chore: e patches all

manually update patch due to context shear from patch removal in previous commit

.github/CODEOWNERS

@@ -8,7 +8,6 @@
 DEPS                                    @electron/wg-upgrades
 
 # Releases WG
-/.github/workflows/update_appveyor_image.yml @electron/wg-releases
 /docs/breaking-changes.md               @electron/wg-releases
 /npm/                                   @electron/wg-releases
 /script/release                         @electron/wg-releases

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,6 +1,6 @@
 name: Bug Report
-description: Report a bug in Electron
-type: 'bug'
+description: Report an Electron bug
+title: "[Bug]: "
 labels: "bug :beetle:"
 body:
 - type: checkboxes

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,6 +1,6 @@
 name: Feature Request
 description: Suggest an idea for Electron
-type: 'enhancement'
+title: "[Feature Request]: "
 labels: "enhancement :sparkles:"
 body:
 - type: checkboxes

.github/actions/build-electron/action.yml

@@ -69,7 +69,7 @@ runs:
       shell: bash
       run: |
         cd src
-        e build --target electron:electron_dist_zip -j $NUMBER_OF_NINJA_PROCESSES -d explain
+        e build --target electron:electron_dist_zip -j $NUMBER_OF_NINJA_PROCESSES
         if [ "${{ inputs.is-asan }}" != "true" ]; then
           target_os=${{ inputs.target-platform == 'macos' && 'mac' || inputs.target-platform }}
           if [ "${{ inputs.artifact-platform }}" = "mas" ]; then
@@ -108,7 +108,9 @@ runs:
         if [ "${{ inputs.target-platform }}" = "win" ]; then
           cd out/Default
           powershell Compress-Archive -update mksnapshot_args mksnapshot.zip
-          powershell Compress-Archive -update gen/v8/embedded.S mksnapshot.zip
+          powershell mkdir mktmp\\gen\\v8
+          powershell Copy-Item gen\\v8\\embedded.S mktmp\\gen\\v8
+          powershell Compress-Archive -update -Path mktmp\\gen mksnapshot.zip
         else
           (cd out/Default; zip mksnapshot.zip mksnapshot_args gen/v8/embedded.S)
         fi
@@ -143,6 +145,25 @@ runs:
       run: |
         cd src
         e build --target electron:node_headers
+    - name: Create installed_software.json ${{ inputs.step-suffix }}
+      shell: powershell
+      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'win' }}
+      run: |
+        cd src
+        Get-CimInstance -Namespace root\cimv2 -Class Win32_product | Select vendor, description, @{l='install_location';e='InstallLocation'}, @{l='install_date';e='InstallDate'}, @{l='install_date_2';e='InstallDate2'}, caption, version, name, @{l='sku_number';e='SKUNumber'} | ConvertTo-Json | Out-File -Encoding utf8 -FilePath .\installed_software.json
+    - name: Profile Windows Toolchain ${{ inputs.step-suffix }}
+      shell: bash
+      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'win' }}
+      run: |
+        cd src
+        python3 electron/build/profile_toolchain.py --output-json=out/Default/windows_toolchain_profile.json
+    - name: Add msdia140.dll to Path ${{ inputs.step-suffix }}
+      shell: bash
+      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'win' }}
+      run: |
+        # Needed for msdia140.dll on 64-bit windows
+        cd src
+        export PATH="$PATH:$(pwd)/third_party/llvm-build/Release+Asserts/bin"
     - name: Generate & Zip Symbols ${{ inputs.step-suffix }}
       shell: bash
       run: |

.github/actions/checkout/action.yml

@@ -20,6 +20,8 @@ runs:
     uses: ./src/electron/.github/actions/install-dependencies
   - name: Install Build Tools
     uses: ./src/electron/.github/actions/install-build-tools
+  - name: Set Chromium Git Cookie
+    uses: ./src/electron/.github/actions/set-chromium-cookie
   - name: Get Depot Tools
     shell: bash
     run: |
@@ -73,10 +75,10 @@ runs:
     if: steps.check-cache.outputs.cache_exists == 'false' && inputs.use-cache  == 'true'
     shell: bash
     run: |    
-      # if there is less than 20 GB free space then creating the cache might fail so exit early
+      # if there is less than 35 GB free space then creating the cache might fail so exit early
       freespace=`df -m /mnt/cross-instance-cache | grep -w /mnt/cross-instance-cache | awk '{print $4}'`
       freespace_human=`df -h /mnt/cross-instance-cache | grep -w /mnt/cross-instance-cache | awk '{print $4}'`
-      if [ $freespace -le 20000 ]; then
+      if [ $freespace -le 35000 ]; then
         echo "The cross mount cache has $freespace_human free space which is not enough - exiting"
         exit 1
       else

.github/actions/install-build-tools/action.yml

@@ -16,5 +16,5 @@ runs:
       e auto-update disable
       if [ "$(expr substr $(uname -s) 1 10)" == "MSYS_NT-10" ]; then
         e d cipd.bat --version
-        cp "C:\Python37\python.exe" "C:\Python37\python3.exe"
+        cp "C:\Python311\python.exe" "C:\Python311\python3.exe"
       fi

.github/actions/set-chromium-cookie/action.yml

@@ -0,0 +1,26 @@
+name: 'Set Chromium Git Cookie'
+description: 'Sets an authenticated cookie from Chromium to allow for a higher request limit'
+runs:
+  using: "composite"
+  steps:
+  - name: Set the git cookie from chromium.googlesource.com (Unix)
+    if: ${{ runner.os != 'Windows' && env.CHROMIUM_GIT_COOKIE }}
+    shell: bash
+    run: |
+      eval 'set +o history' 2>/dev/null || setopt HIST_IGNORE_SPACE 2>/dev/null
+      touch ~/.gitcookies
+      chmod 0600 ~/.gitcookies
+
+      git config --global http.cookiefile ~/.gitcookies
+
+      tr , \\t <<\__END__ >>~/.gitcookies
+      ${{ env.CHROMIUM_GIT_COOKIE }}
+      __END__
+      eval 'set -o history' 2>/dev/null || unsetopt HIST_IGNORE_SPACE 2>/dev/null
+  - name: Set the git cookie from chromium.googlesource.com (Windows)
+    if: ${{ runner.os == 'Windows' && env.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
+    shell: cmd
+    run: |
+      git config --global http.cookiefile "%USERPROFILE%\.gitcookies"
+      powershell -noprofile -nologo -command Write-Output "${{ env.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}" >>"%USERPROFILE%\.gitcookies"
+

.github/workflows/archaeologist-dig.yml

@@ -9,11 +9,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Electron
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.0.2
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.0.2
         with:
           fetch-depth: 0
       - name: Setup Node.js/npm
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+        uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6
         with:
           node-version: 20.11.x
       - name: Setting Up Dig Site
@@ -41,7 +41,7 @@ jobs:
           sha-file: .dig-old
           filename: electron.old.d.ts
       - name: Upload artifacts
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 #v4.6.0
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 #v4.4.0
         with:
           name: artifacts
           path: electron/artifacts

.github/workflows/branch-created.yml

@@ -94,7 +94,7 @@ jobs:
             }))
       - name: Create Release Project Board
         if: ${{ steps.check-major-version.outputs.MAJOR }}
-        uses: dsanders11/project-actions/copy-project@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/copy-project@eb760c48894b5702398529cbb8f6e98378e315d0 # v1.3.0
         id: create-release-board
         with:
           drafts: true
@@ -114,14 +114,14 @@ jobs:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
       - name: Find Previous Release Project Board
         if: ${{ steps.check-major-version.outputs.MAJOR }}
-        uses: dsanders11/project-actions/find-project@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/find-project@eb760c48894b5702398529cbb8f6e98378e315d0 # v1.3.0
         id: find-prev-release-board
         with:
           title: ${{ steps.generate-project-metadata.outputs.prev-prev-major }}-x-y
           token: ${{ steps.generate-token.outputs.token }}
       - name: Close Previous Release Project Board
         if: ${{ steps.check-major-version.outputs.MAJOR }}
-        uses: dsanders11/project-actions/close-project@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/close-project@eb760c48894b5702398529cbb8f6e98378e315d0 # v1.3.0
         with:
           project-number: ${{ steps.find-prev-release-board.outputs.number }}
           token: ${{ steps.generate-token.outputs.token }}

.github/workflows/build.yml

@@ -100,12 +100,13 @@ jobs:
         - /mnt/cross-instance-cache:/mnt/cross-instance-cache
         - /var/run/sas:/var/run/sas
     env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
     outputs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0
@@ -126,13 +127,14 @@ jobs:
         - /mnt/cross-instance-cache:/mnt/cross-instance-cache
         - /var/run/sas:/var/run/sas
     env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
       PATCH_UP_APP_CREDS: ${{ secrets.PATCH_UP_APP_CREDS }}
     outputs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha}}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0
@@ -150,6 +152,8 @@ jobs:
       volumes:
         - /mnt/cross-instance-cache:/mnt/cross-instance-cache
     env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+      CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_win=True'
       TARGET_OS: 'win'
       ELECTRON_DEPOT_TOOLS_WIN_TOOLCHAIN: '1'
@@ -157,7 +161,7 @@ jobs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha}}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/clean-src-cache.yml

@@ -1,8 +1,12 @@
 name: Clean Source Cache
 
+description: |
+  This workflow cleans up the source cache on the cross-instance cache volume
+  to free up space. It runs daily at midnight and clears files older than 15 days.
+
 on:
   schedule:
-    - cron: "0 0 * * SUN"  # Run at midnight every Sunday
+    - cron: "0 0 * * *"
 
 jobs:
   clean-src-cache:
@@ -17,5 +21,5 @@ jobs:
       shell: bash
       run: |
         df -h /mnt/cross-instance-cache
-        find /mnt/cross-instance-cache -type f -mtime +30 -delete
+        find /mnt/cross-instance-cache -type f -mtime +15 -delete
         df -h /mnt/cross-instance-cache

.github/workflows/issue-labeled.yml

@@ -20,13 +20,12 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
       - name: Set status
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@eb760c48894b5702398529cbb8f6e98378e315d0 # v1.3.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 90
           field: Status
           field-value: ✅ Triaged
-          fail-if-item-not-found: false
   issue-labeled-blocked:
     name: blocked/* label added
     if: startsWith(github.event.label.name, 'blocked/')
@@ -39,13 +38,12 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
       - name: Set status
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@eb760c48894b5702398529cbb8f6e98378e315d0 # v1.3.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 90
           field: Status
           field-value: 🛑 Blocked
-          fail-if-item-not-found: false
   issue-labeled-blocked-need-repro:
     name: blocked/need-repro label added
     if: github.event.label.name == 'blocked/need-repro'

.github/workflows/issue-opened.yml

@@ -19,7 +19,7 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
       - name: Add to Issue Triage
-        uses: dsanders11/project-actions/add-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/add-item@eb760c48894b5702398529cbb8f6e98378e315d0 # v1.3.0
         with:
           field: Reporter
           field-value: ${{ github.event.issue.user.login }}
@@ -57,40 +57,34 @@ jobs:
 
             const electronVersion = select('heading:has(> text[value="Electron Version"]) + paragraph > text', tree)?.value.trim();
             if (electronVersion !== undefined) {
-              // It's possible for multiple versions to be listed -
-              // for now check for comma or space separated version.
-              const versions = electronVersion.split(/, | /);
-              for (const version of versions) {
-                const major = semver.coerce(version, { loose: true })?.major;
-                if (major) {
-                  const versionLabel = `${major}-x-y`;
-                  let labelExists = false;
+              const major = semver.parse(electronVersion)?.major;
+              if (major) {
+                const versionLabel = `${major}-x-y`;
+                let labelExists = false;
 
-                  try {
-                    await github.rest.issues.getLabel({
-                      owner,
-                      repo,
-                      name: versionLabel,
-                    });
-                    labelExists = true;
-                  } catch {}
+                try {
+                  await github.rest.issues.getLabel({
+                    owner,
+                    repo,
+                    name: versionLabel,
+                  });
+                  labelExists = true;
+                } catch {}
 
-                  if (labelExists) {
-                    // Check if it's an unsupported major
-                    const { ElectronVersions } = await import('${{ github.workspace }}/node_modules/@electron/fiddle-core/dist/index.js');
-                    const versions = await ElectronVersions.create(undefined, { ignoreCache: true });
+                if (labelExists) {
+                  // Check if it's an unsupported major
+                  const { ElectronVersions } = await import('${{ github.workspace }}/node_modules/@electron/fiddle-core/dist/index.js');
+                  const versions = await ElectronVersions.create(undefined, { ignoreCache: true });
 
-                    const validVersions = [...versions.supportedMajors, ...versions.prereleaseMajors];
-                    if (validVersions.includes(major)) {
-                      labels.push(versionLabel);
-                    }
+                  const validVersions = [...versions.supportedMajors, ...versions.prereleaseMajors];
+                  if (!validVersions.includes(major)) {
+                    core.setOutput('unsupportedMajor', true);
+                    labels.push('blocked/need-info ❌');
                   }
+
+                  labels.push(versionLabel);
                 }
               }
-              if (labels.length === 0) {
-                core.setOutput('unsupportedMajor', true);
-                labels.push('blocked/need-info ❌');
-              }
             }
 
             const operatingSystems = select('heading:has(> text[value="What operating system(s) are you using?"]) + paragraph > text', tree)?.value.trim().split(', ');

.github/workflows/issue-transferred.yml

@@ -1,27 +0,0 @@
-name: Issue Transferred
-
-on:
-  issues:
-    types: [transferred]
-
-permissions: {}
-
-jobs:
-  issue-transferred:
-    name: Issue Transferred
-    runs-on: ubuntu-latest
-    if: ${{ !github.event.changes.new_repository.private }}
-    steps:
-      - name: Generate GitHub App token
-        uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
-        id: generate-token
-        with:
-          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
-          org: electron
-      - name: Remove from issue triage
-        uses: dsanders11/project-actions/delete-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
-        with:
-          token: ${{ steps.generate-token.outputs.token }}
-          project-number: 90
-          item: ${{ github.event.changes.new_issue.html_url }}
-          fail-if-item-not-found: false

.github/workflows/issue-unlabeled.yml

@@ -30,10 +30,9 @@ jobs:
           org: electron
       - name: Set status
         if: ${{ steps.check-for-blocked-labels.outputs.NOT_BLOCKED }}
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@eb760c48894b5702398529cbb8f6e98378e315d0 # v1.3.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 90
           field: Status
           field-value: 📥 Was Blocked
-          fail-if-item-not-found: false

.github/workflows/linux-publish.yml

@@ -30,7 +30,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/macos-publish.yml

@@ -31,7 +31,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-electron-build-and-test-and-nan.yml

@@ -56,8 +56,8 @@ on:
         default: false
 
 concurrency:
-  group: electron-build-and-test-and-nan-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-build-and-test-and-nan-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
 
 jobs:
   build:

.github/workflows/pipeline-electron-build-and-test.yml

@@ -56,8 +56,8 @@ on:
         default: false
 
 concurrency:
-  group: electron-build-and-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-build-and-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
 
 permissions:
   contents: read

.github/workflows/pipeline-electron-docs-only.yml

@@ -20,7 +20,7 @@ jobs:
     container: ${{ fromJSON(inputs.container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-electron-lint.yml

@@ -9,8 +9,11 @@ on:
         type: string
 
 concurrency:
-  group: electron-lint-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-lint-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
+
+env:
+  CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}  
 
 jobs:
   lint:
@@ -20,13 +23,15 @@ jobs:
     container: ${{ fromJSON(inputs.container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
+    - name: Set Chromium Git Cookie
+      uses: ./src/electron/.github/actions/set-chromium-cookie
     - name: Setup third_party Depot Tools
       shell: bash
       run: |

.github/workflows/pipeline-segment-electron-build.yml

@@ -13,7 +13,7 @@ on:
         required: true
       target-arch:
         type: string
-        description: 'Arch to build for, can be x64, arm64 or arm'
+        description: 'Arch to build for, can be x64, arm64, ia32 or arm'
         required: true
       target-variant:
         type: string
@@ -61,10 +61,12 @@ on:
 
 
 concurrency:
-  group: electron-build-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.target-variant }}-${{ inputs.is-asan }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-build-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.target-variant }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
 
 env:
+  CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+  CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
   ELECTRON_ARTIFACTS_BLOB_STORAGE: ${{ secrets.ELECTRON_ARTIFACTS_BLOB_STORAGE }}
   ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
   SUDOWOODO_EXCHANGE_URL: ${{ secrets.SUDOWOODO_EXCHANGE_URL }}
@@ -87,7 +89,7 @@ jobs:
       run: |
         mkdir src
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0
@@ -100,7 +102,7 @@ jobs:
       run: df -h
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'macos' }}
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+      uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6
       with:
         node-version: 20.11.x
         cache: yarn
@@ -125,6 +127,8 @@ jobs:
           GN_EXTRA_ARGS='is_asan=true'
         fi
         echo "GN_EXTRA_ARGS=$GN_EXTRA_ARGS" >> $GITHUB_ENV
+    - name: Set Chromium Git Cookie
+      uses: ./src/electron/.github/actions/set-chromium-cookie
     - name: Get Depot Tools
       timeout-minutes: 5
       run: |
@@ -161,7 +165,7 @@ jobs:
       with:
         use-cache: 'false'
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-segment-electron-gn-check.yml

@@ -44,7 +44,7 @@ jobs:
     container: ${{ fromJSON(inputs.check-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0
@@ -105,7 +105,7 @@ jobs:
     - name: Add CHROMIUM_BUILDTOOLS_PATH to env
       run: echo "CHROMIUM_BUILDTOOLS_PATH=$(pwd)/src/buildtools" >> $GITHUB_ENV
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-segment-electron-test.yml

@@ -27,8 +27,8 @@ on:
         default: false
 
 concurrency:
-  group: electron-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
 
 permissions:
   contents: read
@@ -36,6 +36,8 @@ permissions:
   pull-requests: read
 
 env:
+  CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+  CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
   ELECTRON_OUT_DIR: Default
   ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
 
@@ -74,9 +76,10 @@ jobs:
         echo "C:\Program Files\Git\cmd" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
         echo "C:\Program Files\Git\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
         echo "C:\Python311" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+        cp "C:\Python311\python.exe" "C:\Python311\python3.exe"
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'win' }}
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+      uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6
       with:
         node-version: 20.11.x
     - name: Add TCC permissions on macOS
@@ -113,13 +116,15 @@ jobs:
           fi
         done
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
+    - name: Set Chromium Git Cookie
+      uses: ./src/electron/.github/actions/set-chromium-cookie
     - name: Get Depot Tools
       timeout-minutes: 5
       run: |
@@ -239,7 +244,7 @@ jobs:
       if: always() && !cancelled()
     - name: Upload Test Artifacts
       if: always() && !cancelled()
-      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874
       with:
         name: test_artifacts_${{ env.ARTIFACT_KEY }}_${{ matrix.shard }}
         path: src/electron/spec/artifacts

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -27,10 +27,11 @@ on:
         default: testing
 
 concurrency:
-  group: electron-node-nan-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-node-nan-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
 
 env:
+  CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
   ELECTRON_OUT_DIR: Default
   ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
 
@@ -38,14 +39,14 @@ jobs:
   node-tests:
     name: Run Node.js Tests
     runs-on: electron-arc-linux-amd64-8core
-    timeout-minutes: 20
+    timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}
       BUILD_TYPE: linux
     container: ${{ fromJSON(inputs.test-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0
@@ -57,6 +58,8 @@ jobs:
         e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu ${{ inputs.target-arch }}
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
+    - name: Set Chromium Git Cookie
+      uses: ./src/electron/.github/actions/set-chromium-cookie
     - name: Get Depot Tools
       timeout-minutes: 5
       run: |
@@ -99,14 +102,14 @@ jobs:
   nan-tests:
     name: Run Nan Tests
     runs-on: electron-arc-linux-amd64-4core
-    timeout-minutes: 20
+    timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}
       BUILD_TYPE: linux
     container: ${{ fromJSON(inputs.test-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
       with:
         path: src/electron
         fetch-depth: 0
@@ -118,6 +121,8 @@ jobs:
         e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }}
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
+    - name: Set Chromium Git Cookie
+      uses: ./src/electron/.github/actions/set-chromium-cookie
     - name: Get Depot Tools
       timeout-minutes: 5
       run: |

.github/workflows/pull-request-labeled.yml

@@ -13,14 +13,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Trigger Slack workflow
-        uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
+        uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0
         with:
+          webhook: ${{ secrets.BACKPORT_REQUESTED_SLACK_WEBHOOK_URL }} 
+          webhook-type: webhook-trigger
           payload: |
             {
               "url": "${{ github.event.pull_request.html_url }}"
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.BACKPORT_REQUESTED_SLACK_WEBHOOK_URL }}
   pull-request-labeled-deprecation-review-complete:
     name: deprecation-review/complete label added
     if: github.event.label.name == 'deprecation-review/complete ✅'
@@ -33,7 +33,7 @@ jobs:
           creds: ${{ secrets.RELEASE_BOARD_GH_APP_CREDS }}
           org: electron
       - name: Set status
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@eb760c48894b5702398529cbb8f6e98378e315d0 # v1.3.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 94

.github/workflows/scorecards.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         with:
           persist-credentials: false
 
@@ -42,7 +42,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: SARIF file
           path: results.sarif
@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        uses: github/codeql-action/upload-sarif@f779452ac5af1c261dce0346a8f964149f49322b # v3.26.13
         with:
           sarif_file: results.sarif

.github/workflows/stable-prep-items.yml

@@ -27,7 +27,7 @@ jobs:
           PROJECT_NUMBER=$(gh project list --owner electron --format json | jq -r '.projects | map(select(.title | test("^[0-9]+-x-y$"))) | max_by(.number) | .number')
           echo "PROJECT_NUMBER=$PROJECT_NUMBER" >> "$GITHUB_OUTPUT"
       - name: Update Completed Stable Prep Items
-        uses: dsanders11/project-actions/completed-by@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/completed-by@eb760c48894b5702398529cbb8f6e98378e315d0 # v1.3.0
         with:
           field: Prep Status
           field-value: ✅ Complete

.github/workflows/update_appveyor_image.yml

@@ -1,78 +0,0 @@
-name: Update AppVeyor Image
-
-# Run chron daily Mon-Fri
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 8 * * 1-5' # runs 8:00 every business day (see https://crontab.guru)
-
-permissions: {}
-
-jobs:
-  bake-appveyor-image:
-    name: Bake AppVeyor Image
-    runs-on: ubuntu-latest
-    steps:
-    - name: Generate GitHub App token
-      uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
-      id: generate-token
-      with:
-        creds: ${{ secrets.APPVEYOR_UPDATER_GH_APP_CREDS }}
-    - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        fetch-depth: 0
-        token: ${{ steps.generate-token.outputs.token }}
-        ref: ${{ github.event.pull_request.head.sha }}
-    - name: Setup Node.js
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
-      with:
-        node-version: 20.11.x
-    - name: Yarn install
-      run: |
-        node script/yarn.js install --frozen-lockfile
-    - name: Set Repo for Commit
-      run: git config --global --add safe.directory $GITHUB_WORKSPACE
-    - name: Check AppVeyor Image
-      env:
-        APPVEYOR_TOKEN: ${{ secrets.APPVEYOR_TOKEN }}
-      run: |
-        node ./script/prepare-appveyor
-        if [ -f ./image_version.txt ]; then
-          echo "APPVEYOR_IMAGE_VERSION="$(cat image_version.txt)"" >> $GITHUB_ENV
-          rm image_version.txt
-        fi
-    - name: (Optionally) Update Appveyor Image
-      if: ${{ env.APPVEYOR_IMAGE_VERSION }}
-      uses: mikefarah/yq@8bf425b4d1344db7cd469a8d10a390876e0c77fd # v4.45.1
-      with:
-        cmd: |
-          yq '.image = "${{ env.APPVEYOR_IMAGE_VERSION }}"' "appveyor.yml" > "appveyor2.yml"
-          yq '.image = "${{ env.APPVEYOR_IMAGE_VERSION }}"' "appveyor-woa.yml" > "appveyor-woa2.yml"
-    - name: (Optionally) Generate Commit Diff
-      if: ${{ env.APPVEYOR_IMAGE_VERSION }}
-      run: |
-        diff -w -B appveyor.yml appveyor2.yml > appveyor.diff || true
-        patch -f appveyor.yml < appveyor.diff
-        rm appveyor2.yml appveyor.diff
-        git add appveyor.yml
-    - name: (Optionally) Generate Commit Diff for WOA
-      if: ${{ env.APPVEYOR_IMAGE_VERSION }}
-      run: |
-        diff -w -B appveyor-woa.yml appveyor-woa2.yml > appveyor-woa.diff || true
-        patch -f appveyor-woa.yml < appveyor-woa.diff
-        rm appveyor-woa2.yml appveyor-woa.diff
-        git add appveyor-woa.yml
-    - name: (Optionally) Commit to Branch
-      if: ${{ env.APPVEYOR_IMAGE_VERSION }}
-      uses: dsanders11/github-app-commit-action@43de6da2f4d927e997c0784c7a0b61bd19ad6aac # v1.5.0
-      with:
-        message: 'build: update appveyor image to latest version'
-        ref: bump-appveyor-image
-        token: ${{ steps.generate-token.outputs.token }}
-    - name: (Optionally) Create Pull Request
-      if: ${{ env.APPVEYOR_IMAGE_VERSION }}
-      run: |
-        printf "This PR updates appveyor.yml to the latest baked image, ${{ env.APPVEYOR_IMAGE_VERSION }}.\n\nNotes: none" | gh pr create --head bump-appveyor-image --label no-backport --label semver/none --title 'build: update appveyor image to latest version' --body-file=-
-      env:
-        GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}

.github/workflows/windows-publish.yml

@@ -0,0 +1,84 @@
+name: Publish Windows
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-image-sha:
+        type: string
+        description: 'SHA for electron/build image'
+        default: 'bc2f48b2415a670de18d13605b1cf0eb5fdbaae1'
+        required: true
+      upload-to-storage:
+        description: 'Uploads to Azure storage'
+        required: false
+        default: '1'
+        type: string
+      run-windows-publish:
+        description: 'Run the publish jobs vs just the build jobs'
+        type: boolean
+        default: false
+
+jobs:
+  checkout-windows:
+    runs-on: electron-arc-linux-amd64-32core
+    container:
+      image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
+      options: --user root --device /dev/fuse --cap-add SYS_ADMIN
+      volumes:
+        - /mnt/cross-instance-cache:/mnt/cross-instance-cache
+    env:
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_win=True'
+      TARGET_OS: 'win'
+      ELECTRON_DEPOT_TOOLS_WIN_TOOLCHAIN: '1'
+    outputs:
+      build-image-sha: ${{ inputs.build-image-sha }}
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
+      with:
+        path: src/electron
+        fetch-depth: 0
+    - name: Checkout & Sync & Save
+      uses: ./src/electron/.github/actions/checkout
+
+  publish-x64-win:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    needs: checkout-windows
+    with:
+      environment: production-release
+      build-runs-on: electron-arc-windows-amd64-16core
+      target-platform: win
+      target-arch: x64
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit
+
+  publish-arm64-win:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    needs: checkout-windows
+    with:
+      environment: production-release
+      build-runs-on: electron-arc-windows-amd64-16core
+      target-platform: win
+      target-arch: arm64
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit
+
+  publish-x86-win:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    needs: checkout-windows
+    with:
+      environment: production-release
+      build-runs-on: electron-arc-windows-amd64-16core
+      target-platform: win
+      target-arch: x86
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit

BUILD.gn

@@ -9,7 +9,7 @@ import("//pdf/features.gni")
 import("//ppapi/buildflags/buildflags.gni")
 import("//printing/buildflags/buildflags.gni")
 import("//testing/test.gni")
-import("//third_party/electron_node/node.gni")
+import("//third_party/electron_node/electron_node.gni")
 import("//third_party/ffmpeg/ffmpeg_options.gni")
 import("//tools/generate_library_loader/generate_library_loader.gni")
 import("//tools/grit/grit_rule.gni")
@@ -84,10 +84,7 @@ if (is_linux) {
   # from the gtk library. Function signatures for which stubs are
   # required should be declared in the sig files.
   generate_stubs("electron_gtk_stubs") {
-    sigs = [
-      "shell/browser/ui/electron_gdk.sigs",
-      "shell/browser/ui/electron_gdk_pixbuf.sigs",
-    ]
+    sigs = [ "shell/browser/ui/electron_gdk_pixbuf.sigs" ]
     extra_header = "shell/browser/ui/electron_gtk.fragment"
     output_name = "electron_gtk_stubs"
     public_deps = [ "//ui/gtk:gtk_config" ]
@@ -411,7 +408,7 @@ action("electron_generate_node_defines") {
 source_set("electron_lib") {
   configs += [
     "//v8:external_startup_data",
-    "//third_party/electron_node:node_external_config",
+    "//third_party/electron_node:node_internals",
   ]
 
   public_configs = [
@@ -430,6 +427,7 @@ source_set("electron_lib") {
     "chromium_src:chrome_spellchecker",
     "shell/common:mojo",
     "shell/common:plugin",
+    "shell/common:web_contents_utility",
     "shell/services/node/public/mojom",
     "//base:base_static",
     "//base/allocator:buildflags",
@@ -486,7 +484,7 @@ source_set("electron_lib") {
     "//third_party/blink/public:blink_devtools_inspector_resources",
     "//third_party/blink/public/platform/media",
     "//third_party/boringssl",
-    "//third_party/electron_node:libnode",
+    "//third_party/electron_node:node_lib",
     "//third_party/inspector_protocol:crdtp",
     "//third_party/leveldatabase",
     "//third_party/libyuv",
@@ -871,7 +869,6 @@ if (is_mac) {
       ":electron_framework_resources",
       ":electron_swiftshader_library",
       ":electron_xibs",
-      "//third_party/electron_node:libnode",
     ]
     if (!is_mas_build) {
       deps += [ ":electron_crashpad_helper" ]
@@ -927,6 +924,7 @@ if (is_mac) {
         "shell/app/electron_main_mac.cc",
         "shell/app/uv_stdio_fix.cc",
         "shell/app/uv_stdio_fix.h",
+        "shell/common/electron_constants.cc",
       ]
       include_dirs = [ "." ]
       info_plist = "shell/renderer/resources/mac/Info.plist"
@@ -1195,7 +1193,6 @@ if (is_mac) {
       "//components/crash/core/app",
       "//content:sandbox_helper_win",
       "//electron/buildflags",
-      "//third_party/electron_node:libnode",
       "//ui/strings",
     ]
 
@@ -1507,8 +1504,21 @@ group("electron") {
 ##### node_headers
 
 node_dir = "../third_party/electron_node"
+node_files = read_file("$node_dir/filenames.json", "json")
 node_headers_dir = "$root_gen_dir/node_headers"
 
+header_group_index = 0
+header_groups = []
+foreach(header_group, node_files.headers) {
+  copy("node_headers_${header_group_index}") {
+    sources = rebase_path(header_group.files, ".", node_dir)
+    outputs =
+        [ "$node_headers_dir/${header_group.dest_dir}/{{source_file_part}}" ]
+  }
+  header_groups += [ ":node_headers_${header_group_index}" ]
+  header_group_index += 1
+}
+
 copy("zlib_headers") {
   sources = [
     "$node_dir/deps/zlib/zconf.h",
@@ -1529,19 +1539,13 @@ copy("node_gypi_headers") {
 action("node_version_header") {
   inputs = [ "$node_dir/src/node_version.h" ]
   outputs = [ "$node_headers_dir/include/node/node_version.h" ]
-  script = "script/node/generate_node_version_header.py"
+  script = "script/generate_node_version_header.py"
   args = rebase_path(inputs) + rebase_path(outputs)
   if (node_module_version != "") {
     args += [ "$node_module_version" ]
   }
 }
 
-action("generate_node_headers") {
-  deps = [ ":generate_config_gypi" ]
-  script = "script/node/generate_node_headers.py"
-  outputs = [ "$root_gen_dir/node_headers.json" ]
-}
-
 action("tar_node_headers") {
   deps = [ ":copy_node_headers" ]
   outputs = [ "$root_gen_dir/node_headers.tar.gz" ]
@@ -1553,12 +1557,11 @@ action("tar_node_headers") {
 }
 
 group("copy_node_headers") {
-  public_deps = [
-    ":generate_node_headers",
-    ":node_gypi_headers",
-    ":node_version_header",
-    ":zlib_headers",
-  ]
+  public_deps = header_groups + [
+                  ":node_gypi_headers",
+                  ":node_version_header",
+                  ":zlib_headers",
+                ]
 }
 
 group("node_headers") {

DEPS

@@ -2,9 +2,9 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '133.0.6920.0',
+    '132.0.6834.209',
   'node_version':
-    'v22.11.0',
+    'v20.18.3',
   'nan_version':
     'e14bdcd1f72d62bca1d541b66da43130384ec213',
   'squirrel.mac_version':

appveyor-bake.yml

@@ -1,107 +0,0 @@
-# The config is used to bake appveyor images, not for running CI jobs.
-# The config expects the following environment variables to be set:
-#  - "APPVEYOR_BAKE_IMAGE" e.g. 'electron-99.0.4767.0'. Name of the image to be baked.
-#      Typically named after the Chromium version on which the image is built.
-#      This can be set dynamically in the prepare-appveyor script.
-
-version: 1.0.{build}
-build_cloud: electronhq-16-core
-image: base-bake-image
-environment:
-  GIT_CACHE_PATH: C:\Users\appveyor\libcc_cache
-  ELECTRON_OUT_DIR: Default
-  ELECTRON_ENABLE_STACK_DUMPING: 1
-  MOCHA_REPORTER: mocha-multi-reporters
-  MOCHA_MULTI_REPORTERS: mocha-appveyor-reporter, tap
-  DEPOT_TOOLS_WIN_TOOLCHAIN: 0
-  PYTHONIOENCODING: UTF-8
-
-# The following lines are needed when baking from a completely new image (eg MicrosoftWindowsServer:WindowsServer:2019-Datacenter:latest via image: base-windows-server2019)
-# init:
-#   - ps: $blockRdp = $true; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
-#   - appveyor version
-#   - ps: $ErrorActionPreference = 'Stop'
-#   - ps: 'Write-Host "OS Build: $((Get-CimInstance Win32_OperatingSystem).BuildNumber)"'
-
-# clone_folder: '%USERPROFILE%\image-bake-scripts'
-
-# clone_script:  
-#   - ps: Invoke-WebRequest "https://github.com/appveyor/build-images/archive/1f90d94e74c8243c909a09b994e527584dfcb838.zip" -OutFile "$env:temp\scripts.zip"
-#   - ps: Expand-Archive -Path "$env:temp\scripts.zip" -DestinationPath "$env:temp\scripts" -Force
-#   - ps: Copy-Item -Path "$env:temp\scripts\build-images-1f90d94e74c8243c909a09b994e527584dfcb838\scripts\Windows\*" -Destination $env:APPVEYOR_BUILD_FOLDER -Recurse  
-
-build_script:
-# The following lines are needed when baking from a completely new image (eg MicrosoftWindowsServer:WindowsServer:2019-Datacenter:latest via image: base-windows-server2019)
-  # - ps: .\init_server.ps1
-  # - ps: .\extend_system_volume.ps1
-
-  # # Restart VM
-  # - ps: Start-Sleep -s 5; Restart-Computer
-  # - ps: Start-Sleep -s 5
-
-  # - appveyor version
-  # - ps: .\install_path_utils.ps1
-  # - ps: .\install_powershell_core.ps1
-  # - ps: .\install_powershell_get.ps1
-  # - ps: .\install_7zip.ps1
-  # - ps: .\install_chocolatey.ps1
-  # - ps: .\install_webpi.ps1
-  # - ps: .\install_nuget.ps1
-  # - ps: .\install_pstools.ps1
-
-  # - ps: .\install_git.ps1
-  # - ps: .\install_git_lfs.ps1
-
-  # # Restart VM
-  # - ps: Start-Sleep -s 5; Restart-Computer
-  # - ps: Start-Sleep -s 5
-# END LINES FOR COMPLETELY NEW IMAGE
-
-  - git config --global core.longpaths true
-  - ps: >-
-      if (-not (Test-Path -Path C:\projects\src)) {
-        New-Item -Path C:\projects\src -ItemType Directory
-      }
-  - cd C:\projects\
-  - git clone -q --branch=%APPVEYOR_REPO_BRANCH% https://github.com/electron/electron.git C:\projects\src\electron
-  - git clone --depth=1 https://chromium.googlesource.com/chromium/tools/depot_tools.git
-  - ps: $env:PATH="$pwd\depot_tools;$env:PATH"
-  - update_depot_tools.bat
-  # Uncomment the following line if windows deps change
-  - src\electron\script\setup-win-for-dev.bat
-  - >-
-      gclient config
-      --name "src\electron"
-      --unmanaged
-      %GCLIENT_EXTRA_ARGS%
-      "https://github.com/electron/electron"
-  - ps: cd src\electron
-  - ps: node script\generate-deps-hash.js
-  - ps: $depshash = Get-Content .\.depshash -Raw
-  - ps: Copy-Item -path .\.depshash -destination ..\.depshash
-  - ps: cd ..\..
-  - gclient sync --with_branch_heads --with_tags --nohooks
-  - ps: regsvr32 /s "C:\Program Files\Microsoft Visual Studio\2022\Community\DIA SDK\bin\amd64\msdia140.dll"
-  - ps: set vs2022_install="C:\Program Files\Microsoft Visual Studio\2022\Community"
-
-# The following lines are needed when baking from a completely new image (eg MicrosoftWindowsServer:WindowsServer:2019-Datacenter:latest via image: base-windows-server2019)
-  # # Restart VM
-  # - ps: Start-Sleep -s 5; Restart-Computer 
-  # - ps: Start-Sleep -s 5
-
-  # - cd %USERPROFILE%\image-bake-scripts
-  # - appveyor version
-  # - ps: .\optimize_dotnet_runtime.ps1
-  # - ps: .\disable_windows_background_services.ps1
-  # - ps: .\enforce_windows_firewall.ps1
-  # - ps: .\cleanup_windows.ps1  
-# END LINES FOR COMPLETELY NEW IMAGE  
-on_image_bake:
-  - ps: >-
-      echo "Baking image: $env:APPVEYOR_BAKE_IMAGE at dir $PWD"
-  - ps: Remove-Item -Recurse -Force C:\projects\depot_tools
-  - ps: Remove-Item -Recurse -Force C:\projects\src\electron
-# Uncomment these lines and set APPVEYOR_RDP_PASSWORD in project settings to enable RDP after bake is done
-# # on_finish:
-#   - ps: >-
-#        $blockRdp = $true; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))

appveyor-woa.yml

@@ -1,352 +0,0 @@
-# NOTE IF CHANGING THIS FILE, ALSO APPLY THE CHANGE TO appveyor.yml
-# IF APPLICABLE!!!!
-#
-#
-# The config expects the following environment variables to be set:
-#  - "GN_CONFIG" Build type. One of {'testing', 'release'}.
-#  - "GN_EXTRA_ARGS" Additional gn arguments for a build config,
-#      e.g. 'target_cpu="x86"' to build for a 32bit platform.
-#      https://gn.googlesource.com/gn/+/main/docs/reference.md#var_target_cpu
-#      Don't forget to set up "NPM_CONFIG_ARCH" and "TARGET_ARCH" accordingly
-#      if you pass a custom value for 'target_cpu'.
-#  - "ELECTRON_RELEASE" Set it to '1' upload binaries on success.
-#  - "NPM_CONFIG_ARCH" E.g. 'x86'. Is used to build native Node.js modules.
-#      Must match 'target_cpu' passed to "GN_EXTRA_ARGS" and "TARGET_ARCH" value.
-#  - "TARGET_ARCH" Choose from {'ia32', 'x64', 'arm', 'arm64'}.
-#      Is used in some publishing scripts, but does NOT affect the Electron binary.
-#      Must match 'target_cpu' passed to "GN_EXTRA_ARGS" and "NPM_CONFIG_ARCH" value.
-#  - "UPLOAD_TO_STORAGE" Set it to '1' upload a release to the Azure bucket.
-#      Otherwise the release will be uploaded to the GitHub Releases.
-#      (The value is only checked if "ELECTRON_RELEASE" is defined.)
-#
-# The publishing scripts expect access tokens to be defined as env vars,
-# but those are not covered here.
-#
-# AppVeyor docs on variables:
-# https://www.appveyor.com/docs/environment-variables/
-# https://www.appveyor.com/docs/build-configuration/#secure-variables
-# https://www.appveyor.com/docs/build-configuration/#custom-environment-variables
-
-version: 1.0.{build}
-build_cloud: electronhq-16-core
-image: e-133.0.6878.0
-environment:
-  GIT_CACHE_PATH: C:\Users\appveyor\libcc_cache
-  ELECTRON_OUT_DIR: Default
-  ELECTRON_ENABLE_STACK_DUMPING: 1
-  ELECTRON_ALSO_LOG_TO_STDERR: 1
-  MOCHA_REPORTER: mocha-multi-reporters
-  MOCHA_MULTI_REPORTERS: "@marshallofsound/mocha-appveyor-reporter, mocha-junit-reporter, tap"
-  DEPOT_TOOLS_WIN_TOOLCHAIN: 1
-  DEPOT_TOOLS_WIN_TOOLCHAIN_BASE_URL: "https://dev-cdn.electronjs.org/windows-toolchains/_"  
-  GYP_MSVS_HASH_7393122652: 3ba76c5c20
-  PYTHONIOENCODING: UTF-8
-
-  matrix:
-
-    - job_name: Build Arm on X64 Windows
-    - job_name: Test On Windows On Arm Hardware 1
-      job_depends_on: Build Arm on X64 Windows
-      APPVEYOR_BUILD_WORKER_IMAGE: base-woa
-      APPVEYOR_BUILD_WORKER_CLOUD: electronhq-woa
-      shard: 1
-    - job_name: Test On Windows On Arm Hardware 2
-      job_depends_on: Build Arm on X64 Windows
-      APPVEYOR_BUILD_WORKER_IMAGE: base-woa
-      APPVEYOR_BUILD_WORKER_CLOUD: electronhq-woa
-      shard: 2
-
-clone_script:
-- ps: git clone -q $("--branch=" + $Env:APPVEYOR_REPO_BRANCH) $("https://github.com/" + $Env:APPVEYOR_REPO_NAME + ".git") $Env:APPVEYOR_BUILD_FOLDER
-- ps: if (!$Env:APPVEYOR_PULL_REQUEST_NUMBER) {$("git checkout -qf " + $Env:APPVEYOR_REPO_COMMIT)}
-- ps: if ($Env:APPVEYOR_PULL_REQUEST_NUMBER) {git fetch -q origin +refs/pull/$($Env:APPVEYOR_PULL_REQUEST_NUMBER)/head; git checkout -qf FETCH_HEAD}
-
-clone_folder: C:\projects\src\electron
-
-skip_branch_with_pr: true
-
-# the first failed job cancels other jobs and fails entire build
-matrix:
-  fast_finish: true
-
-for:
-
-  - matrix:
-      only:
-        - job_name: Build Arm on X64 Windows
-
-    build_script:
-      # TODO: Remove --ignore-engines once WOA image is up to node 20
-      - ps: |
-          node script/yarn.js install --frozen-lockfile --ignore-engines
-          node script/doc-only-change.js --prNumber=$env:APPVEYOR_PULL_REQUEST_NUMBER
-          $env:SHOULD_SKIP_ARTIFACT_VALIDATION = "false"
-          if ($LASTEXITCODE -eq 0) {
-            Write-warning "Skipping build for doc-only change"
-            $env:SHOULD_SKIP_ARTIFACT_VALIDATION = "true"
-            Exit-AppveyorBuild
-          } else {
-            $global:LASTEXITCODE = 0
-          }
-      - cd ..
-      - ps: Write-Host "Building $env:GN_CONFIG build"
-      - git config --global core.longpaths true
-      - ps: >-
-          if (Test-Path -Path "$pwd\depot_tools") {
-            Remove-Item -Recurse -Force $pwd\depot_tools
-          }
-      - ps: >-
-          if (Test-Path -Path "$pwd\build-tools") {
-            Remove-Item -Recurse -Force $pwd\build-tools
-          }
-      - git clone --depth=1 https://chromium.googlesource.com/chromium/tools/depot_tools.git
-      - ps: New-Item -Name depot_tools\.disable_auto_update -ItemType File
-      - depot_tools\bootstrap\win_tools.bat
-      - ps: |
-          Set-Content -Path $pwd\depot_tools\build_telemetry.cfg -Value '{"user": "info@electronjs.org", "status": "opt-out", "countdown": 10, "version": 1}'
-      - ps: $env:PATH="$pwd\depot_tools;$env:PATH"
-      - ps: >-
-          if (Test-Path -Path "$pwd\src\electron") {
-            Remove-Item -Recurse -Force $pwd\src\electron
-          }
-      - git clone https://github.com/electron/build-tools.git
-      - cd build-tools
-      - npx yarn --ignore-engines
-      - mkdir third_party
-      - ps: >-
-          node -e "require('./src/utils/reclient.js').downloadAndPrepare({})"
-      - ps: $env:RECLIENT_HELPER = node -p "require('./src/utils/reclient.js').helperPath({})"
-      - ps: >-
-          & $env:RECLIENT_HELPER login
-      - ps: >-
-          $env:RBE_service = node -e "console.log(require('./src/utils/reclient.js').serviceAddress)"
-      - ps: >-
-          $env:RBE_credentials_helper = $env:RECLIENT_HELPER
-      - ps: >-
-          $env:RBE_credentials_helper_args = "print"
-      - ps: >-
-          if ($env:ELECTRON_RBE_JWT -eq '') {
-            $env:RBE_fail_early_min_action_count = "0"
-            $env:RBE_fail_early_min_fallback_ratio = "0"
-          }
-      - cd ..\..
-      - ps: $env:CHROMIUM_BUILDTOOLS_PATH="$pwd\src\buildtools"
-      - ps: >-
-          if ($env:GN_CONFIG -ne 'release') {
-            $env:NINJA_STATUS="[%r processes, %f/%t @ %o/s : %es] "
-          }
-      - gclient config --name "src\electron" --unmanaged %GCLIENT_EXTRA_ARGS% "https://github.com/electron/electron"
-      # Patches are applied in the image bake. Check depshash to see if patches have changed.
-      - ps: $env:RUN_GCLIENT_SYNC="false"
-      - ps: $depshash_baked = Get-Content .\src\.depshash -Raw
-      - ps: cd src\electron
-      - ps: node script\generate-deps-hash.js
-      - ps: $depshash = Get-Content .\.depshash -Raw
-      - ps: cd ..\..
-      - ps: >-
-          if ($depshash_baked -ne $depshash) {
-            $env:RUN_GCLIENT_SYNC="true"
-          }
-      - if "%RUN_GCLIENT_SYNC%"=="true" ( gclient sync --with_branch_heads --with_tags ) else ( gclient runhooks )
-      - cd src
-      - ps: $env:PATH="$pwd\third_party\ninja;$env:PATH"
-      - set BUILD_CONFIG_PATH=//electron/build/args/%GN_CONFIG%.gn
-      - gn gen out/Default "--args=import(\"%BUILD_CONFIG_PATH%\") use_remoteexec=true %GN_EXTRA_ARGS% "
-      - gn check out/Default //electron:electron_lib
-      - gn check out/Default //electron:electron_app
-      - gn check out/Default //electron/shell/common:mojo
-      - gn check out/Default //electron/shell/common:plugin
-      - autoninja -j 300 -C out/Default electron:electron_app
-      - if "%GN_CONFIG%"=="testing" ( python C:\depot_tools\post_build_ninja_summary.py -C out\Default )
-      - gn gen out/ffmpeg "--args=import(\"//electron/build/args/ffmpeg.gn\") use_remoteexec=true %GN_EXTRA_ARGS%"
-      - autoninja -C out/ffmpeg electron:electron_ffmpeg_zip
-      - autoninja -C out/Default electron:electron_dist_zip
-      - gn desc out/Default v8:run_mksnapshot_default args > out/Default/default_mksnapshot_args
-      # Remove unused args from mksnapshot_args
-      - ps: >-
-          Get-Content out/Default/default_mksnapshot_args | Where-Object { -not $_.Contains('--turbo-profiling-input') -And -not $_.Contains('builtins-pgo') } | Set-Content out/Default/mksnapshot_args
-      - autoninja -C out/Default electron:electron_mksnapshot_zip
-      - cd out\Default
-      - 7z a mksnapshot.zip mksnapshot_args gen\v8\embedded.S
-      - cd ..\..
-      - autoninja -C out/Default electron:hunspell_dictionaries_zip
-      - autoninja -C out/Default electron:electron_chromedriver_zip
-      - autoninja -C out/Default electron:node_headers
-      - ps: >-
-          Get-CimInstance -Namespace root\cimv2 -Class Win32_product | Select vendor, description, @{l='install_location';e='InstallLocation'}, @{l='install_date';e='InstallDate'}, @{l='install_date_2';e='InstallDate2'}, caption, version, name, @{l='sku_number';e='SKUNumber'} | ConvertTo-Json | Out-File -Encoding utf8 -FilePath .\installed_software.json
-      - python3 electron/build/profile_toolchain.py --output-json=out/Default/windows_toolchain_profile.json
-      - 7z a node_headers.zip out\Default\gen\node_headers
-      - 7z a nan.zip third_party\nan
-      - ps: >-
-          if ($env:GN_CONFIG -eq 'release') {
-            # Needed for msdia140.dll on 64-bit windows
-            $env:Path += ";$pwd\third_party\llvm-build\Release+Asserts\bin"
-          }
-      - if "%GN_CONFIG%"=="release" ( autoninja -C out/Default electron:electron_symbols )
-      - ps: >-
-          if ($env:GN_CONFIG -eq 'release') {
-            python3 electron\script\zip-symbols.py
-            appveyor-retry appveyor PushArtifact out/Default/symbols.zip
-          } else {
-            # It's useful to have pdb files when debugging testing builds that are
-            # built on CI.
-            7z a pdb.zip out\Default\*.pdb
-          }
-      - ps: |
-          $manifest_file = "electron/script/zip_manifests/dist_zip.win.$env:TARGET_ARCH.manifest"
-          python3 electron/script/zip_manifests/check-zip-manifest.py out/Default/dist.zip $manifest_file
-          if ($LASTEXITCODE -ne 0) {
-            throw "Zip contains files not listed in the manifest $manifest_file"
-          }
-      - ps: |
-          cd C:\projects\src
-          $missing_artifacts = $false
-          if ($env:SHOULD_SKIP_ARTIFACT_VALIDATION -eq 'true') {
-            Write-warning "Skipping artifact validation for doc-only $env:APPVEYOR_PROJECT_NAME"
-          } else {
-            $artifacts_to_validate = 'dist.zip','windows_toolchain_profile.json','chromedriver.zip','ffmpeg.zip','node_headers.zip','mksnapshot.zip','electron.lib','hunspell_dictionaries.zip','nan.zip'
-            foreach($artifact_name in $artifacts_to_validate) {
-              if ($artifact_name -eq 'ffmpeg.zip') {
-                $artifact_file = "out\ffmpeg\ffmpeg.zip"
-              } elseif (
-                $artifact_name -eq 'node_headers.zip') {
-                $artifact_file = $artifact_name
-              } elseif (
-                $artifact_name -eq 'nan.zip') {
-                $artifact_file = $artifact_name
-              } else {
-                $artifact_file = "out\Default\$artifact_name"
-              }
-              if (-not(Test-Path $artifact_file)) {
-                Write-warning "$artifact_name is missing and cannot be added to artifacts"
-                $missing_artifacts = $true
-              }
-            }
-          }
-          if ($missing_artifacts) {
-            throw "Build failed due to missing artifacts"
-          }
-
-    deploy_script:
-      - cd electron
-      - ps: >-
-          if (Test-Path Env:\ELECTRON_RELEASE) {
-            if (Test-Path Env:\UPLOAD_TO_STORAGE) {
-              Write-Output "Uploading Electron release distribution to azure"
-              & python3 script\release\uploaders\upload.py --verbose --upload_to_storage
-            } else {
-              Write-Output "Uploading Electron release distribution to github releases"
-              & python3 script\release\uploaders\upload.py --verbose
-            }
-          }
-    on_finish:
-      # Uncomment this lines to enable RDP
-      # - ps: $blockRdp = $true; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
-      - cd C:\projects\src
-      - if exist out\Default\windows_toolchain_profile.json ( appveyor-retry appveyor PushArtifact out\Default\windows_toolchain_profile.json )
-      - if exist out\Default\dist.zip (appveyor-retry appveyor PushArtifact out\Default\dist.zip)
-      - if exist out\Default\chromedriver.zip (appveyor-retry appveyor PushArtifact out\Default\chromedriver.zip)
-      - if exist out\ffmpeg\ffmpeg.zip (appveyor-retry appveyor PushArtifact out\ffmpeg\ffmpeg.zip)
-      - if exist node_headers.zip (appveyor-retry appveyor PushArtifact node_headers.zip)
-      - if exist nan.zip (appveyor-retry appveyor PushArtifact nan.zip)
-      - if exist out\Default\mksnapshot.zip (appveyor-retry appveyor PushArtifact out\Default\mksnapshot.zip)
-      - if exist out\Default\hunspell_dictionaries.zip (appveyor-retry appveyor PushArtifact out\Default\hunspell_dictionaries.zip)
-      - if exist out\Default\electron.lib (appveyor-retry appveyor PushArtifact out\Default\electron.lib)        
-      - ps: >-
-          if ((Test-Path "pdb.zip") -And ($env:GN_CONFIG -ne 'release')) {
-            appveyor-retry appveyor PushArtifact pdb.zip
-          }
-  - matrix:
-      only:
-        - job_name: Test On Windows On Arm Hardware 1
-        - job_name: Test On Windows On Arm Hardware 2
-
-    environment:
-        IGNORE_YARN_INSTALL_ERROR: 1
-        ELECTRON_TEST_RESULTS_DIR: C:\projects\src\electron\junit
-        MOCHA_MULTI_REPORTERS: "@marshallofsound/mocha-appveyor-reporter, mocha-junit-reporter, tap"
-        MOCHA_REPORTER: mocha-multi-reporters
-        ELECTRON_SKIP_NATIVE_MODULE_TESTS: true
-        DD_ENV: ci
-        DD_SERVICE: electron
-        DD_CIVISIBILITY_LOGS_ENABLED: true
-        DD_GIT_REPOSITORY_URL: "https://github.com/electron/electron.git"
-
-    build_script:
-      - ps: |
-          node script/yarn.js install --frozen-lockfile --ignore-engines
-          node script/doc-only-change.js --prNumber=$env:APPVEYOR_PULL_REQUEST_NUMBER
-          if ($LASTEXITCODE -eq 0) {
-            Write-warning "Skipping build for doc only change"
-            Exit-AppveyorBuild
-          } else {
-            $global:LASTEXITCODE = 0
-          }
-      - ps: Invoke-WebRequest -Uri "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_win-x64" -OutFile "C:\projects\src\electron\datadog-ci.exe"
-      - cd ..
-      - mkdir out\Default
-      - cd ..
-      - ps: |
-          # Download build artifacts
-          $apiUrl = 'https://ci.appveyor.com/api'
-          $build_info = Invoke-RestMethod -Method Get -Uri "$apiUrl/projects/$env:APPVEYOR_ACCOUNT_NAME/$env:APPVEYOR_PROJECT_SLUG/builds/$env:APPVEYOR_BUILD_ID"
-          $artifacts_to_download = @('dist.zip','ffmpeg.zip','node_headers.zip','electron.lib', 'nan.zip')
-          foreach ($job in $build_info.build.jobs) {
-            if ($job.name -eq "Build Arm on X64 Windows") {
-              $jobId = $job.jobId
-              foreach($artifact_name in $artifacts_to_download) {
-                if ($artifact_name -eq 'electron.lib') {
-                  $outfile = "src\out\Default\$artifact_name"
-                } else {
-                  $outfile = $artifact_name
-                }
-                Invoke-RestMethod -Method Get -Uri "$apiUrl/buildjobs/$jobId/artifacts/$artifact_name" -OutFile $outfile
-              }
-              # Uncomment the following lines to download the pdb.zip to show real stacktraces when crashes happen during testing
-              Invoke-RestMethod -Method Get -Uri "$apiUrl/buildjobs/$jobId/artifacts/pdb.zip" -OutFile pdb.zip
-              7z x -y -osrc pdb.zip
-            }
-          }
-      - ps: |
-          $out_default_zips = @('dist.zip')
-          foreach($zip_name in $out_default_zips) {
-            7z x -y -osrc\out\Default $zip_name
-          }
-      - ps: 7z x -y -osrc\out\ffmpeg ffmpeg.zip
-      - ps: 7z x -y -osrc node_headers.zip
-      - ps: 7z x -y -osrc nan.zip
-
-    test_script:
-      # Workaround for https://github.com/appveyor/ci/issues/2420
-      - set "PATH=%PATH%;C:\Program Files\Git\mingw64\libexec\git-core"
-      - ps: |
-          cd src
-          New-Item .\out\Default\gen\node_headers\Release -Type directory
-          Copy-Item -path .\out\Default\electron.lib -destination .\out\Default\gen\node_headers\Release\node.lib
-      - set npm_config_nodedir=%cd%\out\Default\gen\node_headers
-      - set npm_config_arch=arm64
-      - cd electron
-      # Explicitly set npm_config_arch because the .env doesn't persist
-      - ps: >-
-          if ($env:TARGET_ARCH -eq 'ia32') {
-            $env:npm_config_arch = "ia32"
-          }
-      - ps: $env:tests_files=node script\split-tests $env:shard 2
-      - echo "Running shard %shard% specs %tests_files%"
-      - echo Running main test suite & node script/yarn test  --runners=main --enable-logging --disable-features=CalculateNativeWinOcclusion --files %tests_files%
-      - cd ..
-      - echo Verifying non proprietary ffmpeg & python electron\script\verify-ffmpeg.py --build-dir out\Default --source-root %cd% --ffmpeg-path out\ffmpeg
-
-    on_finish:
-      # Uncomment these lines to enable RDP
-      # - ps: $blockRdp = $true; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
-      - if exist electron\junit\test-results-main.xml ( appveyor-retry appveyor PushArtifact electron\junit\test-results-main.xml )
-      - ps: |
-          if ($env:DD_API_KEY) {
-            $env:DD_GIT_COMMIT_SHA = $env:APPVEYOR_REPO_COMMIT
-            $env:DD_GIT_BRANCH = $env:APPVEYOR_PULL_REQUEST_HEAD_REPO_BRANCH
-            $env:DD_TAGS = "os.architecture:$env:TARGET_ARCH,os.family:windows,os.platform:win32"
-            if (Test-Path -Path "C:\projects\src\electron\junit\test-results-main.xml") {
-              C:\projects\src\electron\datadog-ci.exe junit upload --verbose C:\projects\src\electron\junit\test-results-main.xml
-            }
-          }

appveyor.yml

@@ -1,350 +0,0 @@
-# NOTE IF CHANGING THIS FILE, ALSO APPLY THE CHANGE TO appveyor-woa.yml
-# IF APPLICABLE!!!!
-#
-#
-# The config expects the following environment variables to be set:
-#  - "GN_CONFIG" Build type. One of {'testing', 'release'}.
-#  - "GN_EXTRA_ARGS" Additional gn arguments for a build config,
-#      e.g. 'target_cpu="x86"' to build for a 32bit platform.
-#      https://gn.googlesource.com/gn/+/main/docs/reference.md#var_target_cpu
-#      Don't forget to set up "NPM_CONFIG_ARCH" and "TARGET_ARCH" accordingly
-#      if you pass a custom value for 'target_cpu'.
-#  - "ELECTRON_RELEASE" Set it to '1' upload binaries on success.
-#  - "NPM_CONFIG_ARCH" E.g. 'x86'. Is used to build native Node.js modules.
-#      Must match 'target_cpu' passed to "GN_EXTRA_ARGS" and "TARGET_ARCH" value.
-#  - "TARGET_ARCH" Choose from {'ia32', 'x64', 'arm', 'arm64'}.
-#      Is used in some publishing scripts, but does NOT affect the Electron binary.
-#      Must match 'target_cpu' passed to "GN_EXTRA_ARGS" and "NPM_CONFIG_ARCH" value.
-#  - "UPLOAD_TO_STORAGE" Set it to '1' upload a release to the Azure bucket.
-#      Otherwise the release will be uploaded to the GitHub Releases.
-#      (The value is only checked if "ELECTRON_RELEASE" is defined.)
-#
-# The publishing scripts expect access tokens to be defined as env vars,
-# but those are not covered here.
-#
-# AppVeyor docs on variables:
-# https://www.appveyor.com/docs/environment-variables/
-# https://www.appveyor.com/docs/build-configuration/#secure-variables
-# https://www.appveyor.com/docs/build-configuration/#custom-environment-variables
-
-version: 1.0.{build}
-build_cloud: electronhq-16-core
-image: e-133.0.6878.0
-environment:
-  GIT_CACHE_PATH: C:\Users\appveyor\libcc_cache
-  ELECTRON_OUT_DIR: Default
-  ELECTRON_ENABLE_STACK_DUMPING: 1
-  ELECTRON_ALSO_LOG_TO_STDERR: 1
-  MOCHA_REPORTER: mocha-multi-reporters
-  MOCHA_MULTI_REPORTERS: "@marshallofsound/mocha-appveyor-reporter, mocha-junit-reporter, tap"
-  DEPOT_TOOLS_WIN_TOOLCHAIN: 1
-  DEPOT_TOOLS_WIN_TOOLCHAIN_BASE_URL: "https://dev-cdn.electronjs.org/windows-toolchains/_"
-  GYP_MSVS_HASH_7393122652: 3ba76c5c20
-  PYTHONIOENCODING: UTF-8
-
-  matrix:
-
-    - job_name: Build
-    - job_name: Test 1
-      job_depends_on: Build
-      shard: 1
-    - job_name: Test 2
-      job_depends_on: Build
-      shard: 2
-
-clone_script:
-- ps: git clone -q $("--branch=" + $Env:APPVEYOR_REPO_BRANCH) $("https://github.com/" + $Env:APPVEYOR_REPO_NAME + ".git") $Env:APPVEYOR_BUILD_FOLDER
-- ps: if (!$Env:APPVEYOR_PULL_REQUEST_NUMBER) {$("git checkout -qf " + $Env:APPVEYOR_REPO_COMMIT)}
-- ps: if ($Env:APPVEYOR_PULL_REQUEST_NUMBER) {git fetch -q origin +refs/pull/$($Env:APPVEYOR_PULL_REQUEST_NUMBER)/head; git checkout -qf FETCH_HEAD}
-
-clone_folder: C:\projects\src\electron
-
-skip_branch_with_pr: true
-
-# the first failed job cancels other jobs and fails entire build
-matrix:
-  fast_finish: true
-
-for:
-
-  - matrix:
-      only:
-        - job_name: Build
-
-    build_script:
-      - ps: |
-          node script/yarn.js install --frozen-lockfile
-          node script/doc-only-change.js --prNumber=$env:APPVEYOR_PULL_REQUEST_NUMBER
-          $env:SHOULD_SKIP_ARTIFACT_VALIDATION = "false"
-          if ($LASTEXITCODE -eq 0) {
-            Write-warning "Skipping build for doc-only change"
-            $env:SHOULD_SKIP_ARTIFACT_VALIDATION = "true"
-            Exit-AppveyorBuild
-          } else {
-            $global:LASTEXITCODE = 0
-          }
-      - cd ..
-      - ps: Write-Host "Building $env:GN_CONFIG build"
-      - git config --global core.longpaths true
-      - ps: >-
-          if (Test-Path -Path "$pwd\depot_tools") {
-            Remove-Item -Recurse -Force $pwd\depot_tools
-          }
-      - ps: >-
-          if (Test-Path -Path "$pwd\build-tools") {
-            Remove-Item -Recurse -Force $pwd\build-tools
-          }
-      - git clone --depth=1 https://chromium.googlesource.com/chromium/tools/depot_tools.git
-      - ps: New-Item -Name depot_tools\.disable_auto_update -ItemType File
-      - depot_tools\bootstrap\win_tools.bat
-      - ps: |
-          Set-Content -Path $pwd\depot_tools\build_telemetry.cfg -Value '{"user": "info@electronjs.org", "status": "opt-out", "countdown": 10, "version": 1}'
-      - ps: $env:PATH="$pwd\depot_tools;$env:PATH"
-      - ps: >-
-          if (Test-Path -Path "$pwd\src\electron") {
-            Remove-Item -Recurse -Force $pwd\src\electron
-          }
-      - git clone https://github.com/electron/build-tools.git
-      - cd build-tools
-      - npx yarn --ignore-engines
-      - mkdir third_party
-      - ps: >-
-          node -e "require('./src/utils/reclient.js').downloadAndPrepare({})"
-      - ps: $env:RECLIENT_HELPER = node -p "require('./src/utils/reclient.js').helperPath({})"
-      - ps: >-
-          & $env:RECLIENT_HELPER login
-      - ps: >-
-          $env:RBE_service = node -e "console.log(require('./src/utils/reclient.js').serviceAddress)"
-      - ps: >-
-          $env:RBE_credentials_helper = $env:RECLIENT_HELPER
-      - ps: >-
-          $env:RBE_credentials_helper_args = "print"
-      - ps: >-
-          if ($env:ELECTRON_RBE_JWT -eq '') {
-            $env:RBE_fail_early_min_action_count = "0"
-            $env:RBE_fail_early_min_fallback_ratio = "0"
-          }
-      - cd ..\..
-      - ps: $env:CHROMIUM_BUILDTOOLS_PATH="$pwd\src\buildtools"
-      - ps: >-
-          if ($env:GN_CONFIG -ne 'release') {
-            $env:NINJA_STATUS="[%r processes, %f/%t @ %o/s : %es] "
-          }
-      - gclient config --name "src\electron" --unmanaged %GCLIENT_EXTRA_ARGS% "https://github.com/electron/electron"
-      # Patches are applied in the image bake. Check depshash to see if patches have changed.
-      - ps: $env:RUN_GCLIENT_SYNC="false"
-      - ps: $depshash_baked = Get-Content .\src\.depshash -Raw
-      - ps: cd src\electron
-      - ps: node script\generate-deps-hash.js
-      - ps: $depshash = Get-Content .\.depshash -Raw
-      - ps: cd ..\..
-      - ps: >-
-          if ($depshash_baked -ne $depshash) {
-            $env:RUN_GCLIENT_SYNC="true"
-          }
-      - if "%RUN_GCLIENT_SYNC%"=="true" ( gclient sync --with_branch_heads --with_tags ) else ( gclient runhooks )
-      - cd src
-      - ps: $env:PATH="$pwd\third_party\ninja;$env:PATH"
-      - set BUILD_CONFIG_PATH=//electron/build/args/%GN_CONFIG%.gn
-      - gn gen out/Default "--args=import(\"%BUILD_CONFIG_PATH%\") use_remoteexec=true %GN_EXTRA_ARGS% "
-      - gn check out/Default //electron:electron_lib
-      - gn check out/Default //electron:electron_app
-      - gn check out/Default //electron/shell/common:mojo
-      - gn check out/Default //electron/shell/common:plugin
-      - autoninja -j 300 -C out/Default electron:electron_app
-      - if "%GN_CONFIG%"=="testing" ( python C:\depot_tools\post_build_ninja_summary.py -C out\Default )
-      - gn gen out/ffmpeg "--args=import(\"//electron/build/args/ffmpeg.gn\") use_remoteexec=true %GN_EXTRA_ARGS%"
-      - autoninja -C out/ffmpeg electron:electron_ffmpeg_zip
-      - autoninja -C out/Default electron:electron_dist_zip
-      - gn desc out/Default v8:run_mksnapshot_default args > out/Default/default_mksnapshot_args
-      # Remove unused args from mksnapshot_args
-      - ps: >-
-          Get-Content out/Default/default_mksnapshot_args | Where-Object { -not $_.Contains('--turbo-profiling-input') -And -not $_.Contains('builtins-pgo') } | Set-Content out/Default/mksnapshot_args
-      - autoninja -C out/Default electron:electron_mksnapshot_zip
-      - cd out\Default
-      - 7z a mksnapshot.zip mksnapshot_args gen\v8\embedded.S
-      - cd ..\..
-      - autoninja -C out/Default electron:hunspell_dictionaries_zip
-      - autoninja -C out/Default electron:electron_chromedriver_zip
-      - autoninja -C out/Default electron:node_headers
-      - ps: >-
-          Get-CimInstance -Namespace root\cimv2 -Class Win32_product | Select vendor, description, @{l='install_location';e='InstallLocation'}, @{l='install_date';e='InstallDate'}, @{l='install_date_2';e='InstallDate2'}, caption, version, name, @{l='sku_number';e='SKUNumber'} | ConvertTo-Json | Out-File -Encoding utf8 -FilePath .\installed_software.json
-      - python3 electron/build/profile_toolchain.py --output-json=out/Default/windows_toolchain_profile.json
-      - 7z a node_headers.zip out\Default\gen\node_headers
-      - ps: >-
-          if ($env:GN_CONFIG -eq 'release') {
-            # Needed for msdia140.dll on 64-bit windows
-            $env:Path += ";$pwd\third_party\llvm-build\Release+Asserts\bin"
-          }
-      - if "%GN_CONFIG%"=="release" ( autoninja -C out/Default electron:electron_symbols )
-      - ps: >-
-          if ($env:GN_CONFIG -eq 'release') {
-            python3 electron\script\zip-symbols.py
-            appveyor-retry appveyor PushArtifact out/Default/symbols.zip
-          } else {
-            # It's useful to have pdb files when debugging testing builds that are
-            # built on CI.
-            7z a pdb.zip out\Default\*.pdb
-          }
-      - ps: |
-          if ($env:TARGET_ARCH -eq 'ia32') {
-            $env:MANIFEST_ARCH = "x86"
-          } else {
-            $env:MANIFEST_ARCH = $env:TARGET_ARCH
-          }
-          $manifest_file = "electron/script/zip_manifests/dist_zip.win.$env:MANIFEST_ARCH.manifest"
-          python3 electron/script/zip_manifests/check-zip-manifest.py out/Default/dist.zip $manifest_file
-          if ($LASTEXITCODE -ne 0) {
-            throw "Zip contains files not listed in the manifest $manifest_file"
-          }
-      - ps: |
-          cd C:\projects\src
-          $missing_artifacts = $false
-          if ($env:SHOULD_SKIP_ARTIFACT_VALIDATION -eq 'true') {
-            Write-warning "Skipping artifact validation for doc-only $env:APPVEYOR_PROJECT_NAME"
-          } else {
-            $artifacts_to_validate = 'dist.zip','windows_toolchain_profile.json','chromedriver.zip','ffmpeg.zip','node_headers.zip','mksnapshot.zip','electron.lib','hunspell_dictionaries.zip'
-            foreach($artifact_name in $artifacts_to_validate) {
-              if ($artifact_name -eq 'ffmpeg.zip') {
-                $artifact_file = "out\ffmpeg\ffmpeg.zip"
-              } elseif (
-                $artifact_name -eq 'node_headers.zip') {
-                $artifact_file = $artifact_name
-              } else {
-                $artifact_file = "out\Default\$artifact_name"
-              }
-              if (-not(Test-Path $artifact_file)) {
-                Write-warning "$artifact_name is missing and cannot be added to artifacts"
-                $missing_artifacts = $true
-              }
-            }
-          }
-          if ($missing_artifacts) {
-            throw "Build failed due to missing artifacts"
-          }
-
-    deploy_script:
-      - cd electron
-      - ps: >-
-          if (Test-Path Env:\ELECTRON_RELEASE) {
-            if (Test-Path Env:\UPLOAD_TO_STORAGE) {
-              Write-Output "Uploading Electron release distribution to azure"
-              & python3 script\release\uploaders\upload.py --verbose --upload_to_storage
-            } else {
-              Write-Output "Uploading Electron release distribution to github releases"
-              & python3 script\release\uploaders\upload.py --verbose
-            }
-          }
-    on_finish:
-      # Uncomment this lines to enable RDP
-      # - ps: $blockRdp = $true; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
-      - cd C:\projects\src
-      - if exist out\Default\windows_toolchain_profile.json ( appveyor-retry appveyor PushArtifact out\Default\windows_toolchain_profile.json )
-      - if exist out\Default\dist.zip (appveyor-retry appveyor PushArtifact out\Default\dist.zip)
-      - if exist out\Default\chromedriver.zip (appveyor-retry appveyor PushArtifact out\Default\chromedriver.zip)
-      - if exist out\ffmpeg\ffmpeg.zip (appveyor-retry appveyor PushArtifact out\ffmpeg\ffmpeg.zip)
-      - if exist node_headers.zip (appveyor-retry appveyor PushArtifact node_headers.zip)
-      - if exist out\Default\mksnapshot.zip (appveyor-retry appveyor PushArtifact out\Default\mksnapshot.zip)
-      - if exist out\Default\hunspell_dictionaries.zip (appveyor-retry appveyor PushArtifact out\Default\hunspell_dictionaries.zip)
-      - if exist out\Default\electron.lib (appveyor-retry appveyor PushArtifact out\Default\electron.lib)        
-      - ps: >-
-          if ((Test-Path "pdb.zip") -And ($env:GN_CONFIG -ne 'release')) {
-            appveyor-retry appveyor PushArtifact pdb.zip
-          }
-  - matrix:
-      only:
-        - job_name: Test 1
-        - job_name: Test 2
-
-    environment:
-        DD_ENV: ci
-        DD_SERVICE: electron
-        DD_CIVISIBILITY_LOGS_ENABLED: true
-        DD_GIT_REPOSITORY_URL: "https://github.com/electron/electron.git"
-        ELECTRON_TEST_RESULTS_DIR: C:\projects\src\electron\junit
-
-    init:
-      - ps: |
-          if ($env:RUN_TESTS -ne 'true') {
-            Write-warning "Skipping tests for $env:APPVEYOR_PROJECT_NAME"; Exit-AppveyorBuild
-          }
-    build_script:
-      - ps: |
-          node script/yarn.js install --frozen-lockfile
-          node script/doc-only-change.js --prNumber=$env:APPVEYOR_PULL_REQUEST_NUMBER
-          if ($LASTEXITCODE -eq 0) {
-            Write-warning "Skipping build for doc only change"
-            Exit-AppveyorBuild
-          } else {
-            $global:LASTEXITCODE = 0
-          }
-      - npm install -g @datadog/datadog-ci
-      - cd ..
-      - mkdir out\Default
-      - cd ..
-      - ps: |
-          # Download build artifacts
-          $apiUrl = 'https://ci.appveyor.com/api'
-          $build_info = Invoke-RestMethod -Method Get -Uri "$apiUrl/projects/$env:APPVEYOR_ACCOUNT_NAME/$env:APPVEYOR_PROJECT_SLUG/builds/$env:APPVEYOR_BUILD_ID"
-          $artifacts_to_download = @('dist.zip','chromedriver.zip','ffmpeg.zip','node_headers.zip','mksnapshot.zip','electron.lib')
-          foreach ($job in $build_info.build.jobs) {
-            if ($job.name -eq "Build") {
-              $jobId = $job.jobId
-              foreach($artifact_name in $artifacts_to_download) {
-                if ($artifact_name -eq 'electron.lib') {
-                  $outfile = "src\out\Default\$artifact_name"
-                } else {
-                  $outfile = $artifact_name
-                }
-                Invoke-RestMethod -Method Get -Uri "$apiUrl/buildjobs/$jobId/artifacts/$artifact_name" -OutFile $outfile
-              }
-              # Uncomment the following lines to download the pdb.zip to show real stacktraces when crashes happen during testing
-              Invoke-RestMethod -Method Get -Uri "$apiUrl/buildjobs/$jobId/artifacts/pdb.zip" -OutFile pdb.zip
-              7z x -y -osrc pdb.zip
-            }
-          }
-      - ps: |
-          $out_default_zips = @('dist.zip','chromedriver.zip','mksnapshot.zip')
-          foreach($zip_name in $out_default_zips) {
-            7z x -y -osrc\out\Default $zip_name
-          }
-      - ps: 7z x -y -osrc\out\ffmpeg ffmpeg.zip
-      - ps: 7z x -y -osrc node_headers.zip
-
-    test_script:
-      # Workaround for https://github.com/appveyor/ci/issues/2420
-      - set "PATH=%PATH%;C:\Program Files\Git\mingw64\libexec\git-core"
-      - ps: |
-          cd src
-          New-Item .\out\Default\gen\node_headers\Release -Type directory
-          Copy-Item -path .\out\Default\electron.lib -destination .\out\Default\gen\node_headers\Release\node.lib
-      - cd electron
-      # Explicitly set npm_config_arch because the .env doesn't persist
-      - ps: >-
-          if ($env:TARGET_ARCH -eq 'ia32') {
-            $env:npm_config_arch = "ia32"
-          }
-      - ps: $env:tests_files=node script\split-tests $env:shard 2
-      - echo "Running shard %shard% specs %tests_files%"
-      - echo Running main test suite & node script/yarn test -- --trace-uncaught --runners=main --enable-logging --files %tests_files%
-      - cd ..
-      - echo Verifying non proprietary ffmpeg & python electron\script\verify-ffmpeg.py --build-dir out\Default --source-root %cd% --ffmpeg-path out\ffmpeg
-      - echo "About to verify mksnapshot"
-      - echo Verifying mksnapshot & python electron\script\verify-mksnapshot.py --build-dir out\Default --source-root %cd%
-      - echo "Done verifying mksnapshot"
-      - echo Verifying chromedriver & python electron\script\verify-chromedriver.py --build-dir out\Default --source-root %cd%
-      - echo "Done verifying chromedriver"
-
-    on_finish:
-      # Uncomment these lines to enable RDP
-      # - ps: $blockRdp = $true; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
-      - if exist electron\junit\test-results-main.xml ( appveyor-retry appveyor PushArtifact electron\junit\test-results-main.xml )
-      - ps: |
-          if ($env:RUN_TESTS -eq 'true' -And $env:DD_API_KEY) {
-            $env:DD_GIT_COMMIT_SHA = $env:APPVEYOR_REPO_COMMIT
-            $env:DD_GIT_BRANCH = $env:APPVEYOR_PULL_REQUEST_HEAD_REPO_BRANCH
-            $env:DD_TAGS = "os.architecture:$env:TARGET_ARCH,os.family:windows,os.platform:win32"
-            if (Test-Path -Path "C:\projects\src\electron\junit\test-results-main.xml") {
-              C:\Users\appveyor\AppData\Roaming\npm\datadog-ci.ps1 junit upload --verbose C:\projects\src\electron\junit\test-results-main.xml
-            }
-          }

build/args/all.gn

@@ -2,7 +2,7 @@ is_electron_build = true
 root_extra_deps = [ "//electron" ]
 
 # Registry of NMVs --> https://github.com/nodejs/node/blob/main/doc/abi_version_registry.json
-node_module_version = 133
+node_module_version = 132
 
 v8_promise_internal_field_count = 1
 v8_embedder_string = "-electron.0"
@@ -77,6 +77,3 @@ enterprise_cloud_content_analysis = false
 # TODO: remove dependency on legacy ipc
 # https://issues.chromium.org/issues/40943039
 content_enable_legacy_ipc = true
-
-# Electron has its own unsafe-buffers enforcement directories.
-clang_unsafe_buffers_paths = "//electron/electron_unsafe_buffers_paths.txt"

build/rules.gni

@@ -29,7 +29,7 @@ template("compile_ib_files") {
 
     _output_extension = invoker.output_extension
 
-    script = "//build/config/apple/compile_ib_files.py"
+    script = "//build/config/ios/compile_ib_files.py"
     sources = invoker.sources
     outputs = [
       "$target_gen_dir/$target_name/{{source_name_part}}.$_output_extension",

chromium_src/BUILD.gn

@@ -155,6 +155,8 @@ static_library("chrome") {
 
   if (is_win) {
     sources += [
+      "//chrome/browser/extensions/global_shortcut_listener_win.cc",
+      "//chrome/browser/extensions/global_shortcut_listener_win.h",
       "//chrome/browser/icon_loader_win.cc",
       "//chrome/browser/media/webrtc/window_icon_util_win.cc",
       "//chrome/browser/process_singleton_win.cc",
@@ -202,7 +204,6 @@ static_library("chrome") {
     "//components/enterprise/obfuscation/core:enterprise_obfuscation",
     "//components/safe_browsing/core/browser/db:safebrowsing_proto",
     "//components/vector_icons:vector_icons",
-    "//ui/base/accelerators/global_accelerator_listener",
     "//ui/snapshot",
     "//ui/views/controls/webview",
   ]
@@ -218,11 +219,14 @@ static_library("chrome") {
   }
 
   if (is_linux) {
-    sources += [
-      "//chrome/browser/extensions/global_shortcut_listener_linux.cc",
-      "//chrome/browser/extensions/global_shortcut_listener_linux.h",
-      "//chrome/browser/icon_loader_auralinux.cc",
-    ]
+    sources += [ "//chrome/browser/icon_loader_auralinux.cc" ]
+    if (use_ozone) {
+      deps += [ "//ui/ozone" ]
+      sources += [
+        "//chrome/browser/extensions/global_shortcut_listener_ozone.cc",
+        "//chrome/browser/extensions/global_shortcut_listener_ozone.h",
+      ]
+    }
     sources += [
       "//chrome/browser/ui/views/status_icons/concat_menu_model.cc",
       "//chrome/browser/ui/views/status_icons/concat_menu_model.h",
@@ -233,7 +237,10 @@ static_library("chrome") {
       "//chrome/browser/ui/views/dark_mode_manager_linux.cc",
       "//chrome/browser/ui/views/dark_mode_manager_linux.h",
     ]
-    public_deps += [ "//components/dbus" ]
+    public_deps += [
+      "//components/dbus/menu",
+      "//components/dbus/thread_linux",
+    ]
   }
 
   if (is_win) {
@@ -255,6 +262,8 @@ static_library("chrome") {
 
   if (is_mac) {
     sources += [
+      "//chrome/browser/extensions/global_shortcut_listener_mac.h",
+      "//chrome/browser/extensions/global_shortcut_listener_mac.mm",
       "//chrome/browser/icon_loader_mac.mm",
       "//chrome/browser/media/webrtc/system_media_capture_permissions_mac.h",
       "//chrome/browser/media/webrtc/system_media_capture_permissions_mac.mm",

docs/api/app.md

@@ -1302,24 +1302,23 @@ Returns `Object`:
 Set the app's login item settings.
 
 To work with Electron's `autoUpdater` on Windows, which uses [Squirrel][Squirrel-Windows],
-you'll want to set the launch path to your executable's name but a directory up, which is
-a stub application automatically generated by Squirrel which will automatically launch the
-latest version.
+you'll want to set the launch path to Update.exe, and pass arguments that specify your
+application name. For example:
 
 ``` js
 const { app } = require('electron')
 const path = require('node:path')
 
 const appFolder = path.dirname(process.execPath)
-const ourExeName = path.basename(process.execPath)
-const stubLauncher = path.resolve(appFolder, '..', ourExeName)
+const updateExe = path.resolve(appFolder, '..', 'Update.exe')
+const exeName = path.basename(process.execPath)
 
 app.setLoginItemSettings({
   openAtLogin: true,
-  path: stubLauncher,
+  path: updateExe,
   args: [
-    // You might want to pass a parameter here indicating that this
-    // app was launched via login, but you don't have to
+    '--processStart', `"${exeName}"`,
+    '--process-start-args', '"--hidden"'
   ]
 })
 ```

docs/api/auto-updater.md

@@ -68,7 +68,7 @@ Emitted when there is an error while updating.
 
 ### Event: 'checking-for-update'
 
-Emitted when checking for an available update has started.
+Emitted when checking if an update has started.
 
 ### Event: 'update-available'
 

docs/api/base-window.md

@@ -144,24 +144,10 @@ _**Note**: There is a subtle difference between the behaviors of `window.onbefor
 Emitted when the window is closed. After you have received this event you should
 remove the reference to the window and avoid using it any more.
 
-#### Event: 'query-session-end' _Windows_
-
-Returns:
-
-* `event` [WindowSessionEndEvent][window-session-end-event]
-
-Emitted when a session is about to end due to a shutdown, machine restart, or user log-off.
-Calling `event.preventDefault()` can delay the system shutdown, though it’s generally best
-to respect the user’s choice to end the session. However, you may choose to use it if
-ending the session puts the user at risk of losing data.
-
 #### Event: 'session-end' _Windows_
 
-Returns:
-
-* `event` [WindowSessionEndEvent][window-session-end-event]
-
-Emitted when a session is about to end due to a shutdown, machine restart, or user log-off. Once this event fires, there is no way to prevent the session from ending.
+Emitted when window session is going to end due to force shutdown or machine restart
+or session log off.
 
 #### Event: 'blur'
 
@@ -526,7 +512,7 @@ Sets the content view of the window.
 
 #### `win.getContentView()`
 
-Returns [`View`](view.md) - The content view of the window.
+Returns [View](view.md) - The content view of the window.
 
 #### `win.destroy()`
 
@@ -1443,4 +1429,3 @@ On Linux, the `symbolColor` is automatically calculated to have minimum accessib
 [vibrancy-docs]: https://developer.apple.com/documentation/appkit/nsvisualeffectview?preferredLanguage=objc
 [window-levels]: https://developer.apple.com/documentation/appkit/nswindow/level
 [event-emitter]: https://nodejs.org/api/events.html#events_class_eventemitter
-[window-session-end-event]:../api/structures/window-session-end-event.md

docs/api/browser-window.md

@@ -207,24 +207,10 @@ _**Note**: There is a subtle difference between the behaviors of `window.onbefor
 Emitted when the window is closed. After you have received this event you should
 remove the reference to the window and avoid using it any more.
 
-#### Event: 'query-session-end' _Windows_
-
-Returns:
-
-* `event` [WindowSessionEndEvent][window-session-end-event]
-
-Emitted when a session is about to end due to a shutdown, machine restart, or user log-off.
-Calling `event.preventDefault()` can delay the system shutdown, though it’s generally best
-to respect the user’s choice to end the session. However, you may choose to use it if
-ending the session puts the user at risk of losing data.
-
 #### Event: 'session-end' _Windows_
 
-Returns:
-
-* `event` [WindowSessionEndEvent][window-session-end-event]
-
-Emitted when a session is about to end due to a shutdown, machine restart, or user log-off. Once this event fires, there is no way to prevent the session from ending.
+Emitted when window session is going to end due to force shutdown or machine restart
+or session log off.
 
 #### Event: 'unresponsive'
 
@@ -1563,17 +1549,13 @@ there is only one tab in the current window.
 
 Adds a window as a tab on this window, after the tab for the window instance.
 
-#### `win.setVibrancy(type[, options])` _macOS_
+#### `win.setVibrancy(type)` _macOS_
 
 * `type` string | null - Can be `titlebar`, `selection`, `menu`, `popover`, `sidebar`, `header`, `sheet`, `window`, `hud`, `fullscreen-ui`, `tooltip`, `content`, `under-window`, or `under-page`. See
   the [macOS documentation][vibrancy-docs] for more details.
-* `options` Object (optional)
-  * `animationDuration` number (optional) - if greater than zero, the change to vibrancy will be animated over the given duration (in milliseconds).
 
 Adds a vibrancy effect to the browser window. Passing `null` or an empty string
-will remove the vibrancy effect on the window. The `animationDuration` parameter only
- animates fading in or fading out the vibrancy effect. Animating between
- different types of vibrancy is not supported.
+will remove the vibrancy effect on the window.
 
 #### `win.setBackgroundMaterial(material)` _Windows_
 
@@ -1686,4 +1668,3 @@ On Linux, the `symbolColor` is automatically calculated to have minimum accessib
 [vibrancy-docs]: https://developer.apple.com/documentation/appkit/nsvisualeffectview?preferredLanguage=objc
 [window-levels]: https://developer.apple.com/documentation/appkit/nswindow/level
 [event-emitter]: https://nodejs.org/api/events.html#events_class_eventemitter
-[window-session-end-event]:../api/structures/window-session-end-event.md

docs/api/command-line-switches.md

@@ -313,6 +313,12 @@ Set the default value of the `verbatim` parameter in the Node.js [`dns.lookup()`
 
 The default is `verbatim` and `dns.setDefaultResultOrder()` have higher priority than `--dns-result-order`.
 
+### `--diagnostic-dir=directory`
+
+Set the directory to which all Node.js diagnostic output files are written. Defaults to current working directory.
+
+Affects the default output directory of [v8.setHeapSnapshotNearHeapLimit](https://nodejs.org/docs/latest/api/v8.html#v8setheapsnapshotnearheaplimitlimit).
+
 [app]: app.md
 [append-switch]: command-line.md#commandlineappendswitchswitch-value
 [debugging-main-process]: ../tutorial/debugging-main-process.md

docs/api/dialog.md

@@ -360,7 +360,7 @@ On Windows the options are more limited, due to the Win32 APIs used:
 
 ## Bookmarks array
 
-`showOpenDialog` and `showSaveDialog` resolve to an object with a `bookmarks` field. This field is an array of Base64 encoded strings that contain the [security scoped bookmark](https://developer.apple.com/library/content/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html#//apple_ref/doc/uid/TP40011183-CH3-SW16) data for the saved file. The `securityScopedBookmarks` option must be enabled for this to be present.
+`showOpenDialog`, `showOpenDialogSync`, `showSaveDialog`, and `showSaveDialogSync` will return a `bookmarks` array.
 
 | Build Type | securityScopedBookmarks boolean | Return Type | Return Value                   |
 |------------|---------------------------------|:-----------:|--------------------------------|

docs/api/global-shortcut.md

@@ -12,17 +12,9 @@ shortcuts.
 not have the keyboard focus. This module cannot be used before the `ready`
 event of the app module is emitted.
 
-Please also note that it is also possible to use Chromium's
-`GlobalShortcutsPortal` implementation, which allows apps to bind global
-shortcuts when running within a Wayland session.
-
 ```js
 const { app, globalShortcut } = require('electron')
 
-// Enable usage of Portal's globalShortcuts. This is essential for cases when
-// the app runs in a Wayland session.
-app.commandLine.appendSwitch('enable-features', 'GlobalShortcutsPortal')
-
 app.whenReady().then(() => {
   // Register a 'CommandOrControl+X' shortcut listener.
   const ret = globalShortcut.register('CommandOrControl+X', () => {

docs/api/ipc-renderer.md

@@ -41,6 +41,16 @@ The `ipcRenderer` module has the following method to listen for events and send
 Listens to `channel`, when a new message arrives `listener` would be called with
 `listener(event, args...)`.
 
+:::warning
+Do not expose the `event` argument to the renderer for security reasons! Wrap any
+callback that you receive from the renderer in another function like this:
+`ipcRenderer.on('my-channel', (event, ...args) => callback(...args))`.
+Not wrapping the callback in such a function would expose dangerous Electron APIs
+to the renderer process. See the
+[security guide](../tutorial/security.md#20-do-not-expose-electron-apis-to-untrusted-web-content)
+for more info.
+:::
+
 ### `ipcRenderer.off(channel, listener)`
 
 * `channel` string

docs/api/navigation-history.md

@@ -74,3 +74,22 @@ Returns `boolean` - Whether the navigation entry was removed from the webContent
 #### `navigationHistory.getAllEntries()`
 
 Returns [`NavigationEntry[]`](structures/navigation-entry.md) - WebContents complete history.
+
+#### `navigationHistory.restore(options)`
+
+Restores navigation history and loads the given entry in the in stack. Will make a best effort
+to restore not just the navigation stack but also the state of the individual pages - for instance
+including HTML form values or the scroll position. It's recommended to call this API before any
+navigation entries are created, so ideally before you call `loadURL()` or `loadFile()` on the
+`webContents` object.
+
+This API allows you to create common flows that aim to restore, recreate, or clone other webContents.
+
+* `options` Object
+  * `entries` [NavigationEntry[]](structures/navigation-entry.md) - Result of a prior `getAllEntries()` call
+  * `index` Integer (optional) - Index of the stack that should be loaded. If you set it to `0`, the webContents will load the first (oldest) entry. If you leave it undefined, Electron will automatically load the last (newest) entry.
+
+Returns `Promise<void>` - the promise will resolve when the page has finished loading the selected navigation entry
+(see [`did-finish-load`](web-contents.md#event-did-finish-load)), and rejects
+if the page fails to load (see
+[`did-fail-load`](web-contents.md#event-did-fail-load)). A noop rejection handler is already attached, which avoids unhandled rejection errors.

docs/api/power-monitor.md

@@ -26,7 +26,10 @@ Emitted when system changes to battery power.
 
 ### Event: 'thermal-state-change' _macOS_
 
-* `state` string - The system's new thermal state. Can be `unknown`, `nominal`, `fair`, `serious`, `critical`.
+Returns:
+
+* `details` Event\<\>
+  * `state` string - The system's new thermal state. Can be `unknown`, `nominal`, `fair`, `serious`, `critical`.
 
 Emitted when the thermal state of the system changes. Notification of a change
 in the thermal status of the system, such as entering a critical temperature
@@ -42,9 +45,8 @@ See https://developer.apple.com/library/archive/documentation/Performance/Concep
 
 ### Event: 'speed-limit-change' _macOS_ _Windows_
 
-Returns:
-
-* `limit` number - The operating system's advertised speed limit for CPUs, in percent.
+* `details` Event\<\>
+  * `limit` number - The operating system's advertised speed limit for CPUs, in percent.
 
 Notification of a change in the operating system's advertised speed limit for
 CPUs, in percent. Values below 100 indicate that the system is impairing

docs/api/session.md

@@ -933,6 +933,7 @@ session.fromPartition('some-partition').setPermissionRequestHandler((webContents
     * `storage-access` - Allows content loaded in a third-party context to request access to third-party cookies using the [Storage Access API](https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API).
     * `top-level-storage-access` -  Allow top-level sites to request third-party cookie access on behalf of embedded content originating from another site in the same related website set using the [Storage Access API](https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API).
     * `usb` - Expose non-standard Universal Serial Bus (USB) compatible devices services to the web with the [WebUSB API](https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API).
+    * `deprecated-sync-clipboard-read` _Deprecated_ - Request access to run `document.execCommand("paste")`
   * `requestingOrigin` string - The origin URL of the permission check
   * `details` Object - Some properties are only available on certain permission types.
     * `embeddingOrigin` string (optional) - The origin of the frame embedding the frame that made the permission check.  Only set for cross-origin sub frames making permission checks.

docs/api/structures/base-window-options.md

@@ -97,9 +97,10 @@
   * `height` Integer (optional) - The height of the title bar and Window Controls Overlay in pixels. Default is system height.
 * `trafficLightPosition` [Point](point.md) (optional) _macOS_ -
   Set a custom position for the traffic light buttons in frameless windows.
-* `roundedCorners` boolean (optional) _macOS_ - Whether frameless window
-  should have rounded corners on macOS. Default is `true`. Setting this property
-  to `false` will prevent the window from being fullscreenable.
+* `roundedCorners` boolean (optional) _macOS_ _Windows_ - Whether frameless window
+  should have rounded corners. Default is `true`. Setting this property
+  to `false` will prevent the window from being fullscreenable on macOS.
+  On Windows versions older than Windows 11 Build 22000 this property has no effect, and frameless windows will not have rounded corners.
 * `thickFrame` boolean (optional) - Use `WS_THICKFRAME` style for frameless windows on
   Windows, which adds standard window frame. Setting it to `false` will remove
   window shadow and window animations. Default is `true`.

docs/api/structures/navigation-entry.md

@@ -2,3 +2,6 @@
 
 * `url` string
 * `title` string
+* `pageState` string (optional) - A base64 encoded data string containing Chromium page state
+  including information like the current scroll position or form values. It is committed by
+  Chromium before a navigation event and on a regular interval.

docs/api/structures/web-preferences.md

@@ -148,6 +148,7 @@
   this will cause the `preferred-size-changed` event to be emitted on the
   `WebContents` when the preferred size changes. Default is `false`.
 * `transparent` boolean (optional) - Whether to enable background transparency for the guest page. Default is `true`. **Note:** The guest page's text and background colors are derived from the [color scheme](https://developer.mozilla.org/en-US/docs/Web/CSS/color-scheme) of its root element. When transparency is enabled, the text color will still change accordingly but the background will remain transparent.
+* `enableDeprecatedPaste` boolean (optional) _Deprecated_ - Whether to enable the `paste` [execCommand](https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand). Default is `false`.
 
 [chrome-content-scripts]: https://developer.chrome.com/extensions/content_scripts#execution-environment
 [runtime-enabled-features]: https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/platform/runtime_enabled_features.json5

docs/api/structures/window-session-end-event.md

@@ -1,7 +0,0 @@
-# WindowSessionEndEvent Object extends `Event`
-
-* `reasons` string[] - List of reasons for shutdown. Can be 'shutdown', 'close-app', 'critical', or 'logoff'.
-
-Unfortunately, Windows does not offer a way to differentiate between a shutdown and a reboot, meaning the 'shutdown'
-reason is triggered in both scenarios. For more details on the `WM_ENDSESSION` message and its associated reasons,
-refer to the [MSDN documentation](https://learn.microsoft.com/en-us/windows/win32/shutdown/wm-endsession).

docs/api/view.md

@@ -106,6 +106,12 @@ Examples of valid `color` values:
 
 * `visible` boolean - If false, the view will be hidden from display.
 
+#### `view.getVisible()`
+
+Returns `boolean` - Whether the view should be drawn. Note that this is
+different from whether the view is visible on screen—it may still be obscured
+or out of view.
+
 ### Instance Properties
 
 Objects created with `new View` have the following properties:

docs/api/web-contents.md

@@ -955,17 +955,11 @@ Emitted when a `<webview>` has been attached to this web contents.
 
 Returns:
 
-* `details` Event\<\>
-  * `message` string - Message text
-  * `level` string - Message severity
-    Possible values include `info`, `warning`, `error`, and `debug`.
-  * `lineNumber` Integer - Line number in the log source
-  * `sourceId` string - URL of the log source
-  * `frame` WebFrameMain - Frame that logged the message
-* `level` Integer _Deprecated_ - The log level, from 0 to 3. In order it matches `verbose`, `info`, `warning` and `error`.
-* `message` string _Deprecated_ - The actual console message
-* `line` Integer _Deprecated_ - The line number of the source that triggered this console message
-* `sourceId` string _Deprecated_
+* `event` Event
+* `level` Integer - The log level, from 0 to 3. In order it matches `verbose`, `info`, `warning` and `error`.
+* `message` string - The actual console message
+* `line` Integer - The line number of the source that triggered this console message
+* `sourceId` string
 
 Emitted when the associated window logs a console message.
 

docs/breaking-changes.md

@@ -39,6 +39,15 @@ This brings the behavior to parity with Linux. Prior behavior: Menu bar is still
 
 ## Planned Breaking API Changes (33.0)
 
+### Deprecated: `document.execCommand("paste")`
+
+The synchronous clipboard read API [document.execCommand("paste")](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Interact_with_the_clipboard) has been
+deprecated in favor of [async clipboard API](https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_API). This is to align with the browser defaults.
+
+The `enableDeprecatedPaste` option on `WebPreferences` that triggers the permission
+checks for this API and the associated permission type `deprecated-sync-clipboard-read`
+are also deprecated.
+
 ### Behavior Changed: frame properties may retrieve detached WebFrameMain instances or none at all
 
 APIs which provide access to a `WebFrameMain` instance may return an instance
@@ -111,6 +120,16 @@ macOS 10.15 (Catalina) is no longer supported by [Chromium](https://chromium-rev
 Older versions of Electron will continue to run on Catalina, but macOS 11 (Big Sur)
 or later will be required to run Electron v33.0.0 and higher.
 
+### Behavior Changed: Native modules now require C++20
+
+Due to changes made upstream, both
+[V8](https://chromium-review.googlesource.com/c/v8/v8/+/5587859) and
+[Node.js](https://github.com/nodejs/node/pull/45427) now require C++20 as a
+minimum version. Developers using native node modules should build their
+modules with `--std=c++20` rather than `--std=c++17`. Images using gcc9 or
+lower may need to update to gcc10 in order to compile. See
+[#43555](https://github.com/electron/electron/pull/43555) for more details.
+
 ### Deprecated: `systemPreferences.accessibilityDisplayShouldReduceTransparency`
 
 The `systemPreferences.accessibilityDisplayShouldReduceTransparency` property is now deprecated in favor of the new `nativeTheme.prefersReducedTransparency`, which provides identical information and works cross-platform.
@@ -182,6 +201,14 @@ win.webContents.navigationHistory.canGoToOffset()
 win.webContents.navigationHistory.goToOffset(index)
 ```
 
+### Behavior changed: Directory `databases` in `userData` will be deleted
+
+If you have a directory called `databases` in the directory returned by
+`app.getPath('userData')`, it will be deleted when Electron 32 is first run.
+The `databases` directory was used by WebSQL, which was removed in Electron 31.
+Chromium now performs a cleanup that deletes this directory. See
+[issue #45396](https://github.com/electron/electron/issues/45396).
+
 ## Planned Breaking API Changes (31.0)
 
 ### Removed: `WebSQL` support

docs/tutorial/code-signing.md

@@ -13,7 +13,8 @@ security warnings.
 
 Both Windows and macOS prevent users from running unsigned applications. It is
 possible to distribute applications without codesigning them - but in order to
-run them, users need to go through multiple advanced and manual steps.
+run them, users need to go through multiple advanced and manual steps to run
+them.
 
 If you are building an Electron app that you intend to package and distribute,
 it should be code signed. The Electron ecosystem tooling makes codesigning your

docs/tutorial/devtools-extension.md

@@ -78,6 +78,7 @@ The following Devtools extensions have been tested to work in Electron:
 * [React Developer Tools](https://chrome.google.com/webstore/detail/react-developer-tools/fmkadmapgofadopljbjfkapdkoienihi)
 * [Backbone Debugger](https://chrome.google.com/webstore/detail/backbone-debugger/bhljhndlimiafopmmhjlgfpnnchjjbhd)
 * [jQuery Debugger](https://chrome.google.com/webstore/detail/jquery-debugger/dbhhnnnpaeobfddmlalhnehgclcmjimi)
+* [AngularJS Batarang](https://chrome.google.com/webstore/detail/angularjs-batarang/ighdmehidhipcmcojjgiloacoafjmpfk)
 * [Vue.js devtools](https://chrome.google.com/webstore/detail/vuejs-devtools/nhdogjmejiglipccpnnnanhbledajbpd)
 * [Cerebral Debugger](https://cerebraljs.com/docs/introduction/devtools.html)
 * [Redux DevTools Extension](https://chrome.google.com/webstore/detail/redux-devtools/lmhkpmbekcpmknklioeibfkpmmfibljd)

docs/tutorial/multithreading.md

@@ -42,7 +42,7 @@ safe.
 The only way to load a native module safely for now, is to make sure the app
 loads no native modules after the Web Workers get started.
 
-```js
+```js @ts-expect-error=[1]
 process.dlopen = () => {
   throw new Error('Load native module is not safe')
 }

docs/tutorial/native-file-drag-drop.md

@@ -22,12 +22,9 @@ In `preload.js` use the [`contextBridge`][] to inject a method `window.electron.
 
 ```js
 const { contextBridge, ipcRenderer } = require('electron')
-const path = require('node:path')
 
 contextBridge.exposeInMainWorld('electron', {
-  startDrag: (fileName) => {
-    ipcRenderer.send('ondragstart', path.join(process.cwd(), fileName))
-  }
+  startDrag: (fileName) => ipcRenderer.send('ondragstart', fileName)
 })
 ```
 

docs/tutorial/navigation-history.md

@@ -69,8 +69,25 @@ if (navigationHistory.canGoToOffset(2)) {
 }
 ```
 
+## Restoring history
+
+A common flow is that you want to restore the history of a webContents - for instance to implement an "undo close tab" feature. To do so, you can call `navigationHistory.restore({ index, entries })`. This will restore the webContent's navigation history and the webContents location in said history, meaning that `goBack()` and `goForward()` navigate you through the stack as expected.
+
+```js @ts-type={navigationHistory:Electron.NavigationHistory}
+
+const firstWindow = new BrowserWindow()
+
+// Later, you want a second window to have the same history and navigation position
+async function restore () {
+  const entries = firstWindow.webContents.navigationHistory.getAllEntries()
+  const index = firstWindow.webContents.navigationHistory.getActiveIndex()
+
+  const secondWindow = new BrowserWindow()
+  await secondWindow.webContents.navigationHistory.restore({ index, entries })
+}
+```
+
 Here's a full example that you can open with Electron Fiddle:
 
 ```fiddle docs/fiddles/features/navigation-history
-
 ```

docs/tutorial/security.md

@@ -116,6 +116,7 @@ You should at least follow these steps to improve the security of your applicati
 17. [Validate the `sender` of all IPC messages](#17-validate-the-sender-of-all-ipc-messages)
 18. [Avoid usage of the `file://` protocol and prefer usage of custom protocols](#18-avoid-usage-of-the-file-protocol-and-prefer-usage-of-custom-protocols)
 19. [Check which fuses you can change](#19-check-which-fuses-you-can-change)
+20. [Do not expose Electron APIs to untrusted web content](#20-do-not-expose-electron-apis-to-untrusted-web-content)
 
 To automate the detection of misconfigurations and insecure patterns, it is
 possible to use
@@ -229,7 +230,7 @@ API to remotely loaded content via the [contextBridge API](../api/context-bridge
 ### 3. Enable Context Isolation
 
 :::info
-This recommendation is the default behavior in Electron since 12.0.0.
+Context Isolation is the default behavior in Electron since 12.0.0.
 :::
 
 Context isolation is an Electron feature that allows developers to run code
@@ -804,6 +805,48 @@ flipping these fuses easy. Check out the README of that module for more details
 potential error cases, and refer to
 [How do I flip the fuses?](./fuses.md#how-do-i-flip-the-fuses) in our documentation.
 
+### 20. Do not expose Electron APIs to untrusted web content
+
+You should not directly expose Electron's APIs, especially IPC, to untrusted web content in your
+preload scripts.
+
+### Why?
+
+Exposing raw APIs like `ipcRenderer.on` is dangerous because it gives renderer processes direct
+access to the entire IPC event system, allowing them to listen for any IPC events, not just the ones
+intended for them.
+
+To avoid that exposure, we also cannot pass callbacks directly through: The first
+argument to IPC event callbacks is an `IpcRendererEvent` object, which includes properties like `sender`
+that provide access to the underlying `ipcRenderer` instance. Even if you only listen for specific
+events, passing the callback directly means the renderer gets access to this event object.
+
+In short, we want the untrusted web content to only have access to necessary information and APIs.
+
+### How?
+
+```js title='preload'.js'
+// Bad
+contextBridge.exposeInMainWorld('electronAPI', {
+  on: ipcRenderer.on
+})
+
+// Also bad
+contextBridge.exposeInMainWorld('electronAPI', {
+  onUpdateCounter: (callback) => ipcRenderer.on('update-counter', callback)
+})
+
+// Good
+contextBridge.exposeInMainWorld('electronAPI', {
+  onUpdateCounter: (callback) => ipcRenderer.on('update-counter', (_event, value) => callback(value))
+})
+```
+
+:::info
+For more information on what `contextIsolation` is and how to use it to secure your app,
+please see the [Context Isolation](context-isolation.md) document.
+:::
+
 [breaking-changes]: ../breaking-changes.md
 [browser-window]: ../api/browser-window.md
 [webview-tag]: ../api/webview-tag.md

electron_paks.gni

@@ -85,7 +85,7 @@ template("electron_extra_paks") {
       "//net:net_resources",
       "//third_party/blink/public:devtools_inspector_resources",
       "//third_party/blink/public:resources",
-      "//ui/webui/resources",
+      "//ui/resources",
     ]
     if (defined(invoker.deps)) {
       deps += invoker.deps
@@ -98,7 +98,7 @@ template("electron_extra_paks") {
     sources += [
       "$root_gen_dir/content/browser/devtools/devtools_resources.pak",
       "$root_gen_dir/content/process_resources.pak",
-      "$root_gen_dir/ui/webui/resources/webui_resources.pak",
+      "$root_gen_dir/ui/resources/webui_resources.pak",
     ]
     deps += [ "//content/browser/devtools:devtools_resources" ]
     if (enable_pdf_viewer) {

electron_unsafe_buffers_paths.txt

@@ -1,34 +0,0 @@
-# Copyright 2024 The Electron Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# The set of path prefixes that should be checked for unsafe buffer usage (see
-# -Wunsafe-buffer-usage in Clang).
-#
-# ***
-# Paths should be written as relative to the root of the source tree with
-# unix-style path separators. Directory prefixes should end with `/`, such
-# as `base/`.
-# ***
-#
-# Files in this set are known to not use pointer arithmetic/subscripting, and
-# make use of constructs like base::span or containers like std::vector instead.
-#
-# See `docs/unsafe_buffers.md`.
-
-# These directories are excluded because they come from outside Electron and
-# we don't have control over their contents.
--base/
--chrome/
--components/
--device/
--extensions/
--google_apis/
--net/
--services/
--skia/
--third_party/
--tools/
--ui/
--url/
--v8/

filenames.auto.gni

@@ -153,7 +153,6 @@ auto_filenames = {
     "docs/api/structures/web-request-filter.md",
     "docs/api/structures/web-source.md",
     "docs/api/structures/window-open-handler-response.md",
-    "docs/api/structures/window-session-end-event.md",
   ]
 
   sandbox_bundle_deps = [

filenames.gni

@@ -159,8 +159,12 @@ filenames = {
     "shell/browser/osr/osr_web_contents_view_mac.mm",
     "shell/browser/relauncher_mac.cc",
     "shell/browser/ui/certificate_trust_mac.mm",
+    "shell/browser/ui/cocoa/delayed_native_view_host.h",
+    "shell/browser/ui/cocoa/delayed_native_view_host.mm",
     "shell/browser/ui/cocoa/electron_bundle_mover.h",
     "shell/browser/ui/cocoa/electron_bundle_mover.mm",
+    "shell/browser/ui/cocoa/electron_inspectable_web_contents_view.h",
+    "shell/browser/ui/cocoa/electron_inspectable_web_contents_view.mm",
     "shell/browser/ui/cocoa/electron_menu_controller.h",
     "shell/browser/ui/cocoa/electron_menu_controller.mm",
     "shell/browser/ui/cocoa/electron_native_widget_mac.h",
@@ -187,6 +191,8 @@ filenames = {
     "shell/browser/ui/cocoa/window_buttons_proxy.mm",
     "shell/browser/ui/drag_util_mac.mm",
     "shell/browser/ui/file_dialog_mac.mm",
+    "shell/browser/ui/inspectable_web_contents_view_mac.h",
+    "shell/browser/ui/inspectable_web_contents_view_mac.mm",
     "shell/browser/ui/message_box_mac.mm",
     "shell/browser/ui/tray_icon_cocoa.h",
     "shell/browser/ui/tray_icon_cocoa.mm",
@@ -218,6 +224,8 @@ filenames = {
     "shell/browser/ui/views/electron_views_delegate.h",
     "shell/browser/ui/views/frameless_view.cc",
     "shell/browser/ui/views/frameless_view.h",
+    "shell/browser/ui/views/inspectable_web_contents_view_views.cc",
+    "shell/browser/ui/views/inspectable_web_contents_view_views.h",
     "shell/browser/ui/views/menu_bar.cc",
     "shell/browser/ui/views/menu_bar.h",
     "shell/browser/ui/views/menu_delegate.cc",
@@ -578,6 +586,7 @@ filenames = {
     "shell/common/crash_keys.h",
     "shell/common/electron_command_line.cc",
     "shell/common/electron_command_line.h",
+    "shell/common/electron_constants.cc",
     "shell/common/electron_constants.h",
     "shell/common/electron_paths.h",
     "shell/common/gin_converters/accelerator_converter.cc",
@@ -671,6 +680,7 @@ filenames = {
     "shell/common/node_includes.h",
     "shell/common/node_util.cc",
     "shell/common/node_util.h",
+    "shell/common/options_switches.cc",
     "shell/common/options_switches.h",
     "shell/common/platform_util.cc",
     "shell/common/platform_util.h",

lib/browser/api/web-contents.ts

@@ -8,7 +8,7 @@ import * as deprecate from '@electron/internal/common/deprecate';
 import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
 
 import { app, ipcMain, session, webFrameMain, dialog } from 'electron/main';
-import type { BrowserWindowConstructorOptions, MessageBoxOptions } from 'electron/main';
+import type { BrowserWindowConstructorOptions, MessageBoxOptions, NavigationEntry } from 'electron/main';
 
 import * as path from 'path';
 import * as url from 'url';
@@ -343,8 +343,8 @@ WebContents.prototype.loadFile = function (filePath, options = {}) {
 
 type LoadError = { errorCode: number, errorDescription: string, url: string };
 
-WebContents.prototype.loadURL = function (url, options) {
-  const p = new Promise<void>((resolve, reject) => {
+function _awaitNextLoad (this: Electron.WebContents, navigationUrl: string) {
+  return new Promise<void>((resolve, reject) => {
     const resolveAndCleanup = () => {
       removeListeners();
       resolve();
@@ -402,7 +402,7 @@ WebContents.prototype.loadURL = function (url, options) {
       // the only one is with a bad scheme, perhaps ERR_INVALID_ARGUMENT
       // would be more appropriate.
       if (!error) {
-        error = { errorCode: -2, errorDescription: 'ERR_FAILED', url };
+        error = { errorCode: -2, errorDescription: 'ERR_FAILED', url: navigationUrl };
       }
       finishListener();
     };
@@ -426,6 +426,10 @@ WebContents.prototype.loadURL = function (url, options) {
     this.on('did-stop-loading', stopLoadingListener);
     this.on('destroyed', stopLoadingListener);
   });
+};
+
+WebContents.prototype.loadURL = function (url, options) {
+  const p = _awaitNextLoad.call(this, url);
   // Add a no-op rejection handler to silence the unhandled rejection error.
   p.catch(() => {});
   this._loadURL(url, options ?? {});
@@ -549,8 +553,6 @@ WebContents.prototype.goToOffset = function (index: number) {
   return this._goToOffset(index);
 };
 
-const consoleMessageDeprecated = deprecate.warnOnceMessage('\'console-message\' arguments are deprecated and will be removed. Please use Event<WebContentsConsoleMessageEventParams> object instead.');
-
 // Add JavaScript wrappers for WebContents class.
 WebContents.prototype._init = function () {
   const prefs = this.getLastWebPreferences() || {};
@@ -611,7 +613,27 @@ WebContents.prototype._init = function () {
       length: this._historyLength.bind(this),
       getEntryAtIndex: this._getNavigationEntryAtIndex.bind(this),
       removeEntryAtIndex: this._removeNavigationEntryAtIndex.bind(this),
-      getAllEntries: this._getHistory.bind(this)
+      getAllEntries: this._getHistory.bind(this),
+      restore: ({ index, entries }: { index?: number, entries: NavigationEntry[] }) => {
+        if (index === undefined) {
+          index = entries.length - 1;
+        }
+
+        if (index < 0 || !entries[index]) {
+          throw new Error('Invalid index. Index must be a positive integer and within the bounds of the entries length.');
+        }
+
+        const p = _awaitNextLoad.call(this, entries[index].url);
+        p.catch(() => {});
+
+        try {
+          this._restoreHistory(index, entries);
+        } catch (error) {
+          return Promise.reject(error);
+        }
+
+        return p;
+      }
     },
     writable: false,
     enumerable: true
@@ -911,15 +933,6 @@ WebContents.prototype._init = function () {
     openDialogs.clear();
   });
 
-  // TODO(samuelmaddock): remove deprecated 'console-message' arguments
-  this.on('-console-message' as any, (event: Electron.Event<Electron.WebContentsConsoleMessageEventParams>) => {
-    const hasDeprecatedListener = this.listeners('console-message').some(listener => listener.length > 1);
-    if (hasDeprecatedListener) {
-      consoleMessageDeprecated();
-    }
-    this.emit('console-message', event, (event as any)._level, event.message, event.lineNumber, event.sourceId);
-  });
-
   this.on('-unresponsive' as any, (event: Electron.Event<any>) => {
     const shouldEmit = !event.shouldIgnore && event.visible && event.rendererInitialized;
     if (shouldEmit) {

lib/node/asar-fs-wrapper.ts

@@ -306,17 +306,13 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
 
     const archive = getOrCreateArchive(asarPath);
     if (!archive) {
-      if (shouldThrowStatError(options)) {
-        throw createError(AsarError.INVALID_ARCHIVE, { asarPath });
-      };
+      if (shouldThrowStatError(options)) throw createError(AsarError.INVALID_ARCHIVE, { asarPath });
       return null;
     }
 
     const stats = archive.stat(filePath);
     if (!stats) {
-      if (shouldThrowStatError(options)) {
-        throw createError(AsarError.NOT_FOUND, { asarPath, filePath });
-      };
+      if (shouldThrowStatError(options)) throw createError(AsarError.NOT_FOUND, { asarPath, filePath });
       return null;
     }
 
@@ -694,9 +690,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     const { encoding } = options;
     const buffer = Buffer.alloc(info.size);
     const fd = archive.getFdAndValidateIntegrityLater();
-    if (!(fd >= 0)) {
-      throw createError(AsarError.NOT_FOUND, { asarPath, filePath });
-    }
+    if (!(fd >= 0)) throw createError(AsarError.NOT_FOUND, { asarPath, filePath });
 
     logASARAccess(asarPath, filePath, info.offset);
     fs.readSync(fd, buffer, 0, info.size, info.offset);
@@ -761,7 +755,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     nextTick(callback!, [null, files]);
   };
 
-  const { readdir: readdirPromise } = fs.promises;
+  const { readdir: readdirPromise } = require('fs').promises;
   fs.promises.readdir = async function (pathArgument: string, options: ReaddirOptions) {
     options = getOptions(options);
     pathArgument = getValidatedPath(pathArgument);
@@ -847,33 +841,40 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     return files;
   };
 
-  const modBinding = internalBinding('modules');
-  const { readPackageJSON } = modBinding;
-  internalBinding('modules').readPackageJSON = (
-    jsonPath: string,
-    isESM: boolean,
-    base: undefined | string,
-    specifier: undefined | string
-  ) => {
-    const pathInfo = splitPath(jsonPath);
-    if (!pathInfo.isAsar) return readPackageJSON(jsonPath, isESM, base, specifier);
+  const binding = internalBinding('fs');
+  const { internalModuleReadJSON, kUsePromises } = binding;
+  internalBinding('fs').internalModuleReadJSON = (pathArgument: string) => {
+    const pathInfo = splitPath(pathArgument);
+    if (!pathInfo.isAsar) return internalModuleReadJSON(pathArgument);
     const { asarPath, filePath } = pathInfo;
 
     const archive = getOrCreateArchive(asarPath);
-    if (!archive) return undefined;
+    if (!archive) return [];
 
-    const realPath = archive.copyFileOut(filePath);
-    if (!realPath) return undefined;
+    const info = archive.getFileInfo(filePath);
+    if (!info) return [];
+    if (info.size === 0) return ['', false];
+    if (info.unpacked) {
+      const realPath = archive.copyFileOut(filePath);
+      const str = fs.readFileSync(realPath, { encoding: 'utf8' });
+      return [str, str.length > 0];
+    }
 
-    return readPackageJSON(realPath, isESM, base, specifier);
+    const buffer = Buffer.alloc(info.size);
+    const fd = archive.getFdAndValidateIntegrityLater();
+    if (!(fd >= 0)) return [];
+
+    logASARAccess(asarPath, filePath, info.offset);
+    fs.readSync(fd, buffer, 0, info.size, info.offset);
+    validateBufferIntegrity(buffer, info.integrity);
+    const str = buffer.toString('utf8');
+    return [str, str.length > 0];
   };
 
-  const binding = internalBinding('fs');
-
-  const { internalModuleStat } = binding;
-  internalBinding('fs').internalModuleStat = (receiver: unknown, pathArgument: string) => {
+  const { internalModuleStat } = internalBinding('fs');
+  internalBinding('fs').internalModuleStat = (pathArgument: string) => {
     const pathInfo = splitPath(pathArgument);
-    if (!pathInfo.isAsar) return internalModuleStat(receiver, pathArgument);
+    if (!pathInfo.isAsar) return internalModuleStat(pathArgument);
     const { asarPath, filePath } = pathInfo;
 
     // -ENOENT
@@ -887,7 +888,6 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     return (stats.type === AsarFileType.kDirectory) ? 1 : 0;
   };
 
-  const { kUsePromises } = binding;
   async function readdirRecursive (originalPath: string, options: ReaddirOptions) {
     const result: any[] = [];
 
@@ -908,7 +908,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
       if (withFileTypes) {
         initialItem = [
           [...initialItem], initialItem.map((p: string) => {
-            return internalBinding('fs').internalModuleStat(binding, path.join(originalPath, p));
+            return internalBinding('fs').internalModuleStat(path.join(originalPath, p));
           })
         ];
       }
@@ -941,7 +941,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
 
               readdirResult = [
                 [...files], files.map((p: string) => {
-                  return internalBinding('fs').internalModuleStat(binding, path.join(direntPath, p));
+                  return internalBinding('fs').internalModuleStat(path.join(direntPath, p));
                 })
               ];
             } else {
@@ -962,7 +962,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
         const { 0: pathArg, 1: readDir } = queue.pop();
         for (const ent of readDir) {
           const direntPath = path.join(pathArg, ent);
-          const stat = internalBinding('fs').internalModuleStat(binding, direntPath);
+          const stat = internalBinding('fs').internalModuleStat(direntPath);
           result.push(path.relative(originalPath, direntPath));
 
           if (stat === 1) {
@@ -1014,7 +1014,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
         if (withFileTypes) {
           readdirResult = [
             [...readdirResult], readdirResult.map((p: string) => {
-              return internalBinding('fs').internalModuleStat(binding, path.join(pathArg, p));
+              return internalBinding('fs').internalModuleStat(path.join(pathArg, p));
             })
           ];
         }
@@ -1054,7 +1054,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
         for (let i = 0; i < readdirResult.length; i++) {
           const resultPath = path.join(pathArg, readdirResult[i]);
           const relativeResultPath = path.relative(basePath, resultPath);
-          const stat = internalBinding('fs').internalModuleStat(binding, resultPath);
+          const stat = internalBinding('fs').internalModuleStat(resultPath);
 
           readdirResults.push(relativeResultPath);
           if (stat === 1) pathsQueue.push(resultPath);

lib/renderer/init.ts

@@ -12,7 +12,7 @@ const Module = require('module') as NodeJS.ModuleInternal;
 const originalModuleLoad = Module._load;
 Module._load = function (request: string) {
   if (request === 'vm') {
-    console.warn('The vm module of Node.js is unsupported in Electron\'s renderer process due to incompatibilities with the Blink rendering engine. Crashes are likely and avoiding the module is highly recommended. This module may be removed in a future release.');
+    console.warn('The vm module of Node.js is deprecated in the renderer process and will be removed.');
   }
   return originalModuleLoad.apply(this, arguments as any);
 };

npm/package.json

@@ -9,7 +9,7 @@
   },
   "dependencies": {
     "@electron/get": "^2.0.0",
-    "@types/node": "^22.7.7",
+    "@types/node": "^20.9.0",
     "extract-zip": "^2.0.1"
   },
   "engines": {

package.json

@@ -14,7 +14,7 @@
     "@octokit/rest": "^20.0.2",
     "@primer/octicons": "^10.0.0",
     "@types/minimist": "^1.2.5",
-    "@types/node": "^22.7.7",
+    "@types/node": "^20.9.0",
     "@types/semver": "^7.5.8",
     "@types/stream-json": "^1.7.7",
     "@types/temp": "^0.9.4",
@@ -45,7 +45,7 @@
     "null-loader": "^4.0.1",
     "pre-flight": "^2.0.0",
     "process": "^0.11.10",
-    "remark-cli": "^12.0.1",
+    "remark-cli": "^10.0.0",
     "remark-preset-lint-markdown-style-guide": "^4.0.0",
     "semver": "^7.6.3",
     "shx": "^0.3.4",
@@ -57,7 +57,7 @@
     "ts-node": "6.2.0",
     "typescript": "^5.6.2",
     "url": "^0.11.4",
-    "webpack": "^5.95.0",
+    "webpack": "^5.94.0",
     "webpack-cli": "^5.1.4",
     "wrapper-webpack-plugin": "^2.2.0"
   },

patches/boringssl/expose_ripemd160.patch

@@ -9,10 +9,10 @@ with node.js that allows exposing additional digests without patching,
 this patch is required to provide ripemd160 support in the nodejs crypto
 module.
 
-diff --git a/crypto/digest_extra/digest_extra.cc b/crypto/digest_extra/digest_extra.cc
-index 0b30897db59bdfc9ada43cf44af21bc54b6d8442..d6ecbc05d7beb6efea79166004137f7cab4ce425 100644
---- a/crypto/digest_extra/digest_extra.cc
-+++ b/crypto/digest_extra/digest_extra.cc
+diff --git a/crypto/digest_extra/digest_extra.c b/crypto/digest_extra/digest_extra.c
+index 7033d9c9cc2a2e11c5d6b4bc8575b1f6d271170c..97107c022f6997c56581317feee230bd6b1ed542 100644
+--- a/crypto/digest_extra/digest_extra.c
++++ b/crypto/digest_extra/digest_extra.c
 @@ -87,6 +87,7 @@ static const struct nid_to_digest nid_to_digest_mapping[] = {
      {NID_sha512, EVP_sha512, SN_sha512, LN_sha512},
      {NID_sha512_256, EVP_sha512_256, SN_sha512_256, LN_sha512_256},
@@ -21,32 +21,32 @@ index 0b30897db59bdfc9ada43cf44af21bc54b6d8442..d6ecbc05d7beb6efea79166004137f7c
      // As a remnant of signing |EVP_MD|s, OpenSSL returned the corresponding
      // hash function when given a signature OID. To avoid unintended lax parsing
      // of hash OIDs, this is no longer supported for lookup by OID or NID.
-diff --git a/crypto/fipsmodule/digest/digests.cc.inc b/crypto/fipsmodule/digest/digests.cc.inc
-index e1b08fa2f2e2e3afca95b1f8b719220c5436903b..90a5d1895b9d5dff2748ef638c06c127ef84797b 100644
---- a/crypto/fipsmodule/digest/digests.cc.inc
-+++ b/crypto/fipsmodule/digest/digests.cc.inc
+diff --git a/crypto/fipsmodule/digest/digests.c.inc b/crypto/fipsmodule/digest/digests.c.inc
+index 9ead2c65c43f6f4899fa84d095c025b2b7c0bedc..1644bba5c1b87037b681372db89d93c2e637ebf2 100644
+--- a/crypto/fipsmodule/digest/digests.c.inc
++++ b/crypto/fipsmodule/digest/digests.c.inc
 @@ -60,6 +60,7 @@
  #include <string.h>
  
  #include <openssl/nid.h>
 +#include <openssl/ripemd.h>
  
- #include "../../internal.h"
- #include "../bcm_interface.h"
-@@ -217,4 +218,27 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha512_256) {
+ #include "internal.h"
+ #include "../delocate.h"
+@@ -215,4 +216,27 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha512_256) {
    out->ctx_size = sizeof(SHA512_CTX);
  }
  
 +static void ripemd160_init(EVP_MD_CTX *ctx) {
-+  CHECK(RIPEMD160_Init(reinterpret_cast<RIPEMD160_CTX *>(ctx->md_data)));
++  CHECK(RIPEMD160_Init(ctx->md_data));
 +}
 +
 +static void ripemd160_update(EVP_MD_CTX *ctx, const void *data, size_t count) {
-+  CHECK(RIPEMD160_Update(reinterpret_cast<RIPEMD160_CTX *>(ctx->md_data), data, count));
++  CHECK(RIPEMD160_Update(ctx->md_data, data, count));
 +}
 +
 +static void ripemd160_final(EVP_MD_CTX *ctx, uint8_t *md) {
-+  CHECK(RIPEMD160_Final(md, reinterpret_cast<RIPEMD160_CTX *>(ctx->md_data)));
++  CHECK(RIPEMD160_Final(md, ctx->md_data));
 +}
 +
 +DEFINE_METHOD_FUNCTION(EVP_MD, EVP_ripemd160) {
@@ -61,10 +61,10 @@ index e1b08fa2f2e2e3afca95b1f8b719220c5436903b..90a5d1895b9d5dff2748ef638c06c127
 +}
 +
  #undef CHECK
-diff --git a/decrepit/evp/evp_do_all.cc b/decrepit/evp/evp_do_all.cc
-index e199e10ca6602f231df4d83e1efe5254ee20e98f..9fd0e0225fa48b0afb90b525236e54cff17c1c84 100644
---- a/decrepit/evp/evp_do_all.cc
-+++ b/decrepit/evp/evp_do_all.cc
+diff --git a/decrepit/evp/evp_do_all.c b/decrepit/evp/evp_do_all.c
+index a3fb077b9b9e66d1bc524fd7987622e73aa4776a..852b76bea69988e0b3ac76a17b603128f239dde0 100644
+--- a/decrepit/evp/evp_do_all.c
++++ b/decrepit/evp/evp_do_all.c
 @@ -79,6 +79,7 @@ void EVP_MD_do_all_sorted(void (*callback)(const EVP_MD *cipher,
    callback(EVP_sha384(), "SHA384", NULL, arg);
    callback(EVP_sha512(), "SHA512", NULL, arg);
@@ -82,7 +82,7 @@ index e199e10ca6602f231df4d83e1efe5254ee20e98f..9fd0e0225fa48b0afb90b525236e54cf
  
  void EVP_MD_do_all(void (*callback)(const EVP_MD *cipher, const char *name,
 diff --git a/include/openssl/digest.h b/include/openssl/digest.h
-index c3130dc9baf4e28b9eef383a22707a561129ec16..2d046ece0705e8bec17aa1f164e1f9702b2f325b 100644
+index 6e889993edc1caa7e10670529dd270c337b5ae4c..f61f7e5009a9b4f5630cda2c3a5a21b44e5b88d8 100644
 --- a/include/openssl/digest.h
 +++ b/include/openssl/digest.h
 @@ -90,6 +90,9 @@ OPENSSL_EXPORT const EVP_MD *EVP_blake2b256(void);

patches/boringssl/feat_expose_several_extra_cipher_functions.patch

@@ -27,10 +27,10 @@ RC2 Ciphers: rc2-40-cbc
 
 It's unclear whether this would be accepted upstream. We should try regardless.
 
-diff --git a/crypto/cipher_extra/cipher_extra.cc b/crypto/cipher_extra/cipher_extra.cc
+diff --git a/crypto/cipher_extra/cipher_extra.c b/crypto/cipher_extra/cipher_extra.c
 index 62850ab6a216d401d023f81007fb59a33b4585f3..95bd172c99874610ec9157c52df4fe0232e78c7f 100644
---- a/crypto/cipher_extra/cipher_extra.cc
-+++ b/crypto/cipher_extra/cipher_extra.cc
+--- a/crypto/cipher_extra/cipher_extra.c
++++ b/crypto/cipher_extra/cipher_extra.c
 @@ -73,6 +73,7 @@ static const struct {
    const EVP_CIPHER *(*func)(void);
  } kCiphers[] = {
@@ -63,10 +63,10 @@ index 62850ab6a216d401d023f81007fb59a33b4585f3..95bd172c99874610ec9157c52df4fe02
  };
  
  const EVP_CIPHER *EVP_get_cipherbynid(int nid) {
-diff --git a/decrepit/evp/evp_do_all.cc b/decrepit/evp/evp_do_all.cc
-index 9fd0e0225fa48b0afb90b525236e54cff17c1c84..dded715011ac8c1dd9e4525f0bdd64088f8007cf 100644
---- a/decrepit/evp/evp_do_all.cc
-+++ b/decrepit/evp/evp_do_all.cc
+diff --git a/decrepit/evp/evp_do_all.c b/decrepit/evp/evp_do_all.c
+index 852b76bea69988e0b3ac76a17b603128f239dde0..43fc792697519325725e9ce87801c5dc176c70a1 100644
+--- a/decrepit/evp/evp_do_all.c
++++ b/decrepit/evp/evp_do_all.c
 @@ -20,8 +20,10 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
                                                 const char *unused, void *arg),
                                void *arg) {

patches/boringssl/revert_track_ssl_error_zero_return_explicitly.patch

@@ -8,10 +8,10 @@ This reverts commit ebd8b8965c74ab06bb91f7a00b23822e1f1f26ca.
 It is causing significant TLS failures in Node.js.
 
 diff --git a/ssl/ssl_buffer.cc b/ssl/ssl_buffer.cc
-index 76c74e2941d9912ca93a69254f540a6a6ddd9e74..3baf5043800c8cbca73efa4d8a65a68e9ec0ecc4 100644
+index 7de8923518dbfb69fef62d7781f906b30cf62155..7a4310d6d8e85f07f0ae6c97726d909c4503bce9 100644
 --- a/ssl/ssl_buffer.cc
 +++ b/ssl/ssl_buffer.cc
-@@ -230,7 +230,6 @@ int ssl_handle_open_record(SSL *ssl, bool *out_retry, ssl_open_record_t ret,
+@@ -235,7 +235,6 @@ int ssl_handle_open_record(SSL *ssl, bool *out_retry, ssl_open_record_t ret,
        return 1;
  
      case ssl_open_record_close_notify:
@@ -20,10 +20,10 @@ index 76c74e2941d9912ca93a69254f540a6a6ddd9e74..3baf5043800c8cbca73efa4d8a65a68e
  
      case ssl_open_record_error:
 diff --git a/ssl/ssl_lib.cc b/ssl/ssl_lib.cc
-index 4ede3ad282b30b84df70a24ed9b89c516cddae4e..4d8fe9eb9a2138da994e54da6fa00ffa6a62a71d 100644
+index f52030b8cd97d24d805963fd86a9e2b0da15af48..59cb15d5daa22fb87aa9012e25732e90bf5778a4 100644
 --- a/ssl/ssl_lib.cc
 +++ b/ssl/ssl_lib.cc
-@@ -1323,7 +1323,7 @@ int SSL_get_error(const SSL *ssl, int ret_code) {
+@@ -1339,7 +1339,7 @@ int SSL_get_error(const SSL *ssl, int ret_code) {
    }
  
    if (ret_code == 0) {
@@ -32,7 +32,7 @@ index 4ede3ad282b30b84df70a24ed9b89c516cddae4e..4d8fe9eb9a2138da994e54da6fa00ffa
        return SSL_ERROR_ZERO_RETURN;
      }
      // An EOF was observed which violates the protocol, and the underlying
-@@ -2690,13 +2690,7 @@ void *SSL_CTX_get_ex_data(const SSL_CTX *ctx, int idx) {
+@@ -2711,13 +2711,7 @@ void *SSL_CTX_get_ex_data(const SSL_CTX *ctx, int idx) {
    return CRYPTO_get_ex_data(&ctx->ex_data, idx);
  }
  

patches/chromium/.patches

@@ -128,15 +128,17 @@ fix_font_face_resolution_when_renderer_is_blocked.patch
 feat_enable_passing_exit_code_on_service_process_crash.patch
 chore_remove_reference_to_chrome_browser_themes.patch
 feat_enable_customizing_symbol_color_in_framecaptionbutton.patch
-build_expose_webplugininfo_interface_to_electron.patch
+build_allow_electron_mojom_interfaces_to_depend_on_blink.patch
 osr_shared_texture_remove_keyed_mutex_on_win_dxgi.patch
 feat_allow_usage_of_sccontentsharingpicker_on_supported_platforms.patch
 chore_partial_revert_of.patch
 fix_software_compositing_infinite_loop.patch
-fix_add_method_which_disables_headless_mode_on_native_widget.patch
-fix_put_nsvisualeffectview_before_viewscompositorsuperview.patch
 refactor_unfilter_unresponsive_events.patch
-build_disable_thin_lto_mac.patch
-build_add_public_config_simdutf_config.patch
-revert_code_health_clean_up_stale_macwebcontentsocclusion.patch
-check_for_unit_to_activate_before_notifying_about_success.patch
+support_bstr_pkey_appusermodel_id_in_windows_shortcuts.patch
+cherry-pick-1282289030ab.patch
+cherry-pick-3dc17c461b12.patch
+ignore_parse_errors_for_pkey_appusermodel_toastactivatorclsid.patch
+feat_add_signals_when_embedder_cleanup_callbacks_run_for.patch
+feat_separate_content_settings_callback_for_sync_and_async_clipboard.patch
+cherry-pick-dd8e2822e507.patch
+fix_osr_stutter_in_both_cpu_and_gpu_capture_when_page_has_animation.patch

patches/chromium/accelerator.patch

@@ -10,7 +10,7 @@ This patch makes three changes to Accelerator::GetShortcutText to improve shortc
 3. Ctrl-Shift-= and Ctrl-Plus show up as such
 
 diff --git a/ui/base/accelerators/accelerator.cc b/ui/base/accelerators/accelerator.cc
-index 1f90103d1ddb04a24797cf1214c3d0c862d77e9f..67eec0d3526349448a56acf9724806aec06104df 100644
+index 3bcdf9fccf4c391e4239e87a83194f04e683a02c..c6b110eced004ae755a2dfc555b0ceb43bf574fa 100644
 --- a/ui/base/accelerators/accelerator.cc
 +++ b/ui/base/accelerators/accelerator.cc
 @@ -12,6 +12,7 @@
@@ -21,7 +21,7 @@ index 1f90103d1ddb04a24797cf1214c3d0c862d77e9f..67eec0d3526349448a56acf9724806ae
  #include "base/strings/utf_string_conversions.h"
  #include "base/types/cxx23_to_underlying.h"
  #include "build/build_config.h"
-@@ -109,6 +110,11 @@ std::u16string Accelerator::GetShortcutText() const {
+@@ -188,6 +189,11 @@ std::u16string Accelerator::GetShortcutText() const {
  #endif
  
    if (shortcut.empty()) {
@@ -33,7 +33,7 @@ index 1f90103d1ddb04a24797cf1214c3d0c862d77e9f..67eec0d3526349448a56acf9724806ae
  #if BUILDFLAG(IS_WIN)
      // Our fallback is to try translate the key code to a regular character
      // unless it is one of digits (VK_0 to VK_9). Some keyboard
-@@ -133,6 +139,10 @@ std::u16string Accelerator::GetShortcutText() const {
+@@ -212,6 +218,10 @@ std::u16string Accelerator::GetShortcutText() const {
        shortcut +=
            static_cast<std::u16string::value_type>(base::ToUpperASCII(c));
  #endif
@@ -44,7 +44,7 @@ index 1f90103d1ddb04a24797cf1214c3d0c862d77e9f..67eec0d3526349448a56acf9724806ae
    }
  
  #if BUILDFLAG(IS_MAC)
-@@ -317,7 +327,7 @@ std::u16string Accelerator::ApplyLongFormModifiers(
+@@ -396,7 +406,7 @@ std::u16string Accelerator::ApplyLongFormModifiers(
      const std::u16string& shortcut) const {
    std::u16string result = shortcut;
  
@@ -53,7 +53,7 @@ index 1f90103d1ddb04a24797cf1214c3d0c862d77e9f..67eec0d3526349448a56acf9724806ae
      result = ApplyModifierToAcceleratorString(result, IDS_APP_SHIFT_KEY);
  
    // Note that we use 'else-if' in order to avoid using Ctrl+Alt as a shortcut.
-@@ -325,7 +335,7 @@ std::u16string Accelerator::ApplyLongFormModifiers(
+@@ -404,7 +414,7 @@ std::u16string Accelerator::ApplyLongFormModifiers(
    // more information.
    if (IsCtrlDown())
      result = ApplyModifierToAcceleratorString(result, IDS_APP_CTRL_KEY);
@@ -63,18 +63,18 @@ index 1f90103d1ddb04a24797cf1214c3d0c862d77e9f..67eec0d3526349448a56acf9724806ae
  
    if (IsCmdDown()) {
 diff --git a/ui/base/accelerators/accelerator.h b/ui/base/accelerators/accelerator.h
-index 198c7469f410d3516b8a18493c5e4588d02487c2..e4995824ae2f3bb8045a3841a6213a4b315845a8 100644
+index 276f7ded0d6e60b65e461872e23b1f3380542037..94a60d9df75790c85ec93313dada260cdd65f947 100644
 --- a/ui/base/accelerators/accelerator.h
 +++ b/ui/base/accelerators/accelerator.h
-@@ -18,6 +18,7 @@
+@@ -16,6 +16,7 @@
  #include <utility>
  
  #include "base/component_export.h"
 +#include "third_party/abseil-cpp/absl/types/optional.h"
  #include "base/time/time.h"
- #include "build/blink_buildflags.h"
  #include "build/build_config.h"
-@@ -185,6 +186,8 @@ class COMPONENT_EXPORT(UI_BASE) Accelerator {
+ #include "ui/events/event_constants.h"
+@@ -132,6 +133,8 @@ class COMPONENT_EXPORT(UI_BASE) Accelerator {
      return interrupted_by_mouse_event_;
    }
  

patches/chromium/add_contentgpuclient_precreatemessageloop_callback.patch

@@ -10,10 +10,10 @@ Allows Electron to restore WER when ELECTRON_DEFAULT_ERROR_MODE is set.
 This should be upstreamed.
 
 diff --git a/content/gpu/gpu_main.cc b/content/gpu/gpu_main.cc
-index d4ba7601d9e92972b86aa0ca97c33ceb97cd5d10..531a031e69b1a70a9e2c22f8ee72d952abcea7fe 100644
+index 59ab3b746782c71f7d9401c13a7c866e6e7a823d..f95842da98d3a1d853633b53c745be9c394b25d5 100644
 --- a/content/gpu/gpu_main.cc
 +++ b/content/gpu/gpu_main.cc
-@@ -265,6 +265,10 @@ int GpuMain(MainFunctionParams parameters) {
+@@ -258,6 +258,10 @@ int GpuMain(MainFunctionParams parameters) {
    // to the GpuProcessHost once the GpuServiceImpl has started.
    viz::GpuServiceImpl::InstallPreInitializeLogHandler();
  
@@ -24,7 +24,7 @@ index d4ba7601d9e92972b86aa0ca97c33ceb97cd5d10..531a031e69b1a70a9e2c22f8ee72d952
    // We are experiencing what appear to be memory-stomp issues in the GPU
    // process. These issues seem to be impacting the task executor and listeners
    // registered to it. Create the task executor on the heap to guard against
-@@ -375,7 +379,6 @@ int GpuMain(MainFunctionParams parameters) {
+@@ -368,7 +372,6 @@ int GpuMain(MainFunctionParams parameters) {
  #endif
    const bool dead_on_arrival = !init_success;
  
@@ -33,10 +33,10 @@ index d4ba7601d9e92972b86aa0ca97c33ceb97cd5d10..531a031e69b1a70a9e2c22f8ee72d952
      client->PostSandboxInitialized();
    }
 diff --git a/content/public/gpu/content_gpu_client.h b/content/public/gpu/content_gpu_client.h
-index c89b010e7ac78e2a7246ee54fe302cd6b9299710..46fd522fb2ac2793a3a073a4f833a4425dcee941 100644
+index 351b97676ea1b928bedbb8a211d175684a166742..c54c452ef7a248982fa58dcd3b6b6f37bee4d13c 100644
 --- a/content/public/gpu/content_gpu_client.h
 +++ b/content/public/gpu/content_gpu_client.h
-@@ -32,6 +32,10 @@ class CONTENT_EXPORT ContentGpuClient {
+@@ -31,6 +31,10 @@ class CONTENT_EXPORT ContentGpuClient {
   public:
    virtual ~ContentGpuClient() {}
  

patches/chromium/add_didinstallconditionalfeatures.patch

@@ -10,10 +10,10 @@ DidCreateScriptContext is called, not all JS APIs are available in the
 context, which can cause some preload scripts to trip.
 
 diff --git a/content/public/renderer/render_frame_observer.h b/content/public/renderer/render_frame_observer.h
-index dbfaa28f2424f5b109816cfe951d734fc116a39f..d25cece2f5bef606307d44d4fc45eab051e651cc 100644
+index ad0092ef2e13853e4bb8b923481559a043b00ab7..1c2dfd23f18733e21312992877ae1499634d3849 100644
 --- a/content/public/renderer/render_frame_observer.h
 +++ b/content/public/renderer/render_frame_observer.h
-@@ -149,6 +149,8 @@ class CONTENT_EXPORT RenderFrameObserver
+@@ -150,6 +150,8 @@ class CONTENT_EXPORT RenderFrameObserver
    virtual void DidHandleOnloadEvents() {}
    virtual void DidCreateScriptContext(v8::Local<v8::Context> context,
                                        int32_t world_id) {}
@@ -23,10 +23,10 @@ index dbfaa28f2424f5b109816cfe951d734fc116a39f..d25cece2f5bef606307d44d4fc45eab0
                                          int32_t world_id) {}
    virtual void DidClearWindowObject() {}
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index 2f3190e81c665cdfbf75ffee9bf09c5936b4a760..2df3bedc57b27afd2d63a0c726f0479246228d33 100644
+index 6f932370352cb64a218ab93fa04f70a00947c228..df0a2685638b8f9b75f97ec96dd4c8706c013e7e 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -4794,6 +4794,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
+@@ -4792,6 +4792,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
      observer.DidCreateScriptContext(context, world_id);
  }
  
@@ -40,10 +40,10 @@ index 2f3190e81c665cdfbf75ffee9bf09c5936b4a760..2df3bedc57b27afd2d63a0c726f04792
                                                 int world_id) {
    for (auto& observer : observers_)
 diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
-index 1994dc767874809091f478efe298aa88e0de9bb7..a4c9ae4e92906aa114e25994951b50816ca78489 100644
+index 0980dad73ed2d5cbcbabee8f7d6fc827bb31b623..fcc651f75677ad1ae25e4edc5e2ae9a82ddd31d0 100644
 --- a/content/renderer/render_frame_impl.h
 +++ b/content/renderer/render_frame_impl.h
-@@ -650,6 +650,8 @@ class CONTENT_EXPORT RenderFrameImpl
+@@ -651,6 +651,8 @@ class CONTENT_EXPORT RenderFrameImpl
    void DidObserveLayoutShift(double score, bool after_input_or_scroll) override;
    void DidCreateScriptContext(v8::Local<v8::Context> context,
                                int world_id) override;
@@ -53,10 +53,10 @@ index 1994dc767874809091f478efe298aa88e0de9bb7..a4c9ae4e92906aa114e25994951b5081
                                  int world_id) override;
    void DidChangeScrollOffset() override;
 diff --git a/third_party/blink/public/web/web_local_frame_client.h b/third_party/blink/public/web/web_local_frame_client.h
-index 5ea679f5ff3fa5ec6d4937354cb1f52343a05e0d..f4de83e31fe2064adffdb837cd2b8376a545b8bc 100644
+index 403d654e9a5c1196ac11cccce45c8c53b03275f3..2e03b5f2fea36d9bdf71b4bb15c604de2dc3cf5c 100644
 --- a/third_party/blink/public/web/web_local_frame_client.h
 +++ b/third_party/blink/public/web/web_local_frame_client.h
-@@ -663,6 +663,9 @@ class BLINK_EXPORT WebLocalFrameClient {
+@@ -665,6 +665,9 @@ class BLINK_EXPORT WebLocalFrameClient {
    virtual void DidCreateScriptContext(v8::Local<v8::Context>,
                                        int32_t world_id) {}
  
@@ -79,10 +79,10 @@ index f7e0144c74f879e9b29871d7c372b99e127966bb..c3cd7b77ed282f212a56d151dc3fbec3
    if (World().IsMainWorld()) {
      probe::DidCreateMainWorldContext(GetFrame());
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client.h b/third_party/blink/renderer/core/frame/local_frame_client.h
-index c3fb21c5add440acc13ec673b132ccb0bedb5046..5f16a2f3a9583613e319b85f348ea40e4b75c65f 100644
+index d4fe8d76a94eeb27aed8f2261394edc0acdf5694..5af657a1f20949fb4df7b101aa27ed0cd29c89ca 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client.h
 +++ b/third_party/blink/renderer/core/frame/local_frame_client.h
-@@ -299,6 +299,8 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
+@@ -301,6 +301,8 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
  
    virtual void DidCreateScriptContext(v8::Local<v8::Context>,
                                        int32_t world_id) = 0;
@@ -92,7 +92,7 @@ index c3fb21c5add440acc13ec673b132ccb0bedb5046..5f16a2f3a9583613e319b85f348ea40e
                                          int32_t world_id) = 0;
    virtual bool AllowScriptExtensions() = 0;
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
-index 92d2e7e209cac354bec7088a2a64ade3aa88a679..d1d86aeb163134e59f9b2b3a9bd17bcc268fc6e3 100644
+index 0975fc371a20d21df2dd9d08986c665237d6d38f..63c365ed8dd65f6b15b3d887aa2d7f2f18111eb7 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
 @@ -294,6 +294,13 @@ void LocalFrameClientImpl::DidCreateScriptContext(
@@ -110,10 +110,10 @@ index 92d2e7e209cac354bec7088a2a64ade3aa88a679..d1d86aeb163134e59f9b2b3a9bd17bcc
      v8::Local<v8::Context> context,
      int32_t world_id) {
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client_impl.h b/third_party/blink/renderer/core/frame/local_frame_client_impl.h
-index 2a5537ffa0b5c547237d1d3f0a3dfb1f442a9ce2..d3bb5a4fd712f853da56e9dd2480d56dbf013536 100644
+index 526a61b4e9ecb3f0343dcafa6b17e7b24c8db830..5b16f232c651c428ebc150b427dedd73fcd25e2f 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client_impl.h
 +++ b/third_party/blink/renderer/core/frame/local_frame_client_impl.h
-@@ -81,6 +81,8 @@ class CORE_EXPORT LocalFrameClientImpl final : public LocalFrameClient {
+@@ -83,6 +83,8 @@ class CORE_EXPORT LocalFrameClientImpl final : public LocalFrameClient {
  
    void DidCreateScriptContext(v8::Local<v8::Context>,
                                int32_t world_id) override;
@@ -123,7 +123,7 @@ index 2a5537ffa0b5c547237d1d3f0a3dfb1f442a9ce2..d3bb5a4fd712f853da56e9dd2480d56d
                                  int32_t world_id) override;
  
 diff --git a/third_party/blink/renderer/core/loader/empty_clients.h b/third_party/blink/renderer/core/loader/empty_clients.h
-index c8a67a8b31d118282003caa6bf9dd5884e594542..076a68ac3ea04fd65a7580fe818bac1d0ae80b49 100644
+index fb56366d4d8cf46dee3403081be752f86d0713c8..4e5954fe78c3a240dba043b4746b706c1de981cd 100644
 --- a/third_party/blink/renderer/core/loader/empty_clients.h
 +++ b/third_party/blink/renderer/core/loader/empty_clients.h
 @@ -415,6 +415,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {

patches/chromium/add_electron_deps_to_license_credits_file.patch

@@ -7,7 +7,7 @@ Ensure that licenses for the dependencies introduced by Electron
 are included in `LICENSES.chromium.html`
 
 diff --git a/tools/licenses/licenses.py b/tools/licenses/licenses.py
-index a54e35161454fdf3d7dcb20ffcf05acbe394f315..5ff512afad6527b1c409c4f5b5d87a7af6dcd835 100755
+index 2a65975667a9fbedc0f9f108abb67dc6038eaf47..d6205d9fd0eea97d5ed85c2c4994d20c174379a7 100755
 --- a/tools/licenses/licenses.py
 +++ b/tools/licenses/licenses.py
 @@ -336,6 +336,31 @@ SPECIAL_CASES = {

patches/chromium/add_gin_converter_support_for_arraybufferview.patch

@@ -6,7 +6,7 @@ Subject: add gin::Converter support for ArrayBufferView
 This should be upstreamed.
 
 diff --git a/gin/converter.cc b/gin/converter.cc
-index 04bfeb77157ea168de6a382852e7163e0f8d9949..c4d0c2d332f2e09bfa411998abe4c172b135ca23 100644
+index 62209cadaec7314d2d4ec3e63e1bc88394afa4a9..b035bfe1fd16fb6ca8be33bf446ff8578d7cc2a0 100644
 --- a/gin/converter.cc
 +++ b/gin/converter.cc
 @@ -20,6 +20,7 @@
@@ -17,7 +17,7 @@ index 04bfeb77157ea168de6a382852e7163e0f8d9949..c4d0c2d332f2e09bfa411998abe4c172
  using v8::External;
  using v8::Function;
  using v8::Int32;
-@@ -244,6 +245,20 @@ bool Converter<Local<ArrayBuffer>>::FromV8(Isolate* isolate,
+@@ -246,6 +247,20 @@ bool Converter<Local<ArrayBuffer>>::FromV8(Isolate* isolate,
    return true;
  }
  

patches/chromium/adjust_accessibility_ui_for_electron.patch

@@ -10,10 +10,10 @@ usage of BrowserList and Browser as we subclass related methods and use our
 WindowList.
 
 diff --git a/chrome/browser/ui/webui/accessibility/accessibility_ui.cc b/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
-index 4693833f389b54d6c62efdbd8343df8c1f33795d..4bd07712e551162c8df1bad29137f8f27c8a7d7b 100644
+index 12fdd6a6d47b9e2778d9d136f016c942b9e1fc4e..3660d4685f888de1a0610a09fe70c74c8540a3f5 100644
 --- a/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
 +++ b/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
-@@ -43,6 +43,7 @@
+@@ -48,6 +48,7 @@
  #include "content/public/browser/web_contents.h"
  #include "content/public/browser/web_contents_delegate.h"
  #include "content/public/browser/web_ui_data_source.h"
@@ -21,8 +21,8 @@ index 4693833f389b54d6c62efdbd8343df8c1f33795d..4bd07712e551162c8df1bad29137f8f2
  #include "ui/accessibility/accessibility_features.h"
  #include "ui/accessibility/ax_updates_and_events.h"
  #include "ui/accessibility/platform/ax_platform_node.h"
-@@ -166,7 +167,7 @@ base::Value::Dict BuildTargetDescriptor(content::RenderViewHost* rvh) {
-                                rvh->GetRoutingID(), accessibility_mode);
+@@ -174,7 +175,7 @@ base::Value::Dict BuildTargetDescriptor(content::RenderViewHost* rvh) {
+                                accessibility_mode);
  }
  
 -#if !BUILDFLAG(IS_ANDROID)
@@ -30,7 +30,7 @@ index 4693833f389b54d6c62efdbd8343df8c1f33795d..4bd07712e551162c8df1bad29137f8f2
  base::Value::Dict BuildTargetDescriptor(Browser* browser) {
    base::Value::Dict target_data;
    target_data.Set(kSessionIdField, browser->session_id().id());
-@@ -187,7 +188,7 @@ void HandleAccessibilityRequestCallback(
+@@ -208,7 +209,7 @@ void HandleAccessibilityRequestCallback(
    DCHECK(ShouldHandleAccessibilityRequestCallback(path));
  
    base::Value::Dict data;
@@ -39,8 +39,8 @@ index 4693833f389b54d6c62efdbd8343df8c1f33795d..4bd07712e551162c8df1bad29137f8f2
    ui::AXMode mode =
        content::BrowserAccessibilityState::GetInstance()->GetAccessibilityMode();
    bool is_native_enabled = content::BrowserAccessibilityState::GetInstance()
-@@ -216,7 +217,7 @@ void HandleAccessibilityRequestCallback(
-   data.Set(kPDFPrinting, pdf_printing ? kOn : kOff);
+@@ -241,7 +242,7 @@ void HandleAccessibilityRequestCallback(
+   data.Set(kViewsAccessibility, features::IsAccessibilityTreeForViewsEnabled());
  
    std::string pref_api_type =
 -      pref->GetString(prefs::kShownAccessibilityApiType);
@@ -48,7 +48,7 @@ index 4693833f389b54d6c62efdbd8343df8c1f33795d..4bd07712e551162c8df1bad29137f8f2
    bool pref_api_type_supported = false;
  
    std::vector<ui::AXApiType::Type> supported_api_types =
-@@ -283,11 +284,11 @@ void HandleAccessibilityRequestCallback(
+@@ -308,11 +309,11 @@ void HandleAccessibilityRequestCallback(
    data.Set(kPagesField, std::move(page_list));
  
    base::Value::List browser_list;
@@ -61,8 +61,8 @@ index 4693833f389b54d6c62efdbd8343df8c1f33795d..4bd07712e551162c8df1bad29137f8f2
 +#endif
    data.Set(kBrowsersField, std::move(browser_list));
  
-   std::string json_string;
-@@ -606,7 +607,8 @@ void AccessibilityUIMessageHandler::SetGlobalString(
+   base::Value::List widgets_list;
+@@ -645,7 +646,8 @@ void AccessibilityUIMessageHandler::SetGlobalString(
    const std::string value = CheckJSValue(data.FindString(kValueField));
  
    if (string_name == kApiTypeField) {
@@ -72,7 +72,7 @@ index 4693833f389b54d6c62efdbd8343df8c1f33795d..4bd07712e551162c8df1bad29137f8f2
      pref->SetString(prefs::kShownAccessibilityApiType, value);
    }
  }
-@@ -659,7 +661,8 @@ void AccessibilityUIMessageHandler::RequestWebContentsTree(
+@@ -698,7 +700,8 @@ void AccessibilityUIMessageHandler::RequestWebContentsTree(
                       AXPropertyFilter::ALLOW_EMPTY);
    AddPropertyFilters(property_filters, deny, AXPropertyFilter::DENY);
  
@@ -82,7 +82,7 @@ index 4693833f389b54d6c62efdbd8343df8c1f33795d..4bd07712e551162c8df1bad29137f8f2
    ui::AXApiType::Type api_type =
        ui::AXApiType::From(pref->GetString(prefs::kShownAccessibilityApiType));
    std::string accessibility_contents =
-@@ -686,6 +689,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
+@@ -725,6 +728,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
                       AXPropertyFilter::ALLOW_EMPTY);
    AddPropertyFilters(property_filters, deny, AXPropertyFilter::DENY);
  
@@ -90,7 +90,7 @@ index 4693833f389b54d6c62efdbd8343df8c1f33795d..4bd07712e551162c8df1bad29137f8f2
    for (Browser* browser : *BrowserList::GetInstance()) {
      if (browser->session_id().id() == session_id) {
        base::Value::Dict result = BuildTargetDescriptor(browser);
-@@ -698,6 +702,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
+@@ -737,6 +741,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
        return;
      }
    }
@@ -98,7 +98,7 @@ index 4693833f389b54d6c62efdbd8343df8c1f33795d..4bd07712e551162c8df1bad29137f8f2
  #endif  // !BUILDFLAG(IS_ANDROID)
    // No browser with the specified |session_id| was found.
    base::Value::Dict result;
-@@ -741,11 +746,13 @@ void AccessibilityUIMessageHandler::StopRecording(
+@@ -805,11 +810,13 @@ void AccessibilityUIMessageHandler::StopRecording(
  }
  
  ui::AXApiType::Type AccessibilityUIMessageHandler::GetRecordingApiType() {
@@ -115,7 +115,7 @@ index 4693833f389b54d6c62efdbd8343df8c1f33795d..4bd07712e551162c8df1bad29137f8f2
    // Check to see if it is in the supported types list.
    if (std::find(supported_types.begin(), supported_types.end(), api_type) ==
        supported_types.end()) {
-@@ -815,8 +822,11 @@ void AccessibilityUIMessageHandler::RequestAccessibilityEvents(
+@@ -879,8 +886,11 @@ void AccessibilityUIMessageHandler::RequestAccessibilityEvents(
  // static
  void AccessibilityUIMessageHandler::RegisterProfilePrefs(
      user_prefs::PrefRegistrySyncable* registry) {

patches/chromium/allow_disabling_blink_scheduler_throttling_per_renderview.patch

@@ -6,7 +6,7 @@ Subject: allow disabling blink scheduler throttling per RenderView
 This allows us to disable throttling for hidden windows.
 
 diff --git a/content/browser/renderer_host/navigation_controller_impl_unittest.cc b/content/browser/renderer_host/navigation_controller_impl_unittest.cc
-index 63470e0c3d77a2aeeab80e25580b5ccc081cb2b9..e652131f10aa6c74ea9581fcc66a6ffae82d3d86 100644
+index e392efaf2e1ac3cfbef2d787ba40f0491b67f3cc..d45c7570484a7c1bfca25c860a1ddd2d6a9c741d 100644
 --- a/content/browser/renderer_host/navigation_controller_impl_unittest.cc
 +++ b/content/browser/renderer_host/navigation_controller_impl_unittest.cc
 @@ -163,6 +163,12 @@ class MockPageBroadcast : public blink::mojom::PageBroadcast {
@@ -23,7 +23,7 @@ index 63470e0c3d77a2aeeab80e25580b5ccc081cb2b9..e652131f10aa6c74ea9581fcc66a6ffa
      return receiver_.BindNewEndpointAndPassDedicatedRemote();
    }
 diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
-index 1dc919585dd11d70402f1a054f9f7c82a7a4e703..7807defd0ed367b2d4f815ea5df65777fd1d89ca 100644
+index 4675bec818108c5c28f582d3bcffac0b760ff266..c201a7e44ac992e38ed85456be9d69bfc0a843a3 100644
 --- a/content/browser/renderer_host/render_view_host_impl.cc
 +++ b/content/browser/renderer_host/render_view_host_impl.cc
 @@ -754,6 +754,11 @@ void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
@@ -51,10 +51,10 @@ index 5fb8a3dc69dc5fc5bfa08e01d8f03707a23c9274..41774b60b8cb7e0a22cedc597dc07ad1
    void SendRendererPreferencesToRenderer(
        const blink::RendererPreferences& preferences);
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
-index e65c2b9ed1d6d3cc53ee5ba145aa22cb149d9dde..50cac7b36d6e83dea6686636b5e7a2943c44ceac 100644
+index b8c1377d3144031f108bc79dc49d81a4ffbdb68d..1f9d5dde9099232ecb48557a28d545b2ec6f8f2e 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
-@@ -579,8 +579,8 @@ void RenderWidgetHostViewAura::ShowImpl(PageVisibilityState page_visibility) {
+@@ -586,8 +586,8 @@ void RenderWidgetHostViewAura::ShowImpl(PageVisibilityState page_visibility) {
    // OnShowWithPageVisibility will not call NotifyHostAndDelegateOnWasShown,
    // which updates `visibility_`, unless the host is hidden. Make sure no update
    // is needed.
@@ -116,10 +116,10 @@ index 083af135d890c2837e72c314e170e81931bd2a20..5245ea88441ef84c15b8052a9011ce70
    // Visibility -----------------------------------------------------------
  
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index 041ef7c3079f41a273300bcaeddd32342a5e94c4..aa786f1b88186bea18bccb2a99c9d393df7c684c 100644
+index ad134361e0b9c9a9db4cec06c429102d5dbe0c4e..82aef58c0a3c00c818e0d60df9a5296162c57cc3 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
-@@ -2468,6 +2468,10 @@ void WebViewImpl::SetPageLifecycleStateInternal(
+@@ -2456,6 +2456,10 @@ void WebViewImpl::SetPageLifecycleStateInternal(
    TRACE_EVENT2("navigation", "WebViewImpl::SetPageLifecycleStateInternal",
                 "old_state", old_state, "new_state", new_state);
  
@@ -130,7 +130,7 @@ index 041ef7c3079f41a273300bcaeddd32342a5e94c4..aa786f1b88186bea18bccb2a99c9d393
    bool storing_in_bfcache = new_state->is_in_back_forward_cache &&
                              !old_state->is_in_back_forward_cache;
    bool restoring_from_bfcache = !new_state->is_in_back_forward_cache &&
-@@ -3996,10 +4000,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
+@@ -3988,10 +3992,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
    return GetPage()->GetPageScheduler();
  }
  
@@ -155,7 +155,7 @@ index 041ef7c3079f41a273300bcaeddd32342a5e94c4..aa786f1b88186bea18bccb2a99c9d393
    // Do not throttle if the page should be painting.
    bool is_visible =
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.h b/third_party/blink/renderer/core/exported/web_view_impl.h
-index 4f77ef1379390973fa912640a33a5033dc8db68f..12d4932d82df824e459a8a90b6f24222172618df 100644
+index e4784453b357e2a9c18ccf5acfde43f5afd583ae..2c5a9f08ac34ae4106f25c42dca04f78ae703618 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.h
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.h
 @@ -448,6 +448,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,
@@ -166,7 +166,7 @@ index 4f77ef1379390973fa912640a33a5033dc8db68f..12d4932d82df824e459a8a90b6f24222
    void SetVisibilityState(mojom::blink::PageVisibilityState visibility_state,
                            bool is_initial_state) override;
    mojom::blink::PageVisibilityState GetVisibilityState() override;
-@@ -938,6 +939,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
+@@ -936,6 +937,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
    // If true, we send IPC messages when |preferred_size_| changes.
    bool send_preferred_size_changes_ = false;
  

patches/chromium/blink_local_frame.patch

@@ -15,10 +15,10 @@ Refs changes in:
 This patch reverts the changes to fix associated crashes in Electron.
 
 diff --git a/third_party/blink/renderer/core/frame/frame.cc b/third_party/blink/renderer/core/frame/frame.cc
-index e662d4d61595735a30d5c721147a95698d4da3d9..6a0388aad469422dd1c0c2164f8aa858c55cce70 100644
+index 2f33ec660a975522c473ecd50e633b5edaca707f..65221a51927d9f44bd6adbad88fa1144f2db3add 100644
 --- a/third_party/blink/renderer/core/frame/frame.cc
 +++ b/third_party/blink/renderer/core/frame/frame.cc
-@@ -134,14 +134,6 @@ bool Frame::Detach(FrameDetachType type) {
+@@ -135,14 +135,6 @@ bool Frame::Detach(FrameDetachType type) {
  
    DCHECK(!IsDetached());
  
@@ -33,7 +33,7 @@ index e662d4d61595735a30d5c721147a95698d4da3d9..6a0388aad469422dd1c0c2164f8aa858
    if (type == FrameDetachType::kRemove) {
      if (provisional_frame_) {
        provisional_frame_->Detach(FrameDetachType::kRemove);
-@@ -165,6 +157,14 @@ bool Frame::Detach(FrameDetachType type) {
+@@ -166,6 +158,14 @@ bool Frame::Detach(FrameDetachType type) {
      GetWindowProxyManager()->ClearForSwap();
    }
  
@@ -49,10 +49,10 @@ index e662d4d61595735a30d5c721147a95698d4da3d9..6a0388aad469422dd1c0c2164f8aa858
    // its owning reference back to our owning LocalFrame.
    client_->Detached(type);
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
-index 9dbccdb33f73d25416c6c94d59afe9c3261f4875..d43ee5ce7695a7c41cc4f8dc96e066422553b1dd 100644
+index 6a071e614bfd44fce79bf6db80d026f24eefdd7f..1daf1d65e2e6ac494790aa9201609c9ca9af6828 100644
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
-@@ -748,10 +748,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
+@@ -746,10 +746,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
    }
    DCHECK(!view_ || !view_->IsAttached());
  
@@ -63,7 +63,7 @@ index 9dbccdb33f73d25416c6c94d59afe9c3261f4875..d43ee5ce7695a7c41cc4f8dc96e06642
    if (!Client())
      return false;
  
-@@ -805,6 +801,11 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
+@@ -801,6 +797,11 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
    DCHECK(!view_->IsAttached());
    Client()->WillBeDetached();
  

patches/chromium/boringssl_build_gn.patch

@@ -6,7 +6,7 @@ Subject: boringssl BUILD.gn
 Build BoringSSL with some extra functions that nodejs needs.
 
 diff --git a/third_party/boringssl/BUILD.gn b/third_party/boringssl/BUILD.gn
-index 12b2fb63dd3ff8c3d29d915a7d0f84a9d26c6e0a..c9fd2c069473b1c21ca8610afb246337c412e0be 100644
+index 12b2fb63dd3ff8c3d29d915a7d0f84a9d26c6e0a..f7eb3fe3d0cf5198316dbde0ab95bbcc4e4d210b 100644
 --- a/third_party/boringssl/BUILD.gn
 +++ b/third_party/boringssl/BUILD.gn
 @@ -48,6 +48,21 @@ all_sources = bcm_internal_headers + bcm_sources + crypto_internal_headers +
@@ -16,15 +16,15 @@ index 12b2fb63dd3ff8c3d29d915a7d0f84a9d26c6e0a..c9fd2c069473b1c21ca8610afb246337
 +if (is_electron_build) {
 +  # Needed to build a nodejs-compatible boringssl.
 +  all_sources += [
-+    "decrepit/evp/evp_do_all.cc",
-+    "decrepit/xts/xts.cc",
++    "decrepit/evp/evp_do_all.c",
++    "decrepit/xts/xts.c",
 +  ]
 +
 +  all_sources += [
-+    "decrepit/blowfish/blowfish.cc",
-+    "decrepit/cfb/cfb.cc",
++    "decrepit/blowfish/blowfish.c",
++    "decrepit/cfb/cfb.c",
 +    "decrepit/ripemd/internal.h",
-+    "decrepit/ripemd/ripemd.cc",
++    "decrepit/ripemd/ripemd.c",
 +  ]
 +}
 +

patches/chromium/build_add_electron_tracing_category.patch

@@ -8,10 +8,10 @@ categories in use are known / declared.  This patch is required for us
 to introduce a new Electron category for Electron-specific tracing.
 
 diff --git a/base/trace_event/builtin_categories.h b/base/trace_event/builtin_categories.h
-index 0370dff555cc5bd12f5e2a1b000707aa0d4aae74..1ff235570cb61a3288ddc70802b29a63b2e39f64 100644
+index ef993705e4a3624d06e3a74255bbec5c73eb6dfb..d44cae760548fc4ae48ab9406d3ca02b9264f41e 100644
 --- a/base/trace_event/builtin_categories.h
 +++ b/base/trace_event/builtin_categories.h
-@@ -93,6 +93,7 @@
+@@ -88,6 +88,7 @@
    X("drm")                                                               \
    X("drmcursor")                                                         \
    X("dwrite")                                                            \

patches/chromium/build_add_public_config_simdutf_config.patch

@@ -1,31 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Charles Kerr <charles@charleskerr.com>
-Date: Mon, 9 Dec 2024 11:22:20 -0600
-Subject: build: add public config simdutf_config
-
-To avoid building two copies of simdutf, we have electron_node ignore
-third_party/electron_node/deps/simdutf and use
-third_party/simdutf instead.
-
-To accomplish this, we need to make simdutf's config public here
-for use by third_party/electron_node.
-
-diff --git a/third_party/simdutf/BUILD.gn b/third_party/simdutf/BUILD.gn
-index d88fe7e43ac2a8129702e58bd2cd2aea094452e3..3cbeb89587f37b0ebc3622258fea0161ebf1d7b2 100644
---- a/third_party/simdutf/BUILD.gn
-+++ b/third_party/simdutf/BUILD.gn
-@@ -6,9 +6,14 @@ source_set("header") {
-   sources = [ "simdutf.h" ]
- }
- 
-+config("simdutf_config") {
-+  include_dirs = [ "." ]
-+}
-+
- source_set("simdutf") {
-   sources = [ "simdutf.cpp" ]
-   public_deps = [ ":header" ]
-+  public_configs = [ ":simdutf_config" ]
-   cflags_cc = [
-     "-Wno-unused-const-variable",
-     "-Wno-unused-function",

patches/chromium/build_allow_electron_mojom_interfaces_to_depend_on_blink.patch

@@ -1,20 +1,24 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: deepak1556 <hop2deep@gmail.com>
 Date: Fri, 9 Aug 2024 22:39:47 +0900
-Subject: build: expose webplugininfo interface to electron
+Subject: build: allow electron mojom interfaces to depend on blink
+ mojom_platform
 
-Allows implementing electron::mojom::ElectronPluginInfoHost interface
-which provides plugin details between browser<->renderer.
+Needed for:
+
+1) //electron/shell/common:plugin
+2) //electron/shell/common:web_contents_utility
 
 diff --git a/content/public/common/BUILD.gn b/content/public/common/BUILD.gn
-index bfb8b8a712274e7326bbfd0f7c2c8e60106ea135..ce7abdc8dbf30f63694f5f576851a6d6259e3ec0 100644
+index b84e3a73036b0bc2b782d35c04359ba401521917..0099cf78779215bcc85ce3fb57cb34827337111e 100644
 --- a/content/public/common/BUILD.gn
 +++ b/content/public/common/BUILD.gn
-@@ -372,6 +372,7 @@ mojom("interfaces") {
+@@ -377,6 +377,8 @@ mojom("interfaces") {
      "//content/common/*",
      "//extensions/common:mojom",
      "//extensions/common:mojom_blink",
 +    "//electron/shell/common:plugin",
++    "//electron/shell/common:web_contents_utility",
    ]
  
    sources = [

patches/chromium/build_allow_electron_to_use_exec_script.patch

@@ -6,33 +6,15 @@ Subject: build: allow electron to use exec_script
 This is similar to the //build usecase so we're OK adding ourselves here
 
 diff --git a/.gn b/.gn
-index 44a11ec90ec9b67cf22b6d529c6843e6b6af12bc..7c706405eee1f11224e3b016670a6410ebfd853a 100644
+index 44a11ec90ec9b67cf22b6d529c6843e6b6af12bc..783dd77dcdf92ec32cc6594b739eab9738f3e3ba 100644
 --- a/.gn
 +++ b/.gn
-@@ -172,4 +172,26 @@ exec_script_whitelist =
+@@ -172,4 +172,8 @@ exec_script_whitelist =
  
        "//tools/grit/grit_rule.gni",
        "//tools/gritsettings/BUILD.gn",
 +
 +      "//electron/BUILD.gn",
-+      "//third_party/electron_node/deps/ada/unofficial.gni",
 +      "//third_party/electron_node/deps/base64/BUILD.gn",
 +      "//third_party/electron_node/deps/base64/unofficial.gni",
-+      "//third_party/electron_node/node.gni",
-+      "//third_party/electron_node/unofficial.gni",
-+      "//third_party/electron_node/deps/brotli/unofficial.gni",
-+      "//third_party/electron_node/deps/cares/unofficial.gni",
-+      "//third_party/electron_node/deps/googletest/unofficial.gni",
-+      "//third_party/electron_node/deps/histogram/unofficial.gni",
-+      "//third_party/electron_node/deps/llhttp/unofficial.gni",
-+      "//third_party/electron_node/deps/nbytes/unofficial.gni",
-+      "//third_party/electron_node/deps/ncrypto/unofficial.gni",
-+      "//third_party/electron_node/deps/nghttp2/unofficial.gni",
-+      "//third_party/electron_node/deps/ngtcp2/unofficial.gni",
-+      "//third_party/electron_node/deps/openssl/unofficial.gni",
-+      "//third_party/electron_node/deps/simdjson/unofficial.gni",
-+      "//third_party/electron_node/deps/sqlite/unofficial.gni",
-+      "//third_party/electron_node/deps/uv/unofficial.gni",
-+      "//third_party/electron_node/deps/uvwasi/unofficial.gni",
-+      "//third_party/electron_node/src/inspector/unofficial.gni",
      ]

patches/chromium/build_disable_thin_lto_mac.patch

@@ -1,25 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: VerteDinde <vertedinde@electronjs.org>
-Date: Tue, 12 Nov 2024 21:16:15 -0800
-Subject: build: disable thin_lto on mac
-
-This patch disables thin lto on mac only. After Node 22 was merged into
-main, release builds began failing due to missing symbols, which seem to
-be being stripped out by thin lto.
-
-This patch can (and should) be removed when we can prevent those symbols
-from being stripped in the release build.
-
-diff --git a/build/config/compiler/compiler.gni b/build/config/compiler/compiler.gni
-index 5b98b4aedab5b700d21d6a8eac11c81cc13f6b39..8ee6f54f67c300a52074f33f9d6fe08a68e3be4b 100644
---- a/build/config/compiler/compiler.gni
-+++ b/build/config/compiler/compiler.gni
-@@ -79,7 +79,7 @@ declare_args() {
-   # have the same LLVM revisions as us, making bitcode useless to them.
-   use_thin_lto =
-       is_cfi || (is_clang && is_official_build && chrome_pgo_phase != 1 &&
--                 (is_linux || is_win || is_mac ||
-+                 (is_linux || is_win ||
-                   (is_ios && use_lld && !is_cronet_build) ||
-                   (is_android && target_os != "chromeos") ||
-                   (is_chromeos && is_chromeos_device)))

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -11,7 +11,7 @@ if we ever align our .pak file generation with Chrome we can remove this
 patch.
 
 diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
-index 0a236366b3f5050fa5d07971404afa111e699ce8..fb0f867dcf846f64887abc11f1aec67ccb7c5145 100644
+index 9580623c57cb02f7e924742c6cb1638676881115..ad80d8e63dfebbbdb8eaa63bfe38a6f86df9afb6 100644
 --- a/chrome/BUILD.gn
 +++ b/chrome/BUILD.gn
 @@ -200,11 +200,16 @@ if (!is_android && !is_mac) {
@@ -33,11 +33,11 @@ index 0a236366b3f5050fa5d07971404afa111e699ce8..fb0f867dcf846f64887abc11f1aec67c
            "//base",
            "//build:branding_buildflags",
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index 9f35905480ebcbacc724b60a35fe6ecc5f55fa7d..250d9f581018b02ee0e5b1e9630ff292ca3c91c2 100644
+index c2c22a92bccb2487319affed384cac10dbc839a8..d3bccc91ebe651d3075325aaf9d0c5114e238b85 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -4527,7 +4527,7 @@ static_library("browser") {
-           [ "//chrome/browser/ui/webui/signin:profile_impl" ]
+@@ -4524,7 +4524,7 @@ static_library("browser") {
+       ]
      }
  
 -    if (!is_win) {
@@ -46,10 +46,10 @@ index 9f35905480ebcbacc724b60a35fe6ecc5f55fa7d..250d9f581018b02ee0e5b1e9630ff292
        # than here in :chrome_dll.
        deps += [ "//chrome:packed_resources_integrity_header" ]
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 44ac256b44bee638e91b8322d549eedebf762b5a..745f1cf8153d93876c3246b3f4e951cb6ae25098 100644
+index 7a945c6bac66f8f4c579ae3e2bae6f228c453d8f..48b7b801573cbcc977346a3f80c0c907dd619a06 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -6913,9 +6913,12 @@ test("unit_tests") {
+@@ -6818,9 +6818,12 @@ test("unit_tests") {
        "//chrome/notification_helper",
      ]
  
@@ -63,7 +63,7 @@ index 44ac256b44bee638e91b8322d549eedebf762b5a..745f1cf8153d93876c3246b3f4e951cb
        "//chrome//services/util_win:unit_tests",
        "//chrome/app:chrome_dll_resources",
        "//chrome/app:win_unit_tests",
-@@ -7855,6 +7858,10 @@ test("unit_tests") {
+@@ -7762,6 +7765,10 @@ test("unit_tests") {
        "../browser/performance_manager/policies/background_tab_loading_policy_unittest.cc",
      ]
  
@@ -74,7 +74,7 @@ index 44ac256b44bee638e91b8322d549eedebf762b5a..745f1cf8153d93876c3246b3f4e951cb
      sources += [
        # The importer code is not used on Android.
        "../common/importer/firefox_importer_utils_unittest.cc",
-@@ -7908,7 +7915,6 @@ test("unit_tests") {
+@@ -7814,7 +7821,6 @@ test("unit_tests") {
      # Non-android deps for "unit_tests" target.
      deps += [
        "../browser/screen_ai:screen_ai_install_state",

patches/chromium/build_gn.patch

@@ -7,7 +7,7 @@ These are variables we add to the root BUILDCONFIG so that they're available
 everywhere, without having to import("//electron/.../flags.gni").
 
 diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
-index 9164ee0578686c88fc76ea3c59a7d3e50d15147d..243ac3cc41b095c4a0932c9a48f2db38c941badc 100644
+index 8e0c3761f1634312dad5fe16a01653e5e80935f5..04038e0d1a0b4b5823a93762d93379bb9ab4adfc 100644
 --- a/build/config/BUILDCONFIG.gn
 +++ b/build/config/BUILDCONFIG.gn
 @@ -123,6 +123,9 @@ if (current_os == "") {

patches/chromium/build_libc_as_static_library.patch

@@ -7,10 +7,10 @@ Build libc++ as static library to compile and pass
 nan tests
 
 diff --git a/buildtools/third_party/libc++/BUILD.gn b/buildtools/third_party/libc++/BUILD.gn
-index 5c366d2dded04400a3d9c2cb9c31bdfd286e7246..90902df8843858cd8db547d38ee4f58f0dad722c 100644
+index 23afc35f9fe7caadf7ffbc4c87d044a0b0a5e6d1..36461703003c482e3183fe7864e574e1e2cc47c1 100644
 --- a/buildtools/third_party/libc++/BUILD.gn
 +++ b/buildtools/third_party/libc++/BUILD.gn
-@@ -48,7 +48,11 @@ config("winver") {
+@@ -45,7 +45,11 @@ config("winver") {
  if (libcxx_is_shared) {
    _libcxx_target_type = "shared_library"
  } else {
@@ -23,7 +23,7 @@ index 5c366d2dded04400a3d9c2cb9c31bdfd286e7246..90902df8843858cd8db547d38ee4f58f
  }
  target(_libcxx_target_type, "libc++") {
    # Most things that need to depend on libc++ should do so via the implicit
-@@ -56,6 +60,7 @@ target(_libcxx_target_type, "libc++") {
+@@ -53,6 +57,7 @@ target(_libcxx_target_type, "libc++") {
    # need to explicitly depend on libc++.
    visibility = [
      "//build/config:common_deps",

patches/chromium/build_make_libcxx_abi_unstable_false_for_electron.patch

@@ -6,15 +6,16 @@ Subject: build: make libcxx_abi_unstable false for electron
 https://nornagon.medium.com/a-libc-odyssey-973e51649063
 
 diff --git a/buildtools/third_party/libc++/__config_site b/buildtools/third_party/libc++/__config_site
-index 67075bd8b4d42e6e6d651cb0988d64eccb64cc23..e240ff6fff94a6cebf8662996712fe7eb22e5fff 100644
+index 6e4f7269e3db2f7de54f0cfe1fa31303c96f9796..9b207c8cfda3cd9b6c64d2042383312f8abb5619 100644
 --- a/buildtools/third_party/libc++/__config_site
 +++ b/buildtools/third_party/libc++/__config_site
-@@ -18,7 +18,7 @@
+@@ -18,7 +18,9 @@
  //    _LIBCPP_ABI_NAMESPACE to a shorter value.
  #define _LIBCPP_ABI_NAMESPACE __Cr
  
--#define _LIBCPP_ABI_VERSION 2
-+#define _LIBCPP_ABI_VERSION 1
++#if 0
+ #define _LIBCPP_ABI_VERSION 2
++#endif
  
- #define _LIBCPP_ABI_FORCE_ITANIUM 0
- #define _LIBCPP_ABI_FORCE_MICROSOFT 0
+ /* #undef _LIBCPP_ABI_FORCE_ITANIUM */
+ /* #undef _LIBCPP_ABI_FORCE_MICROSOFT */

patches/chromium/build_run_reclient_cfg_generator_after_chrome.patch

@@ -20,7 +20,7 @@ index 17103061c4752e6fcac07413dbf574e0c6fd6d39..848be71fa6dc81a64b7274b31d461f9d
  /win-cross/
  reproxy.cfg
 diff --git a/buildtools/reclient_cfgs/configure_reclient_cfgs.py b/buildtools/reclient_cfgs/configure_reclient_cfgs.py
-index 128bda296c91eac5f0c2fcfeed0c553deb5514dd..f1e33d36810dba80a42608655beb27c6e197a888 100755
+index e367bf89e2ebabe731dcf8714ea7a0fa3b15d50d..f5cf97c51b7cc1d07ca4effb04aa6d9a3ee52845 100755
 --- a/buildtools/reclient_cfgs/configure_reclient_cfgs.py
 +++ b/buildtools/reclient_cfgs/configure_reclient_cfgs.py
 @@ -344,4 +344,13 @@ def main():
@@ -40,12 +40,12 @@ index 128bda296c91eac5f0c2fcfeed0c553deb5514dd..f1e33d36810dba80a42608655beb27c6
 +    print('done')
 diff --git a/buildtools/reclient_cfgs/nacl/rewrapper_linux.cfg b/buildtools/reclient_cfgs/nacl/rewrapper_linux.cfg
 deleted file mode 100644
-index 0a0771da2d7ab44f13037c95f8b948cf9b8c663f..0000000000000000000000000000000000000000
+index f4690257587ee8a83111abc39039c3d552da0979..0000000000000000000000000000000000000000
 --- a/buildtools/reclient_cfgs/nacl/rewrapper_linux.cfg
 +++ /dev/null
 @@ -1,10 +0,0 @@
 -# use the same platform container image as build/config/siso/main.star
--platform=container-image=docker://gcr.io/chops-public-images-prod/rbe/siso-chromium/linux@sha256:ef35d347f4a4a2d32b76fd908e66e96f59bf8ba7379fd5626548244c45343b2b,label:action_default=1
+-platform=container-image=docker://gcr.io/chops-public-images-prod/rbe/siso-chromium/linux@sha256:912808c295e578ccde53b0685bcd0d56c15d7a03e819dcce70694bfe3fdab35e,label:action_default=1
 -server_address=unix:///tmp/reproxy.sock
 -labels=type=compile,compiler=nacl,lang=cpp
 -exec_strategy=racing

patches/chromium/can_create_window.patch

@@ -9,10 +9,10 @@ potentially prevent a window from being created.
 TODO(loc): this patch is currently broken.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index ea77770f7412bc4507897d6edf423966b2111eb4..88396edf058aaf6f18ae8cf09cb7175de5ae8d1c 100644
+index 469e49a552a2229e8686953d5b10b5d1ac974d4e..01367204ab9d872077547c2b2c33c58d9a1653b9 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -9244,6 +9244,7 @@ void RenderFrameHostImpl::CreateNewWindow(
+@@ -9188,6 +9188,7 @@ void RenderFrameHostImpl::CreateNewWindow(
            last_committed_origin_, params->window_container_type,
            params->target_url, params->referrer.To<Referrer>(),
            params->frame_name, params->disposition, *params->features,
@@ -21,10 +21,10 @@ index ea77770f7412bc4507897d6edf423966b2111eb4..88396edf058aaf6f18ae8cf09cb7175d
            &no_javascript_access);
  
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index e131c77f42a7f5183319ff41ec57118981fe76f7..9175a4958c80451dc80205d10856cac40785140e 100644
+index 62420958702cebe16423f0ea42ca200f5a93d45a..d35ae086793a52ea38da97b9236e073b806a67a6 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -4947,6 +4947,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -4895,6 +4895,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    SetPartitionedPopinOpenerOnNewWindowIfNeeded(new_contents_impl, params,
                                                 opener);
  
@@ -37,7 +37,7 @@ index e131c77f42a7f5183319ff41ec57118981fe76f7..9175a4958c80451dc80205d10856cac4
    // If the new frame has a name, make sure any SiteInstances that can find
    // this named frame have proxies for it.  Must be called after
    // SetSessionStorageNamespace, since this calls CreateRenderView, which uses
-@@ -4988,12 +4994,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -4936,12 +4942,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
      AddWebContentsDestructionObserver(new_contents_impl);
    }
  
@@ -51,10 +51,10 @@ index e131c77f42a7f5183319ff41ec57118981fe76f7..9175a4958c80451dc80205d10856cac4
                               new_contents_impl, opener, params.target_url,
                               params.referrer.To<Referrer>(), params.disposition,
 diff --git a/content/common/frame.mojom b/content/common/frame.mojom
-index 91dcf6c9c4a2d840fb50cb329fe3ef1bba9103c3..cbc887a3034605a93468e73a310e9ca6838b32d8 100644
+index 8e571dc1371cf2aa7c8354f0b4e492e0d030b485..c878169e7838849cbc23df2ed94ca65da4518f7f 100644
 --- a/content/common/frame.mojom
 +++ b/content/common/frame.mojom
-@@ -621,6 +621,10 @@ struct CreateNewWindowParams {
+@@ -617,6 +617,10 @@ struct CreateNewWindowParams {
    // The navigation initiator's user activation and ad status.
    blink.mojom.NavigationInitiatorActivationAndAdStatus
        initiator_activation_and_ad_status;
@@ -66,10 +66,10 @@ index 91dcf6c9c4a2d840fb50cb329fe3ef1bba9103c3..cbc887a3034605a93468e73a310e9ca6
  
  // Operation result when the renderer asks the browser to create a new window.
 diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
-index a344bce909add234e5757ddd08d2fafa5e732a42..de3b79ada34d261ab452efd1934bb3ea4fb74c03 100644
+index a1b6aad3587e7e2d4c24e76aa832e95b31b7ed86..826a2038ebe187a473ac8eabdedf977604ec8337 100644
 --- a/content/public/browser/content_browser_client.cc
 +++ b/content/public/browser/content_browser_client.cc
-@@ -790,6 +790,8 @@ bool ContentBrowserClient::CanCreateWindow(
+@@ -785,6 +785,8 @@ bool ContentBrowserClient::CanCreateWindow(
      const std::string& frame_name,
      WindowOpenDisposition disposition,
      const blink::mojom::WindowFeatures& features,
@@ -79,10 +79,10 @@ index a344bce909add234e5757ddd08d2fafa5e732a42..de3b79ada34d261ab452efd1934bb3ea
      bool opener_suppressed,
      bool* no_javascript_access) {
 diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
-index f3cf5f2d45503b683488c3b39708057749fccdfd..87388bf398413d963a4902bfbd43e6509982fb33 100644
+index 4d96255c40a8eac7804016383da32fd954f91430..187e5f078084436b2ff296f1cbacd009d738c635 100644
 --- a/content/public/browser/content_browser_client.h
 +++ b/content/public/browser/content_browser_client.h
-@@ -201,6 +201,7 @@ class NetworkService;
+@@ -195,6 +195,7 @@ class NetworkService;
  class TrustedURLLoaderHeaderClient;
  }  // namespace mojom
  struct ResourceRequest;
@@ -90,7 +90,7 @@ index f3cf5f2d45503b683488c3b39708057749fccdfd..87388bf398413d963a4902bfbd43e650
  }  // namespace network
  
  namespace sandbox {
-@@ -1347,6 +1348,8 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1348,6 +1349,8 @@ class CONTENT_EXPORT ContentBrowserClient {
        const std::string& frame_name,
        WindowOpenDisposition disposition,
        const blink::mojom::WindowFeatures& features,
@@ -100,7 +100,7 @@ index f3cf5f2d45503b683488c3b39708057749fccdfd..87388bf398413d963a4902bfbd43e650
        bool opener_suppressed,
        bool* no_javascript_access);
 diff --git a/content/public/browser/web_contents_delegate.cc b/content/public/browser/web_contents_delegate.cc
-index 2f27fcb0b320d1dcfeb398d34770a9a48ea49915..4d2c03d7102d1217d1b436bf17fa9f293239b049 100644
+index d4546ddda4a14cd5a826a13d4c8132a7fb8b5a7c..d5a7a639089ad37cb611c2ae253675b119ac357b 100644
 --- a/content/public/browser/web_contents_delegate.cc
 +++ b/content/public/browser/web_contents_delegate.cc
 @@ -31,6 +31,17 @@ namespace content {
@@ -122,7 +122,7 @@ index 2f27fcb0b320d1dcfeb398d34770a9a48ea49915..4d2c03d7102d1217d1b436bf17fa9f29
      WebContents* source,
      const OpenURLParams& params,
 diff --git a/content/public/browser/web_contents_delegate.h b/content/public/browser/web_contents_delegate.h
-index 0bab4dd08a28dd572c9cac00c337672af6aee352..d17b95b6b0c9842b6db3d4696525984fbbcc8ddd 100644
+index 77ee6ba6c65c95622e41f86906ea813be62f72e9..7f38098505afabe1887a6d98a705f1adce201314 100644
 --- a/content/public/browser/web_contents_delegate.h
 +++ b/content/public/browser/web_contents_delegate.h
 @@ -18,6 +18,7 @@
@@ -133,7 +133,7 @@ index 0bab4dd08a28dd572c9cac00c337672af6aee352..d17b95b6b0c9842b6db3d4696525984f
  #include "content/public/browser/back_forward_transition_animation_manager.h"
  #include "content/public/browser/eye_dropper.h"
  #include "content/public/browser/fullscreen_types.h"
-@@ -366,6 +367,13 @@ class CONTENT_EXPORT WebContentsDelegate {
+@@ -368,6 +369,13 @@ class CONTENT_EXPORT WebContentsDelegate {
        const StoragePartitionConfig& partition_config,
        SessionStorageNamespace* session_storage_namespace);
  
@@ -148,25 +148,25 @@ index 0bab4dd08a28dd572c9cac00c337672af6aee352..d17b95b6b0c9842b6db3d4696525984f
    // typically happens when popups are created.
    virtual void WebContentsCreated(WebContents* source_contents,
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index 7431b6773d9f0a38f30c00fbff2fa45076beedc9..2f3190e81c665cdfbf75ffee9bf09c5936b4a760 100644
+index a0e45dfcf20ed570f2751a8f194b4a82b46c87b6..6f932370352cb64a218ab93fa04f70a00947c228 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -6863,6 +6863,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
+@@ -6865,6 +6865,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
            request.HasUserGesture(), GetWebFrame()->IsAdFrame(),
            GetWebFrame()->IsAdScriptInStack());
  
 +  params->raw_features = features.raw_features.Utf8(
-+      WTF::Utf8ConversionMode::kStrictReplacingErrors);
++      WTF::UTF8ConversionMode::kStrictUTF8ConversionReplacingUnpairedSurrogatesWithFFFD);
 +  params->body = GetRequestBodyForWebURLRequest(request);
 +
    // We preserve this information before sending the message since |params| is
    // moved on send.
    bool is_background_tab =
 diff --git a/content/web_test/browser/web_test_content_browser_client.cc b/content/web_test/browser/web_test_content_browser_client.cc
-index 5d4101558a3672b747f8f62d4ffaa84416df06a7..204664c08f14bcaf45e287a18fad4aea24a7fa72 100644
+index 4623ebf4ff47e9ec7549659e52c0c5ad7b3ef0ff..83db551286749d8dbf794aa750611e250774e4ff 100644
 --- a/content/web_test/browser/web_test_content_browser_client.cc
 +++ b/content/web_test/browser/web_test_content_browser_client.cc
-@@ -523,6 +523,8 @@ bool WebTestContentBrowserClient::CanCreateWindow(
+@@ -521,6 +521,8 @@ bool WebTestContentBrowserClient::CanCreateWindow(
      const std::string& frame_name,
      WindowOpenDisposition disposition,
      const blink::mojom::WindowFeatures& features,
@@ -176,7 +176,7 @@ index 5d4101558a3672b747f8f62d4ffaa84416df06a7..204664c08f14bcaf45e287a18fad4aea
      bool opener_suppressed,
      bool* no_javascript_access) {
 diff --git a/content/web_test/browser/web_test_content_browser_client.h b/content/web_test/browser/web_test_content_browser_client.h
-index 3a6f32f6412b914d24632a1c25d401de7a8ffbf0..0442c6243dbb38b2723e5e803bb403a157df3bcd 100644
+index 3c8c4a24af84a6c037ce93b10c8f77827cc64440..9389650aac41a76c77cb4924a6a53f0920a4dc65 100644
 --- a/content/web_test/browser/web_test_content_browser_client.h
 +++ b/content/web_test/browser/web_test_content_browser_client.h
 @@ -92,6 +92,8 @@ class WebTestContentBrowserClient : public ShellContentBrowserClient {
@@ -210,10 +210,10 @@ index c576ace24e81cc877aa2595d40e0a13a7af9f6a2..210fb97d44c19c29af424cc7b9cb3169
  
  }  // namespace blink
 diff --git a/third_party/blink/renderer/core/frame/local_dom_window.cc b/third_party/blink/renderer/core/frame/local_dom_window.cc
-index 3287ea39797ceca64947f9d69f6bcb6dcb8de56e..f7b31e1cfd29c2c5385b33024448d46ac8d79bd3 100644
+index ba53e2576ff7944071fd46c2d4d8635084738cb3..fb38a3b96cd32720096b106845f706d113f1794e 100644
 --- a/third_party/blink/renderer/core/frame/local_dom_window.cc
 +++ b/third_party/blink/renderer/core/frame/local_dom_window.cc
-@@ -2226,6 +2226,8 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
+@@ -2235,6 +2235,8 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
    WebWindowFeatures window_features =
        GetWindowFeaturesFromString(features, entered_window);
  

patches/chromium/check_for_unit_to_activate_before_notifying_about_success.patch

@@ -1,497 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Maksim Sisov <msisov@igalia.com>
-Date: Tue, 7 Jan 2025 23:46:56 -0800
-Subject: Check for unit to activate before notifying about success
-
-Portal's globalShortcuts interface relies on the unit name to
-properly assign a client for the bound commands. However, in
-some scenarious, there is a race between the service to be
-created, changed its name and activated. As a result, shortcuts
-might be bound before the name is changed. As a result, shortcuts
-might not correctly work and the client will not receive any
-signals.
-
-This is mostly not an issue for Chromium as it creates the
-global shortcuts portal linux object way earlier than it gets
-commands from the command service. But downstream project, which
-try to bind shortcuts at the same time as that instance is created,
-may experience this issue. As a result, they might not have
-shortcuts working correctly after system reboot or app restart as
-there is a race between those operations.
-
-Bug: None
-Change-Id: I8346d65e051d9587850c76ca0b8807669c161667
-Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6110782
-Reviewed-by: Thomas Anderson <thomasanderson@chromium.org>
-Commit-Queue: Maksim Sisov <msisov@igalia.com>
-Cr-Commit-Position: refs/heads/main@{#1403434}
-
-diff --git a/components/dbus/xdg/systemd.cc b/components/dbus/xdg/systemd.cc
-index 362a16447bf578923cb8a84674c277ae6c98228f..3cd9a55d540c07a4c53f5a62bec5cbea37c11838 100644
---- a/components/dbus/xdg/systemd.cc
-+++ b/components/dbus/xdg/systemd.cc
-@@ -4,9 +4,12 @@
- 
- #include "components/dbus/xdg/systemd.h"
- 
-+#include <string>
- #include <vector>
- 
- #include "base/environment.h"
-+#include "base/functional/bind.h"
-+#include "base/functional/callback_helpers.h"
- #include "base/memory/scoped_refptr.h"
- #include "base/no_destructor.h"
- #include "base/sequence_checker.h"
-@@ -17,7 +20,9 @@
- #include "components/dbus/utils/name_has_owner.h"
- #include "dbus/bus.h"
- #include "dbus/message.h"
-+#include "dbus/object_path.h"
- #include "dbus/object_proxy.h"
-+#include "dbus/property.h"
- #include "third_party/abseil-cpp/absl/types/variant.h"
- 
- namespace dbus_xdg {
-@@ -37,6 +42,10 @@ constexpr char kServiceNameSystemd[] = "org.freedesktop.systemd1";
- constexpr char kObjectPathSystemd[] = "/org/freedesktop/systemd1";
- constexpr char kInterfaceSystemdManager[] = "org.freedesktop.systemd1.Manager";
- constexpr char kMethodStartTransientUnit[] = "StartTransientUnit";
-+constexpr char kMethodGetUnit[] = "GetUnit";
-+
-+constexpr char kInterfaceSystemdUnit[] = "org.freedesktop.systemd1.Unit";
-+constexpr char kActiveStateProp[] = "ActiveState";
- 
- constexpr char kUnitNameFormat[] = "app-$1$2-$3.scope";
- 
-@@ -67,6 +76,81 @@ const char* GetAppNameSuffix(const std::string& channel) {
-   return "";
- }
- 
-+// Declare this helper for SystemdUnitActiveStateWatcher to be used.
-+void SetStateAndRunCallbacks(SystemdUnitStatus result);
-+
-+// Watches the object to become active and fires callbacks via
-+// SetStateAndRunCallbacks. The callbacks are fired whenever a response with the
-+// state being "active" or "failed" (or similar) comes.
-+//
-+// PS firing callbacks results in destroying this object. So any references
-+// to this become invalid.
-+class SystemdUnitActiveStateWatcher : public dbus::PropertySet {
-+ public:
-+  SystemdUnitActiveStateWatcher(scoped_refptr<dbus::Bus> bus,
-+                                dbus::ObjectProxy* object_proxy)
-+      : dbus::PropertySet(object_proxy,
-+                          kInterfaceSystemdUnit,
-+                          base::BindRepeating(
-+                              &SystemdUnitActiveStateWatcher::OnPropertyChanged,
-+                              base::Unretained(this))),
-+        bus_(bus) {
-+    RegisterProperty(kActiveStateProp, &active_state_);
-+    ConnectSignals();
-+    GetAll();
-+  }
-+
-+  ~SystemdUnitActiveStateWatcher() override {
-+    bus_->RemoveObjectProxy(kServiceNameSystemd, object_proxy()->object_path(),
-+                            base::DoNothing());
-+  }
-+
-+ private:
-+  void OnPropertyChanged(const std::string& property_name) {
-+    DCHECK(active_state_.is_valid());
-+    const std::string state_value = active_state_.value();
-+    if (callbacks_called_ || state_value == "activating" ||
-+        state_value == "reloading") {
-+      // Ignore if callbacks have already been fired or continue waiting until
-+      // the state changes to something else.
-+      return;
-+    }
-+
-+    // There are other states as failed, inactive, and deactivating. Treat all
-+    // of them as failed.
-+    callbacks_called_ = true;
-+    SetStateAndRunCallbacks(state_value == "active"
-+                                ? SystemdUnitStatus::kUnitStarted
-+                                : SystemdUnitStatus::kFailedToStart);
-+    MaybeDeleteSelf();
-+  }
-+
-+  void OnGetAll(dbus::Response* response) override {
-+    dbus::PropertySet::OnGetAll(response);
-+    keep_alive_ = false;
-+    MaybeDeleteSelf();
-+  }
-+
-+  void MaybeDeleteSelf() {
-+    if (!keep_alive_ && callbacks_called_) {
-+      delete this;
-+    }
-+  }
-+
-+  // Registered property that this listens updates to.
-+  dbus::Property<std::string> active_state_;
-+
-+  // Indicates whether callbacks for the unit's state have been called.
-+  bool callbacks_called_ = false;
-+
-+  // Control variable that helps to defer the destruction of |this| as deleting
-+  // self when the state changes to active during |OnGetAll| will result in a
-+  // segfault.
-+  bool keep_alive_ = true;
-+
-+  scoped_refptr<dbus::Bus> bus_;
-+};
-+
- // Global state for cached result or pending callbacks.
- StatusOrCallbacks& GetUnitNameState() {
-   static base::NoDestructor<StatusOrCallbacks> state(
-@@ -83,10 +167,52 @@ void SetStateAndRunCallbacks(SystemdUnitStatus result) {
-   }
- }
- 
--void OnStartTransientUnitResponse(dbus::Response* response) {
-+void OnGetPathResponse(scoped_refptr<dbus::Bus> bus, dbus::Response* response) {
-+  dbus::MessageReader reader(response);
-+  dbus::ObjectPath obj_path;
-+  if (!response || !reader.PopObjectPath(&obj_path) || !obj_path.IsValid()) {
-+    // We didn't get a valid response. Treat this as failed service.
-+    SetStateAndRunCallbacks(SystemdUnitStatus::kFailedToStart);
-+    return;
-+  }
-+
-+  dbus::ObjectProxy* unit_proxy =
-+      bus->GetObjectProxy(kServiceNameSystemd, obj_path);
-+  // Create the active state property watcher. It will destroy itself once
-+  // it gets notified about the state change.
-+  std::unique_ptr<SystemdUnitActiveStateWatcher> active_state_watcher =
-+      std::make_unique<SystemdUnitActiveStateWatcher>(bus, unit_proxy);
-+  active_state_watcher.release();
-+}
-+
-+void WaitUnitActivateAndRunCallbacks(scoped_refptr<dbus::Bus> bus,
-+                                     std::string unit_name) {
-+  // Get the path of the unit, which looks similar to
-+  // /org/freedesktop/systemd1/unit/app_2dorg_2echromium_2eChromium_2d3182191_2escope
-+  // and then wait for it activation.
-+  dbus::ObjectProxy* systemd = bus->GetObjectProxy(
-+      kServiceNameSystemd, dbus::ObjectPath(kObjectPathSystemd));
-+
-+  dbus::MethodCall method_call(kInterfaceSystemdManager, kMethodGetUnit);
-+  dbus::MessageWriter writer(&method_call);
-+  writer.AppendString(unit_name);
-+
-+  systemd->CallMethod(&method_call, dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
-+                      base::BindOnce(&OnGetPathResponse, std::move(bus)));
-+}
-+
-+void OnStartTransientUnitResponse(scoped_refptr<dbus::Bus> bus,
-+                                  std::string unit_name,
-+                                  dbus::Response* response) {
-   SystemdUnitStatus result = response ? SystemdUnitStatus::kUnitStarted
-                                       : SystemdUnitStatus::kFailedToStart;
--  SetStateAndRunCallbacks(result);
-+  // If the start of the unit failed, immediately notify the client. Otherwise,
-+  // wait for its activation.
-+  if (result == SystemdUnitStatus::kFailedToStart) {
-+    SetStateAndRunCallbacks(result);
-+  } else {
-+    WaitUnitActivateAndRunCallbacks(std::move(bus), unit_name);
-+  }
- }
- 
- void OnNameHasOwnerResponse(scoped_refptr<dbus::Bus> bus,
-@@ -128,8 +254,9 @@ void OnNameHasOwnerResponse(scoped_refptr<dbus::Bus> bus,
-   properties.Write(&writer);
-   // No auxiliary units.
-   Dict<VarDict>().Write(&writer);
--  systemd->CallMethod(&method_call, dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
--                      base::BindOnce(&OnStartTransientUnitResponse));
-+  systemd->CallMethod(
-+      &method_call, dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
-+      base::BindOnce(&OnStartTransientUnitResponse, std::move(bus), unit_name));
- }
- 
- }  // namespace
-diff --git a/components/dbus/xdg/systemd_unittest.cc b/components/dbus/xdg/systemd_unittest.cc
-index 2e3baecabc4b479000c78d4f6bd30cb1f6e61d2e..67278d7033664d52fbbda02749a2aaa43352f402 100644
---- a/components/dbus/xdg/systemd_unittest.cc
-+++ b/components/dbus/xdg/systemd_unittest.cc
-@@ -16,7 +16,9 @@
- #include "dbus/message.h"
- #include "dbus/mock_bus.h"
- #include "dbus/mock_object_proxy.h"
-+#include "dbus/object_path.h"
- #include "dbus/object_proxy.h"
-+#include "dbus/property.h"
- #include "testing/gmock/include/gmock/gmock.h"
- #include "testing/gtest/include/gtest/gtest.h"
- 
-@@ -32,6 +34,27 @@ constexpr char kServiceNameSystemd[] = "org.freedesktop.systemd1";
- constexpr char kObjectPathSystemd[] = "/org/freedesktop/systemd1";
- constexpr char kInterfaceSystemdManager[] = "org.freedesktop.systemd1.Manager";
- constexpr char kMethodStartTransientUnit[] = "StartTransientUnit";
-+constexpr char kMethodGetUnit[] = "GetUnit";
-+
-+constexpr char kFakeUnitPath[] = "/fake/unit/path";
-+constexpr char kActiveState[] = "ActiveState";
-+constexpr char kStateActive[] = "active";
-+constexpr char kStateInactive[] = "inactive";
-+
-+std::unique_ptr<dbus::Response> CreateActiveStateGetAllResponse(
-+    const std::string& state) {
-+  auto response = dbus::Response::CreateEmpty();
-+  dbus::MessageWriter writer(response.get());
-+  dbus::MessageWriter array_writer(nullptr);
-+  dbus::MessageWriter dict_entry_writer(nullptr);
-+  writer.OpenArray("{sv}", &array_writer);
-+  array_writer.OpenDictEntry(&dict_entry_writer);
-+  dict_entry_writer.AppendString(kActiveState);
-+  dict_entry_writer.AppendVariantOfString(state);
-+  array_writer.CloseContainer(&dict_entry_writer);
-+  writer.CloseContainer(&array_writer);
-+  return response;
-+}
- 
- class SetSystemdScopeUnitNameForXdgPortalTest : public ::testing::Test {
-  public:
-@@ -124,17 +147,48 @@ TEST_F(SetSystemdScopeUnitNameForXdgPortalTest, StartTransientUnitSuccess) {
- 
-   EXPECT_CALL(*bus, GetObjectProxy(kServiceNameSystemd,
-                                    dbus::ObjectPath(kObjectPathSystemd)))
--      .WillOnce(Return(mock_systemd_proxy.get()));
-+      .Times(2)
-+      .WillRepeatedly(Return(mock_systemd_proxy.get()));
-+
-+  auto mock_dbus_unit_proxy = base::MakeRefCounted<dbus::MockObjectProxy>(
-+      bus.get(), kServiceNameSystemd, dbus::ObjectPath(kFakeUnitPath));
-+  EXPECT_CALL(*bus, GetObjectProxy(kServiceNameSystemd,
-+                                   dbus::ObjectPath(kFakeUnitPath)))
-+      .WillOnce(Return(mock_dbus_unit_proxy.get()));
- 
-   EXPECT_CALL(*mock_systemd_proxy, DoCallMethod(_, _, _))
-       .WillOnce(Invoke([](dbus::MethodCall* method_call, int timeout_ms,
-                           dbus::ObjectProxy::ResponseCallback* callback) {
-+        // Expect kMethodStartTransientUnit first.
-         EXPECT_EQ(method_call->GetInterface(), kInterfaceSystemdManager);
-         EXPECT_EQ(method_call->GetMember(), kMethodStartTransientUnit);
- 
-         // Simulate a successful response
-         auto response = dbus::Response::CreateEmpty();
-         std::move(*callback).Run(response.get());
-+      }))
-+      .WillOnce(Invoke([obj_path = kFakeUnitPath](
-+                           dbus::MethodCall* method_call, int timeout_ms,
-+                           dbus::ObjectProxy::ResponseCallback* callback) {
-+        // Then expect kMethodGetUnit. A valid path must be provided.
-+        EXPECT_EQ(method_call->GetInterface(), kInterfaceSystemdManager);
-+        EXPECT_EQ(method_call->GetMember(), kMethodGetUnit);
-+
-+        // Simulate a successful response and provide a fake path to the object.
-+        auto response = dbus::Response::CreateEmpty();
-+        dbus::MessageWriter writer(response.get());
-+        writer.AppendObjectPath(dbus::ObjectPath(obj_path));
-+        std::move(*callback).Run(response.get());
-+      }));
-+
-+  EXPECT_CALL(*mock_dbus_unit_proxy, DoCallMethod(_, _, _))
-+      .WillOnce(Invoke([](dbus::MethodCall* method_call, int timeout_ms,
-+                          dbus::ObjectProxy::ResponseCallback* callback) {
-+        EXPECT_EQ(method_call->GetInterface(), dbus::kPropertiesInterface);
-+        EXPECT_EQ(method_call->GetMember(), dbus::kPropertiesGetAll);
-+        // Simulate a successful response with "active" state.
-+        auto response = CreateActiveStateGetAllResponse(kStateActive);
-+        std::move(*callback).Run(response.get());
-       }));
- 
-   std::optional<SystemdUnitStatus> status;
-@@ -189,6 +243,142 @@ TEST_F(SetSystemdScopeUnitNameForXdgPortalTest, StartTransientUnitFailure) {
-   EXPECT_EQ(status, SystemdUnitStatus::kFailedToStart);
- }
- 
-+TEST_F(SetSystemdScopeUnitNameForXdgPortalTest,
-+       StartTransientUnitInvalidUnitPath) {
-+  scoped_refptr<dbus::MockBus> bus =
-+      base::MakeRefCounted<dbus::MockBus>(dbus::Bus::Options());
-+
-+  auto mock_dbus_proxy = base::MakeRefCounted<dbus::MockObjectProxy>(
-+      bus.get(), DBUS_SERVICE_DBUS, dbus::ObjectPath(DBUS_PATH_DBUS));
-+
-+  EXPECT_CALL(
-+      *bus, GetObjectProxy(DBUS_SERVICE_DBUS, dbus::ObjectPath(DBUS_PATH_DBUS)))
-+      .WillRepeatedly(Return(mock_dbus_proxy.get()));
-+
-+  EXPECT_CALL(*mock_dbus_proxy, DoCallMethod(_, _, _))
-+      .WillOnce(Invoke([](dbus::MethodCall* method_call, int timeout_ms,
-+                          dbus::ObjectProxy::ResponseCallback* callback) {
-+        auto response = dbus::Response::CreateEmpty();
-+        dbus::MessageWriter writer(response.get());
-+        writer.AppendBool(true);
-+        std::move(*callback).Run(response.get());
-+      }));
-+
-+  auto mock_systemd_proxy = base::MakeRefCounted<dbus::MockObjectProxy>(
-+      bus.get(), kServiceNameSystemd, dbus::ObjectPath(kObjectPathSystemd));
-+
-+  EXPECT_CALL(*bus, GetObjectProxy(kServiceNameSystemd,
-+                                   dbus::ObjectPath(kObjectPathSystemd)))
-+      .Times(2)
-+      .WillRepeatedly(Return(mock_systemd_proxy.get()));
-+
-+  EXPECT_CALL(*mock_systemd_proxy, DoCallMethod(_, _, _))
-+      .WillOnce(Invoke([](dbus::MethodCall* method_call, int timeout_ms,
-+                          dbus::ObjectProxy::ResponseCallback* callback) {
-+        EXPECT_EQ(method_call->GetInterface(), kInterfaceSystemdManager);
-+        EXPECT_EQ(method_call->GetMember(), kMethodStartTransientUnit);
-+
-+        // Simulate a successful response
-+        auto response = dbus::Response::CreateEmpty();
-+        std::move(*callback).Run(response.get());
-+      }))
-+      .WillOnce(Invoke([](dbus::MethodCall* method_call, int timeout_ms,
-+                          dbus::ObjectProxy::ResponseCallback* callback) {
-+        EXPECT_EQ(method_call->GetInterface(), kInterfaceSystemdManager);
-+        EXPECT_EQ(method_call->GetMember(), kMethodGetUnit);
-+
-+        // Simulate a failure response.
-+        std::move(*callback).Run(nullptr);
-+      }));
-+
-+  std::optional<SystemdUnitStatus> status;
-+
-+  SetSystemdScopeUnitNameForXdgPortal(
-+      bus.get(), base::BindLambdaForTesting(
-+                     [&](SystemdUnitStatus result) { status = result; }));
-+
-+  EXPECT_EQ(status, SystemdUnitStatus::kFailedToStart);
-+}
-+
-+TEST_F(SetSystemdScopeUnitNameForXdgPortalTest,
-+       StartTransientUnitFailToActivate) {
-+  scoped_refptr<dbus::MockBus> bus =
-+      base::MakeRefCounted<dbus::MockBus>(dbus::Bus::Options());
-+
-+  auto mock_dbus_proxy = base::MakeRefCounted<dbus::MockObjectProxy>(
-+      bus.get(), DBUS_SERVICE_DBUS, dbus::ObjectPath(DBUS_PATH_DBUS));
-+
-+  EXPECT_CALL(
-+      *bus, GetObjectProxy(DBUS_SERVICE_DBUS, dbus::ObjectPath(DBUS_PATH_DBUS)))
-+      .WillRepeatedly(Return(mock_dbus_proxy.get()));
-+
-+  EXPECT_CALL(*mock_dbus_proxy, DoCallMethod(_, _, _))
-+      .WillOnce(Invoke([](dbus::MethodCall* method_call, int timeout_ms,
-+                          dbus::ObjectProxy::ResponseCallback* callback) {
-+        auto response = dbus::Response::CreateEmpty();
-+        dbus::MessageWriter writer(response.get());
-+        writer.AppendBool(true);
-+        std::move(*callback).Run(response.get());
-+      }));
-+
-+  auto mock_systemd_proxy = base::MakeRefCounted<dbus::MockObjectProxy>(
-+      bus.get(), kServiceNameSystemd, dbus::ObjectPath(kObjectPathSystemd));
-+
-+  EXPECT_CALL(*bus, GetObjectProxy(kServiceNameSystemd,
-+                                   dbus::ObjectPath(kObjectPathSystemd)))
-+      .Times(2)
-+      .WillRepeatedly(Return(mock_systemd_proxy.get()));
-+
-+  auto mock_dbus_unit_proxy = base::MakeRefCounted<dbus::MockObjectProxy>(
-+      bus.get(), kServiceNameSystemd, dbus::ObjectPath(kFakeUnitPath));
-+  EXPECT_CALL(*bus, GetObjectProxy(kServiceNameSystemd,
-+                                   dbus::ObjectPath(kFakeUnitPath)))
-+      .WillOnce(Return(mock_dbus_unit_proxy.get()));
-+
-+  EXPECT_CALL(*mock_systemd_proxy, DoCallMethod(_, _, _))
-+      .WillOnce(Invoke([](dbus::MethodCall* method_call, int timeout_ms,
-+                          dbus::ObjectProxy::ResponseCallback* callback) {
-+        EXPECT_EQ(method_call->GetInterface(), kInterfaceSystemdManager);
-+        EXPECT_EQ(method_call->GetMember(), kMethodStartTransientUnit);
-+
-+        // Simulate a successful response
-+        auto response = dbus::Response::CreateEmpty();
-+        std::move(*callback).Run(response.get());
-+      }))
-+      .WillOnce(Invoke([obj_path = kFakeUnitPath](
-+                           dbus::MethodCall* method_call, int timeout_ms,
-+                           dbus::ObjectProxy::ResponseCallback* callback) {
-+        EXPECT_EQ(method_call->GetInterface(), kInterfaceSystemdManager);
-+        EXPECT_EQ(method_call->GetMember(), kMethodGetUnit);
-+
-+        // Simulate a successful response
-+        auto response = dbus::Response::CreateEmpty();
-+        dbus::MessageWriter writer(response.get());
-+        writer.AppendObjectPath(dbus::ObjectPath(obj_path));
-+        std::move(*callback).Run(response.get());
-+      }));
-+
-+  EXPECT_CALL(*mock_dbus_unit_proxy, DoCallMethod(_, _, _))
-+      .WillOnce(Invoke([](dbus::MethodCall* method_call, int timeout_ms,
-+                          dbus::ObjectProxy::ResponseCallback* callback) {
-+        // Then expect kMethodGetUnit. A valid path must be provided.
-+        EXPECT_EQ(method_call->GetInterface(), dbus::kPropertiesInterface);
-+        EXPECT_EQ(method_call->GetMember(), dbus::kPropertiesGetAll);
-+
-+        // Simulate a successful response, but with inactive state.
-+        auto response = CreateActiveStateGetAllResponse(kStateInactive);
-+        std::move(*callback).Run(response.get());
-+      }));
-+
-+  std::optional<SystemdUnitStatus> status;
-+
-+  SetSystemdScopeUnitNameForXdgPortal(
-+      bus.get(), base::BindLambdaForTesting(
-+                     [&](SystemdUnitStatus result) { status = result; }));
-+
-+  EXPECT_EQ(status, SystemdUnitStatus::kFailedToStart);
-+}
-+
- TEST_F(SetSystemdScopeUnitNameForXdgPortalTest, UnitNameConstruction) {
-   scoped_refptr<dbus::MockBus> bus =
-       base::MakeRefCounted<dbus::MockBus>(dbus::Bus::Options());
-@@ -220,7 +410,14 @@ TEST_F(SetSystemdScopeUnitNameForXdgPortalTest, UnitNameConstruction) {
- 
-   EXPECT_CALL(*bus, GetObjectProxy(kServiceNameSystemd,
-                                    dbus::ObjectPath(kObjectPathSystemd)))
--      .WillOnce(Return(mock_systemd_proxy.get()));
-+      .Times(2)
-+      .WillRepeatedly(Return(mock_systemd_proxy.get()));
-+
-+  auto mock_dbus_unit_proxy = base::MakeRefCounted<dbus::MockObjectProxy>(
-+      bus.get(), kServiceNameSystemd, dbus::ObjectPath(kFakeUnitPath));
-+  EXPECT_CALL(*bus, GetObjectProxy(kServiceNameSystemd,
-+                                   dbus::ObjectPath(kFakeUnitPath)))
-+      .WillOnce(Return(mock_dbus_unit_proxy.get()));
- 
-   EXPECT_CALL(*mock_systemd_proxy, DoCallMethod(_, _, _))
-       .WillOnce(Invoke([&](dbus::MethodCall* method_call, int timeout_ms,
-@@ -256,6 +453,30 @@ TEST_F(SetSystemdScopeUnitNameForXdgPortalTest, UnitNameConstruction) {
- 
-         auto response = dbus::Response::CreateEmpty();
-         std::move(*callback).Run(response.get());
-+      }))
-+      .WillOnce(Invoke([obj_path = kFakeUnitPath](
-+                           dbus::MethodCall* method_call, int timeout_ms,
-+                           dbus::ObjectProxy::ResponseCallback* callback) {
-+        EXPECT_EQ(method_call->GetInterface(), kInterfaceSystemdManager);
-+        EXPECT_EQ(method_call->GetMember(), kMethodGetUnit);
-+
-+        // Simulate a successful response
-+        auto response = dbus::Response::CreateEmpty();
-+        dbus::MessageWriter writer(response.get());
-+        writer.AppendObjectPath(dbus::ObjectPath(obj_path));
-+        std::move(*callback).Run(response.get());
-+      }));
-+
-+  EXPECT_CALL(*mock_dbus_unit_proxy, DoCallMethod(_, _, _))
-+      .WillOnce(Invoke([](dbus::MethodCall* method_call, int timeout_ms,
-+                          dbus::ObjectProxy::ResponseCallback* callback) {
-+        // Then expect kMethodGetUnit. A valid path must be provided.
-+        EXPECT_EQ(method_call->GetInterface(), dbus::kPropertiesInterface);
-+        EXPECT_EQ(method_call->GetMember(), dbus::kPropertiesGetAll);
-+
-+        // Simulate a successful response
-+        auto response = CreateActiveStateGetAllResponse(kStateActive);
-+        std::move(*callback).Run(response.get());
-       }));
- 
-   std::optional<SystemdUnitStatus> status;

patches/chromium/cherry-pick-1282289030ab.patch

@@ -0,0 +1,264 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Kevin Ellis <kevers@google.com>
+Date: Thu, 12 Dec 2024 06:47:30 -0800
+Subject: Prune superfluous calls to SetCompositorPending
+
+We only need to call SetCompositorPending with the pending cancel
+reason if the animation is running on the compositor.
+
+The stack trace on the bug report showed a significant time being
+spent in HasProperty. The timing was also optimized in this CL to
+prevent unnecessary duplicate calculations.
+
+Bug: 382394791
+Change-Id: I03ffa1b486b267e05f63328212d192dfca26eb53
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6076354
+Reviewed-by: Robert Flack <flackr@chromium.org>
+Commit-Queue: Kevin Ellis <kevers@chromium.org>
+Reviewed-by: Claire Chambers <clchambers@microsoft.com>
+Cr-Commit-Position: refs/heads/main@{#1395390}
+
+diff --git a/third_party/blink/renderer/core/animation/animation.cc b/third_party/blink/renderer/core/animation/animation.cc
+index 1b384beef682c87b4bec3c9233d45529c5569b56..694ca51b1a59270289fabe70dbb381167fc89a83 100644
+--- a/third_party/blink/renderer/core/animation/animation.cc
++++ b/third_party/blink/renderer/core/animation/animation.cc
+@@ -1269,14 +1269,7 @@ void Animation::setEffect(AnimationEffect* new_effect) {
+   ResolveTimelineOffsets(timeline_ ? timeline_->GetTimelineRange()
+                                    : TimelineRange());
+ 
+-  SetOutdated();
+-
+-  // 7. Run the procedure to update an animation’s finished state for animation
+-  //    with the did seek flag set to false (continuous), and the synchronously
+-  //    notify flag set to false (async).
+-  UpdateFinishedState(UpdateType::kContinuous, NotificationType::kAsync);
+-
+-  SetCompositorPending(CompositorPendingReason::kPendingEffectChange);
++  EffectInvalidated();
+ 
+   // Notify of a potential state change.
+   NotifyProbe();
+@@ -2373,6 +2366,26 @@ void Animation::StartAnimationOnCompositor(
+           timeline()->IsMonotonicallyIncreasing(), boundary_aligned);
+ }
+ 
++Animation::NativePaintWorkletReasons Animation::GetNativePaintWorkletReasons() {
++  if (native_paint_worklet_reasons_) {
++    return native_paint_worklet_reasons_.value();
++  }
++  NativePaintWorkletReasons reasons = kNoPaintWorklet;
++  if (KeyframeEffect* keyframe_effect = DynamicTo<KeyframeEffect>(effect())) {
++    if (RuntimeEnabledFeatures::CompositeBGColorAnimationEnabled() &&
++        keyframe_effect->Affects(
++            PropertyHandle(GetCSSPropertyBackgroundColor()))) {
++      reasons |= kBackgroundColorPaintWorklet;
++    }
++    if (RuntimeEnabledFeatures::CompositeClipPathAnimationEnabled() &&
++        keyframe_effect->Affects(PropertyHandle(GetCSSPropertyClipPath()))) {
++      reasons |= kClipPathPaintWorklet;
++    }
++  }
++  native_paint_worklet_reasons_ = reasons;
++  return reasons;
++}
++
+ // TODO(crbug.com/960944): Rename to SetPendingCommit. This method handles both
+ // composited and non-composited animations. The use of 'compositor' in the name
+ // is confusing.
+@@ -2831,7 +2844,7 @@ bool Animation::Update(TimingUpdateReason reason) {
+     // After updating the animation time if the animation is no longer current
+     // blink will no longer composite the element (see
+     // CompositingReasonFinder::RequiresCompositingFor*Animation).
+-    if (!content_->IsCurrent()) {
++    if (!content_->IsCurrent() && HasActiveAnimationsOnCompositor()) {
+       SetCompositorPending(CompositorPendingReason::kPendingCancel);
+     }
+   }
+@@ -2872,6 +2885,9 @@ void Animation::UpdateIfNecessary() {
+ }
+ 
+ void Animation::EffectInvalidated() {
++  prior_native_paint_worklet_reasons_ = native_paint_worklet_reasons_;
++  native_paint_worklet_reasons_ = std::nullopt;
++
+   SetOutdated();
+   UpdateFinishedState(UpdateType::kContinuous, NotificationType::kAsync);
+   // FIXME: Needs to consider groups when added.
+@@ -3379,15 +3395,22 @@ bool Animation::IsInDisplayLockedSubtree() {
+ }
+ 
+ void Animation::UpdateCompositedPaintStatus() {
+-  if (!NativePaintImageGenerator::NativePaintWorkletAnimationsEnabled()) {
+-    return;
++  if (GetNativePaintWorkletReasons() == Animation::kNoPaintWorklet) {
++    if (!prior_native_paint_worklet_reasons_ ||
++        prior_native_paint_worklet_reasons_ == Animation::kNoPaintWorklet) {
++      return;
++    }
+   }
+ 
++  prior_native_paint_worklet_reasons_ = GetNativePaintWorkletReasons();
++
+   KeyframeEffect* keyframe_effect = DynamicTo<KeyframeEffect>(content_.Get());
+   if (!keyframe_effect) {
+     return;
+   }
+ 
++  // TODO(crbug.com/383562308): If the target changed since the last update, we
++  // need to trigger an update for the previous and current target.
+   Element* target = keyframe_effect->EffectTarget();
+   if (!target) {
+     return;
+@@ -3396,14 +3419,7 @@ void Animation::UpdateCompositedPaintStatus() {
+   ElementAnimations* element_animations = target->GetElementAnimations();
+   DCHECK(element_animations);
+ 
+-  if (RuntimeEnabledFeatures::CompositeBGColorAnimationEnabled()) {
+-    element_animations->RecalcCompositedStatus(target,
+-                                               GetCSSPropertyBackgroundColor());
+-  }
+-  if (RuntimeEnabledFeatures::CompositeClipPathAnimationEnabled()) {
+-    element_animations->RecalcCompositedStatus(target,
+-                                               GetCSSPropertyClipPath());
+-  }
++  element_animations->RecalcCompositedStatus(target);
+ }
+ 
+ void Animation::Trace(Visitor* visitor) const {
+diff --git a/third_party/blink/renderer/core/animation/animation.h b/third_party/blink/renderer/core/animation/animation.h
+index c20180d785ca62417ba5e05417462fec5beeae5b..cfd2b44724c86b272982dee4db54ed5191e51d22 100644
+--- a/third_party/blink/renderer/core/animation/animation.h
++++ b/third_party/blink/renderer/core/animation/animation.h
+@@ -393,6 +393,15 @@ class CORE_EXPORT Animation : public EventTarget,
+     start_time_ = start_time;
+   }
+ 
++  enum NativePaintWorkletProperties {
++    kNoPaintWorklet = 0,
++    kBackgroundColorPaintWorklet = 1,
++    kClipPathPaintWorklet = 2
++  };
++
++  using NativePaintWorkletReasons = uint32_t;
++  NativePaintWorkletReasons GetNativePaintWorkletReasons();
++
+  protected:
+   DispatchEventResult DispatchEventInternal(Event&) override;
+   void AddedEventListener(const AtomicString& event_type,
+@@ -583,6 +592,13 @@ class CORE_EXPORT Animation : public EventTarget,
+ 
+   Member<Event> pending_remove_event_;
+ 
++  // Cache whether animation can potentially have native paint worklets.
++  // In the event of the keyframes changing, we need a new evaluation, of
++  // the composited status for native paint worklet eligible properties.
++  // A change in the playState can also necessitate a composited style update.
++  std::optional<NativePaintWorkletReasons> native_paint_worklet_reasons_;
++  std::optional<NativePaintWorkletReasons> prior_native_paint_worklet_reasons_;
++
+   // TODO(crbug.com/960944): Consider reintroducing kPause and cleanup use of
+   // mutually exclusive pending_play_ and pending_pause_ flags.
+   enum class CompositorAction { kNone, kStart, kCancel };
+diff --git a/third_party/blink/renderer/core/animation/element_animations.cc b/third_party/blink/renderer/core/animation/element_animations.cc
+index ca2864f2f7ef8b8969d63a25e85f23f5c9a97b74..b1f3b32332af4f948bb2598f1646f29c97660413 100644
+--- a/third_party/blink/renderer/core/animation/element_animations.cc
++++ b/third_party/blink/renderer/core/animation/element_animations.cc
+@@ -97,43 +97,59 @@ void ElementAnimations::RecalcCompositedStatusForKeyframeChange(
+     Element& element,
+     AnimationEffect* effect) {
+   if (KeyframeEffect* keyframe_effect = DynamicTo<KeyframeEffect>(effect)) {
+-    if (CompositedBackgroundColorStatus() ==
+-            ElementAnimations::CompositedPaintStatus::kComposited &&
+-        keyframe_effect->Affects(
+-            PropertyHandle(GetCSSPropertyBackgroundColor())) &&
+-        element.GetLayoutObject()) {
+-      SetCompositedBackgroundColorStatus(
+-          ElementAnimations::CompositedPaintStatus::kNeedsRepaint);
+-      element.GetLayoutObject()->SetShouldDoFullPaintInvalidation();
++    if (RuntimeEnabledFeatures::CompositeBGColorAnimationEnabled()) {
++      if (CompositedBackgroundColorStatus() ==
++              ElementAnimations::CompositedPaintStatus::kComposited &&
++          keyframe_effect->Affects(
++              PropertyHandle(GetCSSPropertyBackgroundColor())) &&
++          element.GetLayoutObject()) {
++        SetCompositedBackgroundColorStatus(
++            ElementAnimations::CompositedPaintStatus::kNeedsRepaint);
++        element.GetLayoutObject()->SetShouldDoFullPaintInvalidation();
++      }
+     }
+ 
+-    if (CompositedClipPathStatus() ==
+-            ElementAnimations::CompositedPaintStatus::kComposited &&
+-        keyframe_effect->Affects(PropertyHandle(GetCSSPropertyClipPath())) &&
+-        element.GetLayoutObject()) {
+-      SetCompositedClipPathStatus(
+-          ElementAnimations::CompositedPaintStatus::kNeedsRepaint);
+-      element.GetLayoutObject()->SetShouldDoFullPaintInvalidation();
+-      // For clip paths, we also need to update the paint properties to switch
+-      // from path based to mask based clip.
+-      element.GetLayoutObject()->SetNeedsPaintPropertyUpdate();
++    if (RuntimeEnabledFeatures::CompositeClipPathAnimationEnabled()) {
++      if (CompositedClipPathStatus() ==
++              ElementAnimations::CompositedPaintStatus::kComposited &&
++          keyframe_effect->Affects(PropertyHandle(GetCSSPropertyClipPath())) &&
++          element.GetLayoutObject()) {
++        SetCompositedClipPathStatus(
++            ElementAnimations::CompositedPaintStatus::kNeedsRepaint);
++        element.GetLayoutObject()->SetShouldDoFullPaintInvalidation();
++        // For clip paths, we also need to update the paint properties to switch
++        // from path based to mask based clip.
++        element.GetLayoutObject()->SetNeedsPaintPropertyUpdate();
++      }
+     }
+   }
+ }
+ 
+-void ElementAnimations::RecalcCompositedStatus(Element* element,
+-                                               const CSSProperty& property) {
+-  ElementAnimations::CompositedPaintStatus status =
+-      HasAnimationForProperty(property)
+-          ? ElementAnimations::CompositedPaintStatus::kNeedsRepaint
+-          : ElementAnimations::CompositedPaintStatus::kNoAnimation;
++void ElementAnimations::RecalcCompositedStatus(Element* element) {
++  Animation::NativePaintWorkletReasons reasons = Animation::kNoPaintWorklet;
++  for (auto& entry : Animations()) {
++    if (entry.key->CalculateAnimationPlayState() ==
++        V8AnimationPlayState::Enum::kIdle) {
++      continue;
++    }
++    reasons |= entry.key->GetNativePaintWorkletReasons();
++  }
+ 
+-  if (property.PropertyID() == CSSPropertyID::kBackgroundColor) {
++  if (RuntimeEnabledFeatures::CompositeBGColorAnimationEnabled()) {
++    ElementAnimations::CompositedPaintStatus status =
++        reasons & Animation::kBackgroundColorPaintWorklet
++            ? ElementAnimations::CompositedPaintStatus::kNeedsRepaint
++            : ElementAnimations::CompositedPaintStatus::kNoAnimation;
+     if (SetCompositedBackgroundColorStatus(status) &&
+         element->GetLayoutObject()) {
+       element->GetLayoutObject()->SetShouldDoFullPaintInvalidation();
+     }
+-  } else if (property.PropertyID() == CSSPropertyID::kClipPath) {
++  }
++  if (RuntimeEnabledFeatures::CompositeClipPathAnimationEnabled()) {
++    ElementAnimations::CompositedPaintStatus status =
++        reasons & Animation::kClipPathPaintWorklet
++            ? ElementAnimations::CompositedPaintStatus::kNeedsRepaint
++            : ElementAnimations::CompositedPaintStatus::kNoAnimation;
+     if (SetCompositedClipPathStatus(status) && element->GetLayoutObject()) {
+       element->GetLayoutObject()->SetShouldDoFullPaintInvalidation();
+       // For clip paths, we also need to update the paint properties to switch
+diff --git a/third_party/blink/renderer/core/animation/element_animations.h b/third_party/blink/renderer/core/animation/element_animations.h
+index 624f542785befe6ce92e7f75eb8595a2015a77ef..3171061ceb1a0dad426481454d3698c1eee22fd0 100644
+--- a/third_party/blink/renderer/core/animation/element_animations.h
++++ b/third_party/blink/renderer/core/animation/element_animations.h
+@@ -120,7 +120,7 @@ class CORE_EXPORT ElementAnimations final
+ 
+   void RecalcCompositedStatusForKeyframeChange(Element& element,
+                                                AnimationEffect* effect);
+-  void RecalcCompositedStatus(Element* element, const CSSProperty& property);
++  void RecalcCompositedStatus(Element* element);
+ 
+   // TODO(crbug.com/1301961): Consider converting to an array or flat map of
+   // fields for paint properties that can be composited.

patches/chromium/cherry-pick-3dc17c461b12.patch

@@ -0,0 +1,114 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Orko Garai <orko@igalia.com>
+Date: Fri, 29 Nov 2024 16:17:04 +0000
+Subject: Wayland IME: Underline composition text fallback
+
+At this time text-input-v3 does not provide any styling information.
+As a quality-of-life improvement, ensure that a default composition
+style is applied so that the composition text is underlined.
+
+This will also ensure that the user experience is consistent with
+ozone/x11.
+
+Bug: 355238629
+Change-Id: I8d4bce5e5700510d72f114bb57171f43646be098
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5741768
+Commit-Queue: Orko Garai <orko@igalia.com>
+Reviewed-by: Darren Shen <shend@chromium.org>
+Reviewed-by: Kramer Ge <fangzhoug@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1389833}
+
+diff --git a/ui/ozone/platform/wayland/host/wayland_input_method_context.cc b/ui/ozone/platform/wayland/host/wayland_input_method_context.cc
+index a063ff09e6c388242b94dca73d31b586f12e80a1..23d9918afde6847a3776d810ed60738c59f80c30 100644
+--- a/ui/ozone/platform/wayland/host/wayland_input_method_context.cc
++++ b/ui/ozone/platform/wayland/host/wayland_input_method_context.cc
+@@ -552,6 +552,7 @@ void WaylandInputMethodContext::OnPreeditString(
+     const gfx::Range& preedit_cursor) {
+   CompositionText composition_text;
+   composition_text.text = base::UTF8ToUTF16(text);
++  bool has_composition_style = false;
+   for (const auto& span : spans) {
+     auto start_offset = OffsetFromUTF8Offset(text, span.index);
+     if (!start_offset)
+@@ -562,9 +563,18 @@ void WaylandInputMethodContext::OnPreeditString(
+     const auto& style = span.style;
+     if (!style.has_value())
+       continue;
++    if (style->type == ImeTextSpan::Type::kComposition) {
++      has_composition_style = true;
++    }
+     composition_text.ime_text_spans.emplace_back(style->type, *start_offset,
+                                                  *end_offset, style->thickness);
+   }
++  if (!composition_text.text.empty() && !has_composition_style) {
++    // If no explicit composition style is specified, add default composition
++    // style to the composition text.
++    composition_text.ime_text_spans.emplace_back(
++        ImeTextSpan::Type::kComposition, 0, composition_text.text.length());
++  }
+   if (!preedit_cursor.IsValid()) {
+     // This is the case if a preceding preedit_cursor event in text-input-v1 was
+     // not received or an explicit negative value was requested to hide the
+diff --git a/ui/ozone/platform/wayland/host/wayland_input_method_context_unittest.cc b/ui/ozone/platform/wayland/host/wayland_input_method_context_unittest.cc
+index 7fed0c0a206c98764abbe2fc22110dc31b9fdbd8..24b90a83f2dad3a29634549fc4716980fe409d52 100644
+--- a/ui/ozone/platform/wayland/host/wayland_input_method_context_unittest.cc
++++ b/ui/ozone/platform/wayland/host/wayland_input_method_context_unittest.cc
+@@ -1174,6 +1174,34 @@ TEST_P(WaylandInputMethodContextTest, SetInputTypeAfterFocus) {
+   });
+ }
+ 
++TEST_P(WaylandInputMethodContextTest, OnPreeditChangedDefaultCompositionStyle) {
++  constexpr std::string_view kPreeditString("PreeditString");
++  constexpr gfx::Range kSelection{7, 13};
++  input_method_context_->OnPreeditString(
++      kPreeditString,
++      // No composition style provided.
++      {{1,
++        3,
++        {{ImeTextSpan::Type::kMisspellingSuggestion,
++          ImeTextSpan::Thickness::kNone}}}},
++      kSelection);
++  EXPECT_TRUE(input_method_context_delegate_->was_on_preedit_changed_called());
++  EXPECT_EQ(input_method_context_delegate_->last_preedit()->ime_text_spans,
++            (ImeTextSpans{ImeTextSpan(ImeTextSpan::Type::kMisspellingSuggestion,
++                                      1, 4, ImeTextSpan::Thickness::kNone),
++                          // Default composition should be applied.
++                          ImeTextSpan(ImeTextSpan::Type::kComposition, 0,
++                                      kPreeditString.size(),
++                                      ImeTextSpan::Thickness::kThin)}));
++  EXPECT_EQ(
++      input_method_context_->predicted_state_for_testing().surrounding_text,
++      u"PreeditString");
++  EXPECT_EQ(input_method_context_->predicted_state_for_testing().composition,
++            gfx::Range(0, kPreeditString.size()));
++  EXPECT_EQ(input_method_context_->predicted_state_for_testing().selection,
++            kSelection);
++}
++
+ TEST_P(WaylandInputMethodContextTest, OnPreeditChanged) {
+   constexpr std::string_view kPreeditString("PreeditString");
+   constexpr gfx::Range kSelection{7, 13};
+@@ -1181,13 +1209,19 @@ TEST_P(WaylandInputMethodContextTest, OnPreeditChanged) {
+       kPreeditString,
+       {{0,
+         static_cast<uint32_t>(kPreeditString.size()),
+-        {{ImeTextSpan::Type::kComposition, ImeTextSpan::Thickness::kThin}}}},
++        {{ImeTextSpan::Type::kComposition, ImeTextSpan::Thickness::kThick}}},
++       {1,
++        3,
++        {{ImeTextSpan::Type::kMisspellingSuggestion,
++          ImeTextSpan::Thickness::kNone}}}},
+       kSelection);
+   EXPECT_TRUE(input_method_context_delegate_->was_on_preedit_changed_called());
+   EXPECT_EQ(input_method_context_delegate_->last_preedit()->ime_text_spans,
+-            ImeTextSpans{ImeTextSpan(ImeTextSpan::Type::kComposition, 0,
+-                                     kPreeditString.size(),
+-                                     ImeTextSpan::Thickness::kThin)});
++            (ImeTextSpans{ImeTextSpan(ImeTextSpan::Type::kComposition, 0,
++                                      kPreeditString.size(),
++                                      ImeTextSpan::Thickness::kThick),
++                          ImeTextSpan(ImeTextSpan::Type::kMisspellingSuggestion,
++                                      1, 4, ImeTextSpan::Thickness::kNone)}));
+   EXPECT_EQ(
+       input_method_context_->predicted_state_for_testing().surrounding_text,
+       u"PreeditString");

patches/chromium/cherry-pick-dd8e2822e507.patch

@@ -0,0 +1,71 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Patrick Meenan <pmeenan@chromium.org>
+Date: Thu, 6 Feb 2025 07:41:40 -0800
+Subject: Set is_web_secure_context when initializing Service Worker from disk
+
+The value of is_web_secure_context is not serialized to disk when
+storing the service worker registration (only a few select policies
+are).
+
+When instantiating the policy container for an already-registered
+worker, it uses the default value (false) which is wrong.
+
+Since Service Workers are guaranteed to ALWAYS be a web secure
+context, this change explicitly sets it to true when restoring a
+serialized policy.
+
+See: https://w3c.github.io/webappsec-secure-contexts/#examples-service-workers
+
+Bug: 387258077,383070811
+Change-Id: I75efe895662ab4e6d68cacace6d05e004c5dfd33
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6236205
+Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org>
+Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
+Commit-Queue: Patrick Meenan <pmeenan@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1416795}
+
+diff --git a/content/browser/renderer_host/policy_container_host.cc b/content/browser/renderer_host/policy_container_host.cc
+index b17c33c425da7bc98a6669c6595a7e6185a96644..9630f39ee4570d084c877f69658534affef226d2 100644
+--- a/content/browser/renderer_host/policy_container_host.cc
++++ b/content/browser/renderer_host/policy_container_host.cc
+@@ -135,9 +135,11 @@ PolicyContainerPolicies::PolicyContainerPolicies(
+       allow_cross_origin_isolation(allow_cross_origin_isolation) {}
+ 
+ PolicyContainerPolicies::PolicyContainerPolicies(
+-    const blink::mojom::PolicyContainerPolicies& policies)
++    const blink::mojom::PolicyContainerPolicies& policies,
++    bool is_web_secure_context)
+     : referrer_policy(policies.referrer_policy),
+       ip_address_space(policies.ip_address_space),
++      is_web_secure_context(is_web_secure_context),
+       content_security_policies(
+           mojo::Clone(policies.content_security_policies)),
+       cross_origin_embedder_policy(policies.cross_origin_embedder_policy),
+diff --git a/content/browser/renderer_host/policy_container_host.h b/content/browser/renderer_host/policy_container_host.h
+index 394bd53bb5c1dfea5abe24b9047eb190884c2648..7add42348ef28079196b447feda78210815d1551 100644
+--- a/content/browser/renderer_host/policy_container_host.h
++++ b/content/browser/renderer_host/policy_container_host.h
+@@ -49,7 +49,8 @@ struct CONTENT_EXPORT PolicyContainerPolicies {
+       bool allow_cross_origin_isolation);
+ 
+   explicit PolicyContainerPolicies(
+-      const blink::mojom::PolicyContainerPolicies& policies);
++      const blink::mojom::PolicyContainerPolicies& policies,
++      bool is_web_secure_context);
+ 
+   // Used when loading workers from network schemes.
+   // WARNING: This does not populate referrer policy.
+diff --git a/content/browser/service_worker/service_worker_registry.cc b/content/browser/service_worker/service_worker_registry.cc
+index 8ce6875c21522032e8eb448338558c2a28f78613..efa037a599a38af655fd593767f35a601badd3a1 100644
+--- a/content/browser/service_worker/service_worker_registry.cc
++++ b/content/browser/service_worker/service_worker_registry.cc
+@@ -1076,7 +1076,8 @@ ServiceWorkerRegistry::GetOrCreateRegistration(
+     if (data.policy_container_policies) {
+       version->set_policy_container_host(
+           base::MakeRefCounted<PolicyContainerHost>(
+-              PolicyContainerPolicies(*data.policy_container_policies)));
++              PolicyContainerPolicies(*data.policy_container_policies,
++                                      /*is_web_secure_context=*/true)));
+     }
+     if (data.router_rules && version->IsStaticRouterEnabled()) {
+       auto error = version->SetupRouterEvaluator(*data.router_rules);