fix: auth required websocket crash (#48539)

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>

.devcontainer/devcontainer.json

@@ -1,4 +1,5 @@
 {
+	"name": "Electron Core Development Environment",
 	"dockerComposeFile": "docker-compose.yml",
 	"service": "buildtools",
 	"onCreateCommand": ".devcontainer/on-create-command.sh",
@@ -33,27 +34,15 @@
 				"surajbarkale.ninja",
 				"ms-vscode.cpptools",
 				"mutantdino.resourcemonitor",
+				"dsanders11.vscode-electron-build-tools",
 				"dbaeumer.vscode-eslint",
 				"shakram02.bash-beautify",
-				"marshallofsound.gnls-electron",
+				"marshallofsound.gnls-electron"
 			],
 			"settings": {
 				"editor.tabSize": 2,
 				"bashBeautify.tabSize": 2,
 				"typescript.tsdk": "node_modules/typescript/lib",
-				"[gn]": {
-					"editor.formatOnSave": true
-				},
-				"[javascript]": {
-					"editor.codeActionsOnSave": {
-						"source.fixAll.eslint": true
-					}
-				},
-				"[typescript]": {
-					"editor.codeActionsOnSave": {
-						"source.fixAll.eslint": true
-					}
-				},
 				"javascript.preferences.quoteStyle": "single",
 				"typescript.preferences.quoteStyle": "single"
 			}

.devcontainer/docker-compose.yml

@@ -2,7 +2,7 @@ version: '3'
 
 services:
   buildtools:
-    image: ghcr.io/electron/devcontainer:424eedbf277ad9749ffa9219068aa72ed4a5e373
+    image: ghcr.io/electron/devcontainer:933c7d6ff6802706875270bec2e3c891cf8add3f
 
     volumes:
       - ..:/workspaces/gclient/src/electron:cached

.devcontainer/on-create-command.sh

@@ -58,13 +58,13 @@ if [ ! -f $buildtools/configs/evm.testing.json ]; then
             },
             \"\$schema\": \"file:///home/builduser/.electron_build_tools/evm-config.schema.json\",
             \"configValidationLevel\": \"strict\",
-            \"reclient\": \"$1\",
-            \"preserveXcode\": 5
+            \"remoteBuild\": \"reclient\",
+            \"preserveSDK\": 5
         }
     " >$buildtools/configs/evm.testing.json
   }
 
-  write_config remote_exec
+  write_config
 
   e use testing 
 else

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -73,7 +73,7 @@ body:
 - type: input
   attributes:
     label: Testcase Gist URL
-    description: If you can reproduce the issue in a standalone test case, please use [Electron Fiddle](https://github.com/electron/fiddle) to create one and to publish it as a [GitHub gist](https://gist.github.com) and put the gist URL here. This is **the best way** to ensure this issue is triaged quickly.
+    description: Electron maintainers need a standalone test case to reproduce and fix your issue. Please use [Electron Fiddle](https://github.com/electron/fiddle) to create one and to publish it as a [GitHub gist](https://gist.github.com). Then put the gist URL here. Issues without testcase gists receive less attention and might be closed without a maintainer taking a closer look. To maximize how much attention your issue receives, please include a testcase gist right from the start.
     placeholder: https://gist.github.com/...
 - type: textarea
   attributes:

.github/actions/build-electron/action.yml

@@ -17,9 +17,6 @@ inputs:
   is-release:
     description: 'Is release build'
     required: true
-  strip-binaries:
-    description: 'Strip binaries (Linux only)'
-    required: false
   generate-symbols:
     description: 'Generate symbols'
     required: true
@@ -63,22 +60,21 @@ runs:
           sudo launchctl limit maxfiles 65536 200000
         fi
 
-        NINJA_SUMMARIZE_BUILD=1 e build -j $NUMBER_OF_NINJA_PROCESSES
+        NINJA_SUMMARIZE_BUILD=1 e build
         cp out/Default/.ninja_log out/electron_ninja_log
         node electron/script/check-symlinks.js
-    - name: Strip Electron Binaries ${{ inputs.step-suffix }}
-      shell: bash
-      if: ${{ inputs.strip-binaries == 'true' }}
-      run: |
-        cd src
-        electron/script/copy-debug-symbols.py --target-cpu="${{ inputs.target-arch }}" --out-dir=out/Default/debug --compress
-        electron/script/strip-binaries.py --target-cpu="${{ inputs.target-arch }}" --verbose
-        electron/script/add-debug-link.py --target-cpu="${{ inputs.target-arch }}" --debug-dir=out/Default/debug
+
+        # Upload build stats to Datadog
+        if ! [ -z $DD_API_KEY ]; then
+          npx node electron/script/build-stats.mjs out/Default/siso.INFO --upload-stats || true
+        else
+          echo "Skipping build-stats.mjs upload because DD_API_KEY is not set"
+        fi
     - name: Build Electron dist.zip ${{ inputs.step-suffix }}
       shell: bash
       run: |
         cd src
-        e build --target electron:electron_dist_zip -j $NUMBER_OF_NINJA_PROCESSES -d explain
+        e build --target electron:electron_dist_zip
         if [ "${{ inputs.is-asan }}" != "true" ]; then
           target_os=${{ inputs.target-platform == 'macos' && 'mac' || inputs.target-platform }}
           if [ "${{ inputs.artifact-platform }}" = "mas" ]; then
@@ -90,7 +86,7 @@ runs:
       shell: bash
       run: |
         cd src
-        e build --target electron:electron_mksnapshot -j $NUMBER_OF_NINJA_PROCESSES
+        e build --target electron:electron_mksnapshot_zip
         ELECTRON_DEPOT_TOOLS_DISABLE_LOG=1 e d gn desc out/Default v8:run_mksnapshot_default args > out/Default/mksnapshot_args
         # Remove unused args from mksnapshot_args
         SEDOPTION="-i"
@@ -100,20 +96,6 @@ runs:
         sed $SEDOPTION '/.*builtins-pgo/d' out/Default/mksnapshot_args
         sed $SEDOPTION '/--turbo-profiling-input/d' out/Default/mksnapshot_args
 
-        if [ "${{ inputs.target-platform }}" = "linux" ]; then
-          if [ "${{ inputs.target-arch }}" = "arm" ]; then
-            electron/script/strip-binaries.py --file $PWD/out/Default/clang_x86_v8_arm/mksnapshot
-            electron/script/strip-binaries.py --file $PWD/out/Default/clang_x86_v8_arm/v8_context_snapshot_generator
-          elif [ "${{ inputs.target-arch }}" = "arm64" ]; then
-            electron/script/strip-binaries.py --file $PWD/out/Default/clang_x64_v8_arm64/mksnapshot
-            electron/script/strip-binaries.py --file $PWD/out/Default/clang_x64_v8_arm64/v8_context_snapshot_generator
-          else
-            electron/script/strip-binaries.py --file $PWD/out/Default/mksnapshot
-            electron/script/strip-binaries.py --file $PWD/out/Default/v8_context_snapshot_generator
-          fi
-        fi
-
-        e build --target electron:electron_mksnapshot_zip -j $NUMBER_OF_NINJA_PROCESSES
         if [ "${{ inputs.target-platform }}" = "win" ]; then
           cd out/Default
           powershell Compress-Archive -update mksnapshot_args mksnapshot.zip
@@ -147,7 +129,6 @@ runs:
       shell: bash
       run: |
         cd src
-        e build --target electron:electron_chromedriver -j $NUMBER_OF_NINJA_PROCESSES
         e build --target electron:electron_chromedriver_zip
     - name: Build Node.js headers ${{ inputs.step-suffix }}
       shell: bash
@@ -190,24 +171,24 @@ runs:
           electron/script/zip-symbols.py -b $BUILD_PATH
         fi
     - name: Generate FFMpeg ${{ inputs.step-suffix }}
-      if: ${{ inputs.is-release == 'true' }}
       shell: bash
+      if: ${{ inputs.is-release == 'true' }}
       run: |
         cd src
-        gn gen out/ffmpeg --args="import(\"//electron/build/args/ffmpeg.gn\") use_remoteexec=true $GN_EXTRA_ARGS"
-        e build --target electron:electron_ffmpeg_zip -C ../../out/ffmpeg -j $NUMBER_OF_NINJA_PROCESSES
+        gn gen out/ffmpeg --args="import(\"//electron/build/args/ffmpeg.gn\") use_remoteexec=true use_siso=true $GN_EXTRA_ARGS"
+        e build --target electron:electron_ffmpeg_zip -C ../../out/ffmpeg
     - name: Generate Hunspell Dictionaries ${{ inputs.step-suffix }}
       shell: bash
       if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'linux' }}
       run: |
-        e build --target electron:hunspell_dictionaries_zip -j $NUMBER_OF_NINJA_PROCESSES
+        e build --target electron:hunspell_dictionaries_zip
     - name: Generate Libcxx ${{ inputs.step-suffix }}
       shell: bash
       if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'linux' }}
       run: |
-        e build --target electron:libcxx_headers_zip -j $NUMBER_OF_NINJA_PROCESSES
-        e build --target electron:libcxxabi_headers_zip -j $NUMBER_OF_NINJA_PROCESSES
-        e build --target electron:libcxx_objects_zip -j $NUMBER_OF_NINJA_PROCESSES
+        e build --target electron:libcxx_headers_zip
+        e build --target electron:libcxxabi_headers_zip
+        e build --target electron:libcxx_objects_zip
     - name: Remove Clang problem matcher
       shell: bash
       run: echo "::remove-matcher owner=clang::"
@@ -230,7 +211,29 @@ runs:
           echo 'Uploading Electron release distribution to GitHub releases'
           script/release/uploaders/upload.py --verbose
         fi
+    - name: Generate siso report
+      if: ${{ inputs.target-platform != 'win' && !cancelled() }}
+      shell: bash
+      run: |
+        cd src
+        e d siso report -C out/Default > siso_report.txt
+        SISO_REPORT_PATH=$(grep -o '/.*siso-report-[^ ]*' siso_report.txt)
+        echo "SISO_REPORT_PATH=$SISO_REPORT_PATH" >> $GITHUB_ENV
+        cat siso_report.txt
+        echo "SISO REPORT AT $SISO_REPORT_PATH"
+    - name: Generate siso report (Windows)
+      if: ${{ inputs.target-platform == 'win' && !cancelled() }}
+      shell: powershell
+      run: |
+        cd src
+        e d siso report -C out\Default > siso_report.txt
+        $SISO_REPORT_PATH = Get-Content "siso_report.txt" | Select-String "report file:\s*(.+)" | ForEach-Object { 
+          $_.Matches.Groups[1].Value.Trim() 
+        }
+        echo "SISO_REPORT_PATH=$SISO_REPORT_PATH"
+        echo "SISO_REPORT_PATH=$SISO_REPORT_PATH" >> $env:GITHUB_ENV
     - name: Generate Artifact Key
+      if: always() && !cancelled()
       shell: bash
       run: |
         if [ "${{ inputs.is-asan }}" = "true" ]; then 
@@ -242,9 +245,11 @@ runs:
     # The current generated_artifacts_<< artifact.key >> name was taken from CircleCI
     # to ensure we don't break anything, but we may be able to improve that.
     - name: Move all Generated Artifacts to Upload Folder ${{ inputs.step-suffix }}
+      if: always() && !cancelled()
       shell: bash
       run: ./src/electron/script/actions/move-artifacts.sh
     - name: Upload Generated Artifacts ${{ inputs.step-suffix }}
+      if: always() && !cancelled()
       uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
       with:
         name: generated_artifacts_${{ env.ARTIFACT_KEY }}

.github/actions/checkout/action.yml

@@ -148,6 +148,11 @@ runs:
     run: |
       echo "::remove-matcher owner=merge-conflict::"
       echo "::remove-matcher owner=patch-conflict::"
+  - name: Upload patches stats
+    if: ${{ inputs.target-platform == 'linux' && github.ref == 'refs/heads/main' }}
+    shell: bash
+    run: |
+      npx node src/electron/script/patches-stats.mjs --upload-stats || true
   # delete all .git directories under src/ except for
   # third_party/angle/ and third_party/dawn/ because of build time generation of files
   # gen/angle/commit.h depends on third_party/angle/.git/HEAD

.github/actions/cipd-install/action.yml

@@ -14,6 +14,9 @@ inputs:
     description: 'Target platform, should be linux, win, macos'
   package:
     description: 'Package to install'
+  dependency-version:
+    description: 'Version of the dependency to install'
+    default: ''
 runs:
   using: "composite"
   steps:
@@ -22,15 +25,23 @@ runs:
       run : |
         rm -rf ${{ inputs.cipd-root-prefix-path }}${{ inputs.installation-dir }}
     - name: Create ensure file for ${{ inputs.dependency }}
+      if: ${{ inputs.dependency-version == '' }}
       shell: bash
       run: |
         echo '${{ inputs.package }}' `e d gclient getdep --deps-file=${{ inputs.deps-file }} -r '${{ inputs.installation-dir }}:${{ inputs.package }}'` > ${{ inputs.dependency }}_ensure_file
         cat ${{ inputs.dependency }}_ensure_file
-    - name: CIPD installation of ${{ inputs.dependency }} (macOS)
-      if: ${{ inputs.target-platform == 'macos' }}
+
+    - name: Create ensure file for ${{ inputs.dependency }} from dependency-version
+      if: ${{ inputs.dependency-version != '' }}
       shell: bash
       run: |
-        echo "ensuring ${{ inputs.dependency }} on macOS"
+        echo '${{ inputs.package }} ${{ inputs.dependency-version }}'  > ${{ inputs.dependency }}_ensure_file
+        cat ${{ inputs.dependency }}_ensure_file
+    - name: CIPD installation of ${{ inputs.dependency }} (macOS)
+      if: ${{ inputs.target-platform != 'win' }}
+      shell: bash
+      run: |
+        echo "ensuring ${{ inputs.dependency }}"
         e d cipd ensure --root ${{ inputs.cipd-root-prefix-path }}${{ inputs.installation-dir }} -ensure-file ${{ inputs.dependency }}_ensure_file
     - name: CIPD installation of ${{ inputs.dependency }} (Windows)
       if: ${{ inputs.target-platform == 'win' }}

.github/actions/fix-sync/action.yml

@@ -19,12 +19,16 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Fix clang
+    - name: Fix llvm toolchain
+      if: ${{ inputs.target-platform != 'linux' }}
       shell: bash
       run : |
         rm -rf src/third_party/llvm-build
         python3 src/tools/clang/scripts/update.py
+        # Refs https://chromium-review.googlesource.com/c/chromium/src/+/6667681
+        python3 src/tools/clang/scripts/update.py --package objdump
     - name: Fix esbuild
+      if: ${{ inputs.target-platform != 'linux' }}
       uses: ./src/electron/.github/actions/cipd-install
       with:
         cipd-root-prefix-path: src/third_party/devtools-frontend/src/
@@ -34,6 +38,7 @@ runs:
         target-platform: ${{ inputs.target-platform }}
         package: infra/3pp/tools/esbuild/${platform}
     - name: Fix rustc
+      if: ${{ inputs.target-platform != 'linux' }}
       shell: bash
       run : |
         rm -rf src/third_party/rust-toolchain
@@ -57,6 +62,7 @@ runs:
         target-platform: ${{ inputs.target-platform }}
         package: gn/gn/windows-amd64
     - name: Fix reclient
+      if: ${{ inputs.target-platform != 'linux' }}
       uses: ./src/electron/.github/actions/cipd-install
       with:
         dependency: reclient
@@ -65,6 +71,7 @@ runs:
         target-platform: ${{ inputs.target-platform }}
         package: infra/rbe/client/${platform}
     - name: Configure reclient configs
+      if: ${{ inputs.target-platform != 'linux' }}
       shell: bash
       run : |
         python3 src/buildtools/reclient_cfgs/configure_reclient_cfgs.py --rbe_instance "projects/rbe-chrome-untrusted/instances/default_instance" --reproxy_cfg_template reproxy.cfg.template --rewrapper_cfg_project "" --skip_remoteexec_cfg_fetch
@@ -82,6 +89,7 @@ runs:
           python3 src/third_party/depot_tools/download_from_google_storage.py --no_resume --no_auth --bucket chromium-browser-clang -s $DSYM_SHA_FILE -o src/tools/clang/dsymutil/bin/dsymutil
         fi
     - name: Fix ninja
+      if: ${{ inputs.target-platform != 'linux' }}
       uses: ./src/electron/.github/actions/cipd-install
       with:
         dependency: ninja
@@ -90,10 +98,20 @@ runs:
         target-platform: ${{ inputs.target-platform }}
         package: infra/3pp/tools/ninja/${platform}
     - name: Set ninja in path
+      if: ${{ inputs.target-platform != 'linux' }}
       shell: bash
       run : |
         echo "$(pwd)/src/third_party/ninja" >> $GITHUB_PATH
+    - name: Fix siso
+      uses: ./src/electron/.github/actions/cipd-install
+      with:
+        dependency: siso
+        deps-file: src/DEPS
+        installation-dir: src/third_party/siso/cipd
+        target-platform: ${{ inputs.target-platform }}
+        package: build/siso/${platform}
     - name: Fixup angle git
+      if: ${{ inputs.target-platform != 'linux' }}
       shell: bash
       run : |
         cd src/third_party/angle

.github/actions/free-space-macos/action.yml

@@ -6,8 +6,6 @@ runs:
     - name: Free Space on MacOS
       shell: bash
       run: |
-        echo "Disk usage before cleanup:"
-        df -h
         sudo mkdir -p $TMPDIR/del-target
 
         tmpify() {
@@ -59,10 +57,20 @@ runs:
         sudo rm -rf $TMPDIR/del-target
 
         sudo rm -rf /Applications/Safari.app
+        sudo rm -rf /Applications/Xcode_16.1.app
+        sudo rm -rf /Applications/Xcode_16.3.app
+        sudo rm -rf /Applications/Xcode_16.2.app
+        sudo rm -rf /Applications/Google Chrome.app
+        sudo rm -rf /Applications/Xcode_16.4.app
+        sudo rm -rf /Applications/Google Chrome for Testing.app
+        sudo rm -rf	/Applications/Firefox.app
         sudo rm -rf ~/project/src/third_party/catapult/tracing/test_data
         sudo rm -rf ~/project/src/third_party/angle/third_party/VK-GL-CTS
+        sudo rm -rf /Users/runner/Library/Android
+        sudo rm -rf $JAVA_HOME_11_arm64
+        sudo rm -rf $JAVA_HOME_17_arm64
+        sudo rm -rf $JAVA_HOME_21_arm64
 
         # lipo off some huge binaries arm64 versions to save space
         strip_universal_deep $(xcode-select -p)/../SharedFrameworks
-        # strip_arm_deep /System/Volumes/Data/Library/Developer/CommandLineTools/usr
-        sudo mdutil -a -i off
+        # strip_arm_deep /System/Volumes/Data/Library/Developer/CommandLineTools/usr

.github/actions/install-build-tools/action.yml

@@ -13,8 +13,9 @@ runs:
         git config --global core.fscache true
         git config --global core.longpaths true
         git config --global core.preloadindex true
+        git config --global core.longpaths true
       fi
-      export BUILD_TOOLS_SHA=6e8526315ea3b4828882497e532b8340e64e053c
+      export BUILD_TOOLS_SHA=706147b2376f55078f718576b28129a0457f1795
       npm i -g @electron/build-tools
       # Update depot_tools to ensure python
       e d update_depot_tools

.github/actions/restore-cache-azcopy/action.yml

@@ -97,7 +97,7 @@ runs:
 
       $TEMP_DIR=New-Item -ItemType Directory -Path temp-cache
       $TEMP_DIR_PATH = $TEMP_DIR.FullName
-      C:\ProgramData\Chocolatey\bin\7z.exe -y -snld x $src_cache -o"$TEMP_DIR_PATH"
+      C:\ProgramData\Chocolatey\bin\7z.exe -y -snld20 x $src_cache -o"$TEMP_DIR_PATH"
 
   - name: Move Src Cache (Windows)
     if: ${{ inputs.target-platform == 'win' }}

.github/actions/ssh-debug/action.yml

@@ -6,10 +6,10 @@ inputs:
     required: true
     default: 'false'
   timeout:
-    description: 'SSH session timeout in minutes'
+    description: 'SSH session timeout in seconds'
     required: false
     type: number
-    default: 60
+    default: 3600
 runs:
   using: composite
   steps:

.github/actions/ssh-debug/setup-ssh.sh

@@ -1,44 +1,20 @@
 #!/bin/bash -e
 
-get_authorized_keys() {
-    if [ -z "$AUTHORIZED_USERS" ] || ! echo "$AUTHORIZED_USERS" | grep -q "\b$GITHUB_ACTOR\b"; then
-        return 1
-    fi
-
-    api_response=$(curl -s "https://api.github.com/users/$GITHUB_ACTOR/keys")
-
-    if echo "$api_response" | jq -e 'type == "object" and has("message")' >/dev/null; then
-        error_msg=$(echo "$api_response" | jq -r '.message')
-        echo "Error: $error_msg"
-        return 1
-    else
-        echo "$api_response" | jq -r '.[].key'
-    fi
-}
-
-authorized_keys=$(get_authorized_keys "$GITHUB_ACTOR")
-
-if [ -n "$authorized_keys" ]; then
-    echo "Configured SSH key(s) for user: $GITHUB_ACTOR"
-else
-    echo "Error: User '$GITHUB_ACTOR' is not authorized to access this debug session."
-    echo "Authorized users: $AUTHORIZED_USERS"
-    exit 1
-fi
-
-if [ "$TUNNEL" != "true" ]; then
+if [ "${TUNNEL}" != "true" ]; then
     echo "SSH tunneling is disabled. Set enable-tunnel: true to enable remote access."
     echo "Local SSH server would be available on localhost:2222 if this were a local environment."
     exit 0
 fi
 
+echo ::group::Configuring Tunnel
+
 echo "SSH tunneling enabled. Setting up remote access..."
 
 EXTERNAL_DEPS="curl jq ssh-keygen"
 
 for dep in $EXTERNAL_DEPS; do
-    if ! command -v "$dep" > /dev/null 2>&1; then
-       echo "Command $dep not installed on the system!" >&2
+    if ! command -v "${dep}" > /dev/null 2>&1; then
+       echo "Command ${dep} not installed on the system!" >&2
        exit 1
     fi
 done
@@ -48,22 +24,21 @@ cd "$GITHUB_ACTION_PATH"
 bashrc_path=$(pwd)/bashrc
 
 # Source `bashrc` to auto start tmux on SSH login.
-if ! grep -q "$bashrc_path" ~/.bash_profile; then
+if ! grep -q "${bashrc_path}" ~/.bash_profile; then
     echo >> ~/.bash_profile # On macOS runner there's no newline at the end of the file
-    echo "source \"$bashrc_path\"" >> ~/.bash_profile
+    echo "source \"${bashrc_path}\"" >> ~/.bash_profile
 fi
 
 OS=$(uname -s | tr '[:upper:]' '[:lower:]')
 ARCH=$(uname -m)
 
-if [ "$ARCH" = "x86_64" ]; then
+if [ "${ARCH}" = "x86_64" ]; then
     ARCH="amd64"
-elif [ "$ARCH" = "aarch64" ]; then
+elif [ "${ARCH}" = "aarch64" ]; then
     ARCH="arm64"
 fi
 
-# Install tmux on macOS runners if not present.
-if [ "$OS" = "darwin" ] && ! command -v tmux > /dev/null 2>&1; then
+if [ "${OS}" = "darwin" ] && ! command -v tmux > /dev/null 2>&1; then
     echo "Installing tmux..."
     brew install tmux
 fi
@@ -71,47 +46,80 @@ fi
 if [ "$OS" = "darwin" ]; then
     cloudflared_url="https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${OS}-${ARCH}.tgz"
     echo "Downloading \`cloudflared\` from <$cloudflared_url>..."
-    curl --location --silent --output cloudflared.tgz "$cloudflared_url"
+    curl --location --silent --output cloudflared.tgz "${cloudflared_url}"
     tar xf cloudflared.tgz
     rm cloudflared.tgz
-else
-    cloudflared_url="https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${OS}-${ARCH}"
-    echo "Downloading \`cloudflared\` from <$cloudflared_url>..."
-    curl --location --silent --output cloudflared "$cloudflared_url"
 fi
 
 chmod +x cloudflared
 
-echo "Setting up SSH key for authorized user: $GITHUB_ACTOR"
-echo "$authorized_keys" > authorized_keys
-
 echo 'Creating SSH server key...'
 ssh-keygen -q -f ssh_host_rsa_key -N ''
 
 echo 'Creating SSH server config...'
-sed "s,\$PWD,$PWD,;s,\$USER,$USER," sshd_config.template > sshd_config
+sed "s,\$PWD,${PWD},;s,\$USER,${USER}," sshd_config.template > sshd_config
 
 echo 'Starting SSH server...'
-/usr/sbin/sshd -f sshd_config -D &
+sudo /usr/sbin/sshd -f sshd_config -D &
 sshd_pid=$!
 
-echo 'Starting tmux session...'
-(cd "$GITHUB_WORKSPACE" && tmux new-session -d -s debug)
+echo "SSH server started successfully (PID: ${sshd_pid})"
 
-#if no cloudflare tunnel token is provided, exit
-if [ -z "$CLOUDFLARE_TUNNEL_TOKEN" ]; then
-    echo "Error: required CLOUDFLARE_TUNNEL_TOKEN not found"
+echo 'Starting tmux session...'
+(cd "${GITHUB_WORKSPACE}" && tmux new-session -d -s debug)
+
+mkdir ~/.cloudflared
+CLEAN_TUNNEL_CERT=$(printf '%s\n' "${CLOUDFLARE_TUNNEL_CERT}" | tr -d '\r' | sed '/^[[:space:]]*$/d')
+
+echo "${CLEAN_TUNNEL_CERT}" > ~/.cloudflared/cert.pem
+
+CLEAN_USER_CA_CERT=$(printf '%s\n' "${CLOUDFLARE_USER_CA_CERT}" | tr -d '\r' | sed '/^[[:space:]]*$/d')
+
+echo "${CLEAN_USER_CA_CERT}" | sudo tee /etc/ssh/ca.pub > /dev/null
+sudo chmod 644 /etc/ssh/ca.pub
+
+random_suffix=$(openssl rand -hex 5 | cut -c1-10)
+tunnel_name="${GITHUB_SHA}-${GITHUB_RUN_ID}-${random_suffix}"
+tunnel_url="${tunnel_name}.${CLOUDFLARE_TUNNEL_HOSTNAME}"
+
+if ./cloudflared tunnel list | grep -q "${tunnel_name}"; then
+    echo "Deleting existing tunnel: ${tunnel_name}"
+    ./cloudflared tunnel delete ${tunnel_name}
+fi
+
+echo "Creating new cloudflare tunnel: ${tunnel_name}"
+./cloudflared tunnel create ${tunnel_name}
+
+credentials_file=$(find ~/.cloudflared -name "*.json" | head -n 1)
+if [ -z "${credentials_file}" ]; then
+    echo "Error: Could not find tunnel credentials file"
     exit 1
 fi
 
-echo 'Starting Cloudflare tunnel...'
+echo "Found credentials file: ${credentials_file}"
 
-./cloudflared tunnel --no-autoupdate run --token "$CLOUDFLARE_TUNNEL_TOKEN" 2>&1 | tee cloudflared.log | sed -u 's/^/cloudflared: /' &
+echo 'Creating tunnel configuration...'
+cat > tunnel_config.yml << EOF
+tunnel: ${tunnel_name}
+credentials-file: ${credentials_file}
+
+ingress:
+  - hostname: ${tunnel_url}
+    service: ssh://localhost:2222
+  - service: http_status:404
+EOF
+
+echo 'Setting up DNS routing for tunnel...'
+./cloudflared tunnel route dns ${tunnel_name} ${tunnel_url}
+
+echo 'Running cloudflare tunnel...'
+./cloudflared tunnel --no-autoupdate --config tunnel_config.yml run 2>&1 | tee cloudflared.log | sed -u 's/^/cloudflared: /' &
 cloudflared_pid=$!
 
-url="$TUNNEL_HOSTNAME"
+echo ::endgroup::
+
+echo ::notice title=SSH Debug Session Ready::ssh ${tunnel_url}
 
-public_key=$(cut -d' ' -f1,2 < ssh_host_rsa_key.pub)
 
 (
     echo '    '
@@ -119,22 +127,20 @@ public_key=$(cut -d' ' -f1,2 < ssh_host_rsa_key.pub)
     echo '🔗 SSH Debug Session Ready!'
     echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
     echo '    '
-    echo '📋 Copy and run this command to connect:'
+    echo '📋 Infra WG can copy and run this command to connect:'
     echo '    '
-    if [ -n "$TUNNEL_HOSTNAME" ]; then
-        echo "ssh-keygen -R action-ssh-debug && echo 'action-ssh-debug $public_key' >> ~/.ssh/known_hosts && ssh -o ProxyCommand='cloudflared access tcp --hostname $url' runner@action-ssh-debug"
-    else
-        echo "ssh-keygen -R action-ssh-debug && echo 'action-ssh-debug $public_key' >> ~/.ssh/known_hosts && ssh -o ProxyCommand='cloudflared access tcp --hostname $url' runner@action-ssh-debug"
-    fi
+    echo "ssh ${tunnel_url}"
     echo '    '
-    echo "⏰ Session expires automatically in $TIMEOUT minutes"
+    echo "⏰ Session expires automatically in ${TIMEOUT} seconds"
     echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
     echo '    '
     echo '    '
 ) | cat
 
+echo ::group::Starting Background Session
 echo 'Starting SSH session in background...'
-./ssh-session.sh "$sshd_pid" "$cloudflared_pid" $TIMEOUT &
+./ssh-session.sh "${sshd_pid}" "${cloudflared_pid}" "${TIMEOUT}" "${tunnel_name}" &
 
 echo 'SSH session is running in background. GitHub Action will continue.'
 echo 'Session will auto-cleanup after timeout or when processes end.'
+echo ::endgroup::

.github/actions/ssh-debug/ssh-session.sh

@@ -2,20 +2,51 @@
 
 SSHD_PID=$1
 CLOUDFLARED_PID=$2
-SESSION_TIMEOUT=${3:-3600}
+SESSION_TIMEOUT=${3:-10000}
+TUNNEL_NAME=$4
+
+cleanup() {
+    # Kill processes.
+    for pid in "$SLEEP_PID" "$SSHD_PID" "$CLOUDFLARED_PID"; do
+        if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
+            kill "$pid" 2>/dev/null || true
+        fi
+    done
+
+    # Clean up tunnel.
+    if [ -n "$TUNNEL_NAME" ]; then
+        cd "$GITHUB_ACTION_PATH"
+        ./cloudflared tunnel delete "$TUNNEL_NAME" 2>/dev/null || {
+            echo "Failed to delete tunnel"
+        }
+    fi
+
+    echo "Session ended at $(date)"
+    exit 0
+}
+
+# Trap signals to ensure cleanup.
+trap cleanup SIGTERM SIGINT SIGQUIT SIGHUP EXIT
 
 # Wait for timeout or until processes die.
 sleep "$SESSION_TIMEOUT" &
 SLEEP_PID=$!
 
-# Monitor if SSH or cloudflared dies early.
-while kill -0 "$SSHD_PID" 2>/dev/null && kill -0 "$CLOUDFLARED_PID" 2>/dev/null && kill -0 "$SLEEP_PID" 2>/dev/null; do
-  sleep 10
+# Monitor processes
+while kill -0 "$SLEEP_PID" 2>/dev/null; do
+    # Check SSH daemon.
+    if ! kill -0 "$SSHD_PID" 2>/dev/null; then
+        echo "SSH daemon died at $(date)"
+        break
+    fi
+
+    # Check cloudflared,
+    if ! kill -0 "$CLOUDFLARED_PID" 2>/dev/null; then
+        echo "Cloudflared died at $(date)"
+        break
+    fi
+
+    sleep 10
 done
 
-# Cleanup.
-kill "$SLEEP_PID" 2>/dev/null || true
-kill "$SSHD_PID" 2>/dev/null || true
-kill "$CLOUDFLARED_PID" 2>/dev/null || true
-
-echo "SSH session ended"
+cleanup

.github/actions/ssh-debug/sshd_config.template

@@ -2,8 +2,24 @@ Port 2222
 HostKey $PWD/ssh_host_rsa_key
 PidFile $PWD/sshd.pid
 
-# Only allow single user
-AllowUsers $USER
+# Connection settings
+ClientAliveInterval 30
+ClientAliveCountMax 10
+MaxStartups 10
+LoginGraceTime 120
 
-# Only allow those keys
-AuthorizedKeysFile $PWD/authorized_keys
+# Allow TCP forwarding for tunneling
+AllowTcpForwarding yes
+
+# Try to prevent timeouts
+TCPKeepAlive yes
+
+# Security
+TrustedUserCAKeys /etc/ssh/ca.pub
+PubkeyAuthentication yes
+PasswordAuthentication no
+
+AuthorizedPrincipalsCommand /bin/bash -c "echo '%t %k' | ssh-keygen -L -f - | grep -A1 Principals"
+AuthorizedPrincipalsCommandUser nobody
+
+PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com

.github/workflows/archaeologist-dig.yml

@@ -13,7 +13,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup Node.js/npm
-        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: 20.19.x
       - name: Setting Up Dig Site
@@ -41,7 +41,7 @@ jobs:
           sha-file: .dig-old
           filename: electron.old.d.ts
       - name: Upload artifacts
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 #v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
         with:
           name: artifacts
           path: electron/artifacts

.github/workflows/audit-branch-ci.yml

@@ -0,0 +1,145 @@
+name: Audit CI on Branches
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Run every 2 hours
+    - cron: '0 */2 * * *'
+
+permissions: {}
+
+jobs:
+  audit_branch_ci:
+    name: Audit CI on Branches
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - run: npm install @actions/cache @electron/fiddle-core
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        id: audit-errors
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const cache = require('@actions/cache');
+            const { ElectronVersions } = require('@electron/fiddle-core');
+
+            const runsWithErrors = [];
+
+            // Only want the most recent workflow run that wasn't skipped or cancelled
+            const isValidWorkflowRun = (run) => !['skipped', 'cancelled'].includes(run.conclusion);
+
+            const versions = await ElectronVersions.create(undefined, { ignoreCache: true });
+            const branches = versions.supportedMajors.map((branch) => `${branch}-x-y`);
+
+            for (const branch of ["main", ...branches]) {
+              const latestCheckRuns = new Map();
+              const allCheckRuns = await github.paginate(github.rest.checks.listForRef, {
+                owner: "electron",
+                repo: "electron",
+                ref: branch,
+                status: 'completed',
+              });
+
+              // Sort the check runs by completed_at so that multiple check runs on the
+              // same ref (like a scheduled workflow) only looks at the most recent one
+              for (const checkRun of allCheckRuns.filter(
+                (run) => !['skipped', 'cancelled'].includes(run.conclusion),
+              ).sort((a, b) => new Date(b.completed_at) - new Date(a.completed_at))) {
+                if (!latestCheckRuns.has(checkRun.name)) {
+                  latestCheckRuns.set(checkRun.name, checkRun);
+                }
+              }
+
+              // Check for runs which had error annotations
+              for (const checkRun of Array.from(latestCheckRuns.values())) {
+                if (checkRun.name === "Audit CI on Branches") {
+                  continue; // Skip the audit workflow itself
+                }
+
+                const annotations = (await github.rest.checks.listAnnotations({
+                  owner: "electron",
+                  repo: "electron",
+                  check_run_id: checkRun.id,
+                })).data ?? [];
+
+                if (
+                  annotations.find(
+                    ({ annotation_level, message }) =>
+                      annotation_level === "failure" &&
+                      !message.startsWith("Process completed with exit code") &&
+                      !message.startsWith("Response status code does not indicate success") &&
+                      !/Unable to make request/.test(message) &&
+                      !/The requested URL returned error/.test(message),
+                  )
+                ) {
+                  checkRun.hasErrorAnnotations = true;
+                } else {
+                  continue;
+                }
+
+                // Check if this is a known failure from a previous audit run
+                const cacheKey = `check-run-error-annotations-${checkRun.id}`;
+                const cacheHit =
+                  (await cache.restoreCache(['/dev/null'], cacheKey, undefined, {
+                    lookupOnly: true,
+                  })) !== undefined;
+
+                if (cacheHit) {
+                  checkRun.isStale = true;
+                }
+
+                checkRun.branch = branch;
+                runsWithErrors.push(checkRun);
+  
+                // Create a cache entry (only the name matters) to keep track of
+                // failures we've seen from previous runs to mark them as stale
+                if (!cacheHit) {
+                  await cache.saveCache(['/dev/null'], cacheKey);
+                }
+              }
+            }
+
+            if (runsWithErrors.length > 0) {
+              core.setOutput('errorsFound', true);
+              core.summary.addHeading('⚠️ Runs with Errors');
+              core.summary.addTable([
+                [
+                  { data: 'Branch', header: true },
+                  { data: 'Workflow Run', header: true },
+                  { data: 'Status', header: true },
+                ],
+                ...runsWithErrors
+                  .sort(
+                    (a, b) =>
+                      a.branch.localeCompare(b.branch) ||
+                      a.name.localeCompare(b.name),
+                  )
+                  .map((run) => [
+                    run.branch,
+                    `<a href="${run.html_url}">${run.name}</a>`,
+                    run.isStale
+                      ? '📅 Stale'
+                      : run.hasErrorAnnotations
+                      ? '⚠️ Errors'
+                      : '✅ Succeeded',
+                  ]),
+              ]);
+
+              // Set this as failed so it's easy to scan runs to find failures
+              if (runsWithErrors.find((run) => !run.isStale)) {
+                process.exitCode = 1;
+              }
+            } else {
+              core.summary.addRaw('🎉 No runs with errors');
+            }
+
+            await core.summary.write();
+      - name: Send Slack message if errors
+        if: ${{ always() && steps.audit-errors.outputs.errorsFound && github.ref == 'refs/heads/main' }}
+        uses: slackapi/slack-github-action@b0fa283ad8fea605de13dc3f449259339835fc52 # v2.1.0
+        with:
+          payload: |
+            link: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          webhook: ${{ secrets.CI_ERRORS_SLACK_WEBHOOK_URL }}
+          webhook-type: webhook-trigger

.github/workflows/branch-created.yml

@@ -94,7 +94,7 @@ jobs:
             }))
       - name: Create Release Project Board
         if: ${{ steps.check-major-version.outputs.MAJOR }}
-        uses: dsanders11/project-actions/copy-project@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/copy-project@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
         id: create-release-board
         with:
           drafts: true
@@ -114,14 +114,15 @@ jobs:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
       - name: Find Previous Release Project Board
         if: ${{ steps.check-major-version.outputs.MAJOR }}
-        uses: dsanders11/project-actions/find-project@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/find-project@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
         id: find-prev-release-board
         with:
+          fail-if-project-not-found: false
           title: ${{ steps.generate-project-metadata.outputs.prev-prev-major }}-x-y
           token: ${{ steps.generate-token.outputs.token }}
       - name: Close Previous Release Project Board
-        if: ${{ steps.check-major-version.outputs.MAJOR }}
-        uses: dsanders11/project-actions/close-project@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        if: ${{ steps.find-prev-release-board.outputs.number }}
+        uses: dsanders11/project-actions/close-project@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
         with:
           project-number: ${{ steps.find-prev-release-board.outputs.number }}
           token: ${{ steps.generate-token.outputs.token }}

.github/workflows/build.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
         required: true
       skip-macos:
         type: boolean
@@ -28,6 +28,11 @@ on:
         description: 'Skip lint check'
         default: false
         required: false
+      enable-ssh:
+        description: 'Enable SSH debugging'
+        required: false
+        type: boolean
+        default: false
   push:
     branches:
       - main
@@ -64,7 +69,7 @@ jobs:
       id: set-output
       run: |
         if [ -z "${{ inputs.build-image-sha }}" ]; then
-          echo "build-image-sha=424eedbf277ad9749ffa9219068aa72ed4a5e373" >> "$GITHUB_OUTPUT"
+          echo "build-image-sha=933c7d6ff6802706875270bec2e3c891cf8add3f" >> "$GITHUB_OUTPUT"
         else
           echo "build-image-sha=${{ inputs.build-image-sha }}" >> "$GITHUB_OUTPUT"
         fi
@@ -81,11 +86,11 @@ jobs:
 
   # Docs Only Jobs
   docs-only:
-    needs: setup
+    needs: [setup, checkout-linux]
     if: ${{ needs.setup.outputs.docs-only == 'true' }}
     uses: ./.github/workflows/pipeline-electron-docs-only.yml
     with:
-      container: '{"image":"ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}","options":"--user root"}'
+      container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
     secrets: inherit
 
   # Checkout Jobs
@@ -119,7 +124,7 @@ jobs:
 
   checkout-linux:
     needs: setup
-    if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-linux}}
+    if: ${{ !inputs.skip-linux}}
     runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
@@ -128,7 +133,8 @@ jobs:
         - /mnt/cross-instance-cache:/mnt/cross-instance-cache
         - /var/run/sas:/var/run/sas
     env:
-      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}     
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+      DD_API_KEY: ${{ secrets.DD_API_KEY }}
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
       PATCH_UP_APP_CREDS: ${{ secrets.PATCH_UP_APP_CREDS }}
     outputs:
@@ -142,6 +148,8 @@ jobs:
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Checkout & Sync & Save
       uses: ./src/electron/.github/actions/checkout
+      with:
+        target-platform: linux
 
   checkout-windows:
     needs: setup
@@ -188,6 +196,7 @@ jobs:
   linux-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
     needs: checkout-linux
+    if: ${{ needs.setup.outputs.src == 'true' }}
     with:
       target-platform: linux
       target-archs: x64 arm arm64
@@ -224,6 +233,7 @@ jobs:
       gn-build-type: testing
       generate-symbols: false
       upload-to-storage: '0'
+      enable-ssh: ${{ inputs.enable-ssh || false }}
     secrets: inherit
   
   macos-arm64:
@@ -242,6 +252,7 @@ jobs:
       gn-build-type: testing
       generate-symbols: false
       upload-to-storage: '0'
+      enable-ssh: ${{ inputs.enable-ssh || false }}
     secrets: inherit
 
   linux-x64:
@@ -251,6 +262,7 @@ jobs:
       pull-requests: read
     uses: ./.github/workflows/pipeline-electron-build-and-test-and-nan.yml
     needs: checkout-linux
+    if: ${{ needs.setup.outputs.src == 'true' }}
     with:
       build-runs-on: electron-arc-centralus-linux-amd64-32core
       test-runs-on: electron-arc-centralus-linux-amd64-4core
@@ -271,6 +283,7 @@ jobs:
       pull-requests: read
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
+    if: ${{ needs.setup.outputs.src == 'true' }}
     with:
       build-runs-on: electron-arc-centralus-linux-amd64-32core
       test-runs-on: electron-arc-centralus-linux-amd64-4core
@@ -292,6 +305,7 @@ jobs:
       pull-requests: read
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
+    if: ${{ needs.setup.outputs.src == 'true' }}
     with:
       build-runs-on: electron-arc-centralus-linux-amd64-32core
       test-runs-on: electron-arc-centralus-linux-arm64-4core
@@ -312,9 +326,10 @@ jobs:
       pull-requests: read
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
+    if: ${{ needs.setup.outputs.src == 'true' }}
     with:
       build-runs-on: electron-arc-centralus-linux-amd64-32core
-      test-runs-on: electron-arc-centralus-linux-arm64-4core
+      test-runs-on: ubuntu-22.04-arm
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/test:arm64v8-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
       target-platform: linux
@@ -373,7 +388,7 @@ jobs:
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     with:
       build-runs-on: electron-arc-centralus-windows-amd64-16core
-      test-runs-on: electron-hosted-windows-arm64-4core
+      test-runs-on: windows-11-arm
       target-platform: win
       target-arch: arm64
       is-release: false

.github/workflows/issue-labeled.yml

@@ -20,7 +20,7 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
       - name: Set status
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 90
@@ -39,7 +39,7 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
       - name: Set status
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 90

.github/workflows/issue-opened.yml

@@ -19,7 +19,7 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
       - name: Add to Issue Triage
-        uses: dsanders11/project-actions/add-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/add-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
         with:
           field: Reporter
           field-value: ${{ github.event.issue.user.login }}
@@ -60,6 +60,8 @@ jobs:
               // It's possible for multiple versions to be listed -
               // for now check for comma or space separated version.
               const versions = electronVersion.split(/, | /);
+              let hasSupportedVersion = false;
+
               for (const version of versions) {
                 const major = semver.coerce(version, { loose: true })?.major;
                 if (major) {
@@ -75,19 +77,20 @@ jobs:
                     labelExists = true;
                   } catch {}
 
-                  if (labelExists) {
-                    // Check if it's an unsupported major
-                    const { ElectronVersions } = await import('${{ github.workspace }}/node_modules/@electron/fiddle-core/dist/index.js');
-                    const versions = await ElectronVersions.create(undefined, { ignoreCache: true });
+                  const { ElectronVersions } = await import('${{ github.workspace }}/node_modules/@electron/fiddle-core/dist/index.js');
+                  const electronVersions = await ElectronVersions.create(undefined, { ignoreCache: true });
+                  const validVersions = [...electronVersions.supportedMajors, ...electronVersions.prereleaseMajors];
 
-                    const validVersions = [...versions.supportedMajors, ...versions.prereleaseMajors];
-                    if (validVersions.includes(major)) {
+                  if (validVersions.includes(major)) {
+                    hasSupportedVersion = true;
+                    if (labelExists) {
                       labels.push(versionLabel);
                     }
                   }
                 }
               }
-              if (labels.length === 0) {
+
+              if (!hasSupportedVersion) {
                 core.setOutput('unsupportedMajor', true);
                 labels.push('blocked/need-info ❌');
               }

.github/workflows/issue-transferred.yml

@@ -19,7 +19,7 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
       - name: Remove from issue triage
-        uses: dsanders11/project-actions/delete-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/delete-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 90

.github/workflows/issue-unlabeled.yml

@@ -30,7 +30,7 @@ jobs:
           org: electron
       - name: Set status
         if: ${{ steps.check-for-blocked-labels.outputs.NOT_BLOCKED }}
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 90

.github/workflows/linux-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
       upload-to-storage:
         description: 'Uploads to Azure storage'
         required: false
@@ -50,7 +50,6 @@ jobs:
       is-release: true
       gn-build-type: release
       generate-symbols: true
-      strip-binaries: true
       upload-to-storage: ${{ inputs.upload-to-storage }}
     secrets: inherit
 
@@ -66,7 +65,6 @@ jobs:
       is-release: true
       gn-build-type: release
       generate-symbols: true
-      strip-binaries: true
       upload-to-storage: ${{ inputs.upload-to-storage }}
     secrets: inherit
 
@@ -82,6 +80,5 @@ jobs:
       is-release: true
       gn-build-type: release
       generate-symbols: true
-      strip-binaries: true
       upload-to-storage: ${{ inputs.upload-to-storage }}
     secrets: inherit

.github/workflows/macos-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
         required: true
       upload-to-storage:
         description: 'Uploads to Azure storage'

.github/workflows/pipeline-electron-build-and-test.yml

@@ -54,6 +54,11 @@ on:
         required: false
         type: boolean
         default: false
+      enable-ssh:
+        description: 'Enable SSH debugging'
+        required: false
+        type: boolean
+        default: false
 
 concurrency:
   group: electron-build-and-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
@@ -76,7 +81,8 @@ jobs:
       gn-build-type: ${{ inputs.gn-build-type }}
       generate-symbols: ${{ inputs.generate-symbols }}
       upload-to-storage: ${{ inputs.upload-to-storage }}
-      is-asan: ${{ inputs.is-asan}}
+      is-asan: ${{ inputs.is-asan }}
+      enable-ssh: ${{ inputs.enable-ssh }}
     secrets: inherit
   test:
     uses: ./.github/workflows/pipeline-segment-electron-test.yml
@@ -86,5 +92,6 @@ jobs:
       target-platform: ${{ inputs.target-platform }}
       test-runs-on: ${{ inputs.test-runs-on }}
       test-container: ${{ inputs.test-container }}
-      is-asan: ${{ inputs.is-asan}}
+      is-asan: ${{ inputs.is-asan }}
+      enable-ssh: ${{ inputs.enable-ssh }}
     secrets: inherit

.github/workflows/pipeline-electron-docs-only.yml

@@ -12,6 +12,9 @@ concurrency:
   group: electron-docs-only-${{ github.ref }}
   cancel-in-progress: true
 
+env:  
+  GCLIENT_EXTRA_ARGS: --custom-var=checkout_arm=True --custom-var=checkout_arm64=True
+
 jobs:
   docs-only:
     name: Docs Only Compile
@@ -19,6 +22,22 @@ jobs:
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:
+    - name: Checkout Electron
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Generate DEPS Hash
+      run: |
+        node src/electron/script/generate-deps-hash.js
+        DEPSHASH=v1-src-cache-$(cat src/electron/.depshash)
+        echo "DEPSHASH=$DEPSHASH" >> $GITHUB_ENV
+        echo "CACHE_PATH=$DEPSHASH.tar" >> $GITHUB_ENV
+    - name: Restore src cache via AKS
+      uses: ./src/electron/.github/actions/restore-cache-aks
+      with:
+        target-platform: linux
     - name: Checkout Electron
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:

.github/workflows/pipeline-segment-electron-build.yml

@@ -48,17 +48,16 @@ on:
         required: true
         type: string
         default: '0'
-      strip-binaries: 
-        description: 'Strip the binaries before release (Linux only)'
-        required: false
-        type: boolean
-        default: false
       is-asan: 
         description: 'Building the Address Sanitizer (ASan) Linux build'
         required: false
         type: boolean
         default: false
-
+      enable-ssh:
+        description: 'Enable SSH debugging'
+        required: false
+        type: boolean
+        default: false
 
 concurrency:
   group: electron-build-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.target-variant }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
@@ -67,6 +66,7 @@ concurrency:
 env:
   CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
   CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
+  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   ELECTRON_ARTIFACTS_BLOB_STORAGE: ${{ secrets.ELECTRON_ARTIFACTS_BLOB_STORAGE }}
   ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
   SUDOWOODO_EXCHANGE_URL: ${{ secrets.SUDOWOODO_EXCHANGE_URL }}
@@ -85,6 +85,7 @@ jobs:
     environment: ${{ inputs.environment }}
     env:
       TARGET_ARCH: ${{ inputs.target-arch }}
+      TARGET_PLATFORM: ${{ inputs.target-platform }}
     steps:
     - name: Create src dir
       run: |
@@ -96,14 +97,16 @@ jobs:
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Setup SSH Debugging
-      if: ${{ inputs.target-platform == 'macos' && env.ACTIONS_STEP_DEBUG == 'true' }}
+      if: ${{ inputs.target-platform == 'macos' && (inputs.enable-ssh || env.ACTIONS_STEP_DEBUG == 'true') }}
       uses: ./src/electron/.github/actions/ssh-debug
       with:
         tunnel: 'true'
       env:
-        CLOUDFLARE_TUNNEL_TOKEN: ${{ secrets.CLOUDFLARE_TUNNEL_TOKEN }}
-        TUNNEL_HOSTNAME: ${{ secrets.CLOUDFLARED_SSH_HOSTNAME }}
+        CLOUDFLARE_TUNNEL_CERT: ${{ secrets.CLOUDFLARE_TUNNEL_CERT }}
+        CLOUDFLARE_TUNNEL_HOSTNAME: ${{ vars.CLOUDFLARE_TUNNEL_HOSTNAME }}
+        CLOUDFLARE_USER_CA_CERT: ${{ secrets.CLOUDFLARE_USER_CA_CERT }}
         AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Free up space (macOS)
       if: ${{ inputs.target-platform == 'macos' }}
       uses: ./src/electron/.github/actions/free-space-macos
@@ -112,7 +115,7 @@ jobs:
       run: df -h
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'macos' }}
-      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
       with:
         node-version: 20.19.x
         cache: yarn
@@ -170,7 +173,7 @@ jobs:
         ELECTRON_DEPOT_TOOLS_DISABLE_LOG: true
     - name: Init Build Tools
       run: |
-        e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu ${{ inputs.target-arch }}
+        e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu ${{ inputs.target-arch }} --remote-build siso
     - name: Run Electron Only Hooks
       run: |
         e d gclient runhooks --spec="solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False},'managed':False}]"
@@ -180,9 +183,6 @@ jobs:
         echo "DEPSHASH=$(cat src/electron/.depshash)" >> $GITHUB_ENV
     - name: Add CHROMIUM_BUILDTOOLS_PATH to env
       run: echo "CHROMIUM_BUILDTOOLS_PATH=$(pwd)/src/buildtools" >> $GITHUB_ENV
-    - name: Setup Number of Ninja Processes
-      run: |
-        echo "NUMBER_OF_NINJA_PROCESSES=${{ inputs.target-platform != 'macos' && '300' || '200' }}" >> $GITHUB_ENV
     - name: Free up space (macOS)
       if: ${{ inputs.target-platform == 'macos' }}
       uses: ./src/electron/.github/actions/free-space-macos
@@ -195,7 +195,6 @@ jobs:
         artifact-platform: ${{ inputs.target-platform == 'macos' && 'darwin' || inputs.target-platform }}
         is-release: '${{ inputs.is-release }}'
         generate-symbols: '${{ inputs.generate-symbols }}'
-        strip-binaries: '${{ inputs.strip-binaries }}'
         upload-to-storage: '${{ inputs.upload-to-storage }}'
         is-asan: '${{ inputs.is-asan }}'
     - name: Set GN_EXTRA_ARGS for MAS Build

.github/workflows/pipeline-segment-electron-test.yml

@@ -25,6 +25,11 @@ on:
         required: false
         type: boolean
         default: false
+      enable-ssh:
+        description: 'Enable SSH debugging'
+        required: false
+        type: boolean
+        default: false
 
 concurrency:
   group: electron-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
@@ -63,24 +68,9 @@ jobs:
       if: ${{ inputs.target-arch == 'arm' && inputs.target-platform == 'linux' }}
       run: |
         cp $(which node) /mnt/runner-externals/node20/bin/
-    - name: Install Git on Windows arm64 runners
-      if: ${{ inputs.target-arch == 'arm64' && inputs.target-platform == 'win' }}
-      shell: powershell
-      run: |
-        Set-ExecutionPolicy Bypass -Scope Process -Force
-        [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
-        iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
-        choco install -y --no-progress git.install --params "'/GitAndUnixToolsOnPath'"
-        choco install -y --no-progress git
-        choco install -y --no-progress python --version 3.11.9
-        choco install -y --no-progress visualstudio2022-workload-vctools --package-parameters "--add Microsoft.VisualStudio.Component.VC.Tools.ARM64"
-        echo "C:\Program Files\Git\cmd" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
-        echo "C:\Program Files\Git\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
-        echo "C:\Python311" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
-        cp "C:\Python311\python.exe" "C:\Python311\python3.exe"
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'win' }}
-      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
       with:
         node-version: 20.19.x
     - name: Add TCC permissions on macOS
@@ -104,8 +94,6 @@ jobs:
             "'kTCCServiceCamera','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
             "'kTCCServiceBluetoothAlways','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
             "'kTCCServiceAppleEvents','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
-            "'kTCCServiceCamera','/opt/hca/hosted-compute-agent',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
-            "'kTCCServiceBluetoothAlways','/opt/hca/hosted-compute-agent',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
         )
         for values in "${userValuesArray[@]}"; do
           # Sonoma and higher have a few extra values
@@ -128,14 +116,16 @@ jobs:
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Setup SSH Debugging
-      if: ${{ inputs.target-platform == 'macos' && env.ACTIONS_STEP_DEBUG == 'true' }}
+      if: ${{ inputs.target-platform == 'macos' && (inputs.enable-ssh || env.ACTIONS_STEP_DEBUG == 'true') }}
       uses: ./src/electron/.github/actions/ssh-debug
       with:
         tunnel: 'true'
       env:
-        CLOUDFLARE_TUNNEL_TOKEN: ${{ secrets.CLOUDFLARE_TUNNEL_TOKEN }}
-        TUNNEL_HOSTNAME: ${{ secrets.CLOUDFLARED_SSH_HOSTNAME }}
+        CLOUDFLARE_TUNNEL_CERT: ${{ secrets.CLOUDFLARE_TUNNEL_CERT }}
+        CLOUDFLARE_TUNNEL_HOSTNAME: ${{ vars.CLOUDFLARE_TUNNEL_HOSTNAME }}
+        CLOUDFLARE_USER_CA_CERT: ${{ secrets.CLOUDFLARE_USER_CA_CERT }}
         AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
     - name: Set Chromium Git Cookie
@@ -149,6 +139,7 @@ jobs:
         git config --global core.fscache true
         git config --global core.longpaths true
         git config --global core.preloadindex true
+        git config --global core.longpaths true
         git clone --filter=tree:0 https://chromium.googlesource.com/chromium/tools/depot_tools.git
         # Ensure depot_tools does not update.
         test -d depot_tools && cd depot_tools
@@ -162,33 +153,29 @@ jobs:
         echo "DISABLE_CRASH_REPORTER_TESTS=true" >> $GITHUB_ENV
         echo "IS_ASAN=true" >> $GITHUB_ENV
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
       with:
         name: generated_artifacts_${{ env.ARTIFACT_KEY }}
         path: ./generated_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
       with:
         name: src_artifacts_${{ env.ARTIFACT_KEY }}
         path: ./src_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
     - name: Restore Generated Artifacts
       run: ./src/electron/script/actions/restore-artifacts.sh
-    - name: Unzip Dist, Mksnapshot & Chromedriver (win)
+    - name: Unzip Dist (win)
       if: ${{ inputs.target-platform == 'win' }}
       shell: powershell
       run: |
         Set-ExecutionPolicy Bypass -Scope Process -Force
         cd src/out/Default
         Expand-Archive -Force dist.zip -DestinationPath ./
-        Expand-Archive -Force chromedriver.zip -DestinationPath ./
-        Expand-Archive -Force mksnapshot.zip -DestinationPath ./
-    - name: Unzip Dist, Mksnapshot & Chromedriver (unix)
+    - name: Unzip Dist (unix)
       if: ${{ inputs.target-platform != 'win' }}
       run: |
         cd src/out/Default
         unzip -:o dist.zip
-        unzip -:o chromedriver.zip
-        unzip -:o mksnapshot.zip
     - name: Import & Trust Self-Signed Codesigning Cert on MacOS
       if: ${{ inputs.target-platform == 'macos' && inputs.target-arch == 'x64' }}
       run: |
@@ -224,7 +211,7 @@ jobs:
               export ELECTRON_FORCE_TEST_SUITE_EXIT="true"
             fi
           fi
-          node script/yarn test --runners=main --trace-uncaught --enable-logging --files $tests_files
+          node script/yarn test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
         else
           chown :builduser .. && chmod g+w ..
           chown -R :builduser . && chmod -R g+w .
@@ -261,7 +248,7 @@ jobs:
       if: always() && !cancelled()
     - name: Upload Test Artifacts
       if: always() && !cancelled()
-      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
       with:
         name: test_artifacts_${{ env.ARTIFACT_KEY }}_${{ matrix.shard }}
         path: src/electron/spec/artifacts

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -61,12 +61,12 @@ jobs:
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
       with:
         name: generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
         path: ./generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
       with:
         name: src_artifacts_linux_${{ env.TARGET_ARCH }}
         path: ./src_artifacts_linux_${{ env.TARGET_ARCH }}
@@ -115,12 +115,12 @@ jobs:
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
       with:
         name: generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
         path: ./generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
       with:
         name: src_artifacts_linux_${{ env.TARGET_ARCH }}
         path: ./src_artifacts_linux_${{ env.TARGET_ARCH }}

.github/workflows/pull-request-labeled.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Trigger Slack workflow
-        uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
+        uses: slackapi/slack-github-action@b0fa283ad8fea605de13dc3f449259339835fc52 # v2.1.0
         with:
           webhook: ${{ secrets.BACKPORT_REQUESTED_SLACK_WEBHOOK_URL }} 
           webhook-type: webhook-trigger
@@ -33,7 +33,7 @@ jobs:
           creds: ${{ secrets.RELEASE_BOARD_GH_APP_CREDS }}
           org: electron
       - name: Set status
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 94

.github/workflows/scorecards.yml

@@ -28,7 +28,7 @@ jobs:
 
       # This is a pre-submit / pre-release.
       - name: "Run analysis"
-        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif
@@ -42,7 +42,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
         with:
           sarif_file: results.sarif

.github/workflows/stable-prep-items.yml

@@ -27,7 +27,7 @@ jobs:
           PROJECT_NUMBER=$(gh project list --owner electron --format json | jq -r '.projects | map(select(.title | test("^[0-9]+-x-y$"))) | max_by(.number) | .number')
           echo "PROJECT_NUMBER=$PROJECT_NUMBER" >> "$GITHUB_OUTPUT"
       - name: Update Completed Stable Prep Items
-        uses: dsanders11/project-actions/completed-by@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/completed-by@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
         with:
           field: Prep Status
           field-value: ✅ Complete

.github/workflows/stale.yml

@@ -27,7 +27,7 @@ jobs:
             This issue has been automatically marked as stale. **If this issue is still affecting you, please leave any comment** (for example, "bump"), and we'll keep it open. If you have any new additional information—in particular, if this is still reproducible in the [latest version of Electron](https://www.electronjs.org/releases/stable) or in the [beta](https://www.electronjs.org/releases/beta)—please include it with your comment!
           close-issue-message: >
             This issue has been closed due to inactivity, and will not be monitored.  If this is a bug and you can reproduce this issue on a [supported version of Electron](https://www.electronjs.org/docs/latest/tutorial/electron-timelines#timeline) please open a new issue and include instructions for reproducing the issue.
-          exempt-issue-labels: "discussion,security \U0001F512,enhancement :sparkles:,status/confirmed,stale-exempt"
+          exempt-issue-labels: "discussion,security \U0001F512,enhancement :sparkles:,status/confirmed,stale-exempt,upgrade-follow-up"
           only-pr-labels: not-a-real-label
   pending-repro:
     runs-on: ubuntu-latest

.github/workflows/windows-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
         required: true
       upload-to-storage:
         description: 'Uploads to Azure storage'

.husky/pre-commit

@@ -1,4 +1 @@
-#!/bin/sh
-. "$(dirname "$0")/_/husky.sh"
-
 npm run precommit

.husky/pre-push

@@ -1,4 +1 @@
-#!/bin/sh
-. "$(dirname "$0")/_/husky.sh"
-
 npm run prepack

.markdownlint-cli2.jsonc

@@ -21,7 +21,9 @@
         "ul",
         "unknown",
         "Tabs",
-        "TabItem"
+        "TabItem",
+        "DocCardList",
+        "kbd"
       ]
     },
     "no-newline-in-links": true

BUILD.gn

@@ -4,9 +4,9 @@ import("//build/config/win/manifest.gni")
 import("//components/os_crypt/sync/features.gni")
 import("//components/spellcheck/spellcheck_build_features.gni")
 import("//content/public/app/mac_helpers.gni")
+import("//content/public/common/features.gni")
 import("//extensions/buildflags/buildflags.gni")
 import("//pdf/features.gni")
-import("//ppapi/buildflags/buildflags.gni")
 import("//printing/buildflags/buildflags.gni")
 import("//testing/test.gni")
 import("//third_party/electron_node/node.gni")
@@ -17,19 +17,19 @@ import("//tools/grit/repack.gni")
 import("//tools/v8_context_snapshot/v8_context_snapshot.gni")
 import("//v8/gni/snapshot_toolchain.gni")
 import("build/asar.gni")
+import("build/electron_paks.gni")
 import("build/extract_symbols.gni")
+import("build/js2c_toolchain.gni")
 import("build/npm.gni")
 import("build/templated_file.gni")
 import("build/tsc.gni")
 import("build/webpack/webpack.gni")
 import("buildflags/buildflags.gni")
-import("electron_paks.gni")
 import("filenames.auto.gni")
 import("filenames.gni")
 import("filenames.hunspell.gni")
 import("filenames.libcxx.gni")
 import("filenames.libcxxabi.gni")
-import("js2c_toolchain.gni")
 
 if (is_mac) {
   import("//build/config/mac/rules.gni")
@@ -38,12 +38,13 @@ if (is_mac) {
   import("build/rules.gni")
 
   assert(
-      mac_deployment_target == "11.0",
-      "Chromium has updated the mac_deployment_target, please update this assert, update the supported versions documentation (docs/tutorial/support.md) and flag this as a breaking change")
+      mac_deployment_target == "12.0",
+      "Chromium has updated the mac_deployment_target, please update this assert and flag this as a breaking change (docs/breaking-changes.md)")
 }
 
 if (is_linux) {
   import("//build/config/linux/pkg_config.gni")
+  import("//electron/build/linux/strip_binary.gni")
   import("//tools/generate_stubs/rules.gni")
 
   pkg_config("gio_unix") {
@@ -314,7 +315,7 @@ asar("default_app_asar") {
 }
 
 grit("resources") {
-  source = "electron_resources.grd"
+  source = "build/electron_resources.grd"
 
   outputs = [
     "grit/electron_resources.h",
@@ -452,7 +453,7 @@ source_set("electron_lib") {
     "//components/certificate_transparency",
     "//components/compose:buildflags",
     "//components/embedder_support:user_agent",
-    "//components/input:input",
+    "//components/input",
     "//components/language/core/browser",
     "//components/net_log",
     "//components/network_hints/browser",
@@ -485,7 +486,7 @@ source_set("electron_lib") {
     "//net:extras",
     "//net:net_resources",
     "//printing/buildflags",
-    "//services/device/public/cpp/bluetooth:bluetooth",
+    "//services/device/public/cpp/bluetooth",
     "//services/device/public/cpp/geolocation",
     "//services/device/public/cpp/hid",
     "//services/device/public/mojom",
@@ -518,6 +519,10 @@ source_set("electron_lib") {
     "//v8:v8_libplatform",
   ]
 
+  if (v8_use_external_startup_data && use_v8_context_snapshot) {
+    deps += [ ":mksnapshot_checksum_gen" ]
+  }
+
   public_deps = [
     "//base",
     "//base:i18n",
@@ -650,6 +655,7 @@ source_set("electron_lib") {
       "//ui/events/devices/x11",
       "//ui/events/platform/x11",
       "//ui/gtk:gtk_config",
+      "//ui/linux:display_server_utils",
       "//ui/linux:linux_ui",
       "//ui/linux:linux_ui_factory",
       "//ui/wm",
@@ -682,6 +688,7 @@ source_set("electron_lib") {
     deps += [
       "//components/app_launch_prefetch",
       "//components/crash/core/app:crash_export_thunks",
+      "//third_party/libxml:xml_writer",
       "//ui/native_theme:native_theme_browser",
       "//ui/wm",
       "//ui/wm/public",
@@ -727,7 +734,7 @@ source_set("electron_lib") {
       "shell/common/extensions/api:extensions_features",
       "//chrome/browser/resources:component_extension_resources",
       "//components/guest_view/common:mojom",
-      "//components/update_client:update_client",
+      "//components/update_client",
       "//components/zoom",
       "//extensions/browser",
       "//extensions/browser/api:api_provider",
@@ -772,6 +779,14 @@ source_set("electron_lib") {
   }
 }
 
+action("mksnapshot_checksum_gen") {
+  script = "build/checksum_header.py"
+  outputs = [ "$target_gen_dir/snapshot_checksum.h" ]
+  inputs = [ "$root_out_dir/$v8_context_snapshot_filename" ]
+  args = rebase_path(inputs) + rebase_path(outputs)
+  deps = [ "//tools/v8_context_snapshot" ]
+}
+
 electron_paks("packed_resources") {
   if (is_mac) {
     output_dir = "$root_gen_dir/electron_repack"
@@ -815,7 +830,7 @@ if (is_mac) {
       sources = []
       public_deps = []
       sources += [ "$root_out_dir/libffmpeg.dylib" ]
-      public_deps += [ "//third_party/ffmpeg:ffmpeg" ]
+      public_deps += [ "//third_party/ffmpeg" ]
       outputs = [ "{{bundle_contents_dir}}/Libraries/{{source_file_part}}" ]
     }
   } else {
@@ -1230,7 +1245,7 @@ if (is_mac) {
     }
 
     if (use_v8_context_snapshot) {
-      public_deps = [ "//tools/v8_context_snapshot:v8_context_snapshot" ]
+      public_deps = [ "//tools/v8_context_snapshot" ]
     }
 
     if (is_linux) {
@@ -1409,6 +1424,18 @@ dist_zip("electron_dist_zip") {
     ":licenses",
   ]
   if (is_linux) {
+    if (is_official_build) {
+      data_deps += [
+        ":strip_chrome_crashpad_handler",
+        ":strip_chrome_sandbox",
+        ":strip_electron_binary",
+        ":strip_libEGL_shlib",
+        ":strip_libGLESv2_shlib",
+        ":strip_libffmpeg_shlib",
+        ":strip_libvk_swiftshader_shlib",
+      ]
+    }
+
     data_deps += [ "//sandbox/linux:chrome_sandbox" ]
   }
   deps = data_deps
@@ -1454,6 +1481,16 @@ group("electron_mksnapshot") {
 
 dist_zip("electron_mksnapshot_zip") {
   data_deps = mksnapshot_deps
+  if (is_linux && is_official_build) {
+    data_deps += [
+      ":strip_libEGL_shlib",
+      ":strip_libGLESv2_shlib",
+      ":strip_libffmpeg_shlib",
+      ":strip_libvk_swiftshader_shlib",
+      ":strip_mksnapshot_binary",
+      ":strip_v8_context_snapshot_generator_binary",
+    ]
+  }
   deps = data_deps
   outputs = [ "$root_build_dir/mksnapshot.zip" ]
 }
@@ -1578,3 +1615,78 @@ group("copy_node_headers") {
 group("node_headers") {
   public_deps = [ ":tar_node_headers" ]
 }
+
+if (is_linux && is_official_build) {
+  strip_binary("strip_electron_binary") {
+    binary_input = "$root_out_dir/$electron_project_name"
+    symbol_output = "$root_out_dir/debug/$electron_project_name.debug"
+    compress_debug_sections = true
+    deps = [ ":electron_app" ]
+  }
+
+  strip_binary("strip_chrome_crashpad_handler") {
+    binary_input = "$root_out_dir/chrome_crashpad_handler"
+    symbol_output = "$root_out_dir/debug/chrome_crashpad_handler.debug"
+    compress_debug_sections = true
+    deps = [ "//components/crash/core/app:chrome_crashpad_handler" ]
+  }
+
+  strip_binary("strip_chrome_sandbox") {
+    binary_input = "$root_out_dir/chrome_sandbox"
+    symbol_output = "$root_out_dir/debug/chrome-sandbox.debug"
+    compress_debug_sections = true
+    deps = [ "//sandbox/linux:chrome_sandbox" ]
+  }
+
+  strip_binary("strip_libEGL_shlib") {
+    binary_input = "$root_out_dir/libEGL.so"
+    symbol_output = "$root_out_dir/debug/libEGL.so.debug"
+    compress_debug_sections = true
+    deps = [ "//third_party/angle:libEGL" ]
+  }
+
+  strip_binary("strip_libGLESv2_shlib") {
+    binary_input = "$root_out_dir/libGLESv2.so"
+    symbol_output = "$root_out_dir/debug/libGLESv2.so.debug"
+    compress_debug_sections = true
+    deps = [ "//third_party/angle:libGLESv2" ]
+  }
+
+  strip_binary("strip_libffmpeg_shlib") {
+    binary_input = "$root_out_dir/libffmpeg.so"
+    symbol_output = "$root_out_dir/debug/libffmpeg.so.debug"
+    compress_debug_sections = true
+    deps = [ "//third_party/ffmpeg" ]
+  }
+
+  strip_binary("strip_libvk_swiftshader_shlib") {
+    binary_input = "$root_out_dir/libvk_swiftshader.so"
+    symbol_output = "$root_out_dir/debug/libvk_swiftshader.so.debug"
+    compress_debug_sections = true
+    deps = [ "//third_party/swiftshader/src/Vulkan:swiftshader_libvulkan" ]
+  }
+
+  strip_binary("strip_mksnapshot_binary") {
+    _binary_path = rebase_path(
+            get_label_info(
+                    ":v8_context_snapshot_generator($v8_snapshot_toolchain)",
+                    "root_out_dir") + "/mksnapshot",
+            root_build_dir)
+    binary_input = "$root_out_dir/$_binary_path"
+    symbol_output = "$root_out_dir/debug/${_binary_path}.debug"
+    compress_debug_sections = true
+    deps = mksnapshot_deps
+  }
+
+  strip_binary("strip_v8_context_snapshot_generator_binary") {
+    _binary_path = rebase_path(
+            get_label_info(
+                    ":v8_context_snapshot_generator($v8_snapshot_toolchain)",
+                    "root_out_dir") + "/v8_context_snapshot_generator",
+            root_build_dir)
+    binary_input = "$root_out_dir/$_binary_path"
+    symbol_output = "$root_out_dir/debug/${_binary_path}.debug"
+    compress_debug_sections = true
+    deps = mksnapshot_deps
+  }
+}

DEPS

@@ -2,9 +2,9 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '136.0.7103.177',
+    '140.0.7339.240',
   'node_version':
-    'v22.18.0',
+    'v22.20.0',
   'nan_version':
     'e14bdcd1f72d62bca1d541b66da43130384ec213',
   'squirrel.mac_version':

build/args/all.gn

@@ -2,7 +2,7 @@ is_electron_build = true
 root_extra_deps = [ "//electron" ]
 
 # Registry of NMVs --> https://github.com/nodejs/node/blob/main/doc/abi_version_registry.json
-node_module_version = 135
+node_module_version = 139
 
 v8_promise_internal_field_count = 1
 v8_embedder_string = "-electron.0"
@@ -70,8 +70,8 @@ v8_expose_public_symbols = true
 # sensitive content by enterprise users.
 enterprise_cloud_content_analysis = false
 
-# TODO: remove dependency on legacy ipc
-# https://issues.chromium.org/issues/40943039
-content_enable_legacy_ipc = true
+# We don't use anything from here, and it causes target collisions
+enable_linux_installer = false
 
-clang_unsafe_buffers_paths = "//electron/electron_unsafe_buffers_paths.txt"
+# Disable "Save to Drive" feature in PDF viewer
+enable_pdf_save_to_drive = false

build/checksum_header.py

@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+
+import os
+import sys
+import hashlib
+
+dir_path = os.path.dirname(os.path.realpath(__file__))
+
+TEMPLATE_H = """
+#ifndef ELECTRON_SNAPSHOT_CHECKSUM_H_
+#define ELECTRON_SNAPSHOT_CHECKSUM_H_
+
+namespace electron::snapshot_checksum {
+
+const std::string kChecksum = "{checksum}";
+
+}  // namespace electron::snapshot_checksum
+
+#endif  // ELECTRON_SNAPSHOT_CHECKSUM_H_
+"""
+
+def calculate_sha256(filepath):
+    sha256_hash = hashlib.sha256()
+    with open(filepath, "rb") as f:
+        for byte_block in iter(lambda: f.read(4096), b""):
+            sha256_hash.update(byte_block)
+    return sha256_hash.hexdigest()
+
+input_file = sys.argv[1]
+output_file = sys.argv[2]
+
+checksum = calculate_sha256(input_file)
+
+checksum_h = TEMPLATE_H.replace("{checksum}", checksum)
+
+with open(output_file, 'w') as f:
+    f.write(checksum_h)

build/linux/strip_binary.gni

@@ -0,0 +1,70 @@
+# Copyright 2021 The Chromium Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# This has been adapted from https://source.chromium.org/chromium/chromium/src/+/main:build/linux/strip_binary.gni;drc=c220a41e0422d45f1657c28146d32e99cc53640b
+# The notable difference is it has an option to compress the debug sections
+
+import("//build/config/clang/clang.gni")
+import("//build/toolchain/toolchain.gni")
+
+# Extracts symbols from a binary into a symbol file.
+#
+# Args:
+#   binary_input: Path to the binary containing symbols to extract, e.g.:
+#       "$root_out_dir/chrome"
+#   symbol_output: Desired output file for symbols, e.g.:
+#       "$root_out_dir/chrome.debug"
+#   stripped_binary_output: Desired output file for stripped file, e.g.:
+#       "$root_out_dir/chrome.stripped"
+#   compress_debug_sections: If true, compress the extracted debug sections
+template("strip_binary") {
+  forward_variables_from(invoker,
+                         [
+                           "deps",
+                           "testonly",
+                         ])
+  action("${target_name}") {
+    llvm_strip_binary = "${clang_base_path}/bin/llvm-strip"
+    llvm_objcopy_binary = "${clang_base_path}/bin/llvm-objcopy"
+    script = "//electron/build/linux/strip_binary.py"
+
+    if (defined(invoker.stripped_binary_output)) {
+      stripped_binary_output = invoker.stripped_binary_output
+    } else {
+      stripped_binary_output = invoker.binary_input + ".stripped"
+    }
+    if (defined(invoker.symbol_output)) {
+      symbol_output = invoker.symbol_output
+    } else {
+      symbol_output = invoker.binary_input + ".debug"
+    }
+
+    inputs = [
+      invoker.binary_input,
+      llvm_strip_binary,
+      llvm_objcopy_binary,
+    ]
+    outputs = [
+      symbol_output,
+      stripped_binary_output,
+    ]
+    args = [
+      "--llvm-strip-binary-path",
+      rebase_path(llvm_strip_binary, root_build_dir),
+      "--llvm-objcopy-binary-path",
+      rebase_path(llvm_objcopy_binary, root_build_dir),
+      "--symbol-output",
+      rebase_path(symbol_output, root_build_dir),
+      "--stripped-binary-output",
+      rebase_path(stripped_binary_output, root_build_dir),
+      "--binary-input",
+      rebase_path(invoker.binary_input, root_build_dir),
+    ]
+
+    if (defined(invoker.compress_debug_sections) &&
+        invoker.compress_debug_sections) {
+      args += [ "--compress-debug-sections" ]
+    }
+  }
+}

build/linux/strip_binary.py

@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+#
+# Copyright 2021 The Chromium Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# This has been adapted from https://source.chromium.org/chromium/chromium/src/+/main:build/linux/strip_binary.py;drc=c220a41e0422d45f1657c28146d32e99cc53640b
+# The notable difference is it has an option to compress the debug sections
+
+import argparse
+import subprocess
+import sys
+
+
+def main() -> int:
+  parser = argparse.ArgumentParser(description="Strip binary using LLVM tools.")
+  parser.add_argument("--llvm-strip-binary-path",
+                      help="Path to llvm-strip executable.")
+  parser.add_argument("--llvm-objcopy-binary-path",
+                      required=True,
+                      help="Path to llvm-objcopy executable.")
+  parser.add_argument("--binary-input", help="Input ELF binary.")
+  parser.add_argument("--symbol-output",
+                      help="File to write extracted debug info (.debug).")
+  parser.add_argument("--compress-debug-sections",
+                      action="store_true",
+                      help="Compress extracted debug info.")
+  parser.add_argument("--stripped-binary-output",
+                      help="File to write stripped binary.")
+  args = parser.parse_args()
+
+  # Replicate the behavior of:
+  # eu-strip <binary_input> -o <stripped_binary_output> -f <symbol_output>
+
+  objcopy_args = [
+      "--only-keep-debug",
+      args.binary_input,
+      args.symbol_output,
+  ]
+
+  if args.compress_debug_sections:
+    objcopy_args.insert(0, "--compress-debug-sections")
+
+  subprocess.check_output([args.llvm_objcopy_binary_path] + objcopy_args)
+  subprocess.check_output([
+      args.llvm_strip_binary_path,
+      "--strip-debug",
+      "--strip-unneeded",
+      "-o",
+      args.stripped_binary_output,
+      args.binary_input,
+  ])
+  subprocess.check_output([
+      args.llvm_objcopy_binary_path,
+      f"--add-gnu-debuglink={args.symbol_output}",
+      args.stripped_binary_output,
+  ])
+
+  return 0
+
+
+if __name__ == "__main__":
+  sys.exit(main())

build/siso/backend.star

@@ -0,0 +1,21 @@
+# -*- bazel-starlark -*-
+
+load("@builtin//struct.star", "module")
+
+def __platform_properties(ctx):
+    container_image = "docker://gcr.io/chops-public-images-prod/rbe/siso-chromium/linux@sha256:d7cb1ab14a0f20aa669c23f22c15a9dead761dcac19f43985bf9dd5f41fbef3a"
+    return {
+        "default": {
+            "OSFamily": "Linux",
+            "container-image": container_image,
+        },
+        "large": {
+            "OSFamily": "Linux",
+            "container-image": container_image,
+        },
+    }
+
+backend = module(
+    "backend",
+    platform_properties = __platform_properties,
+)

build/siso/main.star

@@ -0,0 +1,66 @@
+load("@builtin//encoding.star", "json")
+load("@builtin//path.star", "path")
+load("@builtin//runtime.star", "runtime")
+load("@builtin//struct.star", "module")
+load("@config//main.star", upstream_init = "init")
+load("@config//win_sdk.star", "win_sdk")
+load("@config//gn_logs.star", "gn_logs")
+
+def init(ctx):
+    mod = upstream_init(ctx)
+    step_config = json.decode(mod.step_config)
+
+    # Buildbarn doesn't support input_root_absolute_path so disable that
+    for rule in step_config["rules"]:    
+      input_root_absolute_path = rule.get("input_root_absolute_path", False)
+      if input_root_absolute_path:
+        rule.pop("input_root_absolute_path", None)
+
+    # Only wrap clang rules with a remote wrapper if not on Linux. These are currently only
+    # needed for X-Compile builds, which run on Windows and Mac.
+    if runtime.os != "linux":
+      for rule in step_config["rules"]:
+        if rule["name"].startswith("clang/") or rule["name"].startswith("clang-cl/"):
+          rule["remote_wrapper"] = "../../buildtools/reclient_cfgs/chromium-browser-clang/clang_remote_wrapper"
+          if "inputs" not in rule:
+            rule["inputs"] = []
+          rule["inputs"].append("buildtools/reclient_cfgs/chromium-browser-clang/clang_remote_wrapper")
+          rule["inputs"].append("third_party/llvm-build/Release+Asserts_linux/bin/clang")
+
+      if "executables" not in step_config:
+        step_config["executables"] = []
+      step_config["executables"].append("buildtools/reclient_cfgs/chromium-browser-clang/clang_remote_wrapper")
+      step_config["executables"].append("third_party/llvm-build/Release+Asserts_linux/bin/clang")
+
+    if runtime.os == "darwin":
+      # Update platforms to match our default siso config instead of reclient configs.
+      step_config["platforms"].update({
+          "clang": step_config["platforms"]["default"],
+          "clang_large": step_config["platforms"]["default"],          
+      })      
+
+    if runtime.os == "windows":
+      # Add additional Windows SDK headers needed by Electron      
+      win_toolchain_dir = win_sdk.toolchain_dir(ctx)
+      if win_toolchain_dir:
+        sdk_version = gn_logs.read(ctx).get("windows_sdk_version")
+        step_config["input_deps"][win_toolchain_dir + ":headers"].extend([
+          # third_party/electron_node/deps/uv/include/uv/win.h includes mswsock.h
+          path.join(win_toolchain_dir, "Windows Kits/10/Include", sdk_version, "um/mswsock.h"),
+          # third_party/electron_node/src/debug_utils.cc includes lm.h
+          path.join(win_toolchain_dir, "Windows Kits/10/Include", sdk_version, "um/Lm.h"),          
+        ])
+      
+      # Update platforms to match our default siso config instead of reclient configs.
+      step_config["platforms"].update({
+          "clang-cl": step_config["platforms"]["default"],
+          "clang-cl_large": step_config["platforms"]["default"],
+          "lld-link": step_config["platforms"]["default"],
+      })
+
+    return module(
+      "config",
+      step_config = json.encode(step_config),
+      filegroups = mod.filegroups,
+      handlers = mod.handlers,
+    )

build/webpack/webpack.config.base.js

@@ -121,6 +121,7 @@ if ((globalThis.process || binding.process).argv.includes("--profile-electron-in
           'electron/main$': electronAPIFile,
           'electron/renderer$': electronAPIFile,
           'electron/common$': electronAPIFile,
+          'electron/utility$': electronAPIFile,
           // Force timers to resolve to our dependency that doesn't use window.postMessage
           timers: path.resolve(electronRoot, 'node_modules', 'timers-browserify', 'main.js')
         },
@@ -143,7 +144,9 @@ if ((globalThis.process || binding.process).argv.includes("--profile-electron-in
             transpileOnly: onlyPrintingGraph,
             ignoreDiagnostics: [
               // File '{0}' is not under 'rootDir' '{1}'.
-              6059
+              6059,
+              // Private field '{0}' must be declared in an enclosing class.
+              1111
             ]
           }
         }]

build/zip.py

@@ -41,6 +41,8 @@ PATHS_TO_SKIP = [
   'resources/inspector',
   'gen/third_party/devtools-frontend/src',
   'gen/ui/webui',
+  # Skip because these get zipped separately in script/zip-symbols.py
+  'debug',
 ]
 
 def skip_path(dep, dist_zip, target_cpu):
@@ -80,6 +82,11 @@ def main(argv):
       dep = dep.strip()
       if not skip_path(dep, dist_zip, target_cpu):
         dist_files.add(dep)
+  # On Linux, filter out any files which have a .stripped companion
+  if sys.platform == 'linux':
+    dist_files = {
+      dep for dep in dist_files if f"{dep.removeprefix('./')}.stripped" not in dist_files
+    }
   if sys.platform == 'darwin' and not should_flatten:
     execute(['zip', '-r', '-y', dist_zip] + list(dist_files))
   else:
@@ -96,10 +103,13 @@ def main(argv):
           dirname = os.path.dirname(dep)
           arcname = (
             os.path.join(dirname, 'chrome-sandbox')
-            if basename == 'chrome_sandbox'
+            if basename.removesuffix('.stripped') == 'chrome_sandbox'
             else dep
           )
           name_to_write = arcname
+          # On Linux, strip the .stripped suffix from the name before zipping
+          if sys.platform == 'linux':
+            name_to_write = name_to_write.removesuffix('.stripped')
           if should_flatten:
             if flatten_relative_to:
               if name_to_write.startswith(flatten_relative_to):

chromium_src/BUILD.gn

@@ -66,6 +66,8 @@ static_library("chrome") {
     "//chrome/browser/picture_in_picture/picture_in_picture_occlusion_tracker.h",
     "//chrome/browser/picture_in_picture/picture_in_picture_occlusion_tracker_observer.cc",
     "//chrome/browser/picture_in_picture/picture_in_picture_occlusion_tracker_observer.h",
+    "//chrome/browser/picture_in_picture/picture_in_picture_widget_fade_animator.cc",
+    "//chrome/browser/picture_in_picture/picture_in_picture_widget_fade_animator.h",
     "//chrome/browser/picture_in_picture/picture_in_picture_window_manager.cc",
     "//chrome/browser/picture_in_picture/picture_in_picture_window_manager.h",
     "//chrome/browser/picture_in_picture/picture_in_picture_window_manager_uma_helper.cc",
@@ -74,17 +76,13 @@ static_library("chrome") {
     "//chrome/browser/picture_in_picture/scoped_picture_in_picture_occlusion_observation.h",
     "//chrome/browser/platform_util.cc",
     "//chrome/browser/platform_util.h",
-    "//chrome/browser/predictors/preconnect_manager.cc",
-    "//chrome/browser/predictors/preconnect_manager.h",
     "//chrome/browser/predictors/predictors_features.cc",
     "//chrome/browser/predictors/predictors_features.h",
-    "//chrome/browser/predictors/proxy_lookup_client_impl.cc",
-    "//chrome/browser/predictors/proxy_lookup_client_impl.h",
-    "//chrome/browser/predictors/resolve_host_client_impl.cc",
-    "//chrome/browser/predictors/resolve_host_client_impl.h",
     "//chrome/browser/process_singleton.h",
     "//chrome/browser/process_singleton_internal.cc",
     "//chrome/browser/process_singleton_internal.h",
+    "//chrome/browser/serial/serial_blocklist.cc",
+    "//chrome/browser/serial/serial_blocklist.h",
     "//chrome/browser/themes/browser_theme_pack.cc",
     "//chrome/browser/themes/browser_theme_pack.h",
     "//chrome/browser/themes/custom_theme_supplier.cc",
@@ -126,8 +124,12 @@ static_library("chrome") {
     "//chrome/browser/ui/views/overlay/hang_up_button.h",
     "//chrome/browser/ui/views/overlay/minimize_button.cc",
     "//chrome/browser/ui/views/overlay/minimize_button.h",
+    "//chrome/browser/ui/views/overlay/overlay_controls_fade_animation.cc",
+    "//chrome/browser/ui/views/overlay/overlay_controls_fade_animation.h",
     "//chrome/browser/ui/views/overlay/overlay_window_image_button.cc",
     "//chrome/browser/ui/views/overlay/overlay_window_image_button.h",
+    "//chrome/browser/ui/views/overlay/overlay_window_live_caption_button.cc",
+    "//chrome/browser/ui/views/overlay/overlay_window_live_caption_button.h",
     "//chrome/browser/ui/views/overlay/playback_image_button.cc",
     "//chrome/browser/ui/views/overlay/playback_image_button.h",
     "//chrome/browser/ui/views/overlay/resize_handle_button.cc",
@@ -140,10 +142,18 @@ static_library("chrome") {
     "//chrome/browser/ui/views/overlay/toggle_camera_button.h",
     "//chrome/browser/ui/views/overlay/toggle_microphone_button.cc",
     "//chrome/browser/ui/views/overlay/toggle_microphone_button.h",
+    "//chrome/browser/ui/views/overlay/video_overlay_window_native_widget_mac.h",
+    "//chrome/browser/ui/views/overlay/video_overlay_window_native_widget_mac.mm",
     "//chrome/browser/ui/views/overlay/video_overlay_window_views.cc",
     "//chrome/browser/ui/views/overlay/video_overlay_window_views.h",
+    "//chrome/browser/ui/views/picture_in_picture/picture_in_picture_bounds_change_animation.cc",
+    "//chrome/browser/ui/views/picture_in_picture/picture_in_picture_bounds_change_animation.h",
+    "//chrome/browser/ui/views/picture_in_picture/picture_in_picture_tucker.cc",
+    "//chrome/browser/ui/views/picture_in_picture/picture_in_picture_tucker.h",
     "//chrome/browser/ui/webui/accessibility/accessibility_ui.cc",
     "//chrome/browser/ui/webui/accessibility/accessibility_ui.h",
+    "//chrome/browser/usb/usb_blocklist.cc",
+    "//chrome/browser/usb/usb_blocklist.h",
     "//extensions/browser/app_window/size_constraints.cc",
     "//extensions/browser/app_window/size_constraints.h",
     "//ui/base/accelerators/global_accelerator_listener/global_accelerator_listener.cc",
@@ -203,7 +213,7 @@ static_library("chrome") {
     "//components/enterprise/common/proto:connectors_proto",
     "//components/enterprise/obfuscation/core:enterprise_obfuscation",
     "//components/safe_browsing/core/browser/db:safebrowsing_proto",
-    "//components/vector_icons:vector_icons",
+    "//components/vector_icons",
     "//ui/base/accelerators/global_accelerator_listener",
     "//ui/snapshot",
     "//ui/views/controls/webview",
@@ -213,8 +223,8 @@ static_library("chrome") {
     sources += [
       "//chrome/browser/platform_util_aura.cc",
       "//chrome/browser/ui/views/eye_dropper/eye_dropper_aura.cc",
-      "//ui/views/native_window_tracker_aura.cc",
-      "//ui/views/native_window_tracker_aura.h",
+      "//ui/native_window_tracker/native_window_tracker_aura.cc",
+      "//ui/native_window_tracker/native_window_tracker_aura.h",
     ]
     deps += [ "//components/eye_dropper" ]
   }

docs/.eslintrc.json

@@ -0,0 +1,35 @@
+{
+  "extends": "standard",
+  "plugins": [
+    "import",
+    "markdown"
+  ],
+  "overrides": [
+    {
+      "files": ["*.md", "**/*.md"],
+      "processor": "markdown/markdown"
+    }
+  ],
+  "rules": {
+    "@typescript-eslint/no-unused-vars": "off",
+    "import/order": ["error", {
+      "alphabetize": {
+        "order": "asc"
+      },
+      "newlines-between": "always",
+      "pathGroups": [
+        {
+          "pattern": "{electron,electron/**}",
+          "group": "builtin",
+          "position": "before"
+        }
+      ],
+      "pathGroupsExcludedImportTypes": []
+    }],
+    "n/no-callback-literal": "off",
+    "no-undef": "off",
+    "no-unused-expressions": "off",
+    "no-unused-vars": "off",
+    "import/enforce-node-protocol-usage": ["error", "always"]
+  }
+}

docs/api/accelerator.md

@@ -1,82 +0,0 @@
-# Accelerator
-
-> Define keyboard shortcuts.
-
-Accelerators are strings that can contain multiple modifiers and a single key code,
-combined by the `+` character, and are used to define keyboard shortcuts
-throughout your application. Accelerators are case insensitive.
-
-Examples:
-
-* `CommandOrControl+A`
-* `CommandOrControl+Shift+Z`
-
-Shortcuts are registered with the [`globalShortcut`](global-shortcut.md) module
-using the [`register`](global-shortcut.md#globalshortcutregisteraccelerator-callback)
-method, i.e.
-
-```js
-const { app, globalShortcut } = require('electron')
-
-app.whenReady().then(() => {
-  // Register a 'CommandOrControl+Y' shortcut listener.
-  globalShortcut.register('CommandOrControl+Y', () => {
-    // Do stuff when Y and either Command/Control is pressed.
-  })
-})
-```
-
-## Platform notice
-
-On Linux and Windows, the `Command` key does not have any effect so
-use `CommandOrControl` which represents `Command` on macOS and `Control` on
-Linux and Windows to define some accelerators.
-
-Use `Alt` instead of `Option`. The `Option` key only exists on macOS, whereas
-the `Alt` key is available on all platforms.
-
-The `Super` (or `Meta`) key is mapped to the `Windows` key on Windows and Linux and
-`Cmd` on macOS.
-
-## Available modifiers
-
-* `Command` (or `Cmd` for short)
-* `Control` (or `Ctrl` for short)
-* `CommandOrControl` (or `CmdOrCtrl` for short)
-* `Alt`
-* `Option`
-* `AltGr`
-* `Shift`
-* `Super`
-* `Meta`
-
-## Available key codes
-
-* `0` to `9`
-* `A` to `Z`
-* `F1` to `F24`
-* Various Punctuation: `)`, `!`, `@`, `#`, `$`, `%`, `^`, `&`, `*`, `(`, `:`, `;`, `:`, `+`, `=`, `<`, `,`, `_`, `-`, `>`, `.`, `?`, `/`, `~`, `` ` ``, `{`, `]`, `[`, `|`, `\`, `}`, `"`
-* `Plus`
-* `Space`
-* `Tab`
-* `Capslock`
-* `Numlock`
-* `Scrolllock`
-* `Backspace`
-* `Delete`
-* `Insert`
-* `Return` (or `Enter` as alias)
-* `Up`, `Down`, `Left` and `Right`
-* `Home` and `End`
-* `PageUp` and `PageDown`
-* `Escape` (or `Esc` for short)
-* `VolumeUp`, `VolumeDown` and `VolumeMute`
-* `MediaNextTrack`, `MediaPreviousTrack`, `MediaStop` and `MediaPlayPause`
-* `PrintScreen`
-* NumPad Keys
-  * `num0` - `num9`
-  * `numdec` - decimal key
-  * `numadd` - numpad `+` key
-  * `numsub` - numpad `-` key
-  * `nummult` - numpad `*` key
-  * `numdiv` - numpad `÷` key

docs/api/app.md

@@ -9,6 +9,7 @@ closed:
 
 ```js
 const { app } = require('electron')
+
 app.on('window-all-closed', () => {
   app.quit()
 })
@@ -601,6 +602,7 @@ Returns `string` - The current application directory.
     * `%APPDATA%` on Windows
     * `$XDG_CONFIG_HOME` or `~/.config` on Linux
     * `~/Library/Application Support` on macOS
+  * `assets` The directory where app assets such as `resources.pak` are stored. By default this is the same as the folder containing the `exe` path. Available on Windows and Linux only.
   * `userData` The directory for storing your app's configuration files, which
     by default is the `appData` directory appended with your app's name. By
     convention files storing user data should be written to this directory, and
@@ -615,7 +617,7 @@ Returns `string` - The current application directory.
     directory.
   * `temp` Temporary directory.
   * `exe` The current executable file.
-  * `module` The `libchromiumcontent` library.
+  * `module` The location of the Chromium module. By default this is synonymous with `exe`.
   * `desktop` The current user's Desktop directory.
   * `documents` Directory for a user's "My Documents".
   * `downloads` Directory for a user's downloads.
@@ -1039,6 +1041,7 @@ starts:
 
 ```js
 const { app, BrowserWindow } = require('electron')
+
 let myWindow = null
 
 const additionalData = { myKey: 'myValue' }
@@ -1242,6 +1245,8 @@ For `infoType` equal to `complete`:
 For `infoType` equal to `basic`:
   Promise is fulfilled with `Object` containing fewer attributes than when requested with `complete`. Here's an example of basic response:
 
+<!-- eslint-skip -->
+
 ```js
 {
   auxAttributes:
@@ -1355,6 +1360,7 @@ latest version.
 
 ``` js
 const { app } = require('electron')
+
 const path = require('node:path')
 
 const appFolder = path.dirname(process.execPath)
@@ -1429,6 +1435,7 @@ Returns `Function` - This function **must** be called once you have finished acc
 
 ```js
 const { app, dialog } = require('electron')
+
 const fs = require('node:fs')
 
 let filepath

docs/api/base-window.md

@@ -298,6 +298,7 @@ e.g. `APPCOMMAND_BROWSER_BACKWARD` is emitted as `browser-backward`.
 
 ```js
 const { BaseWindow } = require('electron')
+
 const win = new BaseWindow()
 win.on('app-command', (e, cmd) => {
   // Navigate the window back when the user hits their mouse back button
@@ -506,6 +507,7 @@ A `boolean` property that determines whether the window is excluded from the app
 
 ```js @ts-expect-error=[12]
 const { Menu, BaseWindow } = require('electron')
+
 const win = new BaseWindow({ height: 600, width: 600 })
 
 const template = [
@@ -731,6 +733,7 @@ Resizes and moves the window to the supplied bounds. Any properties that are not
 
 ```js
 const { BaseWindow } = require('electron')
+
 const win = new BaseWindow()
 
 // set all bounds properties
@@ -991,6 +994,7 @@ a HTML-rendered toolbar. For example:
 
 ```js
 const { BaseWindow } = require('electron')
+
 const win = new BaseWindow()
 
 const toolbarRect = document.getElementById('toolbar').getBoundingClientRect()

docs/api/browser-window.md

@@ -40,6 +40,7 @@ the window after this event will have no visual flash:
 
 ```js
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow({ show: false })
 win.once('ready-to-show', () => {
   win.show()
@@ -377,6 +378,7 @@ e.g. `APPCOMMAND_BROWSER_BACKWARD` is emitted as `browser-backward`.
 
 ```js
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow()
 win.on('app-command', (e, cmd) => {
   // Navigate the window back when the user hits their mouse back button
@@ -824,6 +826,7 @@ Resizes and moves the window to the supplied bounds. Any properties that are not
 
 ```js
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow()
 
 // set all bounds properties
@@ -1084,6 +1087,7 @@ a HTML-rendered toolbar. For example:
 
 ```js
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow()
 
 const toolbarRect = document.getElementById('toolbar').getBoundingClientRect()
@@ -1236,9 +1240,10 @@ method:
 
 ```js
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow()
 
-const url = require('url').format({
+const url = require('node:url').format({
   protocol: 'file',
   slashes: true,
   pathname: require('node:path').join(__dirname, 'index.html')
@@ -1252,6 +1257,7 @@ the following:
 
 ```js
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow()
 
 win.loadURL('http://localhost:8000/post', {
@@ -1564,11 +1570,18 @@ events.
 
 Prevents the window contents from being captured by other apps.
 
-On macOS it sets the NSWindow's sharingType to NSWindowSharingNone.
-On Windows it calls SetWindowDisplayAffinity with `WDA_EXCLUDEFROMCAPTURE`.
+On Windows, it calls [`SetWindowDisplayAffinity`](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowdisplayaffinity) with `WDA_EXCLUDEFROMCAPTURE`.
 For Windows 10 version 2004 and up the window will be removed from capture entirely,
 older Windows versions behave as if `WDA_MONITOR` is applied capturing a black window.
 
+On macOS, it sets the `NSWindow`'s
+[`sharingType`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.property?language=objc)
+to
+[`NSWindowSharingNone`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.enum/none?language=objc).
+Unfortunately, due to an intentional change in macOS, newer Mac applications that use
+`ScreenCaptureKit` will capture your window despite `win.setContentProtection(true)`.
+See [here](https://github.com/electron/electron/issues/48258#issuecomment-3269893618).
+
 #### `win.isContentProtected()` _macOS_ _Windows_
 
 Returns `boolean` - whether or not content protection is currently enabled.

docs/api/clipboard.md

@@ -4,6 +4,12 @@
 
 Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process) (non-sandboxed only)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 On Linux, there is also a `selection` clipboard. To manipulate it
 you need to pass `selection` to each method:
 

docs/api/command-line-switches.md

@@ -8,6 +8,7 @@ is emitted:
 
 ```js
 const { app } = require('electron')
+
 app.commandLine.appendSwitch('remote-debugging-port', '8315')
 app.commandLine.appendSwitch('host-rules', 'MAP * 127.0.0.1')
 
@@ -188,6 +189,7 @@ For example:
 
 ```js
 const { app } = require('electron')
+
 app.commandLine.appendSwitch('proxy-bypass-list', '<local>;*.google.com;*foo.com;1.2.3.4:5678')
 ```
 
@@ -290,7 +292,7 @@ Specify ways of the inspector web socket url exposure.
 
 By default inspector websocket url is available in stderr and under /json/list endpoint on `http://host:port/json/list`.
 
-### `--experimental-network-inspector`
+### `--experimental-network-inspection`
 
 Enable support for devtools network inspector events, for visibility into requests made by the nodejs `http` and `https` modules.
 

docs/api/command-line.md

@@ -9,6 +9,7 @@ The following example shows how to check if the `--disable-gpu` flag is set.
 
 ```js
 const { app } = require('electron')
+
 app.commandLine.hasSwitch('disable-gpu')
 ```
 

docs/api/context-bridge.md

@@ -189,7 +189,9 @@ Be very cautious about which globals and APIs you expose to untrusted remote con
 
 ```js
 const { contextBridge } = require('electron')
+
 const crypto = require('node:crypto')
+
 contextBridge.exposeInMainWorld('nodeCrypto', {
   sha256sum (data) {
     const hash = crypto.createHash('sha256')

docs/api/corner-smoothing-css.md

@@ -51,19 +51,17 @@ Use the `system-ui` keyword to match the smoothness to the OS design language.
 
 ### Controlling availibility
 
-This CSS rule can be disabled by setting [the `cornerSmoothingCSS` web preference](./structures/web-preferences.md) to `false`.
+This CSS rule can be disabled using the Blink feature flag `ElectronCSSCornerSmoothing`.
 
 ```js
 const myWindow = new BrowserWindow({
   // [...]
   webPreferences: {
-    enableCornerSmoothingCSS: false // Disables the `-electron-corner-smoothing` CSS rule
+    disableBlinkFeatures: 'ElectronCSSCornerSmoothing' // Disables the `-electron-corner-smoothing` CSS rule
   }
 })
 ```
 
-The CSS rule will still parse, but will have no visual effect.
-
 ### Formal reference
 
 * **Initial value**: `0%`

docs/api/crash-reporter.md

@@ -4,6 +4,12 @@
 
 Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 The following is an example of setting up Electron to automatically submit
 crash reports to a remote server:
 
@@ -63,7 +69,7 @@ The `crashReporter` module has the following methods:
   * `extra` Record\<string, string\> (optional) - Extra string key/value
     annotations that will be sent along with crash reports that are generated
     in the main process. Only string values are supported. Crashes generated in
-    child processes will not contain these extra
+    child processes will not include these extra parameters. To add extra
     parameters to crash reports generated from child processes, call
     [`addExtraParameter`](#crashreporteraddextraparameterkey-value) from the
     child process.

docs/api/debugger.md

@@ -10,6 +10,7 @@ runtime that allows interacting with pages and instrumenting them.
 
 ```js
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow()
 
 try {

docs/api/dialog.md

@@ -8,6 +8,7 @@ An example of showing a dialog to select multiple files:
 
 ```js
 const { dialog } = require('electron')
+
 console.log(dialog.showOpenDialog({ properties: ['openFile', 'multiSelections'] }))
 ```
 
@@ -52,6 +53,8 @@ The `window` argument allows the dialog to attach itself to a parent window, mak
 The `filters` specifies an array of file types that can be displayed or
 selected when you want to limit the user to a specific type. For example:
 
+<!-- eslint-skip -->
+
 ```js
 {
   filters: [
@@ -126,6 +129,8 @@ The `window` argument allows the dialog to attach itself to a parent window, mak
 The `filters` specifies an array of file types that can be displayed or
 selected when you want to limit the user to a specific type. For example:
 
+<!-- eslint-skip -->
+
 ```js
 {
   filters: [

docs/api/dock.md

@@ -5,12 +5,8 @@
 Process: [Main](../glossary.md#main-process)<br />
 _This class is not exported from the `'electron'` module. It is only available as a return value of other methods in the Electron API._
 
-The following example shows how to bounce your icon on the dock.
-
-```js
-const { app } = require('electron')
-app.dock?.bounce()
-```
+> [!TIP]
+> See also: [A detailed guide about how to implement Dock menus](../tutorial/macos-dock.md).
 
 ### Instance Methods
 
@@ -49,6 +45,9 @@ Bounces the Downloads stack if the filePath is inside the Downloads folder.
 
 Sets the string to be displayed in the dock’s badging area.
 
+> [!IMPORTANT]
+> You need to ensure that your application has the permission to display notifications for this method to work.
+
 #### `dock.getBadge()` _macOS_
 
 Returns `string` - The badge string of the dock.

docs/api/download-item.md

@@ -12,6 +12,7 @@ control the download item.
 ```js
 // In the main process.
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow()
 win.webContents.session.on('will-download', (event, item, webContents) => {
   // Set the save path, making Electron not to prompt a save dialog.

docs/api/environment-variables.md

@@ -125,16 +125,6 @@ Options:
 * `kioclient5`
 * `kioclient`
 
-### `ELECTRON_OZONE_PLATFORM_HINT` _Linux_
-
-Selects the preferred platform backend used on Linux. The default one is `x11`. `auto` selects Wayland if possible, X11 otherwise.
-
-Options:
-
-* `auto`
-* `wayland`
-* `x11`
-
 ## Development Variables
 
 The following environment variables are intended primarily for development and

docs/api/extensions-api.md

@@ -77,6 +77,7 @@ extension to be loaded.
 
 ```js
 const { app, session } = require('electron')
+
 const path = require('node:path')
 
 app.whenReady().then(async () => {

docs/api/global-shortcut.md

@@ -46,13 +46,16 @@ app.on('will-quit', () => {
 })
 ```
 
+> [!TIP]
+> See also: [A detailed guide on Keyboard Shortcuts](../tutorial/keyboard-shortcuts.md).
+
 ## Methods
 
 The `globalShortcut` module has the following methods:
 
 ### `globalShortcut.register(accelerator, callback)`
 
-* `accelerator` [Accelerator](accelerator.md)
+* `accelerator` string - An [accelerator](../tutorial/keyboard-shortcuts.md#accelerators) shortcut.
 * `callback` Function
 
 Returns `boolean` - Whether or not the shortcut was registered successfully.
@@ -74,7 +77,7 @@ the app has been authorized as a [trusted accessibility client](https://develope
 
 ### `globalShortcut.registerAll(accelerators, callback)`
 
-* `accelerators` [Accelerator](accelerator.md)[] - an array of [Accelerator](accelerator.md)s.
+* `accelerators` string[] - An array of [accelerator](../tutorial/keyboard-shortcuts.md#accelerators) shortcuts.
 * `callback` Function
 
 Registers a global shortcut of all `accelerator` items in `accelerators`. The `callback` is called when any of the registered shortcuts are pressed by the user.
@@ -93,7 +96,7 @@ the app has been authorized as a [trusted accessibility client](https://develope
 
 ### `globalShortcut.isRegistered(accelerator)`
 
-* `accelerator` [Accelerator](accelerator.md)
+* `accelerator` string - An [accelerator](../tutorial/keyboard-shortcuts.md#accelerators) shortcut.
 
 Returns `boolean` - Whether this application has registered `accelerator`.
 
@@ -103,7 +106,7 @@ don't want applications to fight for global shortcuts.
 
 ### `globalShortcut.unregister(accelerator)`
 
-* `accelerator` [Accelerator](accelerator.md)
+* `accelerator` string - An [accelerator](../tutorial/keyboard-shortcuts.md#accelerators) shortcut.
 
 Unregisters the global shortcut of `accelerator`.
 

docs/api/image-view.md

@@ -14,6 +14,7 @@ Note that `ImageView` is experimental and may be changed or removed in the futur
 
 ```js
 const { BaseWindow, ImageView, nativeImage, WebContentsView } = require('electron')
+
 const path = require('node:path')
 
 const win = new BaseWindow({ width: 800, height: 600 })

docs/api/ipc-renderer.md

@@ -20,6 +20,12 @@ changes:
 
 Process: [Renderer](../glossary.md#renderer-process)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 The `ipcRenderer` module is an  [EventEmitter][event-emitter]. It provides a few
 methods so you can send synchronous and asynchronous messages from the render
 process (web page) to the main process. You can also receive replies from the

docs/api/menu-item.md

@@ -1,3 +1,5 @@
+# MenuItem
+
 ## Class: MenuItem
 
 > Add items to native application menus and context menus.
@@ -19,13 +21,19 @@ See [`Menu`](menu.md) for examples.
     * `window` [BaseWindow](base-window.md) | undefined - This will not be defined if no window is open.
     * `event` [KeyboardEvent](structures/keyboard-event.md)
   * `role` string (optional) - Can be `undo`, `redo`, `cut`, `copy`, `paste`, `pasteAndMatchStyle`, `delete`, `selectAll`, `reload`, `forceReload`, `toggleDevTools`, `resetZoom`, `zoomIn`, `zoomOut`, `toggleSpellChecker`, `togglefullscreen`, `window`, `minimize`, `close`, `help`, `about`, `services`, `hide`, `hideOthers`, `unhide`, `quit`, `showSubstitutions`, `toggleSmartQuotes`, `toggleSmartDashes`, `toggleTextReplacement`, `startSpeaking`, `stopSpeaking`, `zoom`, `front`, `appMenu`, `fileMenu`, `editMenu`, `viewMenu`, `shareMenu`, `recentDocuments`, `toggleTabBar`, `selectNextTab`, `selectPreviousTab`, `showAllTabs`, `mergeAllWindows`, `clearRecentDocuments`, `moveTabToNewWindow` or `windowMenu` - Define the action of the menu item, when specified the
-    `click` property will be ignored. See [roles](#roles).
-  * `type` string (optional) - Can be `normal`, `separator`, `submenu`, `checkbox` or
-    `radio`.
+    `click` property will be ignored. See [roles](../tutorial/menus.md#roles).
+  * `type` string (optional)
+    * `normal`
+    * `separator`
+    * `submenu`
+    * `checkbox`
+    * `radio`
+    * `header` - Only available on macOS 14 and up.
+    * `palette` - Only available on macOS 14 and up.
   * `label` string (optional)
   * `sublabel` string (optional) _macOS_ - Available in macOS >= 14.4
   * `toolTip` string (optional) _macOS_ - Hover text for this menu item.
-  * `accelerator` [Accelerator](accelerator.md) (optional)
+  * `accelerator` string (optional) - An [Accelerator](../tutorial/keyboard-shortcuts.md#accelerators) string.
   * `icon` ([NativeImage](native-image.md) | string) (optional)
   * `enabled` boolean (optional) - If false, the menu item will be greyed out and
     unclickable.
@@ -58,88 +66,13 @@ See [`Menu`](menu.md) for examples.
 > [!NOTE]
 > `acceleratorWorksWhenHidden` is specified as being macOS-only because accelerators always work when items are hidden on Windows and Linux. The option is exposed to users to give them the option to turn it off, as this is possible in native macOS development.
 
-### Roles
-
-Roles allow menu items to have predefined behaviors.
-
-It is best to specify `role` for any menu item that matches a standard role,
-rather than trying to manually implement the behavior in a `click` function.
-The built-in `role` behavior will give the best native experience.
-
-The `label` and `accelerator` values are optional when using a `role` and will
-default to appropriate values for each platform.
-
-Every menu item must have either a `role`, `label`, or in the case of a separator
-a `type`.
-
-The `role` property can have following values:
-
-* `undo`
-* `about` - Trigger a native about panel (custom message box on Window, which does not provide its own).
-* `redo`
-* `cut`
-* `copy`
-* `paste`
-* `pasteAndMatchStyle`
-* `selectAll`
-* `delete`
-* `minimize` - Minimize current window.
-* `close` - Close current window.
-* `quit` - Quit the application.
-* `reload` - Reload the current window.
-* `forceReload` - Reload the current window ignoring the cache.
-* `toggleDevTools` - Toggle developer tools in the current window.
-* `togglefullscreen` - Toggle full screen mode on the current window.
-* `resetZoom` - Reset the focused page's zoom level to the original size.
-* `zoomIn` - Zoom in the focused page by 10%.
-* `zoomOut` - Zoom out the focused page by 10%.
-* `toggleSpellChecker` - Enable/disable builtin spell checker.
-* `fileMenu` - Whole default "File" menu (Close / Quit)
-* `editMenu` - Whole default "Edit" menu (Undo, Copy, etc.).
-* `viewMenu` - Whole default "View" menu (Reload, Toggle Developer Tools, etc.)
-* `windowMenu` - Whole default "Window" menu (Minimize, Zoom, etc.).
-
-The following additional roles are available on _macOS_:
-
-* `appMenu` - Whole default "App" menu (About, Services, etc.)
-* `hide` - Map to the `hide` action.
-* `hideOthers` - Map to the `hideOtherApplications` action.
-* `unhide` - Map to the `unhideAllApplications` action.
-* `showSubstitutions` - Map to the `orderFrontSubstitutionsPanel` action.
-* `toggleSmartQuotes` - Map to the `toggleAutomaticQuoteSubstitution` action.
-* `toggleSmartDashes` - Map to the `toggleAutomaticDashSubstitution` action.
-* `toggleTextReplacement` - Map to the `toggleAutomaticTextReplacement` action.
-* `startSpeaking` - Map to the `startSpeaking` action.
-* `stopSpeaking` - Map to the `stopSpeaking` action.
-* `front` - Map to the `arrangeInFront` action.
-* `zoom` - Map to the `performZoom` action.
-* `toggleTabBar` - Map to the `toggleTabBar` action.
-* `selectNextTab` - Map to the `selectNextTab` action.
-* `selectPreviousTab` - Map to the `selectPreviousTab` action.
-* `showAllTabs` - Map to the `showAllTabs` action.
-* `mergeAllWindows` - Map to the `mergeAllWindows` action.
-* `moveTabToNewWindow` - Map to the `moveTabToNewWindow` action.
-* `window` - The submenu is a "Window" menu.
-* `help` - The submenu is a "Help" menu.
-* `services` - The submenu is a ["Services"](https://developer.apple.com/documentation/appkit/nsapplication/1428608-servicesmenu?language=objc) menu. This is only intended for use in the Application Menu and is _not_ the same as the "Services" submenu used in context menus in macOS apps, which is not implemented in Electron.
-* `recentDocuments` - The submenu is an "Open Recent" menu.
-* `clearRecentDocuments` - Map to the `clearRecentDocuments` action.
-* `shareMenu` - The submenu is [share menu][ShareMenu]. The `sharingItem` property must also be set to indicate the item to share.
-
-When specifying a `role` on macOS, `label` and `accelerator` are the only
-options that will affect the menu item. All other options will be ignored.
-Lowercase `role`, e.g. `toggledevtools`, is still supported.
-
-> [!NOTE]
-> The `enabled` and `visibility` properties are not available for top-level menu items in the tray on macOS.
-
 ### Instance Properties
 
 The following properties are available on instances of `MenuItem`:
 
 #### `menuItem.id`
 
-A `string` indicating the item's unique id, this property can be
+A `string` indicating the item's unique id. This property can be
 dynamically changed.
 
 #### `menuItem.label`
@@ -162,7 +95,10 @@ item's submenu, if present.
 
 #### `menuItem.type`
 
-A `string` indicating the type of the item. Can be `normal`, `separator`, `submenu`, `checkbox` or `radio`.
+A `string` indicating the type of the item. Can be `normal`, `separator`, `submenu`, `checkbox`, `radio`, `header` or `palette`.
+
+> [!NOTE]
+> `header` and `palette` are only available on macOS 14 and up.
 
 #### `menuItem.role`
 
@@ -194,17 +130,17 @@ A `string` indicating the item's hover text.
 
 #### `menuItem.enabled`
 
-A `boolean` indicating whether the item is enabled, this property can be
+A `boolean` indicating whether the item is enabled. This property can be
 dynamically changed.
 
 #### `menuItem.visible`
 
-A `boolean` indicating whether the item is visible, this property can be
+A `boolean` indicating whether the item is visible. This property can be
 dynamically changed.
 
 #### `menuItem.checked`
 
-A `boolean` indicating whether the item is checked, this property can be
+A `boolean` indicating whether the item is checked. This property can be
 dynamically changed.
 
 A `checkbox` menu item will toggle the `checked` property on and off when
@@ -235,5 +171,3 @@ A `number` indicating an item's sequential unique id.
 #### `menuItem.menu`
 
 A `Menu` that the item is a part of.
-
-[ShareMenu]: https://developer.apple.com/design/human-interface-guidelines/macos/extensions/share-extensions/

docs/api/menu.md

@@ -6,6 +6,9 @@
 
 Process: [Main](../glossary.md#main-process)
 
+> [!TIP]
+> See also: [A detailed guide about how to implement menus in your application](../tutorial/menus.md).
+
 > [!WARNING]
 > Electron's built-in classes cannot be subclassed in user code.
 > For more information, see [the FAQ](../faq.md#class-inheritance-does-not-work-with-electron-built-in-modules).
@@ -20,7 +23,7 @@ The `Menu` class has the following static methods:
 
 #### `Menu.setApplicationMenu(menu)`
 
-* `menu` Menu | null
+- `menu` Menu | null
 
 Sets `menu` as the application menu on macOS. On Windows and Linux, the
 `menu` will be set as each window's top menu.
@@ -51,18 +54,18 @@ Returns `Menu | null` - The application menu, if set, or `null`, if not set.
 
 #### `Menu.sendActionToFirstResponder(action)` _macOS_
 
-* `action` string
+- `action` string
 
 Sends the `action` to the first responder of application. This is used for
 emulating default macOS menu behaviors. Usually you would use the
-[`role`](menu-item.md#roles) property of a [`MenuItem`](menu-item.md).
+[`role`](../tutorial/menus.md#roles) property of a [`MenuItem`](menu-item.md).
 
 See the [macOS Cocoa Event Handling Guide](https://developer.apple.com/library/mac/documentation/Cocoa/Conceptual/EventOverview/EventArchitecture/EventArchitecture.html#//apple_ref/doc/uid/10000060i-CH3-SW7)
 for more information on macOS' native actions.
 
 #### `Menu.buildFromTemplate(template)`
 
-* `template` (MenuItemConstructorOptions | MenuItem)[]
+- `template` (MenuItemConstructorOptions | MenuItem)[]
 
 Returns `Menu`
 
@@ -77,47 +80,50 @@ The `menu` object has the following instance methods:
 
 #### `menu.popup([options])`
 
-* `options` Object (optional)
-  * `window` [BaseWindow](base-window.md) (optional) - Default is the focused window.
-  * `frame` [WebFrameMain](web-frame-main.md) (optional) - Provide the relevant frame
+- `options` Object (optional)
+  - `window` [BaseWindow](base-window.md) (optional) - Default is the focused window.
+  - `frame` [WebFrameMain](web-frame-main.md) (optional) - Provide the relevant frame
     if you want certain OS-level features such as Writing Tools on macOS to function correctly. Typically, this should be `params.frame` from the [`context-menu` event](web-contents.md#event-context-menu) on a WebContents, or the [`focusedFrame` property](web-contents.md#contentsfocusedframe-readonly) of a WebContents.
-  * `x` number (optional) - Default is the current mouse cursor position.
+  - `x` number (optional) - Default is the current mouse cursor position.
     Must be declared if `y` is declared.
-  * `y` number (optional) - Default is the current mouse cursor position.
+  - `y` number (optional) - Default is the current mouse cursor position.
     Must be declared if `x` is declared.
-  * `positioningItem` number (optional) _macOS_ - The index of the menu item to
+  - `positioningItem` number (optional) _macOS_ - The index of the menu item to
     be positioned under the mouse cursor at the specified coordinates. Default
     is -1.
-  * `sourceType` string (optional) _Windows_ _Linux_ - This should map to the `menuSourceType`
+  - `sourceType` string (optional) _Windows_ _Linux_ - This should map to the `menuSourceType`
     provided by the `context-menu` event. It is not recommended to set this value manually,
     only provide values you receive from other APIs or leave it `undefined`.
     Can be `none`, `mouse`, `keyboard`, `touch`, `touchMenu`, `longPress`, `longTap`, `touchHandle`, `stylus`, `adjustSelection`, or `adjustSelectionReset`.
-  * `callback` Function (optional) - Called when menu is closed.
+  - `callback` Function (optional) - Called when menu is closed.
 
 Pops up this menu as a context menu in the [`BaseWindow`](base-window.md).
 
+> [!TIP]
+> For more details, see the [Context Menu](../tutorial/context-menu.md) guide.
+
 #### `menu.closePopup([window])`
 
-* `window` [BaseWindow](base-window.md) (optional) - Default is the focused window.
+- `window` [BaseWindow](base-window.md) (optional) - Default is the focused window.
 
 Closes the context menu in the `window`.
 
 #### `menu.append(menuItem)`
 
-* `menuItem` [MenuItem](menu-item.md)
+- `menuItem` [MenuItem](menu-item.md)
 
 Appends the `menuItem` to the menu.
 
 #### `menu.getMenuItemById(id)`
 
-* `id` string
+- `id` string
 
 Returns `MenuItem | null` the item with the specified `id`
 
 #### `menu.insert(pos, menuItem)`
 
-* `pos` Integer
-* `menuItem` [MenuItem](menu-item.md)
+- `pos` Integer
+- `menuItem` [MenuItem](menu-item.md)
 
 Inserts the `menuItem` to the `pos` position of the menu.
 
@@ -133,7 +139,7 @@ Objects created with `new Menu` or returned by `Menu.buildFromTemplate` emit the
 
 Returns:
 
-* `event` Event
+- `event` Event
 
 Emitted when `menu.popup()` is called.
 
@@ -141,7 +147,7 @@ Emitted when `menu.popup()` is called.
 
 Returns:
 
-* `event` Event
+- `event` Event
 
 Emitted when a popup is closed either manually or with `menu.closePopup()`.
 
@@ -153,296 +159,5 @@ Emitted when a popup is closed either manually or with `menu.closePopup()`.
 
 A `MenuItem[]` array containing the menu's items.
 
-Each `Menu` consists of multiple [`MenuItem`](menu-item.md)s and each `MenuItem`
-can have a submenu.
-
-## Examples
-
-An example of creating the application menu with the simple template API:
-
-```js @ts-expect-error=[107]
-const { app, Menu } = require('electron')
-
-const isMac = process.platform === 'darwin'
-
-const template = [
-  // { role: 'appMenu' }
-  ...(isMac
-    ? [{
-        label: app.name,
-        submenu: [
-          { role: 'about' },
-          { type: 'separator' },
-          { role: 'services' },
-          { type: 'separator' },
-          { role: 'hide' },
-          { role: 'hideOthers' },
-          { role: 'unhide' },
-          { type: 'separator' },
-          { role: 'quit' }
-        ]
-      }]
-    : []),
-  // { role: 'fileMenu' }
-  {
-    label: 'File',
-    submenu: [
-      isMac ? { role: 'close' } : { role: 'quit' }
-    ]
-  },
-  // { role: 'editMenu' }
-  {
-    label: 'Edit',
-    submenu: [
-      { role: 'undo' },
-      { role: 'redo' },
-      { type: 'separator' },
-      { role: 'cut' },
-      { role: 'copy' },
-      { role: 'paste' },
-      ...(isMac
-        ? [
-            { role: 'pasteAndMatchStyle' },
-            { role: 'delete' },
-            { role: 'selectAll' },
-            { type: 'separator' },
-            {
-              label: 'Speech',
-              submenu: [
-                { role: 'startSpeaking' },
-                { role: 'stopSpeaking' }
-              ]
-            }
-          ]
-        : [
-            { role: 'delete' },
-            { type: 'separator' },
-            { role: 'selectAll' }
-          ])
-    ]
-  },
-  // { role: 'viewMenu' }
-  {
-    label: 'View',
-    submenu: [
-      { role: 'reload' },
-      { role: 'forceReload' },
-      { role: 'toggleDevTools' },
-      { type: 'separator' },
-      { role: 'resetZoom' },
-      { role: 'zoomIn' },
-      { role: 'zoomOut' },
-      { type: 'separator' },
-      { role: 'togglefullscreen' }
-    ]
-  },
-  // { role: 'windowMenu' }
-  {
-    label: 'Window',
-    submenu: [
-      { role: 'minimize' },
-      { role: 'zoom' },
-      ...(isMac
-        ? [
-            { type: 'separator' },
-            { role: 'front' },
-            { type: 'separator' },
-            { role: 'window' }
-          ]
-        : [
-            { role: 'close' }
-          ])
-    ]
-  },
-  {
-    role: 'help',
-    submenu: [
-      {
-        label: 'Learn More',
-        click: async () => {
-          const { shell } = require('electron')
-          await shell.openExternal('https://electronjs.org')
-        }
-      }
-    ]
-  }
-]
-
-const menu = Menu.buildFromTemplate(template)
-Menu.setApplicationMenu(menu)
-```
-
-### Render process
-
-To create menus initiated by the renderer process, send the required
-information to the main process using IPC and have the main process display the
-menu on behalf of the renderer.
-
-Below is an example of showing a menu when the user right clicks the page:
-
-```js @ts-expect-error=[21]
-// renderer
-window.addEventListener('contextmenu', (e) => {
-  e.preventDefault()
-  ipcRenderer.send('show-context-menu')
-})
-
-ipcRenderer.on('context-menu-command', (e, command) => {
-  // ...
-})
-
-// main
-ipcMain.on('show-context-menu', (event) => {
-  const template = [
-    {
-      label: 'Menu Item 1',
-      click: () => { event.sender.send('context-menu-command', 'menu-item-1') }
-    },
-    { type: 'separator' },
-    { label: 'Menu Item 2', type: 'checkbox', checked: true }
-  ]
-  const menu = Menu.buildFromTemplate(template)
-  menu.popup({ window: BrowserWindow.fromWebContents(event.sender) })
-})
-```
-
-## Notes on macOS Application Menu
-
-macOS has a completely different style of application menu from Windows and
-Linux. Here are some notes on making your app's menu more native-like.
-
-### Standard Menus
-
-On macOS there are many system-defined standard menus, like the [`Services`](https://developer.apple.com/documentation/appkit/nsapplication/1428608-servicesmenu?language=objc) and
-`Windows` menus. To make your menu a standard menu, you should set your menu's
-`role` to one of the following and Electron will recognize them and make them
-become standard menus:
-
-* `window`
-* `help`
-* `services`
-
-### Standard Menu Item Actions
-
-macOS has provided standard actions for some menu items, like `About xxx`,
-`Hide xxx`, and `Hide Others`. To set the action of a menu item to a standard
-action, you should set the `role` attribute of the menu item.
-
-### Main Menu's Name
-
-On macOS the label of the application menu's first item is always your app's
-name, no matter what label you set. To change it, modify your app bundle's
-`Info.plist` file. See
-[About Information Property List Files][AboutInformationPropertyListFiles]
-for more information.
-
-### Menu Sublabels
-
-Menu sublabels, or [subtitles](https://developer.apple.com/documentation/appkit/nsmenuitem/subtitle?language=objc), can be added to menu items using the `sublabel` option. Below is an example based on the renderer example above:
-
-```js @ts-expect-error=[12]
-// main
-ipcMain.on('show-context-menu', (event) => {
-  const template = [
-    {
-      label: 'Menu Item 1',
-      sublabel: 'Subtitle 1',
-      click: () => { event.sender.send('context-menu-command', 'menu-item-1') }
-    },
-    { type: 'separator' },
-    { label: 'Menu Item 2', sublabel: 'Subtitle 2', type: 'checkbox', checked: true }
-  ]
-  const menu = Menu.buildFromTemplate(template)
-  menu.popup({ window: BrowserWindow.fromWebContents(event.sender) })
-})
-```
-
-## Setting Menu for Specific Browser Window (_Linux_ _Windows_)
-
-The [`setMenu` method][setMenu] of browser windows can set the menu of certain
-browser windows.
-
-## Menu Item Position
-
-You can make use of `before`, `after`, `beforeGroupContaining`, `afterGroupContaining` and `id` to control how the item will be placed when building a menu with `Menu.buildFromTemplate`.
-
-* `before` - Inserts this item before the item with the specified id. If the
-  referenced item doesn't exist the item will be inserted at the end of
-  the menu. Also implies that the menu item in question should be placed in the same “group” as the item.
-* `after` - Inserts this item after the item with the specified id. If the
-  referenced item doesn't exist the item will be inserted at the end of
-  the menu. Also implies that the menu item in question should be placed in the same “group” as the item.
-* `beforeGroupContaining` - Provides a means for a single context menu to declare
-  the placement of their containing group before the containing group of the item with the specified id.
-* `afterGroupContaining` - Provides a means for a single context menu to declare
-  the placement of their containing group after the containing group of the item with the specified id.
-
-By default, items will be inserted in the order they exist in the template unless one of the specified positioning keywords is used.
-
-### Examples
-
-Template:
-
-```js
-[
-  { id: '1', label: 'one' },
-  { id: '2', label: 'two' },
-  { id: '3', label: 'three' },
-  { id: '4', label: 'four' }
-]
-```
-
-Menu:
-
-```sh
-- 1
-- 2
-- 3
-- 4
-```
-
-Template:
-
-```js
-[
-  { id: '1', label: 'one' },
-  { type: 'separator' },
-  { id: '3', label: 'three', beforeGroupContaining: ['1'] },
-  { id: '4', label: 'four', afterGroupContaining: ['2'] },
-  { type: 'separator' },
-  { id: '2', label: 'two' }
-]
-```
-
-Menu:
-
-```sh
-- 3
-- 4
-- ---
-- 1
-- ---
-- 2
-```
-
-Template:
-
-```js
-[
-  { id: '1', label: 'one', after: ['3'] },
-  { id: '2', label: 'two', before: ['1'] },
-  { id: '3', label: 'three' }
-]
-```
-
-Menu:
-
-```sh
-- ---
-- 3
-- 2
-- 1
-```
-
-[AboutInformationPropertyListFiles]: https://developer.apple.com/library/ios/documentation/general/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html
-[setMenu]: browser-window.md#winsetmenumenu-linux-windows
+Each `Menu` consists of multiple [`MenuItem`](menu-item.md) instances and each `MenuItem`
+can nest a `Menu` into its `submenu` property.

docs/api/message-channel-main.md

@@ -15,9 +15,12 @@ Process: [Main](../glossary.md#main-process)
 
 Example:
 
+<!-- eslint-disable import/order -->
+
 ```js
 // Main process
 const { BrowserWindow, MessageChannelMain } = require('electron')
+
 const w = new BrowserWindow()
 const { port1, port2 } = new MessageChannelMain()
 w.webContents.postMessage('port', null, [port2])
@@ -25,6 +28,7 @@ port1.postMessage({ some: 'message' })
 
 // Renderer process
 const { ipcRenderer } = require('electron')
+
 ipcRenderer.on('port', (e) => {
   // e.ports is a list of ports sent along with this message
   e.ports[0].onmessage = (messageEvent) => {

docs/api/native-image.md

@@ -4,6 +4,12 @@
 
 Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 The `nativeImage` module provides a unified interface for manipulating
 system images. These can be handy if you want to provide multiple scaled
 versions of the same icon or take advantage of macOS [template images][template-image].
@@ -86,6 +92,7 @@ images/
 
 ```js title='Main Process'
 const { Tray } = require('electron')
+
 const appTray = new Tray('/Users/somebody/images/icon.png')
 ```
 

docs/api/net.md

@@ -28,6 +28,7 @@ Example usage:
 
 ```js
 const { app } = require('electron')
+
 app.whenReady().then(() => {
   const { net } = require('electron')
   const request = net.request('https://github.com')

docs/api/process.md

@@ -211,6 +211,10 @@ Returns `Object`:
   system.
 * `free` Integer - The total amount of memory not being used by applications or disk
   cache.
+* `fileBacked` Integer _macOS_ - The amount of memory that currently has been paged out to storage.
+  Includes memory for file caches, network buffers, and other system services.
+* `purgeable` Integer _macOS_ - The amount of memory that is marked as "purgeable". The system can reclaim it
+  if memory pressure increases.
 * `swapTotal` Integer _Windows_ _Linux_ - The total amount of swap memory in Kilobytes available to the
   system.
 * `swapFree` Integer _Windows_ _Linux_ - The free amount of swap memory in Kilobytes available to the

docs/api/protocol.md

@@ -9,6 +9,7 @@ An example of implementing a protocol that has the same effect as the
 
 ```js
 const { app, protocol, net } = require('electron')
+
 const path = require('node:path')
 const url = require('node:url')
 
@@ -38,8 +39,9 @@ to register it to that session explicitly.
 
 ```js
 const { app, BrowserWindow, net, protocol, session } = require('electron')
+
 const path = require('node:path')
-const url = require('url')
+const url = require('node:url')
 
 app.whenReady().then(() => {
   const partition = 'persist:example'
@@ -76,6 +78,7 @@ Policy:
 
 ```js
 const { protocol } = require('electron')
+
 protocol.registerSchemesAsPrivileged([
   { scheme: 'foo', privileges: { bypassCSP: true } }
 ])
@@ -128,8 +131,9 @@ Example:
 
 ```js
 const { app, net, protocol } = require('electron')
+
 const path = require('node:path')
-const { pathToFileURL } = require('url')
+const { pathToFileURL } = require('node:url')
 
 protocol.registerSchemesAsPrivileged([
   {
@@ -330,7 +334,8 @@ Example:
 
 ```js
 const { protocol } = require('electron')
-const { PassThrough } = require('stream')
+
+const { PassThrough } = require('node:stream')
 
 function createStream (text) {
   const rv = new PassThrough() // PassThrough is also a Readable stream

docs/api/service-worker-main.md

@@ -1,11 +1,7 @@
-# ServiceWorkerMain
+## Class: ServiceWorkerMain
 
 > An instance of a Service Worker representing a version of a script for a given scope.
 
-Process: [Main](../glossary.md#main-process)
-
-## Class: ServiceWorkerMain
-
 Process: [Main](../glossary.md#main-process)<br />
 _This class is not exported from the `'electron'` module. It is only available as a return value of other methods in the Electron API._
 
@@ -46,6 +42,10 @@ An [`IpcMainServiceWorker`](ipc-main-service-worker.md) instance scoped to the s
 
 A `string` representing the scope URL of the service worker.
 
+#### `serviceWorker.scriptURL` _Readonly_ _Experimental_
+
+A `string` representing the script URL of the service worker.
+
 #### `serviceWorker.versionId` _Readonly_ _Experimental_
 
 A `number` representing the ID of the specific version of the service worker script in its scope.

docs/api/service-workers.md

@@ -109,6 +109,7 @@ Starts the service worker or does nothing if already running.
 
 ```js
 const { app, session } = require('electron')
+
 const { serviceWorkers } = session.defaultSession
 
 // Collect service workers scopes

docs/api/session.md

@@ -79,6 +79,7 @@ You can create a `Session` object in the `session` module:
 
 ```js
 const { session } = require('electron')
+
 const ses = session.fromPartition('persist:name')
 console.log(ses.getUserAgent())
 ```
@@ -100,8 +101,9 @@ Emitted when Electron is about to download `item` in `webContents`.
 Calling `event.preventDefault()` will cancel the download and `item` will not be
 available from next tick of the process.
 
-```js @ts-expect-error=[4]
+```js @ts-expect-error=[5]
 const { session } = require('electron')
+
 session.defaultSession.on('will-download', (event, item, webContents) => {
   event.preventDefault()
   require('got')(item.getURL()).then((response) => {
@@ -852,6 +854,7 @@ verify proc.
 
 ```js
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow()
 
 win.webContents.session.setCertificateVerifyProc((request, callback) => {
@@ -903,6 +906,7 @@ Most web APIs do a permission check and then make a permission request if the ch
 
 ```js
 const { session } = require('electron')
+
 session.fromPartition('some-partition').setPermissionRequestHandler((webContents, permission, callback) => {
   if (webContents.getURL() === 'some-host' && permission === 'notifications') {
     return callback(false) // denied.
@@ -935,14 +939,18 @@ session.fromPartition('some-partition').setPermissionRequestHandler((webContents
     * `top-level-storage-access` -  Allow top-level sites to request third-party cookie access on behalf of embedded content originating from another site in the same related website set using the [Storage Access API](https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API).
     * `usb` - Expose non-standard Universal Serial Bus (USB) compatible devices services to the web with the [WebUSB API](https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API).
     * `deprecated-sync-clipboard-read` _Deprecated_ - Request access to run `document.execCommand("paste")`
+    * `fileSystem` - Access to read, write, and file management capabilities using the [File System API](https://developer.mozilla.org/en-US/docs/Web/API/File_System_API).
   * `requestingOrigin` string - The origin URL of the permission check
   * `details` Object - Some properties are only available on certain permission types.
     * `embeddingOrigin` string (optional) - The origin of the frame embedding the frame that made the permission check.  Only set for cross-origin sub frames making permission checks.
     * `securityOrigin` string (optional) - The security origin of the `media` check.
     * `mediaType` string (optional) - The type of media access being requested, can be `video`,
-      `audio` or `unknown`
+      `audio` or `unknown`.
     * `requestingUrl` string (optional) - The last URL the requesting frame loaded.  This is not provided for cross-origin sub frames making permission checks.
-    * `isMainFrame` boolean - Whether the frame making the request is the main frame
+    * `isMainFrame` boolean - Whether the frame making the request is the main frame.
+    * `filePath` string (optional) - The path of a `fileSystem` request.
+    * `isDirectory` boolean (optional) - Whether a `fileSystem` request is a directory.
+    * `fileAccessType` string (optional) - The access type of a `fileSystem` request. Can be `writable` or `readable`.
 
 Sets the handler which can be used to respond to permission checks for the `session`.
 Returning `true` will allow the permission and `false` will reject it.  Please note that
@@ -952,7 +960,9 @@ To clear the handler, call `setPermissionCheckHandler(null)`.
 
 ```js
 const { session } = require('electron')
-const url = require('url')
+
+const url = require('node:url')
+
 session.fromPartition('some-partition').setPermissionCheckHandler((webContents, permission, requestingOrigin) => {
   if (new URL(requestingOrigin).hostname === 'some-host' && permission === 'notifications') {
     return true // granted
@@ -962,6 +972,9 @@ session.fromPartition('some-partition').setPermissionCheckHandler((webContents,
 })
 ```
 
+> [!NOTE]
+> `isMainFrame` will always be `false` for a `fileSystem` request as a result of Chromium limitations.
+
 #### `ses.setDisplayMediaRequestHandler(handler[, opts])`
 
 * `handler` Function | null
@@ -1189,6 +1202,7 @@ automatically.  To clear the handler, call `setBluetoothPairingHandler(null)`.
 
 ```js
 const { app, BrowserWindow, session } = require('electron')
+
 const path = require('node:path')
 
 function createWindow () {
@@ -1518,6 +1532,7 @@ extension to be loaded.
 
 ```js
 const { app, session } = require('electron')
+
 const path = require('node:path')
 
 app.whenReady().then(async () => {
@@ -1659,6 +1674,7 @@ A [`Protocol`](protocol.md) object for this session.
 
 ```js
 const { app, session } = require('electron')
+
 const path = require('node:path')
 
 app.whenReady().then(() => {

docs/api/structures/keyboard-input-event.md

@@ -2,5 +2,5 @@
 
 * `type` string - The type of the event, can be `rawKeyDown`, `keyDown`, `keyUp` or `char`.
 * `keyCode` string - The character that will be sent
-  as the keyboard event. Should only use the valid key codes in
-  [Accelerator](../accelerator.md).
+  as the keyboard event. Should only use valid [Accelerator](../../tutorial/keyboard-shortcuts.md#accelerators)
+  key codes.

docs/api/structures/printer-info.md

@@ -12,6 +12,8 @@ The number represented by `status` means different things on different platforms
 Below is an example of some of the additional options that may be set which
 may be different on each platform.
 
+<!-- eslint-skip -->
+
 ```js
 {
   name: 'Austin_4th_Floor_Printer___C02XK13BJHD4',

docs/api/structures/protocol-response.md

@@ -25,9 +25,8 @@
   and URL responses.
 * `method` string (optional) - The HTTP `method`. This is only used for file
   and URL responses.
-* `session` Session (optional) - The session used for requesting URL, by default
-  the HTTP request will reuse the current session. Setting `session` to `null`
-  would use a random independent session. This is only used for URL responses.
+* `session` Session (optional) - The session used for requesting URL.
+  The HTTP request will reuse the current session by default.
 * `uploadData` [ProtocolResponseUploadData](protocol-response-upload-data.md) (optional) - The data used as upload data. This is only
   used for URL responses when `method` is `"POST"`.
 

docs/api/structures/trace-config.md

@@ -26,6 +26,8 @@
 
 An example TraceConfig that roughly matches what Chrome DevTools records:
 
+<!-- eslint-skip -->
+
 ```js
 {
   recording_mode: 'record-until-full',

docs/api/structures/web-preferences.md

@@ -149,7 +149,6 @@
   `WebContents` when the preferred size changes. Default is `false`.
 * `transparent` boolean (optional) - Whether to enable background transparency for the guest page. Default is `true`. **Note:** The guest page's text and background colors are derived from the [color scheme](https://developer.mozilla.org/en-US/docs/Web/CSS/color-scheme) of its root element. When transparency is enabled, the text color will still change accordingly but the background will remain transparent.
 * `enableDeprecatedPaste` boolean (optional) _Deprecated_ - Whether to enable the `paste` [execCommand](https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand). Default is `false`.
-* `enableCornerSmoothingCSS` boolean (optional) _Experimental_ - Whether the [`-electron-corner-smoothing` CSS rule](../corner-smoothing-css.md) is enabled. Default is `true`.
 
 [chrome-content-scripts]: https://developer.chrome.com/extensions/content_scripts#execution-environment
 [runtime-enabled-features]: https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/platform/runtime_enabled_features.json5

docs/api/system-preferences.md

@@ -6,6 +6,7 @@ Process: [Main](../glossary.md#main-process), [Utility](../glossary.md#utility-p
 
 ```js
 const { systemPreferences } = require('electron')
+
 console.log(systemPreferences.getEffectiveAppearance())
 ```
 

docs/api/tray.md

@@ -8,7 +8,7 @@ Process: [Main](../glossary.md#main-process)
 
 `Tray` is an [EventEmitter][event-emitter].
 
-```js
+```js title='Creating a basic tray menu'
 const { app, Menu, Tray } = require('electron')
 
 let tray = null
@@ -25,6 +25,9 @@ app.whenReady().then(() => {
 })
 ```
 
+> [!TIP]
+> See also: [A detailed guide about how to implement Tray menus](../tutorial/tray.md).
+
 > [!WARNING]
 > Electron's built-in classes cannot be subclassed in user code.
 > For more information, see [the FAQ](../faq.md#class-inheritance-does-not-work-with-electron-built-in-modules).
@@ -76,7 +79,15 @@ app.whenReady().then(() => {
 ### `new Tray(image, [guid])`
 
 * `image` ([NativeImage](native-image.md) | string)
-* `guid` string (optional) _Windows_ - Assigns a GUID to the tray icon. If the executable is signed and the signature contains an organization in the subject line then the GUID is permanently associated with that signature. OS level settings like the position of the tray icon in the system tray will persist even if the path to the executable changes. If the executable is not code-signed then the GUID is permanently associated with the path to the executable. Changing the path to the executable will break the creation of the tray icon and a new GUID must be used. However, it is highly recommended to use the GUID parameter only in conjunction with code-signed executable. If an App defines multiple tray icons then each icon must use a separate GUID.
+* `guid` string (optional) _Windows_ _macOS_ - A unique string used to identify the tray icon. Must adhere to [UUID](https://en.wikipedia.org/wiki/Universally_unique_identifier) format.
+
+**Windows**
+
+On Windows, if the executable is signed and the signature contains an organization in the subject line then the GUID is permanently associated with that signature. OS level settings like the position of the tray icon in the system tray will persist even if the path to the executable changes. If the executable is not code-signed then the GUID is permanently associated with the path to the executable. Changing the path to the executable will break the creation of the tray icon and a new GUID must be used. However, it is highly recommended to use the GUID parameter only in conjunction with code-signed executable. If an App defines multiple tray icons then each icon must use a separate GUID.
+
+**MacOS**
+
+On macOS, the `guid` is a string used to uniquely identify the tray icon and allow it to retain its position between relaunches. Using the same string for a new tray item will create it in the same position as the previous tray item to use the string.
 
 Creates a new tray icon associated with the `image`.
 
@@ -324,8 +335,56 @@ Returns [`Rectangle`](structures/rectangle.md)
 
 The `bounds` of this tray icon as `Object`.
 
+#### `tray.getGUID()` _macOS_ _Windows_
+
+Returns `string | null` - The GUID used to uniquely identify the tray icon and allow it to retain its position between relaunches, or null if none is set.
+
 #### `tray.isDestroyed()`
 
 Returns `boolean` - Whether the tray icon is destroyed.
 
 [event-emitter]: https://nodejs.org/api/events.html#events_class_eventemitter
+
+## Platform considerations
+
+### Linux
+
+* Tray icon uses [StatusNotifierItem](https://www.freedesktop.org/wiki/Specifications/StatusNotifierItem/)
+  by default, when it is not available in user's desktop environment the
+  `GtkStatusIcon` will be used instead.
+* The `click` event is emitted when the tray icon receives activation from
+  user, however the StatusNotifierItem spec does not specify which action would
+  cause an activation, for some environments it is left mouse click, but for
+  some it might be double left mouse click.
+* In order for changes made to individual `MenuItem`s to take effect,
+  you have to call `setContextMenu` again. For example:
+
+```js
+const { app, Menu, Tray } = require('electron')
+
+let appIcon = null
+app.whenReady().then(() => {
+  appIcon = new Tray('/path/to/my/icon')
+  const contextMenu = Menu.buildFromTemplate([
+    { label: 'Item1', type: 'radio' },
+    { label: 'Item2', type: 'radio' }
+  ])
+
+  // Make a change to the context menu
+  contextMenu.items[1].checked = false
+
+  // Call this again for Linux because we modified the context menu
+  appIcon.setContextMenu(contextMenu)
+})
+```
+
+### macOS
+
+* Icons passed to the Tray constructor should be [Template Images](native-image.md#template-image-macos).
+* To make sure your icon isn't grainy on retina monitors, be sure your `@2x` image is 144dpi.
+* If you are bundling your application (e.g., with webpack for development), be sure that the file names are not being mangled or hashed. The filename needs to end in Template, and the `@2x` image needs to have the same filename as the standard image, or MacOS will not magically invert your image's colors or use the high density image.
+* 16x16 (72dpi) and 32x32@2x (144dpi) work well for most icons.
+
+### Windows
+
+* It is recommended to use `ICO` icons to get best visual effects.

docs/api/view.md

@@ -9,6 +9,7 @@ module is emitted.
 
 ```js
 const { BaseWindow, View } = require('electron')
+
 const win = new BaseWindow()
 const view = new View()
 

docs/api/web-contents-view.md

@@ -9,6 +9,7 @@ module is emitted.
 
 ```js
 const { BaseWindow, WebContentsView } = require('electron')
+
 const win = new BaseWindow({ width: 800, height: 400 })
 
 const view1 = new WebContentsView()
@@ -56,6 +57,7 @@ Use this to interact with the `WebContents`, for instance to load a URL.
 
 ```js
 const { WebContentsView } = require('electron')
+
 const view = new WebContentsView()
 view.webContents.loadURL('https://electronjs.org/')
 ```

docs/api/web-contents.md

@@ -55,6 +55,7 @@ These methods can be accessed from the `webContents` module:
 
 ```js
 const { webContents } = require('electron')
+
 console.log(webContents)
 ```
 
@@ -446,6 +447,7 @@ and allow the page to be unloaded.
 
 ```js
 const { BrowserWindow, dialog } = require('electron')
+
 const win = new BrowserWindow({ width: 800, height: 600 })
 win.webContents.on('will-prevent-unload', (event) => {
   const choice = dialog.showMessageBoxSync(win, {
@@ -484,16 +486,6 @@ Emitted when the web page becomes unresponsive.
 
 Emitted when the unresponsive web page becomes responsive again.
 
-#### Event: 'plugin-crashed'
-
-Returns:
-
-* `event` Event
-* `name` string
-* `version` string
-
-Emitted when a plugin process has crashed.
-
 #### Event: 'destroyed'
 
 Emitted when `webContents` is destroyed.
@@ -1145,6 +1137,7 @@ Returns `string` - The URL of the current web page.
 
 ```js
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow({ width: 800, height: 600 })
 win.loadURL('https://github.com').then(() => {
   const currentURL = win.webContents.getURL()
@@ -1764,6 +1757,12 @@ When a custom `pageSize` is passed, Chromium attempts to validate platform speci
 Prints window's web page. When `silent` is set to `true`, Electron will pick
 the system's default printer if `deviceName` is empty and the default settings for printing.
 
+Some possible `failureReason`s for print failure include:
+
+* "Invalid printer settings"
+* "Print job canceled"
+* "Print job failed"
+
 Use `page-break-before: always;` CSS style to force to print to a new page.
 
 Example usage:
@@ -1814,9 +1813,10 @@ An example of `webContents.printToPDF`:
 
 ```js
 const { app, BrowserWindow } = require('electron')
+
 const fs = require('node:fs')
-const path = require('node:path')
 const os = require('node:os')
+const path = require('node:path')
 
 app.whenReady().then(() => {
   const win = new BrowserWindow()
@@ -1848,6 +1848,7 @@ creation:
 
 ```js
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow()
 win.webContents.on('devtools-opened', () => {
   win.webContents.addWorkSpace(__dirname)
@@ -1914,6 +1915,7 @@ An example of showing devtools in a `<webview>` tag:
 ```js
 // Main process
 const { ipcMain, webContents } = require('electron')
+
 ipcMain.on('open-devtools', (event, targetContentsId, devtoolsContentsId) => {
   const target = webContents.fromId(targetContentsId)
   const devtools = webContents.fromId(devtoolsContentsId)
@@ -2173,6 +2175,7 @@ Returns `Promise<void>` - resolves if the page is saved.
 
 ```js
 const { BrowserWindow } = require('electron')
+
 const win = new BrowserWindow()
 
 win.loadURL('https://github.com')

docs/api/web-frame-main.md

@@ -66,6 +66,16 @@ These methods can be accessed from the `webFrameMain` module:
 Returns `WebFrameMain | undefined` - A frame with the given process and routing IDs,
 or `undefined` if there is no WebFrameMain associated with the given IDs.
 
+### `webFrameMain.fromFrameToken(processId, frameToken)`
+
+* `processId` Integer - An `Integer` representing the internal ID of the process which owns the frame.
+* `frameToken` string - A `string` token identifying the unique frame. Can also
+  be retrieved in the renderer process via
+  [`webFrame.frameToken`](web-frame.md#webframeframetoken-readonly).
+
+Returns `WebFrameMain | null` - A frame with the given process and frame token,
+or `null` if there is no WebFrameMain associated with the given IDs.
+
 ## Class: WebFrameMain
 
 Process: [Main](../glossary.md#main-process)<br />
@@ -237,6 +247,11 @@ not used again.
 
 A `string` representing the frame name.
 
+#### `frame.frameToken` _Readonly_
+
+A `string` which uniquely identifies the frame within its associated renderer
+process. This is equivalent to [`webFrame.frameToken`](web-frame.md#webframeframetoken-readonly).
+
 #### `frame.osProcessId` _Readonly_
 
 An `Integer` representing the operating system `pid` of the process which owns this frame.

docs/api/web-frame.md

@@ -4,6 +4,12 @@
 
 Process: [Renderer](../glossary.md#renderer-process)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 `webFrame` export of the Electron module is an instance of the `WebFrame`
 class representing the current frame. Sub-frames can be retrieved by
 certain properties and methods (e.g. `webFrame.firstChild`).
@@ -67,7 +73,7 @@ Sets the maximum and minimum pinch-to-zoom level.
 > [!NOTE]
 > Visual zoom only applies to pinch-to-zoom behavior. Cmd+/-/0 zoom shortcuts are
 > controlled by the 'zoomIn', 'zoomOut', and 'resetZoom' MenuItem roles in the application
-> Menu. To disable shortcuts, manually [define the Menu](./menu.md#examples) and omit zoom roles
+> Menu. To disable shortcuts, manually [define the Menu](../tutorial/menus.md) and omit zoom roles
 > from the definition.
 
 ### `webFrame.setSpellCheckProvider(language, provider)`
@@ -99,9 +105,11 @@ with an array of misspelt words when complete.
 
 An example of using [node-spellchecker][spellchecker] as provider:
 
-```js @ts-expect-error=[2,6]
+```js @ts-expect-error=[3,8]
 const { webFrame } = require('electron')
+
 const spellChecker = require('spellchecker')
+
 webFrame.setSpellCheckProvider('en-US', {
   spellCheck (words, callback) {
     setTimeout(() => {
@@ -137,7 +145,7 @@ by its key, which is returned from `webFrame.insertCSS(css)`.
 
 Inserts `text` to the focused element.
 
-### `webFrame.executeJavaScript(code[, userGesture, callback])`
+### `webFrame.executeJavaScript(code[, userGesture][, callback])`
 
 * `code` string
 * `userGesture` boolean (optional) - Default is `false`.
@@ -158,7 +166,7 @@ In the browser window some HTML APIs like `requestFullScreen` can only be
 invoked by a gesture from the user. Setting `userGesture` to `true` will remove
 this limitation.
 
-### `webFrame.executeJavaScriptInIsolatedWorld(worldId, scripts[, userGesture, callback])`
+### `webFrame.executeJavaScriptInIsolatedWorld(worldId, scripts[, userGesture][, callback])`
 
 * `worldId` Integer - The ID of the world to run the javascript
             in, `0` is the default main world (where content runs), `999` is the
@@ -212,11 +220,14 @@ caches.
 
 ```js
 const { webFrame } = require('electron')
+
 console.log(webFrame.getResourceUsage())
 ```
 
 This will generate:
 
+<!-- eslint-skip -->
+
 ```js
 {
   images: {
@@ -248,7 +259,7 @@ and intend to stay there).
 
 * `selector` string - CSS selector for a frame element.
 
-Returns `WebFrame` - The frame element in `webFrame's` document selected by
+Returns `WebFrame | null` - The frame element in `webFrame's` document selected by
 `selector`, `null` would be returned if `selector` does not select a frame or
 if the frame is not in the current renderer process.
 
@@ -256,18 +267,29 @@ if the frame is not in the current renderer process.
 
 * `name` string
 
-Returns `WebFrame` - A child of `webFrame` with the supplied `name`, `null`
+Returns `WebFrame | null` - A child of `webFrame` with the supplied `name`, `null`
 would be returned if there's no such frame or if the frame is not in the current
 renderer process.
 
-### `webFrame.findFrameByRoutingId(routingId)`
+### `webFrame.findFrameByRoutingId(routingId)` _Deprecated_
 
 * `routingId` Integer - An `Integer` representing the unique frame id in the
    current renderer process. Routing IDs can be retrieved from `WebFrame`
    instances (`webFrame.routingId`) and are also passed by frame
    specific `WebContents` navigation events (e.g. `did-frame-navigate`)
 
-Returns `WebFrame` - that has the supplied `routingId`, `null` if not found.
+Returns `WebFrame | null` - that has the supplied `routingId`, `null` if not found.
+
+**Deprecated:** Use the new `webFrame.findFrameByToken` API.
+
+### `webFrame.findFrameByToken(frameToken)`
+
+* `frameToken` string - A `string` representing the unique frame id in the
+   current renderer process. Frame tokens can be retrieved from `WebFrame`
+   instances (`webFrame.frameToken`) and can also be retrieved from
+   `WebFrameMain` instances using `webFrameMain.frameToken`.
+
+Returns `WebFrame | null` - that has the supplied `frameToken`, `null` if not found.
 
 ### `webFrame.isWordMisspelled(word)`
 
@@ -313,8 +335,16 @@ A `WebFrame | null` representing next sibling frame, the property would be `null
 `webFrame` is the last frame in its parent or if the next sibling is not in the
 current renderer process.
 
-### `webFrame.routingId` _Readonly_
+### `webFrame.routingId` _Readonly_ _Deprecated_
 
 An `Integer` representing the unique frame id in the current renderer process.
 Distinct WebFrame instances that refer to the same underlying frame will have
 the same `routingId`.
+
+**Deprecated:** Use the new `webFrame.frameToken` API.
+
+### `webFrame.frameToken` _Readonly_
+
+A `string` representing the unique frame token in the current renderer process.
+Distinct WebFrame instances that refer to the same underlying frame will have
+the same `frameToken`.

docs/api/web-utils.md

@@ -4,6 +4,12 @@
 
 Process: [Renderer](../glossary.md#renderer-process)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 ## Methods
 
 The `webUtils` module has the following methods:
@@ -17,10 +23,27 @@ Returns `string` - The file system path that this `File` object points to. In th
 This method superseded the previous augmentation to the `File` object with the `path` property.  An example is included below.
 
 ```js @ts-nocheck
-// Before
-const oldPath = document.querySelector('input').files[0].path
-
-// After
-const { webUtils } = require('electron')
-const newPath = webUtils.getPathForFile(document.querySelector('input').files[0])
+// Before (renderer)
+const oldPath = document.querySelector('input[type=file]').files[0].path
+```
+
+```js @ts-nocheck
+// After
+
+// Renderer:
+
+const file = document.querySelector('input[type=file]').files[0]
+electronApi.doSomethingWithFile(file)
+
+// Preload script:
+
+const { contextBridge, webUtils } = require('electron')
+
+contextBridge.exposeInMainWorld('electronApi', {
+  doSomethingWithFile (file) {
+    const path = webUtils.getPathForFile(file)
+    // Do something with the path, e.g., send it over IPC to the main process.
+    // It's best not to expose the full file path to the web content if possible.
+  }
+})
 ```

docs/api/webview-tag.md

@@ -987,6 +987,7 @@ webview.send('ping')
 ```js
 // In guest page.
 const { ipcRenderer } = require('electron')
+
 ipcRenderer.on('ping', () => {
   ipcRenderer.sendToHost('pong')
 })
@@ -1001,15 +1002,6 @@ Returns:
 Fired when the renderer process unexpectedly disappears. This is normally
 because it was crashed or killed.
 
-### Event: 'plugin-crashed'
-
-Returns:
-
-* `name` string
-* `version` string
-
-Fired when a plugin process is crashed.
-
 ### Event: 'destroyed'
 
 Fired when the WebContents is destroyed.

docs/api/window-open.md

@@ -39,8 +39,8 @@ consider using `webContents.setWindowOpenHandler` to customize the
 BrowserWindow creation.
 
 A subset of [`WebPreferences`](structures/web-preferences.md) can be set directly,
-unnested, from the features string: `zoomFactor`, `nodeIntegration`, `preload`,
-`javascript`, `contextIsolation`, and `webviewTag`.
+unnested, from the features string: `zoomFactor`, `nodeIntegration`, `javascript`,
+`contextIsolation`, and `webviewTag`.
 
 For example:
 

docs/breaking-changes.md

@@ -12,13 +12,87 @@ This document uses the following convention to categorize breaking changes:
 * **Deprecated:** An API was marked as deprecated. The API will continue to function, but will emit a deprecation warning, and will be removed in a future release.
 * **Removed:** An API or feature was removed, and is no longer supported by Electron.
 
+## Planned Breaking API Changes (38.0)
+
+### Removed: `ELECTRON_OZONE_PLATFORM_HINT` environment variable
+
+The default value of the `--ozone-plaftform` flag [changed to `auto`](https://chromium-review.googlesource.com/c/chromium/src/+/6775426).
+
+You should use the `XDG_SESSION_TYPE=wayland` environment variable instead to use Wayland.
+
+### Removed: macOS 11 support
+
+macOS 11 (Big Sur) is no longer supported by [Chromium](https://chromium-review.googlesource.com/c/chromium/src/+/6594615).
+
+Older versions of Electron will continue to run on Big Sur, but macOS 12 (Monterey)
+or later will be required to run Electron v38.0.0 and higher.
+
+### Removed: `plugin-crashed` event
+
+The `plugin-crashed` event has been removed from `webContents`.
+
+### Deprecated: `webFrame.routingId` property
+
+The `routingId` property will be removed from `webFrame` objects.
+
+You should use `webFrame.frameToken` instead.
+
+### Deprecated: `webFrame.findFrameByRoutingId(routingId)`
+
+The `webFrame.findFrameByRoutingId(routingId)` function will be removed.
+
+You should use `webFrame.findFrameByToken(frameToken)` instead.
+
 ## Planned Breaking API Changes (37.0)
 
+### Utility Process unhandled rejection behavior change
+
+Utility Processes will now warn with an error message when an unhandled
+rejection occurs instead of crashing the process.
+
+To restore the previous behavior, you can use:
+
+```js
+process.on('unhandledRejection', () => {
+  process.exit(1)
+})
+```
+
+### Behavior Changed: `process.exit()` kills utility process synchronously
+
+Calling `process.exit()` in a utility process will now kill the utility process synchronously.
+This brings the behavior of `process.exit()` in line with Node.js behavior.
+
+Please refer to the
+[Node.js docs](https://nodejs.org/docs/latest-v22.x/api/process.html#processexitcode) and
+[PR #45690](https://github.com/electron/electron/pull/45690) to understand the potential
+implications of that, e.g., when calling `console.log()` before `process.exit()`.
+
+### Behavior Changed: WebUSB and WebSerial Blocklist Support
+
+[WebUSB](https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API) and [Web Serial](https://developer.mozilla.org/en-US/docs/Web/API/Web_Serial_API) now support the [WebUSB Blocklist](https://wicg.github.io/webusb/#blocklist) and [Web Serial Blocklist](https://wicg.github.io/serial/#blocklist) used by Chromium and outlined in their respective specifications.
+
+To disable these, users can pass `disable-usb-blocklist` and `disable-serial-blocklist` as command line flags.
+
+### Removed: `null` value for `session` property in `ProtocolResponse`
+
+This deprecated feature has been removed.
+
+Previously, setting the `ProtocolResponse.session` property to `null`
+would create a random independent session. This is no longer supported.
+
+Using single-purpose sessions here is discouraged due to overhead costs;
+however, old code that needs to preserve this behavior can emulate it by
+creating a random session with `session.fromPartition(some_random_string)`
+and then using it in `ProtocolResponse.session`.
+
 ### Behavior Changed: `BrowserWindow.IsVisibleOnAllWorkspaces()` on Linux
 
 `BrowserWindow.IsVisibleOnAllWorkspaces()` will now return false on Linux if the
 window is not currently visible.
 
+## Planned Breaking API Changes (36.0)
+
 ### Behavior Changes: `app.commandLine`
 
 `app.commandLine` will convert upper-cases switches and arguments to lowercase.
@@ -40,9 +114,7 @@ bitmap = image.getBitmap()
 bitmap = image.toBitmap()
 ```
 
-## Planned Breaking API Changes (36.0)
-
-### Removed:`isDefault` and `status` properties on `PrinterInfo`
+### Removed: `isDefault` and `status` properties on `PrinterInfo`
 
 These properties have been removed from the PrinterInfo Object
 because they have been removed from upstream Chromium.
@@ -54,12 +126,6 @@ When calling `Session.clearStorageData(options)`, the `options.quota` type
 [removed](https://chromium-review.googlesource.com/c/chromium/src/+/6309405)
 from upstream Chromium.
 
-### Deprecated: `quota` property in `Session.clearStorageData(options)`
-
-When calling `Session.clearStorageData(options)`, the `options.quota`
-property is deprecated. Since the `syncable` type was removed, there
-is only type left -- `'temporary'` -- so specifying it is unnecessary.
-
 ### Deprecated: `null` value for `session` property in `ProtocolResponse`
 
 Previously, setting the ProtocolResponse.session property to `null`
@@ -70,6 +136,12 @@ however, old code that needs to preserve this behavior can emulate it by
 creating a random session with `session.fromPartition(some_random_string)`
 and then using it in `ProtocolResponse.session`.
 
+### Deprecated: `quota` property in `Session.clearStorageData(options)`
+
+When calling `Session.clearStorageData(options)`, the `options.quota`
+property is deprecated. Since the `syncable` type was removed, there
+is only type left -- `'temporary'` -- so specifying it is unnecessary.
+
 ### Deprecated: Extension methods and events on `session`
 
 `session.loadExtension`, `session.removeExtension`, `session.getExtension`,

docs/development/build-instructions-gn.md

@@ -191,12 +191,6 @@ $ ./out/Testing/electron
 
 ### Packaging
 
-On linux, first strip the debugging and symbol information:
-
-```sh
-$ electron/script/strip-binaries.py -d out/Release
-```
-
 To package the electron build as a distributable zip file:
 
 ```sh

docs/development/creating-api.md

@@ -60,12 +60,12 @@ namespace electron {
 
 namespace api {
 
-class ApiName : public gin::Wrappable<ApiName>  {
+class ApiName : public gin::DeprecatedWrappable<ApiName>  {
  public:
   static gin::Handle<ApiName> Create(v8::Isolate* isolate);
 
   // gin::Wrappable
-  static gin::WrapperInfo kWrapperInfo;
+  static gin::DeprecatedWrapperInfo kWrapperInfo;
   gin::ObjectTemplateBuilder GetObjectTemplateBuilder(
       v8::Isolate* isolate) override;
   const char* GetTypeName() override;
@@ -90,7 +90,7 @@ namespace electron {
 
 namespace api {
 
-gin::WrapperInfo ApiName::kWrapperInfo = {gin::kEmbedderNativeGin};
+gin::DeprecatedWrapperInfo ApiName::kWrapperInfo = {gin::kEmbedderNativeGin};
 
 gin::ObjectTemplateBuilder ApiName::GetObjectTemplateBuilder(
     v8::Isolate* isolate) {
@@ -117,7 +117,7 @@ void Initialize(v8::Local<v8::Object> exports,
                 v8::Local<v8::Value> unused,
                 v8::Local<v8::Context> context,
                 void* priv) {
-  v8::Isolate* isolate = context->GetIsolate();
+  v8::Isolate* const isolate = v8::Isolate::GetCurrent();
   gin_helper::Dictionary dict(isolate, exports);
   dict.Set("apiName", electron::api::ApiName::Create(isolate));
 }
@@ -165,8 +165,10 @@ An example of the contents of this file can be found [here](https://github.com/e
 
 Add your module to the module list found at `"lib/browser/api/module-list.ts"` like so:
 
+<!-- eslint-disable semi -->
+
 ```ts title='lib/browser/api/module-list.ts' @ts-nocheck
 export const browserModuleList: ElectronInternal.ModuleEntry[] = [
-  { name: 'apiName', loader: () => require('./api-name') },
+  { name: 'apiName', loader: () => require('./api-name') }
 ];
 ```