docs: clearer wording (performance common pitfalls)

Signed-off-by: Soobin Rho <soobinrho@gmail.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,3 +1,6 @@
+> [!IMPORTANT]
+> Please note that code reviews and merges will be delayed during our [quiet period in December](https://www.electronjs.org/blog/dec-quiet-period-25) and might not happen until January.
+
 #### Description of Change
 
 <!--

.github/actions/build-electron/action.yml

@@ -188,7 +188,7 @@ runs:
       shell: bash
       run: |
         cd src/electron
-        node script/yarn create-typescript-definitions
+        node script/yarn.js create-typescript-definitions
     - name: Publish Electron Dist ${{ inputs.step-suffix }}
       if: ${{ inputs.is-release == 'true' }}
       shell: bash

.github/actions/checkout/action.yml

@@ -152,7 +152,7 @@ runs:
     if: ${{ inputs.target-platform == 'linux' && github.ref == 'refs/heads/main' }}
     shell: bash
     run: |
-      npx node src/electron/script/patches-stats.mjs --upload-stats || true
+      node src/electron/script/patches-stats.mjs --upload-stats || true
   # delete all .git directories under src/ except for
   # third_party/angle/ and third_party/dawn/ because of build time generation of files
   # gen/angle/commit.h depends on third_party/angle/.git/HEAD

.github/actions/free-space-macos/action.yml

@@ -64,15 +64,26 @@ runs:
         sudo rm -rf /Applications/Xcode_16.1.app
         sudo rm -rf /Applications/Xcode_16.2.app
         sudo rm -rf /Applications/Xcode_16.3.app
+        sudo rm -rf /Applications/Xcode_26*
         sudo rm -rf /Applications/Google Chrome.app
         sudo rm -rf /Applications/Google Chrome for Testing.app
-        sudo rm -rf	/Applications/Firefox.app
+        sudo rm -rf /Applications/Firefox.app
+        sudo rm -rf /Applications/Microsoft Edge.app
         sudo rm -rf ~/project/src/third_party/catapult/tracing/test_data
         sudo rm -rf ~/project/src/third_party/angle/third_party/VK-GL-CTS
         sudo rm -rf /Users/runner/Library/Android
         sudo rm -rf $JAVA_HOME_11_arm64
         sudo rm -rf $JAVA_HOME_17_arm64
         sudo rm -rf $JAVA_HOME_21_arm64
+        sudo rm -rf $JAVA_HOME_25_arm64
+        sudo rm -rf /Users/runner/.dotnet/
+        sudo rm -rf /Users/runner/.rustup
+
+        # remove homebrew packages we don't need
+        if command -v brew &> /dev/null; then
+          brew uninstall -f --zap aws-sam-cli session-manager-plugin gcc gcc@13 gcc@14 llvm@18 gradle maven ant azure-cli
+          brew autoremove
+        fi
 
         # lipo off some huge binaries arm64 versions to save space
         strip_universal_deep $(xcode-select -p)/../SharedFrameworks

.github/actions/generate-types/action.yml

@@ -13,12 +13,16 @@ runs:
   - name: Generating Types for SHA in ${{ inputs.sha-file }}
     shell: bash
     run: |
-      git checkout $(cat ${{ inputs.sha-file }})
-      rm -rf node_modules
-      yarn install --frozen-lockfile --ignore-scripts
+      export ELECTRON_DIR=$(pwd)
+      if [ "${{ inputs.sha-file }}" == ".dig-old" ]; then
+        cd /tmp
+        git clone https://github.com/electron/electron.git
+        cd electron
+      fi
+      git checkout $(cat $ELECTRON_DIR/${{ inputs.sha-file }})
+      node script/yarn.js install --immutable
       echo "#!/usr/bin/env node\nglobal.x=1" > node_modules/typescript/bin/tsc
       node node_modules/.bin/electron-docs-parser --dir=./ --outDir=./ --moduleVersion=0.0.0-development
       node node_modules/.bin/electron-typescript-definitions --api=electron-api.json --outDir=artifacts
-      mv artifacts/electron.d.ts artifacts/${{ inputs.filename }}
-      git checkout .
+      mv artifacts/electron.d.ts $ELECTRON_DIR/artifacts/${{ inputs.filename }}
     working-directory: ./electron

.github/actions/install-dependencies/action.yml

@@ -6,7 +6,7 @@ runs:
   - name: Get yarn cache directory path
     shell: bash
     id: yarn-cache-dir-path
-    run: echo "dir=$(node src/electron/script/yarn cache dir)" >> $GITHUB_OUTPUT
+    run: echo "dir=$(node src/electron/script/yarn.js config get cacheFolder)" >> $GITHUB_OUTPUT
   - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
     id: yarn-cache
     with:
@@ -18,4 +18,14 @@ runs:
     shell: bash
     run: |
       cd src/electron
-      node script/yarn install --frozen-lockfile --prefer-offline
+      if [ "$TARGET_ARCH" = "x86" ]; then
+        export npm_config_arch="ia32"
+      fi
+      # if running on linux arm skip yarn Builds
+      ARCH=$(uname -m)
+      if [ "$ARCH" = "armv7l" ]; then
+        echo "Skipping yarn build on linux arm"
+        node script/yarn.js install --immutable --mode=skip-build
+      else
+        node script/yarn.js install --immutable
+      fi

.github/workflows/archaeologist-dig.yml

@@ -3,19 +3,23 @@ name: Archaeologist
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
    archaeologist-dig:
     name: Archaeologist Dig
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Electron
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
         with:
           fetch-depth: 0
       - name: Setup Node.js/npm
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
         with:
-          node-version: 20.19.x
+          node-version: 22.21.x
       - name: Setting Up Dig Site
         run: |
           echo "remote: ${{ github.event.pull_request.head.repo.clone_url }}"

.github/workflows/audit-branch-ci.yml

@@ -19,12 +19,22 @@ jobs:
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: 22.17.x
-      - run: npm install @actions/cache@4.0.3 @electron/fiddle-core@2.0.1
+      - name: Sparse checkout repository
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          sparse-checkout: |
+            .
+            .github
+            .yarn
+      - run: yarn workspaces focus @electron/gha-workflows
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         id: audit-errors
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
+            const { chdir } = require('node:process');
+            chdir('${{ github.workspace }}/.github/workflows');
+
             const cache = require('@actions/cache');
             const { ElectronVersions } = require('@electron/fiddle-core');
 
@@ -74,6 +84,7 @@ jobs:
                       !message.startsWith("Process completed with exit code") &&
                       !message.startsWith("Response status code does not indicate success") &&
                       !message.startsWith("The hosted runner lost communication with the server") &&
+                      !message.startsWith("Dependabot encountered an error performing the update") &&
                       !/Unable to make request/.test(message) &&
                       !/The requested URL returned error/.test(message),
                   )

.github/workflows/build-git-cache.yml

@@ -6,9 +6,13 @@ on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions: {}
+
 jobs:
   build-git-cache-linux:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root
@@ -19,7 +23,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -30,6 +34,8 @@ jobs:
 
   build-git-cache-windows:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -41,7 +47,7 @@ jobs:
       TARGET_OS: 'win'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -52,6 +58,8 @@ jobs:
 
   build-git-cache-macos:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     # This job updates the same git cache as linux, so it needs to run after the linux one.
     needs: build-git-cache-linux
     container:
@@ -64,7 +72,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/build.yml

@@ -43,10 +43,13 @@ defaults:
   run:
     shell: bash
 
+permissions: {}
+
 jobs:
   setup:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: read
     outputs:
         docs: ${{ steps.filter.outputs.docs }}
@@ -54,7 +57,7 @@ jobs:
         build-image-sha: ${{ steps.set-output.outputs.build-image-sha }}
         docs-only: ${{ steps.set-output.outputs.docs-only }}
     steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         ref: ${{ github.event.pull_request.head.sha }}
     - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -63,6 +66,10 @@ jobs:
         filters: |
           docs:
             - 'docs/**'
+            - README.md
+            - SECURITY.md
+            - CONTRIBUTING.md
+            - CODE_OF_CONDUCT.md
           src:
             - '!docs/**'
     - name: Set Outputs for Build Image SHA & Docs Only
@@ -80,6 +87,8 @@ jobs:
     needs: setup
     if: ${{ !inputs.skip-lint }}
     uses: ./.github/workflows/pipeline-electron-lint.yml
+    permissions:
+      contents: read
     with:
       container: '{"image":"ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}","options":"--user root"}'
     secrets: inherit
@@ -89,6 +98,8 @@ jobs:
     needs: [setup, checkout-linux]
     if: ${{ needs.setup.outputs.docs-only == 'true' }}
     uses: ./.github/workflows/pipeline-electron-docs-only.yml
+    permissions:
+      contents: read
     with:
       container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
     secrets: inherit
@@ -98,6 +109,8 @@ jobs:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-macos}}
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -111,7 +124,7 @@ jobs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -126,6 +139,8 @@ jobs:
     needs: setup
     if: ${{ !inputs.skip-linux}}
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -141,7 +156,7 @@ jobs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha}}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -155,6 +170,8 @@ jobs:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -171,7 +188,7 @@ jobs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha}}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -185,6 +202,8 @@ jobs:
   # GN Check Jobs
   macos-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       target-platform: macos
@@ -195,6 +214,8 @@ jobs:
 
   linux-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     if: ${{ needs.setup.outputs.src == 'true' }}
     with:
@@ -207,6 +228,8 @@ jobs:
 
   windows-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       target-platform: win
@@ -310,7 +333,7 @@ jobs:
       build-runs-on: electron-arc-centralus-linux-amd64-32core
       test-runs-on: electron-arc-centralus-linux-arm64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
-      test-container: '{"image":"ghcr.io/electron/test:arm32v7-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init","volumes":["/home/runner/externals:/mnt/runner-externals"]}'
+      test-container: '{"image":"ghcr.io/electron/test:arm32v7-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init --memory=12g","volumes":["/home/runner/externals:/mnt/runner-externals"]}'
       target-platform: linux
       target-arch: arm
       is-release: false
@@ -400,6 +423,8 @@ jobs:
   gha-done:
     name: GitHub Actions Completed
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     needs: [docs-only, macos-x64, macos-arm64, linux-x64, linux-x64-asan, linux-arm, linux-arm64, windows-x64, windows-x86, windows-arm64]
     if: always() && !contains(needs.*.result, 'failure')
     steps: 

.github/workflows/clean-src-cache.yml

@@ -1,16 +1,20 @@
 name: Clean Source Cache
 
-description: |
-  This workflow cleans up the source cache on the cross-instance cache volume
-  to free up space. It runs daily at midnight and clears files older than 15 days.
+# Description:
+# This workflow cleans up the source cache on the cross-instance cache volume
+# to free up space. It runs daily at midnight and clears files older than 15 days.
 
 on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions: {}
+
 jobs:
   clean-src-cache:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root

.github/workflows/issue-labeled.yml

@@ -4,14 +4,15 @@ on:
   issues:
     types: [labeled]
 
-permissions:  # added using https://github.com/step-security/secure-workflows
-  contents: read
+permissions: {}
 
 jobs:
   issue-labeled-with-status:
     name: status/{confirmed,reviewed} label added
     if: github.event.label.name == 'status/confirmed' || github.event.label.name == 'status/reviewed'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -31,6 +32,8 @@ jobs:
     name: blocked/* label added
     if: startsWith(github.event.label.name, 'blocked/')
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -72,7 +75,7 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
       - name: Create comment
         if: ${{ steps.check-for-comment.outputs.SHOULD_COMMENT }}
-        uses: actions-cool/issues-helper@50068f49b7b2b3857270ead65e2d02e4459b022c # v3.6.2
+        uses: actions-cool/issues-helper@9861779a695cf1898bd984c727f685f351cfc372 # v3.7.2
         with:
           actions: 'create-comment'
           token: ${{ steps.generate-token.outputs.token }}

.github/workflows/issue-opened.yml

@@ -11,6 +11,7 @@ jobs:
   add-to-issue-triage:
     if: ${{ contains(github.event.issue.labels.*.name, 'bug :beetle:') }}
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -28,6 +29,7 @@ jobs:
   set-labels:
     if: ${{ contains(github.event.issue.labels.*.name, 'bug :beetle:') }}
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -35,7 +37,14 @@ jobs:
         with:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
-      - run: npm install @electron/fiddle-core@1.3.3 mdast-util-from-markdown@2.0.0 unist-util-select@5.1.0 semver@7.6.0
+      - name: Sparse checkout repository
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          sparse-checkout: |
+            .
+            .github
+            .yarn
+      - run: yarn workspaces focus @electron/gha-workflows
       - name: Add labels
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         id: add-labels
@@ -44,9 +53,13 @@ jobs:
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
-            const { fromMarkdown } = await import('${{ github.workspace }}/node_modules/mdast-util-from-markdown/index.js');
-            const { select } = await import('${{ github.workspace }}/node_modules/unist-util-select/index.js');
-            const semver = await import('${{ github.workspace }}/node_modules/semver/index.js');
+            const { chdir } = require('node:process');
+            chdir('${{ github.workspace }}/.github/workflows');
+
+            const { ElectronVersions } = require('@electron/fiddle-core');
+            const { fromMarkdown } = require('mdast-util-from-markdown');
+            const { select } = require('unist-util-select');
+            const semver = require('semver');
 
             const [ owner, repo ] = '${{ github.repository }}'.split('/');
             const issue_number = ${{ github.event.issue.number }};
@@ -77,7 +90,6 @@ jobs:
                     labelExists = true;
                   } catch {}
 
-                  const { ElectronVersions } = await import('${{ github.workspace }}/node_modules/@electron/fiddle-core/dist/index.js');
                   const electronVersions = await ElectronVersions.create(undefined, { ignoreCache: true });
                   const validVersions = [...electronVersions.supportedMajors, ...electronVersions.prereleaseMajors];
 
@@ -134,7 +146,7 @@ jobs:
             }
       - name: Create unsupported major comment
         if: ${{ steps.add-labels.outputs.unsupportedMajor }}
-        uses: actions-cool/issues-helper@50068f49b7b2b3857270ead65e2d02e4459b022c # v3.6.2
+        uses: actions-cool/issues-helper@9861779a695cf1898bd984c727f685f351cfc372 # v3.7.2
         with:
           actions: 'create-comment'
           token: ${{ steps.generate-token.outputs.token }}

.github/workflows/issue-transferred.yml

@@ -10,6 +10,7 @@ jobs:
   issue-transferred:
     name: Issue Transferred
     runs-on: ubuntu-latest
+    permissions: {}
     if: ${{ !github.event.changes.new_repository.private }}
     steps:
       - name: Generate GitHub App token

.github/workflows/issue-unlabeled.yml

@@ -4,14 +4,15 @@ on:
   issues:
     types: [unlabeled]
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   issue-unlabeled-blocked:
     name: All blocked/* labels removed
     if: startsWith(github.event.label.name, 'blocked/') && github.event.issue.state == 'open'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check for any blocked labels
         id: check-for-blocked-labels

.github/workflows/linux-publish.yml

@@ -17,9 +17,13 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   checkout-linux:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root
@@ -31,7 +35,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -40,6 +44,8 @@ jobs:
 
   publish-x64:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     with:
       environment: production-release
@@ -55,6 +61,8 @@ jobs:
 
   publish-arm:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     with:
       environment: production-release
@@ -70,6 +78,8 @@ jobs:
 
   publish-arm64:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     with:
       environment: production-release

.github/workflows/macos-disk-cleanup.yml

@@ -0,0 +1,104 @@
+name: macOS Disk Space Cleanup
+
+# Description:
+# This workflow runs the disk space reclaimer on macOS runners every night
+# and logs disk space metrics to Datadog for monitoring.
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  macos-disk-cleanup:
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - macos-15
+          - macos-15-large
+          - macos-15-xlarge
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: |
+            .github/actions/free-space-macos
+          sparse-checkout-cone-mode: false
+
+      - name: Get Disk Space Before Cleanup
+        id: disk-before
+        shell: bash
+        run: |
+          echo "Disk space before cleanup:"
+          df -h /
+          FREE_SPACE_BEFORE=$(df -k / | tail -1 | awk '{print $4}')
+          echo "free_kb=$FREE_SPACE_BEFORE" >> $GITHUB_OUTPUT
+
+      - name: Free Space on macOS
+        uses: ./.github/actions/free-space-macos
+
+      - name: Get Disk Space After Cleanup
+        id: disk-after
+        shell: bash
+        run: |
+          echo "Disk space after cleanup:"
+          df -h /
+          FREE_SPACE_AFTER=$(df -k / | tail -1 | awk '{print $4}')
+          echo "free_kb=$FREE_SPACE_AFTER" >> $GITHUB_OUTPUT
+
+      - name: Log Disk Space to Datadog
+        if: ${{ env.DD_API_KEY != '' }}
+        shell: bash
+        env:
+          DD_API_KEY: ${{ secrets.DD_API_KEY }}
+          FREE_BEFORE: ${{ steps.disk-before.outputs.free_kb }}
+          FREE_AFTER: ${{ steps.disk-after.outputs.free_kb }}
+          MATRIX_RUNNER: ${{ matrix.runner }}
+        run: |
+          TIMESTAMP=$(date +%s)
+          FREE_BEFORE_GB=$(echo "scale=2; $FREE_BEFORE / 1024 / 1024" | bc)
+          FREE_AFTER_GB=$(echo "scale=2; $FREE_AFTER / 1024 / 1024" | bc)
+          SPACE_FREED_GB=$(echo "scale=2; ($FREE_AFTER - $FREE_BEFORE) / 1024 / 1024" | bc)
+
+          echo "Free space before: ${FREE_BEFORE_GB}GB"
+          echo "Free space after: ${FREE_AFTER_GB}GB"
+          echo "Space freed: ${SPACE_FREED_GB}GB"
+
+          curl -s -X POST "https://api.datadoghq.com/api/v2/series" \
+            -H "Content-Type: application/json" \
+            -H "DD-API-KEY: ${DD_API_KEY}" \
+            -d @- << EOF
+          {
+            "series": [
+              {
+                "metric": "electron.macos.disk.free_space_before_cleanup_gb",
+                "points": [{"timestamp": ${TIMESTAMP}, "value": ${FREE_BEFORE_GB}}],
+                "type": 3,
+                "unit": "gigabyte",
+                "tags": ["runner:${MATRIX_RUNNER}", "platform:macos"]
+              },
+              {
+                "metric": "electron.macos.disk.free_space_after_cleanup_gb",
+                "points": [{"timestamp": ${TIMESTAMP}, "value": ${FREE_AFTER_GB}}],
+                "type": 3,
+                "unit": "gigabyte",
+                "tags": ["runner:${MATRIX_RUNNER}", "platform:macos"]
+              },
+              {
+                "metric": "electron.macos.disk.space_freed_gb",
+                "points": [{"timestamp": ${TIMESTAMP}, "value": ${SPACE_FREED_GB}}],
+                "type": 3,
+                "unit": "gigabyte",
+                "tags": ["runner:${MATRIX_RUNNER}", "platform:macos"]
+              }
+            ]
+          }
+          EOF
+
+          echo "Disk space metrics logged to Datadog"

.github/workflows/macos-publish.yml

@@ -18,9 +18,13 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   checkout-macos:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root
@@ -32,7 +36,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -44,6 +48,8 @@ jobs:
 
   publish-x64-darwin:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -59,6 +65,8 @@ jobs:
 
   publish-x64-mas:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -74,6 +82,8 @@ jobs:
 
   publish-arm64-darwin:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -89,6 +99,8 @@ jobs:
 
   publish-arm64-mas:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release

.github/workflows/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@electron/gha-workflows",
+  "version": "0.0.0-development",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@actions/cache": "^4.0.3",
+    "@electron/fiddle-core": "^2.0.1",
+    "mdast-util-from-markdown": "^2.0.0",
+    "semver": "^7.7.2",
+    "unist-util-select": "^5.1.0"
+  }
+}

.github/workflows/pipeline-electron-build-and-test-and-nan.yml

@@ -55,6 +55,8 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 concurrency:
   group: electron-build-and-test-and-nan-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -62,6 +64,8 @@ concurrency:
 jobs:
   build:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     with:
       build-runs-on: ${{ inputs.build-runs-on }}
       build-container: ${{ inputs.build-container }}
@@ -74,6 +78,10 @@ jobs:
     secrets: inherit
   test:
     uses: ./.github/workflows/pipeline-segment-electron-test.yml
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}
@@ -83,6 +91,8 @@ jobs:
     secrets: inherit
   nn-test:
     uses: ./.github/workflows/pipeline-segment-node-nan-test.yml
+    permissions:
+      contents: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}

.github/workflows/pipeline-electron-build-and-test.yml

@@ -64,14 +64,13 @@ concurrency:
   group: electron-build-and-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
 
-permissions:
-  contents: read
-  issues: read
-  pull-requests: read  
+permissions: {}
 
 jobs:
   build:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     with:
       build-runs-on: ${{ inputs.build-runs-on }}
       build-container: ${{ inputs.build-container }}
@@ -86,6 +85,10 @@ jobs:
     secrets: inherit
   test:
     uses: ./.github/workflows/pipeline-segment-electron-test.yml
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}

.github/workflows/pipeline-electron-docs-only.yml

@@ -8,6 +8,8 @@ on:
         description: 'Container to run the docs-only ts compile in'
         type: string
 
+permissions: {}
+
 concurrency:
   group: electron-docs-only-${{ github.ref }}
   cancel-in-progress: true
@@ -19,11 +21,13 @@ jobs:
   docs-only:
     name: Docs Only Compile
     runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -39,7 +43,7 @@ jobs:
       with:
         target-platform: linux
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -50,12 +54,12 @@ jobs:
       shell: bash
       run: |
         cd src/electron
-        node script/yarn create-typescript-definitions
-        node script/yarn tsc -p tsconfig.default_app.json --noEmit
+        node script/yarn.js create-typescript-definitions
+        node script/yarn.js tsc -p tsconfig.default_app.json --noEmit
         for f in build/webpack/*.js
         do
             out="${f:29}"
             if [ "$out" != "base.js" ]; then
-            node script/yarn webpack --config $f --output-filename=$out --output-path=./.tmp --env mode=development
+            node script/yarn.js webpack --config $f --output-filename=$out --output-path=./.tmp --env mode=development
             fi
         done

.github/workflows/pipeline-electron-lint.yml

@@ -8,6 +8,8 @@ on:
         description: 'Container to run lint in'
         type: string
 
+permissions: {}
+
 concurrency:
   group: electron-lint-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -19,11 +21,13 @@ jobs:
   lint:
     name: Lint
     runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -74,11 +78,11 @@ jobs:
         # but then we would lint its contents (at least gn format), and it doesn't pass it.
 
         cd src/electron
-        node script/yarn install --frozen-lockfile
-        node script/yarn lint
+        node script/yarn.js install --immutable
+        node script/yarn.js lint
     - name: Run Script Typechecker
       shell: bash
       run: |
         cd src/electron
-        node script/yarn tsc -p tsconfig.script.json
+        node script/yarn.js tsc -p tsconfig.script.json
     

.github/workflows/pipeline-segment-electron-build.yml

@@ -59,6 +59,8 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 concurrency:
   group: electron-build-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.target-variant }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -81,6 +83,8 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.build-runs-on }}
+    permissions:
+      contents: read
     container: ${{ fromJSON(inputs.build-container) }}
     environment: ${{ inputs.environment }}
     env:
@@ -91,7 +95,7 @@ jobs:
       run: |
         mkdir src
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -117,7 +121,7 @@ jobs:
       if: ${{ inputs.target-platform == 'macos' }}
       uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
       with:
-        node-version: 20.19.x
+        node-version: 22.21.x
         cache: yarn
         cache-dependency-path: src/electron/yarn.lock
     - name: Install Dependencies
@@ -159,7 +163,7 @@ jobs:
       if: ${{ inputs.target-platform == 'linux' }}
       uses: ./src/electron/.github/actions/restore-cache-aks
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-segment-electron-gn-check.yml

@@ -26,6 +26,8 @@ on:
         type: string
         default: testing
 
+permissions: {}
+
 concurrency:
   group: electron-gn-check-${{ inputs.target-platform }}-${{ github.ref }}
   cancel-in-progress: true
@@ -41,10 +43,12 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.check-runs-on }}
+    permissions:
+      contents: read
     container: ${{ fromJSON(inputs.check-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -111,7 +115,7 @@ jobs:
     - name: Add CHROMIUM_BUILDTOOLS_PATH to env
       run: echo "CHROMIUM_BUILDTOOLS_PATH=$(pwd)/src/buildtools" >> $GITHUB_ENV
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-segment-electron-test.yml

@@ -35,10 +35,7 @@ concurrency:
   group: electron-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
 
-permissions:
-  contents: read
-  issues: read
-  pull-requests: read
+permissions: {}
 
 env:
   CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
@@ -53,6 +50,10 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.test-runs-on }}
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     container: ${{ fromJSON(inputs.test-container) }}
     strategy:
       fail-fast: false
@@ -73,7 +74,7 @@ jobs:
       if: ${{ inputs.target-platform == 'win' }}
       uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
       with:
-        node-version: 20.19.x
+        node-version: 22.21.x
     - name: Add TCC permissions on macOS
       if: ${{ inputs.target-platform == 'macos' }}
       run: |
@@ -118,7 +119,7 @@ jobs:
       if: ${{ inputs.target-platform == 'macos' }}
       run: sudo xcode-select --switch /Applications/Xcode_16.4.app
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -196,10 +197,7 @@ jobs:
     #    sudo security authorizationdb write com.apple.trust-settings.admin allow
     #    cd src/electron
     #    ./script/codesign/generate-identity.sh
-    - name: Install Datadog CLI
-      run: |
-        cd src/electron
-        node script/yarn global add @datadog/datadog-ci
+
     - name: Run Electron Tests
       shell: bash
       env:
@@ -225,7 +223,7 @@ jobs:
               export ELECTRON_FORCE_TEST_SUITE_EXIT="true"
             fi
           fi
-          node script/yarn test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
+          node script/yarn.js test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
         else
           chown :builduser .. && chmod g+w ..
           chown -R :builduser . && chmod -R g+w .
@@ -242,9 +240,14 @@ jobs:
             export MOCHA_TIMEOUT=180000
             echo "Piping output to ASAN_SYMBOLIZE ($ASAN_SYMBOLIZE)"
             cd electron
-            runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn test --runners=main --trace-uncaught --enable-logging --files $tests_files | $ASAN_SYMBOLIZE
+            runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --runners=main --trace-uncaught --enable-logging --files $tests_files | $ASAN_SYMBOLIZE
           else
-            runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn test --runners=main --trace-uncaught --enable-logging --files $tests_files
+            if [ "${{ inputs.target-arch }}" = "arm" ]; then
+              runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --skipYarnInstall --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
+            else 
+              runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
+            fi
+            
           fi
         fi
     - name: Upload Test results to Datadog
@@ -256,9 +259,10 @@ jobs:
         DD_TAGS: "os.architecture:${{ inputs.target-arch }},os.family:${{ inputs.target-platform }},os.platform:${{ inputs.target-platform }},asan:${{ inputs.is-asan }}"
       run: |
         if ! [ -z $DD_API_KEY ] && [ -f src/electron/junit/test-results-main.xml ]; then
-          export DATADOG_PATH=`node src/electron/script/yarn global bin`
-          $DATADOG_PATH/datadog-ci junit upload src/electron/junit/test-results-main.xml
-        fi          
+          cd src/electron
+          export DATADOG_PATH=`node script/yarn.js bin datadog-ci`
+          $DATADOG_PATH junit upload junit/test-results-main.xml
+        fi
       if: always() && !cancelled()
     - name: Upload Test Artifacts
       if: always() && !cancelled()

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -26,6 +26,8 @@ on:
         type: string
         default: testing
 
+permissions: {}
+
 concurrency:
   group: electron-node-nan-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -39,6 +41,8 @@ jobs:
   node-tests:
     name: Run Node.js Tests
     runs-on: electron-arc-centralus-linux-amd64-8core
+    permissions:
+      contents: read
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}
@@ -46,7 +50,7 @@ jobs:
     container: ${{ fromJSON(inputs.test-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -93,6 +97,8 @@ jobs:
   nan-tests:
     name: Run Nan Tests
     runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}
@@ -100,7 +106,7 @@ jobs:
     container: ${{ fromJSON(inputs.test-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -132,10 +138,16 @@ jobs:
         unzip -:o dist.zip
     - name: Setup Linux for Headless Testing
       run: sh -e /etc/init.d/xvfb start
+    - name: Add Clang problem matcher
+      shell: bash
+      run: echo "::add-matcher::src/electron/.github/problem-matchers/clang.json"
     - name: Run Nan Tests
       run: |
         cd src
         node electron/script/nan-spec-runner.js
+    - name: Remove Clang problem matcher
+      shell: bash
+      run: echo "::remove-matcher owner=clang::"
     - name: Wait for active SSH sessions
       shell: bash
       if: always() && !cancelled()

.github/workflows/pull-request-labeled.yml

@@ -11,6 +11,7 @@ jobs:
     name: backport/requested label added
     if: github.event.label.name == 'backport/requested 🗳'
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Trigger Slack workflow
         uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
@@ -28,6 +29,7 @@ jobs:
     name: deprecation-review/complete label added
     if: github.event.label.name == 'deprecation-review/complete ✅'
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/scorecards.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 
@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5
+        uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v3.29.5
         with:
           sarif_file: results.sarif

.github/workflows/semantic.yml

@@ -7,8 +7,7 @@ on:
       - edited
       - synchronize
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   main:

.github/workflows/stable-prep-items.yml

@@ -11,6 +11,7 @@ jobs:
   check-stable-prep-items:
     name: Check Stable Prep Items
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/stale.yml

@@ -10,6 +10,7 @@ permissions: {}
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -31,6 +32,7 @@ jobs:
           only-pr-labels: not-a-real-label
   pending-repro:
     runs-on: ubuntu-latest
+    permissions: {}
     if: ${{ always() }}
     needs: stale
     steps:

.github/workflows/windows-publish.yml

@@ -18,9 +18,13 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   checkout-windows:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -36,7 +40,7 @@ jobs:
       build-image-sha: ${{ inputs.build-image-sha }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       with:
         path: src/electron
         fetch-depth: 0
@@ -48,6 +52,8 @@ jobs:
 
   publish-x64-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       environment: production-release
@@ -62,6 +68,8 @@ jobs:
 
   publish-arm64-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       environment: production-release
@@ -76,6 +84,8 @@ jobs:
 
   publish-x86-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       environment: production-release

.gitignore

@@ -53,3 +53,5 @@ ts-gen
 patches/mtime-cache.json
 
 spec/fixtures/logo.png
+
+.yarn/install-state.gz

.yarnrc.yml

@@ -0,0 +1,12 @@
+enableScripts: false
+
+nmHoistingLimits: workspaces
+
+nodeLinker: node-modules
+
+npmMinimalAgeGate: 10080
+
+npmPreapprovedPackages:
+  - "@electron/*"
+
+yarnPath: .yarn/releases/yarn-4.11.0.cjs

BUILD.gn

@@ -480,6 +480,7 @@ source_set("electron_lib") {
     "//device/bluetooth",
     "//device/bluetooth/public/cpp",
     "//gin",
+    "//gpu/ipc/client",
     "//media/capture/mojom:video_capture",
     "//media/mojo/mojom",
     "//media/mojo/mojom:web_speech_recognition",
@@ -761,11 +762,13 @@ source_set("electron_lib") {
   if (enable_pdf_viewer) {
     deps += [
       "//chrome/browser/resources/pdf:resources",
+      "//chrome/browser/ui:browser_element_identifiers",
       "//components/pdf/browser",
       "//components/pdf/browser:interceptors",
       "//components/pdf/common:constants",
       "//components/pdf/common:util",
       "//components/pdf/renderer",
+      "//components/user_education/webui",
       "//pdf",
       "//pdf:content_restriction",
     ]

DEPS

@@ -2,9 +2,9 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '143.0.7497.0',
+    '144.0.7527.0',
   'node_version':
-    'v22.20.0',
+    'v24.11.1',
   'nan_version':
     '675cefebca42410733da8a454c8d9391fcebfbc2',
   'squirrel.mac_version':
@@ -12,7 +12,7 @@ vars = {
   'reactiveobjc_version':
     '74ab5baccc6f7202c8ac69a8d1e152c29dc1ea76',
   'mantle_version':
-    '78d3966b3c331292ea29ec38661b25df0a245948',
+    '2a8e2123a3931038179ee06105c9e6ec336b12ea',
   'engflow_reclient_configs_version':
     '955335c30a752e9ef7bff375baab5e0819b6c00d',
 
@@ -30,9 +30,6 @@ vars = {
   # The path of the sysroots.json file.
   'sysroots_json_path': 'electron/script/sysroots.json',
 
-  # KEEP IN SYNC WITH utils.js FILE
-  'yarn_version': '1.22.22',
-
   # To be able to build clean Chromium from sources.
   'apply_patches': True,
 
@@ -155,7 +152,7 @@ hooks = [
     'action': [
       'python3',
       '-c',
-      'import os, subprocess; os.chdir(os.path.join("src", "electron")); subprocess.check_call(["python3", "script/lib/npx.py", "yarn@' + (Var("yarn_version")) + '", "install", "--frozen-lockfile"]);',
+      'import os, subprocess; os.chdir(os.path.join("src", "electron")); subprocess.check_call(["node", ".yarn/releases/yarn-4.11.0.cjs", "install", "--immutable"]);',
     ],
   },
   {

README.md

@@ -37,7 +37,7 @@ For more installation options and troubleshooting tips, see
 
 Each Electron release provides binaries for macOS, Windows, and Linux.
 
-* macOS (Big Sur and up): Electron provides 64-bit Intel and Apple Silicon / ARM binaries for macOS.
+* macOS (Monterey and up): Electron provides 64-bit Intel and Apple Silicon / ARM binaries for macOS.
 * Windows (Windows 10 and up): Electron provides `ia32` (`x86`), `x64` (`amd64`), and `arm64` binaries for Windows. Windows on ARM support was added in Electron 5.0.8. Support for Windows 7, 8 and 8.1 was [removed in Electron 23, in line with Chromium's Windows deprecation policy](https://www.electronjs.org/blog/windows-7-to-8-1-deprecation-notice).
 * Linux: The prebuilt binaries of Electron are built on Ubuntu 22.04. They have also been verified to work on:
   * Ubuntu 18.04 and newer

chromium_src/BUILD.gn

@@ -383,6 +383,8 @@ static_library("chrome") {
         "//chrome/browser/pdf/chrome_pdf_stream_delegate.h",
         "//chrome/browser/pdf/pdf_extension_util.cc",
         "//chrome/browser/pdf/pdf_extension_util.h",
+        "//chrome/browser/pdf/pdf_help_bubble_handler_factory.cc",
+        "//chrome/browser/pdf/pdf_help_bubble_handler_factory.h",
         "//chrome/browser/pdf/pdf_viewer_stream_manager.cc",
         "//chrome/browser/pdf/pdf_viewer_stream_manager.h",
         "//chrome/browser/plugins/pdf_iframe_navigation_throttle.cc",
@@ -391,6 +393,8 @@ static_library("chrome") {
       deps += [
         "//components/pdf/browser",
         "//components/pdf/renderer",
+        "//ui/base/interaction",
+        "//ui/webui/resources/cr_components/help_bubble:mojo_bindings",
       ]
     }
   } else {

docs/api/app.md

@@ -565,8 +565,9 @@ and subscribing to the `ready` event if the app is not ready yet.
   * `steal` boolean _macOS_ - Make the receiver the active app even if another app is
   currently active.
 
-On Linux, focuses on the first visible window. On macOS, makes the application
-the active app. On Windows, focuses on the application's first window.
+On macOS, makes the application the active app. On Windows, focuses on the application's
+first window. On Linux, either focuses on the first visible window (X11) or requests
+focus but may instead show a notification or flash the app icon (Wayland).
 
 You should seek to use the `steal` option as sparingly as possible.
 
@@ -1217,7 +1218,7 @@ This method can only be called before app is ready.
 
 ### `app.isHardwareAccelerationEnabled()`
 
-Returns `boolean` - whether hardware acceleration is currently disabled.
+Returns `boolean` - whether hardware acceleration is currently enabled.
 
  > [!NOTE]
  > This information is only usable after the `gpu-info-update` event is emitted.

docs/api/browser-window.md

@@ -140,6 +140,10 @@ state is `hidden` in order to minimize power consumption.
   move.
 * On Linux the type of modal windows will be changed to `dialog`.
 * On Linux many desktop environments do not support hiding a modal window.
+* On Wayland (Linux) it is generally not possible to programmatically resize windows
+  after creation, or to position, move, focus, or blur windows without user input.
+  If your app needs these capabilities, run it in Xwayland by appending the flag
+  `--ozone-platform=x11`.
 
 ## Class: BrowserWindow extends `BaseWindow`
 
@@ -656,10 +660,15 @@ the [close event](#event-close).
 
 Focuses on the window.
 
+On Wayland (Linux), the desktop environment may show a notification or flash
+the app icon if the window or app is not already focused.
+
 #### `win.blur()`
 
 Removes focus from the window.
 
+Not supported on Wayland (Linux).
+
 #### `win.isFocused()`
 
 Returns `boolean` - Whether the window is focused.
@@ -676,6 +685,8 @@ Shows and gives focus to the window.
 
 Shows the window but doesn't focus on it.
 
+Not supported on Wayland (Linux).
+
 #### `win.hide()`
 
 Hides the window.
@@ -824,6 +835,8 @@ Closes the currently open [Quick Look][quick-look] panel.
 
 Resizes and moves the window to the supplied bounds. Any properties that are not supplied will default to their current values.
 
+On Wayland (Linux), has the same limitations as `setSize` and `setPosition`.
+
 ```js
 const { BrowserWindow } = require('electron')
 
@@ -866,6 +879,8 @@ See [Setting `backgroundColor`](#setting-the-backgroundcolor-property).
 Resizes and moves the window's client area (e.g. the web page) to
 the supplied bounds.
 
+On Wayland (Linux), has the same limitations as `setContentSize` and `setPosition`.
+
 #### `win.getContentBounds()`
 
 Returns [`Rectangle`](structures/rectangle.md) - The `bounds` of the window's client area as `Object`.
@@ -895,6 +910,8 @@ Returns `boolean` - whether the window is enabled.
 
 Resizes the window to `width` and `height`. If `width` or `height` are below any set minimum size constraints the window will snap to its minimum size.
 
+On Wayland (Linux), may not work as some window managers restrict programmatic window resizing.
+
 #### `win.getSize()`
 
 Returns `Integer[]` - Contains the window's width and height.
@@ -907,6 +924,8 @@ Returns `Integer[]` - Contains the window's width and height.
 
 Resizes the window's client area (e.g. the web page) to `width` and `height`.
 
+On Wayland (Linux), may not work as some window managers restrict programmatic window resizing.
+
 #### `win.getContentSize()`
 
 Returns `Integer[]` - Contains the window's client area's width and height.
@@ -1044,12 +1063,16 @@ this method throws an error.
 
 #### `win.moveTop()`
 
-Moves window to top(z-order) regardless of focus
+Moves window to top(z-order) regardless of focus.
+
+Not supported on Wayland (Linux).
 
 #### `win.center()`
 
 Moves window to the center of the screen.
 
+Not supported on Wayland (Linux).
+
 #### `win.setPosition(x, y[, animate])`
 
 * `x` Integer
@@ -1058,6 +1081,8 @@ Moves window to the center of the screen.
 
 Moves window to `x` and `y`.
 
+Not supported on Wayland (Linux).
+
 #### `win.getPosition()`
 
 Returns `Integer[]` - Contains the window's current position.
@@ -1227,7 +1252,8 @@ Captures a snapshot of the page within `rect`. Omitting `rect` will capture the
 
 Returns `Promise<void>` - the promise will resolve when the page has finished loading
 (see [`did-finish-load`](web-contents.md#event-did-finish-load)), and rejects
-if the page fails to load (see [`did-fail-load`](web-contents.md#event-did-fail-load)).
+if the page fails to load (see
+[`did-fail-load`](web-contents.md#event-did-fail-load)). A noop rejection handler is already attached, which avoids unhandled rejection errors. If the existing page has a beforeUnload handler, [`did-fail-load`](web-contents.md#event-did-fail-load) will be called unless [`will-prevent-unload`](web-contents.md#event-did-fail-load) is handled.
 
 Same as [`webContents.loadURL(url[, options])`](web-contents.md#contentsloadurlurl-options).
 

docs/api/client-request.md

@@ -25,6 +25,11 @@ following properties:
     with which the request is associated. Defaults to the empty string. The
     `session` option supersedes `partition`. Thus if a `session` is explicitly
     specified, `partition` is ignored.
+  * `bypassCustomProtocolHandlers` boolean (optional) - When set to `true`,
+    custom protocol handlers registered for the request's URL scheme will not be
+    called. This allows forwarding an intercepted request to the built-in
+    handler. [webRequest](web-request.md) handlers will still be triggered
+    when bypassing custom protocols. Defaults to `false`.
   * `credentials` string (optional) - Can be `include`, `omit` or
     `same-origin`. Whether to send
     [credentials](https://fetch.spec.whatwg.org/#credentials) with this

docs/api/clipboard.md

@@ -2,10 +2,13 @@
 
 > Perform copy and paste operations on the system clipboard.
 
-Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process) (non-sandboxed only)
+Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process) _Deprecated_ (non-sandboxed only)
+
+> [!NOTE]
+> Using the `clipoard` API from the renderer process is deprecated.
 
 > [!IMPORTANT]
-> If you want to call this API from a renderer process with context isolation enabled,
+> If you want to call this API from a renderer process,
 > place the API call in your preload script and
 > [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
 > [`contextBridge`](context-bridge.md) API.

docs/api/command-line-switches.md

@@ -49,6 +49,10 @@ Disables the disk cache for HTTP requests.
 
 Disable HTTP/2 and SPDY/3.1 protocols.
 
+### --disable-geolocation _macOS_
+
+Disables the Geolocation API. Permission requests for geolocation will be denied internally regardless of the decision made by a handler set via `session.setPermissionRequestHandler`. This functionality is currently implemented only for macOS. Has no effect on other platforms.
+
 ### --disable-renderer-backgrounding
 
 Prevents Chromium from lowering the priority of invisible pages' renderer

docs/api/menu-item.md

@@ -34,7 +34,8 @@ See [`Menu`](menu.md) for examples.
   * `sublabel` string (optional) _macOS_ - Available in macOS >= 14.4
   * `toolTip` string (optional) _macOS_ - Hover text for this menu item.
   * `accelerator` string (optional) - An [Accelerator](../tutorial/keyboard-shortcuts.md#accelerators) string.
-  * `icon` ([NativeImage](native-image.md) | string) (optional)
+  * `icon` ([NativeImage](native-image.md) | string) (optional) - Can be a
+    [NativeImage](native-image.md) or the file path of an icon.
   * `enabled` boolean (optional) - If false, the menu item will be greyed out and
     unclickable.
   * `acceleratorWorksWhenHidden` boolean (optional) _macOS_ - default is `true`, and when `false` will prevent the accelerator from triggering the item if the item is not visible.

docs/api/menu.md

@@ -2,10 +2,15 @@
 
 ## Class: Menu
 
-> Create native application menus and context menus.
+> Create application menus and context menus.
 
 Process: [Main](../glossary.md#main-process)
 
+The presentation of menus varies depending on the operating system:
+
+- Under Windows and Linux, menus are visually similar to Chromium.
+- Under macOS, these will be native menus.
+
 > [!TIP]
 > See also: [A detailed guide about how to implement menus in your application](../tutorial/menus.md).
 

docs/api/native-image.md

@@ -202,8 +202,7 @@ Creates a new `NativeImage` instance from `dataUrl`, a base 64 encoded [Data URL
 Returns `NativeImage`
 
 Creates a new `NativeImage` instance from the `NSImage` that maps to the
-given image name. See Apple's [`NSImageName`](https://developer.apple.com/documentation/appkit/nsimagename#2901388)
-documentation for a list of possible values.
+given image name. See Apple's [`NSImageName`](https://developer.apple.com/documentation/appkit/nsimagename#2901388) documentation and [SF Symbols](https://developer.apple.com/sf-symbols/) for a list of possible values.
 
 The `hslShift` is applied to the image with the following rules:
 
@@ -231,6 +230,15 @@ echo -e '#import <Cocoa/Cocoa.h>\nint main() { NSLog(@"%@", SYSTEM_IMAGE_NAME);
 
 where `SYSTEM_IMAGE_NAME` should be replaced with any value from [this list](https://developer.apple.com/documentation/appkit/nsimagename?language=objc).
 
+For SF Symbols, usage looks as follows:
+
+```js
+const image = nativeImage.createFromNamedImage('square.and.pencil')
+```
+
+where `'square.and.pencil'` is the symbol name from the
+[SF Symbols app](https://developer.apple.com/sf-symbols/).
+
 ## Class: NativeImage
 
 > Natively wrap images such as tray, dock, and application icons.

docs/api/shared-texture.md

@@ -0,0 +1,58 @@
+# sharedTexture
+
+> Import shared textures into Electron and converts platform specific handles into [`VideoFrame`](https://developer.mozilla.org/en-US/docs/Web/API/VideoFrame). Supports all Web rendering systems, and can be transferred across Electron processes. Read [here](https://github.com/electron/electron/blob/main/shell/common/api/shared_texture/README.md) for more information.
+
+Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process)
+
+## Methods
+
+The `sharedTexture` module has the following methods:
+
+**Note:** Experimental APIs are marked as such and could be removed in the future.
+
+### `sharedTexture.importSharedTexture(options)` _Experimental_
+
+* `options` Object - Options for importing shared textures.
+  * `textureInfo` [SharedTextureImportTextureInfo](structures/shared-texture-import-texture-info.md) - The information of the shared texture to import.
+  * `allReferencesReleased` Function (optional) - Called when all references in all processes are released. You should keep the imported texture valid until this callback is called.
+
+Imports the shared texture from the given options.
+
+> [!NOTE]
+> This method is only available in the main process.
+
+Returns `SharedTextureImported` - The imported shared texture.
+
+### `sharedTexture.sendSharedTexture(options, ...args)` _Experimental_
+
+* `options` Object - Options for sending shared texture.
+  * `frame` [WebFrameMain](web-frame-main.md) - The target frame to transfer the shared texture to. For `WebContents`, you can pass `webContents.mainFrame`. If you provide a `webFrameMain` that is not a main frame, you'll need to enable `webPreferences.nodeIntegrationInSubFrames` for this, since this feature requires [IPC](https://www.electronjs.org/docs/latest/api/web-frame-main#frameipc-readonly) between main and the frame.
+  * `importedSharedTexture` [SharedTextureImported](structures/shared-texture-imported.md) - The imported shared texture.
+* `...args` any[] - Additional arguments to pass to the renderer process.
+
+Send the imported shared texture to a renderer process. You must register a receiver at renderer process before calling this method. This method has a 1000ms timeout. Ensure the receiver is set and the renderer process is alive before calling this method.
+
+> [!NOTE]
+> This method is only available in the main process.
+
+Returns `Promise<void>` - Resolves when the transfer is complete.
+
+### `sharedTexture.setSharedTextureReceiver(callback)` _Experimental_
+
+* `callback` Function\<Promise\<void\>\> - The function to receive the imported shared texture.
+  * `receivedSharedTextureData` Object - The data received from the main process.
+    * `importedSharedTexture` [SharedTextureImported](structures/shared-texture-imported.md) - The imported shared texture.
+  * `...args` any[] - Additional arguments passed from the main process.
+
+Set a callback to receive imported shared textures from the main process.
+
+> [!NOTE]
+> This method is only available in the renderer process.
+
+## Properties
+
+The `sharedTexture` module has the following properties:
+
+### `sharedTexture.subtle` _Experimental_
+
+A [`SharedTextureSubtle`](structures/shared-texture-subtle.md) property, provides subtle APIs for interacting with shared texture for advanced users.

docs/api/structures/base-window-options.md

@@ -72,6 +72,9 @@
   some GTK+3 desktop environments. Default is `false`.
 * `transparent` boolean (optional) - Makes the window [transparent](../../tutorial/custom-window-styles.md#transparent-windows).
   Default is `false`. On Windows, does not work unless the window is frameless.
+  When you add a [`View`](../view.md) to a `BaseWindow`, you'll need to call
+  [`view.setBackgroundColor`](../view.md#viewsetbackgroundcolorcolor) with a transparent
+  background color on that view to make its background transparent as well.
 * `type` string (optional) - The type of window, default is normal window. See more about
   this below.
 * `visualEffectState` string (optional) _macOS_ - Specify how the material

docs/api/structures/shared-texture-import-texture-info.md

@@ -0,0 +1,12 @@
+# SharedTextureImportTextureInfo Object
+
+* `pixelFormat` string - The pixel format of the texture.
+  * `bgra` - 32bpp BGRA (byte-order), 1 plane.
+  * `rgba` - 32bpp RGBA (byte-order), 1 plane.
+  * `rgbaf16` - Half float RGBA, 1 plane.
+  * `nv12` - 12bpp with Y plane followed by a 2x2 interleaved UV plane.
+* `colorSpace` [ColorSpace](color-space.md) (optional) - The color space of the texture.
+* `codedSize` [Size](size.md) - The full dimensions of the shared texture.
+* `visibleRect` [Rectangle](rectangle.md) (optional) - A subsection of [0, 0, codedSize.width, codedSize.height]. In common cases, it is the full section area.
+* `timestamp` number (optional) - A timestamp in microseconds that will be reflected to `VideoFrame`.
+* `handle` [SharedTextureHandle](shared-texture-handle.md) - The shared texture handle.

docs/api/structures/shared-texture-imported-subtle.md

@@ -0,0 +1,9 @@
+# SharedTextureImportedSubtle Object
+
+* `getVideoFrame` Function\<[VideoFrame](https://developer.mozilla.org/en-US/docs/Web/API/VideoFrame)\> - Create a `VideoFrame` that uses the imported shared texture in the current process. You can call `VideoFrame.close()` once you've finished using the object. The underlying resources will wait for GPU finish internally.
+* `release` Function - Release the resources. If you transferred and get multiple `SharedTextureImported` objects, you have to `release` every one of them. The resource on the GPU process will be destroyed when the last one is released.
+  * `callback` Function (optional) - Callback when the GPU command buffer finishes using this shared texture. It provides a precise event to safely release dependent resources. For example, if this object is created by `finishTransferSharedTexture`, you can use this callback to safely release the original one that called `startTransferSharedTexture` in other processes. You can also release the source shared texture that was used to `importSharedTexture` safely.
+* `startTransferSharedTexture` Function\<[SharedTextureTransfer](shared-texture-transfer.md)\> - Create a `SharedTextureTransfer` that can be serialized and transferred to other processes.
+* `getFrameCreationSyncToken` Function\<[SharedTextureSyncToken](shared-texture-sync-token.md)\> - This method is for advanced users. If used, it is typically called after `finishTransferSharedTexture`, and should be passed to the object which was called `startTransferSharedTexture` to prevent the source object release the underlying resource before the target object actually acquire the reference at gpu process asyncly.
+* `setReleaseSyncToken` Function - This method is for advanced users. If used, this object's underlying resource will not be released until the set sync token is fulfilled at gpu process. By using sync tokens, users are not required to use release callbacks for lifetime management.
+  * `syncToken` [SharedTextureSyncToken](shared-texture-sync-token.md) - The sync token to set.

docs/api/structures/shared-texture-imported.md

@@ -0,0 +1,6 @@
+# SharedTextureImported Object
+
+* `textureId` string - The unique identifier of the imported shared texture.
+* `getVideoFrame` Function\<[VideoFrame](https://developer.mozilla.org/en-US/docs/Web/API/VideoFrame)\> - Create a `VideoFrame` that uses the imported shared texture in the current process. You can call `VideoFrame.close()` once you've finished using the object. The underlying resources will wait for GPU finish internally.
+* `release` Function - Release this object's reference of the imported shared texture. The underlying resource will be alive until every reference is released.
+* `subtle` [SharedTextureImportedSubtle](shared-texture-imported-subtle.md) - Provides subtle APIs to interact with the imported shared texture for advanced users.

docs/api/structures/shared-texture-subtle.md

@@ -0,0 +1,6 @@
+# SharedTextureSubtle Object
+
+* `importSharedTexture` Function\<[SharedTextureImportedSubtle](shared-texture-imported-subtle.md)\> - Imports the shared texture from the given options. Returns the imported shared texture.
+  * `textureInfo` [SharedTextureImportTextureInfo](shared-texture-import-texture-info.md) - The information of shared texture to import.
+* `finishTransferSharedTexture` Function\<[SharedTextureImportedSubtle](shared-texture-imported-subtle.md)\> - Finishes the transfer of the shared texture and gets the transferred shared texture. Returns the imported shared texture from the transfer object.
+  * `transfer` [SharedTextureTransfer](shared-texture-transfer.md) - The transfer object of the shared texture.

docs/api/structures/shared-texture-sync-token.md

@@ -0,0 +1,3 @@
+# SharedTextureSyncToken Object
+
+* `syncToken` string - The opaque data for sync token.

docs/api/structures/shared-texture-transfer.md

@@ -0,0 +1,10 @@
+# SharedTextureTransfer Object
+
+* `transfer` string _Readonly_ - The opaque transfer data of the shared texture. This can be transferred across Electron processes.
+* `syncToken` string _Readonly_ - The opaque sync token data for frame creation.
+* `pixelFormat` string _Readonly_ - The pixel format of the transferring texture.
+* `codedSize` [Size](size.md) _Readonly_ - The full dimensions of the shared texture.
+* `visibleRect` [Rectangle](rectangle.md) _Readonly_ - A subsection of [0, 0, codedSize.width(), codedSize.height()]. In common cases, it is the full section area.
+* `timestamp` number _Readonly_ - A timestamp in microseconds that will be reflected to `VideoFrame`.
+
+Use `sharedTexture.subtle.finishTransferSharedTexture` to get [`SharedTextureImportedSubtle`](shared-texture-imported-subtle.md) back.

docs/api/web-contents.md

@@ -1079,7 +1079,7 @@ Emitted when the [mainFrame](web-contents.md#contentsmainframe-readonly), an `<i
 Returns `Promise<void>` - the promise will resolve when the page has finished loading
 (see [`did-finish-load`](web-contents.md#event-did-finish-load)), and rejects
 if the page fails to load (see
-[`did-fail-load`](web-contents.md#event-did-fail-load)). A noop rejection handler is already attached, which avoids unhandled rejection errors.
+[`did-fail-load`](web-contents.md#event-did-fail-load)). A noop rejection handler is already attached, which avoids unhandled rejection errors. If the existing page has a beforeUnload handler, [`did-fail-load`](web-contents.md#event-did-fail-load) will be called unless [`will-prevent-unload`](web-contents.md#event-did-fail-load) is handled.
 
 Loads the `url` in the window. The `url` must contain the protocol prefix,
 e.g. the `http://` or `file://`. If the load should bypass http cache then

docs/breaking-changes.md

@@ -12,6 +12,19 @@ This document uses the following convention to categorize breaking changes:
 * **Deprecated:** An API was marked as deprecated. The API will continue to function, but will emit a deprecation warning, and will be removed in a future release.
 * **Removed:** An API or feature was removed, and is no longer supported by Electron.
 
+## Planned Breaking API Changes (40.0)
+
+### Deprecated: `clipboard` API access from renderer processes
+
+Using the `clipboard` API directly in the renderer process is deprecated.
+If you want to call this API from a renderer process, place the API call in
+your preload script and expose it using the [contextBridge](https://www.electronjs.org/docs/latest/api/context-bridge) API.
+
+### Behavior Changed: MacOS dSYM files now compressed with tar.xz
+
+Debug symbols for MacOS (dSYM) now use xz compression in order to handle larger file sizes. `dsym.zip` files are now
+`dsym.tar.xz` files. End users using debug symbols may need to update their zip utilities.
+
 ## Planned Breaking API Changes (39.0)
 
 ### Deprecated: `--host-rules` command line switch
@@ -41,7 +54,7 @@ webContents.setWindowOpenHandler((details) => {
 
 When using shared texture offscreen rendering feature, the `paint` event now emits a more structured object.
 It moves the `sharedTextureHandle`, `planes`, `modifier` into a unified `handle` property.
-See [here](https://www.electronjs.org/docs/latest/api/structures/offscreen-shared-texture) for more details.
+See the [OffscreenSharedTexture](./api/structures/offscreen-shared-texture.md) API structure for more details.
 
 ## Planned Breaking API Changes (38.0)
 

docs/development/build-instructions-linux.md

@@ -6,77 +6,17 @@ Follow the guidelines below for building **Electron itself** on Linux, for the p
 
 ## Prerequisites
 
-* At least 25GB disk space and 8GB RAM.
-* Python >= 3.9.
-* [Node.js](https://nodejs.org/download/) >= 22.12.0
-* [clang](https://clang.llvm.org/get_started.html) 3.4 or later.
-* Development headers of GTK 3 and libnotify.
+Due to Electron's dependency on Chromium, prerequisites and dependencies for Electron change over time. [Chromium's documentation on building on Linux](https://chromium.googlesource.com/chromium/src/+/HEAD/docs/linux/build_instructions.md) has up to date information for building Chromium on Linux. This documentation can generally
+be followed for building Electron on Linux as well.
 
-On Ubuntu >= 20.04, install the following libraries:
-
-```sh
-$ sudo apt-get install build-essential clang libdbus-1-dev libgtk-3-dev \
-                       libnotify-dev libasound2-dev libcap-dev \
-                       libcups2-dev libxtst-dev \
-                       libxss1 libnss3-dev gcc-multilib g++-multilib curl \
-                       gperf bison python3-dbusmock openjdk-8-jre
-```
-
-On Ubuntu < 20.04, install the following libraries:
-
-```sh
-$ sudo apt-get install build-essential clang libdbus-1-dev libgtk-3-dev \
-                       libnotify-dev libgnome-keyring-dev \
-                       libasound2-dev libcap-dev libcups2-dev libxtst-dev \
-                       libxss1 libnss3-dev gcc-multilib g++-multilib curl \
-                       gperf bison python-dbusmock openjdk-8-jre
-```
-
-On RHEL / CentOS, install the following libraries:
-
-```sh
-$ sudo yum install clang dbus-devel gtk3-devel libnotify-devel \
-                   libgnome-keyring-devel xorg-x11-server-utils libcap-devel \
-                   cups-devel libXtst-devel alsa-lib-devel libXrandr-devel \
-                   nss-devel python-dbusmock openjdk-8-jre
-```
-
-On Fedora, install the following libraries:
-
-```sh
-$ sudo dnf install clang dbus-devel gperf gtk3-devel \
-                   libnotify-devel libgnome-keyring-devel libcap-devel \
-                   cups-devel libXtst-devel alsa-lib-devel libXrandr-devel \
-                   nss-devel python-dbusmock
-```
-
-On Arch Linux / Manjaro, install the following libraries:
-
-```sh
-$ sudo pacman -Syu base-devel clang libdbus gtk2 libnotify \
-                   libgnome-keyring alsa-lib libcap libcups libxtst \
-                   libxss nss gcc-multilib curl gperf bison \
-                   python2 python-dbusmock jdk8-openjdk
-```
-
-Other distributions may offer similar packages for installation via package
-managers such as pacman. Or one can compile from source code.
+Additionally, Electron's [Linux dependency installer](https://github.com/electron/build-images/blob/main/tools/install-deps.sh) can be referenced to get the current dependencies that Electron requires in addition to what Chromium installs via [build/install-deps.sh](https://chromium.googlesource.com/chromium/src/+/HEAD/build/install-build-deps.sh).
 
 ### Cross compilation
 
-If you want to build for an `arm` target you should also install the following
-dependencies:
+If you want to build for an `arm` target, you can use Electron's [Linux dependency installer](https://github.com/electron/build-images/blob/main/tools/install-deps.sh) to install the additional dependencies by passing the `--arm argument`:
 
 ```sh
-$ sudo apt-get install libc6-dev-armhf-cross linux-libc-dev-armhf-cross \
-                       g++-arm-linux-gnueabihf
-```
-
-Similarly for `arm64`, install the following:
-
-```sh
-$ sudo apt-get install libc6-dev-arm64-cross linux-libc-dev-arm64-cross \
-                       g++-aarch64-linux-gnu
+$ sudo install-deps.sh --arm
 ```
 
 And to cross-compile for `arm` or targets, you should pass the

docs/tutorial/devtools-extension.md

@@ -94,7 +94,7 @@ If the extension works on Chrome but not on Electron, file a bug in Electron's
 [issue tracker][issue-tracker] and describe which part
 of the extension is not working as expected.
 
-[devtools-extension]: https://developer.chrome.com/extensions/devtools
+[devtools-extension]: https://developer.chrome.com/docs/extensions/how-to/devtools/extend-devtools
 [session]: ../api/session.md
 [react-devtools]: https://chrome.google.com/webstore/detail/react-developer-tools/fmkadmapgofadopljbjfkapdkoienihi
 [load-extension]: ../api/extensions-api.md#extensionsloadextensionpath-options

docs/tutorial/electron-timelines.md

@@ -9,7 +9,7 @@ check out our [Electron Versioning](./electron-versioning.md) doc.
 
 | Electron | Alpha | Beta | Stable | EOL | Chrome | Node | Supported |
 | ------- | ----- | ------- | ------ | ------ | ---- | ---- | ---- |
-| 40.0.0 |  2025-Oct-30 | 2025-Dec-03 | 2025-Oct-28 | 2026-Jun-30 | M144 | TBD | ✅ |
+| 40.0.0 |  2025-Oct-30 | 2025-Dec-03 | 2026-Jan-13 | 2026-Jun-30 | M144 | TBD | ✅ |
 | 39.0.0 |  2025-Sep-04 | 2025-Oct-01 | 2025-Oct-28 | 2026-May-05 | M142 | v22.20 | ✅ |
 | 38.0.0 |  2025-Jun-26 | 2025-Aug-06 | 2025-Sep-02 | 2026-Mar-10 | M140 | v22.18 | ✅ |
 | 37.0.0 |  2025-May-01 | 2025-May-28 | 2025-Jun-24 | 2026-Jan-13 | M138 | v22.16 | ✅ |

docs/tutorial/native-file-drag-drop.md

@@ -110,4 +110,10 @@ the item is a Markdown file located in the root of the project:
 
 ![Drag and drop](../images/drag-and-drop.gif)
 
+## Dragging files into your app
+
+You can use the standard
+[Drag and Drop web API](https://developer.mozilla.org/en-US/docs/Web/API/HTML_Drag_and_Drop_API)
+for dragging and dropping files into your app.
+
 [`contextBridge`]: ../api/context-bridge.md

docs/tutorial/performance.md

@@ -60,7 +60,7 @@ at once, consider the [Chrome Tracing](https://www.chromium.org/developers/how-t
 ## Checklist: Performance recommendations
 
 Chances are that your app could be a little leaner, faster, and generally less
-resource-hungry if you attempt these steps.
+resource-hungry if you avoid the following common pitfalls.
 
 1. [Carelessly including modules](#1-carelessly-including-modules)
 2. [Loading and running code too soon](#2-loading-and-running-code-too-soon)

docs/tutorial/security.md

@@ -118,13 +118,6 @@ You should at least follow these steps to improve the security of your applicati
 19. [Check which fuses you can change](#19-check-which-fuses-you-can-change)
 20. [Do not expose Electron APIs to untrusted web content](#20-do-not-expose-electron-apis-to-untrusted-web-content)
 
-To automate the detection of misconfigurations and insecure patterns, it is
-possible to use
-[Electronegativity](https://github.com/doyensec/electronegativity). For
-additional details on potential weaknesses and implementation bugs when
-developing applications using Electron, please refer to this
-[guide for developers and auditors](https://doyensec.com/resources/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security-wp.pdf).
-
 ### 1. Only load secure content
 
 Any resources not included with your application should be loaded using a

filenames.auto.gni

@@ -52,6 +52,7 @@ auto_filenames = {
     "docs/api/service-workers.md",
     "docs/api/session.md",
     "docs/api/share-menu.md",
+    "docs/api/shared-texture.md",
     "docs/api/shell.md",
     "docs/api/structures",
     "docs/api/system-preferences.md",
@@ -145,6 +146,12 @@ auto_filenames = {
     "docs/api/structures/shared-dictionary-info.md",
     "docs/api/structures/shared-dictionary-usage-info.md",
     "docs/api/structures/shared-texture-handle.md",
+    "docs/api/structures/shared-texture-import-texture-info.md",
+    "docs/api/structures/shared-texture-imported-subtle.md",
+    "docs/api/structures/shared-texture-imported.md",
+    "docs/api/structures/shared-texture-subtle.md",
+    "docs/api/structures/shared-texture-sync-token.md",
+    "docs/api/structures/shared-texture-transfer.md",
     "docs/api/structures/shared-worker-info.md",
     "docs/api/structures/sharing-item.md",
     "docs/api/structures/shortcut-details.md",
@@ -176,6 +183,7 @@ auto_filenames = {
     "lib/renderer/api/context-bridge.ts",
     "lib/renderer/api/crash-reporter.ts",
     "lib/renderer/api/ipc-renderer.ts",
+    "lib/renderer/api/shared-texture.ts",
     "lib/renderer/api/web-frame.ts",
     "lib/renderer/api/web-utils.ts",
     "lib/renderer/common-init.ts",
@@ -257,6 +265,7 @@ auto_filenames = {
     "lib/browser/api/service-worker-main.ts",
     "lib/browser/api/session.ts",
     "lib/browser/api/share-menu.ts",
+    "lib/browser/api/shared-texture.ts",
     "lib/browser/api/system-preferences.ts",
     "lib/browser/api/touch-bar.ts",
     "lib/browser/api/tray.ts",
@@ -312,6 +321,7 @@ auto_filenames = {
     "lib/renderer/api/exports/electron.ts",
     "lib/renderer/api/ipc-renderer.ts",
     "lib/renderer/api/module-list.ts",
+    "lib/renderer/api/shared-texture.ts",
     "lib/renderer/api/web-frame.ts",
     "lib/renderer/api/web-utils.ts",
     "lib/renderer/common-init.ts",
@@ -352,6 +362,7 @@ auto_filenames = {
     "lib/renderer/api/exports/electron.ts",
     "lib/renderer/api/ipc-renderer.ts",
     "lib/renderer/api/module-list.ts",
+    "lib/renderer/api/shared-texture.ts",
     "lib/renderer/api/web-frame.ts",
     "lib/renderer/api/web-utils.ts",
     "lib/renderer/ipc-renderer-bindings.ts",

filenames.gni

@@ -194,6 +194,8 @@ filenames = {
     "shell/common/api/electron_api_clipboard_mac.mm",
     "shell/common/api/electron_api_native_image_mac.mm",
     "shell/common/asar/archive_mac.mm",
+    "shell/common/asar/integrity_digest.h",
+    "shell/common/asar/integrity_digest.mm",
     "shell/common/application_info_mac.mm",
     "shell/common/language_util_mac.mm",
     "shell/common/mac/main_application_bundle.h",
@@ -456,7 +458,6 @@ filenames = {
     "shell/browser/net/system_network_context_manager.h",
     "shell/browser/net/url_loader_network_observer.cc",
     "shell/browser/net/url_loader_network_observer.h",
-    "shell/browser/net/web_request_api_interface.h",
     "shell/browser/network_hints_handler_impl.cc",
     "shell/browser/network_hints_handler_impl.h",
     "shell/browser/notifications/notification.cc",
@@ -564,6 +565,7 @@ filenames = {
     "shell/common/api/electron_api_native_image.cc",
     "shell/common/api/electron_api_native_image.h",
     "shell/common/api/electron_api_net.cc",
+    "shell/common/api/electron_api_shared_texture.cc",
     "shell/common/api/electron_api_shell.cc",
     "shell/common/api/electron_api_testing.cc",
     "shell/common/api/electron_api_url_loader.cc",
@@ -580,6 +582,7 @@ filenames = {
     "shell/common/asar/asar_util.h",
     "shell/common/asar/scoped_temporary_file.cc",
     "shell/common/asar/scoped_temporary_file.h",
+    "shell/common/callback_util.h",
     "shell/common/color_util.cc",
     "shell/common/color_util.h",
     "shell/common/crash_keys.cc",

filenames.hunspell.gni

@@ -7,21 +7,17 @@ hunspell_dictionaries = [
   "//third_party/hunspell_dictionaries/da-DK-3-0.bdic",
   "//third_party/hunspell_dictionaries/de-DE-3-0.bdic",
   "//third_party/hunspell_dictionaries/el-GR-3-0.bdic",
-  "//third_party/hunspell_dictionaries/en-AU-10-0.bdic",
   "//third_party/hunspell_dictionaries/en-AU-10-1.bdic",
-  "//third_party/hunspell_dictionaries/en-CA-10-0.bdic",
   "//third_party/hunspell_dictionaries/en-CA-10-1.bdic",
-  "//third_party/hunspell_dictionaries/en-GB-10-0.bdic",
   "//third_party/hunspell_dictionaries/en-GB-10-1.bdic",
-  "//third_party/hunspell_dictionaries/en-GB-oxendict-10-0.bdic",
   "//third_party/hunspell_dictionaries/en-GB-oxendict-10-1.bdic",
-  "//third_party/hunspell_dictionaries/en-US-10-0.bdic",
   "//third_party/hunspell_dictionaries/en-US-10-1.bdic",
   "//third_party/hunspell_dictionaries/es-ES-3-0.bdic",
   "//third_party/hunspell_dictionaries/et-EE-3-0.bdic",
   "//third_party/hunspell_dictionaries/fa-IR-9-0.bdic",
   "//third_party/hunspell_dictionaries/fo-FO-3-0.bdic",
   "//third_party/hunspell_dictionaries/fr-FR-3-0.bdic",
+  "//third_party/hunspell_dictionaries/gl-1-0.bdic",
   "//third_party/hunspell_dictionaries/he-IL-3-0.bdic",
   "//third_party/hunspell_dictionaries/hi-IN-3-0.bdic",
   "//third_party/hunspell_dictionaries/hr-HR-3-0.bdic",
@@ -59,6 +55,7 @@ hunspell_dictionaries = [
 hunspell_licenses = [
   "//third_party/hunspell_dictionaries/COPYING",
   "//third_party/hunspell_dictionaries/COPYING.Apache",
+  "//third_party/hunspell_dictionaries/COPYING.GPL3",
   "//third_party/hunspell_dictionaries/COPYING.LESSER",
   "//third_party/hunspell_dictionaries/COPYING.LGPL",
   "//third_party/hunspell_dictionaries/COPYING.MIT",

filenames.libcxx.gni

@@ -1105,6 +1105,7 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__locale_dir/support/freebsd.h",
   "//third_party/libc++/src/include/__locale_dir/support/fuchsia.h",
   "//third_party/libc++/src/include/__locale_dir/support/linux.h",
+  "//third_party/libc++/src/include/__locale_dir/support/netbsd.h",
   "//third_party/libc++/src/include/__locale_dir/support/no_locale/characters.h",
   "//third_party/libc++/src/include/__locale_dir/support/no_locale/strtonum.h",
   "//third_party/libc++/src/include/__locale_dir/support/windows.h",
@@ -1453,6 +1454,7 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__type_traits/is_valid_expansion.h",
   "//third_party/libc++/src/include/__type_traits/is_void.h",
   "//third_party/libc++/src/include/__type_traits/is_volatile.h",
+  "//third_party/libc++/src/include/__type_traits/is_within_lifetime.h",
   "//third_party/libc++/src/include/__type_traits/lazy.h",
   "//third_party/libc++/src/include/__type_traits/make_32_64_or_128_bit.h",
   "//third_party/libc++/src/include/__type_traits/make_const_lvalue_ref.h",

lib/browser/api/menu.ts

@@ -46,11 +46,11 @@ Menu.prototype._isCommandIdEnabled = function (id) {
 };
 
 Menu.prototype._shouldCommandIdWorkWhenHidden = function (id) {
-  return this.commandsMap[id] ? !!this.commandsMap[id].acceleratorWorksWhenHidden : false;
+  return this.commandsMap[id]?.acceleratorWorksWhenHidden ?? false;
 };
 
 Menu.prototype._isCommandIdVisible = function (id) {
-  return this.commandsMap[id] ? this.commandsMap[id].visible : false;
+  return this.commandsMap[id]?.visible ?? false;
 };
 
 Menu.prototype._getAcceleratorForCommandId = function (id, useDefaultAccelerator) {
@@ -61,12 +61,12 @@ Menu.prototype._getAcceleratorForCommandId = function (id, useDefaultAccelerator
 };
 
 Menu.prototype._shouldRegisterAcceleratorForCommandId = function (id) {
-  return this.commandsMap[id] ? this.commandsMap[id].registerAccelerator : false;
+  return this.commandsMap[id]?.registerAccelerator ?? false;
 };
 
 if (process.platform === 'darwin') {
   Menu.prototype._getSharingItemForCommandId = function (id) {
-    return this.commandsMap[id] ? this.commandsMap[id].sharingItem : null;
+    return this.commandsMap[id]?.sharingItem ?? null;
   };
 }
 

lib/browser/api/module-list.ts

@@ -31,6 +31,7 @@ export const browserModuleList: ElectronInternal.ModuleEntry[] = [
   { name: 'screen', loader: () => require('./screen') },
   { name: 'ServiceWorkerMain', loader: () => require('./service-worker-main') },
   { name: 'session', loader: () => require('./session') },
+  { name: 'sharedTexture', loader: () => require('./shared-texture') },
   { name: 'ShareMenu', loader: () => require('./share-menu') },
   { name: 'systemPreferences', loader: () => require('./system-preferences') },
   { name: 'TouchBar', loader: () => require('./touch-bar') },

lib/browser/api/net-fetch.ts

@@ -119,7 +119,10 @@ export function fetchWithSession (input: RequestInfo, init: (RequestInit & {bypa
     p.reject(err);
   });
 
-  if (!req.body?.pipeTo(Writable.toWeb(r as unknown as Writable)).then(() => r.end())) { r.end(); }
+  // pipeTo expects a WritableStream<Uint8Array>. Node.js' Writable.toWeb returns WritableStream<any>,
+  // which causes a TS structural mismatch.
+  const writable = Writable.toWeb(r as unknown as Writable) as unknown as WritableStream<Uint8Array>;
+  if (!req.body?.pipeTo(writable).then(() => r.end())) { r.end(); }
 
   return p.promise;
 }

lib/browser/api/protocol.ts

@@ -4,6 +4,8 @@ import { createReadStream } from 'fs';
 import { Readable } from 'stream';
 import { ReadableStream } from 'stream/web';
 
+import type { ReadableStreamDefaultReader } from 'stream/web';
+
 // Global protocol APIs.
 const { registerSchemesAsPrivileged, getStandardSchemes, Protocol } = process._linkedBinding('electron_browser_protocol');
 
@@ -12,7 +14,7 @@ const ERR_UNEXPECTED = -9;
 
 const isBuiltInScheme = (scheme: string) => ['http', 'https', 'file'].includes(scheme);
 
-function makeStreamFromPipe (pipe: any): ReadableStream {
+function makeStreamFromPipe (pipe: any): ReadableStream<Uint8Array> {
   const buf = new Uint8Array(1024 * 1024 /* 1 MB */);
   return new ReadableStream({
     async pull (controller) {
@@ -38,21 +40,26 @@ function makeStreamFromFileInfo ({
   filePath: string;
   offset?: number;
   length?: number;
-}): ReadableStream {
+}): ReadableStream<Uint8Array> {
+  // Node's Readable.toWeb produces a WHATWG ReadableStream whose chunks are Uint8Array.
   return Readable.toWeb(createReadStream(filePath, {
     start: offset,
     end: length >= 0 ? offset + length : undefined
-  }));
+  })) as ReadableStream<Uint8Array>;
 }
 
 function convertToRequestBody (uploadData: ProtocolRequest['uploadData']): RequestInit['body'] {
   if (!uploadData) return null;
   // Optimization: skip creating a stream if the request is just a single buffer.
-  if (uploadData.length === 1 && (uploadData[0] as any).type === 'rawData') return uploadData[0].bytes;
+  if (uploadData.length === 1 && (uploadData[0] as any).type === 'rawData') {
+    return uploadData[0].bytes as any;
+  }
 
-  const chunks = [...uploadData] as any[]; // TODO: types are wrong
-  let current: ReadableStreamDefaultReader | null = null;
-  return new ReadableStream({
+  const chunks = [...uploadData] as any[]; // TODO: refine ProtocolRequest types
+  // Use Node's web stream types explicitly to avoid DOM lib vs Node lib structural mismatches.
+  // Generic <Uint8Array> ensures reader.read() returns value?: Uint8Array consistent with enqueue.
+  let current: ReadableStreamDefaultReader<Uint8Array> | null = null;
+  return new ReadableStream<Uint8Array>({
     async pull (controller) {
       if (current) {
         const { done, value } = await current.read();
@@ -67,7 +74,7 @@ function convertToRequestBody (uploadData: ProtocolRequest['uploadData']): Reque
         if (!chunks.length) { return controller.close(); }
         const chunk = chunks.shift()!;
         if (chunk.type === 'rawData') {
-          controller.enqueue(chunk.bytes);
+          controller.enqueue(chunk.bytes as Uint8Array);
         } else if (chunk.type === 'file') {
           current = makeStreamFromFileInfo(chunk).getReader();
           return this.pull!(controller);

lib/browser/api/shared-texture.ts

@@ -0,0 +1,191 @@
+import ipcMain from '@electron/internal/browser/api/ipc-main';
+import * as ipcMainInternalUtils from '@electron/internal/browser/ipc-main-internal-utils';
+import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
+
+import { randomUUID } from 'crypto';
+
+const transferTimeout = 1000;
+const sharedTextureNative = process._linkedBinding('electron_common_shared_texture');
+const managedSharedTextures = new Map<string, SharedTextureImportedWrapper>();
+
+type AllReleasedCallback = (imported: Electron.SharedTextureImported) => void;
+
+type SharedTextureImportedWrapper = {
+  texture: Electron.SharedTextureImported;
+  allReferencesReleased: AllReleasedCallback | undefined;
+  mainReference: boolean;
+  rendererFrameReferences: Map<number, { count: number, reference: Electron.WebFrameMain }>;
+}
+
+ipcMain.handle(IPC_MESSAGES.IMPORT_SHARED_TEXTURE_RELEASE_RENDERER_TO_MAIN, (event: Electron.IpcMainInvokeEvent, textureId: string) => {
+  const frameTreeNodeId = event.frameTreeNodeId ?? event.sender.mainFrame.frameTreeNodeId;
+  wrapperReleaseFromRenderer(textureId, frameTreeNodeId);
+});
+
+let checkManagedSharedTexturesInterval: NodeJS.Timeout | null = null;
+
+function scheduleCheckManagedSharedTextures () {
+  if (checkManagedSharedTexturesInterval === null) {
+    checkManagedSharedTexturesInterval = setInterval(checkManagedSharedTextures, 1000);
+  }
+}
+
+function unscheduleCheckManagedSharedTextures () {
+  if (checkManagedSharedTexturesInterval !== null) {
+    clearInterval(checkManagedSharedTexturesInterval);
+    checkManagedSharedTexturesInterval = null;
+  }
+}
+
+function checkManagedSharedTextures () {
+  const texturesToRemoveTracking = new Set<string>();
+  for (const [, wrapper] of managedSharedTextures) {
+    for (const [frameTreeNodeId, entry] of wrapper.rendererFrameReferences) {
+      const frame = entry.reference;
+      if (!frame || frame.isDestroyed()) {
+        console.error(`The imported shared texture ${wrapper.texture.textureId} is referenced by a destroyed webContent/webFrameMain, this means a imported shared texture in renderer process is not released before the process is exited. Releasing that dangling reference now.`);
+        wrapper.rendererFrameReferences.delete(frameTreeNodeId);
+      }
+    }
+
+    if (wrapper.rendererFrameReferences.size === 0 && !wrapper.mainReference) {
+      texturesToRemoveTracking.add(wrapper.texture.textureId);
+      wrapper.texture.subtle.release(() => {
+        wrapper.allReferencesReleased?.(wrapper.texture);
+      });
+    }
+  }
+
+  for (const id of texturesToRemoveTracking) {
+    managedSharedTextures.delete(id);
+  }
+
+  if (managedSharedTextures.size === 0) {
+    unscheduleCheckManagedSharedTextures();
+  }
+}
+
+function wrapperReleaseFromRenderer (id: string, frameTreeNodeId: number) {
+  const wrapper = managedSharedTextures.get(id);
+  if (!wrapper) {
+    throw new Error(`Shared texture with id ${id} not found`);
+  }
+
+  const entry = wrapper.rendererFrameReferences.get(frameTreeNodeId);
+  if (!entry) {
+    throw new Error(`Shared texture ${id} is not referenced by renderer frame ${frameTreeNodeId}`);
+  }
+
+  entry.count -= 1;
+  if (entry.count === 0) {
+    wrapper.rendererFrameReferences.delete(frameTreeNodeId);
+  } else {
+    wrapper.rendererFrameReferences.set(frameTreeNodeId, entry);
+  }
+
+  // Actually release the texture if no one is referencing it
+  if (wrapper.rendererFrameReferences.size === 0 && !wrapper.mainReference) {
+    managedSharedTextures.delete(id);
+    wrapper.texture.subtle.release(() => {
+      wrapper.allReferencesReleased?.(wrapper.texture);
+    });
+  }
+}
+
+function wrapperReleaseFromMain (id: string) {
+  const wrapper = managedSharedTextures.get(id);
+  if (!wrapper) {
+    throw new Error(`Shared texture with id ${id} not found`);
+  }
+
+  // Actually release the texture if no one is referencing it
+  wrapper.mainReference = false;
+  if (wrapper.rendererFrameReferences.size === 0) {
+    managedSharedTextures.delete(id);
+    wrapper.texture.subtle.release(() => {
+      wrapper.allReferencesReleased?.(wrapper.texture);
+    });
+  }
+}
+
+async function sendSharedTexture (options: Electron.SendSharedTextureOptions, ...args: any[]) {
+  const imported = options.importedSharedTexture;
+  const transfer = imported.subtle.startTransferSharedTexture();
+
+  let timeoutHandle: NodeJS.Timeout | null = null;
+  const timeoutPromise = new Promise<never>((resolve, reject) => {
+    timeoutHandle = setTimeout(() => {
+      reject(new Error(`transfer shared texture timed out after ${transferTimeout}ms, ensure you have registered receiver at renderer process.`));
+    }, transferTimeout);
+  });
+
+  const targetFrame: Electron.WebFrameMain | undefined = options.frame;
+  if (!targetFrame) {
+    throw new Error('`frame` should be provided');
+  }
+
+  const invokePromise: Promise<Electron.SharedTextureSyncToken> = ipcMainInternalUtils.invokeInWebFrameMain<Electron.SharedTextureSyncToken>(
+    targetFrame,
+    IPC_MESSAGES.IMPORT_SHARED_TEXTURE_TRANSFER_MAIN_TO_RENDERER,
+    transfer,
+    imported.textureId,
+    ...args
+  );
+
+  try {
+    const syncToken = await Promise.race([invokePromise, timeoutPromise]);
+    imported.subtle.setReleaseSyncToken(syncToken);
+
+    const wrapper = managedSharedTextures.get(imported.textureId);
+    if (!wrapper) {
+      throw new Error(`Shared texture with id ${imported.textureId} not found`);
+    }
+
+    const key = targetFrame.frameTreeNodeId;
+    const existing = wrapper.rendererFrameReferences.get(key);
+    if (existing) {
+      existing.count += 1;
+      wrapper.rendererFrameReferences.set(key, existing);
+    } else {
+      wrapper.rendererFrameReferences.set(key, { count: 1, reference: targetFrame });
+    }
+  } finally {
+    if (timeoutHandle) {
+      clearTimeout(timeoutHandle);
+    }
+  }
+
+  // Schedule a check to see if any texture is referenced by any dangling renderer
+  scheduleCheckManagedSharedTextures();
+}
+
+function importSharedTexture (options: Electron.ImportSharedTextureOptions) {
+  const id = randomUUID();
+  const imported = sharedTextureNative.importSharedTexture(Object.assign(options.textureInfo, { id }));
+  const ret: Electron.SharedTextureImported = {
+    textureId: id,
+    subtle: imported,
+    getVideoFrame: imported.getVideoFrame,
+    release: () => {
+      wrapperReleaseFromMain(id);
+    }
+  };
+
+  const wrapper: SharedTextureImportedWrapper = {
+    texture: ret,
+    allReferencesReleased: options.allReferencesReleased,
+    mainReference: true,
+    rendererFrameReferences: new Map()
+  };
+  managedSharedTextures.set(id, wrapper);
+
+  return ret;
+}
+
+const sharedTexture = {
+  subtle: sharedTextureNative,
+  importSharedTexture,
+  sendSharedTexture
+};
+
+export default sharedTexture;

lib/browser/init.ts

@@ -40,7 +40,7 @@ process.on('uncaughtException', function (error) {
 // Emit 'exit' event on quit.
 const { app } = require('electron');
 
-app.on('quit', (_event, exitCode) => {
+app.on('quit', (_event: any, exitCode: number) => {
   process.emit('exit', exitCode);
 });
 

lib/browser/ipc-main-internal-utils.ts

@@ -36,3 +36,27 @@ export function invokeInWebContents<T> (sender: Electron.WebContents, command: s
     sender._sendInternal(command, requestId, ...args);
   });
 }
+
+export function invokeInWebFrameMain<T> (sender: Electron.WebFrameMain, command: string, ...args: any[]) {
+  return new Promise<T>((resolve, reject) => {
+    const requestId = ++nextId;
+    const channel = `${command}_RESPONSE_${requestId}`;
+    const frameTreeNodeId = sender.frameTreeNodeId;
+    ipcMainInternal.on(channel, function handler (event, error: Error, result: any) {
+      if (event.type === 'frame' && event.frameTreeNodeId !== frameTreeNodeId) {
+        console.error(`Reply to ${command} sent by unexpected WebFrameMain (${event.frameTreeNodeId})`);
+        return;
+      }
+
+      ipcMainInternal.removeListener(channel, handler);
+
+      if (error) {
+        reject(error);
+      } else {
+        resolve(result);
+      }
+    });
+
+    sender._sendInternal(command, requestId, ...args);
+  });
+}

lib/common/api/net-client-request.ts

@@ -289,7 +289,8 @@ function parseOptions (optionsIn: ClientRequestConstructorOptions | string): Nod
     referrerPolicy: options.referrerPolicy,
     cache: options.cache,
     allowNonHttpProtocols: Object.hasOwn(options, kAllowNonHttpProtocols),
-    priority: options.priority
+    priority: options.priority,
+    bypassCustomProtocolHandlers: options.bypassCustomProtocolHandlers
   };
   if ('priorityIncremental' in options) {
     urlLoaderOptions.priorityIncremental = options.priorityIncremental;
@@ -427,9 +428,8 @@ export class ClientRequest extends Writable implements Electron.ClientRequest {
     this._started = true;
     const stringifyValues = (obj: Record<string, { name: string, value: string | string[] }>) => {
       const ret: Record<string, string> = {};
-      for (const k of Object.keys(obj)) {
-        const kv = obj[k];
-        ret[kv.name] = kv.value.toString();
+      for (const { name, value } of Object.values(obj)) {
+        ret[name] = value.toString();
       }
       return ret;
     };

lib/common/ipc-messages.ts

@@ -25,4 +25,7 @@ export const enum IPC_MESSAGES {
   INSPECTOR_CONFIRM = 'INSPECTOR_CONFIRM',
   INSPECTOR_CONTEXT_MENU = 'INSPECTOR_CONTEXT_MENU',
   INSPECTOR_SELECT_FILE = 'INSPECTOR_SELECT_FILE',
+
+  IMPORT_SHARED_TEXTURE_TRANSFER_MAIN_TO_RENDERER = 'IMPORT_SHARED_TEXTURE_TRANSFER_MAIN_TO_RENDERER',
+  IMPORT_SHARED_TEXTURE_RELEASE_RENDERER_TO_MAIN = 'IMPORT_SHARED_TEXTURE_RELEASE_RENDERER_TO_MAIN',
 }

lib/node/asar-fs-wrapper.ts

@@ -746,7 +746,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
 
       context.readdirResults.push(dirent);
       if (dirent!.isDirectory() || stat === 1) {
-        context.pathsQueue.push(path.join(dirent!.path, dirent!.name));
+        context.pathsQueue.push(path.join(dirent!.parentPath, dirent!.name));
       }
     }
   }

lib/renderer/api/clipboard.ts

@@ -1,21 +1,45 @@
+import * as deprecate from '@electron/internal/common/deprecate';
 import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
 import * as ipcRendererUtils from '@electron/internal/renderer/ipc-renderer-internal-utils';
 
-const clipboard = process._linkedBinding('electron_common_clipboard');
+const clipboard = {} as Electron.Clipboard;
+const originalClipboard = process._linkedBinding('electron_common_clipboard');
+
+const warnDeprecatedAccess = function (method: keyof Electron.Clipboard) {
+  return deprecate.warnOnceMessage(`Accessing 'clipboard.${method}' from the renderer process is
+     deprecated and will be removed. Please use the 'contextBridge' API to access
+     the clipboard API from the renderer.`);
+};
+
+const makeDeprecatedMethod = function (method: keyof Electron.Clipboard): any {
+  const warnDeprecated = warnDeprecatedAccess(method);
+  return (...args: any[]) => {
+    warnDeprecated();
+    return (originalClipboard[method] as any)(...args);
+  };
+};
 
 const makeRemoteMethod = function (method: keyof Electron.Clipboard): any {
-  return (...args: any[]) => ipcRendererUtils.invokeSync(IPC_MESSAGES.BROWSER_CLIPBOARD_SYNC, method, ...args);
+  const warnDeprecated = warnDeprecatedAccess(method);
+  return (...args: any[]) => {
+    warnDeprecated();
+    return ipcRendererUtils.invokeSync(IPC_MESSAGES.BROWSER_CLIPBOARD_SYNC, method, ...args);
+  };
 };
 
 if (process.platform === 'linux') {
   // On Linux we could not access clipboard in renderer process.
-  for (const method of Object.keys(clipboard) as (keyof Electron.Clipboard)[]) {
+  for (const method of Object.keys(originalClipboard) as (keyof Electron.Clipboard)[]) {
     clipboard[method] = makeRemoteMethod(method);
   }
-} else if (process.platform === 'darwin') {
-  // Read/write to find pasteboard over IPC since only main process is notified of changes
-  clipboard.readFindText = makeRemoteMethod('readFindText');
-  clipboard.writeFindText = makeRemoteMethod('writeFindText');
+} else {
+  for (const method of Object.keys(originalClipboard) as (keyof Electron.Clipboard)[]) {
+    if (process.platform === 'darwin' && (method === 'readFindText' || method === 'writeFindText')) {
+      clipboard[method] = makeRemoteMethod(method);
+    } else {
+      clipboard[method] = makeDeprecatedMethod(method);
+    }
+  }
 }
 
 export default clipboard;

lib/renderer/api/module-list.ts

@@ -4,6 +4,7 @@ export const rendererModuleList: ElectronInternal.ModuleEntry[] = [
   { name: 'contextBridge', loader: () => require('./context-bridge') },
   { name: 'crashReporter', loader: () => require('./crash-reporter') },
   { name: 'ipcRenderer', loader: () => require('./ipc-renderer') },
+  { name: 'sharedTexture', loader: () => require('./shared-texture') },
   { name: 'webFrame', loader: () => require('./web-frame') },
   { name: 'webUtils', loader: () => require('./web-utils') }
 ];

lib/renderer/api/shared-texture.ts

@@ -0,0 +1,45 @@
+import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
+import ipcRenderer from '@electron/internal/renderer/api/ipc-renderer';
+import { ipcRendererInternal } from '@electron/internal/renderer/ipc-renderer-internal';
+
+const sharedTextureNative = process._linkedBinding('electron_common_shared_texture');
+const transferChannelName = IPC_MESSAGES.IMPORT_SHARED_TEXTURE_TRANSFER_MAIN_TO_RENDERER;
+
+type SharedTextureReceiverCallback = (data: Electron.ReceivedSharedTextureData, ...args: any[]) => Promise<void>;
+let sharedTextureReceiverCallback: SharedTextureReceiverCallback | null = null;
+
+ipcRendererInternal.on(transferChannelName, async (event, requestId, ...args) => {
+  const replyChannel = `${transferChannelName}_RESPONSE_${requestId}`;
+  try {
+    const transfer = args[0] as Electron.SharedTextureTransfer;
+    const textureId = args[1] as string;
+    const imported = sharedTextureNative.finishTransferSharedTexture(Object.assign(transfer, { id: textureId }));
+    const syncToken = imported.getFrameCreationSyncToken();
+    event.sender.send(replyChannel, null, syncToken);
+
+    const wrapper: Electron.SharedTextureImported = {
+      textureId,
+      subtle: imported,
+      getVideoFrame: imported.getVideoFrame,
+      release: () => {
+        imported.release(async () => {
+          await ipcRenderer.invoke(IPC_MESSAGES.IMPORT_SHARED_TEXTURE_RELEASE_RENDERER_TO_MAIN, textureId);
+        });
+      }
+    };
+
+    const data: Electron.ReceivedSharedTextureData = { importedSharedTexture: wrapper };
+    await sharedTextureReceiverCallback?.(data, ...args.slice(2));
+  } catch (error) {
+    event.sender.send(replyChannel, error);
+  }
+});
+
+const sharedTexture = {
+  subtle: sharedTextureNative,
+  setSharedTextureReceiver: (callback: SharedTextureReceiverCallback) => {
+    sharedTextureReceiverCallback = callback;
+  }
+};
+
+export default sharedTexture;

lib/sandboxed_renderer/api/module-list.ts

@@ -15,6 +15,10 @@ export const moduleList: ElectronInternal.ModuleEntry[] = [
     name: 'nativeImage',
     loader: () => require('@electron/internal/common/api/native-image')
   },
+  {
+    name: 'sharedTexture',
+    loader: () => require('@electron/internal/renderer/api/shared-texture')
+  },
   {
     name: 'webFrame',
     loader: () => require('@electron/internal/renderer/api/web-frame')

npm/package.json

@@ -9,7 +9,7 @@
   },
   "dependencies": {
     "@electron/get": "^2.0.0",
-    "@types/node": "^22.7.7",
+    "@types/node": "^24.9.0",
     "extract-zip": "^2.0.1"
   },
   "engines": {

package.json

@@ -5,7 +5,8 @@
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
     "@azure/storage-blob": "^12.28.0",
-    "@electron/asar": "^3.2.13",
+    "@datadog/datadog-ci": "^4.1.2",
+    "@electron/asar": "^4.0.1",
     "@electron/docs-parser": "^2.0.0",
     "@electron/fiddle-core": "^1.3.4",
     "@electron/github-app-auth": "^2.2.1",
@@ -14,7 +15,7 @@
     "@octokit/rest": "^20.1.2",
     "@primer/octicons": "^10.0.0",
     "@types/minimist": "^1.2.5",
-    "@types/node": "^22.7.7",
+    "@types/node": "^24.9.0",
     "@types/semver": "^7.5.8",
     "@types/stream-json": "^1.7.8",
     "@types/temp": "^0.9.4",
@@ -40,6 +41,7 @@
     "lint-staged": "^16.1.0",
     "markdownlint-cli2": "^0.18.0",
     "minimist": "^1.2.8",
+    "node-gyp": "^11.4.2",
     "null-loader": "^4.0.1",
     "pre-flight": "^2.0.0",
     "process": "^0.11.10",
@@ -134,6 +136,22 @@
     ]
   },
   "resolutions": {
-    "nan": "nodejs/nan#e14bdcd1f72d62bca1d541b66da43130384ec213"
+    "dbus-native/xml2js": "0.5.0",
+    "abstract-socket": "github:deepak1556/node-abstractsocket#928cc591decd12aff7dad96449da8afc29832c19",
+    "minimist@npm:~0.0.1": "0.2.4"
+  },
+  "packageManager": "yarn@4.11.0",
+  "workspaces": [
+    ".github/workflows",
+    "spec",
+    "spec/fixtures/native-addon/*"
+  ],
+  "dependenciesMeta": {
+    "abstract-socket": {
+      "built": true
+    },
+    "dugite": {
+      "built": true
+    }
   }
 }

patches/Mantle/.patches

@@ -1 +0,0 @@
-remove_mtlmanagedobjectadapter_h.patch

patches/Mantle/remove_mtlmanagedobjectadapter_h.patch

@@ -1,22 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Shelley Vohr <shelley.vohr@gmail.com>
-Date: Mon, 7 Dec 2020 17:34:08 -0800
-Subject: Remove MTLManagedObjectAdapter.h
-
-We are using an outdated version of Mantle which leverages NSConfinementConcurrencyType,
-an enum which has been deprecated with no replacement as of macOS 10.11.
-The actual solution to this problem is to upgrade Mantle, but for now
-we just stop building the offending adapter.
-
-diff --git a/Mantle/Mantle.h b/Mantle/Mantle.h
-index ebd74e7e435ef008ef29e94d406246c1f7b07a12..81abff872bd597ce6d21bb43be4d19ddc7253088 100644
---- a/Mantle/Mantle.h
-+++ b/Mantle/Mantle.h
-@@ -15,7 +15,6 @@ FOUNDATION_EXPORT double MantleVersionNumber;
- FOUNDATION_EXPORT const unsigned char MantleVersionString[];
- 
- #import <Mantle/MTLJSONAdapter.h>
--#import <Mantle/MTLManagedObjectAdapter.h>
- #import <Mantle/MTLModel.h>
- #import <Mantle/MTLModel+NSCoding.h>
- #import <Mantle/MTLValueTransformer.h>

patches/boringssl/.patches

@@ -1,3 +1,2 @@
 expose_ripemd160.patch
-revert_track_ssl_error_zero_return_explicitly.patch
 feat_expose_several_extra_cipher_functions.patch

patches/boringssl/feat_expose_several_extra_cipher_functions.patch

@@ -118,10 +118,10 @@ index 891a73f229e3f0838cb2fa99b8fb24fdeac1962b..f7d0c5dc66f016eb9338c15e7f5ef59e
    callback(EVP_des_ede3_cbc(), "des-ede3-cbc", nullptr, arg);
    callback(EVP_rc2_cbc(), "rc2-cbc", nullptr, arg);
 diff --git a/include/openssl/cipher.h b/include/openssl/cipher.h
-index a5533caf45eaacc4baef4a73d97e9bc2b6e3a942..35f24c1b22ea2c6b4766c0d87e75b6fc6b459f79 100644
+index ed2eeab57779d827eb19edcd435b4664d4079859..74bb77e03b562698cb887b25cc8a779631a809fb 100644
 --- a/include/openssl/cipher.h
 +++ b/include/openssl/cipher.h
-@@ -461,6 +461,7 @@ OPENSSL_EXPORT const EVP_CIPHER *EVP_des_ede3_ecb(void);
+@@ -552,6 +552,7 @@ OPENSSL_EXPORT const EVP_CIPHER *EVP_des_ede3_ecb(void);
  
  // EVP_aes_128_cfb128 is only available in decrepit.
  OPENSSL_EXPORT const EVP_CIPHER *EVP_aes_128_cfb128(void);

patches/boringssl/revert_track_ssl_error_zero_return_explicitly.patch

@@ -1,49 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Shelley Vohr <shelley.vohr@gmail.com>
-Date: Tue, 6 Sep 2022 09:42:52 +0200
-Subject: revert: track SSL_ERROR_ZERO_RETURN explicitly.
-
-This reverts commit ebd8b8965c74ab06bb91f7a00b23822e1f1f26ca.
-
-It is causing significant TLS failures in Node.js.
-
-diff --git a/ssl/ssl_buffer.cc b/ssl/ssl_buffer.cc
-index 8c5c7bcd96229cfcfb605bd4728c52c3c03d6062..ad8f1e7a26c665fd471b62bd694aad1655500d33 100644
---- a/ssl/ssl_buffer.cc
-+++ b/ssl/ssl_buffer.cc
-@@ -230,7 +230,6 @@ int ssl_handle_open_record(SSL *ssl, bool *out_retry, ssl_open_record_t ret,
-       return 1;
- 
-     case ssl_open_record_close_notify:
--      ssl->s3->rwstate = SSL_ERROR_ZERO_RETURN;
-       return 0;
- 
-     case ssl_open_record_error:
-diff --git a/ssl/ssl_lib.cc b/ssl/ssl_lib.cc
-index f64b103fbb7a298a22fe0ff4bc95a4415c58e305..9bc3e1c3114ae67c0eb6a31de05b85e517ea6ae2 100644
---- a/ssl/ssl_lib.cc
-+++ b/ssl/ssl_lib.cc
-@@ -1211,7 +1211,7 @@ int SSL_get_error(const SSL *ssl, int ret_code) {
-   }
- 
-   if (ret_code == 0) {
--    if (ssl->s3->rwstate == SSL_ERROR_ZERO_RETURN) {
-+    if (ssl->s3->read_shutdown == ssl_shutdown_close_notify) {
-       return SSL_ERROR_ZERO_RETURN;
-     }
-     // An EOF was observed which violates the protocol, and the underlying
-@@ -2672,13 +2672,7 @@ void *SSL_CTX_get_ex_data(const SSL_CTX *ctx, int idx) {
-   return CRYPTO_get_ex_data(&ctx->ex_data, idx);
- }
- 
--int SSL_want(const SSL *ssl) {
--  // Historically, OpenSSL did not track |SSL_ERROR_ZERO_RETURN| as an |rwstate|
--  // value. We do, but map it back to |SSL_ERROR_NONE| to preserve the original
--  // behavior.
--  return ssl->s3->rwstate == SSL_ERROR_ZERO_RETURN ? SSL_ERROR_NONE
--                                                   : ssl->s3->rwstate;
--}
-+int SSL_want(const SSL *ssl) { return ssl->s3->rwstate; }
- 
- void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,
-                                   RSA *(*cb)(SSL *ssl, int is_export,

patches/chromium/.patches

@@ -59,7 +59,6 @@ webview_fullscreen.patch
 extend_apply_webpreferences.patch
 build_libc_as_static_library.patch
 build_do_not_depend_on_packed_resource_integrity.patch
-refactor_restore_base_adaptcallbackforrepeating.patch
 logging_win32_only_create_a_console_if_logging_to_stderr.patch
 fix_media_key_usage_with_globalshortcuts.patch
 feat_expose_raw_response_headers_from_urlloader.patch
@@ -142,4 +141,4 @@ allow_electron_to_depend_on_components_os_crypt_sync.patch
 expose_referrerscriptinfo_hostdefinedoptionsindex.patch
 chore_disable_protocol_handler_dcheck.patch
 fix_check_for_file_existence_before_setting_mtime.patch
-revert_cleanup_remove_feature_windelayspellcheckserviceinit.patch
+fix_linux_tray_id.patch

patches/chromium/add_didinstallconditionalfeatures.patch

@@ -23,10 +23,10 @@ index 5196f155cdc641b66c4faa77d8b00097145a1290..bbfac47a74f989482343c222b78f187b
                                          int32_t world_id) {}
    virtual void DidClearWindowObject() {}
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index 298387873e7ded5f96c788bc53ad7256a8f5b13e..7e64e34a2ebd9738d33bfc9cc7fd827b8757037d 100644
+index d4755acfd0ba3016da545de87d64046a6f5ee387..7070884305eb648c9aa0020f8161202671e1f671 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -4659,6 +4659,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
+@@ -4662,6 +4662,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
      observer.DidCreateScriptContext(context, world_id);
  }
  
@@ -40,7 +40,7 @@ index 298387873e7ded5f96c788bc53ad7256a8f5b13e..7e64e34a2ebd9738d33bfc9cc7fd827b
                                                 int world_id) {
    for (auto& observer : observers_)
 diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
-index b6acf7101932961b4a81738e1fcda07efc714edc..32dfed04e2fd7cd2e60c7cf145d182f4163feb68 100644
+index 19c5dab00dd9355736c6040868b320483b780afb..621cd9ae7f43470ed4414a48d62330b36c7058e9 100644
 --- a/content/renderer/render_frame_impl.h
 +++ b/content/renderer/render_frame_impl.h
 @@ -603,6 +603,8 @@ class CONTENT_EXPORT RenderFrameImpl
@@ -123,10 +123,10 @@ index fcc0928abbc454281b022e0451d993651ecba42f..16066fe34ee0335a0dabe00b6890e584
                                  int32_t world_id) override;
  
 diff --git a/third_party/blink/renderer/core/loader/empty_clients.h b/third_party/blink/renderer/core/loader/empty_clients.h
-index 9ec4431ed035543beb78a3311049886c6d8e03f8..d46f3b764f653c990e57fb2c67121c8fd6b1b115 100644
+index b1677488cb64d2ad83f231b4cbe74bc4f56149b4..80ee0065d1b16520389b6809402438f087430fa3 100644
 --- a/third_party/blink/renderer/core/loader/empty_clients.h
 +++ b/third_party/blink/renderer/core/loader/empty_clients.h
-@@ -424,6 +424,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {
+@@ -426,6 +426,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {
  
    void DidCreateScriptContext(v8::Local<v8::Context>,
                                int32_t world_id) override {}

patches/chromium/add_electron_deps_to_license_credits_file.patch

@@ -7,10 +7,10 @@ Ensure that licenses for the dependencies introduced by Electron
 are included in `LICENSES.chromium.html`
 
 diff --git a/tools/licenses/licenses.py b/tools/licenses/licenses.py
-index 833a80f1387c64eec418b57d74373dd93130a9dc..a85714b903fc934593258192bc61d72cc557615b 100755
+index 514be069768cc1bbd39f2b261cefb1a9f267f89f..0a1ab64914cfaa087e4000fb81bfafd18aa1b98b 100755
 --- a/tools/licenses/licenses.py
 +++ b/tools/licenses/licenses.py
-@@ -356,6 +356,31 @@ SPECIAL_CASES = {
+@@ -357,6 +357,31 @@ SPECIAL_CASES = {
          "License": "Apache 2.0",
          "License File": ["//third_party/sample3/the_license"],
      },

patches/chromium/adjust_accessibility_ui_for_electron.patch

@@ -10,7 +10,7 @@ usage of BrowserList and Browser as we subclass related methods and use our
 WindowList.
 
 diff --git a/chrome/browser/ui/webui/accessibility/accessibility_ui.cc b/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
-index 049ae3881eff6426b37a1ba09cfd8a10a7e9a597..0cdb542da696e9fc85e9bf321182da2967073016 100644
+index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3b33c3777 100644
 --- a/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
 +++ b/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
 @@ -48,6 +48,7 @@
@@ -21,16 +21,16 @@ index 049ae3881eff6426b37a1ba09cfd8a10a7e9a597..0cdb542da696e9fc85e9bf321182da29
  #include "ui/accessibility/accessibility_features.h"
  #include "ui/accessibility/ax_mode.h"
  #include "ui/accessibility/ax_updates_and_events.h"
-@@ -178,7 +179,7 @@ base::Value::Dict BuildTargetDescriptor(content::RenderViewHost* rvh) {
+@@ -179,7 +180,7 @@ base::Value::Dict BuildTargetDescriptor(content::RenderViewHost* rvh) {
                                 rvh->GetRoutingID(), accessibility_mode);
  }
  
 -#if !BUILDFLAG(IS_ANDROID)
 +#if 0
- base::Value::Dict BuildTargetDescriptor(Browser* browser) {
+ base::Value::Dict BuildTargetDescriptor(BrowserWindowInterface* browser) {
    base::Value::Dict target_data;
-   target_data.Set(kSessionIdField, browser->session_id().id());
-@@ -224,7 +225,7 @@ void HandleAccessibilityRequestCallback(
+   target_data.Set(kSessionIdField, browser->GetSessionID().id());
+@@ -226,7 +227,7 @@ void HandleAccessibilityRequestCallback(
    auto& browser_accessibility_state =
        *content::BrowserAccessibilityState::GetInstance();
    base::Value::Dict data;
@@ -39,7 +39,7 @@ index 049ae3881eff6426b37a1ba09cfd8a10a7e9a597..0cdb542da696e9fc85e9bf321182da29
    ui::AXMode mode = browser_accessibility_state.GetAccessibilityMode();
    bool native = mode.has_mode(ui::AXMode::kNativeAPIs);
    bool web = mode.has_mode(ui::AXMode::kWebContents);
-@@ -285,7 +286,7 @@ void HandleAccessibilityRequestCallback(
+@@ -287,7 +288,7 @@ void HandleAccessibilityRequestCallback(
    data.Set(kIsScreenReaderActive, is_screen_reader_active);
  
    std::string pref_api_type =
@@ -48,21 +48,23 @@ index 049ae3881eff6426b37a1ba09cfd8a10a7e9a597..0cdb542da696e9fc85e9bf321182da29
    bool pref_api_type_supported = false;
  
    std::vector<ui::AXApiType::Type> supported_api_types =
-@@ -353,11 +354,11 @@ void HandleAccessibilityRequestCallback(
+@@ -355,13 +356,13 @@ void HandleAccessibilityRequestCallback(
    data.Set(kPagesField, std::move(page_list));
  
    base::Value::List browser_list;
 -#if !BUILDFLAG(IS_ANDROID)
 +#if 0
-   for (Browser* browser : *BrowserList::GetInstance()) {
-     browser_list.Append(BuildTargetDescriptor(browser));
-   }
+   ForEachCurrentBrowserWindowInterfaceOrderedByActivation(
+       [&browser_list](BrowserWindowInterface* browser) {
+         browser_list.Append(BuildTargetDescriptor(browser));
+         return true;
+       });
 -#endif  // !BUILDFLAG(IS_ANDROID)
 +#endif
    data.Set(kBrowsersField, std::move(browser_list));
  
  #if BUILDFLAG(IS_WIN)
-@@ -844,7 +845,8 @@ void AccessibilityUIMessageHandler::SetGlobalString(
+@@ -848,7 +849,8 @@ void AccessibilityUIMessageHandler::SetGlobalString(
    const std::string value = CheckJSValue(data.FindString(kValueField));
  
    if (string_name == kApiTypeField) {
@@ -72,7 +74,7 @@ index 049ae3881eff6426b37a1ba09cfd8a10a7e9a597..0cdb542da696e9fc85e9bf321182da29
      pref->SetString(prefs::kShownAccessibilityApiType, value);
    }
  }
-@@ -898,7 +900,8 @@ void AccessibilityUIMessageHandler::RequestWebContentsTree(
+@@ -902,7 +904,8 @@ void AccessibilityUIMessageHandler::RequestWebContentsTree(
                       AXPropertyFilter::ALLOW_EMPTY);
    AddPropertyFilters(property_filters, deny, AXPropertyFilter::DENY);
  
@@ -82,23 +84,25 @@ index 049ae3881eff6426b37a1ba09cfd8a10a7e9a597..0cdb542da696e9fc85e9bf321182da29
    ui::AXApiType::Type api_type =
        ui::AXApiType::From(pref->GetString(prefs::kShownAccessibilityApiType));
    std::string accessibility_contents =
-@@ -925,6 +928,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
-                      AXPropertyFilter::ALLOW_EMPTY);
-   AddPropertyFilters(property_filters, deny, AXPropertyFilter::DENY);
+@@ -922,7 +925,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
  
+   AllowJavascript();
+ 
+-#if !BUILDFLAG(IS_ANDROID)
 +#if 0
-   for (Browser* browser : *BrowserList::GetInstance()) {
-     if (browser->session_id().id() == session_id) {
-       base::Value::Dict result = BuildTargetDescriptor(browser);
-@@ -937,6 +941,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
-       return;
-     }
+   std::vector<AXPropertyFilter> property_filters;
+   AddPropertyFilters(property_filters, allow, AXPropertyFilter::ALLOW);
+   AddPropertyFilters(property_filters, allow_empty,
+@@ -949,7 +952,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
+   if (found) {
+     return;
    }
+-#endif  // !BUILDFLAG(IS_ANDROID)
 +#endif
- #endif  // !BUILDFLAG(IS_ANDROID)
    // No browser with the specified |session_id| was found.
    base::Value::Dict result;
-@@ -980,11 +985,13 @@ void AccessibilityUIMessageHandler::StopRecording(
+   result.Set(kSessionIdField, session_id);
+@@ -992,11 +995,13 @@ void AccessibilityUIMessageHandler::StopRecording(
  }
  
  ui::AXApiType::Type AccessibilityUIMessageHandler::GetRecordingApiType() {
@@ -115,7 +119,7 @@ index 049ae3881eff6426b37a1ba09cfd8a10a7e9a597..0cdb542da696e9fc85e9bf321182da29
    // Check to see if it is in the supported types list.
    if (std::find(supported_types.begin(), supported_types.end(), api_type) ==
        supported_types.end()) {
-@@ -1054,10 +1061,13 @@ void AccessibilityUIMessageHandler::RequestAccessibilityEvents(
+@@ -1066,10 +1071,13 @@ void AccessibilityUIMessageHandler::RequestAccessibilityEvents(
  // static
  void AccessibilityUIMessageHandler::RegisterProfilePrefs(
      user_prefs::PrefRegistrySyncable* registry) {

patches/chromium/allow_disabling_blink_scheduler_throttling_per_renderview.patch

@@ -6,10 +6,10 @@ Subject: allow disabling blink scheduler throttling per RenderView
 This allows us to disable throttling for hidden windows.
 
 diff --git a/content/browser/renderer_host/navigation_controller_impl_unittest.cc b/content/browser/renderer_host/navigation_controller_impl_unittest.cc
-index 74b39146bbb8151a66ecb4f138f769fffc2525b2..a54948fa36c85c5c5dd04b9836951b1ce1279038 100644
+index ab916b56116e911af3cf6655cdd68ce139e260b9..f148ce57ae6c75f6635fca487d9493199b79a9f3 100644
 --- a/content/browser/renderer_host/navigation_controller_impl_unittest.cc
 +++ b/content/browser/renderer_host/navigation_controller_impl_unittest.cc
-@@ -173,6 +173,12 @@ class MockPageBroadcast : public blink::mojom::PageBroadcast {
+@@ -167,6 +167,12 @@ class MockPageBroadcast : public blink::mojom::PageBroadcast {
                (bool supports_draggable_regions),
                (override));
  
@@ -23,10 +23,10 @@ index 74b39146bbb8151a66ecb4f138f769fffc2525b2..a54948fa36c85c5c5dd04b9836951b1c
      return receiver_.BindNewEndpointAndPassDedicatedRemote();
    }
 diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
-index a9e4dbfd99b56167d05aa6c30c09408036bc897d..1b0f636cc3705eda221389967d9cd3acf563f00d 100644
+index 44fc40e608097797e4c2f5675bf10e5cdeb54d27..aa1d092cfc389fe81052160dc435981069a8a600 100644
 --- a/content/browser/renderer_host/render_view_host_impl.cc
 +++ b/content/browser/renderer_host/render_view_host_impl.cc
-@@ -779,6 +779,11 @@ void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
+@@ -756,6 +756,11 @@ void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
    GetWidget()->GetAssociatedFrameWidget()->SetBackgroundOpaque(opaque);
  }
  
@@ -51,7 +51,7 @@ index 7944fe64e0da112fc670358b75506bb199bb5e4a..0e3c16c6af2a078943e9f39808134ab2
    void SendRendererPreferencesToRenderer(
        const blink::RendererPreferences& preferences);
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
-index d97cbb4fd8e12bcbff19bf8cc8378997110c60c0..1041d25d5ef78abdcf7b85fe8457ec2a20e2a759 100644
+index c6434aedc2529a05c74d8163f2184990cd7cb14c..f19ed1ca1b5f28fc0373106c961a91976df12061 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
 @@ -632,8 +632,8 @@ void RenderWidgetHostViewAura::ShowImpl(PageVisibilityState page_visibility) {
@@ -80,22 +80,22 @@ index 782bed0fdc08d57eceb059f398f253fab9233b1b..f1ab5b981ea68af1b11313e67f2c5060
    // This interface should only be implemented inside content.
    friend class RenderViewHostImpl;
 diff --git a/content/test/test_page_broadcast.h b/content/test/test_page_broadcast.h
-index 8762811ec25069ddd0c57e3ffb50d158532a39b1..f5cdae891cc3b98371ae18dbc119b5e7f379f2bf 100644
+index 4c8d44cdb2fde8e174b78aee7defb980651da18e..f8bf421b5b32af4cd197cbf23f4bd281c3a12514 100644
 --- a/content/test/test_page_broadcast.h
 +++ b/content/test/test_page_broadcast.h
-@@ -54,6 +54,7 @@ class TestPageBroadcast : public blink::mojom::PageBroadcast {
-   void UpdateCanvasNoiseToken(
-       std::optional<blink::NoiseToken> canvas_noise_token) override;
+@@ -52,6 +52,7 @@ class TestPageBroadcast : public blink::mojom::PageBroadcast {
+   void UpdateColorProviders(
+       const blink::ColorProviderColorMaps& color_provider_colors) override;
    void SetSupportsDraggableRegions(bool supports_draggable_regions) override;
 +  void SetSchedulerThrottling(bool allowed) override {}
  
    mojo::AssociatedReceiver<blink::mojom::PageBroadcast> receiver_;
  };
 diff --git a/third_party/blink/public/mojom/page/page.mojom b/third_party/blink/public/mojom/page/page.mojom
-index fb846303b126c0bbaa252b8b6c5b9b2971100c62..e6dcf94dcde8515e9cf73656d6c1659492aac4b4 100644
+index b00bc8a8a5044fbf46f627f9db56cea7f09d7ef6..114c3a4522d11c1348f681af500c487ccd97eea9 100644
 --- a/third_party/blink/public/mojom/page/page.mojom
 +++ b/third_party/blink/public/mojom/page/page.mojom
-@@ -186,4 +186,7 @@ interface PageBroadcast {
+@@ -180,4 +180,7 @@ interface PageBroadcast {
    // Indicates that the page's main frame should collect draggable regions set
    // using the app-region CSS property.
    SetSupportsDraggableRegions(bool supports_draggable_regions);
@@ -104,10 +104,10 @@ index fb846303b126c0bbaa252b8b6c5b9b2971100c62..e6dcf94dcde8515e9cf73656d6c16594
 +  SetSchedulerThrottling(bool allowed);
  };
 diff --git a/third_party/blink/public/web/web_view.h b/third_party/blink/public/web/web_view.h
-index 11a31c9ed26b5abde0ea812eae6b219340ed711c..a72cf76b820cb86b9495ea147efbdcf53b8a9845 100644
+index 932658273154ef2e022358e493a8e7c00c86e732..57bbfb5cde62c9496c351c861880a18918e22c05 100644
 --- a/third_party/blink/public/web/web_view.h
 +++ b/third_party/blink/public/web/web_view.h
-@@ -366,6 +366,7 @@ class BLINK_EXPORT WebView {
+@@ -355,6 +355,7 @@ class BLINK_EXPORT WebView {
    // Scheduling -----------------------------------------------------------
  
    virtual PageScheduler* Scheduler() const = 0;
@@ -116,10 +116,10 @@ index 11a31c9ed26b5abde0ea812eae6b219340ed711c..a72cf76b820cb86b9495ea147efbdcf5
    // Visibility -----------------------------------------------------------
  
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index 9d1d25758c8f5f7adb613516a87e81c33e31072b..de1c308b599377dd2598a75427347dc5c980fc07 100644
+index e974581ae0c6b146b92054a56174ba8fdb666574..0d1cd0e4f502f44362fba6552080f31fe5c6b7ea 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
-@@ -2501,6 +2501,10 @@ void WebViewImpl::SetPageLifecycleStateInternal(
+@@ -2505,6 +2505,10 @@ void WebViewImpl::SetPageLifecycleStateInternal(
    TRACE_EVENT2("navigation", "WebViewImpl::SetPageLifecycleStateInternal",
                 "old_state", old_state, "new_state", new_state);
  
@@ -130,7 +130,7 @@ index 9d1d25758c8f5f7adb613516a87e81c33e31072b..de1c308b599377dd2598a75427347dc5
    bool storing_in_bfcache = new_state->is_in_back_forward_cache &&
                              !old_state->is_in_back_forward_cache;
    bool restoring_from_bfcache = !new_state->is_in_back_forward_cache &&
-@@ -4018,10 +4022,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
+@@ -4013,10 +4017,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
    return GetPage()->GetPageScheduler();
  }
  
@@ -155,10 +155,10 @@ index 9d1d25758c8f5f7adb613516a87e81c33e31072b..de1c308b599377dd2598a75427347dc5
    // Do not throttle if the page should be painting.
    bool is_visible =
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.h b/third_party/blink/renderer/core/exported/web_view_impl.h
-index 5dd87ed6a78156cf7d1fc130fc2db6b399227d76..6bd345d2fb854c5d2a79bfcfa9d8618c35bd8489 100644
+index aecdcea36ed0a502a9da68e871e0ee86040b4350..b2788642a20511f3725d045bc97bc108fba88752 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.h
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.h
-@@ -452,6 +452,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,
+@@ -445,6 +445,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,
    LocalDOMWindow* PagePopupWindow() const;
  
    PageScheduler* Scheduler() const override;
@@ -166,7 +166,7 @@ index 5dd87ed6a78156cf7d1fc130fc2db6b399227d76..6bd345d2fb854c5d2a79bfcfa9d8618c
    void SetVisibilityState(mojom::blink::PageVisibilityState visibility_state,
                            bool is_initial_state) override;
    mojom::blink::PageVisibilityState GetVisibilityState() override;
-@@ -945,6 +946,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
+@@ -938,6 +939,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
    // If true, we send IPC messages when |preferred_size_| changes.
    bool send_preferred_size_changes_ = false;
  

patches/chromium/allow_in-process_windows_to_have_different_web_prefs.patch

@@ -8,10 +8,10 @@ WebPreferences of in-process child windows, rather than relying on
 process-level command line switches, as before.
 
 diff --git a/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc b/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
-index 845edd77da72cfe2d9a56e15cf1e50bdd391be49..9b50605b67c0da8692653816c8638ea89561282f 100644
+index 11e6b9d984eb95adfeb8675d487002fa1ac851bd..081cf9d03cb9db13113b604af104afbe9030e5c8 100644
 --- a/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
 +++ b/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
-@@ -148,6 +148,19 @@ bool StructTraits<blink::mojom::WebPreferencesDataView,
+@@ -150,6 +150,19 @@ bool StructTraits<blink::mojom::WebPreferencesDataView,
    out->v8_cache_options = data.v8_cache_options();
    out->record_whole_document = data.record_whole_document();
    out->stylus_handwriting_enabled = data.stylus_handwriting_enabled();
@@ -32,7 +32,7 @@ index 845edd77da72cfe2d9a56e15cf1e50bdd391be49..9b50605b67c0da8692653816c8638ea8
    out->accelerated_video_decode_enabled =
        data.accelerated_video_decode_enabled();
 diff --git a/third_party/blink/public/common/web_preferences/web_preferences.h b/third_party/blink/public/common/web_preferences/web_preferences.h
-index da99e295dd7c063b5416d310fe91d422e74bf5fb..0c91e14c0fb760dd075f517731d110caa3f7739a 100644
+index 1ba0466171963503d412b8aeb37d5953b3bbda9d..34654a186c0dc1715ac217d4c1480e6c36897e93 100644
 --- a/third_party/blink/public/common/web_preferences/web_preferences.h
 +++ b/third_party/blink/public/common/web_preferences/web_preferences.h
 @@ -9,6 +9,7 @@
@@ -43,7 +43,7 @@ index da99e295dd7c063b5416d310fe91d422e74bf5fb..0c91e14c0fb760dd075f517731d110ca
  #include "build/build_config.h"
  #include "net/nqe/effective_connection_type.h"
  #include "third_party/blink/public/common/common_export.h"
-@@ -460,6 +461,19 @@ struct BLINK_COMMON_EXPORT WebPreferences {
+@@ -466,6 +467,19 @@ struct BLINK_COMMON_EXPORT WebPreferences {
    bool should_screenshot_on_mainframe_same_doc_navigation = true;
  #endif  // BUILDFLAG(IS_ANDROID)
  
@@ -64,7 +64,7 @@ index da99e295dd7c063b5416d310fe91d422e74bf5fb..0c91e14c0fb760dd075f517731d110ca
    // chrome, except for the cases where it would require lots of extra work for
    // the embedder to use the same default value.
 diff --git a/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h b/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
-index b46fc738d5813a71212c4e1a29a8d08fc15982b3..f65ece291742e9776612cd1e5d2bf2f741c6a400 100644
+index 53cfdb6a2739aedef3c72fc2e43709dd5a673c79..045b43f48a619234a8c0c4c76aea1025c10f193d 100644
 --- a/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
 +++ b/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
 @@ -8,6 +8,7 @@
@@ -75,7 +75,7 @@ index b46fc738d5813a71212c4e1a29a8d08fc15982b3..f65ece291742e9776612cd1e5d2bf2f7
  #include "mojo/public/cpp/bindings/struct_traits.h"
  #include "net/nqe/effective_connection_type.h"
  #include "third_party/blink/public/common/common_export.h"
-@@ -434,6 +435,52 @@ struct BLINK_COMMON_EXPORT StructTraits<blink::mojom::WebPreferencesDataView,
+@@ -439,6 +440,52 @@ struct BLINK_COMMON_EXPORT StructTraits<blink::mojom::WebPreferencesDataView,
      return r.stylus_handwriting_enabled;
    }
  
@@ -129,7 +129,7 @@ index b46fc738d5813a71212c4e1a29a8d08fc15982b3..f65ece291742e9776612cd1e5d2bf2f7
      return r.cookie_enabled;
    }
 diff --git a/third_party/blink/public/mojom/webpreferences/web_preferences.mojom b/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
-index 03ae611eda0f4b9888c498b89e4b805dbe629268..b96998d728c9b107532b2ec67320367eaa6b1f94 100644
+index 58b674f1848a5a70d08323d6f734794218d6ea8e..7011b1b7a754bfc2be30cf4eb07a32134d218359 100644
 --- a/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
 +++ b/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
 @@ -4,6 +4,7 @@
@@ -140,7 +140,7 @@ index 03ae611eda0f4b9888c498b89e4b805dbe629268..b96998d728c9b107532b2ec67320367e
  import "mojo/public/mojom/base/string16.mojom";
  import "skia/public/mojom/skcolor.mojom";
  import "third_party/blink/public/mojom/css/preferred_color_scheme.mojom";
-@@ -223,6 +224,19 @@ struct WebPreferences {
+@@ -224,6 +225,19 @@ struct WebPreferences {
    // If true, stylus handwriting recognition to text input will be available in
    // editable input fields which are non-password type.
    bool stylus_handwriting_enabled;

patches/chromium/blink_local_frame.patch

@@ -15,7 +15,7 @@ Refs changes in:
 This patch reverts the changes to fix associated crashes in Electron.
 
 diff --git a/third_party/blink/renderer/core/frame/frame.cc b/third_party/blink/renderer/core/frame/frame.cc
-index cdb5b9246087b5678cf6a0f2713f6238dafc13de..7efbe7524c5ddd3785fff0e2d8901f931f024f48 100644
+index 2670ea1361ccd8a9e3bac507e94dd25b7205ecf9..c12f78d925e4ccb4ac2fd3851a9c61e87058dc75 100644
 --- a/third_party/blink/renderer/core/frame/frame.cc
 +++ b/third_party/blink/renderer/core/frame/frame.cc
 @@ -134,14 +134,6 @@ bool Frame::Detach(FrameDetachType type) {
@@ -49,10 +49,10 @@ index cdb5b9246087b5678cf6a0f2713f6238dafc13de..7efbe7524c5ddd3785fff0e2d8901f93
    // its owning reference back to our owning LocalFrame.
    client_->Detached(type);
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
-index 0b8972e0ab8ff854fc169b39d762790299f7bf9c..fdbafb9177d345181339fcdf2d95aebbd8665a49 100644
+index f05c75ec4483f60ccbb4aac3c4bc322d594ab217..b299f0dbfcc23458390d2c7298cc5df33f129b2b 100644
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
-@@ -747,10 +747,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
+@@ -750,10 +750,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
    }
    DCHECK(!view_ || !view_->IsAttached());
  
@@ -63,7 +63,7 @@ index 0b8972e0ab8ff854fc169b39d762790299f7bf9c..fdbafb9177d345181339fcdf2d95aebb
    if (!Client())
      return false;
  
-@@ -804,6 +800,11 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
+@@ -807,6 +803,11 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
    DCHECK(!view_->IsAttached());
    Client()->WillBeDetached();
  

patches/chromium/build_allow_electron_mojom_interfaces_to_depend_on_blink.patch

@@ -10,10 +10,10 @@ Needed for:
 2) //electron/shell/common:web_contents_utility
 
 diff --git a/content/public/common/BUILD.gn b/content/public/common/BUILD.gn
-index b6511498e08e6d0a280b89175fcfdb61c7e40df4..e214d7ea5e7108baf9f9910d6b44deff587914c2 100644
+index 49f3360c3d5ff66ebbc7d6164de3f7ff7244b1fe..ec9018d38520dfca461e9dbb041566b0b3400133 100644
 --- a/content/public/common/BUILD.gn
 +++ b/content/public/common/BUILD.gn
-@@ -370,6 +370,8 @@ mojom("interfaces") {
+@@ -362,6 +362,8 @@ mojom("interfaces") {
      "//content/common/*",
      "//extensions/common:mojom",
      "//extensions/common:mojom_blink",

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -11,7 +11,7 @@ if we ever align our .pak file generation with Chrome we can remove this
 patch.
 
 diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
-index c51468e6fdb46634b5458b387d1c78caf2dd083f..7236611d2a392008f43b1b83ae125e945673f31c 100644
+index 606b3bd43179a5b4179a6ec9f58e531d55c1acb5..4d503a53290b4deaea016bb6867f3c07920f4055 100644
 --- a/chrome/BUILD.gn
 +++ b/chrome/BUILD.gn
 @@ -196,11 +196,16 @@ if (!is_android && !is_mac) {
@@ -33,10 +33,10 @@ index c51468e6fdb46634b5458b387d1c78caf2dd083f..7236611d2a392008f43b1b83ae125e94
          "//base",
          "//build:branding_buildflags",
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index 03b7e243f304528ed12fcb0194f084bb4475d3a6..5ae8aaea4939b6a5500f487fa79c6352ffd6d173 100644
+index b5d32cb1857b2fa7bd5e599a9256ce4d512d7887..dead035b27372526a81aea766be78308c7f56620 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -4823,7 +4823,7 @@ static_library("browser") {
+@@ -4837,7 +4837,7 @@ static_library("browser") {
        ]
      }
  
@@ -46,10 +46,10 @@ index 03b7e243f304528ed12fcb0194f084bb4475d3a6..5ae8aaea4939b6a5500f487fa79c6352
        # than here in :chrome_dll.
        deps += [ "//chrome:packed_resources_integrity_header" ]
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 870557c8f7edb33c6373d59ffa9e87483262ca27..0e7ce248a0af7b9062ae258613474f859a3e153c 100644
+index 4882a382e133cefbc669035471c02d90e4592cf0..f24ba12f37e8c926259de9f1ae0b724acdab2afe 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -7583,9 +7583,12 @@ test("unit_tests") {
+@@ -7602,9 +7602,12 @@ test("unit_tests") {
        "//chrome/notification_helper",
      ]
  
@@ -63,7 +63,7 @@ index 870557c8f7edb33c6373d59ffa9e87483262ca27..0e7ce248a0af7b9062ae258613474f85
        "//chrome//services/util_win:unit_tests",
        "//chrome/app:chrome_dll_resources",
        "//chrome/app:win_unit_tests",
-@@ -8521,6 +8524,10 @@ test("unit_tests") {
+@@ -8547,6 +8550,10 @@ test("unit_tests") {
        "../browser/performance_manager/policies/background_tab_loading_policy_unittest.cc",
      ]
  
@@ -74,7 +74,7 @@ index 870557c8f7edb33c6373d59ffa9e87483262ca27..0e7ce248a0af7b9062ae258613474f85
      sources += [
        # The importer code is not used on Android.
        "../common/importer/firefox_importer_utils_unittest.cc",
-@@ -8577,7 +8584,6 @@ test("unit_tests") {
+@@ -8603,7 +8610,6 @@ test("unit_tests") {
      # TODO(crbug.com/417513088): Maybe merge with the non-android `deps` declaration above?
      deps += [
        "../browser/screen_ai:screen_ai_install_state",

patches/chromium/build_gn.patch

@@ -7,7 +7,7 @@ These are variables we add to the root BUILDCONFIG so that they're available
 everywhere, without having to import("//electron/.../flags.gni").
 
 diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
-index 69f7eb1ac466fbd4e528e3cf2e4e2f96e622424f..05f540daf67de55c09befa81b487a8fb9c45e751 100644
+index 749662ebf2e8f271400f4015f5503378f42ef2b4..f974d8048ca21371865bcae56e8e687529e0be4b 100644
 --- a/build/config/BUILDCONFIG.gn
 +++ b/build/config/BUILDCONFIG.gn
 @@ -123,6 +123,9 @@ if (current_os == "") {

patches/chromium/can_create_window.patch

@@ -9,10 +9,10 @@ potentially prevent a window from being created.
 TODO(loc): this patch is currently broken.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index c6addeca2a539557c4b6bbb1c20e9904c64525f5..c50cceaf899308e126844e986abc4e01bc7497bb 100644
+index 5025a34f81d255c9c3f8cb8c7ba8e570297f9a06..772cff9b1a9a061645f2220fdc3003627679ac58 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -9848,6 +9848,7 @@ void RenderFrameHostImpl::CreateNewWindow(
+@@ -9878,6 +9878,7 @@ void RenderFrameHostImpl::CreateNewWindow(
            last_committed_origin_, params->window_container_type,
            params->target_url, params->referrer.To<Referrer>(),
            params->frame_name, params->disposition, *params->features,
@@ -21,10 +21,10 @@ index c6addeca2a539557c4b6bbb1c20e9904c64525f5..c50cceaf899308e126844e986abc4e01
            &no_javascript_access);
  
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 5aa061cd96f291eb955892363180e412c495f1d6..f208b31c5e39cb8c4e5e50ed3dd236bdc266baa5 100644
+index b33145fdbfafd5ea1c23255a4fb8eff2088df915..e003e3a9784e3a9741283128a97f4e3bc255935b 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -5356,6 +5356,10 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5314,6 +5314,10 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    create_params.initially_hidden = renderer_started_hidden;
    create_params.initial_popup_url = params.target_url;
  
@@ -35,7 +35,7 @@ index 5aa061cd96f291eb955892363180e412c495f1d6..f208b31c5e39cb8c4e5e50ed3dd236bd
    // Even though all codepaths leading here are in response to a renderer
    // trying to open a new window, if the new window ends up in a different
    // browsing instance, then the RenderViewHost, RenderWidgetHost,
-@@ -5410,6 +5414,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5366,6 +5370,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    // Sets the newly created WebContents WindowOpenDisposition.
    new_contents_impl->original_window_open_disposition_ = params.disposition;
  
@@ -48,7 +48,7 @@ index 5aa061cd96f291eb955892363180e412c495f1d6..f208b31c5e39cb8c4e5e50ed3dd236bd
    // If the new frame has a name, make sure any SiteInstances that can find
    // this named frame have proxies for it.  Must be called after
    // SetSessionStorageNamespace, since this calls CreateRenderView, which uses
-@@ -5451,12 +5461,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5407,12 +5417,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
      AddWebContentsDestructionObserver(new_contents_impl);
    }
  
@@ -62,10 +62,10 @@ index 5aa061cd96f291eb955892363180e412c495f1d6..f208b31c5e39cb8c4e5e50ed3dd236bd
                               new_contents_impl, opener, params.target_url,
                               params.referrer.To<Referrer>(), params.disposition,
 diff --git a/content/common/frame.mojom b/content/common/frame.mojom
-index 3ef244ccfe40506e22b5c3d293a25d04e908ddcf..d17fd7226d7f8a585e82a9f155459a6835504be4 100644
+index 4c55f0abf8df5a3408f3f90d444ceff3c23ee1bc..72bdb5b5a4c2c21a7192b34bb293bd23bafaf50c 100644
 --- a/content/common/frame.mojom
 +++ b/content/common/frame.mojom
-@@ -658,6 +658,10 @@ struct CreateNewWindowParams {
+@@ -648,6 +648,10 @@ struct CreateNewWindowParams {
    pending_associated_remote<blink.mojom.Widget> widget;
    pending_associated_receiver<blink.mojom.FrameWidgetHost> frame_widget_host;
    pending_associated_remote<blink.mojom.FrameWidget> frame_widget;
@@ -77,10 +77,10 @@ index 3ef244ccfe40506e22b5c3d293a25d04e908ddcf..d17fd7226d7f8a585e82a9f155459a68
  
  // Operation result when the renderer asks the browser to create a new window.
 diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
-index 8e4e1a3b7d84803077b0b7719d2c6a87a4ed1d91..de9ae56525931d3497881acf287abb798acc19f5 100644
+index a0ccc5352495e75e1603fd3f90825eba85276a6a..3cf480086d77bddb3328aa02137e7bb66c2eb511 100644
 --- a/content/public/browser/content_browser_client.cc
 +++ b/content/public/browser/content_browser_client.cc
-@@ -883,6 +883,8 @@ bool ContentBrowserClient::CanCreateWindow(
+@@ -885,6 +885,8 @@ bool ContentBrowserClient::CanCreateWindow(
      const std::string& frame_name,
      WindowOpenDisposition disposition,
      const blink::mojom::WindowFeatures& features,
@@ -90,10 +90,10 @@ index 8e4e1a3b7d84803077b0b7719d2c6a87a4ed1d91..de9ae56525931d3497881acf287abb79
      bool opener_suppressed,
      bool* no_javascript_access) {
 diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
-index 038f760010334a1f27a6e31bdeb87fa691f4cd17..86967a3df04e0ce4f464f399d547ca0252168af0 100644
+index 3ca58d5630486cd378f3109b1ca59a4563608187..9f8fe55d6c360e3a709f2e5f05baf02c9ca29101 100644
 --- a/content/public/browser/content_browser_client.h
 +++ b/content/public/browser/content_browser_client.h
-@@ -202,6 +202,7 @@ class NetworkService;
+@@ -203,6 +203,7 @@ class NetworkService;
  class TrustedURLLoaderHeaderClient;
  }  // namespace mojom
  struct ResourceRequest;
@@ -101,7 +101,7 @@ index 038f760010334a1f27a6e31bdeb87fa691f4cd17..86967a3df04e0ce4f464f399d547ca02
  }  // namespace network
  
  namespace sandbox {
-@@ -1460,6 +1461,8 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1462,6 +1463,8 @@ class CONTENT_EXPORT ContentBrowserClient {
        const std::string& frame_name,
        WindowOpenDisposition disposition,
        const blink::mojom::WindowFeatures& features,
@@ -111,10 +111,10 @@ index 038f760010334a1f27a6e31bdeb87fa691f4cd17..86967a3df04e0ce4f464f399d547ca02
        bool opener_suppressed,
        bool* no_javascript_access);
 diff --git a/content/public/browser/web_contents_delegate.cc b/content/public/browser/web_contents_delegate.cc
-index edee20df7f5bb087df9c134c7892f4befe2f14b9..df972f1ce594f2d4651202b650ff2d41fe19ecd0 100644
+index 2bac91454385d005d8a6d14c45e63e64923310e0..4f79d90a7d30a6ce2a3720ef94c1ade264d20e16 100644
 --- a/content/public/browser/web_contents_delegate.cc
 +++ b/content/public/browser/web_contents_delegate.cc
-@@ -34,6 +34,17 @@ namespace content {
+@@ -35,6 +35,17 @@ namespace content {
  
  WebContentsDelegate::WebContentsDelegate() = default;
  
@@ -133,10 +133,10 @@ index edee20df7f5bb087df9c134c7892f4befe2f14b9..df972f1ce594f2d4651202b650ff2d41
      WebContents* source,
      const OpenURLParams& params,
 diff --git a/content/public/browser/web_contents_delegate.h b/content/public/browser/web_contents_delegate.h
-index 0c3d4f8ed4df5ca8d9db5424fa2be2d26510c4c9..98492cff13c97388d001fc33cc948261990edef1 100644
+index 2cda4986f3cdef0a01e755b57c307890b62aa4e2..1dab9cf23213d497bb6354d3b909911b014675ba 100644
 --- a/content/public/browser/web_contents_delegate.h
 +++ b/content/public/browser/web_contents_delegate.h
-@@ -18,6 +18,7 @@
+@@ -19,6 +19,7 @@
  #include "base/types/expected.h"
  #include "build/build_config.h"
  #include "content/common/content_export.h"
@@ -144,15 +144,15 @@ index 0c3d4f8ed4df5ca8d9db5424fa2be2d26510c4c9..98492cff13c97388d001fc33cc948261
  #include "content/public/browser/eye_dropper.h"
  #include "content/public/browser/fullscreen_types.h"
  #include "content/public/browser/invalidate_type.h"
-@@ -29,6 +30,7 @@
+@@ -30,6 +31,7 @@
  #include "content/public/browser/select_audio_output_request.h"
  #include "content/public/browser/serial_chooser.h"
  #include "content/public/browser/storage_partition_config.h"
 +#include "content/public/browser/web_contents.h"
  #include "content/public/common/window_container_type.mojom-forward.h"
  #include "third_party/blink/public/common/input/web_mouse_event.h"
- #include "third_party/blink/public/common/mediastream/media_stream_request.h"
-@@ -385,6 +387,16 @@ class CONTENT_EXPORT WebContentsDelegate {
+ #include "third_party/blink/public/common/page/drag_operation.h"
+@@ -397,6 +399,16 @@ class CONTENT_EXPORT WebContentsDelegate {
        const StoragePartitionConfig& partition_config,
        SessionStorageNamespace* session_storage_namespace);
  
@@ -170,10 +170,10 @@ index 0c3d4f8ed4df5ca8d9db5424fa2be2d26510c4c9..98492cff13c97388d001fc33cc948261
    // typically happens when popups are created.
    virtual void WebContentsCreated(WebContents* source_contents,
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index 9d495e31443cf4c50024b9c892fb7c7d0b40bed0..298387873e7ded5f96c788bc53ad7256a8f5b13e 100644
+index 403ecc046ee270175a7e7444d9d80ed4456450cc..d4755acfd0ba3016da545de87d64046a6f5ee387 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -6740,6 +6740,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
+@@ -6727,6 +6727,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
            request.HasUserGesture(), GetWebFrame()->IsAdFrame(),
            GetWebFrame()->IsAdScriptInStack());
  
@@ -211,7 +211,7 @@ index 790f004d2a3a9ae5a3588fda097732a5daac0c75..83fcc9418b89b669863e730f2049a1d8
                         bool opener_suppressed,
                         bool* no_javascript_access) override;
 diff --git a/third_party/blink/public/web/web_window_features.h b/third_party/blink/public/web/web_window_features.h
-index 82e9d3dfb5f7da76d89fe15ae61d379fa46e177d..fd035512099a54dff6cc951a2226c23a252a90e2 100644
+index d92bab531c12c62a5321a23f4a0cb89691668127..c354a79c7c8dd047264df35b873e90c15fa364a2 100644
 --- a/third_party/blink/public/web/web_window_features.h
 +++ b/third_party/blink/public/web/web_window_features.h
 @@ -35,6 +35,7 @@
@@ -222,7 +222,7 @@ index 82e9d3dfb5f7da76d89fe15ae61d379fa46e177d..fd035512099a54dff6cc951a2226c23a
  
  namespace blink {
  
-@@ -74,6 +75,8 @@ struct WebWindowFeatures {
+@@ -70,6 +71,8 @@ struct WebWindowFeatures {
    // TODO(apaseltiner): Investigate moving this field to a non-public struct
    // since it is only needed within //third_party/blink.
    std::optional<std::vector<WebString>> attribution_srcs;
@@ -232,7 +232,7 @@ index 82e9d3dfb5f7da76d89fe15ae61d379fa46e177d..fd035512099a54dff6cc951a2226c23a
  
  }  // namespace blink
 diff --git a/third_party/blink/renderer/core/frame/local_dom_window.cc b/third_party/blink/renderer/core/frame/local_dom_window.cc
-index 04c6dad1650273f15d60f8ad6bf51ca771f77923..ae64f6f689bdaa1221634b2b434e62c52aa9084f 100644
+index 438eba715eb4f2a59676491d4d06cd6969c2a107..cfdd94e58cc81ce7b56a1ca64fe7b32cf7bc1f7e 100644
 --- a/third_party/blink/renderer/core/frame/local_dom_window.cc
 +++ b/third_party/blink/renderer/core/frame/local_dom_window.cc
 @@ -2340,6 +2340,8 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
@@ -241,6 +241,6 @@ index 04c6dad1650273f15d60f8ad6bf51ca771f77923..ae64f6f689bdaa1221634b2b434e62c5
  
 +  window_features.raw_features = features;
 +
-   if (window_features.is_partitioned_popin) {
-     UseCounter::Count(*entered_window,
-                       WebFeature::kPartitionedPopin_OpenAttempt);
+   // In fenced frames, we should always use `noopener`.
+   if (GetFrame()->IsInFencedFrameTree()) {
+     window_features.noopener = true;