +++ b/src/js_native_api_v8.cc
-@@ -1577,7 +1577,7 @@ napi_status NAPI_CDECL napi_get_prototype(napi_env env,
+@@ -1578,7 +1578,7 @@ napi_status NAPI_CDECL napi_get_prototype(napi_env env,
    CHECK_TO_OBJECT(env, context, obj, object);
  
    // This doesn't invokes Proxy's [[GetPrototypeOf]] handler.
@@ -51,7 +51,7 @@ index 7b2efa49468c0bed2f5935552addd3ab37d0a50b..413db3ed9b88d7b7fb2ac6dd1153dade
    return GET_RETURN_STATUS(env);
  }
 diff --git a/src/node_buffer.cc b/src/node_buffer.cc
-index 8a5b6b57321c2843a965a7e51b2ebed991a1e424..e844fe6cb33acefd075516e675075421ad5c3cff 100644
+index b87b53843c3369832e561b9ffd40ca7c2134e74c..0cf2a07deb382dfd96607f84b583ffbd62447769 100644
 --- a/src/node_buffer.cc
 +++ b/src/node_buffer.cc
 @@ -283,8 +283,9 @@ MaybeLocal<Uint8Array> New(Environment* env,
@@ -135,7 +135,7 @@ index b1ee513fc0873a51b4885f612dbf7b950b5cf2ca..2f23cc63f148a792f1302e1d2d888227
    Local<Object> internal_constants = Object::New(isolate);
    CHECK(internal_constants->SetPrototype(env->context(),
 diff --git a/src/node_options.cc b/src/node_options.cc
-index b067685822dc056e446e1a9402a5a6cba86cc722..e93e8684e518b30a2514768a269be6d32d1f5b94 100644
+index 5a1675f2b4448e5da71f0badee8ac5f2d2a9c6ee..1ebc7bfca2d89f78898873e8b6f838f3f4c2e576 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -1552,7 +1552,8 @@ void GetCLIOptionsInfo(const FunctionCallbackInfo<Value>& args) {
@@ -159,10 +159,10 @@ index b067685822dc056e446e1a9402a5a6cba86cc722..e93e8684e518b30a2514768a269be6d3
      return;
    }
 diff --git a/src/node_webstorage.cc b/src/node_webstorage.cc
-index 9a7b7db881a564a68683c55cb10919454e80edbf..bf88ce68f9173ef24a283dd370e71903220b0077 100644
+index d6dee522023a4e65d948b1554e9ae472f1e96e40..e7d0c4e2e1150a62a1ccfbe9e9ec08b6b2e5be65 100644
 --- a/src/node_webstorage.cc
 +++ b/src/node_webstorage.cc
-@@ -532,7 +532,7 @@ template <typename T>
+@@ -536,7 +536,7 @@ template <typename T>
  static bool ShouldIntercept(Local<Name> property,
                              const PropertyCallbackInfo<T>& info) {
    Environment* env = Environment::GetCurrent(info);

patches/node/src_use_cp_utf8_for_wide_file_names_on_win32.patch

@@ -24,10 +24,10 @@ Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 
 diff --git a/src/node_file.cc b/src/node_file.cc
-index 75be21c9e8b413f522240a906da06d26c44d5b71..e94c2b5f2cf7cac413cd5cb782fa1cca6d764960 100644
+index 57c8dc35dc86efed6e8736e4649b90905a8da54b..89c51a3fd0752ac1586de6840243e93ef5bc080e 100644
 --- a/src/node_file.cc
 +++ b/src/node_file.cc
-@@ -3056,42 +3056,6 @@ static void GetFormatOfExtensionlessFile(
+@@ -3066,42 +3066,6 @@ static void GetFormatOfExtensionlessFile(
    return args.GetReturnValue().Set(EXTENSIONLESS_FORMAT_JAVASCRIPT);
  }
  
@@ -70,7 +70,7 @@ index 75be21c9e8b413f522240a906da06d26c44d5b71..e94c2b5f2cf7cac413cd5cb782fa1cca
  static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
    Environment* env = Environment::GetCurrent(args);
    Isolate* isolate = env->isolate();
-@@ -3104,7 +3068,7 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
+@@ -3114,7 +3078,7 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
    THROW_IF_INSUFFICIENT_PERMISSIONS(
        env, permission::PermissionScope::kFileSystemRead, src.ToStringView());
  
@@ -79,7 +79,7 @@ index 75be21c9e8b413f522240a906da06d26c44d5b71..e94c2b5f2cf7cac413cd5cb782fa1cca
  
    BufferValue dest(isolate, args[1]);
    CHECK_NOT_NULL(*dest);
-@@ -3112,7 +3076,7 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
+@@ -3122,7 +3086,7 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
    THROW_IF_INSUFFICIENT_PERMISSIONS(
        env, permission::PermissionScope::kFileSystemWrite, dest.ToStringView());
  
@@ -88,7 +88,7 @@ index 75be21c9e8b413f522240a906da06d26c44d5b71..e94c2b5f2cf7cac413cd5cb782fa1cca
    bool dereference = args[2]->IsTrue();
    bool recursive = args[3]->IsTrue();
  
-@@ -3141,8 +3105,8 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
+@@ -3151,8 +3115,8 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
        (src_status.type() == std::filesystem::file_type::directory) ||
        (dereference && src_status.type() == std::filesystem::file_type::symlink);
  
@@ -99,7 +99,7 @@ index 75be21c9e8b413f522240a906da06d26c44d5b71..e94c2b5f2cf7cac413cd5cb782fa1cca
  
    if (!error_code) {
      // Check if src and dest are identical.
-@@ -3237,7 +3201,7 @@ static bool CopyUtimes(const std::filesystem::path& src,
+@@ -3247,7 +3211,7 @@ static bool CopyUtimes(const std::filesystem::path& src,
    uv_fs_t req;
    auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
  
@@ -108,7 +108,7 @@ index 75be21c9e8b413f522240a906da06d26c44d5b71..e94c2b5f2cf7cac413cd5cb782fa1cca
    int result = uv_fs_stat(nullptr, &req, src_path_str.c_str(), nullptr);
    if (is_uv_error(result)) {
      env->ThrowUVException(result, "stat", nullptr, src_path_str.c_str());
-@@ -3248,7 +3212,7 @@ static bool CopyUtimes(const std::filesystem::path& src,
+@@ -3258,7 +3222,7 @@ static bool CopyUtimes(const std::filesystem::path& src,
    const double source_atime = s->st_atim.tv_sec + s->st_atim.tv_nsec / 1e9;
    const double source_mtime = s->st_mtim.tv_sec + s->st_mtim.tv_nsec / 1e9;
  
@@ -117,7 +117,7 @@ index 75be21c9e8b413f522240a906da06d26c44d5b71..e94c2b5f2cf7cac413cd5cb782fa1cca
    int utime_result = uv_fs_utime(nullptr,
                                   &req,
                                   dest_file_path_str.c_str(),
-@@ -3383,7 +3347,7 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
+@@ -3393,7 +3357,7 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
      std::error_code error;
      for (auto dir_entry : std::filesystem::directory_iterator(src)) {
        auto dest_file_path = dest / dir_entry.path().filename();
@@ -126,7 +126,7 @@ index 75be21c9e8b413f522240a906da06d26c44d5b71..e94c2b5f2cf7cac413cd5cb782fa1cca
  
        if (dir_entry.is_symlink()) {
          if (verbatim_symlinks) {
-@@ -3446,7 +3410,7 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
+@@ -3452,7 +3416,7 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
                }
              } else if (std::filesystem::is_regular_file(dest_file_path)) {
                if (!dereference || (!force && error_on_exist)) {

patches/node/support_v8_sandboxed_pointers.patch

@@ -132,7 +132,7 @@ index f616223cfb0f6e10f7cf57ada9704316bde2797e..eb6dad44a49d997097c8fb5009eeb60a
    Local<Value> ret;
    if (!Buffer::New(env, ab, 0, ab->ByteLength()).ToLocal(&ret)) return {};
 diff --git a/src/node_buffer.cc b/src/node_buffer.cc
-index 357dc5f6d1c1c2d3756a94c1326b0502403e1eaf..b9f0c97938203b4652780a7d707c5e83319330b0 100644
+index 70fdb52de7b3394df52d327cb485b7c615f8be2d..2fdada446c5d1ffa460f483a3360aeca658d9eef 100644
 --- a/src/node_buffer.cc
 +++ b/src/node_buffer.cc
 @@ -1412,7 +1412,7 @@ inline size_t CheckNumberToSize(Local<Value> number) {

patches/node/test_correct_conditional_secure_heap_flags_test.patch

@@ -1,33 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Shelley Vohr <shelley.vohr@gmail.com>
-Date: Tue, 4 Nov 2025 21:20:26 +0100
-Subject: test: correct conditional secure heap flags test
-
-PR-URL: https://github.com/nodejs/node/pull/60385
-Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
-Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
-(cherry picked from commit 53c4a39fec941e04150554fdd3e654b48f2e1b31)
-
-diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
-index afd43cfffe638f4f084f1c36949068e7239eadc3..c70e073bab888c349e8f5c691f5679a3796c896c 100644
---- a/test/parallel/test-process-env-allowed-flags-are-documented.js
-+++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
-@@ -49,6 +49,8 @@ if (!hasOpenSSL3) {
-   documented.delete('--openssl-shared-config');
- }
- 
-+const isV8Sandboxed = process.config.variables.v8_enable_sandbox;
-+
- // Filter out options that are conditionally present.
- const conditionalOpts = [
-   {
-@@ -74,6 +76,9 @@ const conditionalOpts = [
-   }, {
-     include: process.features.inspector,
-     filter: (opt) => opt.startsWith('--inspect') || opt === '--debug-port'
-+  }, {
-+    include: !isV8Sandboxed,
-+    filter: (opt) => ['--secure-heap', '--secure-heap-min'].includes(opt)
-   },
- ];
- documented.forEach((opt) => {

patches/node/test_formally_mark_some_tests_as_flaky.patch

@@ -7,7 +7,7 @@ Instead of disabling the tests, flag them as flaky so they still run
 but don't cause CI failures on flakes.
 
 diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
-index 9822dc622ebfc2d1a31539474b78e03e64426195..045a415f7b9f461bd9b2c97d42051f2580b7df1a 100644
+index 0d3ed11813f0df93374a1f683add4c621ee8d0c8..c6e7866405ced71aaa2a884addf493f7366fd377 100644
 --- a/test/parallel/parallel.status
 +++ b/test/parallel/parallel.status
 @@ -5,6 +5,16 @@ prefix parallel
@@ -28,7 +28,7 @@ index 9822dc622ebfc2d1a31539474b78e03e64426195..045a415f7b9f461bd9b2c97d42051f25
  test-net-write-fully-async-hex-string: PASS, FLAKY
  # https://github.com/nodejs/node/issues/52273
 diff --git a/test/sequential/sequential.status b/test/sequential/sequential.status
-index f6c9c77379930a8234cd4c5f933c261d6bd1a238..28d5378e4051b78e9a7ff81886c3382e92a5da2e 100644
+index 33d1109b015ba1abcd52eb6400afff32b82afb3c..6e088c2273d4b034dc458608505cabe8aa304ea1 100644
 --- a/test/sequential/sequential.status
 +++ b/test/sequential/sequential.status
 @@ -7,6 +7,18 @@ prefix sequential

script/node-disabled-tests.json

@@ -46,8 +46,6 @@
   "parallel/test-repl",
   "parallel/test-repl-underscore",
   "parallel/test-tls-securepair-leak",
-  "parallel/test-single-executable-blob-config",
-  "parallel/test-single-executable-blob-config-errors",
   "parallel/test-shadow-realm-custom-loaders",
   "parallel/test-snapshot-api",
   "parallel/test-snapshot-argv1",
@@ -109,6 +107,9 @@
   "parallel/test-tls-multi-key",
   "parallel/test-tls-multi-pfx",
   "parallel/test-tls-no-cert-required",
+  "parallel/test-tls-off-thread-cert-loading",
+  "parallel/test-tls-off-thread-cert-loading-disabled",
+  "parallel/test-tls-off-thread-cert-loading-system",
   "parallel/test-tls-options-boolean-check",
   "parallel/test-tls-passphrase",
   "parallel/test-tls-peer-certificate",
@@ -172,6 +173,8 @@
   "report/test-report-uv-handles",
   "report/test-report-worker",
   "report/test-report-writereport",
+  "sea/test-single-executable-blob-config",
+  "sea/test-single-executable-blob-config-errors",
   "sequential/test-single-executable-application",
   "sequential/test-single-executable-application-disable-experimental-sea-warning",
   "sequential/test-single-executable-application-empty",