chore: bump node to v24.13.0 (main) (#49189)

* chore: bump node in DEPS to v24.12.0

* src: use CP_UTF8 for wide file names on win32

https://github.com/nodejs/node/pull/60575

* test,crypto: handle a few more BoringSSL tests

https://github.com/nodejs/node/pull/59030

* chore: fixup patch indices

* chore: re-add accidentally removed sslv23 test

* chore: fixup crypto patch rebase

* test: make buffer sizes 32bit-aware in test-internal-util-construct-sab

https://github.com/nodejs/node/pull/61026

* src: add internal binding for constructing SharedArrayBuffers

https://github.com/nodejs/node/pull/60497

* chore: bump node in DEPS to v24.13.0

* chore: fixup patch indices

* chore: fixup sandboxed pointers patch

* tls: route callback exceptions through error handlers

https://github.com/nodejs-private/node-private/pull/782

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>

DEPS

@@ -4,7 +4,7 @@ vars = {
   'chromium_version':
     '146.0.7633.0',
   'node_version':
-    'v24.11.1',
+    'v24.13.0',
   'nan_version':
     '675cefebca42410733da8a454c8d9391fcebfbc2',
   'squirrel.mac_version':

patches/node/.patches

@@ -36,11 +36,10 @@ fix_redefined_macos_sdk_header_symbols.patch
 fix_allow_disabling_fetch_in_renderer_and_worker_processes.patch
 feat_disable_js_source_phase_imports_by_default.patch
 fix_avoid_external_memory_leak_on_invalid_tls_protocol_versions.patch
-lib_check_sharedarraybuffer_existence_in_fast-utf8-stream.patch
 api_delete_deprecated_fields_on_v8_isolate.patch
 api_promote_deprecation_of_v8_context_and_v8_object_api_methods.patch
-src_use_cp_utf8_for_wide_file_names_on_win32.patch
 fix_ensure_traverseparent_bails_on_resource_path_exit.patch
 reland_temporal_unflag_temporal.patch
 src_handle_der_decoding_errors_from_system_certificates.patch
 fix_suppress_nodiscard_warning_for_copy_options_operator.patch
+test_make_buffer_sizes_32bit-aware_in.patch

patches/node/api_delete_deprecated_fields_on_v8_isolate.patch

@@ -6,10 +6,10 @@ Subject: Delete deprecated fields on v8::Isolate
 https://chromium-review.googlesource.com/c/v8/v8/+/7081397
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index ea3e9374c30be92ba5668e33773ffbb2aef55b30..44ba3c42c7a980eee19e1aadcbe7999eefeda989 100644
+index cb1e4e6176e7385f8bc2bc9510761d3fc9c3182d..730254bfc16eceb7394f5aa766b648da4b96511f 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -231,8 +231,6 @@ void SetIsolateCreateParamsForNode(Isolate::CreateParams* params) {
+@@ -226,8 +226,6 @@ void SetIsolateCreateParamsForNode(Isolate::CreateParams* params) {
      // heap based on the actual physical memory.
      params->constraints.ConfigureDefaults(total_memory, 0);
    }

patches/node/api_remove_deprecated_getisolate.patch

@@ -6,10 +6,10 @@ Subject: Remove deprecated `GetIsolate`
 https://chromium-review.googlesource.com/c/v8/v8/+/6905244
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 451796ffc4ec93b6e317dd49d92070c61aca04e5..ea3e9374c30be92ba5668e33773ffbb2aef55b30 100644
+index 0f19cb09ea0963a9c505c51f89d1c7a939f2730b..cb1e4e6176e7385f8bc2bc9510761d3fc9c3182d 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -687,7 +687,7 @@ std::unique_ptr<MultiIsolatePlatform> MultiIsolatePlatform::Create(
+@@ -682,7 +682,7 @@ std::unique_ptr<MultiIsolatePlatform> MultiIsolatePlatform::Create(
  
  MaybeLocal<Object> GetPerContextExports(Local<Context> context,
                                          IsolateData* isolate_data) {
@@ -18,7 +18,7 @@ index 451796ffc4ec93b6e317dd49d92070c61aca04e5..ea3e9374c30be92ba5668e33773ffbb2
    EscapableHandleScope handle_scope(isolate);
  
    Local<Object> global = context->Global();
-@@ -733,7 +733,7 @@ void ProtoThrower(const FunctionCallbackInfo<Value>& info) {
+@@ -728,7 +728,7 @@ void ProtoThrower(const FunctionCallbackInfo<Value>& info) {
  // This runs at runtime, regardless of whether the context
  // is created from a snapshot.
  Maybe<void> InitializeContextRuntime(Local<Context> context) {
@@ -27,7 +27,7 @@ index 451796ffc4ec93b6e317dd49d92070c61aca04e5..ea3e9374c30be92ba5668e33773ffbb2
    HandleScope handle_scope(isolate);
  
    // When `IsCodeGenerationFromStringsAllowed` is true, V8 takes the fast path
-@@ -812,7 +812,7 @@ Maybe<void> InitializeContextRuntime(Local<Context> context) {
+@@ -807,7 +807,7 @@ Maybe<void> InitializeContextRuntime(Local<Context> context) {
  }
  
  Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
@@ -36,7 +36,7 @@ index 451796ffc4ec93b6e317dd49d92070c61aca04e5..ea3e9374c30be92ba5668e33773ffbb2
    HandleScope handle_scope(isolate);
  
    // Delete `Intl.v8BreakIterator`
-@@ -837,7 +837,7 @@ Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
+@@ -832,7 +832,7 @@ Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
  }
  
  Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
@@ -45,7 +45,7 @@ index 451796ffc4ec93b6e317dd49d92070c61aca04e5..ea3e9374c30be92ba5668e33773ffbb2
    HandleScope handle_scope(isolate);
  
    // Initialize the default values.
-@@ -855,7 +855,7 @@ Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
+@@ -850,7 +850,7 @@ Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
  MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
                                              IsolateData* isolate_data) {
    CHECK(isolate_data);
@@ -54,7 +54,7 @@ index 451796ffc4ec93b6e317dd49d92070c61aca04e5..ea3e9374c30be92ba5668e33773ffbb2
    EscapableHandleScope scope(isolate);
    Context::Scope context_scope(context);
  
-@@ -879,7 +879,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
+@@ -874,7 +874,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
  MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
                                                 IsolateData* isolate_data) {
    CHECK(isolate_data);
@@ -63,7 +63,7 @@ index 451796ffc4ec93b6e317dd49d92070c61aca04e5..ea3e9374c30be92ba5668e33773ffbb2
    EscapableHandleScope scope(isolate);
    Context::Scope context_scope(context);
  
-@@ -905,7 +905,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
+@@ -900,7 +900,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
  Maybe<void> InitializePrimordials(Local<Context> context,
                                    IsolateData* isolate_data) {
    // Run per-context JS files.
@@ -85,7 +85,7 @@ index cc60ddddb037e0279615bbe24821eb20fd8da677..37d83e41b618a07aca98118260abe961
  
    return handle;
 diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index 20d3c1d9d17fde18fc09b6ee219137831eb08a45..8fbf4f25a91b953f3d2868889c7ee06932ee3c5f 100644
+index f3631d538a38dc3a93a47707ea8dab0462fa2140..12ad6e6ddbda2cc679e733f7a9c6b9e4cf9623dd 100644
 --- a/src/crypto/crypto_context.cc
 +++ b/src/crypto/crypto_context.cc
 @@ -1022,7 +1022,7 @@ bool ArrayOfStringsToX509s(Local<Context> context,
@@ -133,10 +133,10 @@ index 266f640fb1c6503a424e77cc41fc15bc658bb6a5..877ae8a18f6b8f2c7e3474dfba060d99
    // Recreate the buffer in the constructor.
    InternalFieldInfo* casted_info = static_cast<InternalFieldInfo*>(info);
 diff --git a/src/env.cc b/src/env.cc
-index a78817467518245c4a190e870e0eb30658eafcdb..13dcf0e9c2c86486d1e43763033f43ac4e6b6feb 100644
+index b5cf58cc953590493beb52abf249e33e486ffc46..347ec5c42e098186ff489dff199ac5989961f6e3 100644
 --- a/src/env.cc
 +++ b/src/env.cc
-@@ -1753,10 +1753,10 @@ void AsyncHooks::Deserialize(Local<Context> context) {
+@@ -1765,10 +1765,10 @@ void AsyncHooks::Deserialize(Local<Context> context) {
          context->GetDataFromSnapshotOnce<Array>(
              info_->js_execution_async_resources).ToLocalChecked();
    } else {
@@ -149,7 +149,7 @@ index a78817467518245c4a190e870e0eb30658eafcdb..13dcf0e9c2c86486d1e43763033f43ac
  
    // The native_execution_async_resources_ field requires v8::Local<> instances
    // for async calls whose resources were on the stack as JS objects when they
-@@ -1796,7 +1796,7 @@ AsyncHooks::SerializeInfo AsyncHooks::Serialize(Local<Context> context,
+@@ -1808,7 +1808,7 @@ AsyncHooks::SerializeInfo AsyncHooks::Serialize(Local<Context> context,
    info.async_id_fields = async_id_fields_.Serialize(context, creator);
    if (!js_execution_async_resources_.IsEmpty()) {
      info.js_execution_async_resources = creator->AddData(
@@ -295,7 +295,7 @@ index 27aeac589b19cd681923fb848ce5f36c66fc05e2..5f2900869763f40cac54e3cb3fe2e24e
          module_api_version(module_api_version) {
      napi_clear_last_error(this);
 diff --git a/src/module_wrap.cc b/src/module_wrap.cc
-index fa2f28989be19e8ea8f53b990ae96be92ef3c3a3..c26d1301d7b81a6c281d5465bfb29a5786b09dc2 100644
+index 52483740bb377a2bc2a16af701615d9a4e448eae..84d17a46efe146c1794a43963c41a4461eacfca2 100644
 --- a/src/module_wrap.cc
 +++ b/src/module_wrap.cc
 @@ -99,7 +99,7 @@ ModuleCacheKey ModuleCacheKey::From(Local<Context> context,
@@ -307,7 +307,7 @@ index fa2f28989be19e8ea8f53b990ae96be92ef3c3a3..c26d1301d7b81a6c281d5465bfb29a57
    std::size_t h1 = specifier->GetIdentityHash();
    size_t num_attributes = import_attributes->Length() / elements_per_attribute;
    ImportAttributeVector attributes;
-@@ -1023,7 +1023,7 @@ MaybeLocal<Module> ModuleWrap::ResolveModuleCallback(
+@@ -1022,7 +1022,7 @@ MaybeLocal<Module> ModuleWrap::ResolveModuleCallback(
      return {};
    }
    DCHECK_NOT_NULL(resolved_module);
@@ -316,16 +316,16 @@ index fa2f28989be19e8ea8f53b990ae96be92ef3c3a3..c26d1301d7b81a6c281d5465bfb29a57
  }
  
  // static
-@@ -1047,7 +1047,7 @@ MaybeLocal<Object> ModuleWrap::ResolveSourceCallback(
-     Local<String> url = resolved_module->object()
-                             ->GetInternalField(ModuleWrap::kURLSlot)
-                             .As<String>();
--    THROW_ERR_SOURCE_PHASE_NOT_DEFINED(context->GetIsolate(), url);
-+    THROW_ERR_SOURCE_PHASE_NOT_DEFINED(Isolate::GetCurrent(), url);
+@@ -1043,7 +1043,7 @@ MaybeLocal<Object> ModuleWrap::ResolveSourceCallback(
+           ->GetInternalField(ModuleWrap::kModuleSourceObjectSlot)
+           .As<Value>();
+   if (module_source_object->IsUndefined()) {
+-    THROW_ERR_SOURCE_PHASE_NOT_DEFINED(context->GetIsolate(),
++    THROW_ERR_SOURCE_PHASE_NOT_DEFINED(Isolate::GetCurrent(),
+                                        resolved_module->url_);
      return {};
    }
-   CHECK(module_source_object->IsObject());
-@@ -1060,7 +1060,7 @@ Maybe<ModuleWrap*> ModuleWrap::ResolveModule(
+@@ -1057,7 +1057,7 @@ Maybe<ModuleWrap*> ModuleWrap::ResolveModule(
      Local<String> specifier,
      Local<FixedArray> import_attributes,
      Local<Module> referrer) {
@@ -334,7 +334,7 @@ index fa2f28989be19e8ea8f53b990ae96be92ef3c3a3..c26d1301d7b81a6c281d5465bfb29a57
    Environment* env = Environment::GetCurrent(context);
    if (env == nullptr) {
      THROW_ERR_EXECUTION_ENVIRONMENT_NOT_AVAILABLE(isolate);
-@@ -1105,7 +1105,7 @@ MaybeLocal<Promise> ImportModuleDynamicallyWithPhase(
+@@ -1106,7 +1106,7 @@ MaybeLocal<Promise> ImportModuleDynamicallyWithPhase(
      Local<String> specifier,
      ModuleImportPhase phase,
      Local<FixedArray> import_attributes) {
@@ -343,7 +343,7 @@ index fa2f28989be19e8ea8f53b990ae96be92ef3c3a3..c26d1301d7b81a6c281d5465bfb29a57
    Environment* env = Environment::GetCurrent(context);
    if (env == nullptr) {
      THROW_ERR_EXECUTION_ENVIRONMENT_NOT_AVAILABLE(isolate);
-@@ -1347,7 +1347,7 @@ MaybeLocal<Module> LinkRequireFacadeWithOriginal(
+@@ -1348,7 +1348,7 @@ MaybeLocal<Module> LinkRequireFacadeWithOriginal(
      Local<FixedArray> import_attributes,
      Local<Module> referrer) {
    Environment* env = Environment::GetCurrent(context);
@@ -353,10 +353,10 @@ index fa2f28989be19e8ea8f53b990ae96be92ef3c3a3..c26d1301d7b81a6c281d5465bfb29a57
    CHECK(!env->temporary_required_module_facade_original.IsEmpty());
    return env->temporary_required_module_facade_original.Get(isolate);
 diff --git a/src/node.h b/src/node.h
-index 486d941cf0c5c4588604f3808807717aaed2f018..754e8ce35e006946c276b63c184cde6e1bbf881a 100644
+index 5a6004ca4dfd15a813f3fcc7687958432e4fd5a0..ee4eb270eeb5a76415e74ac6322e0cb347fe60ce 100644
 --- a/src/node.h
 +++ b/src/node.h
-@@ -1065,7 +1065,7 @@ NODE_DEPRECATED("Use v8::Date::ValueOf() directly",
+@@ -1064,7 +1064,7 @@ NODE_DEPRECATED("Use v8::Date::ValueOf() directly",
  
  #define NODE_DEFINE_CONSTANT(target, constant)                                 \
    do {                                                                         \
@@ -365,7 +365,7 @@ index 486d941cf0c5c4588604f3808807717aaed2f018..754e8ce35e006946c276b63c184cde6e
      v8::Local<v8::Context> context = isolate->GetCurrentContext();             \
      v8::Local<v8::String> constant_name = v8::String::NewFromUtf8Literal(      \
          isolate, #constant, v8::NewStringType::kInternalized);                 \
-@@ -1081,7 +1081,7 @@ NODE_DEPRECATED("Use v8::Date::ValueOf() directly",
+@@ -1080,7 +1080,7 @@ NODE_DEPRECATED("Use v8::Date::ValueOf() directly",
  
  #define NODE_DEFINE_HIDDEN_CONSTANT(target, constant)                          \
    do {                                                                         \
@@ -502,10 +502,10 @@ index 6aad252eb5681bb9ab9890812602b43c418e7a7f..5f7ef8cc58f589ba30a44abaaaaaf151
    Local<Array> keys;
    if (!entries->GetOwnPropertyNames(context).ToLocal(&keys))
 diff --git a/src/node_errors.cc b/src/node_errors.cc
-index 15d78e3eca9693dc518ccb28fc7c02fa1372f34b..9286d20c19a1e06001ca4b60981291d320858064 100644
+index 55a0c986c5b6989ee9ce277bb6a9778abb2ad2ee..809d88f21e5572807e38132d40ee75870ab8de07 100644
 --- a/src/node_errors.cc
 +++ b/src/node_errors.cc
-@@ -633,7 +633,7 @@ v8::ModifyCodeGenerationFromStringsResult ModifyCodeGenerationFromStrings(
+@@ -631,7 +631,7 @@ v8::ModifyCodeGenerationFromStringsResult ModifyCodeGenerationFromStrings(
      v8::Local<v8::Context> context,
      v8::Local<v8::Value> source,
      bool is_code_like) {
@@ -514,7 +514,7 @@ index 15d78e3eca9693dc518ccb28fc7c02fa1372f34b..9286d20c19a1e06001ca4b60981291d3
  
    if (context->GetNumberOfEmbedderDataFields() <=
        ContextEmbedderIndex::kAllowCodeGenerationFromStrings) {
-@@ -1000,7 +1000,7 @@ const char* errno_string(int errorno) {
+@@ -1037,7 +1037,7 @@ const char* errno_string(int errorno) {
  }
  
  void PerIsolateMessageListener(Local<Message> message, Local<Value> error) {
@@ -523,7 +523,7 @@ index 15d78e3eca9693dc518ccb28fc7c02fa1372f34b..9286d20c19a1e06001ca4b60981291d3
    switch (message->ErrorLevel()) {
      case Isolate::MessageErrorLevel::kMessageWarning: {
        Environment* env = Environment::GetCurrent(isolate);
-@@ -1160,7 +1160,7 @@ void Initialize(Local<Object> target,
+@@ -1197,7 +1197,7 @@ void Initialize(Local<Object> target,
    SetMethod(
        context, target, "getErrorSourcePositions", GetErrorSourcePositions);
  
@@ -533,10 +533,10 @@ index 15d78e3eca9693dc518ccb28fc7c02fa1372f34b..9286d20c19a1e06001ca4b60981291d3
    READONLY_PROPERTY(target, "exitCodes", exit_codes);
  
 diff --git a/src/node_file.cc b/src/node_file.cc
-index d73dac2ee3f1cf1cac6845fae0f702c9fba8fcef..969e7d08086f8442bed476feaf15599b8c79db7c 100644
+index 7dfb7a486040e0188eb53ee7a65f91a99e713a3a..c364f2a4f6dd6ec066b00f364108383154be12ec 100644
 --- a/src/node_file.cc
 +++ b/src/node_file.cc
-@@ -3874,7 +3874,7 @@ void BindingData::Deserialize(Local<Context> context,
+@@ -3834,7 +3834,7 @@ void BindingData::Deserialize(Local<Context> context,
                                int index,
                                InternalFieldInfoBase* info) {
    DCHECK_IS_SNAPSHOT_SLOT(index);
@@ -586,7 +586,7 @@ index 57e068ae249d618c2658638f9f3b03e1fedb6524..8c51ae4e0a435971c6d0288af8781087
    data_.Reset();
    return ret;
 diff --git a/src/node_modules.cc b/src/node_modules.cc
-index 6b1a9e257b0ce52820838f88c44ec546068fe419..5355f2f96e9c9f6548ae43fd38b0d89a825e6b60 100644
+index d3907c3d063c7757cdd7ef99ed09bea1eb58a3fd..df9925404e77ec61900f89a5241c86a599e548c5 100644
 --- a/src/node_modules.cc
 +++ b/src/node_modules.cc
 @@ -70,7 +70,7 @@ void BindingData::Deserialize(v8::Local<v8::Context> context,
@@ -634,7 +634,7 @@ index 2a5fe9fe501d1fd9356eeb7d044a872fa5a55f38..39f6f142044c42904d234da20a266315
    env->AssignToContext(context, this, ContextInfo(""));
    // The environment can also purge empty wrappers in the check callback,
 diff --git a/src/node_report.cc b/src/node_report.cc
-index 139e2ae3f2de1f1e28876bdc5332f68ea392484e..d479ada5bf0776fac52cd43c952a7f418ebc0679 100644
+index ba2dd7e676bfdfe7da66a4a79db3c791a505c9a8..28e6cfac682e301b605c00c4ef2eaf01431f04e4 100644
 --- a/src/node_report.cc
 +++ b/src/node_report.cc
 @@ -400,7 +400,7 @@ static void PrintJavaScriptErrorProperties(JSONWriter* writer,
@@ -660,10 +660,10 @@ index c2e24b4645e7903e08c80aead1c18c7bcff1bd89..e34d24d51d5c090b560d06f727043f20
    // Recreate the buffer in the constructor.
    InternalFieldInfo* casted_info = static_cast<InternalFieldInfo*>(info);
 diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
-index 8b0bd18e6d9434aba4dd1a02beb0d8a2347c851c..1cab6dde9df945eb82ae59908711cfb75bd8993f 100644
+index 955b76cbc71d0cd3a1cc01c3c0dea0536a792dc0..0b111ce1fb1d59cad019ba13bbfc513f157d3f06 100644
 --- a/src/node_sqlite.cc
 +++ b/src/node_sqlite.cc
-@@ -2018,7 +2018,7 @@ bool StatementSync::BindParams(const FunctionCallbackInfo<Value>& args) {
+@@ -2061,7 +2061,7 @@ bool StatementSync::BindParams(const FunctionCallbackInfo<Value>& args) {
  
    if (args[0]->IsObject() && !args[0]->IsArrayBufferView()) {
      Local<Object> obj = args[0].As<Object>();
@@ -699,10 +699,10 @@ index 9d1e8ec05161570db11f7b662395509774668d78..9b91f83d879ea02fd3d61913c8dfd35b
    BindingData* binding = realm->AddBindingData<BindingData>(holder);
    CHECK_NOT_NULL(binding);
 diff --git a/src/node_v8.cc b/src/node_v8.cc
-index 5cf30e8094b0014e12fa26d95d19a2d0e6f0ff56..13a4cbb11ad59e761f686c67f7a550d002b8e45c 100644
+index 8dd32dad262679444c10878299eb6bb8fb04e120..935ea2cf5157c3a2fbdf142fc7024ec6b6d5de26 100644
 --- a/src/node_v8.cc
 +++ b/src/node_v8.cc
-@@ -158,7 +158,7 @@ void BindingData::Deserialize(Local<Context> context,
+@@ -163,7 +163,7 @@ void BindingData::Deserialize(Local<Context> context,
                                int index,
                                InternalFieldInfoBase* info) {
    DCHECK_IS_SNAPSHOT_SLOT(index);
@@ -784,7 +784,7 @@ index da4206187f7c7d2becb8a101c1ff5346a10e13f4..03f0910926f3d403121e227cee32a546
    // Recreate the buffer in the constructor.
    BindingData* binding = realm->AddBindingData<BindingData>(holder);
 diff --git a/src/util-inl.h b/src/util-inl.h
-index 5699d76fdfee4b260aa23929f1fb678389ad99e7..d07bceb425f00882db116975a92f4835d7c2cf3b 100644
+index aae5956742f195279ab6af04029d76dee6af2e84..6898e8ea794675e903e13e2b45524d572a3f68bb 100644
 --- a/src/util-inl.h
 +++ b/src/util-inl.h
 @@ -336,14 +336,14 @@ v8::Maybe<void> FromV8Array(v8::Local<v8::Context> context,
@@ -876,7 +876,7 @@ index 5699d76fdfee4b260aa23929f1fb678389ad99e7..d07bceb425f00882db116975a92f4835
    v8::EscapableHandleScope handle_scope(isolate);
  
    v8::LocalVector<v8::Value> elements(isolate);
-@@ -751,7 +751,7 @@ inline v8::MaybeLocal<v8::Object> NewDictionaryInstanceNullProto(
+@@ -803,7 +803,7 @@ inline v8::MaybeLocal<v8::Object> NewDictionaryInstanceNullProto(
      if (value.IsEmpty()) return v8::MaybeLocal<v8::Object>();
    }
    v8::Local<v8::Object> obj = tmpl->NewInstance(context, property_values);
@@ -935,10 +935,10 @@ index 660cfff6b8a0c583be843e555e7a06cd09e0d279..c4b39450c5b7f91c46f7027db367c30d
        context, that, OneByteString(isolate, name), tmpl, flag);
  }
 diff --git a/src/util.h b/src/util.h
-index 63479eb3f12685702a06c27db52183a585de0da9..1db426df35e4976427b578a2974041ec9e92cf4c 100644
+index 81d08c27fb7037d16e12843dc03c3d8f9caee723..52e6a149d6760640d93c56ce91a759ae9207a8c7 100644
 --- a/src/util.h
 +++ b/src/util.h
-@@ -751,7 +751,7 @@ inline v8::MaybeLocal<v8::Value> ToV8Value(
+@@ -753,7 +753,7 @@ inline v8::MaybeLocal<v8::Value> ToV8Value(
  // Variation on NODE_DEFINE_CONSTANT that sets a String value.
  #define NODE_DEFINE_STRING_CONSTANT(target, name, constant)                    \
    do {                                                                         \

patches/node/build_enable_perfetto.patch

@@ -33,7 +33,7 @@ index 8d7204f6cb48f783adc4d1c1eb2de0c83b7fffe2..a154559a56bf383d3c26af523c9bb07b
  
    // Non-alphabetic chars.
 diff --git a/lib/internal/http.js b/lib/internal/http.js
-index 9bf929f7f3360f13058d3f446c18a36cd15bea58..abf9a06d891488288bccd98c437746c1ce48bf83 100644
+index e664663348adc7bb31f7c9ec78481bbeb71401d9..62b659beb766b8256b214447af376f438278b058 100644
 --- a/lib/internal/http.js
 +++ b/lib/internal/http.js
 @@ -11,8 +11,8 @@ const {
@@ -64,7 +64,7 @@ index 9bf929f7f3360f13058d3f446c18a36cd15bea58..abf9a06d891488288bccd98c437746c1
  
  function ipToInt(ip) {
 diff --git a/node.gyp b/node.gyp
-index a598de39f13e7069e75484463fb096b771fa45fb..975f3897dd1ce1074626925b9fbf22f15632a0b1 100644
+index c3917f805464669c709bef83b9982ef95d0fbaa1..56e11cde31897260bf41db3f32f5c6d6fbd6d5bf 100644
 --- a/node.gyp
 +++ b/node.gyp
 @@ -176,7 +176,6 @@

patches/node/build_ensure_native_module_compilation_fails_if_not_using_a_new.patch

@@ -7,7 +7,7 @@ Subject: build: ensure native module compilation fails if not using a new
 This should not be upstreamed, it is a quality-of-life patch for downstream module builders.
 
 diff --git a/common.gypi b/common.gypi
-index 088e7ebbfe07d273691c86c7ab2dce00fcb475c8..a3f7415dba63828bec94ac8503420f14e3fea14c 100644
+index 8280cff0d93d42a95875b78de84221aa1bcae092..76a03b9a5458f4afc0ab5768c8a2e90633749fe9 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -89,6 +89,8 @@
@@ -54,7 +54,7 @@ index e063f9131d4d547d231811dafea03c8c52b611e6..a5c764d9e7fb0ffa219202015ec67ed6
    o['variables']['v8_enable_javascript_promise_hooks'] = 1
    o['variables']['v8_enable_lite_mode'] = 1 if options.v8_lite_mode else 0
 diff --git a/src/node.h b/src/node.h
-index 27f5bb1571920c963e05644a5fc5858aa4b88288..9c624e4ef26c1b06a6c4bca7def245935189ce07 100644
+index be22ad370217a13aef2479d478a6373feaf6f208..19c34a430d095c06ccf5a988db91311d420a485a 100644
 --- a/src/node.h
 +++ b/src/node.h
 @@ -22,6 +22,12 @@

patches/node/build_restore_clang_as_default_compiler_on_macos.patch

@@ -11,7 +11,7 @@ node-gyp will use the result of `process.config` that reflects the environment
 in which the binary got built.
 
 diff --git a/common.gypi b/common.gypi
-index a3f7415dba63828bec94ac8503420f14e3fea14c..c08f65b0448806c613b27eb91f9dd512adab938c 100644
+index 76a03b9a5458f4afc0ab5768c8a2e90633749fe9..bdadbdaa607b2f668749fc484271de8d126bbd17 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -128,6 +128,7 @@

patches/node/chore_allow_the_node_entrypoint_to_be_a_builtin_module.patch

@@ -8,7 +8,7 @@ they use themselves as the entry point. We should try to upstream some form
 of this.
 
 diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
-index 6585c52e4bd997b20d5a297c536844dea1b8fdc8..fd0a81f5216d8bcf662c7e8bb972ed789eda8645 100644
+index 8ed8802adcda308166d700e463c8d6cbcb26d94a..9a99ff6d44320c0e28f4a787d24ea98ae1c96196 100644
 --- a/lib/internal/process/pre_execution.js
 +++ b/lib/internal/process/pre_execution.js
 @@ -276,12 +276,14 @@ function patchProcessObject(expandArgv1) {

patches/node/chore_disable_deprecation_ftbfs_in_simdjson_header.patch

@@ -14,10 +14,10 @@ and
 This patch can be removed once this is fixed upstream in simdjson.
 
 diff --git a/deps/simdjson/simdjson.h b/deps/simdjson/simdjson.h
-index a8bd86b28acc16cb04c193a1afbeb8171b314107..e200835e3ae6042f5af62f7ea3e082c677a9d0cf 100644
+index 35ff2626f26735495e308381782e5f1d9b8a629e..b4aa4bce33d62c579beee745712d24d9ebd5e0c2 100644
 --- a/deps/simdjson/simdjson.h
 +++ b/deps/simdjson/simdjson.h
-@@ -4160,12 +4160,17 @@ inline std::ostream& operator<<(std::ostream& out, simdjson_result<padded_string
+@@ -4179,12 +4179,17 @@ inline std::ostream& operator<<(std::ostream& out, simdjson_result<padded_string
  
  } // namespace simdjson
  
@@ -35,7 +35,7 @@ index a8bd86b28acc16cb04c193a1afbeb8171b314107..e200835e3ae6042f5af62f7ea3e082c6
  namespace simdjson {
  namespace internal {
  
-@@ -4617,6 +4622,9 @@ inline simdjson_result<padded_string> padded_string::load(std::string_view filen
+@@ -4636,6 +4641,9 @@ inline simdjson_result<padded_string> padded_string::load(std::string_view filen
  
  } // namespace simdjson
  
@@ -45,7 +45,7 @@ index a8bd86b28acc16cb04c193a1afbeb8171b314107..e200835e3ae6042f5af62f7ea3e082c6
  inline simdjson::padded_string operator ""_padded(const char *str, size_t len) {
    return simdjson::padded_string(str, len);
  }
-@@ -4625,6 +4633,8 @@ inline simdjson::padded_string operator ""_padded(const char8_t *str, size_t len
+@@ -4644,6 +4652,8 @@ inline simdjson::padded_string operator ""_padded(const char8_t *str, size_t len
    return simdjson::padded_string(reinterpret_cast<const char8_t *>(str), len);
  }
  #endif
@@ -54,7 +54,7 @@ index a8bd86b28acc16cb04c193a1afbeb8171b314107..e200835e3ae6042f5af62f7ea3e082c6
  #endif // SIMDJSON_PADDED_STRING_INL_H
  /* end file simdjson/padded_string-inl.h */
  /* skipped duplicate #include "simdjson/padded_string_view.h" */
-@@ -43655,12 +43665,16 @@ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::
+@@ -43674,12 +43684,16 @@ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::
    return parser_instance;
  }
  
@@ -71,7 +71,7 @@ index a8bd86b28acc16cb04c193a1afbeb8171b314107..e200835e3ae6042f5af62f7ea3e082c6
  
  } // namespace ondemand
  } // namespace arm64
-@@ -56961,12 +56975,16 @@ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::
+@@ -57923,12 +57937,16 @@ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::
    return parser_instance;
  }
  

patches/node/chore_expose_importmoduledynamically_and.patch

@@ -11,10 +11,10 @@ its own blended handler between Node and Blink.
 Not upstreamable.
 
 diff --git a/lib/internal/modules/esm/utils.js b/lib/internal/modules/esm/utils.js
-index a9076a7ae941284d4585829292e2ece25c2b90e4..7335fe20f34fdd822276575686379dd954f1c8e1 100644
+index 0af25ebbf6c3f2b790238e32f01addfb648e4e52..bd726088f7480853b8507c39668cc4716c4ce61f 100644
 --- a/lib/internal/modules/esm/utils.js
 +++ b/lib/internal/modules/esm/utils.js
-@@ -34,7 +34,7 @@ const {
+@@ -35,7 +35,7 @@ const {
    ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING,
    ERR_INVALID_ARG_VALUE,
  } = require('internal/errors').codes;
@@ -23,7 +23,7 @@ index a9076a7ae941284d4585829292e2ece25c2b90e4..7335fe20f34fdd822276575686379dd9
  const {
    emitExperimentalWarning,
    kEmptyObject,
-@@ -285,12 +285,13 @@ let _shouldSpawnLoaderHookWorker = true;
+@@ -286,12 +286,13 @@ let _shouldSpawnLoaderHookWorker = true;
   *   should be spawned later.
   */
  function initializeESM(shouldSpawnLoaderHookWorker = true) {
@@ -40,10 +40,10 @@ index a9076a7ae941284d4585829292e2ece25c2b90e4..7335fe20f34fdd822276575686379dd9
  
  /**
 diff --git a/src/module_wrap.cc b/src/module_wrap.cc
-index 26e6bcfa30be8b22b20e66ffe2f8d0b7d60fc6cc..fa2f28989be19e8ea8f53b990ae96be92ef3c3a3 100644
+index 5703590b5ee2a91a504cf8491716773fc4a302bd..52483740bb377a2bc2a16af701615d9a4e448eae 100644
 --- a/src/module_wrap.cc
 +++ b/src/module_wrap.cc
-@@ -1098,7 +1098,7 @@ Maybe<ModuleWrap*> ModuleWrap::ResolveModule(
+@@ -1099,7 +1099,7 @@ Maybe<ModuleWrap*> ModuleWrap::ResolveModule(
    return Just(module_wrap);
  }
  
@@ -52,7 +52,7 @@ index 26e6bcfa30be8b22b20e66ffe2f8d0b7d60fc6cc..fa2f28989be19e8ea8f53b990ae96be9
      Local<Context> context,
      Local<Data> host_defined_options,
      Local<Value> resource_name,
-@@ -1186,14 +1186,16 @@ void ModuleWrap::SetImportModuleDynamicallyCallback(
+@@ -1187,14 +1187,16 @@ void ModuleWrap::SetImportModuleDynamicallyCallback(
    Realm* realm = Realm::GetCurrent(args);
    HandleScope handle_scope(isolate);
  
@@ -72,7 +72,7 @@ index 26e6bcfa30be8b22b20e66ffe2f8d0b7d60fc6cc..fa2f28989be19e8ea8f53b990ae96be9
  }
  
  void ModuleWrap::HostInitializeImportMetaObjectCallback(
-@@ -1235,13 +1237,14 @@ void ModuleWrap::SetInitializeImportMetaObjectCallback(
+@@ -1236,13 +1238,14 @@ void ModuleWrap::SetInitializeImportMetaObjectCallback(
    Realm* realm = Realm::GetCurrent(args);
    Isolate* isolate = realm->isolate();
  
@@ -91,7 +91,7 @@ index 26e6bcfa30be8b22b20e66ffe2f8d0b7d60fc6cc..fa2f28989be19e8ea8f53b990ae96be9
  
  MaybeLocal<Value> ModuleWrap::SyntheticModuleEvaluationStepsCallback(
 diff --git a/src/module_wrap.h b/src/module_wrap.h
-index 03cf8d0e91d795aad6db9b11956d296ff4999f7e..45264c2ad58e37a73fd62addac7fb671eed6d502 100644
+index d81facabf8d80e967c5bff2bbd3a1ce9dd79cc76..93d47c7573da7e5824e9bc391dd1c2f5f2588822 100644
 --- a/src/module_wrap.h
 +++ b/src/module_wrap.h
 @@ -8,6 +8,7 @@
@@ -119,7 +119,7 @@ index 03cf8d0e91d795aad6db9b11956d296ff4999f7e..45264c2ad58e37a73fd62addac7fb671
    using ResolveCache =
        std::unordered_map<ModuleCacheKey, uint32_t, ModuleCacheKey::Hash>;
  
-@@ -157,6 +166,8 @@ class ModuleWrap : public BaseObject {
+@@ -156,6 +165,8 @@ class ModuleWrap : public BaseObject {
    static void CreateRequiredModuleFacade(
        const v8::FunctionCallbackInfo<v8::Value>& args);
  
@@ -128,7 +128,7 @@ index 03cf8d0e91d795aad6db9b11956d296ff4999f7e..45264c2ad58e37a73fd62addac7fb671
   private:
    ModuleWrap(Realm* realm,
               v8::Local<v8::Object> object,
-@@ -205,7 +216,6 @@ class ModuleWrap : public BaseObject {
+@@ -204,7 +215,6 @@ class ModuleWrap : public BaseObject {
        v8::Local<v8::String> specifier,
        v8::Local<v8::FixedArray> import_attributes,
        v8::Local<v8::Module> referrer);

patches/node/expose_get_builtin_module_function.patch

@@ -24,10 +24,10 @@ index 5bd07e5253ae64b02ae1874226ab70c1972cf9e0..768d81a63a42d9016a42b7cdce7b6be8
    Environment* env = Environment::GetCurrent(args);
  
 diff --git a/src/node_binding.h b/src/node_binding.h
-index 813204dc473960e63896b6d3609a882b52ac59fa..2fe91a28460973b543f5dde7a78fdedb05ac98b3 100644
+index a55a9c6a5787983c0477cb268ef1355162e72911..3455eb3d223a49cd73d80c72c209c26d49b769dc 100644
 --- a/src/node_binding.h
 +++ b/src/node_binding.h
-@@ -155,6 +155,8 @@ void GetInternalBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
+@@ -154,6 +154,8 @@ void GetInternalBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
  void GetLinkedBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
  void DLOpen(const v8::FunctionCallbackInfo<v8::Value>& args);
  

patches/node/fix_add_default_values_for_variables_in_common_gypi.patch

@@ -7,7 +7,7 @@ common.gypi is a file that's included in the node header bundle, despite
 the fact that we do not build node with gyp.
 
 diff --git a/common.gypi b/common.gypi
-index 60585d136f7ee103ac49ce0271e24561a2685a0a..088e7ebbfe07d273691c86c7ab2dce00fcb475c8 100644
+index db1625378697d9e6d7685d57acbdc212e8f25ec0..8280cff0d93d42a95875b78de84221aa1bcae092 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -91,6 +91,23 @@

patches/node/fix_allow_disabling_fetch_in_renderer_and_worker_processes.patch

@@ -9,10 +9,10 @@ conflict with Blink's in renderer and worker processes.
 We should try to upstream some version of this.
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index 38c66ec426205c07925e4d634e877a8cbb47b255..9b9a5455b9d597bb4009074c922d2c7c5aa975f1 100644
+index 667603438cc41701820d6aaa734d21ac35bcc8d1..6611face009797f9d540be4478df80d05888893a 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -1770,6 +1770,14 @@ changes:
+@@ -1798,6 +1798,14 @@ changes:
  
  Disable using [syntax detection][] to determine module type.
  
@@ -27,7 +27,7 @@ index 38c66ec426205c07925e4d634e877a8cbb47b255..9b9a5455b9d597bb4009074c922d2c7c
  ### `--no-experimental-global-navigator`
  
  <!-- YAML
-@@ -3439,6 +3447,7 @@ one is included in the list below.
+@@ -3476,6 +3484,7 @@ one is included in the list below.
  * `--no-addons`
  * `--no-async-context-frame`
  * `--no-deprecation`
@@ -36,10 +36,10 @@ index 38c66ec426205c07925e4d634e877a8cbb47b255..9b9a5455b9d597bb4009074c922d2c7c
  * `--no-experimental-repl-await`
  * `--no-experimental-sqlite`
 diff --git a/doc/node.1 b/doc/node.1
-index dad692863f2cc6b6d4fad86915cd1700d52e8279..6d451ef912d1162a242b7952f94d2071d8238673 100644
+index 9a0f5beb5b995fb92b31514c166e1c76e18d8ca9..fab0b24b630e755658b58a7281df1dacc4b7f32a 100644
 --- a/doc/node.1
 +++ b/doc/node.1
-@@ -198,6 +198,9 @@ Enable transformation of TypeScript-only syntax into JavaScript code.
+@@ -201,6 +201,9 @@ Enable transformation of TypeScript-only syntax into JavaScript code.
  .It Fl -experimental-eventsource
  Enable experimental support for the EventSource Web API.
  .
@@ -50,7 +50,7 @@ index dad692863f2cc6b6d4fad86915cd1700d52e8279..6d451ef912d1162a242b7952f94d2071
  Disable experimental support for the WebSocket API.
  .
 diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
-index fd0a81f5216d8bcf662c7e8bb972ed789eda8645..72944995cf3cc30d8bc33bfef8c6690c652cdcf9 100644
+index 9a99ff6d44320c0e28f4a787d24ea98ae1c96196..8f5810267d1ba430bae02be141f087f2a5d3cf9f 100644
 --- a/lib/internal/process/pre_execution.js
 +++ b/lib/internal/process/pre_execution.js
 @@ -117,6 +117,7 @@ function prepareExecution(options) {
@@ -79,7 +79,7 @@ index fd0a81f5216d8bcf662c7e8bb972ed789eda8645..72944995cf3cc30d8bc33bfef8c6690c
  function setupWebsocket() {
    if (getOptionValue('--no-experimental-websocket')) {
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 03c1dde6de237e44539dccea3295cf4339260b1e..c53c40b36ec311f433c8a0cbb1c06287576e1453 100644
+index 342bffb00fd355f7f1c5d0d83133bd5561be91e1..41f268195c281689339e98ceb98e8034ecd28b63 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -545,7 +545,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {

patches/node/fix_allow_passing_fileexists_fn_to_legacymainresolve.patch

@@ -53,10 +53,10 @@ index 72cc9444ca93ef7a1526e23314693aeaf5f173b0..79684dd7e8d1629b19be01ebf97e43e5
    const maybeMain = resolvedOption <= legacyMainResolveExtensionsIndexes.kResolvedByMainIndexNode ?
      packageConfig.main || './' : '';
 diff --git a/src/node_file.cc b/src/node_file.cc
-index 00f369e9691e184f9e5f226ce4216bd5b1d353ae..d73dac2ee3f1cf1cac6845fae0f702c9fba8fcef 100644
+index 88fdca1eb85a49468e787d50f1cee6b8561841d6..7dfb7a486040e0188eb53ee7a65f91a99e713a3a 100644
 --- a/src/node_file.cc
 +++ b/src/node_file.cc
-@@ -3623,13 +3623,25 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
+@@ -3583,13 +3583,25 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
  }
  
  BindingData::FilePathIsFileReturnType BindingData::FilePathIsFile(
@@ -83,7 +83,7 @@ index 00f369e9691e184f9e5f226ce4216bd5b1d353ae..d73dac2ee3f1cf1cac6845fae0f702c9
    uv_fs_t req;
  
    int rc = uv_fs_stat(env->event_loop(), &req, file_path.c_str(), nullptr);
-@@ -3687,6 +3699,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3647,6 +3659,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
    std::optional<std::string> initial_file_path;
    std::string file_path;
  
@@ -95,7 +95,7 @@ index 00f369e9691e184f9e5f226ce4216bd5b1d353ae..d73dac2ee3f1cf1cac6845fae0f702c9
    if (args.Length() >= 2 && args[1]->IsString()) {
      auto package_config_main = Utf8Value(isolate, args[1]).ToString();
  
-@@ -3707,7 +3724,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3667,7 +3684,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
        BufferValue buff_file_path(isolate, local_file_path);
        ToNamespacedPath(env, &buff_file_path);
  
@@ -104,7 +104,7 @@ index 00f369e9691e184f9e5f226ce4216bd5b1d353ae..d73dac2ee3f1cf1cac6845fae0f702c9
          case BindingData::FilePathIsFileReturnType::kIsFile:
            return args.GetReturnValue().Set(i);
          case BindingData::FilePathIsFileReturnType::kIsNotFile:
-@@ -3744,7 +3761,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3704,7 +3721,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
      BufferValue buff_file_path(isolate, local_file_path);
      ToNamespacedPath(env, &buff_file_path);
  

patches/node/fix_avoid_external_memory_leak_on_invalid_tls_protocol_versions.patch

@@ -39,10 +39,10 @@ index 66331d2d9999e93e59cbce9e153affb942b79946..0f7fd0747ea779f76a9e64ed37d195bd
    if (secureOptions) {
      validateInteger(secureOptions, 'secureOptions');
 diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index 8fbf4f25a91b953f3d2868889c7ee06932ee3c5f..96f6ea29525bc2c60297e7be5bc1d0b74cd568e1 100644
+index 12ad6e6ddbda2cc679e733f7a9c6b9e4cf9623dd..fc6d295a401d5283ba19dd5c95b748c83b7055a9 100644
 --- a/src/crypto/crypto_context.cc
 +++ b/src/crypto/crypto_context.cc
-@@ -1355,10 +1355,8 @@ SecureContext::SecureContext(Environment* env, Local<Object> wrap)
+@@ -1354,10 +1354,8 @@ SecureContext::SecureContext(Environment* env, Local<Object> wrap)
  }
  
  inline void SecureContext::Reset() {

patches/node/fix_crypto_tests_to_run_with_bssl.patch

@@ -22,98 +22,36 @@ index 423f2c4d77bfc98bfbdab93c09aff8012c678cbd..fa0bcceb5697486930a9530732f9a9ab
    const pkcs8 = Buffer.from(
      '308204bf020100300d06092a864886f70d0101010500048204a9308204a5020100028' +
      '2010100d3576092e62957364544e7e4233b7bdb293db2085122c479328546f9f0f712' +
-diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
-index 337ed577b143062d41e378cc1f820945e76cea08..76d5e805cbc0e756aef0013373baec31bd320f44 100644
---- a/test/fixtures/webcrypto/supports-modern-algorithms.mjs
-+++ b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
-@@ -9,6 +9,7 @@ const shake256 = crypto.getHashes().includes('shake256');
- const chacha = crypto.getCiphers().includes('chacha20-poly1305');
- const ocb = hasOpenSSL(3);
- const kmac = hasOpenSSL(3);
-+const boringSSL = process.features.openssl_is_boringssl;
- 
- const { subtle } = globalThis.crypto;
- const X25519 = await subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']);
-@@ -108,9 +109,9 @@ export const vectors = {
-     [true, 'RSA-PSS'],
-     [true, 'RSASSA-PKCS1-v1_5'],
-     [true, 'X25519'],
--    [true, 'X448'],
-+    [!boringSSL, 'X448'],
-     [true, 'Ed25519'],
--    [true, 'Ed448'],
-+    [!boringSSL, 'Ed448'],
-     [true, 'ECDH'],
-     [true, 'ECDSA'],
-     [pqc, 'ML-DSA-44'],
 diff --git a/test/parallel/test-crypto-async-sign-verify.js b/test/parallel/test-crypto-async-sign-verify.js
-index d385926e9943052bbe1793d4b1e39846e1a69562..dbf7b04afa77f132aaa466c9ee02c5ffad0296bc 100644
+index 9876c4bb6ecd2e5b8879f153811cd0a0a22997aa..2c4bf03452eb10fec52c38a361b6aad93169f08d 100644
 --- a/test/parallel/test-crypto-async-sign-verify.js
 +++ b/test/parallel/test-crypto-async-sign-verify.js
-@@ -89,6 +89,7 @@ test('rsa_public.pem', 'rsa_private.pem', 'sha256', false,
- // ED25519
- test('ed25519_public.pem', 'ed25519_private.pem', undefined, true);
- // ED448
-+if (!process.features.openssl_is_boringssl) {
- test('ed448_public.pem', 'ed448_private.pem', undefined, true);
+@@ -102,17 +102,17 @@ if (!process.features.openssl_is_boringssl) {
+   // ECDSA w/ ieee-p1363 signature encoding
+   test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384', false,
+        { dsaEncoding: 'ieee-p1363' });
+-}
  
- // ECDSA w/ der signature encoding
-@@ -110,6 +111,7 @@ test('dsa_public.pem', 'dsa_private.pem', 'sha256',
- // DSA w/ ieee-p1363 signature encoding
- test('dsa_public.pem', 'dsa_private.pem', 'sha256', false,
-      { dsaEncoding: 'ieee-p1363' });
+-// DSA w/ der signature encoding
+-test('dsa_public.pem', 'dsa_private.pem', 'sha256',
+-     false);
+-test('dsa_public.pem', 'dsa_private.pem', 'sha256',
+-     false, { dsaEncoding: 'der' });
++  // DSA w/ der signature encoding
++  test('dsa_public.pem', 'dsa_private.pem', 'sha256',
++      false);
++  test('dsa_public.pem', 'dsa_private.pem', 'sha256',
++      false, { dsaEncoding: 'der' });
+ 
+-// DSA w/ ieee-p1363 signature encoding
+-test('dsa_public.pem', 'dsa_private.pem', 'sha256', false,
+-     { dsaEncoding: 'ieee-p1363' });
++  // DSA w/ ieee-p1363 signature encoding
++  test('dsa_public.pem', 'dsa_private.pem', 'sha256', false,
++      { dsaEncoding: 'ieee-p1363' });
 +}
  
  // Test Parallel Execution w/ KeyObject is threadsafe in openssl3
- {
-@@ -150,7 +152,10 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
-   const data = crypto.randomBytes(32);
-   const signature = crypto.randomBytes(16);
- 
--  const expected = hasOpenSSL3 ? /operation not supported for this keytype/ : /no default digest/;
-+  let expected = hasOpenSSL3 ? /operation not supported for this keytype/ : /no default digest/;
-+  if (hasOpenSSL3 || process.features.openssl_is_boringssl) {
-+    expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
-+  }
- 
-   crypto.verify(undefined, data, untrustedKey, signature, common.mustCall((err) => {
-     assert.ok(err);
-@@ -164,6 +169,6 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
-   });
-   crypto.sign('sha512', 'message', privateKey, common.mustCall((err) => {
-     assert.ok(err);
--    assert.match(err.message, /digest too big for rsa key/);
-+    assert.match(err.message, /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i);
-   }));
- }
-diff --git a/test/parallel/test-crypto-certificate.js b/test/parallel/test-crypto-certificate.js
-index 4a5f1f149fe6c739f7f1d2ee17df6e61a942d621..b3287f428ce6b3fde11d449c601a57ff5e3843f9 100644
---- a/test/parallel/test-crypto-certificate.js
-+++ b/test/parallel/test-crypto-certificate.js
-@@ -40,8 +40,10 @@ function copyArrayBuffer(buf) {
- }
- 
- function checkMethods(certificate) {
--
-+  /* spkacValid has a md5 based signature which is not allowed in boringssl
-+  https://boringssl.googlesource.com/boringssl/+/33d7e32ce40c04e8f1b99c05964956fda187819f
-   assert.strictEqual(certificate.verifySpkac(spkacValid), true);
-+  */
-   assert.strictEqual(certificate.verifySpkac(spkacFail), false);
- 
-   assert.strictEqual(
-@@ -56,10 +58,12 @@ function checkMethods(certificate) {
-   );
-   assert.strictEqual(certificate.exportChallenge(spkacFail), '');
- 
-+  /* spkacValid has a md5 based signature which is not allowed in boringssl
-   const ab = copyArrayBuffer(spkacValid);
-   assert.strictEqual(certificate.verifySpkac(ab), true);
-   assert.strictEqual(certificate.verifySpkac(new Uint8Array(ab)), true);
-   assert.strictEqual(certificate.verifySpkac(new DataView(ab)), true);
-+  */
- }
- 
  {
 diff --git a/test/parallel/test-crypto-cipheriv-decipheriv.js b/test/parallel/test-crypto-cipheriv-decipheriv.js
 index 6742722f9e90914b4dc8c079426d10040d476f72..8801ddfe7023fd0f7d5657b86a9164d75765322e 100644
@@ -144,7 +82,7 @@ index 81a469c226c261564dee1e0b06b6571b18a41f1f..58b66045dba4201b7ebedd78b129420f
  
  const availableCurves = new Set(crypto.getCurves());
 diff --git a/test/parallel/test-crypto-dh-errors.js b/test/parallel/test-crypto-dh-errors.js
-index 0af4db0310750cea9350ecff7fc44404c6df6c83..b14b4bbf88b902b6de916b92e3d48335c01df911 100644
+index d7527d82617efccd931f0fc2f700ab876872c1e6..b14b4bbf88b902b6de916b92e3d48335c01df911 100644
 --- a/test/parallel/test-crypto-dh-errors.js
 +++ b/test/parallel/test-crypto-dh-errors.js
 @@ -27,7 +27,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), {
@@ -156,47 +94,11 @@ index 0af4db0310750cea9350ecff7fc44404c6df6c83..b14b4bbf88b902b6de916b92e3d48335
        name: 'Error',
        message: /modulus too small/,
      });
-@@ -35,7 +35,7 @@ for (const bits of [-1, 0, 1]) {
-     assert.throws(() => crypto.createDiffieHellman(bits), {
-       code: 'ERR_OSSL_BN_BITS_TOO_SMALL',
-       name: 'Error',
--      message: /bits too small/,
-+      message: /bits[\s_]too[\s_]small/i,
-     });
-   }
- }
 diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
-index d7ffbe5eca92734aa2380f482c7f9bfe7e2a36c7..b4e7002d862907d2af3b4f8e985700bd03300809 100644
+index 3c00a5fc73bb9f86f944df74f29d6b5225bc2f0e..b4e7002d862907d2af3b4f8e985700bd03300809 100644
 --- a/test/parallel/test-crypto-dh.js
 +++ b/test/parallel/test-crypto-dh.js
-@@ -60,18 +60,17 @@ const {
-   let wrongBlockLength;
-   if (hasOpenSSL3) {
-     wrongBlockLength = {
--      message: 'error:1C80006B:Provider routines::wrong final block length',
--      code: 'ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH',
--      library: 'Provider routines',
--      reason: 'wrong final block length'
-+      message: /wrong[\s_]final[\s_]block[\s_]length/i,
-+      code: /ERR_OSSL_(EVP_)?WRONG_FINAL_BLOCK_LENGTH/,
-+      library: /Provider routines|Cipher functions/,
-+      reason: /wrong[\s_]final[\s_]block[\s_]length/i,
-     };
-   } else {
-     wrongBlockLength = {
--      message: 'error:0606506D:digital envelope' +
--        ' routines:EVP_DecryptFinal_ex:wrong final block length',
--      code: 'ERR_OSSL_EVP_WRONG_FINAL_BLOCK_LENGTH',
--      library: 'digital envelope routines',
--      reason: 'wrong final block length'
-+      message: /wrong[\s_]final[\s_]block[\s_]length/i,
-+      code: /ERR_OSSL_(EVP_)?WRONG_FINAL_BLOCK_LENGTH/,
-+      library: /digital envelope routines|Cipher functions/,
-+      reason: /wrong[\s_]final[\s_]block[\s_]length/i,
-     };
-   }
- 
-@@ -98,17 +97,23 @@ const {
+@@ -97,17 +97,23 @@ const {
        dh3.computeSecret('');
      }, { message: hasOpenSSL3 && !hasOpenSSL3WithNewErrorMessage ?
        'Unspecified validation error' :
@@ -244,19 +146,6 @@ index d22281abbd5c3cab3aaa3ac494301fa6b4a8a968..5f0c6a4aed2e868a1a1049212edf2187
  
  s.pipe(h).on('data', common.mustCall(function(c) {
    assert.strictEqual(c, expect);
-diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
-index 929dd36c669239804f2cfc5168bd3bf6e15855e6..8ebe599bbd21ad30e5041e0eab1e5898caf33e49 100644
---- a/test/parallel/test-crypto-hash.js
-+++ b/test/parallel/test-crypto-hash.js
-@@ -182,7 +182,7 @@ assert.throws(
- }
- 
- // Test XOF hash functions and the outputLength option.
--{
-+if (!process.features.openssl_is_boringssl) {
-   // Default outputLengths.
-   assert.strictEqual(crypto.createHash('shake128').digest('hex'),
-                      '7f9c2ba4e88f827d616045507605853e');
 diff --git a/test/parallel/test-crypto-oneshot-hash-xof.js b/test/parallel/test-crypto-oneshot-hash-xof.js
 index 75cb4800ff1bd51fedd7bc4e2d7e6af6f4f48346..b4363c31592763235116d970a5f45d4cf63de373 100644
 --- a/test/parallel/test-crypto-oneshot-hash-xof.js
@@ -272,51 +161,6 @@ index 75cb4800ff1bd51fedd7bc4e2d7e6af6f4f48346..b4363c31592763235116d970a5f45d4c
  // Test XOF hash functions and the outputLength option.
  {
    // Default outputLengths.
-diff --git a/test/parallel/test-crypto-padding.js b/test/parallel/test-crypto-padding.js
-index 48cd1ed4df61aaddeee8785cb90f83bdd9628187..d09e01712c617597833bb1320a32a967bcf1d318 100644
---- a/test/parallel/test-crypto-padding.js
-+++ b/test/parallel/test-crypto-padding.js
-@@ -84,14 +84,13 @@ assert.throws(function() {
-   // Input must have block length %.
-   enc(ODD_LENGTH_PLAIN, false);
- }, hasOpenSSL3 ? {
--  message: 'error:1C80006B:Provider routines::wrong final block length',
--  code: 'ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH',
--  reason: 'wrong final block length',
-+  message: /wrong[\s_]final[\s_]block[\s_]length/i,
-+  code: /ERR_OSSL(_EVP)?_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH/,
-+  message: /wrong[\s_]final[\s_]block[\s_]length/i,
- } : {
--  message: 'error:0607F08A:digital envelope routines:EVP_EncryptFinal_ex:' +
--    'data not multiple of block length',
--  code: 'ERR_OSSL_EVP_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH',
--  reason: 'data not multiple of block length',
-+  message: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i,
-+  code: /ERR_OSSL(_EVP)?_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH/,
-+  reason: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i,
- }
- );
- 
-@@ -110,15 +109,10 @@ assert.strictEqual(dec(EVEN_LENGTH_ENCRYPTED, false).length, 48);
- assert.throws(function() {
-   // Must have at least 1 byte of padding (PKCS):
-   assert.strictEqual(dec(EVEN_LENGTH_ENCRYPTED_NOPAD, true), EVEN_LENGTH_PLAIN);
--}, hasOpenSSL3 ? {
--  message: 'error:1C800064:Provider routines::bad decrypt',
--  reason: 'bad decrypt',
--  code: 'ERR_OSSL_BAD_DECRYPT',
--} : {
--  message: 'error:06065064:digital envelope routines:EVP_DecryptFinal_ex:' +
--    'bad decrypt',
--  reason: 'bad decrypt',
--  code: 'ERR_OSSL_EVP_BAD_DECRYPT',
-+}, {
-+  message: /bad[\s_]decrypt/i,
-+  reason: /bad[\s_]decrypt/i,
-+  code: /ERR_OSSL(_EVP)?_BAD_DECRYPT/,
- });
- 
- // No-pad encrypted string should return the same:
 diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
 index 119bc3c2d20ea7d681f0b579f9d91ad46cdc3634..8d13b105fa426015a873c411ad1d7f64b3d9580e 100644
 --- a/test/parallel/test-crypto-rsa-dsa.js
@@ -428,23 +272,6 @@ index a66f0a94efd7c952c1d2320fbc7a39fe3a88a8a1..dc5846db0e3dcf8f7cb5f7efcdbc81c1
  
    for (const [file, length] of keys) {
      const privKey = fixtures.readKey(file);
-diff --git a/test/parallel/test-crypto-stream.js b/test/parallel/test-crypto-stream.js
-index 747af780469c22eb8e4c6c35424043e868f75c3d..ed0916b036a9af23d805007ebd609973ee954473 100644
---- a/test/parallel/test-crypto-stream.js
-+++ b/test/parallel/test-crypto-stream.js
-@@ -73,9 +73,9 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv);
- const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv);
- 
- cipher.pipe(decipher)
--  .on('error', common.expectsError(hasOpenSSL3 ? {
--    message: /bad[\s_]decrypt/,
--    library: 'Provider routines',
-+  .on('error', common.expectsError((hasOpenSSL3 || process.features.openssl_is_boringssl) ? {
-+    message: /bad[\s_]decrypt/i,
-+    library: /Provider routines|Cipher functions/,
-     reason: /bad[\s_]decrypt/i,
-   } : {
-     message: /bad[\s_]decrypt/i,
 diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
 index 84111740cd9ef6425b747e24e984e66e46b0b2ef..b1621d310536fae3fdec91a6a9d275ec8fc99a98 100644
 --- a/test/parallel/test-crypto.js
@@ -502,29 +329,6 @@ index 84111740cd9ef6425b747e24e984e66e46b0b2ef..b1621d310536fae3fdec91a6a9d275ec
  // Make sure memory isn't released before being returned
  console.log(crypto.randomBytes(16));
  
-diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js
-index 7bd42bbe721c4c9442410d524c5ca740078fc72c..de49dbdc2b75517f497af353a6b24b1beb11ed69 100644
---- a/test/parallel/test-tls-alert-handling.js
-+++ b/test/parallel/test-tls-alert-handling.js
-@@ -43,7 +43,8 @@ const errorHandler = common.mustCall((err) => {
- 
-   assert.strictEqual(err.code, expectedErrorCode);
-   assert.strictEqual(err.library, 'SSL routines');
--  if (!hasOpenSSL3) assert.strictEqual(err.function, 'ssl3_get_record');
-+  if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
-+    assert.strictEqual(err.function, 'ssl3_get_record');
-   assert.match(err.reason, expectedErrorReason);
-   errorReceived = true;
-   if (canCloseServer())
-@@ -105,7 +106,7 @@ function sendBADTLSRecord() {
-     }
-     assert.strictEqual(err.code, expectedErrorCode);
-     assert.strictEqual(err.library, 'SSL routines');
--    if (!hasOpenSSL3)
-+    if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
-       assert.strictEqual(err.function, 'ssl3_read_bytes');
-     assert.match(err.reason, expectedErrorReason);
-   }));
 diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js
 index bd788ec4ed88289d35798b8af8c9490a68e081a2..1a5477ba928bce93320f8056db02e1a7b8ddcdf3 100644
 --- a/test/parallel/test-webcrypto-wrap-unwrap.js
@@ -584,9 +388,18 @@ index bd788ec4ed88289d35798b8af8c9490a68e081a2..1a5477ba928bce93320f8056db02e1a7
  function generateWrappingKeys() {
    return Promise.all(Object.keys(kWrappingData).map(async (name) => {
 diff --git a/test/parallel/test-x509-escaping.js b/test/parallel/test-x509-escaping.js
-index b507af88e1f7f3424b7b5d6d683a295b9d208e5e..825ba4c8dce775f401080a0522565bb7a087bcc3 100644
+index c8fc4abbb108a6d6849e8452d97d29187da2ebe6..825ba4c8dce775f401080a0522565bb7a087bcc3 100644
 --- a/test/parallel/test-x509-escaping.js
 +++ b/test/parallel/test-x509-escaping.js
+@@ -438,7 +438,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
+   const cert = fixtures.readKey('incorrect_san_correct_subject-cert.pem');
+ 
+   // The hostname is the CN, but not a SAN entry.
+-  const servername = process.features.openssl_is_boringssl ? undefined : 'good.example.com';
++  const servername = 'good.example.com';
+   const certX509 = new X509Certificate(cert);
+   assert.strictEqual(certX509.subject, `CN=${servername}`);
+   assert.strictEqual(certX509.subjectAltName, 'DNS:evil.example.com');
 @@ -448,7 +448,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
    assert.strictEqual(certX509.checkHost(servername, { subject: 'default' }),
                       undefined);

patches/node/fix_do_not_resolve_electron_entrypoints.patch

@@ -6,10 +6,10 @@ Subject: fix: do not resolve electron entrypoints
 This wastes fs cycles and can result in strange behavior if this path actually exists on disk
 
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 96869be3c48b84106a5fe2cb752fe979a211d96a..64f8902b1a3d5c335a3b8889b2dc801e8f9ec79c 100644
+index e4d5579565eea07013c8260fa3c4aa3b266a4b35..fbcef937b26023e0f6f97a0e58ac7350e7616f58 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -404,6 +404,10 @@ function cjsPreparseModuleExports(filename, source, format) {
+@@ -407,6 +407,10 @@ function cjsPreparseModuleExports(filename, source, format) {
      return { module, exportNames: module[kModuleExportNames] };
    }
  
@@ -21,7 +21,7 @@ index 96869be3c48b84106a5fe2cb752fe979a211d96a..64f8902b1a3d5c335a3b8889b2dc801e
      ({ source } = loadSourceForCJSWithHooks(module, filename, format));
    }
 diff --git a/lib/internal/modules/run_main.js b/lib/internal/modules/run_main.js
-index d337eeca801b9c187d1513519d7faf27310dbc41..34025f0c2c984b1b9993709cbd00be4158ea1db3 100644
+index 2974459755ec25139aefdab7f36811e036ac4204..593235acacd266ba7d6f1925032cd5ba455c29da 100644
 --- a/lib/internal/modules/run_main.js
 +++ b/lib/internal/modules/run_main.js
 @@ -2,6 +2,7 @@

patches/node/fix_ensure_traverseparent_bails_on_resource_path_exit.patch

@@ -8,7 +8,7 @@ resource path. This commit ensures that the TraverseParent function
 bails out if the parent path is outside of the resource path.
 
 diff --git a/src/node_modules.cc b/src/node_modules.cc
-index 15686c00524b6e9a31d6d27069605b1d9ebd5d38..98d4dec64c904f45ae09bf3cd8ec9b18b275bc44 100644
+index df9925404e77ec61900f89a5241c86a599e548c5..b5425122b54d91673e184ccfe88dd3a0ca2ff634 100644
 --- a/src/node_modules.cc
 +++ b/src/node_modules.cc
 @@ -333,8 +333,41 @@ const BindingData::PackageConfig* BindingData::TraverseParent(

patches/node/fix_expose_readfilesync_override_for_modules.patch

@@ -8,10 +8,10 @@ an API override to replace the native `ReadFileSync` in the `modules`
 binding.
 
 diff --git a/src/env_properties.h b/src/env_properties.h
-index 39803ae466fc81a6b2ff6e12093cdf2082790a9f..29ce687a03ccc8e45881f70d34e009e028aa4074 100644
+index bb874fec74c73b5de0ef6d1e2a872ebceefb11ce..6fafe2a8029c535fa98276e2d73f04ee603a7805 100644
 --- a/src/env_properties.h
 +++ b/src/env_properties.h
-@@ -490,6 +490,7 @@
+@@ -491,6 +491,7 @@
    V(maybe_cache_generated_source_map, v8::Function)                            \
    V(messaging_deserialize_create_object, v8::Function)                         \
    V(message_port, v8::Object)                                                  \
@@ -20,7 +20,7 @@ index 39803ae466fc81a6b2ff6e12093cdf2082790a9f..29ce687a03ccc8e45881f70d34e009e0
    V(performance_entry_callback, v8::Function)                                  \
    V(prepare_stack_trace_callback, v8::Function)                                \
 diff --git a/src/node_modules.cc b/src/node_modules.cc
-index 9eec93f52f0d0b2e45ae04ff357b4ced0770782f..6b1a9e257b0ce52820838f88c44ec546068fe419 100644
+index fa0aa90cf4d6a9fae3cde0b0bb743b88b47c07bb..d3907c3d063c7757cdd7ef99ed09bea1eb58a3fd 100644
 --- a/src/node_modules.cc
 +++ b/src/node_modules.cc
 @@ -23,12 +23,14 @@ namespace modules {

patches/node/fix_expose_the_built-in_electron_module_via_the_esm_loader.patch

@@ -6,7 +6,7 @@ Subject: fix: expose the built-in electron module via the ESM loader
 This allows usage of `import { app } from 'electron'` and `import('electron')` natively in the browser + non-sandboxed renderer
 
 diff --git a/lib/internal/modules/esm/get_format.js b/lib/internal/modules/esm/get_format.js
-index 01584983c16a2ab6eec2fbb01208504f2771148b..6afbbca6c95103f3ecad29485581c94735bac0d3 100644
+index 48ccb97a6244eab4bcfbee92feb9829ca32ad0c5..043d094540845228556b0f9837f48fbaddedfb47 100644
 --- a/lib/internal/modules/esm/get_format.js
 +++ b/lib/internal/modules/esm/get_format.js
 @@ -26,6 +26,7 @@ const protocolHandlers = {
@@ -64,18 +64,18 @@ index c284163fba86ec820af1996571fbd3d092d41d34..5f1921d15bc1d3a68c35990f85e36a0e
    }
  }
 diff --git a/lib/internal/modules/esm/loader.js b/lib/internal/modules/esm/loader.js
-index d536d8215c93abd4b9e1faa125257fe120242e92..20bc3b3b15a01251964e741e16500d5d1fb5994e 100644
+index abfe88c272dcc4aa1e95948bf754f55e1df74ddf..7a29cd391fdf050ebda50c5b2f263d27001ced74 100644
 --- a/lib/internal/modules/esm/loader.js
 +++ b/lib/internal/modules/esm/loader.js
-@@ -499,7 +499,7 @@ class ModuleLoader {
-     }
+@@ -437,7 +437,7 @@ class ModuleLoader {
+     assert(wrap instanceof ModuleWrap, `Translator used for require(${url}) should not be async`);
  
      const cjsModule = wrap[imported_cjs_symbol];
 -    if (cjsModule) {
 +    if (cjsModule && translatorKey !== 'electron') {
-       assert(translatorKey === 'commonjs-sync');
        // Check if the ESM initiating import CJS is being required by the same CJS module.
        if (cjsModule?.[kIsExecuting]) {
+         const parentFilename = urlToFilename(parentURL);
 diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
 index c27ee4c6612c6a7ea0b6355f03563e8724fd0e40..5f03cf14e948d449d303b22ab6710b5508fb83b2 100644
 --- a/lib/internal/modules/esm/resolve.js
@@ -103,10 +103,10 @@ index c27ee4c6612c6a7ea0b6355f03563e8724fd0e40..5f03cf14e948d449d303b22ab6710b55
  
    const packageConfig = packageJsonReader.read(packageJSONPath, { __proto__: null, specifier, base, isESM: true });
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 446349113e13bce042734010fd98af053c8cf31e..52b8b5d9255f782af96aa859dec4ffa6ca82c9d0 100644
+index 1716328c7a98996a8933dbaa00a1c6c3156fb2ff..30f887663bbbd9913eff35f0e6e5b8291adda120 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -220,7 +220,9 @@ function createCJSModuleWrap(url, translateContext, parentURL, loadCJS = loadCJS
+@@ -223,7 +223,9 @@ function createCJSModuleWrap(url, translateContext, parentURL, loadCJS = loadCJS
    const { exportNames, module } = cjsPreparseModuleExports(filename, source, sourceFormat);
    cjsCache.set(url, module);
  
@@ -117,7 +117,7 @@ index 446349113e13bce042734010fd98af053c8cf31e..52b8b5d9255f782af96aa859dec4ffa6
    if (!exportNames.has('default')) {
      ArrayPrototypePush(wrapperNames, 'default');
    }
-@@ -322,6 +324,10 @@ translators.set('require-commonjs', (url, translateContext, parentURL) => {
+@@ -325,6 +327,10 @@ translators.set('require-commonjs', (url, translateContext, parentURL) => {
    return createCJSModuleWrap(url, translateContext, parentURL);
  });
  

patches/node/fix_handle_boringssl_and_openssl_incompatibilities.patch

@@ -17,7 +17,7 @@ Upstreams:
 - https://github.com/nodejs/node/pull/39136
 
 diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
-index e1c2da6969a1ce937d397735e844930f3234bba7..0bed152014949c22b6c610198df39a2522890279 100644
+index 461819ce0fa732048e4365c40a86ef55d984c35f..fa55c980a9c4f373723a867fd41276d67b0b9413 100644
 --- a/deps/ncrypto/ncrypto.cc
 +++ b/deps/ncrypto/ncrypto.cc
 @@ -11,6 +11,7 @@
@@ -151,7 +151,7 @@ index d005bf0ffb93445fa6611a1beb1b465764271ede..01770687bd191c61af02e76d7de24bba
        X509View ca(sk_X509_value(peer_certs.get(), i));
        if (!cert->view().isIssuedBy(ca)) continue;
 diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index 6482bd58bb6a95cfa4074ea9535e1443aea66bb5..20d3c1d9d17fde18fc09b6ee219137831eb08a45 100644
+index 03c0c6f42d84efaeba0cc3b997cd29f77648b00d..f3631d538a38dc3a93a47707ea8dab0462fa2140 100644
 --- a/src/crypto/crypto_context.cc
 +++ b/src/crypto/crypto_context.cc
 @@ -143,7 +143,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
@@ -163,7 +163,7 @@ index 6482bd58bb6a95cfa4074ea9535e1443aea66bb5..20d3c1d9d17fde18fc09b6ee21913783
        X509* ca = sk_X509_value(extra_certs, i);
  
        // NOTE: Increments reference count on `ca`
-@@ -1831,11 +1831,12 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
+@@ -1832,11 +1832,12 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
    // If the user specified "auto" for dhparams, the JavaScript layer will pass
    // true to this function instead of the original string. Any other string
    // value will be interpreted as custom DH parameters below.
@@ -177,7 +177,7 @@ index 6482bd58bb6a95cfa4074ea9535e1443aea66bb5..20d3c1d9d17fde18fc09b6ee21913783
    DHPointer dh;
    {
      BIOPointer bio(LoadBIO(env, args[0]));
-@@ -2061,7 +2062,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
+@@ -2062,7 +2063,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
    }
  
    // Add CA certs too
@@ -276,7 +276,7 @@ index 205e248e0f20f019e189a6c69d3c011a616b3939..12b0d804c6f1d4998b85160b0aac8eb7
  
  #define V(name) case ERR_LIB_##name: lib = #name "_"; break;
 diff --git a/src/env.h b/src/env.h
-index f3a2d221f4bb52987e1bdacdadf19aacfcf65ec3..d34aec43630b3cf53004d8180446d7136b59ceac 100644
+index ed2253f1fc3cf8d59e73e4f2478dfb0d4227aacd..84a650885a79bc5c49efdc26f62ec8db48de775c 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -52,7 +52,7 @@
@@ -288,7 +288,7 @@ index f3a2d221f4bb52987e1bdacdadf19aacfcf65ec3..d34aec43630b3cf53004d8180446d713
  #include <openssl/evp.h>
  #endif
  
-@@ -1058,7 +1058,7 @@ class Environment final : public MemoryRetainer {
+@@ -1059,7 +1059,7 @@ class Environment final : public MemoryRetainer {
      kExitInfoFieldCount
    };
  
@@ -311,7 +311,7 @@ index d9c533f100d25aeab1fe8589932a8ddead431258..2acab8786a8a752b17961445edeb872c
  #if NODE_OPENSSL_HAS_QUIC
  #include <openssl/quic.h>
 diff --git a/src/node_options.h b/src/node_options.h
-index 3a1503a035e12b5dce75c77c327607c857a8a367..941ae4f15c42fb8016d03c786973fd4709ac1a0d 100644
+index 1f15c6cc6a9ae192b1b394c437393e744b5b1153..638e49ccf48d9b9c60189af9255ce7cef9184723 100644
 --- a/src/node_options.h
 +++ b/src/node_options.h
 @@ -11,7 +11,7 @@

patches/node/fix_lazyload_fs_in_esm_loaders_to_apply_asar_patches.patch

@@ -50,7 +50,7 @@ index 5f03cf14e948d449d303b22ab6710b5508fb83b2..72cc9444ca93ef7a1526e23314693aea
      });
      const { search, hash } = resolved;
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 52b8b5d9255f782af96aa859dec4ffa6ca82c9d0..96869be3c48b84106a5fe2cb752fe979a211d96a 100644
+index 30f887663bbbd9913eff35f0e6e5b8291adda120..e4d5579565eea07013c8260fa3c4aa3b266a4b35 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
 @@ -24,7 +24,7 @@ const {
@@ -62,7 +62,7 @@ index 52b8b5d9255f782af96aa859dec4ffa6ca82c9d0..96869be3c48b84106a5fe2cb752fe979
  const { dirname, extname } = require('path');
  const {
    assertBufferSource,
-@@ -362,7 +362,7 @@ translators.set('commonjs', function commonjsStrategy(url, translateContext, par
+@@ -365,7 +365,7 @@ translators.set('commonjs', function commonjsStrategy(url, translateContext, par
  
    try {
      // We still need to read the FS to detect the exports.

patches/node/fix_remove_deprecated_errno_constants.patch

@@ -86,10 +86,10 @@ index fd28e0904d05e24e8eeb74fa36abd9727699a649..fea0426496978c0003fe1481afcf93fc
    NODE_DEFINE_CONSTANT(target, ETIMEDOUT);
  #endif
 diff --git a/src/node_errors.cc b/src/node_errors.cc
-index 552aa161636928fb646a97402988bc394ee987c1..15d78e3eca9693dc518ccb28fc7c02fa1372f34b 100644
+index d148127b89b632b339a63eb50370dfa0daca6308..55a0c986c5b6989ee9ce277bb6a9778abb2ad2ee 100644
 --- a/src/node_errors.cc
 +++ b/src/node_errors.cc
-@@ -862,10 +862,6 @@ const char* errno_string(int errorno) {
+@@ -899,10 +899,6 @@ const char* errno_string(int errorno) {
      ERRNO_CASE(ENOBUFS);
  #endif
  
@@ -100,7 +100,7 @@ index 552aa161636928fb646a97402988bc394ee987c1..15d78e3eca9693dc518ccb28fc7c02fa
  #ifdef ENODEV
      ERRNO_CASE(ENODEV);
  #endif
-@@ -904,14 +900,6 @@ const char* errno_string(int errorno) {
+@@ -941,14 +937,6 @@ const char* errno_string(int errorno) {
      ERRNO_CASE(ENOSPC);
  #endif
  
@@ -115,7 +115,7 @@ index 552aa161636928fb646a97402988bc394ee987c1..15d78e3eca9693dc518ccb28fc7c02fa
  #ifdef ENOSYS
      ERRNO_CASE(ENOSYS);
  #endif
-@@ -994,10 +982,6 @@ const char* errno_string(int errorno) {
+@@ -1031,10 +1019,6 @@ const char* errno_string(int errorno) {
      ERRNO_CASE(ESTALE);
  #endif
  

patches/node/fix_suppress_nodiscard_warning_for_copy_options_operator.patch

@@ -7,7 +7,7 @@ libc++ added [[nodiscard]] to std::filesystem::copy_options operator|=
 which causes build failures with -Werror.
 
 diff --git a/src/node_file.cc b/src/node_file.cc
-index e7459654401c275dfb86207831016ed71060bcc9..5c426c4d3d309df8c6c43e8b105d993ed80c2ca6 100644
+index c364f2a4f6dd6ec066b00f364108383154be12ec..326e1c3c3b9e987e89cfc12b260b0a6ab333a607 100644
 --- a/src/node_file.cc
 +++ b/src/node_file.cc
 @@ -3444,11 +3444,11 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {

patches/node/lib_check_sharedarraybuffer_existence_in_fast-utf8-stream.patch

@@ -1,46 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Shelley Vohr <shelley.vohr@gmail.com>
-Date: Sat, 25 Oct 2025 11:06:10 +0200
-Subject: lib: check SharedArrayBuffer existence in fast-utf8-stream
-
-After https://github.com/nodejs/node/pull/58897 calling
-Object.entries on fs will lazy-load fast-utf8-stream, which uses
-SharedArrayBuffer without checking for its existence first. It
-won't exist in the renderer process and will throw
-'SharedArrayBuffer is not a constructor'. Refactor to check
-for SharedArrayBuffer first.
-
-This should be upstreamed to Node.js
-
-diff --git a/lib/internal/streams/fast-utf8-stream.js b/lib/internal/streams/fast-utf8-stream.js
-index 3bfcc494d17b5cc4c9f494fab4aff4f0d68d2287..241a6b05e84f8e79b8c9b93abfda5562c2e35e9e 100644
---- a/lib/internal/streams/fast-utf8-stream.js
-+++ b/lib/internal/streams/fast-utf8-stream.js
-@@ -49,7 +49,8 @@ const {
- const BUSY_WRITE_TIMEOUT = 100;
- const kEmptyBuffer = Buffer.allocUnsafe(0);
- 
--const kNil = new Int32Array(new SharedArrayBuffer(4));
-+const haveSAB = typeof SharedArrayBuffer !== 'undefined';
-+const kNil = haveSAB ? new Int32Array(new SharedArrayBuffer(4)) : null;
- 
- function sleep(ms) {
-   // Also filters out NaN, non-number types, including empty strings, but allows bigints
-@@ -59,10 +60,14 @@ function sleep(ms) {
-       throw new ERR_INVALID_ARG_TYPE('ms', ['number', 'bigint'], ms);
-     }
-     throw new ERR_INVALID_ARG_VALUE.RangeError('ms', ms,
--                                               'must be a number greater than 0 and less than Infinity');
-+      'must be a number greater than 0 and less than Infinity');
-+  }
-+  if (haveSAB) {
-+    AtomicsWait(kNil, 0, 0, Number(ms));
-+  } else {
-+    const { sleep: _sleep } = internalBinding('util');
-+    _sleep(ms);
-   }
--
--  AtomicsWait(kNil, 0, 0, Number(ms));
- }
- 
- // 16 KB. Don't write more than docker buffer size.

patches/node/pass_all_globals_through_require.patch

@@ -6,7 +6,7 @@ Subject: Pass all globals through "require"
 (cherry picked from commit 7d015419cb7a0ecfe6728431a4ed2056cd411d62)
 
 diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
-index 02c9ba15853603ed69af7bdb9a3d3c7513e53ca1..1d43e75ae55a7dd37095a4379963e0e8278aafa1 100644
+index 414e450ee3a8110b8249dd831fef1ab885cc6fa1..c6ff40d814a49536808a2fd79ee6918c3ac118c9 100644
 --- a/lib/internal/modules/cjs/loader.js
 +++ b/lib/internal/modules/cjs/loader.js
 @@ -209,6 +209,13 @@ const {

patches/node/refactor_allow_embedder_overriding_of_internal_fs_calls.patch

@@ -7,7 +7,7 @@ We use this to allow node's 'fs' module to read from ASAR files as if they were
 a real filesystem.
 
 diff --git a/lib/internal/bootstrap/node.js b/lib/internal/bootstrap/node.js
-index 963fe2ab11927a6802d2b1c0f653b5b1032d4243..0a531f216bd64477b800a169e91d859844161f16 100644
+index de18fc4934bcfef6485dc0bc853ca324ed17fc4e..52998c967109c797f3eab64f2f99990b2d69841a 100644
 --- a/lib/internal/bootstrap/node.js
 +++ b/lib/internal/bootstrap/node.js
 @@ -129,6 +129,10 @@ process.domain = null;

patches/node/refactor_attach_cppgc_heap_on_v8_isolate_creation.patch

@@ -18,10 +18,10 @@ This can be removed when Node.js upgrades to a version of V8 containing CLs
 from the above issue.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 6e7c0dbe31d0fef23288787df44e58c44bd47c5d..451796ffc4ec93b6e317dd49d92070c61aca04e5 100644
+index 5c8bc870dcf2e974036cf3bcb60fd288e59045d9..0f19cb09ea0963a9c505c51f89d1c7a939f2730b 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -336,6 +336,10 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
+@@ -331,6 +331,10 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
                      MultiIsolatePlatform* platform,
                      const SnapshotData* snapshot_data,
                      const IsolateSettings& settings) {
@@ -32,7 +32,7 @@ index 6e7c0dbe31d0fef23288787df44e58c44bd47c5d..451796ffc4ec93b6e317dd49d92070c6
    IsolateGroup group = GetOrCreateIsolateGroup();
    Isolate* isolate = Isolate::Allocate(group);
    if (isolate == nullptr) return nullptr;
-@@ -392,9 +396,12 @@ Isolate* NewIsolate(ArrayBufferAllocator* allocator,
+@@ -387,9 +391,12 @@ Isolate* NewIsolate(ArrayBufferAllocator* allocator,
                      uv_loop_t* event_loop,
                      MultiIsolatePlatform* platform,
                      const EmbedderSnapshotData* snapshot_data,
@@ -89,7 +89,7 @@ index fb2af584a4ae777022c9ef8c20ada1edcbbbefdc..fe6300a5d5d2d6602a84cbd33736c213
  #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
  
 diff --git a/src/env.cc b/src/env.cc
-index 53f0bf7fc1e5c85fa9a5a323e998f04310f4f75e..a78817467518245c4a190e870e0eb30658eafcdb 100644
+index fdabe48dd7776c59298f7d972286d0d2ed062752..b5cf58cc953590493beb52abf249e33e486ffc46 100644
 --- a/src/env.cc
 +++ b/src/env.cc
 @@ -611,7 +611,7 @@ IsolateData::~IsolateData() {}
@@ -102,7 +102,7 @@ index 53f0bf7fc1e5c85fa9a5a323e998f04310f4f75e..a78817467518245c4a190e870e0eb306
        isolate, object, wrappable);
  }
 diff --git a/src/node.h b/src/node.h
-index 9c624e4ef26c1b06a6c4bca7def245935189ce07..486d941cf0c5c4588604f3808807717aaed2f018 100644
+index 19c34a430d095c06ccf5a988db91311d420a485a..5a6004ca4dfd15a813f3fcc7687958432e4fd5a0 100644
 --- a/src/node.h
 +++ b/src/node.h
 @@ -78,6 +78,7 @@
@@ -113,7 +113,7 @@ index 9c624e4ef26c1b06a6c4bca7def245935189ce07..486d941cf0c5c4588604f3808807717a
  
  #include "v8-platform.h"  // NOLINT(build/include_order)
  #include "node_version.h"  // NODE_MODULE_VERSION
-@@ -604,7 +605,8 @@ NODE_EXTERN v8::Isolate* NewIsolate(
+@@ -603,7 +604,8 @@ NODE_EXTERN v8::Isolate* NewIsolate(
      struct uv_loop_s* event_loop,
      MultiIsolatePlatform* platform,
      const EmbedderSnapshotData* snapshot_data = nullptr,
@@ -123,7 +123,7 @@ index 9c624e4ef26c1b06a6c4bca7def245935189ce07..486d941cf0c5c4588604f3808807717a
  NODE_EXTERN v8::Isolate* NewIsolate(
      std::shared_ptr<ArrayBufferAllocator> allocator,
      struct uv_loop_s* event_loop,
-@@ -1625,9 +1627,10 @@ void RegisterSignalHandler(int signal,
+@@ -1624,9 +1626,10 @@ void RegisterSignalHandler(int signal,
  // work with only Node.js versions with v8::Object::Wrap() should use that
  // instead.
  NODE_DEPRECATED("Use v8::Object::Wrap()",

patches/node/src_handle_der_decoding_errors_from_system_certificates.patch

@@ -9,7 +9,7 @@ that cannot be decoded (might be related to SSL implementation issues),
 skip them.
 
 diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index 96f6ea29525bc2c60297e7be5bc1d0b74cd568e1..9b83f8d6b2c7639044e739a7f055e457882370a2 100644
+index fc6d295a401d5283ba19dd5c95b748c83b7055a9..b971ea5b6842549563c0c54168d17ecf6e72bb73 100644
 --- a/src/crypto/crypto_context.cc
 +++ b/src/crypto/crypto_context.cc
 @@ -507,7 +507,11 @@ void ReadMacOSKeychainCertificates(

patches/node/src_use_cp_utf8_for_wide_file_names_on_win32.patch

@@ -1,308 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fedor Indutny <indutny@signal.org>
-Date: Tue, 11 Nov 2025 13:43:01 -0800
-Subject: src: use CP_UTF8 for wide file names on win32
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-`src/node_modules.cc` needs to be consistent with `src/node_file.cc` in
-how it translates the utf8 strings to `std::wstring` otherwise we might
-end up in situation where we can read the source code of imported
-package from disk, but fail to recognize that it is an ESM (or CJS) and
-cause runtime errors. This type of error is possible on Windows when the
-path contains unicode characters and "Language for non-Unicode programs"
-is set to "Chinese (Traditional, Taiwan)".
-
-See: #58768
-PR-URL: https://github.com/nodejs/node/pull/60575
-Reviewed-By: Anna Henningsen <anna@addaleax.net>
-Reviewed-By: Darshan Sen <raisinten@gmail.com>
-Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
-Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
-Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
-Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
-
-diff --git a/src/node_file.cc b/src/node_file.cc
-index 969e7d08086f8442bed476feaf15599b8c79db7c..e7459654401c275dfb86207831016ed71060bcc9 100644
---- a/src/node_file.cc
-+++ b/src/node_file.cc
-@@ -3175,42 +3175,6 @@ static void GetFormatOfExtensionlessFile(
-   return args.GetReturnValue().Set(EXTENSIONLESS_FORMAT_JAVASCRIPT);
- }
- 
--#ifdef _WIN32
--#define BufferValueToPath(str)                                                 \
--  std::filesystem::path(ConvertToWideString(str.ToString(), CP_UTF8))
--
--std::string ConvertWideToUTF8(const std::wstring& wstr) {
--  if (wstr.empty()) return std::string();
--
--  int size_needed = WideCharToMultiByte(CP_UTF8,
--                                        0,
--                                        &wstr[0],
--                                        static_cast<int>(wstr.size()),
--                                        nullptr,
--                                        0,
--                                        nullptr,
--                                        nullptr);
--  std::string strTo(size_needed, 0);
--  WideCharToMultiByte(CP_UTF8,
--                      0,
--                      &wstr[0],
--                      static_cast<int>(wstr.size()),
--                      &strTo[0],
--                      size_needed,
--                      nullptr,
--                      nullptr);
--  return strTo;
--}
--
--#define PathToString(path) ConvertWideToUTF8(path.wstring());
--
--#else  // _WIN32
--
--#define BufferValueToPath(str) std::filesystem::path(str.ToStringView());
--#define PathToString(path) path.native();
--
--#endif  // _WIN32
--
- static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
-   Environment* env = Environment::GetCurrent(args);
-   Isolate* isolate = env->isolate();
-@@ -3223,7 +3187,7 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
-   THROW_IF_INSUFFICIENT_PERMISSIONS(
-       env, permission::PermissionScope::kFileSystemRead, src.ToStringView());
- 
--  auto src_path = BufferValueToPath(src);
-+  auto src_path = src.ToPath();
- 
-   BufferValue dest(isolate, args[1]);
-   CHECK_NOT_NULL(*dest);
-@@ -3231,7 +3195,7 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
-   THROW_IF_INSUFFICIENT_PERMISSIONS(
-       env, permission::PermissionScope::kFileSystemWrite, dest.ToStringView());
- 
--  auto dest_path = BufferValueToPath(dest);
-+  auto dest_path = dest.ToPath();
-   bool dereference = args[2]->IsTrue();
-   bool recursive = args[3]->IsTrue();
- 
-@@ -3260,8 +3224,8 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
-       (src_status.type() == std::filesystem::file_type::directory) ||
-       (dereference && src_status.type() == std::filesystem::file_type::symlink);
- 
--  auto src_path_str = PathToString(src_path);
--  auto dest_path_str = PathToString(dest_path);
-+  auto src_path_str = ConvertPathToUTF8(src_path);
-+  auto dest_path_str = ConvertPathToUTF8(dest_path);
- 
-   if (!error_code) {
-     // Check if src and dest are identical.
-@@ -3356,7 +3320,7 @@ static bool CopyUtimes(const std::filesystem::path& src,
-   uv_fs_t req;
-   auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
- 
--  auto src_path_str = PathToString(src);
-+  auto src_path_str = ConvertPathToUTF8(src);
-   int result = uv_fs_stat(nullptr, &req, src_path_str.c_str(), nullptr);
-   if (is_uv_error(result)) {
-     env->ThrowUVException(result, "stat", nullptr, src_path_str.c_str());
-@@ -3367,7 +3331,7 @@ static bool CopyUtimes(const std::filesystem::path& src,
-   const double source_atime = s->st_atim.tv_sec + s->st_atim.tv_nsec / 1e9;
-   const double source_mtime = s->st_mtim.tv_sec + s->st_mtim.tv_nsec / 1e9;
- 
--  auto dest_file_path_str = PathToString(dest);
-+  auto dest_file_path_str = ConvertPathToUTF8(dest);
-   int utime_result = uv_fs_utime(nullptr,
-                                  &req,
-                                  dest_file_path_str.c_str(),
-@@ -3502,7 +3466,7 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
-     std::error_code error;
-     for (auto dir_entry : std::filesystem::directory_iterator(src)) {
-       auto dest_file_path = dest / dir_entry.path().filename();
--      auto dest_str = PathToString(dest);
-+      auto dest_str = ConvertPathToUTF8(dest);
- 
-       if (dir_entry.is_symlink()) {
-         if (verbatim_symlinks) {
-@@ -3565,7 +3529,7 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
-               }
-             } else if (std::filesystem::is_regular_file(dest_file_path)) {
-               if (!dereference || (!force && error_on_exist)) {
--                auto dest_file_path_str = PathToString(dest_file_path);
-+                auto dest_file_path_str = ConvertPathToUTF8(dest_file_path);
-                 env->ThrowStdErrException(
-                     std::make_error_code(std::errc::file_exists),
-                     "cp",
-diff --git a/src/node_modules.cc b/src/node_modules.cc
-index 5355f2f96e9c9f6548ae43fd38b0d89a825e6b60..15686c00524b6e9a31d6d27069605b1d9ebd5d38 100644
---- a/src/node_modules.cc
-+++ b/src/node_modules.cc
-@@ -345,22 +345,24 @@ const BindingData::PackageConfig* BindingData::TraverseParent(
- 
-     // Stop the search when the process doesn't have permissions
-     // to walk upwards
--    if (is_permissions_enabled &&
--        !env->permission()->is_granted(
--            env,
--            permission::PermissionScope::kFileSystemRead,
--            current_path.generic_string())) [[unlikely]] {
--      return nullptr;
-+    if (is_permissions_enabled) {
-+      if (!env->permission()->is_granted(
-+              env,
-+              permission::PermissionScope::kFileSystemRead,
-+              ConvertGenericPathToUTF8(current_path))) [[unlikely]] {
-+        return nullptr;
-+      }
-     }
- 
-     // Check if the path ends with `/node_modules`
--    if (current_path.generic_string().ends_with("/node_modules")) {
-+    if (current_path.filename() == "node_modules") {
-       return nullptr;
-     }
- 
-     auto package_json_path = current_path / "package.json";
-+
-     auto package_json =
--        GetPackageJSON(realm, package_json_path.string(), nullptr);
-+        GetPackageJSON(realm, ConvertPathToUTF8(package_json_path), nullptr);
-     if (package_json != nullptr) {
-       return package_json;
-     }
-@@ -382,20 +384,12 @@ void BindingData::GetNearestParentPackageJSONType(
- 
-   ToNamespacedPath(realm->env(), &path_value);
- 
--  std::string path_value_str = path_value.ToString();
-+  auto path = path_value.ToPath();
-+
-   if (slashCheck) {
--    path_value_str.push_back(kPathSeparator);
-+    path /= "";
-   }
- 
--  std::filesystem::path path;
--
--#ifdef _WIN32
--  std::wstring wide_path = ConvertToWideString(path_value_str, GetACP());
--  path = std::filesystem::path(wide_path);
--#else
--  path = std::filesystem::path(path_value_str);
--#endif
--
-   auto package_json = TraverseParent(realm, path);
- 
-   if (package_json == nullptr) {
-diff --git a/src/util-inl.h b/src/util-inl.h
-index d07bceb425f00882db116975a92f4835d7c2cf3b..6898e8ea794675e903e13e2b45524d572a3f68bb 100644
---- a/src/util-inl.h
-+++ b/src/util-inl.h
-@@ -718,12 +718,11 @@ inline bool IsWindowsBatchFile(const char* filename) {
-   return !extension.empty() && (extension == "cmd" || extension == "bat");
- }
- 
--inline std::wstring ConvertToWideString(const std::string& str,
--                                        UINT code_page) {
-+inline std::wstring ConvertUTF8ToWideString(const std::string& str) {
-   int size_needed = MultiByteToWideChar(
--      code_page, 0, &str[0], static_cast<int>(str.size()), nullptr, 0);
-+      CP_UTF8, 0, &str[0], static_cast<int>(str.size()), nullptr, 0);
-   std::wstring wstrTo(size_needed, 0);
--  MultiByteToWideChar(code_page,
-+  MultiByteToWideChar(CP_UTF8,
-                       0,
-                       &str[0],
-                       static_cast<int>(str.size()),
-@@ -731,6 +730,59 @@ inline std::wstring ConvertToWideString(const std::string& str,
-                       size_needed);
-   return wstrTo;
- }
-+
-+std::string ConvertWideStringToUTF8(const std::wstring& wstr) {
-+  if (wstr.empty()) return std::string();
-+
-+  int size_needed = WideCharToMultiByte(CP_UTF8,
-+                                        0,
-+                                        &wstr[0],
-+                                        static_cast<int>(wstr.size()),
-+                                        nullptr,
-+                                        0,
-+                                        nullptr,
-+                                        nullptr);
-+  std::string strTo(size_needed, 0);
-+  WideCharToMultiByte(CP_UTF8,
-+                      0,
-+                      &wstr[0],
-+                      static_cast<int>(wstr.size()),
-+                      &strTo[0],
-+                      size_needed,
-+                      nullptr,
-+                      nullptr);
-+  return strTo;
-+}
-+
-+template <typename T, size_t kStackStorageSize>
-+std::filesystem::path MaybeStackBuffer<T, kStackStorageSize>::ToPath() const {
-+  std::wstring wide_path = ConvertUTF8ToWideString(ToString());
-+  return std::filesystem::path(wide_path);
-+}
-+
-+std::string ConvertPathToUTF8(const std::filesystem::path& path) {
-+  return ConvertWideStringToUTF8(path.wstring());
-+}
-+
-+std::string ConvertGenericPathToUTF8(const std::filesystem::path& path) {
-+  return ConvertWideStringToUTF8(path.generic_wstring());
-+}
-+
-+#else  // _WIN32
-+
-+template <typename T, size_t kStackStorageSize>
-+std::filesystem::path MaybeStackBuffer<T, kStackStorageSize>::ToPath() const {
-+  return std::filesystem::path(ToStringView());
-+}
-+
-+std::string ConvertPathToUTF8(const std::filesystem::path& path) {
-+  return path.native();
-+}
-+
-+std::string ConvertGenericPathToUTF8(const std::filesystem::path& path) {
-+  return path.generic_string();
-+}
-+
- #endif  // _WIN32
- 
- inline v8::MaybeLocal<v8::Object> NewDictionaryInstance(
-diff --git a/src/util.h b/src/util.h
-index 1db426df35e4976427b578a2974041ec9e92cf4c..52e6a149d6760640d93c56ce91a759ae9207a8c7 100644
---- a/src/util.h
-+++ b/src/util.h
-@@ -507,6 +507,8 @@ class MaybeStackBuffer {
-   inline std::basic_string_view<T> ToStringView() const {
-     return {out(), length()};
-   }
-+  // This can only be used if the buffer contains path data in UTF8
-+  inline std::filesystem::path ToPath() const;
- 
-  private:
-   size_t length_;
-@@ -1038,9 +1040,15 @@ class JSONOutputStream final : public v8::OutputStream {
- // Returns true if OS==Windows and filename ends in .bat or .cmd,
- // case insensitive.
- inline bool IsWindowsBatchFile(const char* filename);
--inline std::wstring ConvertToWideString(const std::string& str, UINT code_page);
-+inline std::wstring ConvertUTF8ToWideString(const std::string& str);
-+inline std::string ConvertWideStringToUTF8(const std::wstring& wstr);
-+
- #endif  // _WIN32
- 
-+inline std::filesystem::path ConvertUTF8ToPath(const std::string& str);
-+inline std::string ConvertPathToUTF8(const std::filesystem::path& path);
-+inline std::string ConvertGenericPathToUTF8(const std::filesystem::path& path);
-+
- // A helper to create a new instance of the dictionary template.
- // Unlike v8::DictionaryTemplate::NewInstance, this method will
- // check that all properties have been set (are not empty MaybeLocals)

patches/node/support_v8_sandboxed_pointers.patch

@@ -7,7 +7,7 @@ This refactors several allocators to allocate within the V8 memory cage,
 allowing them to be compatible with the V8_SANDBOXED_POINTERS feature.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 31007e599f0b717d586aa97b26c610047f402f0f..6e7c0dbe31d0fef23288787df44e58c44bd47c5d 100644
+index 53f05293bd94e159dfedf48735989e668acdd08e..5c8bc870dcf2e974036cf3bcb60fd288e59045d9 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
 @@ -111,6 +111,14 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,
@@ -24,8 +24,8 @@ index 31007e599f0b717d586aa97b26c610047f402f0f..6e7c0dbe31d0fef23288787df44e58c4
 +
  void* NodeArrayBufferAllocator::Allocate(size_t size) {
    void* ret;
-   if (zero_fill_field_ || per_process::cli_options->zero_fill_all_buffers) {
-@@ -342,6 +350,12 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
+   COUNT_GENERIC_USAGE("NodeArrayBufferAllocator.Allocate.ZeroFilled");
+@@ -337,6 +345,12 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
      // but also otherwise just doesn't work, and the only real alternative
      // is disabling shared-readonly-heap mode altogether.
      static Isolate::CreateParams first_params = *params;
@@ -211,7 +211,7 @@ index 97c43afb487b58c0c77bd59b4a6b6d7a13690053..5dfbd564d5bbd22ebf3b529a07b73e85
    return isolate_;
  }
 diff --git a/src/env.h b/src/env.h
-index d34aec43630b3cf53004d8180446d7136b59ceac..b30314d7773742e2332ff47f84bc326151563690 100644
+index 84a650885a79bc5c49efdc26f62ec8db48de775c..ba442937bf0d7831c9a84b5a57211e9f90c81705 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -111,6 +111,19 @@ class ModuleWrap;
@@ -234,6 +234,89 @@ index d34aec43630b3cf53004d8180446d7136b59ceac..b30314d7773742e2332ff47f84bc3261
  struct IsolateDataSerializeInfo {
    std::vector<SnapshotIndex> primitive_values;
    std::vector<PropInfo> template_values;
+diff --git a/src/node_buffer.cc b/src/node_buffer.cc
+index 49df0b4284748effb27b05ecd69f05699dd8be75..eb104ab80fd2052d1523cb2f2ecdb6d23ac3be98 100644
+--- a/src/node_buffer.cc
++++ b/src/node_buffer.cc
+@@ -81,6 +81,7 @@ using v8::SharedArrayBuffer;
+ using v8::String;
+ using v8::Uint32;
+ using v8::Uint8Array;
++using v8::Uint32Array;
+ using v8::Value;
+ 
+ namespace {
+@@ -1243,6 +1244,45 @@ void SetBufferPrototype(const FunctionCallbackInfo<Value>& args) {
+   realm->set_buffer_prototype_object(proto);
+ }
+ 
++void GetZeroFillToggle(const FunctionCallbackInfo<Value>& args) {
++  Environment* env = Environment::GetCurrent(args);
++  NodeArrayBufferAllocator* allocator = env->isolate_data()->node_allocator();
++  Local<ArrayBuffer> ab;
++  // It can be a nullptr when running inside an isolate where we
++  // do not own the ArrayBuffer allocator.
++  if (allocator == nullptr || env->isolate_data()->is_building_snapshot()) {
++    // Create a dummy Uint32Array - the JS land can only toggle the C++ land
++    // setting when the allocator uses our toggle. With this the toggle in JS
++    // land results in no-ops.
++    // When building a snapshot, just use a dummy toggle as well to avoid
++    // introducing the dynamic external reference. We'll re-initialize the
++    // toggle with a real one connected to the C++ allocator after snapshot
++    // deserialization.
++
++    ab = ArrayBuffer::New(env->isolate(), sizeof(uint32_t));
++  } else {
++    // TODO(joyeecheung): save ab->GetBackingStore()->Data() in the Node.js
++    // array buffer allocator and include it into the C++ toggle while the
++    // Environment is still alive.
++    uint32_t* zero_fill_field = allocator->zero_fill_field();
++    std::unique_ptr<BackingStore> backing =
++        ArrayBuffer::NewBackingStore(zero_fill_field,
++                                     sizeof(*zero_fill_field),
++                                     [](void*, size_t, void*) {},
++                                     nullptr);
++    ab = ArrayBuffer::New(env->isolate(), std::move(backing));
++  }
++
++  if (ab->SetPrivate(env->context(),
++                     env->untransferable_object_private_symbol(),
++                     True(env->isolate()))
++          .IsNothing()) {
++    return;
++  }
++
++  args.GetReturnValue().Set(Uint32Array::New(ab, 0, 1));
++}
++
+ static void Btoa(const FunctionCallbackInfo<Value>& args) {
+   CHECK_EQ(args.Length(), 1);
+   Environment* env = Environment::GetCurrent(args);
+@@ -1420,7 +1460,7 @@ inline size_t CheckNumberToSize(Local<Value> number) {
+   CHECK(value >= 0 && value < maxSize);
+   size_t size = static_cast<size_t>(value);
+ #ifdef V8_ENABLE_SANDBOX
+-  CHECK_LE(size, kMaxSafeBufferSizeForSandbox);
++  CHECK_LE(size, v8::internal::kMaxSafeBufferSizeForSandbox);
+ #endif
+   return size;
+ }
+@@ -1638,6 +1678,7 @@ void Initialize(Local<Object> target,
+                 "utf8WriteStatic",
+                 SlowWriteString<UTF8>,
+                 &fast_write_string_utf8);
++  SetMethod(context, target, "getZeroFillToggle", GetZeroFillToggle);
+ }
+ 
+ }  // anonymous namespace
+@@ -1686,6 +1727,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+   registry->Register(StringWrite<HEX>);
+   registry->Register(StringWrite<UCS2>);
+   registry->Register(StringWrite<UTF8>);
++  registry->Register(GetZeroFillToggle);
+ 
+   registry->Register(CopyArrayBuffer);
+   registry->Register(CreateUnsafeArrayBuffer);
 diff --git a/src/node_i18n.cc b/src/node_i18n.cc
 index 3c4f419aa29470b3280174b58680b9421b0340b5..3b24ad2a2316f89d98b067e2c13988f87a9a00d2 100644
 --- a/src/node_i18n.cc
@@ -275,25 +358,23 @@ index 3c4f419aa29470b3280174b58680b9421b0340b5..3b24ad2a2316f89d98b067e2c13988f8
  
  constexpr const char* EncodingName(const enum encoding encoding) {
 diff --git a/src/node_internals.h b/src/node_internals.h
-index 95ce3cf882296bf8eed5a11fe189857c3c88fd15..6612751d07803a1e9b8bf8196b5b8067644064ad 100644
+index 61a58b6ccfb26efefd6d3b61a1c8741f9550ae8d..29d1ecc2b209c9c3c2e956263ba2d57fb688b34c 100644
 --- a/src/node_internals.h
 +++ b/src/node_internals.h
-@@ -124,7 +124,9 @@ v8::MaybeLocal<v8::Object> InitializePrivateSymbols(
+@@ -124,6 +124,9 @@ v8::MaybeLocal<v8::Object> InitializePrivateSymbols(
  
  class NodeArrayBufferAllocator : public ArrayBufferAllocator {
   public:
--  inline uint32_t* zero_fill_field() { return &zero_fill_field_; }
 +  NodeArrayBufferAllocator();
 +  ~NodeArrayBufferAllocator() override;
 +  inline uint32_t* zero_fill_field() { return zero_fill_field_; }
- 
    void* Allocate(size_t size) override;  // Defined in src/node.cc
    void* AllocateUninitialized(size_t size) override;
-@@ -142,7 +144,7 @@ class NodeArrayBufferAllocator : public ArrayBufferAllocator {
+   void Free(void* data, size_t size) override;
+@@ -140,6 +143,7 @@ class NodeArrayBufferAllocator : public ArrayBufferAllocator {
    }
  
   private:
--  uint32_t zero_fill_field_ = 1;  // Boolean but exposed as uint32 to JS land.
 +  uint32_t* zero_fill_field_ = nullptr;  // Boolean but exposed as uint32 to JS land.
    std::atomic<size_t> total_mem_usage_ {0};
  
@@ -434,26 +515,3 @@ index ef659f1c39f7ee958879bf395377bc99911fc346..225b1465b7c97d972a38968faf6d6850
    auto ab = ArrayBuffer::New(isolate, std::move(bs));
    v8::Local<Uint8Array> u8 = v8::Uint8Array::New(ab, 0, 1);
  
-diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
-index 07e38748b07ddd32a6e3caa3c34183387e1cae18..f09bf0940dad2068f0aa5dce783dd422773d4bbb 100644
---- a/test/parallel/test-process-env-allowed-flags-are-documented.js
-+++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
-@@ -49,6 +49,8 @@ if (!hasOpenSSL3) {
-   documented.delete('--openssl-shared-config');
- }
- 
-+const isV8Sandboxed = process.config.variables.v8_enable_sandbox;
-+
- // Filter out options that are conditionally present.
- const conditionalOpts = [
-   {
-@@ -74,6 +76,9 @@ const conditionalOpts = [
-   }, {
-     include: process.features.inspector,
-     filter: (opt) => opt.startsWith('--inspect') || opt === '--debug-port'
-+  }, {
-+    include: !isV8Sandboxed,
-+    filter: (opt) => ['--secure-heap', '--secure-heap-min'].includes(opt)
-   },
- ];
- documented.forEach((opt) => {

patches/node/test_formally_mark_some_tests_as_flaky.patch

@@ -7,7 +7,7 @@ Instead of disabling the tests, flag them as flaky so they still run
 but don't cause CI failures on flakes.
 
 diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
-index bf040bf2ee9c727542e347f3467e04a29bfd1b63..9dcd28bc499aa2b1ba313ab9e921d6835140cc92 100644
+index 8ac30c589926a46356f44076a21f8c18057378e1..8531599f1c1474640bf804737244129c5860b0bd 100644
 --- a/test/parallel/parallel.status
 +++ b/test/parallel/parallel.status
 @@ -5,6 +5,16 @@ prefix parallel

patches/node/test_make_buffer_sizes_32bit-aware_in.patch

@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ren=C3=A9?= <contact.9a5d6388@renegade334.me.uk>
+Date: Sat, 20 Dec 2025 22:20:21 +0000
+Subject: test: make buffer sizes 32bit-aware in
+ test-internal-util-construct-sab
+
+PR-URL: https://github.com/nodejs/node/pull/61026
+Fixes: https://github.com/nodejs/node/issues/61025
+Refs: https://github.com/nodejs/node/pull/60497
+Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
+
+diff --git a/test/parallel/test-internal-util-construct-sab.js b/test/parallel/test-internal-util-construct-sab.js
+index 5ff9b09f8e7d36a91825a38e861b8c2615c62500..403b59809e47d2e1d3503a059826f66334a2f035 100644
+--- a/test/parallel/test-internal-util-construct-sab.js
++++ b/test/parallel/test-internal-util-construct-sab.js
+@@ -3,16 +3,20 @@
+ 
+ require('../common');
+ const assert = require('assert');
++const { kMaxLength } = require('buffer');
+ const { isSharedArrayBuffer } = require('util/types');
+ const { constructSharedArrayBuffer } = require('internal/util');
+ 
+ // We're testing that we can construct a SAB even when the global is not exposed.
+ assert.strictEqual(typeof SharedArrayBuffer, 'undefined');
+ 
+-for (const length of [undefined, 0, 1, 2 ** 32]) {
++for (const length of [undefined, 0, 1, 2 ** 16]) {
+   assert(isSharedArrayBuffer(constructSharedArrayBuffer(length)));
+ }
+ 
+-for (const length of [-1, Number.MAX_SAFE_INTEGER + 1, 2 ** 64]) {
++// Specifically test the following cases:
++// - out-of-range allocation requests should not crash the process
++// - no int64 overflow
++for (const length of [-1, kMaxLength + 1, 2 ** 64]) {
+   assert.throws(() => constructSharedArrayBuffer(length), RangeError);
+ }

script/node-disabled-tests.json

@@ -107,10 +107,12 @@
   "parallel/test-tls-multi-key",
   "parallel/test-tls-multi-pfx",
   "parallel/test-tls-no-cert-required",
+  "parallel/test-tls-no-sslv23.js",
   "parallel/test-tls-options-boolean-check",
   "parallel/test-tls-passphrase",
   "parallel/test-tls-peer-certificate",
   "parallel/test-tls-pfx-authorizationerror",
+  "parallel/test-tls-psk-alpn-callback-exception-handling",
   "parallel/test-tls-psk-circuit",
   "parallel/test-tls-reduced-SECLEVEL-in-cipher",
   "parallel/test-tls-root-certificates",