fix: Update widget visibility in NativeWindowMac::ShowInactive (#45502)

When using `views::WebView` on macOS `NativeWidgetMacNSWindowHost`
contains a layer and compositor responsible for drawing web contents.
To trigger drawing `NativeWidgetMacNSWindowHost::OnVisibilityChanged`
needs to be called and `[NSWindow orderFrontRegardless]` does not trigger
`[NSWindow orderWindow:relativeTo:]` which can change
`NativeWidgetMacNSWindowHost` visiblity with stack:
```
views::NativeWidgetMacNSWindowHost::OnVisibilityChanged(bool)
remote_cocoa::NativeWidgetNSWindowBridge::OnVisibilityChanged()
-[ViewsNSWindowDelegate onWindowOrderChanged:]
-[NativeWidgetMacNSWindow orderWindow:relativeTo:]
```
`views::Widget` has method for showing inactive window:
`views::Widget::ShowInactive` which triggers
`NativeWidgetMacNSWindowHost::OnVisibilityChanged` with stack:
```
views::NativeWidgetMacNSWindowHost::OnVisibilityChanged(bool)
remote_cocoa::NativeWidgetNSWindowBridge::SetVisibilityState(remote_cocoa::mojom::WindowVisibilityState)
views::NativeWidgetMacNSWindowHost::SetVisibilityState(remote_cocoa::mojom::WindowVisibilityState)
views::NativeWidgetMac::Show(ui::mojom::WindowShowState, gfx::Rect const&)
views::Widget::ShowInactive() + 168
```
However this call seems to be insufficient to bring window to front,
therefore `[NSWindow orderFrontRegardless]` still needs to be called.
Calling `views::Widget::ShowInactive` ensures that all logic related to
showing Chromium widget will be properly executed, but onfortunately it
does not call `[NSWindow orderWindow:relativeTo:]` which is used to
disabling headless mode by the `ElectronNSWindow`, therefore we need to
trigger it manually through exposed `[ElectronNSWindow disableHeadlessMode]`.

Fixes: #45415

Co-authored-by: Michał Pichliński <michal.pichlinski@here.io>

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,3 @@
-blank_issues_enabled: false
 contact_links:
   - name: Discord Chat
     url: https://discord.gg/APGC3k5yaH

.github/ISSUE_TEMPLATE/maintainer_issue.yml

@@ -1,14 +0,0 @@
-name: Maintainer Issue (not for public use)
-description: Only to be created by Electron maintainers
-body:
-- type: checkboxes
-  attributes:
-    label: Confirmation
-    options:
-      - label: I am a [maintainer](https://github.com/orgs/electron/people) of the Electron project. (If not, please create a [different issue type](https://github.com/electron/electron/issues/new/).)
-        required: true
-- type: textarea
-  attributes:
-    label: Description
-  validations:
-    required: true

.github/actions/build-electron/action.yml

@@ -143,6 +143,25 @@ runs:
       run: |
         cd src
         e build --target electron:node_headers
+    - name: Create installed_software.json ${{ inputs.step-suffix }}
+      shell: powershell
+      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'win' }}
+      run: |
+        cd src
+        Get-CimInstance -Namespace root\cimv2 -Class Win32_product | Select vendor, description, @{l='install_location';e='InstallLocation'}, @{l='install_date';e='InstallDate'}, @{l='install_date_2';e='InstallDate2'}, caption, version, name, @{l='sku_number';e='SKUNumber'} | ConvertTo-Json | Out-File -Encoding utf8 -FilePath .\installed_software.json
+    - name: Profile Windows Toolchain ${{ inputs.step-suffix }}
+      shell: bash
+      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'win' }}
+      run: |
+        cd src
+        python3 electron/build/profile_toolchain.py --output-json=out/Default/windows_toolchain_profile.json
+    - name: Add msdia140.dll to Path ${{ inputs.step-suffix }}
+      shell: bash
+      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'win' }}
+      run: |
+        # Needed for msdia140.dll on 64-bit windows
+        cd src
+        export PATH="$PATH:$(pwd)/third_party/llvm-build/Release+Asserts/bin"
     - name: Generate & Zip Symbols ${{ inputs.step-suffix }}
       shell: bash
       run: |

.github/workflows/archaeologist-dig.yml

@@ -13,7 +13,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup Node.js/npm
-        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
         with:
           node-version: 20.11.x
       - name: Setting Up Dig Site
@@ -41,7 +41,7 @@ jobs:
           sha-file: .dig-old
           filename: electron.old.d.ts
       - name: Upload artifacts
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 #v4.6.0
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b #v4.5.0
         with:
           name: artifacts
           path: electron/artifacts

.github/workflows/branch-created.yml

@@ -94,7 +94,7 @@ jobs:
             }))
       - name: Create Release Project Board
         if: ${{ steps.check-major-version.outputs.MAJOR }}
-        uses: dsanders11/project-actions/copy-project@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/copy-project@438b25e007c2f4efec324497fadc6402e7cc61a6 # v1.4.0
         id: create-release-board
         with:
           drafts: true
@@ -114,14 +114,14 @@ jobs:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
       - name: Find Previous Release Project Board
         if: ${{ steps.check-major-version.outputs.MAJOR }}
-        uses: dsanders11/project-actions/find-project@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/find-project@438b25e007c2f4efec324497fadc6402e7cc61a6 # v1.4.0
         id: find-prev-release-board
         with:
           title: ${{ steps.generate-project-metadata.outputs.prev-prev-major }}-x-y
           token: ${{ steps.generate-token.outputs.token }}
       - name: Close Previous Release Project Board
         if: ${{ steps.check-major-version.outputs.MAJOR }}
-        uses: dsanders11/project-actions/close-project@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/close-project@438b25e007c2f4efec324497fadc6402e7cc61a6 # v1.4.0
         with:
           project-number: ${{ steps.find-prev-release-board.outputs.number }}
           token: ${{ steps.generate-token.outputs.token }}

.github/workflows/issue-labeled.yml

@@ -20,13 +20,12 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
       - name: Set status
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@438b25e007c2f4efec324497fadc6402e7cc61a6 # v1.4.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 90
           field: Status
           field-value: ✅ Triaged
-          fail-if-item-not-found: false
   issue-labeled-blocked:
     name: blocked/* label added
     if: startsWith(github.event.label.name, 'blocked/')
@@ -39,13 +38,12 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
       - name: Set status
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@438b25e007c2f4efec324497fadc6402e7cc61a6 # v1.4.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 90
           field: Status
           field-value: 🛑 Blocked
-          fail-if-item-not-found: false
   issue-labeled-blocked-need-repro:
     name: blocked/need-repro label added
     if: github.event.label.name == 'blocked/need-repro'

.github/workflows/issue-opened.yml

@@ -19,7 +19,7 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
       - name: Add to Issue Triage
-        uses: dsanders11/project-actions/add-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/add-item@438b25e007c2f4efec324497fadc6402e7cc61a6 # v1.4.0
         with:
           field: Reporter
           field-value: ${{ github.event.issue.user.login }}

.github/workflows/issue-transferred.yml

@@ -10,7 +10,6 @@ jobs:
   issue-transferred:
     name: Issue Transferred
     runs-on: ubuntu-latest
-    if: ${{ !github.event.changes.new_repository.private }}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -19,9 +18,7 @@ jobs:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
           org: electron
       - name: Remove from issue triage
-        uses: dsanders11/project-actions/delete-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/delete-item@438b25e007c2f4efec324497fadc6402e7cc61a6 # v1.4.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 90
-          item: ${{ github.event.changes.new_issue.html_url }}
-          fail-if-item-not-found: false

.github/workflows/issue-unlabeled.yml

@@ -30,10 +30,9 @@ jobs:
           org: electron
       - name: Set status
         if: ${{ steps.check-for-blocked-labels.outputs.NOT_BLOCKED }}
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@438b25e007c2f4efec324497fadc6402e7cc61a6 # v1.4.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 90
           field: Status
           field-value: 📥 Was Blocked
-          fail-if-item-not-found: false

.github/workflows/pipeline-electron-build-and-test-and-nan.yml

@@ -56,8 +56,8 @@ on:
         default: false
 
 concurrency:
-  group: electron-build-and-test-and-nan-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-build-and-test-and-nan-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
 
 jobs:
   build:

.github/workflows/pipeline-electron-build-and-test.yml

@@ -56,8 +56,8 @@ on:
         default: false
 
 concurrency:
-  group: electron-build-and-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-build-and-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
 
 permissions:
   contents: read

.github/workflows/pipeline-electron-lint.yml

@@ -9,8 +9,8 @@ on:
         type: string
 
 concurrency:
-  group: electron-lint-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-lint-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
 
 jobs:
   lint:

.github/workflows/pipeline-segment-electron-build.yml

@@ -61,8 +61,8 @@ on:
 
 
 concurrency:
-  group: electron-build-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.target-variant }}-${{ inputs.is-asan }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-build-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.target-variant }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
 
 env:
   ELECTRON_ARTIFACTS_BLOB_STORAGE: ${{ secrets.ELECTRON_ARTIFACTS_BLOB_STORAGE }}
@@ -100,7 +100,7 @@ jobs:
       run: df -h
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'macos' }}
-      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a
+      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
       with:
         node-version: 20.11.x
         cache: yarn

.github/workflows/pipeline-segment-electron-test.yml

@@ -27,8 +27,8 @@ on:
         default: false
 
 concurrency:
-  group: electron-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
 
 permissions:
   contents: read
@@ -74,9 +74,10 @@ jobs:
         echo "C:\Program Files\Git\cmd" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
         echo "C:\Program Files\Git\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
         echo "C:\Python311" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+        cp "C:\Python311\python.exe" "C:\Python311\python3.exe"
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'win' }}
-      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a
+      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
       with:
         node-version: 20.11.x
     - name: Add TCC permissions on macOS
@@ -239,7 +240,7 @@ jobs:
       if: always() && !cancelled()
     - name: Upload Test Artifacts
       if: always() && !cancelled()
-      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b
       with:
         name: test_artifacts_${{ env.ARTIFACT_KEY }}_${{ matrix.shard }}
         path: src/electron/spec/artifacts

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -27,8 +27,8 @@ on:
         default: testing
 
 concurrency:
-  group: electron-node-nan-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !endsWith(github.ref, '-x-y') }}
+  group: electron-node-nan-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
 
 env:
   ELECTRON_OUT_DIR: Default

.github/workflows/pull-request-labeled.yml

@@ -15,12 +15,12 @@ jobs:
       - name: Trigger Slack workflow
         uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
         with:
+          webhook: ${{ secrets.BACKPORT_REQUESTED_SLACK_WEBHOOK_URL }} 
+          webhook-type: webhook-trigger
           payload: |
             {
               "url": "${{ github.event.pull_request.html_url }}"
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.BACKPORT_REQUESTED_SLACK_WEBHOOK_URL }}
   pull-request-labeled-deprecation-review-complete:
     name: deprecation-review/complete label added
     if: github.event.label.name == 'deprecation-review/complete ✅'
@@ -33,7 +33,7 @@ jobs:
           creds: ${{ secrets.RELEASE_BOARD_GH_APP_CREDS }}
           org: electron
       - name: Set status
-        uses: dsanders11/project-actions/edit-item@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/edit-item@438b25e007c2f4efec324497fadc6402e7cc61a6 # v1.4.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
           project-number: 94

.github/workflows/scorecards.yml

@@ -42,7 +42,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: SARIF file
           path: results.sarif
@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
         with:
           sarif_file: results.sarif

.github/workflows/stable-prep-items.yml

@@ -27,7 +27,7 @@ jobs:
           PROJECT_NUMBER=$(gh project list --owner electron --format json | jq -r '.projects | map(select(.title | test("^[0-9]+-x-y$"))) | max_by(.number) | .number')
           echo "PROJECT_NUMBER=$PROJECT_NUMBER" >> "$GITHUB_OUTPUT"
       - name: Update Completed Stable Prep Items
-        uses: dsanders11/project-actions/completed-by@9c80cd31f58599941c64f74636bea95ba5d46090 # v1.5.1
+        uses: dsanders11/project-actions/completed-by@438b25e007c2f4efec324497fadc6402e7cc61a6 # v1.4.0
         with:
           field: Prep Status
           field-value: ✅ Complete

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
         id: generate-token
         with:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
-      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # tag: v9.1.0
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # tag: v9.0.0
         with:
           repo-token: ${{ steps.generate-token.outputs.token }}
           days-before-stale: 90
@@ -39,7 +39,7 @@ jobs:
         id: generate-token
         with:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
-      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # tag: v9.1.0
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # tag: v9.0.0
         with:
           repo-token: ${{ steps.generate-token.outputs.token }}
           days-before-stale: -1

.github/workflows/update_appveyor_image.yml

@@ -25,7 +25,7 @@ jobs:
         token: ${{ steps.generate-token.outputs.token }}
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Setup Node.js
-      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
+      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
       with:
         node-version: 20.11.x
     - name: Yarn install
@@ -44,7 +44,7 @@ jobs:
         fi
     - name: (Optionally) Update Appveyor Image
       if: ${{ env.APPVEYOR_IMAGE_VERSION }}
-      uses: mikefarah/yq@8bf425b4d1344db7cd469a8d10a390876e0c77fd # v4.45.1
+      uses: mikefarah/yq@4839dbbf80445070a31c7a9c1055da527db2d5ee # v4.44.6
       with:
         cmd: |
           yq '.image = "${{ env.APPVEYOR_IMAGE_VERSION }}"' "appveyor.yml" > "appveyor2.yml"

.github/workflows/windows-publish.yml

@@ -34,7 +34,7 @@ jobs:
       build-image-sha: ${{ inputs.build-image-sha }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
       with:
         path: src/electron
         fetch-depth: 0

BUILD.gn

@@ -224,11 +224,21 @@ webpack_build("electron_utility_bundle") {
   out_file = "$target_gen_dir/js2c/utility_init.js"
 }
 
+webpack_build("electron_preload_realm_bundle") {
+  deps = [ ":build_electron_definitions" ]
+
+  inputs = auto_filenames.preload_realm_bundle_deps
+
+  config_file = "//electron/build/webpack/webpack.config.preload_realm.js"
+  out_file = "$target_gen_dir/js2c/preload_realm_bundle.js"
+}
+
 action("electron_js2c") {
   deps = [
     ":electron_browser_bundle",
     ":electron_isolated_renderer_bundle",
     ":electron_node_bundle",
+    ":electron_preload_realm_bundle",
     ":electron_renderer_bundle",
     ":electron_sandboxed_renderer_bundle",
     ":electron_utility_bundle",
@@ -240,6 +250,7 @@ action("electron_js2c") {
     "$target_gen_dir/js2c/browser_init.js",
     "$target_gen_dir/js2c/isolated_bundle.js",
     "$target_gen_dir/js2c/node_init.js",
+    "$target_gen_dir/js2c/preload_realm_bundle.js",
     "$target_gen_dir/js2c/renderer_init.js",
     "$target_gen_dir/js2c/sandbox_bundle.js",
     "$target_gen_dir/js2c/utility_init.js",
@@ -430,6 +441,7 @@ source_set("electron_lib") {
     "chromium_src:chrome_spellchecker",
     "shell/common:mojo",
     "shell/common:plugin",
+    "shell/common:web_contents_utility",
     "shell/services/node/public/mojom",
     "//base:base_static",
     "//base/allocator:buildflags",

DEPS

@@ -4,7 +4,7 @@ vars = {
   'chromium_version':
     '134.0.6968.0',
   'node_version':
-    'v22.11.0',
+    'v22.9.0',
   'nan_version':
     'e14bdcd1f72d62bca1d541b66da43130384ec213',
   'squirrel.mac_version':

build/webpack/webpack.config.preload_realm.js

@@ -0,0 +1,6 @@
+module.exports = require('./webpack.config.base')({
+  target: 'preload_realm',
+  alwaysHasNode: false,
+  wrapInitWithProfilingTimeout: true,
+  wrapInitWithTryCatch: true
+});

docs/api/global-shortcut.md

@@ -12,17 +12,9 @@ shortcuts.
 not have the keyboard focus. This module cannot be used before the `ready`
 event of the app module is emitted.
 
-Please also note that it is also possible to use Chromium's
-`GlobalShortcutsPortal` implementation, which allows apps to bind global
-shortcuts when running within a Wayland session.
-
 ```js
 const { app, globalShortcut } = require('electron')
 
-// Enable usage of Portal's globalShortcuts. This is essential for cases when
-// the app runs in a Wayland session.
-app.commandLine.appendSwitch('enable-features', 'GlobalShortcutsPortal')
-
 app.whenReady().then(() => {
   // Register a 'CommandOrControl+X' shortcut listener.
   const ret = globalShortcut.register('CommandOrControl+X', () => {

docs/api/ipc-main-service-worker.md

@@ -0,0 +1,75 @@
+## Class: IpcMainServiceWorker
+
+> Communicate asynchronously from the main process to service workers.
+
+Process: [Main](../glossary.md#main-process)
+
+> [!NOTE]
+> This API is a subtle variation of [`IpcMain`](ipc-main.md)—targeted for
+> communicating with service workers. For communicating with web frames,
+> consult the `IpcMain` documentation.
+
+<!-- TODO(samuelmaddock): refactor doc gen to allow generics to reduce duplication -->
+
+### Instance Methods
+
+#### `ipcMainServiceWorker.on(channel, listener)`
+
+* `channel` string
+* `listener` Function
+  * `event` [IpcMainServiceWorkerEvent][ipc-main-service-worker-event]
+  * `...args` any[]
+
+Listens to `channel`, when a new message arrives `listener` would be called with
+`listener(event, args...)`.
+
+#### `ipcMainServiceWorker.once(channel, listener)`
+
+* `channel` string
+* `listener` Function
+  * `event` [IpcMainServiceWorkerEvent][ipc-main-service-worker-event]
+  * `...args` any[]
+
+Adds a one time `listener` function for the event. This `listener` is invoked
+only the next time a message is sent to `channel`, after which it is removed.
+
+#### `ipcMainServiceWorker.removeListener(channel, listener)`
+
+* `channel` string
+* `listener` Function
+  * `...args` any[]
+
+Removes the specified `listener` from the listener array for the specified
+`channel`.
+
+#### `ipcMainServiceWorker.removeAllListeners([channel])`
+
+* `channel` string (optional)
+
+Removes listeners of the specified `channel`.
+
+#### `ipcMainServiceWorker.handle(channel, listener)`
+
+* `channel` string
+* `listener` Function\<Promise\<any\> | any\>
+  * `event` [IpcMainServiceWorkerInvokeEvent][ipc-main-service-worker-invoke-event]
+  * `...args` any[]
+
+#### `ipcMainServiceWorker.handleOnce(channel, listener)`
+
+* `channel` string
+* `listener` Function\<Promise\<any\> | any\>
+  * `event` [IpcMainServiceWorkerInvokeEvent][ipc-main-service-worker-invoke-event]
+  * `...args` any[]
+
+Handles a single `invoke`able IPC message, then removes the listener. See
+`ipcMainServiceWorker.handle(channel, listener)`.
+
+#### `ipcMainServiceWorker.removeHandler(channel)`
+
+* `channel` string
+
+Removes any handler for `channel`, if present.
+
+[ipc-main-service-worker-event]:../api/structures/ipc-main-service-worker-event.md
+[ipc-main-service-worker-invoke-event]:../api/structures/ipc-main-service-worker-invoke-event.md

docs/api/ipc-renderer.md

@@ -41,6 +41,16 @@ The `ipcRenderer` module has the following method to listen for events and send
 Listens to `channel`, when a new message arrives `listener` would be called with
 `listener(event, args...)`.
 
+:::warning
+Do not expose the `event` argument to the renderer for security reasons! Wrap any
+callback that you receive from the renderer in another function like this:
+`ipcRenderer.on('my-channel', (event, ...args) => callback(...args))`.
+Not wrapping the callback in such a function would expose dangerous Electron APIs
+to the renderer process. See the
+[security guide](../tutorial/security.md#20-do-not-expose-electron-apis-to-untrusted-web-content)
+for more info.
+:::
+
 ### `ipcRenderer.off(channel, listener)`
 
 * `channel` string

docs/api/process.md

@@ -114,6 +114,7 @@ A `string` representing the current process's type, can be:
 
 * `browser` - The main process
 * `renderer` - A renderer process
+* `service-worker` - In a service worker
 * `worker` - In a web worker
 * `utility` - In a node process launched as a service
 

docs/api/service-worker-main.md

@@ -15,6 +15,19 @@ _This class is not exported from the `'electron'` module. It is only available a
 
 Returns `boolean` - Whether the service worker has been destroyed.
 
+#### `serviceWorker.send(channel, ...args)` _Experimental_
+
+- `channel` string
+- `...args` any[]
+
+Send an asynchronous message to the service worker process via `channel`, along with
+arguments. Arguments will be serialized with the [Structured Clone Algorithm][SCA],
+just like [`postMessage`][], so prototype chains will not be included.
+Sending Functions, Promises, Symbols, WeakMaps, or WeakSets will throw an exception.
+
+The service worker process can handle the message by listening to `channel` with the
+[`ipcRenderer`](ipc-renderer.md) module.
+
 #### `serviceWorker.startTask()` _Experimental_
 
 Returns `Object`:
@@ -25,6 +38,10 @@ Initiate a task to keep the service worker alive until ended.
 
 ### Instance Properties
 
+#### `serviceWorker.ipc` _Readonly_ _Experimental_
+
+An [`IpcMainServiceWorker`](ipc-main-service-worker.md) instance scoped to the service worker.
+
 #### `serviceWorker.scope` _Readonly_ _Experimental_
 
 A `string` representing the scope URL of the service worker.
@@ -32,3 +49,6 @@ A `string` representing the scope URL of the service worker.
 #### `serviceWorker.versionId` _Readonly_ _Experimental_
 
 A `number` representing the ID of the specific version of the service worker script in its scope.
+
+[SCA]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm
+[`postMessage`]: https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage

docs/api/service-workers.md

@@ -107,8 +107,6 @@ Returns `Promise<ServiceWorkerMain>` - Resolves with the service worker when it'
 
 Starts the service worker or does nothing if already running.
 
-<!-- TODO(samuelmaddock): extend example to send IPC after starting worker -->
-
 ```js
 const { app, session } = require('electron')
 const { serviceWorkers } = session.defaultSession
@@ -120,7 +118,8 @@ app.on('browser-window-created', async (event, window) => {
   for (const scope of workerScopes) {
     try {
       // Ensure worker is started
-      await serviceWorkers.startWorkerForScope(scope)
+      const serviceWorker = await serviceWorkers.startWorkerForScope(scope)
+      serviceWorker.send('window-created', { windowId: window.id })
     } catch (error) {
       console.error(`Failed to start service worker for ${scope}`)
       console.error(error)

docs/api/session.md

@@ -933,6 +933,7 @@ session.fromPartition('some-partition').setPermissionRequestHandler((webContents
     * `storage-access` - Allows content loaded in a third-party context to request access to third-party cookies using the [Storage Access API](https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API).
     * `top-level-storage-access` -  Allow top-level sites to request third-party cookie access on behalf of embedded content originating from another site in the same related website set using the [Storage Access API](https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API).
     * `usb` - Expose non-standard Universal Serial Bus (USB) compatible devices services to the web with the [WebUSB API](https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API).
+    * `deprecated-sync-clipboard-read` _Deprecated_ - Request access to run `document.execCommand("paste")`
   * `requestingOrigin` string - The origin URL of the permission check
   * `details` Object - Some properties are only available on certain permission types.
     * `embeddingOrigin` string (optional) - The origin of the frame embedding the frame that made the permission check.  Only set for cross-origin sub frames making permission checks.

docs/api/structures/base-window-options.md

@@ -149,7 +149,7 @@ Possible values are:
     focus, keyboard or mouse events, but you can use `globalShortcut` to receive
     input sparingly.
   * The `panel` type enables the window to float on top of full-screened apps
-    by adding the `NSWindowStyleMaskNonactivatingPanel` style mask,normally
+    by adding the `NSWindowStyleMaskNonactivatingPanel` style mask, normally
     reserved for NSPanel, at runtime. Also, the window will appear on all
     spaces (desktops).
 * On Windows, possible type is `toolbar`.

docs/api/structures/display.md

@@ -5,7 +5,7 @@
 * `colorDepth` number - The number of bits per pixel.
 * `colorSpace` string -  represent a color space (three-dimensional object which contains all realizable color combinations) for the purpose of color conversions.
 * `depthPerComponent` number - The number of bits per color component.
-* `detected` boolean - `true`` if the display is detected by the system.
+* `detected` boolean - `true` if the display is detected by the system.
 * `displayFrequency` number - The display refresh rate.
 * `id` number - Unique identifier associated with the display. A value of of -1 means the display is invalid or the correct `id` is not yet known, and a value of -10 means the display is a virtual display assigned to a unified desktop.
 * `internal` boolean - `true` for an internal display and `false` for an external display.

docs/api/structures/ipc-main-event.md

@@ -1,5 +1,6 @@
 # IpcMainEvent Object extends `Event`
 
+* `type` String - Possible values include `frame`
 * `processId` Integer - The internal ID of the renderer process that sent this message
 * `frameId` Integer - The ID of the renderer frame that sent this message
 * `returnValue` any - Set this to the value to be returned in a synchronous message

docs/api/structures/ipc-main-invoke-event.md

@@ -1,5 +1,6 @@
 # IpcMainInvokeEvent Object extends `Event`
 
+* `type` String - Possible values include `frame`
 * `processId` Integer - The internal ID of the renderer process that sent this message
 * `frameId` Integer - The ID of the renderer frame that sent this message
 * `sender` [WebContents](../web-contents.md) - Returns the `webContents` that sent the message

docs/api/structures/ipc-main-service-worker-event.md

@@ -0,0 +1,11 @@
+# IpcMainServiceWorkerEvent Object extends `Event`
+
+* `type` String - Possible values include `service-worker`.
+* `serviceWorker` [ServiceWorkerMain](../service-worker-main.md) _Readonly_ - The service worker that sent this message
+* `versionId` Number - The service worker version ID.
+* `session` Session - The [`Session`](../session.md) instance with which the event is associated.
+* `returnValue` any - Set this to the value to be returned in a synchronous message
+* `ports` [MessagePortMain](../message-port-main.md)[] - A list of MessagePorts that were transferred with this message
+* `reply` Function - A function that will send an IPC message to the renderer frame that sent the original message that you are currently handling.  You should use this method to "reply" to the sent message in order to guarantee the reply will go to the correct process and frame.
+  * `channel` string
+  * `...args` any[]

docs/api/structures/ipc-main-service-worker-invoke-event.md

@@ -0,0 +1,6 @@
+# IpcMainServiceWorkerInvokeEvent Object extends `Event`
+
+* `type` String - Possible values include `service-worker`.
+* `serviceWorker` [ServiceWorkerMain](../service-worker-main.md) _Readonly_ - The service worker that sent this message
+* `versionId` Number - The service worker version ID.
+* `session` Session - The [`Session`](../session.md) instance with which the event is associated.

docs/api/structures/preload-script-registration.md

@@ -1,6 +1,6 @@
 # PreloadScriptRegistration Object
 
 * `type` string - Context type where the preload script will be executed.
-  Possible values include `frame`.
+  Possible values include `frame` or `service-worker`.
 * `id` string (optional) - Unique ID of preload script. Defaults to a random UUID.
 * `filePath` string - Path of the script file. Must be an absolute path.

docs/api/structures/preload-script.md

@@ -1,6 +1,6 @@
 # PreloadScript Object
 
 * `type` string - Context type where the preload script will be executed.
-  Possible values include `frame`.
+  Possible values include `frame` or `service-worker`.
 * `id` string - Unique ID of preload script.
 * `filePath` string - Path of the script file. Must be an absolute path.

docs/api/structures/web-preferences.md

@@ -148,6 +148,7 @@
   this will cause the `preferred-size-changed` event to be emitted on the
   `WebContents` when the preferred size changes. Default is `false`.
 * `transparent` boolean (optional) - Whether to enable background transparency for the guest page. Default is `true`. **Note:** The guest page's text and background colors are derived from the [color scheme](https://developer.mozilla.org/en-US/docs/Web/CSS/color-scheme) of its root element. When transparency is enabled, the text color will still change accordingly but the background will remain transparent.
+* `enableDeprecatedPaste` boolean (optional) _Deprecated_ - Whether to enable the `paste` [execCommand](https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand). Default is `false`.
 
 [chrome-content-scripts]: https://developer.chrome.com/extensions/content_scripts#execution-environment
 [runtime-enabled-features]: https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/platform/runtime_enabled_features.json5

docs/api/view.md

@@ -106,6 +106,12 @@ Examples of valid `color` values:
 
 * `visible` boolean - If false, the view will be hidden from display.
 
+#### `view.getVisible()`
+
+Returns `boolean` - Whether the view should be drawn. Note that this is
+different from whether the view is visible on screen—it may still be obscured
+or out of view.
+
 ### Instance Properties
 
 Objects created with `new View` have the following properties:

docs/breaking-changes.md

@@ -14,21 +14,6 @@ This document uses the following convention to categorize breaking changes:
 
 ## Planned Breaking API Changes (35.0)
 
-### Deprecated: `getFromVersionID` on `session.serviceWorkers`
-
-The `session.serviceWorkers.fromVersionID(versionId)` API has been deprecated
-in favor of `session.serviceWorkers.getInfoFromVersionID(versionId)`. This was
-changed to make it more clear which object is returned with the introduction
-of the `session.serviceWorkers.getWorkerFromVersionID(versionId)` API.
-
-```js
-// Deprecated
-session.serviceWorkers.fromVersionID(versionId)
-
-// Replace with
-session.serviceWorkers.getInfoFromVersionID(versionId)
-```
-
 ### Deprecated: `setPreloads`, `getPreloads` on `Session`
 
 `registerPreloadScript`, `unregisterPreloadScript`, and `getPreloadScripts` are introduced as a
@@ -48,6 +33,21 @@ session.registerPreloadScript({
 })
 ```
 
+### Deprecated: `getFromVersionID` on `session.serviceWorkers`
+
+The `session.serviceWorkers.fromVersionID(versionId)` API has been deprecated
+in favor of `session.serviceWorkers.getInfoFromVersionID(versionId)`. This was
+changed to make it more clear which object is returned with the introduction
+of the `session.serviceWorkers.getWorkerFromVersionID(versionId)` API.
+
+```js
+// Deprecated
+session.serviceWorkers.fromVersionID(versionId)
+
+// Replace with
+session.serviceWorkers.getInfoFromVersionID(versionId)
+```
+
 ### Deprecated: `level`, `message`, `line`, and `sourceId` arguments in `console-message` event on `WebContents`
 
 The `console-message` event on `WebContents` has been updated to provide details on the `Event`
@@ -73,6 +73,15 @@ This brings the behavior to parity with Linux. Prior behavior: Menu bar is still
 
 ## Planned Breaking API Changes (33.0)
 
+### Deprecated: `document.execCommand("paste")`
+
+The synchronous clipboard read API [document.execCommand("paste")](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Interact_with_the_clipboard) has been
+deprecated in favor of [async clipboard API](https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_API). This is to align with the browser defaults.
+
+The `enableDeprecatedPaste` option on `WebPreferences` that triggers the permission
+checks for this API and the associated permission type `deprecated-sync-clipboard-read`
+are also deprecated.
+
 ### Behavior Changed: frame properties may retrieve detached WebFrameMain instances or none at all
 
 APIs which provide access to a `WebFrameMain` instance may return an instance
@@ -145,6 +154,16 @@ macOS 10.15 (Catalina) is no longer supported by [Chromium](https://chromium-rev
 Older versions of Electron will continue to run on Catalina, but macOS 11 (Big Sur)
 or later will be required to run Electron v33.0.0 and higher.
 
+### Behavior Changed: Native modules now require C++20
+
+Due to changes made upstream, both
+[V8](https://chromium-review.googlesource.com/c/v8/v8/+/5587859) and
+[Node.js](https://github.com/nodejs/node/pull/45427) now require C++20 as a
+minimum version. Developers using native node modules should build their
+modules with `--std=c++20` rather than `--std=c++17`. Images using gcc9 or
+lower may need to update to gcc10 in order to compile. See
+[#43555](https://github.com/electron/electron/pull/43555) for more details.
+
 ### Deprecated: `systemPreferences.accessibilityDisplayShouldReduceTransparency`
 
 The `systemPreferences.accessibilityDisplayShouldReduceTransparency` property is now deprecated in favor of the new `nativeTheme.prefersReducedTransparency`, which provides identical information and works cross-platform.
@@ -216,6 +235,14 @@ win.webContents.navigationHistory.canGoToOffset()
 win.webContents.navigationHistory.goToOffset(index)
 ```
 
+### Behavior changed: Directory `databases` in `userData` will be deleted
+
+If you have a directory called `databases` in the directory returned by
+`app.getPath('userData')`, it will be deleted when Electron 32 is first run.
+The `databases` directory was used by WebSQL, which was removed in Electron 31.
+Chromium now performs a cleanup that deletes this directory. See
+[issue #45396](https://github.com/electron/electron/issues/45396).
+
 ## Planned Breaking API Changes (31.0)
 
 ### Removed: `WebSQL` support

filenames.auto.gni

@@ -25,6 +25,7 @@ auto_filenames = {
     "docs/api/global-shortcut.md",
     "docs/api/in-app-purchase.md",
     "docs/api/incoming-message.md",
+    "docs/api/ipc-main-service-worker.md",
     "docs/api/ipc-main.md",
     "docs/api/ipc-renderer.md",
     "docs/api/menu-item.md",
@@ -95,6 +96,8 @@ auto_filenames = {
     "docs/api/structures/input-event.md",
     "docs/api/structures/ipc-main-event.md",
     "docs/api/structures/ipc-main-invoke-event.md",
+    "docs/api/structures/ipc-main-service-worker-event.md",
+    "docs/api/structures/ipc-main-service-worker-invoke-event.md",
     "docs/api/structures/ipc-renderer-event.md",
     "docs/api/structures/jump-list-category.md",
     "docs/api/structures/jump-list-item.md",
@@ -172,6 +175,8 @@ auto_filenames = {
     "lib/renderer/api/web-utils.ts",
     "lib/renderer/common-init.ts",
     "lib/renderer/inspector.ts",
+    "lib/renderer/ipc-native-setup.ts",
+    "lib/renderer/ipc-renderer-bindings.ts",
     "lib/renderer/ipc-renderer-internal-utils.ts",
     "lib/renderer/ipc-renderer-internal.ts",
     "lib/renderer/security-warnings.ts",
@@ -261,6 +266,7 @@ auto_filenames = {
     "lib/browser/guest-view-manager.ts",
     "lib/browser/guest-window-manager.ts",
     "lib/browser/init.ts",
+    "lib/browser/ipc-dispatch.ts",
     "lib/browser/ipc-main-impl.ts",
     "lib/browser/ipc-main-internal-utils.ts",
     "lib/browser/ipc-main-internal.ts",
@@ -305,6 +311,8 @@ auto_filenames = {
     "lib/renderer/common-init.ts",
     "lib/renderer/init.ts",
     "lib/renderer/inspector.ts",
+    "lib/renderer/ipc-native-setup.ts",
+    "lib/renderer/ipc-renderer-bindings.ts",
     "lib/renderer/ipc-renderer-internal-utils.ts",
     "lib/renderer/ipc-renderer-internal.ts",
     "lib/renderer/security-warnings.ts",
@@ -339,6 +347,7 @@ auto_filenames = {
     "lib/renderer/api/module-list.ts",
     "lib/renderer/api/web-frame.ts",
     "lib/renderer/api/web-utils.ts",
+    "lib/renderer/ipc-renderer-bindings.ts",
     "lib/renderer/ipc-renderer-internal-utils.ts",
     "lib/renderer/ipc-renderer-internal.ts",
     "lib/worker/init.ts",
@@ -379,4 +388,27 @@ auto_filenames = {
     "typings/internal-ambient.d.ts",
     "typings/internal-electron.d.ts",
   ]
+
+  preload_realm_bundle_deps = [
+    "lib/common/api/native-image.ts",
+    "lib/common/define-properties.ts",
+    "lib/common/ipc-messages.ts",
+    "lib/common/webpack-globals-provider.ts",
+    "lib/preload_realm/api/exports/electron.ts",
+    "lib/preload_realm/api/module-list.ts",
+    "lib/preload_realm/init.ts",
+    "lib/renderer/api/context-bridge.ts",
+    "lib/renderer/api/ipc-renderer.ts",
+    "lib/renderer/ipc-native-setup.ts",
+    "lib/renderer/ipc-renderer-bindings.ts",
+    "lib/renderer/ipc-renderer-internal-utils.ts",
+    "lib/renderer/ipc-renderer-internal.ts",
+    "lib/sandboxed_renderer/pre-init.ts",
+    "lib/sandboxed_renderer/preload.ts",
+    "package.json",
+    "tsconfig.electron.json",
+    "tsconfig.json",
+    "typings/internal-ambient.d.ts",
+    "typings/internal-electron.d.ts",
+  ]
 }

filenames.gni

@@ -324,6 +324,7 @@ filenames = {
     "shell/browser/api/gpu_info_enumerator.h",
     "shell/browser/api/gpuinfo_manager.cc",
     "shell/browser/api/gpuinfo_manager.h",
+    "shell/browser/api/ipc_dispatcher.h",
     "shell/browser/api/message_port.cc",
     "shell/browser/api/message_port.h",
     "shell/browser/api/process_metric.cc",
@@ -355,6 +356,8 @@ filenames = {
     "shell/browser/draggable_region_provider.h",
     "shell/browser/electron_api_ipc_handler_impl.cc",
     "shell/browser/electron_api_ipc_handler_impl.h",
+    "shell/browser/electron_api_sw_ipc_handler_impl.cc",
+    "shell/browser/electron_api_sw_ipc_handler_impl.h",
     "shell/browser/electron_autofill_driver.cc",
     "shell/browser/electron_autofill_driver.h",
     "shell/browser/electron_autofill_driver_factory.cc",
@@ -658,6 +661,8 @@ filenames = {
     "shell/common/gin_helper/pinnable.h",
     "shell/common/gin_helper/promise.cc",
     "shell/common/gin_helper/promise.h",
+    "shell/common/gin_helper/reply_channel.cc",
+    "shell/common/gin_helper/reply_channel.h",
     "shell/common/gin_helper/trackable_object.cc",
     "shell/common/gin_helper/trackable_object.h",
     "shell/common/gin_helper/wrappable.cc",
@@ -707,14 +712,22 @@ filenames = {
     "shell/renderer/electron_api_service_impl.h",
     "shell/renderer/electron_autofill_agent.cc",
     "shell/renderer/electron_autofill_agent.h",
+    "shell/renderer/electron_ipc_native.cc",
+    "shell/renderer/electron_ipc_native.h",
     "shell/renderer/electron_render_frame_observer.cc",
     "shell/renderer/electron_render_frame_observer.h",
     "shell/renderer/electron_renderer_client.cc",
     "shell/renderer/electron_renderer_client.h",
     "shell/renderer/electron_sandboxed_renderer_client.cc",
     "shell/renderer/electron_sandboxed_renderer_client.h",
+    "shell/renderer/preload_realm_context.cc",
+    "shell/renderer/preload_realm_context.h",
+    "shell/renderer/preload_utils.cc",
+    "shell/renderer/preload_utils.h",
     "shell/renderer/renderer_client_base.cc",
     "shell/renderer/renderer_client_base.h",
+    "shell/renderer/service_worker_data.cc",
+    "shell/renderer/service_worker_data.h",
     "shell/renderer/web_worker_observer.cc",
     "shell/renderer/web_worker_observer.h",
     "shell/services/node/node_service.cc",

lib/browser/api/service-worker-main.ts

@@ -1,5 +1,27 @@
+import { IpcMainImpl } from '@electron/internal/browser/ipc-main-impl';
+
 const { ServiceWorkerMain } = process._linkedBinding('electron_browser_service_worker_main');
 
+Object.defineProperty(ServiceWorkerMain.prototype, 'ipc', {
+  get () {
+    const ipc = new IpcMainImpl();
+    Object.defineProperty(this, 'ipc', { value: ipc });
+    return ipc;
+  }
+});
+
+ServiceWorkerMain.prototype.send = function (channel, ...args) {
+  if (typeof channel !== 'string') {
+    throw new TypeError('Missing required channel argument');
+  }
+
+  try {
+    return this._send(false /* internal */, channel, args);
+  } catch (e) {
+    console.error('Error sending from ServiceWorkerMain: ', e);
+  }
+};
+
 ServiceWorkerMain.prototype.startTask = function () {
   // TODO(samuelmaddock): maybe make timeout configurable in the future
   const hasTimeout = false;

lib/browser/api/session.ts

@@ -1,4 +1,5 @@
 import { fetchWithSession } from '@electron/internal/browser/api/net-fetch';
+import { addIpcDispatchListeners } from '@electron/internal/browser/ipc-dispatch';
 import * as deprecate from '@electron/internal/common/deprecate';
 
 import { net } from 'electron/main';
@@ -21,6 +22,10 @@ Object.defineProperty(systemPickerVideoSource, 'id', {
 systemPickerVideoSource.name = '';
 Object.freeze(systemPickerVideoSource);
 
+Session.prototype._init = function () {
+  addIpcDispatchListeners(this, this.serviceWorkers);
+};
+
 Session.prototype.fetch = function (input: RequestInfo, init?: RequestInit) {
   return fetchWithSession(input, init, this, net.request);
 };

lib/browser/devtools.ts

@@ -69,6 +69,7 @@ const assertChromeDevTools = function (contents: Electron.WebContents, api: stri
 
 ipcMainInternal.handle(IPC_MESSAGES.INSPECTOR_CONTEXT_MENU, function (event, items: ContextMenuItem[], isEditMenu: boolean) {
   return new Promise<number | void>(resolve => {
+    if (event.type !== 'frame') return;
     assertChromeDevTools(event.sender, 'window.InspectorFrontendHost.showContextMenuAtPoint()');
 
     const template = isEditMenu ? getEditMenuItems() : convertToMenuTemplate(items, resolve);
@@ -80,6 +81,7 @@ ipcMainInternal.handle(IPC_MESSAGES.INSPECTOR_CONTEXT_MENU, function (event, ite
 });
 
 ipcMainInternal.handle(IPC_MESSAGES.INSPECTOR_SELECT_FILE, async function (event) {
+  if (event.type !== 'frame') return [];
   assertChromeDevTools(event.sender, 'window.UI.createFileSelectorElement()');
 
   const result = await dialog.showOpenDialog({});
@@ -92,6 +94,7 @@ ipcMainInternal.handle(IPC_MESSAGES.INSPECTOR_SELECT_FILE, async function (event
 });
 
 ipcMainUtils.handleSync(IPC_MESSAGES.INSPECTOR_CONFIRM, async function (event, message: string = '', title: string = '') {
+  if (event.type !== 'frame') return;
   assertChromeDevTools(event.sender, 'window.confirm()');
 
   const options = {

lib/browser/guest-view-manager.ts

@@ -267,9 +267,10 @@ const isWebViewTagEnabled = function (contents: Electron.WebContents) {
 };
 
 const makeSafeHandler = function<Event extends { sender: Electron.WebContents }> (channel: string, handler: (event: Event, ...args: any[]) => any) {
-  return (event: Event, ...args: any[]) => {
+  return (event: Electron.IpcMainInvokeEvent | Electron.IpcMainServiceWorkerInvokeEvent, ...args: any[]) => {
+    if (event.type !== 'frame') return;
     if (isWebViewTagEnabled(event.sender)) {
-      return handler(event, ...args);
+      return handler(event as unknown as Event, ...args);
     } else {
       console.error(`<webview> IPC message ${channel} sent by WebContents with <webview> disabled (${event.sender.id})`);
       throw new Error('<webview> disabled');
@@ -281,7 +282,7 @@ const handleMessage = function (channel: string, handler: (event: Electron.IpcMa
   ipcMainInternal.handle(channel, makeSafeHandler(channel, handler));
 };
 
-const handleMessageSync = function (channel: string, handler: (event: ElectronInternal.IpcMainInternalEvent, ...args: any[]) => any) {
+const handleMessageSync = function (channel: string, handler: (event: { sender: Electron.WebContents }, ...args: any[]) => any) {
   ipcMainUtils.handleSync(channel, makeSafeHandler(channel, handler));
 };
 
@@ -294,8 +295,10 @@ handleMessageSync(IPC_MESSAGES.GUEST_VIEW_MANAGER_DETACH_GUEST, function (event,
 });
 
 // this message is sent by the actual <webview>
-ipcMainInternal.on(IPC_MESSAGES.GUEST_VIEW_MANAGER_FOCUS_CHANGE, function (event: ElectronInternal.IpcMainInternalEvent, focus: boolean) {
-  event.sender.emit('-focus-change', {}, focus);
+ipcMainInternal.on(IPC_MESSAGES.GUEST_VIEW_MANAGER_FOCUS_CHANGE, function (event, focus: boolean) {
+  if (event.type === 'frame') {
+    event.sender.emit('-focus-change', {}, focus);
+  }
 });
 
 handleMessage(IPC_MESSAGES.GUEST_VIEW_MANAGER_CALL, function (event, guestInstanceId: number, method: string, args: any[]) {

lib/browser/ipc-dispatch.ts

@@ -0,0 +1,91 @@
+import { ipcMainInternal } from '@electron/internal/browser/ipc-main-internal';
+import { MessagePortMain } from '@electron/internal/browser/message-port-main';
+
+import type { ServiceWorkerMain } from 'electron/main';
+
+const v8Util = process._linkedBinding('electron_common_v8_util');
+
+const addReturnValueToEvent = (event: Electron.IpcMainEvent | Electron.IpcMainServiceWorkerEvent) => {
+  Object.defineProperty(event, 'returnValue', {
+    set: (value) => event._replyChannel.sendReply(value),
+    get: () => {}
+  });
+};
+
+/**
+ * Listens for IPC dispatch events on `api`.
+ *
+ * NOTE: Currently this only supports dispatching IPCs for ServiceWorkerMain.
+ */
+export function addIpcDispatchListeners (api: NodeJS.EventEmitter, serviceWorkers: Electron.ServiceWorkers) {
+  const getServiceWorkerFromEvent = (event: Electron.IpcMainServiceWorkerEvent | Electron.IpcMainServiceWorkerInvokeEvent): ServiceWorkerMain | undefined => {
+    return serviceWorkers._getWorkerFromVersionIDIfExists(event.versionId);
+  };
+  const addServiceWorkerPropertyToEvent = (event: Electron.IpcMainServiceWorkerEvent | Electron.IpcMainServiceWorkerInvokeEvent) => {
+    Object.defineProperty(event, 'serviceWorker', {
+      get: () => serviceWorkers.getWorkerFromVersionID(event.versionId)
+    });
+  };
+
+  api.on('-ipc-message' as any, function (event: Electron.IpcMainEvent | Electron.IpcMainServiceWorkerEvent, channel: string, args: any[]) {
+    const internal = v8Util.getHiddenValue<boolean>(event, 'internal');
+
+    if (internal) {
+      ipcMainInternal.emit(channel, event, ...args);
+    } else if (event.type === 'service-worker') {
+      addServiceWorkerPropertyToEvent(event);
+      getServiceWorkerFromEvent(event)?.ipc.emit(channel, event, ...args);
+    }
+  } as any);
+
+  api.on('-ipc-invoke' as any, async function (event: Electron.IpcMainInvokeEvent | Electron.IpcMainServiceWorkerInvokeEvent, channel: string, args: any[]) {
+    const internal = v8Util.getHiddenValue<boolean>(event, 'internal');
+
+    const replyWithResult = (result: any) => event._replyChannel.sendReply({ result });
+    const replyWithError = (error: Error) => {
+      console.error(`Error occurred in handler for '${channel}':`, error);
+      event._replyChannel.sendReply({ error: error.toString() });
+    };
+
+    const targets: (Electron.IpcMainServiceWorker | ElectronInternal.IpcMainInternal | undefined)[] = [];
+
+    if (internal) {
+      targets.push(ipcMainInternal);
+    } else if (event.type === 'service-worker') {
+      addServiceWorkerPropertyToEvent(event);
+      const workerIpc = getServiceWorkerFromEvent(event)?.ipc;
+      targets.push(workerIpc);
+    }
+
+    const target = targets.find(target => (target as any)?._invokeHandlers.has(channel));
+    if (target) {
+      const handler = (target as any)._invokeHandlers.get(channel);
+      try {
+        replyWithResult(await Promise.resolve(handler(event, ...args)));
+      } catch (err) {
+        replyWithError(err as Error);
+      }
+    } else {
+      replyWithError(new Error(`No handler registered for '${channel}'`));
+    }
+  } as any);
+
+  api.on('-ipc-message-sync' as any, function (event: Electron.IpcMainEvent | Electron.IpcMainServiceWorkerEvent, channel: string, args: any[]) {
+    const internal = v8Util.getHiddenValue<boolean>(event, 'internal');
+    addReturnValueToEvent(event);
+    if (internal) {
+      ipcMainInternal.emit(channel, event, ...args);
+    } else if (event.type === 'service-worker') {
+      addServiceWorkerPropertyToEvent(event);
+      getServiceWorkerFromEvent(event)?.ipc.emit(channel, event, ...args);
+    }
+  } as any);
+
+  api.on('-ipc-ports' as any, function (event: Electron.IpcMainEvent | Electron.IpcMainServiceWorkerEvent, channel: string, message: any, ports: any[]) {
+    event.ports = ports.map(p => new MessagePortMain(p));
+    if (event.type === 'service-worker') {
+      addServiceWorkerPropertyToEvent(event);
+      getServiceWorkerFromEvent(event)?.ipc.emit(channel, event, message);
+    }
+  } as any);
+}

lib/browser/ipc-main-internal-utils.ts

@@ -19,7 +19,7 @@ export function invokeInWebContents<T> (sender: Electron.WebContents, command: s
     const requestId = ++nextId;
     const channel = `${command}_RESPONSE_${requestId}`;
     ipcMainInternal.on(channel, function handler (event, error: Error, result: any) {
-      if (event.sender !== sender) {
+      if (event.type === 'frame' && event.sender !== sender) {
         console.error(`Reply to ${command} sent by unexpected WebContents (${event.sender.id})`);
         return;
       }

lib/browser/rpc-server.ts

@@ -9,6 +9,8 @@ import * as path from 'path';
 
 // Implements window.close()
 ipcMainInternal.on(IPC_MESSAGES.BROWSER_WINDOW_CLOSE, function (event) {
+  if (event.type !== 'frame') return;
+
   const window = event.sender.getOwnerBrowserWindow();
   if (window) {
     window.close();
@@ -17,10 +19,12 @@ ipcMainInternal.on(IPC_MESSAGES.BROWSER_WINDOW_CLOSE, function (event) {
 });
 
 ipcMainInternal.handle(IPC_MESSAGES.BROWSER_GET_LAST_WEB_PREFERENCES, function (event) {
+  if (event.type !== 'frame') return;
   return event.sender.getLastWebPreferences();
 });
 
 ipcMainInternal.handle(IPC_MESSAGES.BROWSER_GET_PROCESS_MEMORY_INFO, function (event) {
+  if (event.type !== 'frame') return;
   return event.sender._getProcessMemoryInfo();
 });
 
@@ -45,16 +49,23 @@ ipcMainUtils.handleSync(IPC_MESSAGES.BROWSER_CLIPBOARD_SYNC, function (event, me
 });
 
 const getPreloadScriptsFromEvent = (event: ElectronInternal.IpcMainInternalEvent) => {
-  const session: Electron.Session = event.sender.session;
-  const preloadScripts = session.getPreloadScripts();
-  const framePreloads = preloadScripts.filter(script => script.type === 'frame');
+  const session: Electron.Session = event.type === 'service-worker' ? event.session : event.sender.session;
+  let preloadScripts = session.getPreloadScripts();
 
-  const webPrefPreload = event.sender._getPreloadScript();
-  if (webPrefPreload) framePreloads.push(webPrefPreload);
+  if (event.type === 'frame') {
+    preloadScripts = preloadScripts.filter(script => script.type === 'frame');
+
+    const webPrefPreload = event.sender._getPreloadScript();
+    if (webPrefPreload) preloadScripts.push(webPrefPreload);
+  } else if (event.type === 'service-worker') {
+    preloadScripts = preloadScripts.filter(script => script.type === 'service-worker');
+  } else {
+    throw new Error(`getPreloadScriptsFromEvent: event.type is invalid (${(event as any).type})`);
+  }
 
   // TODO(samuelmaddock): Remove filter after Session.setPreloads is fully
   // deprecated. The new API will prevent relative paths from being registered.
-  return framePreloads.filter(script => path.isAbsolute(script.filePath));
+  return preloadScripts.filter(script => path.isAbsolute(script.filePath));
 };
 
 const readPreloadScript = async function (script: Electron.PreloadScript): Promise<ElectronInternal.PreloadScript> {
@@ -95,5 +106,6 @@ ipcMainUtils.handleSync(IPC_MESSAGES.BROWSER_NONSANDBOX_LOAD, function (event) {
 });
 
 ipcMainInternal.on(IPC_MESSAGES.BROWSER_PRELOAD_ERROR, function (event, preloadPath: string, error: Error) {
-  event.sender.emit('preload-error', event, preloadPath, error);
+  if (event.type !== 'frame') return;
+  event.sender?.emit('preload-error', event, preloadPath, error);
 });

lib/node/asar-fs-wrapper.ts

@@ -871,9 +871,9 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
   const binding = internalBinding('fs');
 
   const { internalModuleStat } = binding;
-  internalBinding('fs').internalModuleStat = (receiver: unknown, pathArgument: string) => {
+  internalBinding('fs').internalModuleStat = (pathArgument: string) => {
     const pathInfo = splitPath(pathArgument);
-    if (!pathInfo.isAsar) return internalModuleStat(receiver, pathArgument);
+    if (!pathInfo.isAsar) return internalModuleStat(pathArgument);
     const { asarPath, filePath } = pathInfo;
 
     // -ENOENT
@@ -908,7 +908,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
       if (withFileTypes) {
         initialItem = [
           [...initialItem], initialItem.map((p: string) => {
-            return internalBinding('fs').internalModuleStat(binding, path.join(originalPath, p));
+            return internalBinding('fs').internalModuleStat(path.join(originalPath, p));
           })
         ];
       }
@@ -941,7 +941,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
 
               readdirResult = [
                 [...files], files.map((p: string) => {
-                  return internalBinding('fs').internalModuleStat(binding, path.join(direntPath, p));
+                  return internalBinding('fs').internalModuleStat(path.join(direntPath, p));
                 })
               ];
             } else {
@@ -962,7 +962,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
         const { 0: pathArg, 1: readDir } = queue.pop();
         for (const ent of readDir) {
           const direntPath = path.join(pathArg, ent);
-          const stat = internalBinding('fs').internalModuleStat(binding, direntPath);
+          const stat = internalBinding('fs').internalModuleStat(direntPath);
           result.push(path.relative(originalPath, direntPath));
 
           if (stat === 1) {
@@ -1014,7 +1014,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
         if (withFileTypes) {
           readdirResult = [
             [...readdirResult], readdirResult.map((p: string) => {
-              return internalBinding('fs').internalModuleStat(binding, path.join(pathArg, p));
+              return internalBinding('fs').internalModuleStat(path.join(pathArg, p));
             })
           ];
         }
@@ -1054,7 +1054,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
         for (let i = 0; i < readdirResult.length; i++) {
           const resultPath = path.join(pathArg, readdirResult[i]);
           const relativeResultPath = path.relative(basePath, resultPath);
-          const stat = internalBinding('fs').internalModuleStat(binding, resultPath);
+          const stat = internalBinding('fs').internalModuleStat(resultPath);
 
           readdirResults.push(relativeResultPath);
           if (stat === 1) pathsQueue.push(resultPath);

lib/preload_realm/.eslintrc.json

@@ -0,0 +1,18 @@
+{
+  "rules": {
+    "no-restricted-imports": [
+      "error",
+      {
+        "paths": [
+          "electron",
+          "electron/main"
+        ],
+        "patterns": [
+          "./*",
+          "../*",
+          "@electron/internal/browser/*"
+        ]
+      }
+    ]
+  }
+}

lib/preload_realm/api/exports/electron.ts

@@ -0,0 +1,6 @@
+import { defineProperties } from '@electron/internal/common/define-properties';
+import { moduleList } from '@electron/internal/preload_realm/api/module-list';
+
+module.exports = {};
+
+defineProperties(module.exports, moduleList);

lib/preload_realm/api/module-list.ts

@@ -0,0 +1,14 @@
+export const moduleList: ElectronInternal.ModuleEntry[] = [
+  {
+    name: 'contextBridge',
+    loader: () => require('@electron/internal/renderer/api/context-bridge')
+  },
+  {
+    name: 'ipcRenderer',
+    loader: () => require('@electron/internal/renderer/api/ipc-renderer')
+  },
+  {
+    name: 'nativeImage',
+    loader: () => require('@electron/internal/common/api/native-image')
+  }
+];

lib/preload_realm/init.ts

@@ -0,0 +1,58 @@
+import '@electron/internal/sandboxed_renderer/pre-init';
+import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
+import type * as ipcRendererUtilsModule from '@electron/internal/renderer/ipc-renderer-internal-utils';
+import { createPreloadProcessObject, executeSandboxedPreloadScripts } from '@electron/internal/sandboxed_renderer/preload';
+
+import * as events from 'events';
+
+declare const binding: {
+  get: (name: string) => any;
+  process: NodeJS.Process;
+  createPreloadScript: (src: string) => Function
+};
+
+const ipcRendererUtils = require('@electron/internal/renderer/ipc-renderer-internal-utils') as typeof ipcRendererUtilsModule;
+
+const {
+  preloadScripts,
+  process: processProps
+} = ipcRendererUtils.invokeSync<{
+  preloadScripts: ElectronInternal.PreloadScript[];
+  process: NodeJS.Process;
+}>(IPC_MESSAGES.BROWSER_SANDBOX_LOAD);
+
+const electron = require('electron');
+
+const loadedModules = new Map<string, any>([
+  ['electron', electron],
+  ['electron/common', electron],
+  ['events', events],
+  ['node:events', events]
+]);
+
+const loadableModules = new Map<string, Function>([
+  ['url', () => require('url')],
+  ['node:url', () => require('url')]
+]);
+
+const preloadProcess = createPreloadProcessObject();
+
+Object.assign(preloadProcess, binding.process);
+Object.assign(preloadProcess, processProps);
+
+Object.assign(process, processProps);
+
+require('@electron/internal/renderer/ipc-native-setup');
+
+executeSandboxedPreloadScripts({
+  loadedModules,
+  loadableModules,
+  process: preloadProcess,
+  createPreloadScript: binding.createPreloadScript,
+  exposeGlobals: {
+    Buffer,
+    // FIXME(samuelmaddock): workaround webpack bug replacing this with just
+    // `__webpack_require__.g,` which causes script error
+    global: globalThis
+  }
+}, preloadScripts);

lib/renderer/api/ipc-renderer.ts

@@ -1,8 +1,10 @@
+import { getIPCRenderer } from '@electron/internal/renderer/ipc-renderer-bindings';
+
 import { EventEmitter } from 'events';
 
-const { ipc } = process._linkedBinding('electron_renderer_ipc');
-
+const ipc = getIPCRenderer();
 const internal = false;
+
 class IpcRenderer extends EventEmitter implements Electron.IpcRenderer {
   send (channel: string, ...args: any[]) {
     return ipc.send(internal, channel, args);

lib/renderer/common-init.ts

@@ -1,27 +1,16 @@
-import { ipcRendererInternal } from '@electron/internal/renderer/ipc-renderer-internal';
 import type * as securityWarningsModule from '@electron/internal/renderer/security-warnings';
 import type * as webFrameInitModule from '@electron/internal/renderer/web-frame-init';
 import type * as webViewInitModule from '@electron/internal/renderer/web-view/web-view-init';
 import type * as windowSetupModule from '@electron/internal/renderer/window-setup';
 
-import { ipcRenderer } from 'electron/renderer';
-
 const { mainFrame } = process._linkedBinding('electron_renderer_web_frame');
-const v8Util = process._linkedBinding('electron_common_v8_util');
 
 const nodeIntegration = mainFrame.getWebPreference('nodeIntegration');
 const webviewTag = mainFrame.getWebPreference('webviewTag');
 const isHiddenPage = mainFrame.getWebPreference('hiddenPage');
 const isWebView = mainFrame.getWebPreference('isWebView');
 
-// ElectronApiServiceImpl will look for the "ipcNative" hidden object when
-// invoking the 'onMessage' callback.
-v8Util.setHiddenValue(global, 'ipcNative', {
-  onMessage (internal: boolean, channel: string, ports: MessagePort[], args: any[]) {
-    const sender = internal ? ipcRendererInternal : ipcRenderer;
-    sender.emit(channel, { sender, ports }, ...args);
-  }
-});
+require('@electron/internal/renderer/ipc-native-setup');
 
 switch (window.location.protocol) {
   case 'devtools:': {

lib/renderer/ipc-native-setup.ts

@@ -0,0 +1,14 @@
+import { ipcRendererInternal } from '@electron/internal/renderer/ipc-renderer-internal';
+
+import { ipcRenderer } from 'electron/renderer';
+
+const v8Util = process._linkedBinding('electron_common_v8_util');
+
+// ElectronApiServiceImpl will look for the "ipcNative" hidden object when
+// invoking the 'onMessage' callback.
+v8Util.setHiddenValue(globalThis, 'ipcNative', {
+  onMessage (internal: boolean, channel: string, ports: MessagePort[], args: any[]) {
+    const sender = internal ? ipcRendererInternal : ipcRenderer;
+    sender.emit(channel, { sender, ports }, ...args);
+  }
+});

lib/renderer/ipc-renderer-bindings.ts

@@ -0,0 +1,17 @@
+let ipc: NodeJS.IpcRendererImpl | undefined;
+
+/**
+ * Get IPCRenderer implementation for the current process.
+ */
+export function getIPCRenderer () {
+  if (ipc) return ipc;
+  const ipcBinding = process._linkedBinding('electron_renderer_ipc');
+  switch (process.type) {
+    case 'renderer':
+      return (ipc = ipcBinding.createForRenderFrame());
+    case 'service-worker':
+      return (ipc = ipcBinding.createForServiceWorker());
+    default:
+      throw new Error(`Cannot create IPCRenderer for '${process.type}' process`);
+  }
+};

lib/renderer/ipc-renderer-internal.ts

@@ -1,7 +1,8 @@
+import { getIPCRenderer } from '@electron/internal/renderer/ipc-renderer-bindings';
+
 import { EventEmitter } from 'events';
 
-const { ipc } = process._linkedBinding('electron_renderer_ipc');
-
+const ipc = getIPCRenderer();
 const internal = true;
 
 class IpcRendererInternal extends EventEmitter implements ElectronInternal.IpcRendererInternal {

lib/sandboxed_renderer/init.ts

@@ -7,12 +7,10 @@ import * as events from 'events';
 import { setImmediate, clearImmediate } from 'timers';
 
 declare const binding: {
-  get: (name: string) => any;
   process: NodeJS.Process;
   createPreloadScript: (src: string) => Function
 };
 
-const v8Util = process._linkedBinding('electron_common_v8_util');
 const ipcRendererUtils = require('@electron/internal/renderer/ipc-renderer-internal-utils') as typeof ipcRendererUtilsModule;
 
 const {
@@ -43,6 +41,7 @@ const loadableModules = new Map<string, Function>([
 const preloadProcess = createPreloadProcessObject();
 
 // InvokeEmitProcessEvent in ElectronSandboxedRendererClient will look for this
+const v8Util = process._linkedBinding('electron_common_v8_util');
 v8Util.setHiddenValue(global, 'emit-process-event', (event: string) => {
   (process as events.EventEmitter).emit(event);
   (preloadProcess as events.EventEmitter).emit(event);

patches/chromium/.patches

@@ -128,7 +128,7 @@ fix_font_face_resolution_when_renderer_is_blocked.patch
 feat_enable_passing_exit_code_on_service_process_crash.patch
 chore_remove_reference_to_chrome_browser_themes.patch
 feat_enable_customizing_symbol_color_in_framecaptionbutton.patch
-build_expose_webplugininfo_interface_to_electron.patch
+build_allow_electron_mojom_interfaces_to_depend_on_blink.patch
 osr_shared_texture_remove_keyed_mutex_on_win_dxgi.patch
 feat_allow_usage_of_sccontentsharingpicker_on_supported_platforms.patch
 chore_partial_revert_of.patch
@@ -138,5 +138,7 @@ refactor_unfilter_unresponsive_events.patch
 build_disable_thin_lto_mac.patch
 build_add_public_config_simdutf_config.patch
 revert_code_health_clean_up_stale_macwebcontentsocclusion.patch
+feat_add_signals_when_embedder_cleanup_callbacks_run_for.patch
 build_remove_vr_directx_helpers_dependency.patch
-ignore_parse_errors_for_pkey_appusermodel_toastactivatorclsid.patch
+feat_separate_content_settings_callback_for_sync_and_async_clipboard.patch
+cherry-pick-dd8e2822e507.patch

patches/chromium/build_allow_electron_mojom_interfaces_to_depend_on_blink.patch

@@ -1,20 +1,24 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: deepak1556 <hop2deep@gmail.com>
 Date: Fri, 9 Aug 2024 22:39:47 +0900
-Subject: build: expose webplugininfo interface to electron
+Subject: build: allow electron mojom interfaces to depend on blink
+ mojom_platform
 
-Allows implementing electron::mojom::ElectronPluginInfoHost interface
-which provides plugin details between browser<->renderer.
+Needed for:
+
+1) //electron/shell/common:plugin
+2) //electron/shell/common:web_contents_utility
 
 diff --git a/content/public/common/BUILD.gn b/content/public/common/BUILD.gn
-index 659f500a47eb0f2d1f753dee2b234bb7bf1027d4..46e4714e14a5992b30ea8bfa99c126e5f1d2c3eb 100644
+index 659f500a47eb0f2d1f753dee2b234bb7bf1027d4..8f6e733b1ae1081f19a090cbdf2372b164e514a8 100644
 --- a/content/public/common/BUILD.gn
 +++ b/content/public/common/BUILD.gn
-@@ -379,6 +379,7 @@ mojom("interfaces") {
+@@ -379,6 +379,8 @@ mojom("interfaces") {
      "//content/common/*",
      "//extensions/common:mojom",
      "//extensions/common:mojom_blink",
 +    "//electron/shell/common:plugin",
++    "//electron/shell/common:web_contents_utility",
    ]
  
    sources = [

patches/chromium/cherry-pick-dd8e2822e507.patch

@@ -0,0 +1,72 @@
+From dd8e2822e507a24e1dd16306dca768d29333ba02 Mon Sep 17 00:00:00 2001
+From: Patrick Meenan <pmeenan@chromium.org>
+Date: Thu, 06 Feb 2025 07:41:40 -0800
+Subject: [PATCH] Set is_web_secure_context when initializing Service Worker from disk
+
+The value of is_web_secure_context is not serialized to disk when
+storing the service worker registration (only a few select policies
+are).
+
+When instantiating the policy container for an already-registered
+worker, it uses the default value (false) which is wrong.
+
+Since Service Workers are guaranteed to ALWAYS be a web secure
+context, this change explicitly sets it to true when restoring a
+serialized policy.
+
+See: https://w3c.github.io/webappsec-secure-contexts/#examples-service-workers
+
+Bug: 387258077,383070811
+Change-Id: I75efe895662ab4e6d68cacace6d05e004c5dfd33
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6236205
+Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org>
+Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
+Commit-Queue: Patrick Meenan <pmeenan@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1416795}
+---
+
+diff --git a/content/browser/renderer_host/policy_container_host.cc b/content/browser/renderer_host/policy_container_host.cc
+index 0b6509d..ad174110 100644
+--- a/content/browser/renderer_host/policy_container_host.cc
++++ b/content/browser/renderer_host/policy_container_host.cc
+@@ -143,9 +143,11 @@
+           cross_origin_isolation_enabled_by_dip) {}
+ 
+ PolicyContainerPolicies::PolicyContainerPolicies(
+-    const blink::mojom::PolicyContainerPolicies& policies)
++    const blink::mojom::PolicyContainerPolicies& policies,
++    bool is_web_secure_context)
+     : referrer_policy(policies.referrer_policy),
+       ip_address_space(policies.ip_address_space),
++      is_web_secure_context(is_web_secure_context),
+       content_security_policies(
+           mojo::Clone(policies.content_security_policies)),
+       cross_origin_embedder_policy(policies.cross_origin_embedder_policy),
+diff --git a/content/browser/renderer_host/policy_container_host.h b/content/browser/renderer_host/policy_container_host.h
+index 51d05d8..fc0ae74 100644
+--- a/content/browser/renderer_host/policy_container_host.h
++++ b/content/browser/renderer_host/policy_container_host.h
+@@ -50,7 +50,8 @@
+       bool cross_origin_isolation_enabled_by_dip);
+ 
+   explicit PolicyContainerPolicies(
+-      const blink::mojom::PolicyContainerPolicies& policies);
++      const blink::mojom::PolicyContainerPolicies& policies,
++      bool is_web_secure_context);
+ 
+   // Used when loading workers from network schemes.
+   // WARNING: This does not populate referrer policy.
+diff --git a/content/browser/service_worker/service_worker_registry.cc b/content/browser/service_worker/service_worker_registry.cc
+index aa1e8fb5..68b5c2b 100644
+--- a/content/browser/service_worker/service_worker_registry.cc
++++ b/content/browser/service_worker/service_worker_registry.cc
+@@ -1084,7 +1084,8 @@
+     if (data.policy_container_policies) {
+       version->set_policy_container_host(
+           base::MakeRefCounted<PolicyContainerHost>(
+-              PolicyContainerPolicies(*data.policy_container_policies)));
++              PolicyContainerPolicies(*data.policy_container_policies,
++                                      /*is_web_secure_context=*/true)));
+     }
+     if (data.router_rules) {
+       auto error = version->SetupRouterEvaluator(*data.router_rules);

patches/chromium/feat_add_signals_when_embedder_cleanup_callbacks_run_for.patch

@@ -0,0 +1,168 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: deepak1556 <hop2deep@gmail.com>
+Date: Wed, 29 Jan 2025 17:01:03 +0900
+Subject: feat: add signals when embedder cleanup callbacks run for
+ gin::wrappable
+
+Current setup of finalization callbacks does not work well with
+gin_helper::CleanedUpAtExit for wrappables specifically on environment
+shutdown leading to UAF in the second pass.
+
+Details at  https://github.com/microsoft/vscode/issues/192119#issuecomment-2375851531
+
+The signals exposed in this patch does the following 2 things,
+
+1) Fix weak state of the wrapped object when the finializer callbacks
+   have not yet been processed
+2) Avoid calling into the second pass when the embedder has already
+  destroyed the wrapped object via CleanedUpAtExit.
+
+This patch is more of a bandaid fix to improve the lifetime
+management with existing finalizer callbacks. We should be able to
+remove this patch once gin::Wrappable can be managed by V8 Oilpan
+
+Refs https://issues.chromium.org/issues/40210365 which is blocked
+on https://issues.chromium.org/issues/42203693
+
+diff --git a/gin/isolate_holder.cc b/gin/isolate_holder.cc
+index 2be37976a1305f1deed561b3b829dbb5d7ae85e7..44eb16f17d272125e2b4a590f8962eb8144d9755 100644
+--- a/gin/isolate_holder.cc
++++ b/gin/isolate_holder.cc
+@@ -34,6 +34,8 @@ v8::ArrayBuffer::Allocator* g_array_buffer_allocator = nullptr;
+ const intptr_t* g_reference_table = nullptr;
+ v8::FatalErrorCallback g_fatal_error_callback = nullptr;
+ v8::OOMErrorCallback g_oom_error_callback = nullptr;
++bool g_initialized_microtasks_runner = false;
++bool g_destroyed_microtasks_runner = false;
+ 
+ std::unique_ptr<v8::Isolate::CreateParams> getModifiedIsolateParams(
+     std::unique_ptr<v8::Isolate::CreateParams> params,
+@@ -198,10 +200,26 @@ IsolateHolder::getDefaultIsolateParams() {
+   return params;
+ }
+ 
++// static
++bool IsolateHolder::DestroyedMicrotasksRunner() {
++  return g_initialized_microtasks_runner &&
++         g_destroyed_microtasks_runner;
++}
++
+ void IsolateHolder::EnableIdleTasks(
+     std::unique_ptr<V8IdleTaskRunner> idle_task_runner) {
+   DCHECK(isolate_data_.get());
+   isolate_data_->EnableIdleTasks(std::move(idle_task_runner));
+ }
+ 
++void IsolateHolder::WillCreateMicrotasksRunner() {
++  DCHECK(!g_initialized_microtasks_runner);
++  g_initialized_microtasks_runner = true;
++}
++
++void IsolateHolder::WillDestroyMicrotasksRunner() {
++  DCHECK(g_initialized_microtasks_runner);
++  g_destroyed_microtasks_runner = true;
++}
++
+ }  // namespace gin
+diff --git a/gin/public/isolate_holder.h b/gin/public/isolate_holder.h
+index 52b8c1af58678b9fee684ff75340c98fcc73b552..f79407d741a30298d09efd53589f16dc9b26107f 100644
+--- a/gin/public/isolate_holder.h
++++ b/gin/public/isolate_holder.h
+@@ -131,6 +131,8 @@ class GIN_EXPORT IsolateHolder {
+   // Should only be called after v8::IsolateHolder::Initialize() is invoked.
+   static std::unique_ptr<v8::Isolate::CreateParams> getDefaultIsolateParams();
+ 
++  static bool DestroyedMicrotasksRunner();
++
+   v8::Isolate* isolate() { return isolate_; }
+ 
+   // This method returns if v8::Locker is needed to access isolate.
+@@ -144,6 +146,9 @@ class GIN_EXPORT IsolateHolder {
+ 
+   void EnableIdleTasks(std::unique_ptr<V8IdleTaskRunner> idle_task_runner);
+ 
++  void WillCreateMicrotasksRunner();
++  void WillDestroyMicrotasksRunner();
++
+   // This method returns V8IsolateMemoryDumpProvider of this isolate, used for
+   // testing.
+   V8IsolateMemoryDumpProvider* isolate_memory_dump_provider_for_testing()
+diff --git a/gin/wrappable.cc b/gin/wrappable.cc
+index 402355cb836cea14e9ee725a142a4bad44fd5bed..7e7f028dcfb87c7b80adebabac19ced8791f642e 100644
+--- a/gin/wrappable.cc
++++ b/gin/wrappable.cc
+@@ -13,6 +13,9 @@ namespace gin {
+ WrappableBase::WrappableBase() = default;
+ 
+ WrappableBase::~WrappableBase() {
++  if (!wrapper_.IsEmpty()) {
++    wrapper_.ClearWeak();
++  }
+   wrapper_.Reset();
+ }
+ 
+@@ -28,15 +31,24 @@ const char* WrappableBase::GetTypeName() {
+ void WrappableBase::FirstWeakCallback(
+     const v8::WeakCallbackInfo<WrappableBase>& data) {
+   WrappableBase* wrappable = data.GetParameter();
+-  wrappable->dead_ = true;
+-  wrappable->wrapper_.Reset();
+-  data.SetSecondPassCallback(SecondWeakCallback);
++  WrappableBase* wrappable_from_field =
++      static_cast<WrappableBase*>(data.GetInternalField(1));
++  if (wrappable && wrappable == wrappable_from_field) {
++    wrappable->dead_ = true;
++    wrappable->wrapper_.Reset();
++    data.SetSecondPassCallback(SecondWeakCallback);
++  }
+ }
+ 
+ void WrappableBase::SecondWeakCallback(
+     const v8::WeakCallbackInfo<WrappableBase>& data) {
++  if (IsolateHolder::DestroyedMicrotasksRunner()) {
++    return;
++  }
+   WrappableBase* wrappable = data.GetParameter();
+-  delete wrappable;
++  if (wrappable) {
++    delete wrappable;
++  }
+ }
+ 
+ v8::MaybeLocal<v8::Object> WrappableBase::GetWrapperImpl(v8::Isolate* isolate,
+@@ -71,10 +83,16 @@ v8::MaybeLocal<v8::Object> WrappableBase::GetWrapperImpl(v8::Isolate* isolate,
+   void* values[] = {info, this};
+   wrapper->SetAlignedPointerInInternalFields(2, indices, values);
+   wrapper_.Reset(isolate, wrapper);
+-  wrapper_.SetWeak(this, FirstWeakCallback, v8::WeakCallbackType::kParameter);
++  wrapper_.SetWeak(this, FirstWeakCallback, v8::WeakCallbackType::kInternalFields);
+   return v8::MaybeLocal<v8::Object>(wrapper);
+ }
+ 
++void WrappableBase::ClearWeak() {
++  if (!wrapper_.IsEmpty()) {
++    wrapper_.ClearWeak();
++  }
++}
++
+ namespace internal {
+ 
+ void* FromV8Impl(v8::Isolate* isolate, v8::Local<v8::Value> val,
+diff --git a/gin/wrappable.h b/gin/wrappable.h
+index 4e7115685a5bf6997e78edcc1851e28bd00b1aa2..ca51fe33605e855438e88969e3d3cc734ef4523e 100644
+--- a/gin/wrappable.h
++++ b/gin/wrappable.h
+@@ -80,6 +80,13 @@ class GIN_EXPORT WrappableBase {
+   v8::MaybeLocal<v8::Object> GetWrapperImpl(v8::Isolate* isolate,
+                                             WrapperInfo* wrapper_info);
+ 
++  // Make this wrappable strong again. This is useful when the wrappable is
++  // destroyed outside the finalizer callbacks and we want to avoid scheduling
++  // the weak callbacks if they haven't been scheduled yet.
++  // NOTE!!! this does not prevent finalization callbacks from running if they
++  // have already been processed.
++  void ClearWeak();
++
+  private:
+   static void FirstWeakCallback(
+       const v8::WeakCallbackInfo<WrappableBase>& data);

patches/chromium/feat_add_support_for_missing_dialog_features_to_shell_dialogs.patch

@@ -14,10 +14,25 @@ It also:
 This may be partially upstreamed to Chromium in the future.
 
 diff --git a/ui/gtk/select_file_dialog_linux_gtk.cc b/ui/gtk/select_file_dialog_linux_gtk.cc
-index b83f0177a2adb0a19be49684f865941e6708f626..f313c766ddc2b79f082e70138dd566a846f0d923 100644
+index b83f0177a2adb0a19be49684f865941e6708f626..a8c7032cfc122b97665c41da9e1191e747b95a33 100644
 --- a/ui/gtk/select_file_dialog_linux_gtk.cc
 +++ b/ui/gtk/select_file_dialog_linux_gtk.cc
-@@ -407,9 +407,11 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateFileOpenHelper(
+@@ -259,8 +259,12 @@ void SelectFileDialogLinuxGtk::SelectFileImpl(
+     case SELECT_EXISTING_FOLDER:
+       dialog = CreateSelectFolderDialog(type, title_string, default_path,
+                                         owning_window);
+-      connect("response",
+-              &SelectFileDialogLinuxGtk::OnSelectSingleFolderDialogResponse);
++      if (allow_multiple_selection())
++        connect("response",
++                &SelectFileDialogLinuxGtk::OnSelectMultiFolderDialogResponse);
++      else
++        connect("response",
++                &SelectFileDialogLinuxGtk::OnSelectSingleFolderDialogResponse);
+       break;
+     case SELECT_OPEN_FILE:
+       dialog = CreateFileOpenDialog(title_string, default_path, owning_window);
+@@ -407,9 +411,11 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateFileOpenHelper(
      const std::string& title,
      const base::FilePath& default_path,
      gfx::NativeWindow parent) {
@@ -30,7 +45,7 @@ index b83f0177a2adb0a19be49684f865941e6708f626..f313c766ddc2b79f082e70138dd566a8
    SetGtkTransientForAura(dialog, parent);
    AddFilters(GTK_FILE_CHOOSER(dialog));
  
-@@ -425,6 +427,7 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateFileOpenHelper(
+@@ -425,6 +431,7 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateFileOpenHelper(
      GtkFileChooserSetCurrentFolder(GTK_FILE_CHOOSER(dialog),
                                     *last_opened_path());
    }
@@ -38,7 +53,7 @@ index b83f0177a2adb0a19be49684f865941e6708f626..f313c766ddc2b79f082e70138dd566a8
    return dialog;
  }
  
-@@ -440,11 +443,15 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateSelectFolderDialog(
+@@ -440,11 +447,15 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateSelectFolderDialog(
              ? l10n_util::GetStringUTF8(IDS_SELECT_UPLOAD_FOLDER_DIALOG_TITLE)
              : l10n_util::GetStringUTF8(IDS_SELECT_FOLDER_DIALOG_TITLE);
    }
@@ -59,7 +74,7 @@ index b83f0177a2adb0a19be49684f865941e6708f626..f313c766ddc2b79f082e70138dd566a8
  
    GtkWidget* dialog = GtkFileChooserDialogNew(
        title_string.c_str(), nullptr, GTK_FILE_CHOOSER_ACTION_SELECT_FOLDER,
-@@ -466,7 +473,8 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateSelectFolderDialog(
+@@ -466,7 +477,8 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateSelectFolderDialog(
    gtk_file_filter_add_mime_type(only_folders, "inode/directory");
    gtk_file_filter_add_mime_type(only_folders, "text/directory");
    gtk_file_chooser_add_filter(chooser, only_folders);
@@ -69,7 +84,7 @@ index b83f0177a2adb0a19be49684f865941e6708f626..f313c766ddc2b79f082e70138dd566a8
    return dialog;
  }
  
-@@ -503,10 +511,11 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateSaveAsDialog(
+@@ -503,10 +515,11 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateSaveAsDialog(
    std::string title_string =
        !title.empty() ? title
                       : l10n_util::GetStringUTF8(IDS_SAVE_AS_DIALOG_TITLE);
@@ -83,7 +98,7 @@ index b83f0177a2adb0a19be49684f865941e6708f626..f313c766ddc2b79f082e70138dd566a8
        GTK_RESPONSE_ACCEPT);
    SetGtkTransientForAura(dialog, parent);
  
-@@ -532,9 +541,10 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateSaveAsDialog(
+@@ -532,9 +545,10 @@ GtkWidget* SelectFileDialogLinuxGtk::CreateSaveAsDialog(
    gtk_file_chooser_set_select_multiple(GTK_FILE_CHOOSER(dialog), FALSE);
    // Overwrite confirmation is always enabled in GTK4.
    if (!GtkCheckVersion(4)) {
@@ -96,6 +111,65 @@ index b83f0177a2adb0a19be49684f865941e6708f626..f313c766ddc2b79f082e70138dd566a8
    return dialog;
  }
  
+@@ -589,15 +603,29 @@ void SelectFileDialogLinuxGtk::OnSelectSingleFolderDialogResponse(
+ void SelectFileDialogLinuxGtk::OnSelectMultiFileDialogResponse(
+     GtkWidget* dialog,
+     int response_id) {
++  SelectMultiFileHelper(dialog, response_id, false);
++}
++
++void SelectFileDialogLinuxGtk::OnSelectMultiFolderDialogResponse(
++    GtkWidget* dialog,
++    int response_id) {
++  SelectMultiFileHelper(dialog, response_id, true);
++}
++
++void SelectFileDialogLinuxGtk::SelectMultiFileHelper(GtkWidget* dialog,
++                                                     int response_id,
++                                                     bool allow_folder) {
+   if (IsCancelResponse(response_id)) {
+     FileNotSelected(dialog);
+     return;
+   }
+ 
+   auto filenames = GtkFileChooserGetFilenames(dialog);
+-  std::erase_if(filenames, [this](const base::FilePath& path) {
+-    return CallDirectoryExistsOnUIThread(path);
++  std::erase_if(filenames, [this, &allow_folder](const base::FilePath& path) {
++    bool directory_exists = CallDirectoryExistsOnUIThread(path);
++    return !allow_folder && directory_exists;
+   });
++
+   if (filenames.empty()) {
+     FileNotSelected(dialog);
+     return;
+diff --git a/ui/gtk/select_file_dialog_linux_gtk.h b/ui/gtk/select_file_dialog_linux_gtk.h
+index 213eaa5ec6d657a659726cb38103e8bd671fe907..f497447c598198bf690758b1d1c5c6fe4112627f 100644
+--- a/ui/gtk/select_file_dialog_linux_gtk.h
++++ b/ui/gtk/select_file_dialog_linux_gtk.h
+@@ -108,6 +108,12 @@ class SelectFileDialogLinuxGtk : public ui::SelectFileDialogLinux,
+                               gint response_id,
+                               bool allow_folder);
+ 
++  // Common function for OnSelectMultiFileDialogResponse and
++  // OnSelectMultiFolderDialogResponse.
++  void SelectMultiFileHelper(GtkWidget* dialog,
++                             gint response_id,
++                             bool allow_folder);
++
+   // Common function for CreateFileOpenDialog and CreateMultiFileOpenDialog.
+   GtkWidget* CreateFileOpenHelper(const std::string& title,
+                                   const base::FilePath& default_path,
+@@ -122,6 +128,9 @@ class SelectFileDialogLinuxGtk : public ui::SelectFileDialogLinux,
+   // Callback for when the user responds to a Open Multiple Files dialog.
+   void OnSelectMultiFileDialogResponse(GtkWidget* dialog, int response_id);
+ 
++  // Callback for when the user responds to a Select Multiple Folders dialog.
++  void OnSelectMultiFolderDialogResponse(GtkWidget* dialog, int response_id);
++
+   // Callback for when the file chooser gets destroyed.
+   void OnFileChooserDestroy(GtkWidget* dialog);
+ 
 diff --git a/ui/shell_dialogs/select_file_dialog.h b/ui/shell_dialogs/select_file_dialog.h
 index eb3d997598631b220c3566748f23a5cdac3e4692..b4b2f7294ce6e9349a4a8a05f614e93359eca25a 100644
 --- a/ui/shell_dialogs/select_file_dialog.h
@@ -186,18 +260,118 @@ index 61683d0eddb04c494ca5e650e7d556b44968ec49..5492456a9138b250e97a5479838bb443
  
  }  // namespace ui
 diff --git a/ui/shell_dialogs/select_file_dialog_linux_kde.cc b/ui/shell_dialogs/select_file_dialog_linux_kde.cc
-index 64a79ebe2e2d21d5a6b4a98042d1cdb7b6edad52..16f2ae01a8d33e6341ed52638e963c340455ebf8 100644
+index 64a79ebe2e2d21d5a6b4a98042d1cdb7b6edad52..400cce91b020ecd5e48566f125515d2cfe3ea6af 100644
 --- a/ui/shell_dialogs/select_file_dialog_linux_kde.cc
 +++ b/ui/shell_dialogs/select_file_dialog_linux_kde.cc
-@@ -468,7 +468,7 @@ void SelectFileDialogLinuxKde::CreateSelectFolderDialog(
+@@ -8,6 +8,7 @@
+ #include <string_view>
+ 
+ #include "base/command_line.h"
++#include "base/files/file_util.h"
+ #include "base/functional/bind.h"
+ #include "base/functional/callback_helpers.h"
+ #include "base/logging.h"
+@@ -154,9 +155,20 @@ class SelectFileDialogLinuxKde : public SelectFileDialogLinux {
+   void OnSelectMultiFileDialogResponse(
+       gfx::AcceleratedWidget parent,
+       std::unique_ptr<KDialogOutputParams> results);
++
++  // Common function for OnSelectSingleFolderDialogResponse and
++  // OnSelectMultiFileDialogResponse.
++  void SelectMultiFileDialogHelper(
++      bool allow_folder,
++      gfx::AcceleratedWidget parent,
++      std::unique_ptr<KDialogOutputParams> results);
++
+   void OnSelectSingleFolderDialogResponse(
+       gfx::AcceleratedWidget parent,
+       std::unique_ptr<KDialogOutputParams> results);
++  void OnSelectMultiFolderDialogResponse(
++      gfx::AcceleratedWidget parent,
++      std::unique_ptr<KDialogOutputParams> results);
+ 
+   // Should be either DESKTOP_ENVIRONMENT_KDE3, KDE4, KDE5, or KDE6.
+   base::nix::DesktopEnvironment desktop_;
+@@ -413,10 +425,16 @@ void SelectFileDialogLinuxKde::GetKDialogCommandLine(
+   }
+   command_line->AppendSwitch(type);
+   // The path should never be empty. If it is, set it to PWD.
+-  if (path.empty())
+-    command_line->AppendArgPath(base::FilePath("."));
+-  else
++  auto pwd = base::FilePath(".");
++  if (path.empty()) {
++    command_line->AppendArgPath(pwd);
++  } else if (path.IsAbsolute()) {
+     command_line->AppendArgPath(path);
++  } else {
++    // KDialog won't set the default name in the Name field for relative paths.
++    auto abs_path = base::MakeAbsoluteFilePathNoResolveSymbolicLinks(path);
++    command_line->AppendArgPath(abs_path.value_or(pwd));
++  }
+   // Depending on the type of the operation we need, get the path to the
+   // file/folder and set up mime type filters.
+   if (file_operation)
+@@ -461,6 +479,7 @@ void SelectFileDialogLinuxKde::CreateSelectFolderDialog(
+   int title_message_id = (type == SELECT_UPLOAD_FOLDER)
+                              ? IDS_SELECT_UPLOAD_FOLDER_DIALOG_TITLE
+                              : IDS_SELECT_FOLDER_DIALOG_TITLE;
++  bool multiple_selection = allow_multiple_selection();
+   pipe_task_runner_->PostTaskAndReplyWithResult(
+       FROM_HERE,
+       base::BindOnce(
+@@ -468,10 +487,12 @@ void SelectFileDialogLinuxKde::CreateSelectFolderDialog(
            KDialogParams(
                "--getexistingdirectory", GetTitle(title, title_message_id),
                default_path.empty() ? *last_opened_path() : default_path, parent,
 -              false, false)),
-+              false, allow_multiple_selection())),
++              false, multiple_selection)),
        base::BindOnce(
-           &SelectFileDialogLinuxKde::OnSelectSingleFolderDialogResponse, this,
-           parent));
+-          &SelectFileDialogLinuxKde::OnSelectSingleFolderDialogResponse, this,
+-          parent));
++          multiple_selection
++              ? &SelectFileDialogLinuxKde::OnSelectMultiFolderDialogResponse
++              : &SelectFileDialogLinuxKde::OnSelectSingleFolderDialogResponse,
++          this, parent));
+ }
+ 
+ void SelectFileDialogLinuxKde::CreateFileOpenDialog(
+@@ -561,7 +582,8 @@ void SelectFileDialogLinuxKde::OnSelectSingleFolderDialogResponse(
+   SelectSingleFileHelper(true, std::move(results));
+ }
+ 
+-void SelectFileDialogLinuxKde::OnSelectMultiFileDialogResponse(
++void SelectFileDialogLinuxKde::SelectMultiFileDialogHelper(
++    bool allow_folder,
+     gfx::AcceleratedWidget parent,
+     std::unique_ptr<KDialogOutputParams> results) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+@@ -579,7 +601,7 @@ void SelectFileDialogLinuxKde::OnSelectMultiFileDialogResponse(
+        base::SplitStringPiece(results->output, "\n", base::KEEP_WHITESPACE,
+                               base::SPLIT_WANT_NONEMPTY)) {
+     base::FilePath path(line);
+-    if (CallDirectoryExistsOnUIThread(path))
++    if (!allow_folder && CallDirectoryExistsOnUIThread(path))
+       continue;
+     filenames_fp.push_back(path);
+   }
+@@ -591,4 +613,16 @@ void SelectFileDialogLinuxKde::OnSelectMultiFileDialogResponse(
+   MultiFilesSelected(filenames_fp);
+ }
+ 
++void SelectFileDialogLinuxKde::OnSelectMultiFolderDialogResponse(
++    gfx::AcceleratedWidget parent,
++    std::unique_ptr<KDialogOutputParams> results) {
++  SelectMultiFileDialogHelper(true, parent, std::move(results));
++}
++
++void SelectFileDialogLinuxKde::OnSelectMultiFileDialogResponse(
++    gfx::AcceleratedWidget parent,
++    std::unique_ptr<KDialogOutputParams> results) {
++  SelectMultiFileDialogHelper(false, parent, std::move(results));
++}
++
+ }  // namespace ui
 diff --git a/ui/shell_dialogs/select_file_dialog_linux_portal.cc b/ui/shell_dialogs/select_file_dialog_linux_portal.cc
 index 9780c80ffff7bdb715a9adcb656e5d33be974db6..cf6edf5c68a8e2f8ffda119b58c6283bc43199c0 100644
 --- a/ui/shell_dialogs/select_file_dialog_linux_portal.cc

patches/chromium/feat_separate_content_settings_callback_for_sync_and_async_clipboard.patch

@@ -0,0 +1,114 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: deepak1556 <hop2deep@gmail.com>
+Date: Thu, 30 Jan 2025 20:28:38 +0900
+Subject: feat: separate content settings callback for sync and async clipboard
+
+`AllowReadFromClipboard` is called from both the types without a way to differentiate.
+
+[sync path] - third_party/blink/renderer/core/editing/commands/clipboard_commands.cc
+[async path] - third_party/blink/renderer/modules/clipboard/clipboard_promise.cc
+
+This patch adds a new callback to separate these two paths so that we
+can have sync permission checks for the sync path.
+
+Additionally, `blink::PermissionType::DEPRECATED_SYNC_CLIPBOARD_READ`
+has been added to support type conversion in permission policy checks. We have extended
+`blink::PermissionType` in `electron::WebContentsPermissionHelper::PermissionType`
+but it is hard to import the latter into the content permission layer checks.
+
+This patch will be removed when the deprecated sync api support is
+removed.
+
+diff --git a/components/permissions/permission_util.cc b/components/permissions/permission_util.cc
+index 0265815ae3b300c1c0637686e212d3a1c55fdd1b..eb7ea287de24a2563604e639de3bb783d80d98eb 100644
+--- a/components/permissions/permission_util.cc
++++ b/components/permissions/permission_util.cc
+@@ -384,6 +384,7 @@ ContentSettingsType PermissionUtil::PermissionTypeToContentSettingsTypeSafe(
+       return ContentSettingsType::AUTOMATIC_FULLSCREEN;
+     case PermissionType::WEB_APP_INSTALLATION:
+       return ContentSettingsType::WEB_APP_INSTALLATION;
++    case PermissionType::DEPRECATED_SYNC_CLIPBOARD_READ:
+     case PermissionType::NUM:
+       break;
+   }
+diff --git a/content/browser/permissions/permission_controller_impl.cc b/content/browser/permissions/permission_controller_impl.cc
+index e991887c103618b35688cf72307ca05fdb202e6e..54894f3412d42264eae80d767be5215e52f08184 100644
+--- a/content/browser/permissions/permission_controller_impl.cc
++++ b/content/browser/permissions/permission_controller_impl.cc
+@@ -86,6 +86,7 @@ PermissionToSchedulingFeature(PermissionType permission_name) {
+     case PermissionType::POINTER_LOCK:
+     case PermissionType::AUTOMATIC_FULLSCREEN:
+     case PermissionType::WEB_APP_INSTALLATION:
++    case PermissionType::DEPRECATED_SYNC_CLIPBOARD_READ:
+       return std::nullopt;
+   }
+ }
+diff --git a/third_party/blink/common/permissions/permission_utils.cc b/third_party/blink/common/permissions/permission_utils.cc
+index dfcd99a4336db5c5b8b722c6612b8abbf419a08f..9f074285203e6ee408abf8275f3070221b0d25c0 100644
+--- a/third_party/blink/common/permissions/permission_utils.cc
++++ b/third_party/blink/common/permissions/permission_utils.cc
+@@ -99,6 +99,8 @@ std::string GetPermissionString(PermissionType permission) {
+       return "AutomaticFullscreen";
+     case PermissionType::WEB_APP_INSTALLATION:
+       return "WebAppInstallation";
++    case PermissionType::DEPRECATED_SYNC_CLIPBOARD_READ:
++      return "DeprecatedSyncClipboardRead";
+     case PermissionType::NUM:
+       NOTREACHED();
+   }
+@@ -171,6 +173,7 @@ PermissionTypeToPermissionsPolicyFeature(PermissionType permission) {
+     case PermissionType::NOTIFICATIONS:
+     case PermissionType::KEYBOARD_LOCK:
+     case PermissionType::POINTER_LOCK:
++    case PermissionType::DEPRECATED_SYNC_CLIPBOARD_READ:
+       return std::nullopt;
+ 
+     case PermissionType::NUM:
+diff --git a/third_party/blink/public/common/permissions/permission_utils.h b/third_party/blink/public/common/permissions/permission_utils.h
+index ae03b7f099d30c157cfda7d1beb7c535d3615471..ca287e7a5271ee83c393de6c1fe347973f4292ba 100644
+--- a/third_party/blink/public/common/permissions/permission_utils.h
++++ b/third_party/blink/public/common/permissions/permission_utils.h
+@@ -64,6 +64,7 @@ enum class PermissionType {
+   AUTOMATIC_FULLSCREEN = 40,
+   HAND_TRACKING = 41,
+   WEB_APP_INSTALLATION = 42,
++  DEPRECATED_SYNC_CLIPBOARD_READ = 43,
+ 
+   // Always keep this at the end.
+   NUM,
+diff --git a/third_party/blink/public/platform/web_content_settings_client.h b/third_party/blink/public/platform/web_content_settings_client.h
+index 28f616f21f998c7cd1c794e58efaccf9e6c11e6e..c64896642209124e500db2ed6fe2357e426cd10b 100644
+--- a/third_party/blink/public/platform/web_content_settings_client.h
++++ b/third_party/blink/public/platform/web_content_settings_client.h
+@@ -55,6 +55,9 @@ class WebContentSettingsClient {
+   // Controls whether access to write the clipboard is allowed for this frame.
+   virtual bool AllowWriteToClipboard() { return false; }
+ 
++  // Controls whether synchronous access to read the clipboard is allowed for this frame.
++  virtual bool AllowReadFromClipboardSync() { return false; }
++
+   // Controls whether to enable MutationEvents for this frame.
+   // The common use case of this method is actually to selectively disable
+   // MutationEvents, but it's been named for consistency with the rest of the
+diff --git a/third_party/blink/renderer/core/editing/commands/clipboard_commands.cc b/third_party/blink/renderer/core/editing/commands/clipboard_commands.cc
+index 271ca7ba88fc92b8f6bad5ee4cffedf7f1b05aee..d8d01062de4af45a59eb10a1c0fa046a4adf1894 100644
+--- a/third_party/blink/renderer/core/editing/commands/clipboard_commands.cc
++++ b/third_party/blink/renderer/core/editing/commands/clipboard_commands.cc
+@@ -121,7 +121,7 @@ bool ClipboardCommands::CanReadClipboard(LocalFrame& frame,
+     return true;
+   }
+   return frame.GetContentSettingsClient() &&
+-         frame.GetContentSettingsClient()->AllowReadFromClipboard();
++         frame.GetContentSettingsClient()->AllowReadFromClipboardSync();
+ }
+ 
+ bool ClipboardCommands::CanWriteClipboard(LocalFrame& frame,
+@@ -310,7 +310,7 @@ bool ClipboardCommands::PasteSupported(LocalFrame* frame) {
+     return true;
+   }
+   return frame->GetContentSettingsClient() &&
+-         frame->GetContentSettingsClient()->AllowReadFromClipboard();
++         frame->GetContentSettingsClient()->AllowReadFromClipboardSync();
+ }
+ 
+ bool ClipboardCommands::ExecuteCopy(LocalFrame& frame,

patches/chromium/ignore_parse_errors_for_pkey_appusermodel_toastactivatorclsid.patch

@@ -1,40 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?David=20L=C3=B6nnhager?= <dv.lnh.d@gmail.com>
-Date: Fri, 17 Jan 2025 14:30:48 +0100
-Subject: Ignore parse errors for PKEY_AppUserModel_ToastActivatorCLSID
-
-Some shortcuts store this as a string UUID as opposed to VT_CLSID,
-hitting NOTREACHED() and sometimes breaking parsing in Electron.
-Ignore this error instead.
-
-Bug: N/A
-Change-Id: I9fc472212b2d3afac2c8e18a2159bc2d50bbdf98
-
-diff --git a/AUTHORS b/AUTHORS
-index 55dc38c1448c1960b802c136018c8be22ed61c18..5cd195df3650331fbfd62b2f964368b5f3217f3c 100644
---- a/AUTHORS
-+++ b/AUTHORS
-@@ -337,6 +337,7 @@ David Futcher <david.mike.futcher@gmail.com>
- David Jin <davidjin@amazon.com>
- David Lechner <david@pybricks.com>
- David Leen <davileen@amazon.com>
-+David Lönnhager <dv.lnh.d@gmail.com>
- David Manouchehri <david@davidmanouchehri.com>
- David McAllister <mcdavid@amazon.com>
- David Michael Barr <david.barr@samsung.com>
-diff --git a/base/win/shortcut.cc b/base/win/shortcut.cc
-index e790adb2f1d6529ac0dd77145f5da2796264c7ae..8a7edcfaf9af963468b4b42fe55a771fb31f13a2 100644
---- a/base/win/shortcut.cc
-+++ b/base/win/shortcut.cc
-@@ -342,8 +342,9 @@ bool ResolveShortcutProperties(const FilePath& shortcut_path,
-               *(pv_toast_activator_clsid.get().puuid));
-           break;
-         default:
--          NOTREACHED() << "Unexpected variant type: "
--                       << pv_toast_activator_clsid.get().vt;
-+          // Shortcuts may use strings to represent the CLSID. This case is
-+          // ignored.
-+          break;
-       }
-     }
-   }

patches/node/.patches

@@ -11,7 +11,6 @@ fix_crypto_tests_to_run_with_bssl.patch
 fix_account_for_debugger_agent_race_condition.patch
 fix_readbarrier_undefined_symbol_error_on_woa_arm64.patch
 fix_suppress_clang_-wdeprecated-declarations_in_libuv.patch
-fix_serdes_test.patch
 feat_add_uv_loop_interrupt_on_io_change_option_to_uv_loop_configure.patch
 support_v8_sandboxed_pointers.patch
 build_ensure_native_module_compilation_fails_if_not_using_a_new.patch

patches/node/build_add_gn_build_files.patch

@@ -10,17 +10,6 @@ however those files were cherry-picked from main branch and do not
 really in 20/21. We have to wait until 22 is released to be able to
 build with upstream GN files.
 
-diff --git a/deps/simdjson/unofficial.gni b/deps/simdjson/unofficial.gni
-index d6909b95886f4de3f0b953c2a2992f69066b7434..972955f9144aafcd3a3fe278b7aaad401cadddda 100644
---- a/deps/simdjson/unofficial.gni
-+++ b/deps/simdjson/unofficial.gni
-@@ -18,5 +18,6 @@ template("simdjson_gn_build") {
-     forward_variables_from(invoker, "*")
-     public_configs = [ ":simdjson_config" ]
-     sources = gypi_values.simdjson_sources
-+    cflags_c = [ "-Wdeprecated-literal-operator" ]
-   }
- }
 diff --git a/deps/sqlite/unofficial.gni b/deps/sqlite/unofficial.gni
 index ebb3ffcd6d42b4c16b6865a91ccf4428cffe864b..00225afa1fb4205f1e02d9f185aeb97d642b3fd9 100644
 --- a/deps/sqlite/unofficial.gni
@@ -42,7 +31,7 @@ index ebb3ffcd6d42b4c16b6865a91ccf4428cffe864b..00225afa1fb4205f1e02d9f185aeb97d
          "-Wno-unused-but-set-variable",
          "-Wno-unused-function",
 diff --git a/node.gni b/node.gni
-index 9dca810decebd75aab427e306b3cc37c80fb55c9..852f64fa9cfb50fe6e9ce7aa46be336d3196d5b8 100644
+index 9dca810decebd75aab427e306b3cc37c80fb55c9..32709b860ccb12d8d1e75342a65dda0b86129b21 100644
 --- a/node.gni
 +++ b/node.gni
 @@ -5,10 +5,10 @@
@@ -67,29 +56,20 @@ index 9dca810decebd75aab427e306b3cc37c80fb55c9..852f64fa9cfb50fe6e9ce7aa46be336d
  
    # Custom build tag.
    node_tag = ""
-@@ -58,7 +58,16 @@ declare_args() {
+@@ -58,7 +58,7 @@ declare_args() {
    # TODO(zcbenz): There are few broken things for now:
    #   1. cross-os compilation is not supported.
    #   2. node_mksnapshot crashes when cross-compiling for x64 from arm64.
 -  node_use_node_snapshot = (host_os == target_os) && !(host_cpu == "arm64" && target_cpu == "x64")
 +  node_use_node_snapshot = false
-+
-+  # Build with Amaro (TypeScript utils).
-+  node_use_amaro = true
-+
-+  # Allows downstream packagers (eg. Linux distributions) to build against system shared libraries.
-+  use_system_cares = false
-+  use_system_nghttp2 = false
-+  use_system_llhttp = false
-+  use_system_histogram = false
  }
  
  assert(!node_enable_inspector || node_use_openssl,
 diff --git a/src/node_builtins.cc b/src/node_builtins.cc
-index 1bec44f6f29b0b652e92d2bb336fdb74b85eee30..599b59873dbb17ae5e7463403859e088ffb86cda 100644
+index 2bc7155f7c075e5a22ece7159a64a1c9ba3d8ac9..48d29a0d05538cd1d992f3f086d826e78d0d8882 100644
 --- a/src/node_builtins.cc
 +++ b/src/node_builtins.cc
-@@ -778,6 +778,7 @@ void BuiltinLoader::RegisterExternalReferences(
+@@ -775,6 +775,7 @@ void BuiltinLoader::RegisterExternalReferences(
    registry->Register(GetNatives);
  
    RegisterExternalReferencesForInternalizedBuiltinCode(registry);
@@ -111,7 +91,7 @@ index 1cb85b9058d06555382e565dc32192a9fa48ed9f..cec9be01abd107e8612f70daf19b4834
  // Handles compilation and caching of built-in JavaScript modules and
  // bootstrap scripts, whose source are bundled into the binary as static data.
 diff --git a/tools/generate_config_gypi.py b/tools/generate_config_gypi.py
-index 45b3ac5006140fb55aad0e6b78084b753a947a76..35cce2ea8fd85f21582962115ac455918d4c4553 100755
+index 45b3ac5006140fb55aad0e6b78084b753a947a76..8667857107e4f2481fd98032d4333b086fb7b479 100755
 --- a/tools/generate_config_gypi.py
 +++ b/tools/generate_config_gypi.py
 @@ -21,7 +21,7 @@ import getnapibuildversion
@@ -123,14 +103,6 @@ index 45b3ac5006140fb55aad0e6b78084b753a947a76..35cce2ea8fd85f21582962115ac45591
  else:
    GN = 'gn'
  
-@@ -65,6 +65,7 @@ def translate_config(out_dir, config, v8_config):
-           eval(config['node_builtin_shareable_builtins']),
-       'node_module_version': int(config['node_module_version']),
-       'node_use_openssl': config['node_use_openssl'],
-+      'node_use_amaro': config['node_use_amaro'],
-       'node_use_node_code_cache': config['node_use_node_code_cache'],
-       'node_use_node_snapshot': config['node_use_node_snapshot'],
-       'v8_enable_inspector':  # this is actually a node misnomer
 diff --git a/tools/install.py b/tools/install.py
 index bf54249b66c0d4e179deaae5a9fd55568e694fe0..31b94d2e4b532d3b8202b512e2d2f41d29a2a546 100755
 --- a/tools/install.py
@@ -146,10 +118,10 @@ index bf54249b66c0d4e179deaae5a9fd55568e694fe0..31b94d2e4b532d3b8202b512e2d2f41d
 diff --git a/tools/js2c.cc b/tools/js2c.cc
 old mode 100644
 new mode 100755
-index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2e9dfb0f0
+index a536b5dcd857275d3b02e361bd7d37a939f6b573..b2d5678d58a79774d5aeedc15ac5d5fd786f64bb
 --- a/tools/js2c.cc
 +++ b/tools/js2c.cc
-@@ -28,6 +28,7 @@ namespace js2c {
+@@ -30,6 +30,7 @@ namespace js2c {
  int Main(int argc, char* argv[]);
  
  static bool is_verbose = false;
@@ -157,7 +129,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
  
  void Debug(const char* format, ...) {
    va_list arguments;
-@@ -175,6 +176,7 @@ const char* kTemplate = R"(
+@@ -196,6 +197,7 @@ const char* kTemplate = R"(
  #include "node_builtins.h"
  #include "node_external_reference.h"
  #include "node_internals.h"
@@ -165,7 +137,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
  
  namespace node {
  
-@@ -190,7 +192,11 @@ const ThreadsafeCopyOnWrite<BuiltinSourceMap> global_source_map {
+@@ -211,7 +213,11 @@ const ThreadsafeCopyOnWrite<BuiltinSourceMap> global_source_map {
  }  // anonymous namespace
  
  void BuiltinLoader::LoadJavaScriptSource() {
@@ -178,7 +150,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
  }
  
  void RegisterExternalReferencesForInternalizedBuiltinCode(
-@@ -207,6 +213,45 @@ UnionBytes BuiltinLoader::GetConfig() {
+@@ -228,6 +234,45 @@ UnionBytes BuiltinLoader::GetConfig() {
  }  // namespace node
  )";
  
@@ -224,7 +196,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
  Fragment Format(const Fragments& definitions,
                  const Fragments& initializers,
                  const Fragments& registrations) {
-@@ -216,13 +261,12 @@ Fragment Format(const Fragments& definitions,
+@@ -237,13 +282,12 @@ Fragment Format(const Fragments& definitions,
    size_t init_size = init_buf.size();
    std::vector<char> reg_buf = Join(registrations, "\n");
    size_t reg_size = reg_buf.size();
@@ -241,7 +213,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
                     static_cast<int>(def_buf.size()),
                     def_buf.data(),
                     static_cast<int>(init_buf.size()),
-@@ -846,12 +890,15 @@ int JS2C(const FileList& js_files,
+@@ -834,12 +878,15 @@ int JS2C(const FileList& js_files,
      }
    }
  
@@ -257,7 +229,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
    Fragment out = Format(definitions, initializers, registrations);
    return WriteIfChanged(out, dest);
  }
-@@ -877,6 +924,8 @@ int Main(int argc, char* argv[]) {
+@@ -865,6 +912,8 @@ int Main(int argc, char* argv[]) {
      std::string arg(argv[i]);
      if (arg == "--verbose") {
        is_verbose = true;
@@ -266,7 +238,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
      } else if (arg == "--root") {
        if (i == argc - 1) {
          fprintf(stderr, "--root must be followed by a path\n");
-@@ -925,6 +974,14 @@ int Main(int argc, char* argv[]) {
+@@ -913,6 +962,14 @@ int Main(int argc, char* argv[]) {
      }
    }
  
@@ -281,7 +253,7 @@ index 21992cbe894a880e3223c379326b62db22f2f12d..1296a5457422099035ba34f2b02624f2
    // Should have exactly 3 types: `.js`, `.mjs` and `.gypi`.
    assert(file_map.size() == 3);
    auto gypi_it = file_map.find(".gypi");
-@@ -951,6 +1008,7 @@ int Main(int argc, char* argv[]) {
+@@ -939,6 +996,7 @@ int Main(int argc, char* argv[]) {
    std::sort(mjs_it->second.begin(), mjs_it->second.end());
  
    return JS2C(js_it->second, mjs_it->second, gypi_it->second[0], output);
@@ -302,22 +274,10 @@ index 65d0e1be42f0a85418491ebb548278cf431aa6a0..d4a31342f1c6107b029394c6e1d00a1d
    except Exception as e:
      print(str(e))
 diff --git a/unofficial.gni b/unofficial.gni
-index c3b311e4a7f5444b07d4d7028d4621806959804e..f6793b8bf22d6ac911a1977edaa881b6dbbe7ac7 100644
+index c3b311e4a7f5444b07d4d7028d4621806959804e..de6ff5548ca5282199b7d85c11941c1fa351a9d9 100644
 --- a/unofficial.gni
 +++ b/unofficial.gni
-@@ -22,6 +22,11 @@ template("node_gn_build") {
-     } else {
-       defines += [ "HAVE_OPENSSL=0" ]
-     }
-+    if (node_use_amaro) {
-+      defines += [ "HAVE_AMARO=1" ]
-+    } else {
-+      defines += [ "HAVE_AMARO=0" ]
-+    }
-     if (node_use_v8_platform) {
-       defines += [ "NODE_USE_V8_PLATFORM=1" ]
-     } else {
-@@ -139,6 +144,7 @@ template("node_gn_build") {
+@@ -139,6 +139,7 @@ template("node_gn_build") {
      public_deps = [
        "deps/ada",
        "deps/uv",
@@ -325,7 +285,7 @@ index c3b311e4a7f5444b07d4d7028d4621806959804e..f6793b8bf22d6ac911a1977edaa881b6
        "deps/simdjson",
        "$node_v8_path",
      ]
-@@ -150,7 +156,6 @@ template("node_gn_build") {
+@@ -150,7 +151,6 @@ template("node_gn_build") {
        "deps/llhttp",
        "deps/nbytes",
        "deps/nghttp2",
@@ -333,7 +293,7 @@ index c3b311e4a7f5444b07d4d7028d4621806959804e..f6793b8bf22d6ac911a1977edaa881b6
        "deps/postject",
        "deps/simdutf",
        "deps/sqlite",
-@@ -159,7 +164,11 @@ template("node_gn_build") {
+@@ -159,7 +159,11 @@ template("node_gn_build") {
        "$node_v8_path:v8_libplatform",
      ]
  
@@ -345,7 +305,7 @@ index c3b311e4a7f5444b07d4d7028d4621806959804e..f6793b8bf22d6ac911a1977edaa881b6
        "$target_gen_dir/node_javascript.cc",
      ] + gypi_values.node_sources
  
-@@ -178,8 +187,10 @@ template("node_gn_build") {
+@@ -178,8 +182,10 @@ template("node_gn_build") {
        deps += [ "//third_party/icu" ]
      }
      if (node_use_openssl) {
@@ -358,7 +318,7 @@ index c3b311e4a7f5444b07d4d7028d4621806959804e..f6793b8bf22d6ac911a1977edaa881b6
        sources += gypi_values.node_crypto_sources
      }
      if (node_enable_inspector) {
-@@ -276,6 +287,7 @@ template("node_gn_build") {
+@@ -276,6 +282,7 @@ template("node_gn_build") {
    }
  
    executable("node_js2c") {
@@ -366,7 +326,7 @@ index c3b311e4a7f5444b07d4d7028d4621806959804e..f6793b8bf22d6ac911a1977edaa881b6
      deps = [
        "deps/simdutf",
        "deps/uv",
-@@ -286,26 +298,75 @@ template("node_gn_build") {
+@@ -286,26 +293,75 @@ template("node_gn_build") {
        "src/embedded_data.cc",
        "src/embedded_data.h",
      ]
@@ -452,7 +412,7 @@ index c3b311e4a7f5444b07d4d7028d4621806959804e..f6793b8bf22d6ac911a1977edaa881b6
      outputs = [ "$target_gen_dir/node_javascript.cc" ]
  
      # Get the path to node_js2c executable of the host toolchain.
-@@ -319,11 +380,11 @@ template("node_gn_build") {
+@@ -319,11 +375,11 @@ template("node_gn_build") {
          get_label_info(":node_js2c($host_toolchain)", "name") +
          host_executable_suffix
  

patches/node/build_allow_unbundling_of_node_js_dependencies.patch

@@ -13,11 +13,28 @@ We don't need to do this for zlib, as the existing gn workflow uses the same
 
 Upstreamed at https://github.com/nodejs/node/pull/55903
 
+diff --git a/node.gni b/node.gni
+index 18d58591e3d0f1f3512db00033c3410a65702864..99ec540ec41ddf5682eed7618ba87d6935b3b982 100644
+--- a/node.gni
++++ b/node.gni
+@@ -61,6 +61,12 @@ declare_args() {
+   #   1. cross-os compilation is not supported.
+   #   2. node_mksnapshot crashes when cross-compiling for x64 from arm64.
+   node_use_node_snapshot = false
++
++  # Allows downstream packagers (eg. Linux distributions) to build against system shared libraries.
++  use_system_cares = false
++  use_system_nghttp2 = false
++  use_system_llhttp = false
++  use_system_histogram = false
+ }
+ 
+ assert(!node_enable_inspector || node_use_openssl,
 diff --git a/unofficial.gni b/unofficial.gni
-index ddfbb97276b29df114ab455a2eed3b186b3af5d2..87bfc313dd1408e597e929ba93c8c0f52ae39ced 100644
+index 3d8b7957e791ce2fa2a8d0937a87b6010087803d..c23922a301a721662ff34bf6e54fd26b41f25ccc 100644
 --- a/unofficial.gni
 +++ b/unofficial.gni
-@@ -152,7 +152,6 @@ template("node_gn_build") {
+@@ -147,7 +147,6 @@ template("node_gn_build") {
        ":run_node_js2c",
        "deps/cares",
        "deps/histogram",
@@ -25,7 +42,7 @@ index ddfbb97276b29df114ab455a2eed3b186b3af5d2..87bfc313dd1408e597e929ba93c8c0f5
        "deps/nbytes",
        "deps/nghttp2",
        "deps/postject",
-@@ -183,7 +182,17 @@ template("node_gn_build") {
+@@ -178,7 +177,17 @@ template("node_gn_build") {
        configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
        configs += [ "//build/config/gcc:symbol_visibility_default" ]
      }
@@ -44,7 +61,7 @@ index ddfbb97276b29df114ab455a2eed3b186b3af5d2..87bfc313dd1408e597e929ba93c8c0f5
      if (v8_enable_i18n_support) {
        deps += [ "//third_party/icu" ]
      }
-@@ -210,6 +219,19 @@ template("node_gn_build") {
+@@ -205,6 +214,19 @@ template("node_gn_build") {
        sources += node_inspector.node_inspector_sources +
                   node_inspector.node_inspector_generated_sources
      }

patches/node/build_compile_with_c_20_support.patch

@@ -10,7 +10,7 @@ V8 requires C++20 support as of https://chromium-review.googlesource.com/c/v8/v8
 This can be removed when Electron upgrades to a version of Node.js containing the required V8 version.
 
 diff --git a/common.gypi b/common.gypi
-index 34aaf439936c874bd4c8b7d4ffd69477abb40193..69d10c17ef3c5b0ce6173d1754a975df589d9b61 100644
+index 74616453e2e047acbb9e25f2f93ebeab06011669..bce15fc4a8b3f2fa0b5a588e6a2b28d2b8b6ac45 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -518,7 +518,7 @@

patches/node/build_enable_perfetto.patch

@@ -264,25 +264,27 @@ index 18e4f43efaae3a60b924e697918867e604513194..7cbaf01235750138c680c8ec2ed5d206
    uint32_t current_chunk_seq_ = 1;
    uint32_t id_;
 diff --git a/src/tracing/node_trace_writer.cc b/src/tracing/node_trace_writer.cc
-index 8f053efe93324b9acbb4e85f7b974b4f7712e200..1801594e727ec7a2ef3b89603975f507078b88a1 100644
+index 8f053efe93324b9acbb4e85f7b974b4f7712e200..e331ed5567caa39ade90ce28cea69f1d10533812 100644
 --- a/src/tracing/node_trace_writer.cc
 +++ b/src/tracing/node_trace_writer.cc
-@@ -96,6 +96,7 @@ void NodeTraceWriter::OpenNewFileForStreaming() {
+@@ -95,7 +95,7 @@ void NodeTraceWriter::OpenNewFileForStreaming() {
+     fd_ = -1;
    }
  }
- 
+-
 +#ifndef V8_USE_PERFETTO
  void NodeTraceWriter::AppendTraceEvent(TraceObject* trace_event) {
    Mutex::ScopedLock scoped_lock(stream_mutex_);
    // If this is the first trace event, open a new file for streaming.
-@@ -112,6 +113,7 @@ void NodeTraceWriter::AppendTraceEvent(TraceObject* trace_event) {
+@@ -112,7 +112,7 @@ void NodeTraceWriter::AppendTraceEvent(TraceObject* trace_event) {
    ++total_traces_;
    json_trace_writer_->AppendTraceEvent(trace_event);
  }
+-
 +#endif
- 
  void NodeTraceWriter::FlushPrivate() {
    std::string str;
+   int highest_request_id;
 diff --git a/src/tracing/node_trace_writer.h b/src/tracing/node_trace_writer.h
 index cd965d77b7859ff2edcf781a934594b5a9b6d251..fe1714ba77fddef693d37eeb8c7a196ddfd15c26 100644
 --- a/src/tracing/node_trace_writer.h
@@ -298,7 +300,7 @@ index cd965d77b7859ff2edcf781a934594b5a9b6d251..fe1714ba77fddef693d37eeb8c7a196d
  
    static const int kTracesPerFile = 1 << 19;
 diff --git a/src/tracing/trace_event.h b/src/tracing/trace_event.h
-index a662a081dc3bf356bf93e4063fcb043e4d8df07b..c89cdfe2b2681fbf9946200a03d7d1f7bad21226 100644
+index be0f55a409a71bf9c1763c36fdc252857228742e..827b5330b2f8c545338a46c548f8abf4aab7f50c 100644
 --- a/src/tracing/trace_event.h
 +++ b/src/tracing/trace_event.h
 @@ -69,8 +69,16 @@ enum CategoryGroupEnabledFlags {
@@ -334,23 +336,21 @@ index a662a081dc3bf356bf93e4063fcb043e4d8df07b..c89cdfe2b2681fbf9946200a03d7d1f7
  
  // Adds a metadata event to the trace log. The |AppendValueAsTraceFormat| method
  // on the convertable value will be called at flush time.
-@@ -319,12 +332,15 @@ class TraceEventHelper {
+@@ -319,10 +332,13 @@ class TraceEventHelper {
    static void SetAgent(Agent* agent);
  
    static inline const uint8_t* GetCategoryGroupEnabled(const char* group) {
 +#ifndef V8_USE_PERFETTO
      v8::TracingController* controller = GetTracingController();
      static const uint8_t disabled = 0;
-     if (controller == nullptr) [[unlikely]] {
-       return &disabled;
-     }
+     if (UNLIKELY(controller == nullptr)) return &disabled;
      return controller->GetCategoryGroupEnabled(group);
 +#endif
 +    return 0;
    }
  };
  
-@@ -462,6 +478,7 @@ static inline uint64_t AddTraceEventImpl(
+@@ -460,6 +476,7 @@ static inline uint64_t AddTraceEventImpl(
      const char* scope, uint64_t id, uint64_t bind_id, int32_t num_args,
      const char** arg_names, const uint8_t* arg_types,
      const uint64_t* arg_values, unsigned int flags) {
@@ -358,7 +358,14 @@ index a662a081dc3bf356bf93e4063fcb043e4d8df07b..c89cdfe2b2681fbf9946200a03d7d1f7
    std::unique_ptr<v8::ConvertableToTraceFormat> arg_convertibles[2];
    if (num_args > 0 && arg_types[0] == TRACE_VALUE_TYPE_CONVERTABLE) {
      arg_convertibles[0].reset(reinterpret_cast<v8::ConvertableToTraceFormat*>(
-@@ -478,6 +495,8 @@ static inline uint64_t AddTraceEventImpl(
+@@ -469,13 +486,14 @@ static inline uint64_t AddTraceEventImpl(
+     arg_convertibles[1].reset(reinterpret_cast<v8::ConvertableToTraceFormat*>(
+         static_cast<intptr_t>(arg_values[1])));
+   }
+-  // DCHECK(num_args, 2);
+   v8::TracingController* controller =
+       node::tracing::TraceEventHelper::GetTracingController();
+   if (controller == nullptr) return 0;
    return controller->AddTraceEvent(phase, category_group_enabled, name, scope, id,
                                     bind_id, num_args, arg_names, arg_types,
                                     arg_values, arg_convertibles, flags);
@@ -367,18 +374,25 @@ index a662a081dc3bf356bf93e4063fcb043e4d8df07b..c89cdfe2b2681fbf9946200a03d7d1f7
  }
  
  static V8_INLINE uint64_t AddTraceEventWithTimestampImpl(
-@@ -485,6 +504,7 @@ static V8_INLINE uint64_t AddTraceEventWithTimestampImpl(
+@@ -483,6 +501,7 @@ static V8_INLINE uint64_t AddTraceEventWithTimestampImpl(
      const char* scope, uint64_t id, uint64_t bind_id, int32_t num_args,
      const char** arg_names, const uint8_t* arg_types,
      const uint64_t* arg_values, unsigned int flags, int64_t timestamp) {
 +#ifndef V8_USE_PERFETTO
-   std::unique_ptr<v8::ConvertableToTraceFormat> arg_convertibles[2];
+   std::unique_ptr<v8::ConvertableToTraceFormat> arg_convertables[2];
    if (num_args > 0 && arg_types[0] == TRACE_VALUE_TYPE_CONVERTABLE) {
-     arg_convertibles[0].reset(reinterpret_cast<v8::ConvertableToTraceFormat*>(
-@@ -501,12 +521,15 @@ static V8_INLINE uint64_t AddTraceEventWithTimestampImpl(
+     arg_convertables[0].reset(reinterpret_cast<v8::ConvertableToTraceFormat*>(
+@@ -492,19 +511,21 @@ static V8_INLINE uint64_t AddTraceEventWithTimestampImpl(
+     arg_convertables[1].reset(reinterpret_cast<v8::ConvertableToTraceFormat*>(
+         static_cast<intptr_t>(arg_values[1])));
+   }
+-  // DCHECK_LE(num_args, 2);
+   v8::TracingController* controller =
+       node::tracing::TraceEventHelper::GetTracingController();
+   if (controller == nullptr) return 0;
    return controller->AddTraceEventWithTimestamp(
        phase, category_group_enabled, name, scope, id, bind_id, num_args,
-       arg_names, arg_types, arg_values, arg_convertibles, flags, timestamp);
+       arg_names, arg_types, arg_values, arg_convertables, flags, timestamp);
 +#endif
 +  return 0;
  }
@@ -391,7 +405,7 @@ index a662a081dc3bf356bf93e4063fcb043e4d8df07b..c89cdfe2b2681fbf9946200a03d7d1f7
    std::unique_ptr<v8::ConvertableToTraceFormat> arg_convertibles[2];
    if (num_args > 0 && arg_types[0] == TRACE_VALUE_TYPE_CONVERTABLE) {
      arg_convertibles[0].reset(reinterpret_cast<v8::ConvertableToTraceFormat*>(
-@@ -522,6 +545,7 @@ static V8_INLINE void AddMetadataEventImpl(
+@@ -520,6 +541,7 @@ static V8_INLINE void AddMetadataEventImpl(
    return agent->GetTracingController()->AddMetadataEvent(
        category_group_enabled, name, num_args, arg_names, arg_types, arg_values,
        arg_convertibles, flags);

patches/node/build_ensure_native_module_compilation_fails_if_not_using_a_new.patch

@@ -7,7 +7,7 @@ Subject: build: ensure native module compilation fails if not using a new
 This should not be upstreamed, it is a quality-of-life patch for downstream module builders.
 
 diff --git a/common.gypi b/common.gypi
-index cfb1fd6b53715dd2a39ab58b6a3bee0d8aef12bc..34aaf439936c874bd4c8b7d4ffd69477abb40193 100644
+index 229cb96c1385c597138719f2b01f78bd54ad44ab..74616453e2e047acbb9e25f2f93ebeab06011669 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -86,6 +86,8 @@
@@ -40,7 +40,7 @@ index cfb1fd6b53715dd2a39ab58b6a3bee0d8aef12bc..34aaf439936c874bd4c8b7d4ffd69477
        # list in v8/BUILD.gn.
        ['v8_enable_v8_checks == 1', {
 diff --git a/configure.py b/configure.py
-index c4653f37f5a69b7cdbd6e4c32e0717ab40a00994..88db584318a4b0f95539baf1d0895d6039fb25ca 100755
+index d03db1970fd7a1629a7a7719a5ff267402ab4a66..ce055fb5dfc84c75c486b99f01fea6b9531ff54b 100755
 --- a/configure.py
 +++ b/configure.py
 @@ -1634,6 +1634,7 @@ def configure_library(lib, output, pkgname=None):

patches/node/build_modify_js2c_py_to_allow_injection_of_original-fs_and_custom_embedder_js.patch

@@ -34,7 +34,7 @@ index f5ecc15159f457cd0b8069c0427b7c758c916c4e..c9ce67391f321989b0af48159b4da3ab
  let kResistStopPropagation;
  
 diff --git a/src/node_builtins.cc b/src/node_builtins.cc
-index 599b59873dbb17ae5e7463403859e088ffb86cda..d23cb087de5cb3cd02ef0542fd2f34207f967ad2 100644
+index 48d29a0d05538cd1d992f3f086d826e78d0d8882..8987234c2d08449242b5fd037ed314b725bc42a5 100644
 --- a/src/node_builtins.cc
 +++ b/src/node_builtins.cc
 @@ -34,6 +34,7 @@ using v8::Value;

patches/node/build_restore_clang_as_default_compiler_on_macos.patch

@@ -11,7 +11,7 @@ node-gyp will use the result of `process.config` that reflects the environment
 in which the binary got built.
 
 diff --git a/common.gypi b/common.gypi
-index 69d10c17ef3c5b0ce6173d1754a975df589d9b61..2e3a04e90a6bb32b3437780502cf45a7acad75c0 100644
+index bce15fc4a8b3f2fa0b5a588e6a2b28d2b8b6ac45..289ab5d282e93c795eafb5fb992c3bbc4790a687 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -125,6 +125,7 @@

patches/node/build_use_third_party_simdutf.patch

@@ -6,7 +6,7 @@ Subject: build: use third_party/simdutf
 use the Chromium version of simdutf to avoid duplicate symbols
 
 diff --git a/node.gni b/node.gni
-index 461bff93e151c454cd0a9575daa01d3f7c0ec9c3..a1eab549b8686c24399f5206f9b611bcbce3d470 100644
+index 99ec540ec41ddf5682eed7618ba87d6935b3b982..274e627fe27b318218f10e982ca5a0773a9075a5 100644
 --- a/node.gni
 +++ b/node.gni
 @@ -12,6 +12,8 @@ declare_args() {
@@ -19,10 +19,10 @@ index 461bff93e151c454cd0a9575daa01d3f7c0ec9c3..a1eab549b8686c24399f5206f9b611bc
    node_module_version = exec_script("$node_path/tools/getmoduleversion.py", [], "value")
  
 diff --git a/unofficial.gni b/unofficial.gni
-index 87bfc313dd1408e597e929ba93c8c0f52ae39ced..4ef97ab65bdfacca4d6dbbc603da0218214b039d 100644
+index c23922a301a721662ff34bf6e54fd26b41f25ccc..988dd1d73e72ccd3a6eb10b326b8dc7fcd8e257b 100644
 --- a/unofficial.gni
 +++ b/unofficial.gni
-@@ -155,7 +155,7 @@ template("node_gn_build") {
+@@ -150,7 +150,7 @@ template("node_gn_build") {
        "deps/nbytes",
        "deps/nghttp2",
        "deps/postject",
@@ -31,7 +31,7 @@ index 87bfc313dd1408e597e929ba93c8c0f52ae39ced..4ef97ab65bdfacca4d6dbbc603da0218
        "deps/sqlite",
        "deps/uvwasi",
        "//third_party/zlib",
-@@ -310,7 +310,7 @@ template("node_gn_build") {
+@@ -305,7 +305,7 @@ template("node_gn_build") {
    executable("node_js2c") {
      defines = []
      deps = [
@@ -40,7 +40,7 @@ index 87bfc313dd1408e597e929ba93c8c0f52ae39ced..4ef97ab65bdfacca4d6dbbc603da0218
        "deps/uv",
      ]
      sources = [
-@@ -417,7 +417,7 @@ template("node_gn_build") {
+@@ -412,7 +412,7 @@ template("node_gn_build") {
        "deps/googletest",
        "deps/googletest:gtest_main",
        "deps/nbytes",

patches/node/chore_allow_the_node_entrypoint_to_be_a_builtin_module.patch

@@ -8,7 +8,7 @@ they use themselves as the entry point. We should try to upstream some form
 of this.
 
 diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
-index ad8d41a06bde1ca22d0245fa49143e080365b5e1..69d7743767d025453e43d99b32235700d8122c9a 100644
+index d49941881e6cfd8647a6d44a57e0daaf1c874702..f696fb263b356a76b87cd4b6c4b1a0fd60a84afd 100644
 --- a/lib/internal/modules/cjs/loader.js
 +++ b/lib/internal/modules/cjs/loader.js
 @@ -1518,6 +1518,13 @@ Module.prototype._compile = function(content, filename, format) {
@@ -26,10 +26,10 @@ index ad8d41a06bde1ca22d0245fa49143e080365b5e1..69d7743767d025453e43d99b32235700
          try {
            resolvedArgv = Module._resolveFilename(process.argv[1], null, false);
 diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
-index 848ff7f142fc700dd3b4b7a6b14d3c537e0fd280..be3018296dd3c63a930328fa9cb1d902cc779b89 100644
+index cb96fd1bc4fcdce750ce241ee5f47f2ae39cfdc6..c46b270109697f7cc1683f8f9f463575e5040216 100644
 --- a/lib/internal/process/pre_execution.js
 +++ b/lib/internal/process/pre_execution.js
-@@ -245,12 +245,14 @@ function patchProcessObject(expandArgv1) {
+@@ -243,12 +243,14 @@ function patchProcessObject(expandArgv1) {
    if (expandArgv1 && process.argv[1] &&
        !StringPrototypeStartsWith(process.argv[1], '-')) {
      // Expand process.argv[1] into a full path.

patches/node/chore_expose_importmoduledynamically_and.patch

@@ -11,7 +11,7 @@ its own blended handler between Node and Blink.
 Not upstreamable.
 
 diff --git a/lib/internal/modules/esm/utils.js b/lib/internal/modules/esm/utils.js
-index 2799af0f8dd4923ef5ccd372922ea39a66f93470..3012ea1da2db6b22dc6c6a1cac12ec4c5b44487a 100644
+index d393d4336a0c1e681e4f6b4e5c7cf2bcc5fc287e..807cb5172e0c2178b6c20e81f8175141d3a0284f 100644
 --- a/lib/internal/modules/esm/utils.js
 +++ b/lib/internal/modules/esm/utils.js
 @@ -30,7 +30,7 @@ const {
@@ -23,7 +23,7 @@ index 2799af0f8dd4923ef5ccd372922ea39a66f93470..3012ea1da2db6b22dc6c6a1cac12ec4c
  const {
    loadPreloadModules,
    initializeFrozenIntrinsics,
-@@ -276,12 +276,13 @@ let _forceDefaultLoader = false;
+@@ -273,12 +273,13 @@ let _forceDefaultLoader = false;
   * @param {boolean} [forceDefaultLoader=false] - A boolean indicating disabling custom loaders.
   */
  function initializeESM(forceDefaultLoader = false) {
@@ -40,7 +40,7 @@ index 2799af0f8dd4923ef5ccd372922ea39a66f93470..3012ea1da2db6b22dc6c6a1cac12ec4c
  
  /**
 diff --git a/src/module_wrap.cc b/src/module_wrap.cc
-index e2252639cf45184b72ebe669f7603bd5e6d92b9a..05353281c0a773d5cf5585cb1698126e17f677a0 100644
+index 48b61e8b7600701c4992a98ff802614ce915faee..4e9835e502a8d078a448aa4253f37de0f49f4854 100644
 --- a/src/module_wrap.cc
 +++ b/src/module_wrap.cc
 @@ -813,7 +813,7 @@ MaybeLocal<Module> ModuleWrap::ResolveModuleCallback(

patches/node/cli_remove_deprecated_v8_flag.patch

@@ -18,10 +18,10 @@ Reviewed-By: Michaël Zasso <targos@protonmail.com>
 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index 62d3d37a061f787babe44649143d45010ce90011..1f614cabf0f31d7adff9dd7a039ca591d805d3bd 100644
+index 0cfed4a4a91a3d3fb5aee6c9a4db3405ba836565..61d980a12fcf7c799e726e1462c65ce478a8ed0c 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -3177,7 +3177,6 @@ V8 options that are allowed are:
+@@ -3151,7 +3151,6 @@ V8 options that are allowed are:
  * `--disallow-code-generation-from-strings`
  * `--enable-etw-stack-walking`
  * `--expose-gc`
@@ -30,10 +30,10 @@ index 62d3d37a061f787babe44649143d45010ce90011..1f614cabf0f31d7adff9dd7a039ca591
  * `--jitless`
  * `--max-old-space-size`
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 6f9a8d3e0884bc6e356413f2f39522a7109c86b5..ccf740bfd631aca608244b6b3998177ca5f47f75 100644
+index 4b3f7751db2871c8ce76b197a84a2417097030ea..21e53e1053fe2e4194d91b27a726d3a1306b1683 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
-@@ -929,11 +929,6 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
+@@ -922,11 +922,6 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
              "disallow eval and friends",
              V8Option{},
              kAllowedInEnvvar);
@@ -46,10 +46,10 @@ index 6f9a8d3e0884bc6e356413f2f39522a7109c86b5..ccf740bfd631aca608244b6b3998177c
              "disable runtime allocation of executable memory",
              V8Option{},
 diff --git a/test/parallel/test-cli-node-options.js b/test/parallel/test-cli-node-options.js
-index 03ffe7aa03f48156f04bb527316221ec10e7e0df..69bf136559c1a8a18a7bfc444a439d161f622635 100644
+index e898a81af09ca6852ddc866310e5b8e0dc82971b..22d5a342df5d55f065383a6ebe1aebe59dc0f8d2 100644
 --- a/test/parallel/test-cli-node-options.js
 +++ b/test/parallel/test-cli-node-options.js
-@@ -72,7 +72,6 @@ if (common.hasCrypto) {
+@@ -70,7 +70,6 @@ if (common.hasCrypto) {
  expect('--abort_on-uncaught_exception', 'B\n');
  expect('--disallow-code-generation-from-strings', 'B\n');
  expect('--expose-gc', 'B\n');

patches/node/enable_crashpad_linux_node_processes.patch

@@ -8,7 +8,7 @@ to child processes spawned with `ELECTRON_RUN_AS_NODE` which is used
 by the crashpad client to connect with the handler process.
 
 diff --git a/lib/child_process.js b/lib/child_process.js
-index 51fc6fe995d3cf8c70ad7bc3cecf1cc00f190b08..012ad108f44b73346d19d927afc78b57c18b7718 100644
+index 580a441a803bdd0b57871c0cdd8af576f11609b1..755712d24219de7ffe491957d941df7c8cf7baad 100644
 --- a/lib/child_process.js
 +++ b/lib/child_process.js
 @@ -61,6 +61,7 @@ let debug = require('internal/util/debuglog').debuglog(
@@ -27,7 +27,7 @@ index 51fc6fe995d3cf8c70ad7bc3cecf1cc00f190b08..012ad108f44b73346d19d927afc78b57
    args = [...execArgv, modulePath, ...args];
  
    if (typeof options.stdio === 'string') {
-@@ -615,6 +615,22 @@ function normalizeSpawnArguments(file, args, options) {
+@@ -617,6 +617,22 @@ function normalizeSpawnArguments(file, args, options) {
                      'options.windowsVerbatimArguments');
    }
  
@@ -50,7 +50,7 @@ index 51fc6fe995d3cf8c70ad7bc3cecf1cc00f190b08..012ad108f44b73346d19d927afc78b57
    if (options.shell) {
      validateArgumentNullCheck(options.shell, 'options.shell');
      const command = ArrayPrototypeJoin([file, ...args], ' ');
-@@ -648,7 +664,6 @@ function normalizeSpawnArguments(file, args, options) {
+@@ -650,7 +666,6 @@ function normalizeSpawnArguments(file, args, options) {
      ArrayPrototypeUnshift(args, file);
    }
  

patches/node/fix_add_default_values_for_variables_in_common_gypi.patch

@@ -7,7 +7,7 @@ common.gypi is a file that's included in the node header bundle, despite
 the fact that we do not build node with gyp.
 
 diff --git a/common.gypi b/common.gypi
-index de83a566724a36fff8b0c4ca9ba7e151a8c39f54..cfb1fd6b53715dd2a39ab58b6a3bee0d8aef12bc 100644
+index a97e77860e151f5126515d65ef99b34aa7301f76..229cb96c1385c597138719f2b01f78bd54ad44ab 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -88,6 +88,23 @@

patches/node/fix_assert_module_in_the_renderer_process.patch

@@ -44,10 +44,10 @@ index 59b5a16f1309a5e4055bccfdb7a529045ad30402..bfdaf6211466a01b64b7942f7b16c480
    let filename = call.getFileName();
    const line = call.getLineNumber() - 1;
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 89ce587cac4506c4218a9316fe0b68070a7a8504..b74fb837fc1cfee839c8b5b8c0b9a6f805881206 100644
+index f59abcb21d64b910d8d42eb23c03109f62558813..1b6613d1de8c89c8271066a652afd1024988362d 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -247,6 +247,9 @@ void SetIsolateErrorHandlers(v8::Isolate* isolate, const IsolateSettings& s) {
+@@ -244,6 +244,9 @@ void SetIsolateErrorHandlers(v8::Isolate* isolate, const IsolateSettings& s) {
      auto* prepare_stack_trace_cb = s.prepare_stack_trace_callback ?
          s.prepare_stack_trace_callback : PrepareStackTraceCallback;
      isolate->SetPrepareStackTraceCallback(prepare_stack_trace_cb);
@@ -58,10 +58,10 @@ index 89ce587cac4506c4218a9316fe0b68070a7a8504..b74fb837fc1cfee839c8b5b8c0b9a6f8
  }
  
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 3c42f9b87c11a0f88800d6709515c1c9e2972fc0..6f9a8d3e0884bc6e356413f2f39522a7109c86b5 100644
+index 29630fcccc3bd9d24ad6aec64bef2fedfc3c4031..4b3f7751db2871c8ce76b197a84a2417097030ea 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
-@@ -1476,14 +1476,16 @@ void GetEmbedderOptions(const FunctionCallbackInfo<Value>& args) {
+@@ -1464,14 +1464,16 @@ void GetEmbedderOptions(const FunctionCallbackInfo<Value>& args) {
    }
    Isolate* isolate = args.GetIsolate();
  

patches/node/fix_crypto_tests_to_run_with_bssl.patch

@@ -11,7 +11,7 @@ before it's acceptable to upstream, as this patch comments out a couple
 of tests that upstream probably cares about.
 
 diff --git a/test/common/index.js b/test/common/index.js
-index b95e812c5a9fab59f742e1557e9f218155638af4..6d2566c43f16493cbb2a0f9469ed386c41686782 100644
+index 172cdb6b049824539a9850789e0e7c5baf613367..c29abc18191aec78ad8eb810093a9a4ef9e854e4 100644
 --- a/test/common/index.js
 +++ b/test/common/index.js
 @@ -65,6 +65,8 @@ const opensslVersionNumber = (major = 0, minor = 0, patch = 0) => {
@@ -23,7 +23,7 @@ index b95e812c5a9fab59f742e1557e9f218155638af4..6d2566c43f16493cbb2a0f9469ed386c
  let OPENSSL_VERSION_NUMBER;
  const hasOpenSSL = (major = 0, minor = 0, patch = 0) => {
    if (!hasCrypto) return false;
-@@ -1008,6 +1010,7 @@ const common = {
+@@ -996,6 +998,7 @@ const common = {
    mustNotMutateObjectDeep,
    mustSucceed,
    nodeProcessAborted,
@@ -395,7 +395,7 @@ index 338a19b0e88ad6f08d2f6b6a5d38b9980996ce11..a4ee215575d072450ba66c558ddca88b
    };
    assert.throws(() => crypto.scrypt('pass', 'salt', 1, options, () => {}),
 diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
-index 8a263ec3350f5540591ac02e70fa2f552b9ac477..dcc4c2ec816d28f1b27df1c358cfce66f1a3a03b 100644
+index 9dd586a1a1f9a00d9bb0af5b0532e81e7b96a5ce..a37e6d50914345829c8260a97949cee7d17ab676 100644
 --- a/test/parallel/test-crypto-sign-verify.js
 +++ b/test/parallel/test-crypto-sign-verify.js
 @@ -29,7 +29,7 @@ const keySize = 2048;
@@ -471,21 +471,10 @@ index 008ab129f0e019c659eecf5a76b7eb412c947fe3..6688f5d916f50e1e4fcfff1619c8634a
  
  cipher.end('Papaya!');  // Should not cause an unhandled exception.
 diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js
-index 15e1f53bb05faf60fa808eb5901591d1512edf3c..329f0d00c869cd19580acea18c904cf9900fb816 100644
+index 89a7521544f7051edc1779138551bbad1972b3fb..91df6acc65d4003999f29f0fa5f639056b21ee3b 100644
 --- a/test/parallel/test-crypto-x509.js
 +++ b/test/parallel/test-crypto-x509.js
-@@ -96,8 +96,10 @@ const der = Buffer.from(
-   assert.strictEqual(x509.infoAccess, infoAccessCheck);
-   assert.strictEqual(x509.validFrom, 'Sep  3 21:40:37 2022 GMT');
-   assert.strictEqual(x509.validTo, 'Jun 17 21:40:37 2296 GMT');
-+  if (!common.openSSLIsBoringSSL) {
-   assert.deepStrictEqual(x509.validFromDate, new Date('2022-09-03T21:40:37Z'));
-   assert.deepStrictEqual(x509.validToDate, new Date('2296-06-17T21:40:37Z'));
-+  }
-   assert.strictEqual(
-     x509.fingerprint,
-     '8B:89:16:C4:99:87:D2:13:1A:64:94:36:38:A5:32:01:F0:95:3B:53');
-@@ -113,7 +115,7 @@ const der = Buffer.from(
+@@ -111,7 +111,7 @@ const der = Buffer.from(
      '5A:42:63:E0:21:2F:D6:70:63:07:96:6F:27:A7:78:12:08:02:7A:8B'
    );
    assert.strictEqual(x509.keyUsage, undefined);
@@ -494,7 +483,7 @@ index 15e1f53bb05faf60fa808eb5901591d1512edf3c..329f0d00c869cd19580acea18c904cf9
  
    assert.deepStrictEqual(x509.raw, der);
  
-@@ -255,6 +257,16 @@ oans248kpal88CGqsN2so/wZKxVnpiXlPHMdiNL7hRSUqlHkUi07FrP2Htg8kjI=
+@@ -253,6 +253,16 @@ oans248kpal88CGqsN2so/wZKxVnpiXlPHMdiNL7hRSUqlHkUi07FrP2Htg8kjI=
    });
    mc.port2.postMessage(x509);
  
@@ -511,7 +500,7 @@ index 15e1f53bb05faf60fa808eb5901591d1512edf3c..329f0d00c869cd19580acea18c904cf9
    // Verify that legacy encoding works
    const legacyObjectCheck = {
      subject: Object.assign({ __proto__: null }, {
-@@ -279,15 +291,7 @@ oans248kpal88CGqsN2so/wZKxVnpiXlPHMdiNL7hRSUqlHkUi07FrP2Htg8kjI=
+@@ -277,15 +287,7 @@ oans248kpal88CGqsN2so/wZKxVnpiXlPHMdiNL7hRSUqlHkUi07FrP2Htg8kjI=
        'OCSP - URI': ['http://ocsp.nodejs.org/'],
        'CA Issuers - URI': ['http://ca.nodejs.org/ca.cert']
      }),
@@ -528,7 +517,7 @@ index 15e1f53bb05faf60fa808eb5901591d1512edf3c..329f0d00c869cd19580acea18c904cf9
      bits: 2048,
      exponent: '0x10001',
      valid_from: 'Sep  3 21:40:37 2022 GMT',
-@@ -300,7 +304,7 @@ oans248kpal88CGqsN2so/wZKxVnpiXlPHMdiNL7hRSUqlHkUi07FrP2Htg8kjI=
+@@ -298,7 +300,7 @@ oans248kpal88CGqsN2so/wZKxVnpiXlPHMdiNL7hRSUqlHkUi07FrP2Htg8kjI=
        '51:62:18:39:E2:E2:77:F5:86:11:E8:C0:CA:54:43:7C:76:83:19:05:D0:03:' +
        '24:21:B8:EB:14:61:FB:24:16:EB:BD:51:1A:17:91:04:30:03:EB:68:5F:DC:' +
        '86:E1:D1:7C:FB:AF:78:ED:63:5F:29:9C:32:AF:A1:8E:22:96:D1:02',
@@ -537,7 +526,7 @@ index 15e1f53bb05faf60fa808eb5901591d1512edf3c..329f0d00c869cd19580acea18c904cf9
    };
  
    const legacyObject = x509.toLegacyObject();
-@@ -309,7 +313,7 @@ oans248kpal88CGqsN2so/wZKxVnpiXlPHMdiNL7hRSUqlHkUi07FrP2Htg8kjI=
+@@ -307,7 +309,7 @@ oans248kpal88CGqsN2so/wZKxVnpiXlPHMdiNL7hRSUqlHkUi07FrP2Htg8kjI=
    assert.deepStrictEqual(legacyObject.subject, legacyObjectCheck.subject);
    assert.deepStrictEqual(legacyObject.issuer, legacyObjectCheck.issuer);
    assert.deepStrictEqual(legacyObject.infoAccess, legacyObjectCheck.infoAccess);
@@ -546,7 +535,7 @@ index 15e1f53bb05faf60fa808eb5901591d1512edf3c..329f0d00c869cd19580acea18c904cf9
    assert.strictEqual(legacyObject.bits, legacyObjectCheck.bits);
    assert.strictEqual(legacyObject.exponent, legacyObjectCheck.exponent);
    assert.strictEqual(legacyObject.valid_from, legacyObjectCheck.valid_from);
-@@ -318,11 +322,12 @@ oans248kpal88CGqsN2so/wZKxVnpiXlPHMdiNL7hRSUqlHkUi07FrP2Htg8kjI=
+@@ -316,11 +318,12 @@ oans248kpal88CGqsN2so/wZKxVnpiXlPHMdiNL7hRSUqlHkUi07FrP2Htg8kjI=
    assert.strictEqual(
      legacyObject.fingerprint256,
      legacyObjectCheck.fingerprint256);
@@ -557,40 +546,17 @@ index 15e1f53bb05faf60fa808eb5901591d1512edf3c..329f0d00c869cd19580acea18c904cf9
 +    legacyObjectCheck.serialNumberPattern);
  }
  
-+if (!common.openSSLIsBoringSSL) {
++/*
  {
    // This X.509 Certificate can be parsed by OpenSSL because it contains a
    // structurally sound TBSCertificate structure. However, the SPKI field of the
-@@ -361,6 +366,7 @@ UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0
+@@ -359,3 +362,4 @@ UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0
  
    assert.strictEqual(cert.checkIssued(cert), false);
  }
-+}
- 
- {
-   // Test date parsing of `validFromDate` and `validToDate` fields, according to RFC 5280.
-@@ -398,8 +404,10 @@ UidvpWWipVLZgK+oDks+bKTobcoXGW9oXobiIYqslXPy
- -----END CERTIFICATE-----`.trim();
-   const c1 = new X509Certificate(certPemUTCTime);
- 
-+  if (!common.openSSLIsBoringSSL) {
-   assert.deepStrictEqual(c1.validFromDate, new Date('1949-12-25T23:59:58Z'));
-   assert.deepStrictEqual(c1.validToDate, new Date('1950-01-01T23:59:58Z'));
-+  }
- 
-   // The GeneralizedTime format is used for dates in 2050 or later.
-   const certPemGeneralizedTime = `-----BEGIN CERTIFICATE-----
-@@ -433,6 +441,8 @@ CWwQO8JZjJqFtqtuzy2n+gLCvqePgG/gmSqHOPm2ZbLW
- -----END CERTIFICATE-----`.trim();
-   const c2 = new X509Certificate(certPemGeneralizedTime);
- 
-+  if (!common.openSSLIsBoringSSL) {
-   assert.deepStrictEqual(c2.validFromDate, new Date('2049-12-26T00:00:01Z'));
-   assert.deepStrictEqual(c2.validToDate, new Date('2050-01-02T00:00:01Z'));
-+  }
- }
++*/
 diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
-index 4271121881379b6c6892e89e520345f77e4181df..7a17285deee18ffbccf1d01d9d1b7b87e561bffa 100644
+index 4271121881379b6c6892e89e520345f77e4181df..6c87a1ac687aa37d4ba245d1b6fc746a5f1eeffc 100644
 --- a/test/parallel/test-crypto.js
 +++ b/test/parallel/test-crypto.js
 @@ -61,7 +61,7 @@ assert.throws(() => {
@@ -629,14 +595,23 @@ index 4271121881379b6c6892e89e520345f77e4181df..7a17285deee18ffbccf1d01d9d1b7b87
  validateList(crypto.getHashes());
  // Make sure all of the hashes are supported by OpenSSL
  for (const algo of crypto.getHashes())
-@@ -196,6 +194,7 @@ assert.throws(
+@@ -195,7 +193,7 @@ assert.throws(
+     return true;
    }
  );
- 
-+if (!common.openSSLIsBoringSSL) {
+-
++/*
  assert.throws(() => {
    const priv = [
      '-----BEGIN RSA PRIVATE KEY-----',
+@@ -208,6 +206,7 @@ assert.throws(() => {
+   ].join('\n');
+   crypto.createSign('SHA256').update('test').sign(priv);
+ }, (err) => {
++  console.log(err)
+   if (!common.hasOpenSSL3)
+     assert.ok(!('opensslErrorStack' in err));
+   assert.throws(() => { throw err; }, common.hasOpenSSL3 ? {
 @@ -216,10 +215,10 @@ assert.throws(() => {
      library: 'rsa routines',
    } : {
@@ -657,7 +632,7 @@ index 4271121881379b6c6892e89e520345f77e4181df..7a17285deee18ffbccf1d01d9d1b7b87
    });
  }
 -
-+}
++*/
  // Make sure memory isn't released before being returned
  console.log(crypto.randomBytes(16));
  
@@ -750,7 +725,7 @@ index b06f2fa2c53ea72f9a66f0d002dd9281d0259a0f..864fffeebfad75d95416fd47efdea7f2
  
  const server = https.createServer(opts, (req, res) => {
 diff --git a/test/parallel/test-webcrypto-derivebits.js b/test/parallel/test-webcrypto-derivebits.js
-index eb09bc24f0cb8244b05987e3a7c1d203360d3a38..8c251ff2371fb59bf679160574e1c5dc1b4b2665 100644
+index eb09bc24f0cb8244b05987e3a7c1d203360d3a38..011990db171faa708c5211f6ab9ae1ac0e0ab90e 100644
 --- a/test/parallel/test-webcrypto-derivebits.js
 +++ b/test/parallel/test-webcrypto-derivebits.js
 @@ -101,8 +101,9 @@ const { subtle } = globalThis.crypto;
@@ -764,6 +739,11 @@ index eb09bc24f0cb8244b05987e3a7c1d203360d3a38..8c251ff2371fb59bf679160574e1c5dc
    async function test(name) {
      const [alice, bob] = await Promise.all([
        subtle.generateKey({ name }, true, ['deriveBits']),
+@@ -126,3 +127,4 @@ const { subtle } = globalThis.crypto;
+   test('X25519').then(common.mustCall());
+   test('X448').then(common.mustCall());
+ }
++
 diff --git a/test/parallel/test-webcrypto-derivekey.js b/test/parallel/test-webcrypto-derivekey.js
 index 558d37d90d5796b30101d1b512c9df3e7661d0db..f42bf8f4be0b439dd7e7c8d0f6f8a41e01588870 100644
 --- a/test/parallel/test-webcrypto-derivekey.js

patches/node/fix_do_not_resolve_electron_entrypoints.patch

@@ -19,10 +19,10 @@ index 463e76cb1abc0c2fdddba4db2ca2e00f7c591e12..d7bc3c35c77b5bf9ec122b38248d0cf1
        context = { __proto__: context, source };
      }
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 45a0abc6423a4e53e070f3c117fac2a3554b188d..abd89e9cccba1060f8e76580d5bb338e65a710ea 100644
+index 06b31af80ebbfbf35ec787a94f345775eb512ebf..deca5aa4b8829ba9921440fcb5c285a10e40c8f0 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -287,6 +287,9 @@ function cjsPreparseModuleExports(filename, source) {
+@@ -354,6 +354,9 @@ function cjsPreparseModuleExports(filename, source) {
    if (module && module[kModuleExportNames] !== undefined) {
      return { module, exportNames: module[kModuleExportNames] };
    }
@@ -33,7 +33,7 @@ index 45a0abc6423a4e53e070f3c117fac2a3554b188d..abd89e9cccba1060f8e76580d5bb338e
    if (!loaded) {
      module = new CJSModule(filename);
 diff --git a/lib/internal/modules/run_main.js b/lib/internal/modules/run_main.js
-index ab4783a7982b9feb8fa85b62e3e3b181f93309bd..34f91026451d7347ae278712d083e4fe281e50f3 100644
+index 1e1a1ea46fc6c1b43cad4038ab0d9cdf21d6ba3d..95e2fa5479ea31559fdb5a2e03515f243b231b75 100644
 --- a/lib/internal/modules/run_main.js
 +++ b/lib/internal/modules/run_main.js
 @@ -2,6 +2,7 @@
@@ -58,7 +58,7 @@ index ab4783a7982b9feb8fa85b62e3e3b181f93309bd..34f91026451d7347ae278712d083e4fe
    const defaultType = getOptionValue('--experimental-default-type');
    /** @type {string} */
    let mainPath;
-@@ -62,6 +70,13 @@ function resolveMainPath(main) {
+@@ -63,6 +71,13 @@ function resolveMainPath(main) {
   * @param {string} mainPath - Absolute path to the main entry point
   */
  function shouldUseESMLoader(mainPath) {

patches/node/fix_expose_the_built-in_electron_module_via_the_esm_loader.patch

@@ -6,7 +6,7 @@ Subject: fix: expose the built-in electron module via the ESM loader
 This allows usage of `import { app } from 'electron'` and `import('electron')` natively in the browser + non-sandboxed renderer
 
 diff --git a/lib/internal/modules/esm/get_format.js b/lib/internal/modules/esm/get_format.js
-index 26d0bace6cdd3905f1248c5ad3fa794eb272252d..4ec1f4f6951be40f5fcb4c1cb3d1205e69434f23 100644
+index a89446df710a941390c15171fea63c551776fc93..912f03bfa96c3aa12bfa6e709746642452568bb7 100644
 --- a/lib/internal/modules/esm/get_format.js
 +++ b/lib/internal/modules/esm/get_format.js
 @@ -26,6 +26,7 @@ const protocolHandlers = {
@@ -46,7 +46,7 @@ index 8b157f0f461c7b92c567fffe4d99357dbc09aee7..605e812d515fc467001e4ab88fc15b4a
    }
  }
 diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
-index 35925ef0817273948b7a2128c6ddc12c91bc3cfd..ee2cc03892c01141b71571989b18eec387d3c766 100644
+index 1fbbb6773c9479128408fa1f27cf19f1a7786ba6..f05c6f99c0037193c5802024be46a967d6cf47a0 100644
 --- a/lib/internal/modules/esm/resolve.js
 +++ b/lib/internal/modules/esm/resolve.js
 @@ -772,6 +772,8 @@ function parsePackageName(specifier, base) {
@@ -71,10 +71,10 @@ index 35925ef0817273948b7a2128c6ddc12c91bc3cfd..ee2cc03892c01141b71571989b18eec3
      parsePackageName(specifier, base);
  
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 9b89c3e1d52a0f724dab451844d32df67f1eab9f..25ee090bbb4884d3e5f2530cc7153f9215754fae 100644
+index 8f88214f558c52ef26000fb0e1ef4d391327e84e..d182eedf5e96039e0029d36e51f40b75c6fb2a39 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -182,7 +182,7 @@ function createCJSModuleWrap(url, source, isMain, loadCJS = loadCJSModule) {
+@@ -246,7 +246,7 @@ function createCJSModuleWrap(url, source, isMain, loadCJS = loadCJSModule) {
  
    const { exportNames, module } = cjsPreparseModuleExports(filename, source);
    cjsCache.set(url, module);
@@ -83,7 +83,7 @@ index 9b89c3e1d52a0f724dab451844d32df67f1eab9f..25ee090bbb4884d3e5f2530cc7153f92
      [...exportNames] : ['default', ...exportNames];
  
    if (isMain) {
-@@ -204,8 +204,8 @@ function createCJSModuleWrap(url, source, isMain, loadCJS = loadCJSModule) {
+@@ -268,8 +268,8 @@ function createCJSModuleWrap(url, source, isMain, loadCJS = loadCJSModule) {
        ({ exports } = module);
      }
      for (const exportName of exportNames) {
@@ -94,7 +94,7 @@ index 9b89c3e1d52a0f724dab451844d32df67f1eab9f..25ee090bbb4884d3e5f2530cc7153f92
          continue;
        }
        // We might trigger a getter -> dont fail.
-@@ -239,6 +239,10 @@ translators.set('require-commonjs', (url, source, isMain) => {
+@@ -304,6 +304,10 @@ translators.set('require-commonjs', (url, source, isMain) => {
    return createCJSModuleWrap(url, source);
  });
  

patches/node/fix_expose_tracing_agent_and_use_tracing_tracingcontroller_instead.patch

@@ -7,10 +7,10 @@ Subject: fix: expose tracing::Agent and use tracing::TracingController instead
 This API is used by Electron to create Node's tracing controller.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index ad323fc800a33c010b0504a4aa55c107498dee26..e044f10284f31f1862b18be752a04b3bd5d53401 100644
+index 77c20a4b6b9db414444974f68c5def8788386d2b..5fc1b6f2446d7c786024eb60800e2edab613dcd1 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -567,6 +567,10 @@ MultiIsolatePlatform* GetMultiIsolatePlatform(IsolateData* env) {
+@@ -564,6 +564,10 @@ MultiIsolatePlatform* GetMultiIsolatePlatform(IsolateData* env) {
    return env->platform();
  }
  

patches/node/fix_handle_boringssl_and_openssl_incompatibilities.patch

@@ -17,7 +17,7 @@ Upstreams:
 - https://github.com/nodejs/node/pull/39136
 
 diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
-index 457bd2f6c5b18956d06c716fbfae429496fb352d..e954cb2e53f3d8c297d21ef9f698d824ca574106 100644
+index eb3533bb4623b152605c3c590f37f086cce5f073..ded231aeaa15af22845704cfcc7d24a44bd88f8e 100644
 --- a/deps/ncrypto/ncrypto.cc
 +++ b/deps/ncrypto/ncrypto.cc
 @@ -6,13 +6,11 @@
@@ -35,7 +35,7 @@ index 457bd2f6c5b18956d06c716fbfae429496fb352d..e954cb2e53f3d8c297d21ef9f698d824
  
  namespace ncrypto {
  namespace {
-@@ -694,7 +692,7 @@ bool SafeX509SubjectAltNamePrint(const BIOPointer& out, X509_EXTENSION* ext) {
+@@ -665,7 +663,7 @@ bool SafeX509SubjectAltNamePrint(const BIOPointer& out, X509_EXTENSION* ext) {
  
    bool ok = true;
  
@@ -44,7 +44,7 @@ index 457bd2f6c5b18956d06c716fbfae429496fb352d..e954cb2e53f3d8c297d21ef9f698d824
      GENERAL_NAME* gen = sk_GENERAL_NAME_value(names, i);
  
      if (i != 0)
-@@ -720,7 +718,7 @@ bool SafeX509InfoAccessPrint(const BIOPointer& out, X509_EXTENSION* ext) {
+@@ -691,7 +689,7 @@ bool SafeX509InfoAccessPrint(const BIOPointer& out, X509_EXTENSION* ext) {
  
    bool ok = true;
  
@@ -53,25 +53,7 @@ index 457bd2f6c5b18956d06c716fbfae429496fb352d..e954cb2e53f3d8c297d21ef9f698d824
      ACCESS_DESCRIPTION* desc = sk_ACCESS_DESCRIPTION_value(descs, i);
  
      if (i != 0)
-@@ -857,13 +855,17 @@ BIOPointer X509View::getValidTo() const {
- 
- int64_t X509View::getValidToTime() const {
-   struct tm tp;
-+#ifndef OPENSSL_IS_BORINGSSL
-   ASN1_TIME_to_tm(X509_get0_notAfter(cert_), &tp);
-+#endif
-   return PortableTimeGM(&tp);
- }
- 
- int64_t X509View::getValidFromTime() const {
-   struct tm tp;
-+#ifndef OPENSSL_IS_BORINGSSL
-   ASN1_TIME_to_tm(X509_get0_notBefore(cert_), &tp);
-+#endif
-   return PortableTimeGM(&tp);
- }
- 
-@@ -1043,7 +1045,11 @@ BIOPointer BIOPointer::NewMem() {
+@@ -1002,7 +1000,11 @@ BIOPointer BIOPointer::NewMem() {
  }
  
  BIOPointer BIOPointer::NewSecMem() {
@@ -83,7 +65,7 @@ index 457bd2f6c5b18956d06c716fbfae429496fb352d..e954cb2e53f3d8c297d21ef9f698d824
  }
  
  BIOPointer BIOPointer::New(const BIO_METHOD* method) {
-@@ -1098,8 +1104,10 @@ BignumPointer DHPointer::FindGroup(const std::string_view name,
+@@ -1057,8 +1059,10 @@ BignumPointer DHPointer::FindGroup(const std::string_view name,
                                     FindGroupOption option) {
  #define V(n, p) if (EqualNoCase(name, n)) return BignumPointer(p(nullptr));
    if (option != FindGroupOption::NO_SMALL_PRIMES) {
@@ -94,7 +76,7 @@ index 457bd2f6c5b18956d06c716fbfae429496fb352d..e954cb2e53f3d8c297d21ef9f698d824
      V("modp5", BN_get_rfc3526_prime_1536);
    }
    V("modp14", BN_get_rfc3526_prime_2048);
-@@ -1171,11 +1179,13 @@ DHPointer::CheckPublicKeyResult DHPointer::checkPublicKey(const BignumPointer& p
+@@ -1130,11 +1134,13 @@ DHPointer::CheckPublicKeyResult DHPointer::checkPublicKey(const BignumPointer& p
    int codes = 0;
    if (DH_check_pub_key(dh_.get(), pub_key.get(), &codes) != 1)
      return DHPointer::CheckPublicKeyResult::CHECK_FAILED;
@@ -110,10 +92,10 @@ index 457bd2f6c5b18956d06c716fbfae429496fb352d..e954cb2e53f3d8c297d21ef9f698d824
    }
    return CheckPublicKeyResult::NONE;
 diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
-index 20b69dc67b13fd4f0bd44f7adf6a0d928a2c10c4..2320f92c50543fb9b426bce1c6d182bddf7658de 100644
+index 60bfce3ea8999e8e145aaf8cd14f0fdf21ed9c54..55aae783bb57273d1b49927f65b6c0830d09d115 100644
 --- a/deps/ncrypto/ncrypto.h
 +++ b/deps/ncrypto/ncrypto.h
-@@ -493,17 +493,21 @@ public:
+@@ -400,17 +400,21 @@ public:
      UNABLE_TO_CHECK_GENERATOR = DH_UNABLE_TO_CHECK_GENERATOR,
      NOT_SUITABLE_GENERATOR = DH_NOT_SUITABLE_GENERATOR,
      Q_NOT_PRIME = DH_CHECK_Q_NOT_PRIME,
@@ -149,7 +131,7 @@ index ea024af73e215b3cad5f08796ac405f419530c86..41061b524eea74330b8d2452635a38c4
    }
  }
 diff --git a/node.gni b/node.gni
-index 852f64fa9cfb50fe6e9ce7aa46be336d3196d5b8..461bff93e151c454cd0a9575daa01d3f7c0ec9c3 100644
+index 32709b860ccb12d8d1e75342a65dda0b86129b21..18d58591e3d0f1f3512db00033c3410a65702864 100644
 --- a/node.gni
 +++ b/node.gni
 @@ -10,6 +10,8 @@ declare_args() {
@@ -162,10 +144,10 @@ index 852f64fa9cfb50fe6e9ce7aa46be336d3196d5b8..461bff93e151c454cd0a9575daa01d3f
    node_module_version = exec_script("$node_path/tools/getmoduleversion.py", [], "value")
  
 diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
-index a81ab8e95f2fc23e1e315fb9c69364934377a0c1..dbe12ba2413ef29ff06a7e8abde50000eaf277e2 100644
+index fe35a8e0f6bbb7ab515a0343a7ed046c44e86474..43a7abbf237d8d809953e302b83755a3283a1bf4 100644
 --- a/src/crypto/crypto_cipher.cc
 +++ b/src/crypto/crypto_cipher.cc
-@@ -1080,7 +1080,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
+@@ -1078,7 +1078,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
      if (EVP_PKEY_decrypt_init(ctx.get()) <= 0) {
        return ThrowCryptoError(env, ERR_get_error());
      }
@@ -174,7 +156,7 @@ index a81ab8e95f2fc23e1e315fb9c69364934377a0c1..dbe12ba2413ef29ff06a7e8abde50000
      int rsa_pkcs1_implicit_rejection =
          EVP_PKEY_CTX_ctrl_str(ctx.get(), "rsa_pkcs1_implicit_rejection", "1");
      // From the doc -2 means that the option is not supported.
-@@ -1096,6 +1096,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
+@@ -1094,6 +1094,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
            "RSA_PKCS1_PADDING is no longer supported for private decryption,"
            " this can be reverted with --security-revert=CVE-2024-PEND");
      }
@@ -183,7 +165,7 @@ index a81ab8e95f2fc23e1e315fb9c69364934377a0c1..dbe12ba2413ef29ff06a7e8abde50000
  
    const EVP_MD* digest = nullptr;
 diff --git a/src/crypto/crypto_common.cc b/src/crypto/crypto_common.cc
-index 43a126f863779d3f364f92bd237039474b489845..77a3caee93049f65faef37e93b871c467ebca7e5 100644
+index 6a967702b22df0eb8aa10e853fd232794955860d..31058cccc6ffeed6b09aaecda320ee2f15849ec8 100644
 --- a/src/crypto/crypto_common.cc
 +++ b/src/crypto/crypto_common.cc
 @@ -134,7 +134,7 @@ const char* GetClientHelloALPN(const SSLPointer& ssl) {
@@ -272,7 +254,7 @@ index 43a126f863779d3f364f92bd237039474b489845..77a3caee93049f65faef37e93b871c46
    crypto::EVPKeyPointer key(raw_key);
  
 diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index aa5fc61f19e435b4833f3f49df10fa1edf2142c7..0a338b018a4ec20cb5bce250faf60d3f3bf192d4 100644
+index c924a54639e8c22d765dc240dffacfffb200ca0c..287afcc792a0a2b7e19126ee9a48ebe21cc8844e 100644
 --- a/src/crypto/crypto_context.cc
 +++ b/src/crypto/crypto_context.cc
 @@ -94,7 +94,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
@@ -308,7 +290,7 @@ index aa5fc61f19e435b4833f3f49df10fa1edf2142c7..0a338b018a4ec20cb5bce250faf60d3f
  
      X509_STORE_add_cert(sc->GetCertStoreOwnedByThisSecureContext(), ca);
 diff --git a/src/crypto/crypto_dh.cc b/src/crypto/crypto_dh.cc
-index d760a0d3ea1d12184a558f5e87cb22043d26a0f5..f973941b3b9ea954f35f2ea135f8ee3d77b98958 100644
+index e5664dfa2bc7e11922fa965f28acdf21470d1147..33ffbbb85d05f5356183e3aa1ca23707c5629b5d 100644
 --- a/src/crypto/crypto_dh.cc
 +++ b/src/crypto/crypto_dh.cc
 @@ -7,7 +7,9 @@
@@ -393,7 +375,7 @@ index d760a0d3ea1d12184a558f5e87cb22043d26a0f5..f973941b3b9ea954f35f2ea135f8ee3d
        break;
    }
 @@ -398,9 +398,11 @@ EVPKeyCtxPointer DhKeyGenTraits::Setup(DhKeyPairGenConfig* params) {
-     key_params = EVPKeyPointer::New();
+     key_params = EVPKeyPointer(EVP_PKEY_new());
      CHECK(key_params);
      CHECK_EQ(EVP_PKEY_assign_DH(key_params.get(), dh.release()), 1);
 -  } else if (int* prime_size = std::get_if<int>(&params->params.prime)) {
@@ -416,7 +398,7 @@ index d760a0d3ea1d12184a558f5e87cb22043d26a0f5..f973941b3b9ea954f35f2ea135f8ee3d
      UNREACHABLE();
    }
 diff --git a/src/crypto/crypto_dsa.cc b/src/crypto/crypto_dsa.cc
-index b557de774117e442d7f429e92d63a6e1faa236fd..0aca233ced39269b09c383e5b32d85cf36260a1e 100644
+index 5d081863cf2dcdcf8c2d09db6060eeb5e78c452f..67523ec1c406e345945e1dde663c784c43a1c624 100644
 --- a/src/crypto/crypto_dsa.cc
 +++ b/src/crypto/crypto_dsa.cc
 @@ -40,7 +40,7 @@ namespace crypto {
@@ -440,10 +422,10 @@ index b557de774117e442d7f429e92d63a6e1faa236fd..0aca233ced39269b09c383e5b32d85cf
      return EVPKeyCtxPointer();
  
 diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
-index 6af8d089ca6bcd73aff314638443610b9cc4bf7e..c84cbd5b4708e0c403ab0a1e1ddf5fc72eb3d148 100644
+index 8488fc57faaf722174032c5a927d150c76120d60..c51efc92d4818ee7701b4725585fb7e1d2d644ad 100644
 --- a/src/crypto/crypto_keys.cc
 +++ b/src/crypto/crypto_keys.cc
-@@ -1059,6 +1059,7 @@ void KeyObjectHandle::GetAsymmetricKeyType(
+@@ -1204,6 +1204,7 @@ void KeyObjectHandle::GetAsymmetricKeyType(
  }
  
  bool KeyObjectHandle::CheckEcKeyData() const {
@@ -451,7 +433,7 @@ index 6af8d089ca6bcd73aff314638443610b9cc4bf7e..c84cbd5b4708e0c403ab0a1e1ddf5fc7
    MarkPopErrorOnReturn mark_pop_error_on_return;
  
    const auto& key = data_.GetAsymmetricKey();
-@@ -1075,6 +1076,9 @@ bool KeyObjectHandle::CheckEcKeyData() const {
+@@ -1220,6 +1221,9 @@ bool KeyObjectHandle::CheckEcKeyData() const {
  #else
    return EVP_PKEY_public_check(ctx.get()) == 1;
  #endif
@@ -475,25 +457,27 @@ index b59e394d9a7e2c19fdf1f2b0177753ff488da0fa..91218f49da5392c6f769495ee7f9275a
      THROW_ERR_CRYPTO_OPERATION_FAILED(env, "could not generate prime");
      return Nothing<void>();
 diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
-index 6d360554b31d53a597d61fcbd660f703a903ca21..86fafe98222d4c18f062032d80104f3ef00dbc01 100644
+index 02e8e24b4054afd4c3ca797c19a78927319a0d9e..d2a931a3f8f9490fe17ef8a82d0204ee2cca409d 100644
 --- a/src/crypto/crypto_rsa.cc
 +++ b/src/crypto/crypto_rsa.cc
-@@ -608,10 +608,13 @@ Maybe<void> GetRsaKeyDetail(Environment* env,
+@@ -608,10 +608,11 @@ Maybe<void> GetRsaKeyDetail(Environment* env,
        }
  
        if (params->saltLength != nullptr) {
-+#ifndef OPENSSL_IS_BORINGSSL
+-        if (ASN1_INTEGER_get_int64(&salt_length, params->saltLength) != 1) {
+-          ThrowCryptoError(env, ERR_get_error(), "ASN1_INTEGER_get_in64 error");
+-          return Nothing<void>();
+-        }
 +        // TODO(codebytere): Upstream a shim to BoringSSL?
-         if (ASN1_INTEGER_get_int64(&salt_length, params->saltLength) != 1) {
-           ThrowCryptoError(env, ERR_get_error(), "ASN1_INTEGER_get_in64 error");
-           return Nothing<void>();
-         }
-+#endif
++        // if (ASN1_INTEGER_get_int64(&salt_length, params->saltLength) != 1) {
++        //   ThrowCryptoError(env, ERR_get_error(), "ASN1_INTEGER_get_in64 error");
++        //   return Nothing<void>();
++        // }
        }
  
        if (target
 diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
-index 12ee0cde0897024bccb0face49053544a0bcfcd7..8a6a36a3c31532ed585c287ba8cee14026d315b4 100644
+index 793c196f8ce538c66b20611d00e12392ff9e878b..ee81048caab4ccfe26ea9e677782c9c955d162a9 100644
 --- a/src/crypto/crypto_util.cc
 +++ b/src/crypto/crypto_util.cc
 @@ -495,24 +495,15 @@ Maybe<void> Decorate(Environment* env,
@@ -554,7 +538,7 @@ index 12ee0cde0897024bccb0face49053544a0bcfcd7..8a6a36a3c31532ed585c287ba8cee140
  }  // namespace
  
 diff --git a/src/env.h b/src/env.h
-index 55124cd38e75ab67c092f6bf5c909a50e7232045..3ef093e612b23d5e1e7cacf56055e5f9818bcb02 100644
+index fc8dbd615255851cad90e1d8ffe225f5e0c6a718..49ca9c0042ccf22ad1fffa54f05fd443cbc681ba 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -50,7 +50,7 @@
@@ -566,7 +550,7 @@ index 55124cd38e75ab67c092f6bf5c909a50e7232045..3ef093e612b23d5e1e7cacf56055e5f9
  #include <openssl/evp.h>
  #endif
  
-@@ -1060,7 +1060,7 @@ class Environment final : public MemoryRetainer {
+@@ -1073,7 +1073,7 @@ class Environment final : public MemoryRetainer {
      kExitInfoFieldCount
    };
  
@@ -589,7 +573,7 @@ index c59e65ad1fe3fac23f1fc25ca77e6133d1ccaccd..f2f07434e076e2977755ef7dac7d489a
  #if NODE_OPENSSL_HAS_QUIC
  #include <openssl/quic.h>
 diff --git a/src/node_options.cc b/src/node_options.cc
-index d3b59690e917afcf725cbfb1232d6ed9f298ee3a..3c42f9b87c11a0f88800d6709515c1c9e2972fc0 100644
+index cfc599ec9a6197231c3469d318f02c620cdb03a8..29630fcccc3bd9d24ad6aec64bef2fedfc3c4031 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -6,7 +6,7 @@
@@ -602,7 +586,7 @@ index d3b59690e917afcf725cbfb1232d6ed9f298ee3a..3c42f9b87c11a0f88800d6709515c1c9
  #endif
  
 diff --git a/src/node_options.h b/src/node_options.h
-index fc7f898a6b9b6072c15d77710c20ed1ba580966b..f39dcad0a28ae483e6d0e5df3816693119ac823e 100644
+index 9e656a2815045aa5da7eb267708c03058be9f362..600e0850f01e01024414d42b25605f256200540a 100644
 --- a/src/node_options.h
 +++ b/src/node_options.h
 @@ -11,7 +11,7 @@
@@ -615,10 +599,10 @@ index fc7f898a6b9b6072c15d77710c20ed1ba580966b..f39dcad0a28ae483e6d0e5df38166931
  #endif
  
 diff --git a/unofficial.gni b/unofficial.gni
-index f6793b8bf22d6ac911a1977edaa881b6dbbe7ac7..ddfbb97276b29df114ab455a2eed3b186b3af5d2 100644
+index de6ff5548ca5282199b7d85c11941c1fa351a9d9..3d8b7957e791ce2fa2a8d0937a87b6010087803d 100644
 --- a/unofficial.gni
 +++ b/unofficial.gni
-@@ -150,7 +150,6 @@ template("node_gn_build") {
+@@ -145,7 +145,6 @@ template("node_gn_build") {
      ]
      deps = [
        ":run_node_js2c",
@@ -626,7 +610,7 @@ index f6793b8bf22d6ac911a1977edaa881b6dbbe7ac7..ddfbb97276b29df114ab455a2eed3b18
        "deps/cares",
        "deps/histogram",
        "deps/llhttp",
-@@ -161,6 +160,8 @@ template("node_gn_build") {
+@@ -156,6 +155,8 @@ template("node_gn_build") {
        "deps/sqlite",
        "deps/uvwasi",
        "//third_party/zlib",
@@ -635,7 +619,7 @@ index f6793b8bf22d6ac911a1977edaa881b6dbbe7ac7..ddfbb97276b29df114ab455a2eed3b18
        "$node_v8_path:v8_libplatform",
      ]
  
-@@ -187,10 +188,8 @@ template("node_gn_build") {
+@@ -182,10 +183,8 @@ template("node_gn_build") {
        deps += [ "//third_party/icu" ]
      }
      if (node_use_openssl) {

patches/node/fix_lazyload_fs_in_esm_loaders_to_apply_asar_patches.patch

@@ -38,11 +38,11 @@ index 605e812d515fc467001e4ab88fc15b4af3fd4aa2..463e76cb1abc0c2fdddba4db2ca2e00f
      const result = dataURLProcessor(url);
      if (result === 'failure') {
 diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
-index ee2cc03892c01141b71571989b18eec387d3c766..c13475102a75d65329908f44def06a60f4a2c4f1 100644
+index f05c6f99c0037193c5802024be46a967d6cf47a0..f3dad958b2ec275992554477b9344214c8c1e2c8 100644
 --- a/lib/internal/modules/esm/resolve.js
 +++ b/lib/internal/modules/esm/resolve.js
-@@ -25,7 +25,7 @@ const {
- const assert = require('internal/assert');
+@@ -24,7 +24,7 @@ const {
+ } = primordials;
  const internalFS = require('internal/fs/utils');
  const { BuiltinModule } = require('internal/bootstrap/realm');
 -const { realpathSync } = require('fs');
@@ -60,10 +60,10 @@ index ee2cc03892c01141b71571989b18eec387d3c766..c13475102a75d65329908f44def06a60
      });
      const { search, hash } = resolved;
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 25ee090bbb4884d3e5f2530cc7153f9215754fae..45a0abc6423a4e53e070f3c117fac2a3554b188d 100644
+index d182eedf5e96039e0029d36e51f40b75c6fb2a39..06b31af80ebbfbf35ec787a94f345775eb512ebf 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -24,7 +24,7 @@ const {
+@@ -34,7 +34,7 @@ const {
  
  const { BuiltinModule } = require('internal/bootstrap/realm');
  const assert = require('internal/assert');
@@ -71,8 +71,8 @@ index 25ee090bbb4884d3e5f2530cc7153f9215754fae..45a0abc6423a4e53e070f3c117fac2a3
 +const fs = require('fs');
  const { dirname, extname, isAbsolute } = require('path');
  const {
-   assertBufferSource,
-@@ -269,7 +269,7 @@ translators.set('commonjs', function commonjsStrategy(url, source, isMain) {
+   loadBuiltinModule,
+@@ -335,7 +335,7 @@ translators.set('commonjs', async function commonjsStrategy(url, source,
  
    try {
      // We still need to read the FS to detect the exports.
@@ -81,7 +81,7 @@ index 25ee090bbb4884d3e5f2530cc7153f9215754fae..45a0abc6423a4e53e070f3c117fac2a3
    } catch {
      // Continue regardless of error.
    }
-@@ -336,7 +336,7 @@ function cjsPreparseModuleExports(filename, source) {
+@@ -403,7 +403,7 @@ function cjsPreparseModuleExports(filename, source) {
        isAbsolute(resolved)) {
          // TODO: this should be calling the `load` hook chain to get the source
          // (and fallback to reading the FS only if the source is nullish).

patches/node/fix_remove_fastapitypedarray_usage.patch

@@ -48,7 +48,7 @@ index 867a1c4aca54b9d41490d23a5eb55088b7e941cc..09f4c65a18efea262b1f854f993c6f18
  
  static v8::CFunction fast_equal(v8::CFunction::Make(FastTimingSafeEqual));
 diff --git a/src/node_buffer.cc b/src/node_buffer.cc
-index cd51d9acf9540d506ec35812b9d2c530fce24912..07068344262f7b73a83073d4da75bffe8b747a61 100644
+index 2302e8d94da3250e7fb4ee0c5e6a51d3d6941fbc..ed72476e16036d972de54d39cf4bd37bbbed5c5f 100644
 --- a/src/node_buffer.cc
 +++ b/src/node_buffer.cc
 @@ -44,6 +44,14 @@
@@ -74,7 +74,7 @@ index cd51d9acf9540d506ec35812b9d2c530fce24912..07068344262f7b73a83073d4da75bffe
  using v8::FunctionCallbackInfo;
  using v8::Global;
  using v8::HandleScope;
-@@ -582,19 +589,24 @@ void SlowCopy(const FunctionCallbackInfo<Value>& args) {
+@@ -581,19 +588,24 @@ void SlowCopy(const FunctionCallbackInfo<Value>& args) {
  
  // Assume caller has properly validated args.
  uint32_t FastCopy(Local<Value> receiver,
@@ -107,7 +107,7 @@ index cd51d9acf9540d506ec35812b9d2c530fce24912..07068344262f7b73a83073d4da75bffe
    return to_copy;
  }
  
-@@ -858,19 +870,17 @@ void Compare(const FunctionCallbackInfo<Value> &args) {
+@@ -857,19 +869,17 @@ void Compare(const FunctionCallbackInfo<Value> &args) {
  }
  
  int32_t FastCompare(v8::Local<v8::Value>,
@@ -135,7 +135,7 @@ index cd51d9acf9540d506ec35812b9d2c530fce24912..07068344262f7b73a83073d4da75bffe
  }
  
  static v8::CFunction fast_compare(v8::CFunction::Make(FastCompare));
-@@ -1141,14 +1151,13 @@ void SlowIndexOfNumber(const FunctionCallbackInfo<Value>& args) {
+@@ -1140,14 +1150,13 @@ void SlowIndexOfNumber(const FunctionCallbackInfo<Value>& args) {
  }
  
  int32_t FastIndexOfNumber(v8::Local<v8::Value>,
@@ -153,7 +153,7 @@ index cd51d9acf9540d506ec35812b9d2c530fce24912..07068344262f7b73a83073d4da75bffe
  }
  
  static v8::CFunction fast_index_of_number(
-@@ -1501,21 +1510,31 @@ void SlowWriteString(const FunctionCallbackInfo<Value>& args) {
+@@ -1552,21 +1561,31 @@ void SlowWriteString(const FunctionCallbackInfo<Value>& args) {
  
  template <encoding encoding>
  uint32_t FastWriteString(Local<Value> receiver,
@@ -194,10 +194,10 @@ index cd51d9acf9540d506ec35812b9d2c530fce24912..07068344262f7b73a83073d4da75bffe
  
  static v8::CFunction fast_write_string_ascii(
 diff --git a/src/node_external_reference.h b/src/node_external_reference.h
-index 8d49a119c218323674e29a522ecf71bd22cdaf1b..d39693f2f45f39e45960453112b0f6460a1b3a4d 100644
+index 38a4ff7e6c2c9997f004c7c1f94cb5a9ffc2ffe0..48e73168f994d79ae3564b813acb5546ca8f2526 100644
 --- a/src/node_external_reference.h
 +++ b/src/node_external_reference.h
-@@ -40,16 +40,16 @@ using CFunctionCallbackWithStrings =
+@@ -34,16 +34,16 @@ using CFunctionCallbackWithStrings =
               const v8::FastOneByteString& base);
  using CFunctionCallbackWithTwoUint8Arrays =
      int32_t (*)(v8::Local<v8::Value>,
@@ -219,7 +219,7 @@ index 8d49a119c218323674e29a522ecf71bd22cdaf1b..d39693f2f45f39e45960453112b0f646
                  uint32_t,
                  int64_t,
                  bool);
-@@ -68,18 +68,20 @@ using CFunctionWithBool = void (*)(v8::Local<v8::Value>,
+@@ -58,18 +58,20 @@ using CFunctionWithBool = void (*)(v8::Local<v8::Value>, bool);
  
  using CFunctionWriteString =
      uint32_t (*)(v8::Local<v8::Value> receiver,
@@ -246,18 +246,19 @@ index 8d49a119c218323674e29a522ecf71bd22cdaf1b..d39693f2f45f39e45960453112b0f646
  // This class manages the external references from the V8 heap
  // to the C++ addresses in Node.js.
 diff --git a/src/util.h b/src/util.h
-index b1f316eebc7199a3737f05a5f9a1dd7fc289490c..23a0a486244ce38277ef11df5806da1266b901ac 100644
+index a6da8720c499df54ab4608eb03cff905759c2232..43ef977363e565a6f9422c9454e25b8fe0b327d5 100644
 --- a/src/util.h
 +++ b/src/util.h
-@@ -59,6 +59,7 @@
+@@ -57,6 +57,8 @@
+ 
  namespace node {
  
- constexpr char kPathSeparator = std::filesystem::path::preferred_separator;
-+static constexpr size_t kMaxSizeInHeap = 64;
- 
++static constexpr size_t kMaxSizeInHeap = 64;                                 \
++
  #ifdef _WIN32
  /* MAX_PATH is in characters, not bytes. Make sure we have enough headroom. */
-@@ -576,6 +577,16 @@ class BufferValue : public MaybeStackBuffer<char> {
+ #define PATH_MAX_BYTES (MAX_PATH * 4)
+@@ -573,6 +575,16 @@ class BufferValue : public MaybeStackBuffer<char> {
        static_cast<char*>(name->Buffer()->Data()) + name##_offset;              \
    if (name##_length > 0) CHECK_NE(name##_data, nullptr);
  

patches/node/fix_remove_harmony-import-assertions_from_node_cc.patch

@@ -11,7 +11,7 @@ This patch can be removed when we upgrade to a V8 version that
 contains the above CL.
 
 diff --git a/src/node.cc b/src/node.cc
-index 1a2a43bdd37441400323a800c147fcb89f0d549a..ae0b40b40e601e86d22e223a764c20106ae29d70 100644
+index ccc1085a84b214d241687fa9ebd45b55b2cc60d8..1df8e1f00a0e2ffa63bfd4369240b837ab6a9c50 100644
 --- a/src/node.cc
 +++ b/src/node.cc
 @@ -804,7 +804,7 @@ static ExitCode ProcessGlobalArgsInternal(std::vector<std::string>* args,

patches/node/fix_revert_src_lb_reducing_c_calls_of_esm_legacy_main_resolve.patch

@@ -15,10 +15,10 @@ to recognize asar files.
 This reverts commit 9cf2e1f55b8446a7cde23699d00a3be73aa0c8f1.
 
 diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
-index c13475102a75d65329908f44def06a60f4a2c4f1..e9fe83a675cb5bf681934e0f1c30a3cab447ba57 100644
+index f3dad958b2ec275992554477b9344214c8c1e2c8..a086217046fd5ed7cfb09cfd2ed62f3987eb1f31 100644
 --- a/lib/internal/modules/esm/resolve.js
 +++ b/lib/internal/modules/esm/resolve.js
-@@ -28,14 +28,13 @@ const { BuiltinModule } = require('internal/bootstrap/realm');
+@@ -27,14 +27,13 @@ const { BuiltinModule } = require('internal/bootstrap/realm');
  const fs = require('fs');
  const { getOptionValue } = require('internal/options');
  // Do not eagerly grab .manifest, it may be in TDZ
@@ -35,36 +35,56 @@ index c13475102a75d65329908f44def06a60f4a2c4f1..e9fe83a675cb5bf681934e0f1c30a3ca
  const {
    ERR_INPUT_TYPE_NOT_ALLOWED,
    ERR_INVALID_ARG_TYPE,
-@@ -183,6 +182,15 @@ const legacyMainResolveExtensionsIndexes = {
-   kResolvedByPackageAndNode: 9,
- };
+@@ -154,34 +153,13 @@ function emitLegacyIndexDeprecation(url, packageJSONUrl, base, main) {
  
+ const realpathCache = new SafeMap();
+ 
+-const legacyMainResolveExtensions = [
+-  '',
+-  '.js',
+-  '.json',
+-  '.node',
+-  '/index.js',
+-  '/index.json',
+-  '/index.node',
+-  './index.js',
+-  './index.json',
+-  './index.node',
+-];
+-
+-const legacyMainResolveExtensionsIndexes = {
+-  // 0-6: when packageConfig.main is defined
+-  kResolvedByMain: 0,
+-  kResolvedByMainJs: 1,
+-  kResolvedByMainJson: 2,
+-  kResolvedByMainNode: 3,
+-  kResolvedByMainIndexJs: 4,
+-  kResolvedByMainIndexJson: 5,
+-  kResolvedByMainIndexNode: 6,
+-  // 7-9: when packageConfig.main is NOT defined,
+-  //      or when the previous case didn't found the file
+-  kResolvedByPackageAndJs: 7,
+-  kResolvedByPackageAndJson: 8,
+-  kResolvedByPackageAndNode: 9,
+-};
 +/**
 + * @param {string | URL} url
 + * @returns {boolean}
 + */
 +function fileExists(url) {
-+  const namespaced = toNamespacedPath(toPathIfFileURL(url));
-+  return internalFsBinding.internalModuleStat(internalFsBinding, namespaced) === 0;
++  return internalFsBinding.internalModuleStat(toNamespacedPath(toPathIfFileURL(url))) === 0;
 +}
-+
+ 
  /**
   * Legacy CommonJS main resolution:
-  * 1. let M = pkg_url + (json main field)
-@@ -199,18 +207,45 @@ function legacyMainResolve(packageJSONUrl, packageConfig, base) {
-   assert(isURL(packageJSONUrl));
-   const pkgPath = fileURLToPath(new URL('.', packageJSONUrl));
- 
--  const baseStringified = isURL(base) ? base.href : base;
+@@ -196,22 +174,44 @@ const legacyMainResolveExtensionsIndexes = {
+  * @returns {URL}
+  */
+ function legacyMainResolve(packageJSONUrl, packageConfig, base) {
+-  const packageJsonUrlString = packageJSONUrl.href;
 -
--  const resolvedOption = FSLegacyMainResolve(pkgPath, packageConfig.main, baseStringified);
--
--  const maybeMain = resolvedOption <= legacyMainResolveExtensionsIndexes.kResolvedByMainIndexNode ?
--    packageConfig.main || './' : '';
--  const resolvedPath = resolve(pkgPath, maybeMain + legacyMainResolveExtensions[resolvedOption]);
--  const resolvedUrl = pathToFileURL(resolvedPath);
--
--  emitLegacyIndexDeprecation(resolvedUrl, resolvedPath, pkgPath, base, packageConfig.main);
+-  if (typeof packageJsonUrlString !== 'string') {
+-    throw new ERR_INVALID_ARG_TYPE('packageJSONUrl', ['URL'], packageJSONUrl);
 +  let guess;
 +  if (packageConfig.main !== undefined) {
 +    // Note: fs check redundances will be handled by Descriptor cache here.
@@ -85,39 +105,277 @@ index c13475102a75d65329908f44def06a60f4a2c4f1..e9fe83a675cb5bf681934e0f1c30a3ca
 +                                        packageJSONUrl)));
 +    else guess = undefined;
 +    if (guess) {
-+      emitLegacyIndexDeprecation(guess, fileURLToPath(guess), pkgPath,
-+                                 base, packageConfig.main);
++      emitLegacyIndexDeprecation(guess, packageJSONUrl, base,
++                                 packageConfig.main);
 +      return guess;
 +    }
-+  }
- 
++    // Fallthrough.
+   }
+-
+-  const baseStringified = isURL(base) ? base.href : base;
+-
+-  const resolvedOption = FSLegacyMainResolve(packageJsonUrlString, packageConfig.main, baseStringified);
+-
+-  const baseUrl = resolvedOption <= legacyMainResolveExtensionsIndexes.kResolvedByMainIndexNode ? `./${packageConfig.main}` : '';
+-  const resolvedUrl = new URL(baseUrl + legacyMainResolveExtensions[resolvedOption], packageJSONUrl);
+-
+-  emitLegacyIndexDeprecation(resolvedUrl, packageJSONUrl, base, packageConfig.main);
+-
 -  return resolvedUrl;
-+  // Fallthrough.
 +  if (fileExists(guess = new URL('./index.js', packageJSONUrl)));
 +  // So fs.
 +  else if (fileExists(guess = new URL('./index.json', packageJSONUrl)));
 +  else if (fileExists(guess = new URL('./index.node', packageJSONUrl)));
 +  else guess = undefined;
 +  if (guess) {
-+    emitLegacyIndexDeprecation(guess, fileURLToPath(guess), pkgPath,
-+                                base, packageConfig.main);
++    emitLegacyIndexDeprecation(guess, packageJSONUrl, base, packageConfig.main);
 +    return guess;
 +  }
 +  // Not found.
-+  throw new ERR_MODULE_NOT_FOUND(pkgPath, fileURLToPath(base), null);
++  throw new ERR_MODULE_NOT_FOUND(
++    fileURLToPath(new URL('.', packageJSONUrl)), fileURLToPath(base));
  }
  
  const encodedSepRegEx = /%2F|%5C/i;
+diff --git a/src/node_file.cc b/src/node_file.cc
+index 0bb70eb0fcd42ddf4d5e585065cf1ad8e74faab3..b565beae625d970ba92ab667a145d8897d4e8a6e 100644
+--- a/src/node_file.cc
++++ b/src/node_file.cc
+@@ -19,14 +19,12 @@
+ // OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ // USE OR OTHER DEALINGS IN THE SOFTWARE.
+ #include "node_file.h"  // NOLINT(build/include_inline)
+-#include "ada.h"
+ #include "aliased_buffer-inl.h"
+ #include "memory_tracker-inl.h"
+ #include "node_buffer.h"
+ #include "node_errors.h"
+ #include "node_external_reference.h"
+ #include "node_file-inl.h"
+-#include "node_metadata.h"
+ #include "node_process-inl.h"
+ #include "node_stat_watcher.h"
+ #include "node_url.h"
+@@ -3208,146 +3206,6 @@ constexpr std::array<std::string_view, 10> legacy_main_extensions = {
+ 
+ }  // namespace
+ 
+-void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+-  CHECK_GE(args.Length(), 1);
+-  CHECK(args[0]->IsString());
+-
+-  Environment* env = Environment::GetCurrent(args);
+-  auto isolate = env->isolate();
+-
+-  Utf8Value utf8_package_json_url(isolate, args[0]);
+-  auto package_json_url =
+-      ada::parse<ada::url_aggregator>(utf8_package_json_url.ToStringView());
+-
+-  if (!package_json_url) {
+-    THROW_ERR_INVALID_URL(isolate, "Invalid URL");
+-    return;
+-  }
+-
+-  std::string package_initial_file = "";
+-
+-  ada::result<ada::url_aggregator> file_path_url;
+-  std::optional<std::string> initial_file_path;
+-  std::string file_path;
+-
+-  if (args.Length() >= 2 && args[1]->IsString()) {
+-    auto package_config_main = Utf8Value(isolate, args[1]).ToString();
+-
+-    file_path_url = ada::parse<ada::url_aggregator>(
+-        std::string("./") + package_config_main, &package_json_url.value());
+-
+-    if (!file_path_url) {
+-      THROW_ERR_INVALID_URL(isolate, "Invalid URL");
+-      return;
+-    }
+-
+-    initial_file_path = node::url::FileURLToPath(env, *file_path_url);
+-    if (!initial_file_path.has_value()) {
+-      return;
+-    }
+-
+-    FromNamespacedPath(&initial_file_path.value());
+-
+-    package_initial_file = *initial_file_path;
+-
+-    for (int i = 0; i < legacy_main_extensions_with_main_end; i++) {
+-      file_path = *initial_file_path + std::string(legacy_main_extensions[i]);
+-      // TODO(anonrig): Remove this when ToNamespacedPath supports std::string
+-      Local<Value> local_file_path =
+-          Buffer::Copy(env->isolate(), file_path.c_str(), file_path.size())
+-              .ToLocalChecked();
+-      BufferValue buff_file_path(isolate, local_file_path);
+-      ToNamespacedPath(env, &buff_file_path);
+-
+-      switch (FilePathIsFile(env, buff_file_path.ToString())) {
+-        case BindingData::FilePathIsFileReturnType::kIsFile:
+-          return args.GetReturnValue().Set(i);
+-        case BindingData::FilePathIsFileReturnType::kIsNotFile:
+-          continue;
+-        case BindingData::FilePathIsFileReturnType::
+-            kThrowInsufficientPermissions:
+-          // the default behavior when do not have permission is to return
+-          // and exit the execution of the method as soon as possible
+-          // the internal function will throw the exception
+-          return;
+-        default:
+-          UNREACHABLE();
+-      }
+-    }
+-  }
+-
+-  file_path_url =
+-      ada::parse<ada::url_aggregator>("./index", &package_json_url.value());
+-
+-  if (!file_path_url) {
+-    THROW_ERR_INVALID_URL(isolate, "Invalid URL");
+-    return;
+-  }
+-
+-  initial_file_path = node::url::FileURLToPath(env, *file_path_url);
+-  if (!initial_file_path.has_value()) {
+-    return;
+-  }
+-
+-  FromNamespacedPath(&initial_file_path.value());
+-
+-  for (int i = legacy_main_extensions_with_main_end;
+-       i < legacy_main_extensions_package_fallback_end;
+-       i++) {
+-    file_path = *initial_file_path + std::string(legacy_main_extensions[i]);
+-    // TODO(anonrig): Remove this when ToNamespacedPath supports std::string
+-    Local<Value> local_file_path =
+-        Buffer::Copy(env->isolate(), file_path.c_str(), file_path.size())
+-            .ToLocalChecked();
+-    BufferValue buff_file_path(isolate, local_file_path);
+-    ToNamespacedPath(env, &buff_file_path);
+-
+-    switch (FilePathIsFile(env, buff_file_path.ToString())) {
+-      case BindingData::FilePathIsFileReturnType::kIsFile:
+-        return args.GetReturnValue().Set(i);
+-      case BindingData::FilePathIsFileReturnType::kIsNotFile:
+-        continue;
+-      case BindingData::FilePathIsFileReturnType::kThrowInsufficientPermissions:
+-        // the default behavior when do not have permission is to return
+-        // and exit the execution of the method as soon as possible
+-        // the internal function will throw the exception
+-        return;
+-      default:
+-        UNREACHABLE();
+-    }
+-  }
+-
+-  if (package_initial_file == "")
+-    package_initial_file = *initial_file_path + ".js";
+-
+-  std::optional<std::string> module_base;
+-
+-  if (args.Length() >= 3 && args[2]->IsString()) {
+-    Utf8Value utf8_base_path(isolate, args[2]);
+-    auto base_url =
+-        ada::parse<ada::url_aggregator>(utf8_base_path.ToStringView());
+-
+-    if (!base_url) {
+-      THROW_ERR_INVALID_URL(isolate, "Invalid URL");
+-      return;
+-    }
+-
+-    module_base = node::url::FileURLToPath(env, *base_url);
+-    if (!module_base.has_value()) {
+-      return;
+-    }
+-  } else {
+-    THROW_ERR_INVALID_ARG_TYPE(
+-        isolate,
+-        "The \"base\" argument must be of type string or an instance of URL.");
+-    return;
+-  }
+-
+-  THROW_ERR_MODULE_NOT_FOUND(isolate,
+-                             "Cannot find package '%s' imported from %s",
+-                             package_initial_file,
+-                             *module_base);
+-}
+ 
+ void BindingData::MemoryInfo(MemoryTracker* tracker) const {
+   tracker->TrackField("stats_field_array", stats_field_array);
+@@ -3448,19 +3306,6 @@ InternalFieldInfoBase* BindingData::Serialize(int index) {
+   return info;
+ }
+ 
+-void BindingData::CreatePerIsolateProperties(IsolateData* isolate_data,
+-                                             Local<ObjectTemplate> target) {
+-  Isolate* isolate = isolate_data->isolate();
+-
+-  SetMethod(
+-      isolate, target, "legacyMainResolve", BindingData::LegacyMainResolve);
+-}
+-
+-void BindingData::RegisterExternalReferences(
+-    ExternalReferenceRegistry* registry) {
+-  registry->Register(BindingData::LegacyMainResolve);
+-}
+-
+ static void CreatePerIsolateProperties(IsolateData* isolate_data,
+                                        Local<ObjectTemplate> target) {
+   Isolate* isolate = isolate_data->isolate();
+@@ -3520,7 +3365,6 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
+   SetMethod(isolate, target, "cpSyncCheckPaths", CpSyncCheckPaths);
+ 
+   StatWatcher::CreatePerIsolateProperties(isolate_data, target);
+-  BindingData::CreatePerIsolateProperties(isolate_data, target);
+ 
+   target->Set(
+       FIXED_ONE_BYTE_STRING(isolate, "kFsStatsFieldsNumber"),
+@@ -3593,7 +3437,6 @@ BindingData* FSReqBase::binding_data() {
+ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+   registry->Register(Access);
+   StatWatcher::RegisterExternalReferences(registry);
+-  BindingData::RegisterExternalReferences(registry);
+ 
+   registry->Register(GetFormatOfExtensionlessFile);
+   registry->Register(Close);
+diff --git a/src/node_file.h b/src/node_file.h
+index bdad1ae25f4892cbbfd8cc30c4d8b4a6f600edbc..5a3c462853aa784d9ef61ff4f63010848c48b92c 100644
+--- a/src/node_file.h
++++ b/src/node_file.h
+@@ -86,13 +86,6 @@ class BindingData : public SnapshotableObject {
+   SERIALIZABLE_OBJECT_METHODS()
+   SET_BINDING_ID(fs_binding_data)
+ 
+-  static void LegacyMainResolve(
+-      const v8::FunctionCallbackInfo<v8::Value>& args);
+-
+-  static void CreatePerIsolateProperties(IsolateData* isolate_data,
+-                                         v8::Local<v8::ObjectTemplate> ctor);
+-  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+-
+   void MemoryInfo(MemoryTracker* tracker) const override;
+   SET_SELF_SIZE(BindingData)
+   SET_MEMORY_INFO_NAME(BindingData)
 diff --git a/test/es-module/test-cjs-legacyMainResolve.js b/test/es-module/test-cjs-legacyMainResolve.js
-index edb567bce403f2d4df482c2549c6f7cec78c3588..4567ddc3715ac0d11facb0b567c5f5763699f4c9 100644
+index 0bfeb567a22b1f9d9116b749d6cb3a8fda6bcc6a..17f137c595a9fef5f051fafc4682f206034c214c 100644
 --- a/test/es-module/test-cjs-legacyMainResolve.js
 +++ b/test/es-module/test-cjs-legacyMainResolve.js
+@@ -82,7 +82,7 @@ describe('legacyMainResolve', () => {
+           {},
+           ''
+         ),
+-      { message: /instance of URL/, code: 'ERR_INVALID_ARG_TYPE' },
++      { message: 'Invalid URL', code: 'ERR_INVALID_URL' },
+     );
+   });
+ 
 @@ -129,7 +129,7 @@ describe('legacyMainResolve', () => {
      );
      assert.throws(
        () => legacyMainResolve(packageJsonUrl, { main: null }, packageJsonUrl),
 -      { message: /index\.js/, code: 'ERR_MODULE_NOT_FOUND' },
-+      { code: 'ERR_MODULE_NOT_FOUND' },
++      { code: 'ERR_INTERNAL_ASSERTION' },
      );
    });
  
@@ -126,7 +384,7 @@ index edb567bce403f2d4df482c2549c6f7cec78c3588..4567ddc3715ac0d11facb0b567c5f576
      assert.throws(
        () => legacyMainResolve(packageJsonUrl, { main: null }, packageJsonUrl),
 -      { message: /index\.js/, code: 'ERR_MODULE_NOT_FOUND' },
-+      { code: 'ERR_MODULE_NOT_FOUND' },
++      { code: 'ERR_INTERNAL_ASSERTION' },
      );
    });
  
@@ -135,11 +393,11 @@ index edb567bce403f2d4df482c2549c6f7cec78c3588..4567ddc3715ac0d11facb0b567c5f576
      assert.throws(
        () => legacyMainResolve(packageJsonUrl, { main: './index.node' }, packageJsonUrl),
 -      { message: /index\.node/, code: 'ERR_MODULE_NOT_FOUND' },
-+      { code: 'ERR_MODULE_NOT_FOUND' },
++      { code: 'ERR_INTERNAL_ASSERTION' },
      );
    });
  
-@@ -163,11 +163,11 @@ describe('legacyMainResolve', () => {
+@@ -163,7 +163,7 @@ describe('legacyMainResolve', () => {
      );
      assert.throws(
        () => legacyMainResolve(packageJsonUrl, { main: null }, undefined),
@@ -147,9 +405,4 @@ index edb567bce403f2d4df482c2549c6f7cec78c3588..4567ddc3715ac0d11facb0b567c5f576
 +      { message: 'The "path" argument must be of type string or an instance of URL. Received undefined', code: 'ERR_INVALID_ARG_TYPE' },
      );
    });
- 
--  it('should interpret main as a path, not a URL', () => {
-+  it.skip('should interpret main as a path, not a URL', () => {
-     const packageJsonUrl = fixtures.fileURL('/es-modules/legacy-main-resolver/package.json');
-     assert.deepStrictEqual(
-       legacyMainResolve(packageJsonUrl, { main: '../folder%25with percentage#/' }, packageJsonUrl),
+ });

patches/node/fix_serdes_test.patch

@@ -1,34 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Jeremy Rose <nornagon@nornagon.net>
-Date: Fri, 28 Jan 2022 13:50:21 -0800
-Subject: fix serdes test
-
-The V8 wire format version changed.
-
-diff --git a/test/parallel/test-v8-serdes.js b/test/parallel/test-v8-serdes.js
-index 296e076a9f760d94293fe4310d6f3a081e3e59f4..be6deaf463977cc65e9f135008c3ce2b2919e22f 100644
---- a/test/parallel/test-v8-serdes.js
-+++ b/test/parallel/test-v8-serdes.js
-@@ -163,11 +163,11 @@ const hostObject = new (internalBinding('js_stream').JSStream)();
- 
- {
-   // Test that an old serialized value can still be deserialized.
--  const buf = Buffer.from('ff0d6f2203666f6f5e007b01', 'hex');
-+  const buf = Buffer.from('ff0f6f2203666f6f5e007b01', 'hex');
- 
-   const des = new v8.DefaultDeserializer(buf);
-   des.readHeader();
--  assert.strictEqual(des.getWireFormatVersion(), 0x0d);
-+  assert.strictEqual(des.getWireFormatVersion(), 0x0f);
- 
-   const value = des.readValue();
-   assert.strictEqual(value, value.foo);
-@@ -202,7 +202,7 @@ const hostObject = new (internalBinding('js_stream').JSStream)();
- {
-   // Unaligned Uint16Array read, with padding in the underlying array buffer.
-   let buf = Buffer.alloc(32 + 9);
--  buf.write('ff0d5c0404addeefbe', 32, 'hex');
-+  buf.write('ff0e5c0404addeefbe', 32, 'hex');
-   buf = buf.slice(32);
- 
-   const expectedResult = os.endianness() === 'LE' ?

patches/node/pass_all_globals_through_require.patch

@@ -6,10 +6,10 @@ Subject: Pass all globals through "require"
 (cherry picked from commit 7d015419cb7a0ecfe6728431a4ed2056cd411d62)
 
 diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
-index b0210e4d96348c77da9eabbe8f3d292337cd6ae4..ad8d41a06bde1ca22d0245fa49143e080365b5e1 100644
+index 451b7c2195e7ad3ab0bde95259e054dc431d7de9..d49941881e6cfd8647a6d44a57e0daaf1c874702 100644
 --- a/lib/internal/modules/cjs/loader.js
 +++ b/lib/internal/modules/cjs/loader.js
-@@ -183,6 +183,13 @@ const {
+@@ -182,6 +182,13 @@ const {
    CHAR_FORWARD_SLASH,
  } = require('internal/constants');
  

patches/node/refactor_allow_embedder_overriding_of_internal_fs_calls.patch

@@ -7,7 +7,7 @@ We use this to allow node's 'fs' module to read from ASAR files as if they were
 a real filesystem.
 
 diff --git a/lib/internal/bootstrap/node.js b/lib/internal/bootstrap/node.js
-index 11d585bc5b3e47b36877ca8306b72f571acb7d09..65d42428c70a3242f7076f1c1a4cec027a9c9829 100644
+index f7a62364b6107ab0bad33ea2f745703c746991dc..bab2aaf3db66452216035db594dc3ebdc3606c8b 100644
 --- a/lib/internal/bootstrap/node.js
 +++ b/lib/internal/bootstrap/node.js
 @@ -134,6 +134,10 @@ process.domain = null;

patches/node/src_provide_workaround_for_container-overflow.patch

@@ -15,7 +15,7 @@ In a future release of simdjson, we will provide a more convenient function that
 avoids such ugly workaround.
 
 diff --git a/src/node_modules.cc b/src/node_modules.cc
-index dfd115a9eccc6b58d63a72ac450a1497354482dd..16a9f923148835daa95d3578e5941b284ff71434 100644
+index 3bedd2dfecb49c3f69ea59b70d72b8b6fc605132..2b0e4905dd557e73542cf052ba81327b1e1e471f 100644
 --- a/src/node_modules.cc
 +++ b/src/node_modules.cc
 @@ -100,11 +100,23 @@ const BindingData::PackageConfig* BindingData::GetPackageJSON(

patches/node/src_remove_dependency_on_wrapper-descriptor-based_cppheap.patch

@@ -16,7 +16,7 @@ patch:
 (cherry picked from commit 30329d06235a9f9733b1d4da479b403462d1b326)
 
 diff --git a/src/env-inl.h b/src/env-inl.h
-index 3b041dd28ba32f028ecbb7d87b82f9ddee406b4f..5436c1a0f21e261f2eb2fdbb7f679d4f92a14ffd 100644
+index 28a15aa741ddd40c664aae641797e7cc2813442f..08fe98e10b7716c694bbc882299fe0ed9e282d73 100644
 --- a/src/env-inl.h
 +++ b/src/env-inl.h
 @@ -62,31 +62,6 @@ inline uv_loop_t* IsolateData::event_loop() const {
@@ -52,7 +52,7 @@ index 3b041dd28ba32f028ecbb7d87b82f9ddee406b4f..5436c1a0f21e261f2eb2fdbb7f679d4f
    return &(wrapper_data_->cppgc_id);
  }
 diff --git a/src/env.cc b/src/env.cc
-index 130524cad713e8aa685feaa8c384fe4db9452500..21bc5b8a3326e759ce12b865e49029cf8ffe9995 100644
+index 665b064091d4cc42a4dc9ee5b0ea9e2f190338ca..4c8cb75945d82544ce2237d94cd1406d15efe424 100644
 --- a/src/env.cc
 +++ b/src/env.cc
 @@ -23,6 +23,7 @@
@@ -63,7 +63,7 @@ index 130524cad713e8aa685feaa8c384fe4db9452500..21bc5b8a3326e759ce12b865e49029cf
  
  #include <algorithm>
  #include <atomic>
-@@ -70,7 +71,6 @@ using v8::TryCatch;
+@@ -71,7 +72,6 @@ using v8::TryCatch;
  using v8::Uint32;
  using v8::Undefined;
  using v8::Value;
@@ -146,7 +146,7 @@ index 130524cad713e8aa685feaa8c384fe4db9452500..21bc5b8a3326e759ce12b865e49029cf
  
  void IsolateData::MemoryInfo(MemoryTracker* tracker) const {
 diff --git a/src/env.h b/src/env.h
-index 3ef093e612b23d5e1e7cacf56055e5f9818bcb02..9dfc1364c7206377b6d0d088b456c357c23a9151 100644
+index 49ca9c0042ccf22ad1fffa54f05fd443cbc681ba..945535d0dc40f1a32f7e3ecf7d50361e591ba6c8 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -175,10 +175,6 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {

patches/node/src_stop_using_deprecated_fields_of_fastapicallbackoptions.patch

@@ -26,10 +26,10 @@ index 3d8ccc77b5952a999c5fe48792259d32b402c460..867a1c4aca54b9d41490d23a5eb55088
    }
  
 diff --git a/src/histogram.cc b/src/histogram.cc
-index c62a5b8952400ff0dd8818c31a3e07622b63725c..36f61f57e951e1abfeb2fedb831b55c61363bcbc 100644
+index 4dbdea9be5721486d71a9dda77311b4919d450a3..4aacaa2a5d12533a039b4b96cb7f1fd79063d50f 100644
 --- a/src/histogram.cc
 +++ b/src/histogram.cc
-@@ -195,7 +195,8 @@ void HistogramBase::FastRecord(Local<Value> unused,
+@@ -193,7 +193,8 @@ void HistogramBase::FastRecord(Local<Value> receiver,
                                 const int64_t value,
                                 FastApiCallbackOptions& options) {
    if (value < 1) {
@@ -40,13 +40,14 @@ index c62a5b8952400ff0dd8818c31a3e07622b63725c..36f61f57e951e1abfeb2fedb831b55c6
    }
    HistogramBase* histogram;
 diff --git a/src/node_file.cc b/src/node_file.cc
-index 6b98a13099990918dc619c47124c8538bbee5e2d..307492bf3dfce7b4a476c448bec666b8116dc431 100644
+index b565beae625d970ba92ab667a145d8897d4e8a6e..31c2fe82299d6905855c4efffeea4a4d161a88d5 100644
 --- a/src/node_file.cc
 +++ b/src/node_file.cc
-@@ -1060,22 +1060,10 @@ static int32_t FastInternalModuleStat(
+@@ -1049,23 +1049,10 @@ static int32_t FastInternalModuleStat(
+     const FastOneByteString& input,
      // NOLINTNEXTLINE(runtime/references) This is V8 api.
      FastApiCallbackOptions& options) {
-   // This needs a HandleScope which needs an isolate.
+-  // This needs a HandleScope which needs an isolate.
 -  Isolate* isolate = Isolate::TryGetCurrent();
 -  if (!isolate) {
 -    options.fallback = true;
@@ -59,24 +60,24 @@ index 6b98a13099990918dc619c47124c8538bbee5e2d..307492bf3dfce7b4a476c448bec666b8
 +  HandleScope scope(env->isolate());
  
    auto path = std::filesystem::path(input.data, input.data + input.length);
--  if (!env->permission()->is_granted(
--          env, permission::PermissionScope::kFileSystemRead, path.string()))
--      [[unlikely]] {
+-  if (UNLIKELY(!env->permission()->is_granted(
+-          env, permission::PermissionScope::kFileSystemRead, path.string()))) {
 -    options.fallback = true;
 -    return -1;
 -  }
- 
+-
    switch (std::filesystem::status(path).type()) {
      case std::filesystem::file_type::directory:
+       return 1;
 diff --git a/src/node_wasi.cc b/src/node_wasi.cc
-index 468c2e59903fefe58d9c178d3afac3ef5b09f611..23a376e52e08a8af49dd47c47488552e01287426 100644
+index ad1da44a01f437c97e06a3857eebd2edcebc83da..7123278e1a0942b61a76e9b1e7464eb8b5064079 100644
 --- a/src/node_wasi.cc
 +++ b/src/node_wasi.cc
-@@ -251,17 +251,19 @@ R WASI::WasiFunction<FT, F, R, Args...>::FastCallback(
-     return EinvalError<R>();
-   }
+@@ -248,17 +248,18 @@ R WASI::WasiFunction<FT, F, R, Args...>::FastCallback(
+   WASI* wasi = reinterpret_cast<WASI*>(BaseObject::FromJSObject(receiver));
+   if (UNLIKELY(wasi == nullptr)) return EinvalError<R>();
  
--  if (options.wasm_memory == nullptr || wasi->memory_.IsEmpty()) [[unlikely]] {
+-  if (UNLIKELY(options.wasm_memory == nullptr || wasi->memory_.IsEmpty())) {
 -    // fallback to slow path which to throw an error about missing memory.
 -    options.fallback = true;
 +  v8::Isolate* isolate = receiver->GetIsolate();
@@ -86,16 +87,15 @@ index 468c2e59903fefe58d9c178d3afac3ef5b09f611..23a376e52e08a8af49dd47c47488552e
      return EinvalError<R>();
    }
 -  uint8_t* memory = nullptr;
--  CHECK(options.wasm_memory->getStorageIfAligned(&memory));
- 
--  return F(*wasi,
--           {reinterpret_cast<char*>(memory), options.wasm_memory->length()},
--           args...);
+-  CHECK(LIKELY(options.wasm_memory->getStorageIfAligned(&memory)));
 +  Local<ArrayBuffer> ab = wasi->memory_.Get(isolate)->Buffer();
 +  size_t mem_size = ab->ByteLength();
 +  char* mem_data = static_cast<char*>(ab->Data());
 +  CHECK_NOT_NULL(mem_data);
-+
+ 
+-  return F(*wasi,
+-           {reinterpret_cast<char*>(memory), options.wasm_memory->length()},
+-           args...);
 +  return F(*wasi, {mem_data, mem_size}, args...);
  }
  

patches/node/support_v8_sandboxed_pointers.patch

@@ -7,10 +7,10 @@ This refactors several allocators to allocate within the V8 memory cage,
 allowing them to be compatible with the V8_SANDBOXED_POINTERS feature.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index e044f10284f31f1862b18be752a04b3bd5d53401..89ce587cac4506c4218a9316fe0b68070a7a8504 100644
+index 5fc1b6f2446d7c786024eb60800e2edab613dcd1..f59abcb21d64b910d8d42eb23c03109f62558813 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -102,6 +102,14 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,
+@@ -101,6 +101,14 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,
    return result;
  }
  
@@ -26,7 +26,7 @@ index e044f10284f31f1862b18be752a04b3bd5d53401..89ce587cac4506c4218a9316fe0b6807
    void* ret;
    if (zero_fill_field_ || per_process::cli_options->zero_fill_all_buffers)
 diff --git a/src/crypto/crypto_dh.cc b/src/crypto/crypto_dh.cc
-index f973941b3b9ea954f35f2ea135f8ee3d77b98958..743c63ff7e3f526829919a8f2de7ebd625a93fbc 100644
+index 33ffbbb85d05f5356183e3aa1ca23707c5629b5d..008d212ebe25b0022020379aa08963c12828940c 100644
 --- a/src/crypto/crypto_dh.cc
 +++ b/src/crypto/crypto_dh.cc
 @@ -51,6 +51,25 @@ void DiffieHellman::MemoryInfo(MemoryTracker* tracker) const {
@@ -64,7 +64,7 @@ index f973941b3b9ea954f35f2ea135f8ee3d77b98958..743c63ff7e3f526829919a8f2de7ebd6
    auto ab = ArrayBuffer::New(env->isolate(), std::move(backing));
    return Buffer::New(env, ab, 0, ab->ByteLength()).FromMaybe(Local<Value>());
 diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
-index 8a6a36a3c31532ed585c287ba8cee14026d315b4..3d449b5853f359d63e1b88671a857bf9152ff6af 100644
+index ee81048caab4ccfe26ea9e677782c9c955d162a9..643c9d31dc2737faa2ec51684ffceb35a1014a58 100644
 --- a/src/crypto/crypto_util.cc
 +++ b/src/crypto/crypto_util.cc
 @@ -326,10 +326,35 @@ ByteSource& ByteSource::operator=(ByteSource&& other) noexcept {
@@ -156,10 +156,10 @@ index 922e77091d72172ed6cfc5e8477901e3608396c5..16a236c69caed6d60248c7973531a95a
    v8::Local<v8::ArrayBuffer> ToArrayBuffer(Environment* env);
  
 diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc
-index 9b9bb7be9a8daca98a2635bf13cb6d1d561ea5fb..81afe2b5f7398f0c20b340648ca75022470be544 100644
+index af2f953f0388dbce326b0c519de3883552f8f009..7fb34057a486914dd886ec4d3d23be90cccb4fea 100644
 --- a/src/crypto/crypto_x509.cc
 +++ b/src/crypto/crypto_x509.cc
-@@ -175,6 +175,19 @@ MaybeLocal<Value> ToV8Value(Local<Context> context, const BIOPointer& bio) {
+@@ -174,6 +174,19 @@ MaybeLocal<Value> ToV8Value(Local<Context> context, const BIOPointer& bio) {
  MaybeLocal<Value> ToBuffer(Environment* env, BIOPointer* bio) {
    if (bio == nullptr || !*bio) return {};
    BUF_MEM* mem = *bio;
@@ -179,7 +179,7 @@ index 9b9bb7be9a8daca98a2635bf13cb6d1d561ea5fb..81afe2b5f7398f0c20b340648ca75022
    auto backing = ArrayBuffer::NewBackingStore(
        mem->data,
        mem->length,
-@@ -182,6 +195,8 @@ MaybeLocal<Value> ToBuffer(Environment* env, BIOPointer* bio) {
+@@ -181,6 +194,8 @@ MaybeLocal<Value> ToBuffer(Environment* env, BIOPointer* bio) {
          BIOPointer free_me(static_cast<BIO*>(data));
        },
        bio->release());
@@ -229,10 +229,10 @@ index 43bb68351bf0a68285e464601013bbdbd5d5df5f..4126bbff080548c91154a6dcc437359c
  
  constexpr const char* EncodingName(const enum encoding encoding) {
 diff --git a/src/node_internals.h b/src/node_internals.h
-index 85b666e11f5654afe2a2f192e629221f2133b165..bd8d65247ad3ba4878f1288ab2b66e3598982b09 100644
+index fe2d25decd883085e4c3f368ab4acc01a7f66f6e..bcd5c87afcff9c56429443363c63fc8079521451 100644
 --- a/src/node_internals.h
 +++ b/src/node_internals.h
-@@ -117,7 +117,9 @@ v8::Maybe<void> InitializePrimordials(v8::Local<v8::Context> context);
+@@ -117,7 +117,9 @@ v8::Maybe<bool> InitializePrimordials(v8::Local<v8::Context> context);
  
  class NodeArrayBufferAllocator : public ArrayBufferAllocator {
   public:
@@ -384,18 +384,3 @@ index 9787b14352753c5e0f8dc2b90093680e7cd10f1a..31af9e62396368af1b81f8841a705fd3
    auto ab = ArrayBuffer::New(isolate, std::move(bs));
    v8::Local<Uint8Array> u8 = v8::Uint8Array::New(ab, 0, 1);
  
-diff --git a/test/parallel/test-buffer-tostring-range.js b/test/parallel/test-buffer-tostring-range.js
-index 73fec107a36c3db4af6f492137d0ca174f2d0547..a1153ec381f7b12a1640b611073f6997e1ec5696 100644
---- a/test/parallel/test-buffer-tostring-range.js
-+++ b/test/parallel/test-buffer-tostring-range.js
-@@ -102,8 +102,8 @@ assert.throws(() => {
- // Must not throw when start and end are within kMaxLength
- // Cannot test on 32bit machine as we are testing the case
- // when start and end are above the threshold
--if (!common.openSSLIsBoringSSL) {
-+/*
- const threshold = 0xFFFFFFFF;
- const largeBuffer = Buffer.alloc(threshold + 20);
- largeBuffer.toString('utf8', threshold, threshold + 20);
--}
-+*/