ci: disallow non-maintainer changes to Yarn files (#49192)

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: David Sanders <dsanders11@ucsbalum.com>

.github/actions/build-electron/action.yml

@@ -70,11 +70,7 @@ runs:
 
         # Upload build stats to Datadog
         if ! [ -z $DD_API_KEY ]; then
-          if [ "$TARGET_PLATFORM" = "win" ]; then
-            npx node electron/script/build-stats.mjs out/Default/siso.exe.INFO --upload-stats || true
-          else
-            npx node electron/script/build-stats.mjs out/Default/siso.INFO --upload-stats || true
-          fi
+          npx node electron/script/build-stats.mjs out/Default/siso.INFO --upload-stats || true
         else
           echo "Skipping build-stats.mjs upload because DD_API_KEY is not set"
         fi
@@ -188,7 +184,7 @@ runs:
       shell: bash
       run: |
         cd src/electron
-        node script/yarn create-typescript-definitions
+        node script/yarn.js create-typescript-definitions
     - name: Publish Electron Dist ${{ inputs.step-suffix }}
       if: ${{ inputs.is-release == 'true' }}
       shell: bash

.github/actions/checkout/action.yml

@@ -152,7 +152,7 @@ runs:
     if: ${{ inputs.target-platform == 'linux' && github.ref == 'refs/heads/main' }}
     shell: bash
     run: |
-      npx node src/electron/script/patches-stats.mjs --upload-stats || true
+      node src/electron/script/patches-stats.mjs --upload-stats || true
   # delete all .git directories under src/ except for
   # third_party/angle/ and third_party/dawn/ because of build time generation of files
   # gen/angle/commit.h depends on third_party/angle/.git/HEAD

.github/actions/free-space-macos/action.yml

@@ -64,15 +64,24 @@ runs:
         sudo rm -rf /Applications/Xcode_16.1.app
         sudo rm -rf /Applications/Xcode_16.2.app
         sudo rm -rf /Applications/Xcode_16.3.app
+        sudo rm -rf /Applications/Xcode_26*
         sudo rm -rf /Applications/Google Chrome.app
         sudo rm -rf /Applications/Google Chrome for Testing.app
-        sudo rm -rf	/Applications/Firefox.app
+        sudo rm -rf /Applications/Firefox.app
+        sudo rm -rf /Applications/Microsoft Edge.app
         sudo rm -rf ~/project/src/third_party/catapult/tracing/test_data
         sudo rm -rf ~/project/src/third_party/angle/third_party/VK-GL-CTS
         sudo rm -rf /Users/runner/Library/Android
         sudo rm -rf $JAVA_HOME_11_arm64
         sudo rm -rf $JAVA_HOME_17_arm64
         sudo rm -rf $JAVA_HOME_21_arm64
+        sudo rm -rf $JAVA_HOME_25_arm64
+        sudo rm -rf /Users/runner/.dotnet/
+        sudo rm -rf /Users/runner/.rustup
+
+        # remove homebrew packages we don't need
+        brew uninstall -f --zap aws-sam-cli session-manager-plugin gcc gcc@13 gcc@14 llvm@18 gradle maven ant azure-cli
+        brew autoremove
 
         # lipo off some huge binaries arm64 versions to save space
         strip_universal_deep $(xcode-select -p)/../SharedFrameworks

.github/actions/generate-types/action.yml

@@ -13,12 +13,16 @@ runs:
   - name: Generating Types for SHA in ${{ inputs.sha-file }}
     shell: bash
     run: |
-      git checkout $(cat ${{ inputs.sha-file }})
-      rm -rf node_modules
-      yarn install --frozen-lockfile --ignore-scripts
+      export ELECTRON_DIR=$(pwd)
+      if [ "${{ inputs.sha-file }}" == ".dig-old" ]; then
+        cd /tmp
+        git clone https://github.com/electron/electron.git
+        cd electron
+      fi
+      git checkout $(cat $ELECTRON_DIR/${{ inputs.sha-file }})
+      node script/yarn.js install --immutable
       echo "#!/usr/bin/env node\nglobal.x=1" > node_modules/typescript/bin/tsc
       node node_modules/.bin/electron-docs-parser --dir=./ --outDir=./ --moduleVersion=0.0.0-development
       node node_modules/.bin/electron-typescript-definitions --api=electron-api.json --outDir=artifacts
-      mv artifacts/electron.d.ts artifacts/${{ inputs.filename }}
-      git checkout .
+      mv artifacts/electron.d.ts $ELECTRON_DIR/artifacts/${{ inputs.filename }}
     working-directory: ./electron

.github/actions/install-dependencies/action.yml

@@ -6,7 +6,7 @@ runs:
   - name: Get yarn cache directory path
     shell: bash
     id: yarn-cache-dir-path
-    run: echo "dir=$(node src/electron/script/yarn cache dir)" >> $GITHUB_OUTPUT
+    run: echo "dir=$(node src/electron/script/yarn.js config get cacheFolder)" >> $GITHUB_OUTPUT
   - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
     id: yarn-cache
     with:
@@ -18,4 +18,14 @@ runs:
     shell: bash
     run: |
       cd src/electron
-      node script/yarn install --frozen-lockfile --prefer-offline
+      if [ "$TARGET_ARCH" = "x86" ]; then
+        export npm_config_arch="ia32"
+      fi
+      # if running on linux arm skip yarn Builds
+      ARCH=$(uname -m)
+      if [ "$ARCH" = "armv7l" ]; then
+        echo "Skipping yarn build on linux arm"
+        node script/yarn.js install --immutable --mode=skip-build
+      else
+        node script/yarn.js install --immutable
+      fi

.github/workflows/archaeologist-dig.yml

@@ -3,17 +3,21 @@ name: Archaeologist
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
    archaeologist-dig:
     name: Archaeologist Dig
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Electron
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.0.2
         with:
           fetch-depth: 0
       - name: Setup Node.js/npm
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: 20.19.x
       - name: Setting Up Dig Site
@@ -41,7 +45,7 @@ jobs:
           sha-file: .dig-old
           filename: electron.old.d.ts
       - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 #v5.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
         with:
           name: artifacts
           path: electron/artifacts

.github/workflows/audit-branch-ci.yml

@@ -16,11 +16,11 @@ jobs:
       contents: read
     steps:
       - name: Setup Node.js
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22.17.x
       - run: npm install @actions/cache@4.0.3 @electron/fiddle-core@2.0.1
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         id: audit-errors
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -73,7 +73,6 @@ jobs:
                       annotation_level === "failure" &&
                       !message.startsWith("Process completed with exit code") &&
                       !message.startsWith("Response status code does not indicate success") &&
-                      !message.startsWith("The hosted runner lost communication with the server") &&
                       !/Unable to make request/.test(message) &&
                       !/The requested URL returned error/.test(message),
                   )

.github/workflows/branch-created.yml

@@ -75,7 +75,7 @@ jobs:
           org: electron
       - name: Generate Release Project Board Metadata
         if: ${{ steps.check-major-version.outputs.MAJOR }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         id: generate-project-metadata
         with:
           script: |

.github/workflows/build-git-cache.yml

@@ -6,9 +6,13 @@ on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions: {}
+
 jobs:
   build-git-cache-linux:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root
@@ -19,7 +23,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -30,6 +34,8 @@ jobs:
 
   build-git-cache-windows:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -41,7 +47,7 @@ jobs:
       TARGET_OS: 'win'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -52,6 +58,8 @@ jobs:
 
   build-git-cache-macos:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     # This job updates the same git cache as linux, so it needs to run after the linux one.
     needs: build-git-cache-linux
     container:
@@ -64,7 +72,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/build.yml

@@ -43,10 +43,13 @@ defaults:
   run:
     shell: bash
 
+permissions: {}
+
 jobs:
   setup:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: read
     outputs:
         docs: ${{ steps.filter.outputs.docs }}
@@ -54,7 +57,7 @@ jobs:
         build-image-sha: ${{ steps.set-output.outputs.build-image-sha }}
         docs-only: ${{ steps.set-output.outputs.docs-only }}
     steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.0.2
       with:
         ref: ${{ github.event.pull_request.head.sha }}
     - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -63,6 +66,10 @@ jobs:
         filters: |
           docs:
             - 'docs/**'
+            - README.md
+            - SECURITY.md
+            - CONTRIBUTING.md
+            - CODE_OF_CONDUCT.md
           src:
             - '!docs/**'
     - name: Set Outputs for Build Image SHA & Docs Only
@@ -80,6 +87,8 @@ jobs:
     needs: setup
     if: ${{ !inputs.skip-lint }}
     uses: ./.github/workflows/pipeline-electron-lint.yml
+    permissions:
+      contents: read
     with:
       container: '{"image":"ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}","options":"--user root"}'
     secrets: inherit
@@ -89,6 +98,8 @@ jobs:
     needs: [setup, checkout-linux]
     if: ${{ needs.setup.outputs.docs-only == 'true' }}
     uses: ./.github/workflows/pipeline-electron-docs-only.yml
+    permissions:
+      contents: read
     with:
       container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
     secrets: inherit
@@ -98,6 +109,8 @@ jobs:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-macos}}
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -111,7 +124,7 @@ jobs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -126,6 +139,8 @@ jobs:
     needs: setup
     if: ${{ !inputs.skip-linux}}
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -141,7 +156,7 @@ jobs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha}}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -155,6 +170,8 @@ jobs:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -171,7 +188,7 @@ jobs:
       build-image-sha: ${{ needs.setup.outputs.build-image-sha}}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -185,6 +202,8 @@ jobs:
   # GN Check Jobs
   macos-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       target-platform: macos
@@ -195,6 +214,8 @@ jobs:
 
   linux-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     if: ${{ needs.setup.outputs.src == 'true' }}
     with:
@@ -207,6 +228,8 @@ jobs:
 
   windows-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       target-platform: win
@@ -310,7 +333,7 @@ jobs:
       build-runs-on: electron-arc-centralus-linux-amd64-32core
       test-runs-on: electron-arc-centralus-linux-arm64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
-      test-container: '{"image":"ghcr.io/electron/test:arm32v7-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init","volumes":["/home/runner/externals:/mnt/runner-externals"]}'
+      test-container: '{"image":"ghcr.io/electron/test:arm32v7-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init --memory=12g","volumes":["/home/runner/externals:/mnt/runner-externals"]}'
       target-platform: linux
       target-arch: arm
       is-release: false
@@ -400,6 +423,8 @@ jobs:
   gha-done:
     name: GitHub Actions Completed
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     needs: [docs-only, macos-x64, macos-arm64, linux-x64, linux-x64-asan, linux-arm, linux-arm64, windows-x64, windows-x86, windows-arm64]
     if: always() && !contains(needs.*.result, 'failure')
     steps: 

.github/workflows/clean-src-cache.yml

@@ -1,16 +1,20 @@
 name: Clean Source Cache
 
-description: |
-  This workflow cleans up the source cache on the cross-instance cache volume
-  to free up space. It runs daily at midnight and clears files older than 15 days.
+# Description:
+# This workflow cleans up the source cache on the cross-instance cache volume
+# to free up space. It runs daily at midnight and clears files older than 15 days.
 
 on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions: {}
+
 jobs:
   clean-src-cache:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root

.github/workflows/issue-labeled.yml

@@ -4,14 +4,15 @@ on:
   issues:
     types: [labeled]
 
-permissions:  # added using https://github.com/step-security/secure-workflows
-  contents: read
+permissions: {}
 
 jobs:
   issue-labeled-with-status:
     name: status/{confirmed,reviewed} label added
     if: github.event.label.name == 'status/confirmed' || github.event.label.name == 'status/reviewed'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -31,6 +32,8 @@ jobs:
     name: blocked/* label added
     if: startsWith(github.event.label.name, 'blocked/')
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/issue-opened.yml

@@ -11,6 +11,7 @@ jobs:
   add-to-issue-triage:
     if: ${{ contains(github.event.issue.labels.*.name, 'bug :beetle:') }}
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -28,6 +29,7 @@ jobs:
   set-labels:
     if: ${{ contains(github.event.issue.labels.*.name, 'bug :beetle:') }}
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -37,7 +39,7 @@ jobs:
           org: electron
       - run: npm install @electron/fiddle-core@1.3.3 mdast-util-from-markdown@2.0.0 unist-util-select@5.1.0 semver@7.6.0
       - name: Add labels
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         id: add-labels
         env:
           ISSUE_BODY: ${{ github.event.issue.body }}

.github/workflows/issue-transferred.yml

@@ -10,6 +10,7 @@ jobs:
   issue-transferred:
     name: Issue Transferred
     runs-on: ubuntu-latest
+    permissions: {}
     if: ${{ !github.event.changes.new_repository.private }}
     steps:
       - name: Generate GitHub App token

.github/workflows/issue-unlabeled.yml

@@ -4,14 +4,15 @@ on:
   issues:
     types: [unlabeled]
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   issue-unlabeled-blocked:
     name: All blocked/* labels removed
     if: startsWith(github.event.label.name, 'blocked/') && github.event.issue.state == 'open'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check for any blocked labels
         id: check-for-blocked-labels

.github/workflows/linux-publish.yml

@@ -17,9 +17,13 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   checkout-linux:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root
@@ -31,7 +35,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -40,6 +44,8 @@ jobs:
 
   publish-x64:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     with:
       environment: production-release
@@ -55,6 +61,8 @@ jobs:
 
   publish-arm:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     with:
       environment: production-release
@@ -70,6 +78,8 @@ jobs:
 
   publish-arm64:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     with:
       environment: production-release

.github/workflows/macos-publish.yml

@@ -18,9 +18,13 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   checkout-macos:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root
@@ -32,7 +36,7 @@ jobs:
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -44,6 +48,8 @@ jobs:
 
   publish-x64-darwin:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -59,6 +65,8 @@ jobs:
 
   publish-x64-mas:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -74,6 +82,8 @@ jobs:
 
   publish-arm64-darwin:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -89,6 +99,8 @@ jobs:
 
   publish-arm64-mas:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release

.github/workflows/non-maintainer-dependency-change.yml

@@ -7,6 +7,8 @@ on:
       - 'spec/yarn.lock'
       - '.github/workflows/**'
       - '.github/actions/**'
+      - '.yarn/**'
+      - '.yarnrc.yml'
 
 permissions: {}
 

.github/workflows/pipeline-electron-build-and-test-and-nan.yml

@@ -55,6 +55,8 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 concurrency:
   group: electron-build-and-test-and-nan-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -62,6 +64,8 @@ concurrency:
 jobs:
   build:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     with:
       build-runs-on: ${{ inputs.build-runs-on }}
       build-container: ${{ inputs.build-container }}
@@ -74,6 +78,10 @@ jobs:
     secrets: inherit
   test:
     uses: ./.github/workflows/pipeline-segment-electron-test.yml
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}
@@ -83,6 +91,8 @@ jobs:
     secrets: inherit
   nn-test:
     uses: ./.github/workflows/pipeline-segment-node-nan-test.yml
+    permissions:
+      contents: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}

.github/workflows/pipeline-electron-build-and-test.yml

@@ -64,14 +64,13 @@ concurrency:
   group: electron-build-and-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
 
-permissions:
-  contents: read
-  issues: read
-  pull-requests: read  
+permissions: {}
 
 jobs:
   build:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     with:
       build-runs-on: ${{ inputs.build-runs-on }}
       build-container: ${{ inputs.build-container }}
@@ -86,6 +85,10 @@ jobs:
     secrets: inherit
   test:
     uses: ./.github/workflows/pipeline-segment-electron-test.yml
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}

.github/workflows/pipeline-electron-docs-only.yml

@@ -8,6 +8,8 @@ on:
         description: 'Container to run the docs-only ts compile in'
         type: string
 
+permissions: {}
+
 concurrency:
   group: electron-docs-only-${{ github.ref }}
   cancel-in-progress: true
@@ -19,11 +21,13 @@ jobs:
   docs-only:
     name: Docs Only Compile
     runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -39,7 +43,7 @@ jobs:
       with:
         target-platform: linux
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -50,12 +54,12 @@ jobs:
       shell: bash
       run: |
         cd src/electron
-        node script/yarn create-typescript-definitions
-        node script/yarn tsc -p tsconfig.default_app.json --noEmit
+        node script/yarn.js create-typescript-definitions
+        node script/yarn.js tsc -p tsconfig.default_app.json --noEmit
         for f in build/webpack/*.js
         do
             out="${f:29}"
             if [ "$out" != "base.js" ]; then
-            node script/yarn webpack --config $f --output-filename=$out --output-path=./.tmp --env mode=development
+            node script/yarn.js webpack --config $f --output-filename=$out --output-path=./.tmp --env mode=development
             fi
         done

.github/workflows/pipeline-electron-lint.yml

@@ -8,6 +8,8 @@ on:
         description: 'Container to run lint in'
         type: string
 
+permissions: {}
+
 concurrency:
   group: electron-lint-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -19,11 +21,13 @@ jobs:
   lint:
     name: Lint
     runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -74,11 +78,11 @@ jobs:
         # but then we would lint its contents (at least gn format), and it doesn't pass it.
 
         cd src/electron
-        node script/yarn install --frozen-lockfile
-        node script/yarn lint
+        node script/yarn.js install --immutable
+        node script/yarn.js lint
     - name: Run Script Typechecker
       shell: bash
       run: |
         cd src/electron
-        node script/yarn tsc -p tsconfig.script.json
+        node script/yarn.js tsc -p tsconfig.script.json
     

.github/workflows/pipeline-segment-electron-build.yml

@@ -59,6 +59,8 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 concurrency:
   group: electron-build-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.target-variant }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -81,6 +83,8 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.build-runs-on }}
+    permissions:
+      contents: read
     container: ${{ fromJSON(inputs.build-container) }}
     environment: ${{ inputs.environment }}
     env:
@@ -91,7 +95,7 @@ jobs:
       run: |
         mkdir src
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -115,7 +119,7 @@ jobs:
       run: df -h
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'macos' }}
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
       with:
         node-version: 20.19.x
         cache: yarn
@@ -159,7 +163,7 @@ jobs:
       if: ${{ inputs.target-platform == 'linux' }}
       uses: ./src/electron/.github/actions/restore-cache-aks
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-segment-electron-gn-check.yml

@@ -26,6 +26,8 @@ on:
         type: string
         default: testing
 
+permissions: {}
+
 concurrency:
   group: electron-gn-check-${{ inputs.target-platform }}-${{ github.ref }}
   cancel-in-progress: true
@@ -41,10 +43,12 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.check-runs-on }}
+    permissions:
+      contents: read
     container: ${{ fromJSON(inputs.check-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -111,7 +115,7 @@ jobs:
     - name: Add CHROMIUM_BUILDTOOLS_PATH to env
       run: echo "CHROMIUM_BUILDTOOLS_PATH=$(pwd)/src/buildtools" >> $GITHUB_ENV
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0

.github/workflows/pipeline-segment-electron-test.yml

@@ -35,10 +35,7 @@ concurrency:
   group: electron-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
 
-permissions:
-  contents: read
-  issues: read
-  pull-requests: read
+permissions: {}
 
 env:
   CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
@@ -53,6 +50,10 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.test-runs-on }}
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     container: ${{ fromJSON(inputs.test-container) }}
     strategy:
       fail-fast: false
@@ -68,10 +69,9 @@ jobs:
       if: ${{ inputs.target-arch == 'arm' && inputs.target-platform == 'linux' }}
       run: |
         cp $(which node) /mnt/runner-externals/node20/bin/
-        cp $(which node) /mnt/runner-externals/node24/bin/
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'win' }}
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
       with:
         node-version: 20.19.x
     - name: Add TCC permissions on macOS
@@ -118,7 +118,7 @@ jobs:
       if: ${{ inputs.target-platform == 'macos' }}
       run: sudo xcode-select --switch /Applications/Xcode_16.4.app
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -167,12 +167,12 @@ jobs:
         echo "DISABLE_CRASH_REPORTER_TESTS=true" >> $GITHUB_ENV
         echo "IS_ASAN=true" >> $GITHUB_ENV
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
       with:
         name: generated_artifacts_${{ env.ARTIFACT_KEY }}
         path: ./generated_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
       with:
         name: src_artifacts_${{ env.ARTIFACT_KEY }}
         path: ./src_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
@@ -196,10 +196,7 @@ jobs:
     #    sudo security authorizationdb write com.apple.trust-settings.admin allow
     #    cd src/electron
     #    ./script/codesign/generate-identity.sh
-    - name: Install Datadog CLI
-      run: |
-        cd src/electron
-        node script/yarn global add @datadog/datadog-ci
+
     - name: Run Electron Tests
       shell: bash
       env:
@@ -225,7 +222,7 @@ jobs:
               export ELECTRON_FORCE_TEST_SUITE_EXIT="true"
             fi
           fi
-          node script/yarn test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
+          node script/yarn.js test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
         else
           chown :builduser .. && chmod g+w ..
           chown -R :builduser . && chmod -R g+w .
@@ -242,9 +239,14 @@ jobs:
             export MOCHA_TIMEOUT=180000
             echo "Piping output to ASAN_SYMBOLIZE ($ASAN_SYMBOLIZE)"
             cd electron
-            runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn test --runners=main --trace-uncaught --enable-logging --files $tests_files | $ASAN_SYMBOLIZE
+            runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --runners=main --trace-uncaught --enable-logging --files $tests_files | $ASAN_SYMBOLIZE
           else
-            runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn test --runners=main --trace-uncaught --enable-logging --files $tests_files
+            if [ "${{ inputs.target-arch }}" = "arm" ]; then
+              runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --skipYarnInstall --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
+            else 
+              runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
+            fi
+            
           fi
         fi
     - name: Upload Test results to Datadog
@@ -256,13 +258,14 @@ jobs:
         DD_TAGS: "os.architecture:${{ inputs.target-arch }},os.family:${{ inputs.target-platform }},os.platform:${{ inputs.target-platform }},asan:${{ inputs.is-asan }}"
       run: |
         if ! [ -z $DD_API_KEY ] && [ -f src/electron/junit/test-results-main.xml ]; then
-          export DATADOG_PATH=`node src/electron/script/yarn global bin`
-          $DATADOG_PATH/datadog-ci junit upload src/electron/junit/test-results-main.xml
-        fi          
+          cd src/electron
+          export DATADOG_PATH=`node script/yarn.js bin datadog-ci`
+          $DATADOG_PATH junit upload junit/test-results-main.xml
+        fi
       if: always() && !cancelled()
     - name: Upload Test Artifacts
       if: always() && !cancelled()
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
       with:
         name: test_artifacts_${{ env.ARTIFACT_KEY }}_${{ matrix.shard }}
         path: src/electron/spec/artifacts

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -26,6 +26,8 @@ on:
         type: string
         default: testing
 
+permissions: {}
+
 concurrency:
   group: electron-node-nan-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -39,6 +41,8 @@ jobs:
   node-tests:
     name: Run Node.js Tests
     runs-on: electron-arc-centralus-linux-amd64-8core
+    permissions:
+      contents: read
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}
@@ -46,7 +50,7 @@ jobs:
     container: ${{ fromJSON(inputs.test-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -61,12 +65,12 @@ jobs:
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
       with:
         name: generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
         path: ./generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
       with:
         name: src_artifacts_linux_${{ env.TARGET_ARCH }}
         path: ./src_artifacts_linux_${{ env.TARGET_ARCH }}
@@ -93,6 +97,8 @@ jobs:
   nan-tests:
     name: Run Nan Tests
     runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}
@@ -100,7 +106,7 @@ jobs:
     container: ${{ fromJSON(inputs.test-container) }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -115,12 +121,12 @@ jobs:
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
     - name: Download Generated Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
       with:
         name: generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
         path: ./generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
     - name: Download Src Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
       with:
         name: src_artifacts_linux_${{ env.TARGET_ARCH }}
         path: ./src_artifacts_linux_${{ env.TARGET_ARCH }}
@@ -132,10 +138,16 @@ jobs:
         unzip -:o dist.zip
     - name: Setup Linux for Headless Testing
       run: sh -e /etc/init.d/xvfb start
+    - name: Add Clang problem matcher
+      shell: bash
+      run: echo "::add-matcher::src/electron/.github/problem-matchers/clang.json"
     - name: Run Nan Tests
       run: |
         cd src
         node electron/script/nan-spec-runner.js
+    - name: Remove Clang problem matcher
+      shell: bash
+      run: echo "::remove-matcher owner=clang::"
     - name: Wait for active SSH sessions
       shell: bash
       if: always() && !cancelled()

.github/workflows/pull-request-labeled.yml

@@ -11,6 +11,7 @@ jobs:
     name: backport/requested label added
     if: github.event.label.name == 'backport/requested 🗳'
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Trigger Slack workflow
         uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
@@ -28,6 +29,7 @@ jobs:
     name: deprecation-review/complete label added
     if: github.event.label.name == 'deprecation-review/complete ✅'
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/scorecards.yml

@@ -22,13 +22,13 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
       # This is a pre-submit / pre-release.
       - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif
@@ -42,7 +42,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5
+        uses: github/codeql-action/upload-sarif@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.5
         with:
           sarif_file: results.sarif

.github/workflows/semantic.yml

@@ -7,8 +7,7 @@ on:
       - edited
       - synchronize
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   main:

.github/workflows/stable-prep-items.yml

@@ -11,6 +11,7 @@ jobs:
   check-stable-prep-items:
     name: Check Stable Prep Items
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/stale.yml

@@ -10,13 +10,14 @@ permissions: {}
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
         id: generate-token
         with:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
-      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # tag: v10.1.0
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # tag: v9.1.0
         with:
           repo-token: ${{ steps.generate-token.outputs.token }}
           days-before-stale: 90
@@ -27,10 +28,11 @@ jobs:
             This issue has been automatically marked as stale. **If this issue is still affecting you, please leave any comment** (for example, "bump"), and we'll keep it open. If you have any new additional information—in particular, if this is still reproducible in the [latest version of Electron](https://www.electronjs.org/releases/stable) or in the [beta](https://www.electronjs.org/releases/beta)—please include it with your comment!
           close-issue-message: >
             This issue has been closed due to inactivity, and will not be monitored.  If this is a bug and you can reproduce this issue on a [supported version of Electron](https://www.electronjs.org/docs/latest/tutorial/electron-timelines#timeline) please open a new issue and include instructions for reproducing the issue.
-          exempt-issue-labels: "discussion,security \U0001F512,enhancement :sparkles:,status/confirmed,stale-exempt,upgrade-follow-up,tracking-upstream"
+          exempt-issue-labels: "discussion,security \U0001F512,enhancement :sparkles:,status/confirmed,stale-exempt,upgrade-follow-up"
           only-pr-labels: not-a-real-label
   pending-repro:
     runs-on: ubuntu-latest
+    permissions: {}
     if: ${{ always() }}
     needs: stale
     steps:
@@ -39,7 +41,7 @@ jobs:
         id: generate-token
         with:
           creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
-      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # tag: v10.1.0
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # tag: v9.1.0
         with:
           repo-token: ${{ steps.generate-token.outputs.token }}
           days-before-stale: -1

.github/workflows/windows-publish.yml

@@ -18,9 +18,13 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   checkout-windows:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -36,7 +40,7 @@ jobs:
       build-image-sha: ${{ inputs.build-image-sha }}
     steps:
     - name: Checkout Electron
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:
         path: src/electron
         fetch-depth: 0
@@ -48,6 +52,8 @@ jobs:
 
   publish-x64-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       environment: production-release
@@ -62,6 +68,8 @@ jobs:
 
   publish-arm64-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       environment: production-release
@@ -76,6 +84,8 @@ jobs:
 
   publish-x86-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       environment: production-release

.gitignore

@@ -53,3 +53,5 @@ ts-gen
 patches/mtime-cache.json
 
 spec/fixtures/logo.png
+
+.yarn/install-state.gz

.yarnrc.yml

@@ -0,0 +1,12 @@
+enableScripts: false
+
+nmHoistingLimits: workspaces
+
+nodeLinker: node-modules
+
+npmMinimalAgeGate: 10080
+
+npmPreapprovedPackages:
+  - "@electron/*"
+
+yarnPath: .yarn/releases/yarn-4.12.0.cjs

BUILD.gn

@@ -592,7 +592,6 @@ source_set("electron_lib") {
     use_libcxx_modules = false
 
     deps += [
-      "//components/os_crypt/common:keychain_password_mac",
       "//components/remote_cocoa/app_shim",
       "//components/remote_cocoa/browser",
       "//content/browser:mac_helpers",

DEPS

@@ -2,11 +2,11 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '144.0.7506.0',
+    '142.0.7444.235',
   'node_version':
-    'v24.10.0',
+    'v22.21.1',
   'nan_version':
-    '675cefebca42410733da8a454c8d9391fcebfbc2',
+    'e14bdcd1f72d62bca1d541b66da43130384ec213',
   'squirrel.mac_version':
     '0e5d146ba13101a1302d59ea6e6e0b3cace4ae38',
   'reactiveobjc_version':
@@ -14,7 +14,7 @@ vars = {
   'mantle_version':
     '78d3966b3c331292ea29ec38661b25df0a245948',
   'engflow_reclient_configs_version':
-    'd3a4d5e20f46c7cc771cf59cf6bd8e6f3c763ee1',
+    '955335c30a752e9ef7bff375baab5e0819b6c00d',
 
   'pyyaml_version': '3.12',
 
@@ -30,9 +30,6 @@ vars = {
   # The path of the sysroots.json file.
   'sysroots_json_path': 'electron/script/sysroots.json',
 
-  # KEEP IN SYNC WITH utils.js FILE
-  'yarn_version': '1.22.22',
-
   # To be able to build clean Chromium from sources.
   'apply_patches': True,
 
@@ -155,7 +152,7 @@ hooks = [
     'action': [
       'python3',
       '-c',
-      'import os, subprocess; os.chdir(os.path.join("src", "electron")); subprocess.check_call(["python3", "script/lib/npx.py", "yarn@' + (Var("yarn_version")) + '", "install", "--frozen-lockfile"]);',
+      'import os, subprocess; os.chdir(os.path.join("src", "electron")); subprocess.check_call(["node", ".yarn/releases/yarn-4.12.0.cjs", "install", "--immutable"]);',
     ],
   },
   {

README.md

@@ -37,7 +37,7 @@ For more installation options and troubleshooting tips, see
 
 Each Electron release provides binaries for macOS, Windows, and Linux.
 
-* macOS (Big Sur and up): Electron provides 64-bit Intel and Apple Silicon / ARM binaries for macOS.
+* macOS (Monterey and up): Electron provides 64-bit Intel and Apple Silicon / ARM binaries for macOS.
 * Windows (Windows 10 and up): Electron provides `ia32` (`x86`), `x64` (`amd64`), and `arm64` binaries for Windows. Windows on ARM support was added in Electron 5.0.8. Support for Windows 7, 8 and 8.1 was [removed in Electron 23, in line with Chromium's Windows deprecation policy](https://www.electronjs.org/blog/windows-7-to-8-1-deprecation-notice).
 * Linux: The prebuilt binaries of Electron are built on Ubuntu 22.04. They have also been verified to work on:
   * Ubuntu 18.04 and newer

SECURITY.md

@@ -8,12 +8,6 @@ The Electron team will send a response indicating the next steps in handling you
 
 Report security bugs in third-party modules to the person or team maintaining the module. You can also report a vulnerability through the [npm contact form](https://www.npmjs.com/support) by selecting "I'm reporting a security vulnerability".
 
-## Escalation
-
-If you do not receive an acknowledgement of your report within 6 business days, or if you cannot find a private security contact for the project, you may escalate to the OpenJS Foundation CNA at `security@lists.openjsf.org`.
-
-If the project acknowledges your report but does not provide any further response or engagement within 14 days, escalation is also appropriate.
-
 ## The Electron Security Notification Process
 
 For context on Electron's security notification process, please see the [Notifications](https://github.com/electron/governance/blob/main/wg-security/membership-and-notifications.md#notifications) section of the Security WG's [Membership and Notifications](https://github.com/electron/governance/blob/main/wg-security/membership-and-notifications.md) Governance document.

build/args/all.gn

@@ -2,7 +2,7 @@ is_electron_build = true
 root_extra_deps = [ "//electron" ]
 
 # Registry of NMVs --> https://github.com/nodejs/node/blob/main/doc/abi_version_registry.json
-node_module_version = 143
+node_module_version = 140
 
 v8_promise_internal_field_count = 1
 v8_embedder_string = "-electron.0"

docs/api/app.md

@@ -1218,7 +1218,7 @@ This method can only be called before app is ready.
 
 ### `app.isHardwareAccelerationEnabled()`
 
-Returns `boolean` - whether hardware acceleration is currently disabled.
+Returns `boolean` - whether hardware acceleration is currently enabled.
 
  > [!NOTE]
  > This information is only usable after the `gpu-info-update` event is emitted.

docs/api/browser-window.md

@@ -1252,7 +1252,8 @@ Captures a snapshot of the page within `rect`. Omitting `rect` will capture the
 
 Returns `Promise<void>` - the promise will resolve when the page has finished loading
 (see [`did-finish-load`](web-contents.md#event-did-finish-load)), and rejects
-if the page fails to load (see [`did-fail-load`](web-contents.md#event-did-fail-load)).
+if the page fails to load (see
+[`did-fail-load`](web-contents.md#event-did-fail-load)). A noop rejection handler is already attached, which avoids unhandled rejection errors. If the existing page has a beforeUnload handler, [`did-fail-load`](web-contents.md#event-did-fail-load) will be called unless [`will-prevent-unload`](web-contents.md#event-did-fail-load) is handled.
 
 Same as [`webContents.loadURL(url[, options])`](web-contents.md#contentsloadurlurl-options).
 

docs/api/client-request.md

@@ -25,6 +25,11 @@ following properties:
     with which the request is associated. Defaults to the empty string. The
     `session` option supersedes `partition`. Thus if a `session` is explicitly
     specified, `partition` is ignored.
+  * `bypassCustomProtocolHandlers` boolean (optional) - When set to `true`,
+    custom protocol handlers registered for the request's URL scheme will not be
+    called. This allows forwarding an intercepted request to the built-in
+    handler. [webRequest](web-request.md) handlers will still be triggered
+    when bypassing custom protocols. Defaults to `false`.
   * `credentials` string (optional) - Can be `include`, `omit` or
     `same-origin`. Whether to send
     [credentials](https://fetch.spec.whatwg.org/#credentials) with this

docs/api/command-line-switches.md

@@ -193,11 +193,6 @@ Disables the Chromium [sandbox](https://www.chromium.org/developers/design-docum
 Forces renderer process and Chromium helper processes to run un-sandboxed.
 Should only be used for testing.
 
-### --no-stdio-init
-
-Disable stdio initialization during node initialization.
-Used to avoid node initialization crash when the nul device is disabled on Windows platform.
-
 ### --proxy-bypass-list=`hosts`
 
 Instructs Electron to bypass the proxy server for the given semi-colon-separated

docs/api/menu-item.md

@@ -34,7 +34,8 @@ See [`Menu`](menu.md) for examples.
   * `sublabel` string (optional) _macOS_ - Available in macOS >= 14.4
   * `toolTip` string (optional) _macOS_ - Hover text for this menu item.
   * `accelerator` string (optional) - An [Accelerator](../tutorial/keyboard-shortcuts.md#accelerators) string.
-  * `icon` ([NativeImage](native-image.md) | string) (optional)
+  * `icon` ([NativeImage](native-image.md) | string) (optional) - Can be a
+    [NativeImage](native-image.md) or the file path of an icon.
   * `enabled` boolean (optional) - If false, the menu item will be greyed out and
     unclickable.
   * `acceleratorWorksWhenHidden` boolean (optional) _macOS_ - default is `true`, and when `false` will prevent the accelerator from triggering the item if the item is not visible.

docs/api/native-image.md

@@ -230,6 +230,15 @@ echo -e '#import <Cocoa/Cocoa.h>\nint main() { NSLog(@"%@", SYSTEM_IMAGE_NAME);
 
 where `SYSTEM_IMAGE_NAME` should be replaced with any value from [this list](https://developer.apple.com/documentation/appkit/nsimagename?language=objc).
 
+For SF Symbols, usage looks as follows:
+
+```js
+const image = nativeImage.createFromNamedImage('square.and.pencil')
+```
+
+where `'square.and.pencil'` is the symbol name from the
+[SF Symbols app](https://developer.apple.com/sf-symbols/).
+
 ## Class: NativeImage
 
 > Natively wrap images such as tray, dock, and application icons.

docs/api/session.md

@@ -66,7 +66,7 @@ The `session` module has the following properties:
 
 ### `session.defaultSession`
 
-A `Session` object, the default session object of the app, available after `app.whenReady` is called.
+A `Session` object, the default session object of the app.
 
 ## Class: Session
 

docs/api/structures/base-window-options.md

@@ -72,6 +72,9 @@
   some GTK+3 desktop environments. Default is `false`.
 * `transparent` boolean (optional) - Makes the window [transparent](../../tutorial/custom-window-styles.md#transparent-windows).
   Default is `false`. On Windows, does not work unless the window is frameless.
+  When you add a [`View`](../view.md) to a `BaseWindow`, you'll need to call
+  [`view.setBackgroundColor`](../view.md#viewsetbackgroundcolorcolor) with a transparent
+  background color on that view to make its background transparent as well.
 * `type` string (optional) - The type of window, default is normal window. See more about
   this below.
 * `visualEffectState` string (optional) _macOS_ - Specify how the material

docs/api/web-contents.md

@@ -1079,7 +1079,7 @@ Emitted when the [mainFrame](web-contents.md#contentsmainframe-readonly), an `<i
 Returns `Promise<void>` - the promise will resolve when the page has finished loading
 (see [`did-finish-load`](web-contents.md#event-did-finish-load)), and rejects
 if the page fails to load (see
-[`did-fail-load`](web-contents.md#event-did-fail-load)). A noop rejection handler is already attached, which avoids unhandled rejection errors.
+[`did-fail-load`](web-contents.md#event-did-fail-load)). A noop rejection handler is already attached, which avoids unhandled rejection errors. If the existing page has a beforeUnload handler, [`did-fail-load`](web-contents.md#event-did-fail-load) will be called unless [`will-prevent-unload`](web-contents.md#event-did-fail-load) is handled.
 
 Loads the `url` in the window. The `url` must contain the protocol prefix,
 e.g. the `http://` or `file://`. If the load should bypass http cache then

docs/development/build-instructions-linux.md

@@ -6,77 +6,17 @@ Follow the guidelines below for building **Electron itself** on Linux, for the p
 
 ## Prerequisites
 
-* At least 25GB disk space and 8GB RAM.
-* Python >= 3.9.
-* [Node.js](https://nodejs.org/download/) >= 22.12.0
-* [clang](https://clang.llvm.org/get_started.html) 3.4 or later.
-* Development headers of GTK 3 and libnotify.
+Due to Electron's dependency on Chromium, prerequisites and dependencies for Electron change over time. [Chromium's documentation on building on Linux](https://chromium.googlesource.com/chromium/src/+/HEAD/docs/linux/build_instructions.md) has up to date information for building Chromium on Linux. This documentation can generally
+be followed for building Electron on Linux as well.
 
-On Ubuntu >= 20.04, install the following libraries:
-
-```sh
-$ sudo apt-get install build-essential clang libdbus-1-dev libgtk-3-dev \
-                       libnotify-dev libasound2-dev libcap-dev \
-                       libcups2-dev libxtst-dev \
-                       libxss1 libnss3-dev gcc-multilib g++-multilib curl \
-                       gperf bison python3-dbusmock openjdk-8-jre
-```
-
-On Ubuntu < 20.04, install the following libraries:
-
-```sh
-$ sudo apt-get install build-essential clang libdbus-1-dev libgtk-3-dev \
-                       libnotify-dev libgnome-keyring-dev \
-                       libasound2-dev libcap-dev libcups2-dev libxtst-dev \
-                       libxss1 libnss3-dev gcc-multilib g++-multilib curl \
-                       gperf bison python-dbusmock openjdk-8-jre
-```
-
-On RHEL / CentOS, install the following libraries:
-
-```sh
-$ sudo yum install clang dbus-devel gtk3-devel libnotify-devel \
-                   libgnome-keyring-devel xorg-x11-server-utils libcap-devel \
-                   cups-devel libXtst-devel alsa-lib-devel libXrandr-devel \
-                   nss-devel python-dbusmock openjdk-8-jre
-```
-
-On Fedora, install the following libraries:
-
-```sh
-$ sudo dnf install clang dbus-devel gperf gtk3-devel \
-                   libnotify-devel libgnome-keyring-devel libcap-devel \
-                   cups-devel libXtst-devel alsa-lib-devel libXrandr-devel \
-                   nss-devel python-dbusmock
-```
-
-On Arch Linux / Manjaro, install the following libraries:
-
-```sh
-$ sudo pacman -Syu base-devel clang libdbus gtk2 libnotify \
-                   libgnome-keyring alsa-lib libcap libcups libxtst \
-                   libxss nss gcc-multilib curl gperf bison \
-                   python2 python-dbusmock jdk8-openjdk
-```
-
-Other distributions may offer similar packages for installation via package
-managers such as pacman. Or one can compile from source code.
+Additionally, Electron's [Linux dependency installer](https://github.com/electron/build-images/blob/main/tools/install-deps.sh) can be referenced to get the current dependencies that Electron requires in addition to what Chromium installs via [build/install-deps.sh](https://chromium.googlesource.com/chromium/src/+/HEAD/build/install-build-deps.sh).
 
 ### Cross compilation
 
-If you want to build for an `arm` target you should also install the following
-dependencies:
+If you want to build for an `arm` target, you can use Electron's [Linux dependency installer](https://github.com/electron/build-images/blob/main/tools/install-deps.sh) to install the additional dependencies by passing the `--arm argument`:
 
 ```sh
-$ sudo apt-get install libc6-dev-armhf-cross linux-libc-dev-armhf-cross \
-                       g++-arm-linux-gnueabihf
-```
-
-Similarly for `arm64`, install the following:
-
-```sh
-$ sudo apt-get install libc6-dev-arm64-cross linux-libc-dev-arm64-cross \
-                       g++-aarch64-linux-gnu
+$ sudo install-deps.sh --arm
 ```
 
 And to cross-compile for `arm` or targets, you should pass the

docs/tutorial/devtools-extension.md

@@ -94,7 +94,7 @@ If the extension works on Chrome but not on Electron, file a bug in Electron's
 [issue tracker][issue-tracker] and describe which part
 of the extension is not working as expected.
 
-[devtools-extension]: https://developer.chrome.com/extensions/devtools
+[devtools-extension]: https://developer.chrome.com/docs/extensions/how-to/devtools/extend-devtools
 [session]: ../api/session.md
 [react-devtools]: https://chrome.google.com/webstore/detail/react-developer-tools/fmkadmapgofadopljbjfkapdkoienihi
 [load-extension]: ../api/extensions-api.md#extensionsloadextensionpath-options

docs/tutorial/electron-timelines.md

@@ -9,7 +9,7 @@ check out our [Electron Versioning](./electron-versioning.md) doc.
 
 | Electron | Alpha | Beta | Stable | EOL | Chrome | Node | Supported |
 | ------- | ----- | ------- | ------ | ------ | ---- | ---- | ---- |
-| 40.0.0 |  2025-Oct-30 | 2025-Dec-03 | 2025-Oct-28 | 2026-Jun-30 | M144 | TBD | ✅ |
+| 40.0.0 |  2025-Oct-30 | 2025-Dec-03 | 2026-Jan-13 | 2026-Jun-30 | M144 | TBD | ✅ |
 | 39.0.0 |  2025-Sep-04 | 2025-Oct-01 | 2025-Oct-28 | 2026-May-05 | M142 | v22.20 | ✅ |
 | 38.0.0 |  2025-Jun-26 | 2025-Aug-06 | 2025-Sep-02 | 2026-Mar-10 | M140 | v22.18 | ✅ |
 | 37.0.0 |  2025-May-01 | 2025-May-28 | 2025-Jun-24 | 2026-Jan-13 | M138 | v22.16 | ✅ |
@@ -122,3 +122,22 @@ and that number is reduced to two in major version 10, the three-argument versio
 continue to work until, at minimum, major version 12. Past the minimum two-version
 threshold, we will attempt to support backwards compatibility beyond two versions
 until the maintainers feel the maintenance burden is too high to continue doing so.
+
+### End-of-life
+
+When a release branch reaches the end of its support cycle, the series
+will be deprecated in NPM and a final end-of-support release will be
+made. This release will add a warning to inform that an unsupported
+version of Electron is in use.
+
+These steps are to help app developers learn when a branch they're
+using becomes unsupported, but without being excessively intrusive
+to end users.
+
+If an application has exceptional circumstances and needs to stay
+on an unsupported series of Electron, developers can silence the
+end-of-support warning by omitting the final release from the app's
+`package.json` `devDependencies`. For example, since the 1-6-x series
+ended with an end-of-support 1.6.18 release, developers could choose
+to stay in the 1-6-x series without warnings with `devDependency` of
+`"electron": 1.6.0 - 1.6.17`.

docs/tutorial/native-file-drag-drop.md

@@ -110,10 +110,4 @@ the item is a Markdown file located in the root of the project:
 
 ![Drag and drop](../images/drag-and-drop.gif)
 
-## Dragging files into your app
-
-You can use the standard
-[Drag and Drop web API](https://developer.mozilla.org/en-US/docs/Web/API/HTML_Drag_and_Drop_API)
-for dragging and dropping files into your app.
-
 [`contextBridge`]: ../api/context-bridge.md

docs/tutorial/security.md

@@ -118,13 +118,6 @@ You should at least follow these steps to improve the security of your applicati
 19. [Check which fuses you can change](#19-check-which-fuses-you-can-change)
 20. [Do not expose Electron APIs to untrusted web content](#20-do-not-expose-electron-apis-to-untrusted-web-content)
 
-To automate the detection of misconfigurations and insecure patterns, it is
-possible to use
-[Electronegativity](https://github.com/doyensec/electronegativity). For
-additional details on potential weaknesses and implementation bugs when
-developing applications using Electron, please refer to this
-[guide for developers and auditors](https://doyensec.com/resources/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security-wp.pdf).
-
 ### 1. Only load secure content
 
 Any resources not included with your application should be loaded using a
@@ -299,7 +292,7 @@ const { session } = require('electron')
 const { URL } = require('node:url')
 
 session
-  .defaultSession
+  .fromPartition('some-partition')
   .setPermissionRequestHandler((webContents, permission, callback) => {
     const parsedUrl = new URL(webContents.getURL())
 
@@ -316,8 +309,6 @@ session
   })
 ```
 
-Note: `session.defaultSession` is only available after `app.whenReady` is called.
-
 ### 6. Do not disable `webSecurity`
 
 :::info
@@ -408,8 +399,6 @@ session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
 })
 ```
 
-Note: `session.defaultSession` is only available after `app.whenReady` is called.
-
 #### CSP meta tag
 
 CSP's preferred delivery mechanism is an HTTP header. However, it is not possible

filenames.gni

@@ -629,6 +629,8 @@ filenames = {
     "shell/common/gin_converters/usb_device_info_converter.h",
     "shell/common/gin_converters/value_converter.cc",
     "shell/common/gin_converters/value_converter.h",
+    "shell/common/gin_helper/arguments.cc",
+    "shell/common/gin_helper/arguments.h",
     "shell/common/gin_helper/callback.cc",
     "shell/common/gin_helper/callback.h",
     "shell/common/gin_helper/cleaned_up_at_exit.cc",

filenames.libcxx.gni

@@ -841,6 +841,7 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__cxx03/cmath",
   "//third_party/libc++/src/include/__cxx03/codecvt",
   "//third_party/libc++/src/include/__cxx03/complex",
+  "//third_party/libc++/src/include/__cxx03/complex.h",
   "//third_party/libc++/src/include/__cxx03/condition_variable",
   "//third_party/libc++/src/include/__cxx03/csetjmp",
   "//third_party/libc++/src/include/__cxx03/csignal",
@@ -853,20 +854,25 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__cxx03/cstring",
   "//third_party/libc++/src/include/__cxx03/ctgmath",
   "//third_party/libc++/src/include/__cxx03/ctime",
+  "//third_party/libc++/src/include/__cxx03/ctype.h",
   "//third_party/libc++/src/include/__cxx03/cuchar",
   "//third_party/libc++/src/include/__cxx03/cwchar",
   "//third_party/libc++/src/include/__cxx03/cwctype",
   "//third_party/libc++/src/include/__cxx03/deque",
+  "//third_party/libc++/src/include/__cxx03/errno.h",
   "//third_party/libc++/src/include/__cxx03/exception",
   "//third_party/libc++/src/include/__cxx03/experimental/__config",
   "//third_party/libc++/src/include/__cxx03/experimental/utility",
   "//third_party/libc++/src/include/__cxx03/ext/__hash",
   "//third_party/libc++/src/include/__cxx03/ext/hash_map",
   "//third_party/libc++/src/include/__cxx03/ext/hash_set",
+  "//third_party/libc++/src/include/__cxx03/fenv.h",
+  "//third_party/libc++/src/include/__cxx03/float.h",
   "//third_party/libc++/src/include/__cxx03/forward_list",
   "//third_party/libc++/src/include/__cxx03/fstream",
   "//third_party/libc++/src/include/__cxx03/functional",
   "//third_party/libc++/src/include/__cxx03/future",
+  "//third_party/libc++/src/include/__cxx03/inttypes.h",
   "//third_party/libc++/src/include/__cxx03/iomanip",
   "//third_party/libc++/src/include/__cxx03/ios",
   "//third_party/libc++/src/include/__cxx03/iosfwd",
@@ -893,8 +899,11 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__cxx03/sstream",
   "//third_party/libc++/src/include/__cxx03/stack",
   "//third_party/libc++/src/include/__cxx03/stdatomic.h",
+  "//third_party/libc++/src/include/__cxx03/stdbool.h",
+  "//third_party/libc++/src/include/__cxx03/stddef.h",
   "//third_party/libc++/src/include/__cxx03/stdexcept",
   "//third_party/libc++/src/include/__cxx03/stdint.h",
+  "//third_party/libc++/src/include/__cxx03/stdio.h",
   "//third_party/libc++/src/include/__cxx03/stdlib.h",
   "//third_party/libc++/src/include/__cxx03/streambuf",
   "//third_party/libc++/src/include/__cxx03/string",
@@ -902,6 +911,7 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__cxx03/string_view",
   "//third_party/libc++/src/include/__cxx03/strstream",
   "//third_party/libc++/src/include/__cxx03/system_error",
+  "//third_party/libc++/src/include/__cxx03/tgmath.h",
   "//third_party/libc++/src/include/__cxx03/thread",
   "//third_party/libc++/src/include/__cxx03/type_traits",
   "//third_party/libc++/src/include/__cxx03/typeindex",
@@ -914,6 +924,7 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__cxx03/vector",
   "//third_party/libc++/src/include/__cxx03/version",
   "//third_party/libc++/src/include/__cxx03/wchar.h",
+  "//third_party/libc++/src/include/__cxx03/wctype.h",
   "//third_party/libc++/src/include/__debug_utils/randomize_range.h",
   "//third_party/libc++/src/include/__debug_utils/sanitizers.h",
   "//third_party/libc++/src/include/__debug_utils/strict_weak_ordering_check.h",
@@ -1105,7 +1116,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__locale_dir/support/freebsd.h",
   "//third_party/libc++/src/include/__locale_dir/support/fuchsia.h",
   "//third_party/libc++/src/include/__locale_dir/support/linux.h",
-  "//third_party/libc++/src/include/__locale_dir/support/netbsd.h",
   "//third_party/libc++/src/include/__locale_dir/support/no_locale/characters.h",
   "//third_party/libc++/src/include/__locale_dir/support/no_locale/strtonum.h",
   "//third_party/libc++/src/include/__locale_dir/support/windows.h",
@@ -1359,6 +1369,7 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__tuple/sfinae_helpers.h",
   "//third_party/libc++/src/include/__tuple/tuple_element.h",
   "//third_party/libc++/src/include/__tuple/tuple_like.h",
+  "//third_party/libc++/src/include/__tuple/tuple_like_ext.h",
   "//third_party/libc++/src/include/__tuple/tuple_like_no_subrange.h",
   "//third_party/libc++/src/include/__tuple/tuple_size.h",
   "//third_party/libc++/src/include/__tuple/tuple_types.h",
@@ -1415,7 +1426,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__type_traits/is_floating_point.h",
   "//third_party/libc++/src/include/__type_traits/is_function.h",
   "//third_party/libc++/src/include/__type_traits/is_fundamental.h",
-  "//third_party/libc++/src/include/__type_traits/is_generic_transparent_comparator.h",
   "//third_party/libc++/src/include/__type_traits/is_implicit_lifetime.h",
   "//third_party/libc++/src/include/__type_traits/is_implicitly_default_constructible.h",
   "//third_party/libc++/src/include/__type_traits/is_integral.h",
@@ -1458,7 +1468,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__type_traits/make_32_64_or_128_bit.h",
   "//third_party/libc++/src/include/__type_traits/make_const_lvalue_ref.h",
   "//third_party/libc++/src/include/__type_traits/make_signed.h",
-  "//third_party/libc++/src/include/__type_traits/make_transparent.h",
   "//third_party/libc++/src/include/__type_traits/make_unsigned.h",
   "//third_party/libc++/src/include/__type_traits/maybe_const.h",
   "//third_party/libc++/src/include/__type_traits/nat.h",

lib/common/api/net-client-request.ts

@@ -289,7 +289,8 @@ function parseOptions (optionsIn: ClientRequestConstructorOptions | string): Nod
     referrerPolicy: options.referrerPolicy,
     cache: options.cache,
     allowNonHttpProtocols: Object.hasOwn(options, kAllowNonHttpProtocols),
-    priority: options.priority
+    priority: options.priority,
+    bypassCustomProtocolHandlers: options.bypassCustomProtocolHandlers
   };
   if ('priorityIncremental' in options) {
     urlLoaderOptions.priorityIncremental = options.priorityIncremental;
@@ -427,8 +428,9 @@ export class ClientRequest extends Writable implements Electron.ClientRequest {
     this._started = true;
     const stringifyValues = (obj: Record<string, { name: string, value: string | string[] }>) => {
       const ret: Record<string, string> = {};
-      for (const { name, value } of Object.values(obj)) {
-        ret[name] = value.toString();
+      for (const k of Object.keys(obj)) {
+        const kv = obj[k];
+        ret[kv.name] = kv.value.toString();
       }
       return ret;
     };

lib/node/asar-fs-wrapper.ts

@@ -746,7 +746,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
 
       context.readdirResults.push(dirent);
       if (dirent!.isDirectory() || stat === 1) {
-        context.pathsQueue.push(path.join(dirent!.parentPath, dirent!.name));
+        context.pathsQueue.push(path.join(dirent!.path, dirent!.name));
       }
     }
   }

npm/cli.js

@@ -5,9 +5,7 @@ const proc = require('child_process');
 const electron = require('./');
 
 const child = proc.spawn(electron, process.argv.slice(2), { stdio: 'inherit', windowsHide: false });
-let childClosed = false;
 child.on('close', function (code, signal) {
-  childClosed = true;
   if (code === null) {
     console.error(electron, 'exited with signal', signal);
     process.exit(1);
@@ -17,7 +15,7 @@ child.on('close', function (code, signal) {
 
 const handleTerminationSignal = function (signal) {
   process.on(signal, function signalHandler () {
-    if (!childClosed) {
+    if (!child.killed) {
       child.kill(signal);
     }
   });
@@ -25,4 +23,3 @@ const handleTerminationSignal = function (signal) {
 
 handleTerminationSignal('SIGINT');
 handleTerminationSignal('SIGTERM');
-handleTerminationSignal('SIGUSR2');

npm/package.json

@@ -9,7 +9,7 @@
   },
   "dependencies": {
     "@electron/get": "^2.0.0",
-    "@types/node": "^24.9.0",
+    "@types/node": "^22.7.7",
     "extract-zip": "^2.0.1"
   },
   "engines": {

package.json

@@ -5,16 +5,17 @@
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
     "@azure/storage-blob": "^12.28.0",
+    "@datadog/datadog-ci": "^4.1.2",
     "@electron/asar": "^3.2.13",
     "@electron/docs-parser": "^2.0.0",
     "@electron/fiddle-core": "^1.3.4",
-    "@electron/github-app-auth": "^2.2.1",
+    "@electron/github-app-auth": "^3.2.0",
     "@electron/lint-roller": "^3.1.2",
-    "@electron/typescript-definitions": "^9.1.5",
+    "@electron/typescript-definitions": "^9.1.2",
     "@octokit/rest": "^20.1.2",
     "@primer/octicons": "^10.0.0",
     "@types/minimist": "^1.2.5",
-    "@types/node": "^24.9.0",
+    "@types/node": "^22.7.7",
     "@types/semver": "^7.5.8",
     "@types/stream-json": "^1.7.8",
     "@types/temp": "^0.9.4",
@@ -40,6 +41,7 @@
     "lint-staged": "^16.1.0",
     "markdownlint-cli2": "^0.18.0",
     "minimist": "^1.2.8",
+    "node-gyp": "^11.4.2",
     "null-loader": "^4.0.1",
     "pre-flight": "^2.0.0",
     "process": "^0.11.10",
@@ -52,10 +54,10 @@
     "timers-browserify": "1.4.2",
     "ts-loader": "^8.0.2",
     "ts-node": "6.2.0",
-    "typescript": "^5.8.3",
+    "typescript": "^5.6.2",
     "url": "^0.11.4",
     "webpack": "^5.95.0",
-    "webpack-cli": "^6.0.1",
+    "webpack-cli": "^5.1.4",
     "wrapper-webpack-plugin": "^2.2.0"
   },
   "private": true,
@@ -134,6 +136,21 @@
     ]
   },
   "resolutions": {
-    "nan": "nodejs/nan#e14bdcd1f72d62bca1d541b66da43130384ec213"
+    "dbus-native/xml2js": "0.5.0",
+    "abstract-socket": "github:deepak1556/node-abstractsocket#928cc591decd12aff7dad96449da8afc29832c19",
+    "minimist@npm:~0.0.1": "0.2.4"
+  },
+  "packageManager": "yarn@4.12.0",
+  "workspaces": [
+    "spec",
+    "spec/fixtures/native-addon/*"
+  ],
+  "dependenciesMeta": {
+    "abstract-socket": {
+      "built": true
+    },
+    "dugite": {
+      "built": true
+    }
   }
 }

patches/boringssl/expose_ripemd160.patch

@@ -10,7 +10,7 @@ this patch is required to provide ripemd160 support in the nodejs crypto
 module.
 
 diff --git a/crypto/digest/digest_extra.cc b/crypto/digest/digest_extra.cc
-index ea1709ae6b50faedc786c0eaeb5f9002fd0db7d8..5b0ed4dc6aaf3fafad034e9ecc62cd47b9e3034f 100644
+index 345c94f6e26e88aac77b9feb92bd8d6665234981..8ef2ab8987da63f321d1dbb79f2eded8b8209bfc 100644
 --- a/crypto/digest/digest_extra.cc
 +++ b/crypto/digest/digest_extra.cc
 @@ -47,6 +47,7 @@ static const struct nid_to_digest nid_to_digest_mapping[] = {
@@ -22,7 +22,7 @@ index ea1709ae6b50faedc786c0eaeb5f9002fd0db7d8..5b0ed4dc6aaf3fafad034e9ecc62cd47
      // hash function when given a signature OID. To avoid unintended lax parsing
      // of hash OIDs, this is no longer supported for lookup by OID or NID.
 diff --git a/crypto/fipsmodule/digest/digests.cc.inc b/crypto/fipsmodule/digest/digests.cc.inc
-index 3a3bfd3f0560fcd7b5fdbdf4cc29a56e0346b90a..a7335ca03b5b3b918c4321d890b45649679d772b 100644
+index 99e3a66c0a47818ccb039f8ccc41ea50e529a16d..dc50fd05bed6cb40bffe1c0f6f3019d25d351ba2 100644
 --- a/crypto/fipsmodule/digest/digests.cc.inc
 +++ b/crypto/fipsmodule/digest/digests.cc.inc
 @@ -18,6 +18,7 @@
@@ -62,27 +62,27 @@ index 3a3bfd3f0560fcd7b5fdbdf4cc29a56e0346b90a..a7335ca03b5b3b918c4321d890b45649
 +
  #undef CHECK
 diff --git a/decrepit/evp/evp_do_all.cc b/decrepit/evp/evp_do_all.cc
-index feaf17c72cecb8099bc11ac10747fbad719ddca9..891a73f229e3f0838cb2fa99b8fb24fdeac1962b 100644
+index e04b80cd6a1a215fc87f8fd8d750c3d258c3974f..8fdf1c624794f568bfc77b7b6b0c510b23905a4d 100644
 --- a/decrepit/evp/evp_do_all.cc
 +++ b/decrepit/evp/evp_do_all.cc
 @@ -79,6 +79,7 @@ void EVP_MD_do_all_sorted(void (*callback)(const EVP_MD *cipher,
-   callback(EVP_sha384(), "SHA384", nullptr, arg);
-   callback(EVP_sha512(), "SHA512", nullptr, arg);
-   callback(EVP_sha512_256(), "SHA512-256", nullptr, arg);
-+  callback(EVP_ripemd160(), "ripemd160", nullptr, arg);
+   callback(EVP_sha384(), "SHA384", NULL, arg);
+   callback(EVP_sha512(), "SHA512", NULL, arg);
+   callback(EVP_sha512_256(), "SHA512-256", NULL, arg);
++  callback(EVP_ripemd160(), "ripemd160", NULL, arg);
  
-   callback(EVP_md4(), "md4", nullptr, arg);
-   callback(EVP_md5(), "md5", nullptr, arg);
+   callback(EVP_md4(), "md4", NULL, arg);
+   callback(EVP_md5(), "md5", NULL, arg);
 @@ -88,6 +89,7 @@ void EVP_MD_do_all_sorted(void (*callback)(const EVP_MD *cipher,
-   callback(EVP_sha384(), "sha384", nullptr, arg);
-   callback(EVP_sha512(), "sha512", nullptr, arg);
-   callback(EVP_sha512_256(), "sha512-256", nullptr, arg);
-+  callback(EVP_ripemd160(), "ripemd160", nullptr, arg);
+   callback(EVP_sha384(), "sha384", NULL, arg);
+   callback(EVP_sha512(), "sha512", NULL, arg);
+   callback(EVP_sha512_256(), "sha512-256", NULL, arg);
++  callback(EVP_ripemd160(), "ripemd160", NULL, arg);
  }
  
  void EVP_MD_do_all(void (*callback)(const EVP_MD *cipher, const char *name,
 diff --git a/include/openssl/digest.h b/include/openssl/digest.h
-index a86c18926e7798a3b0aae70c53870e03b5acd0ab..f4f27f9e803533d8db50d89e7a0125384a025a46 100644
+index b604aba00c1c6cea8002b6dc298ea5fe979589b1..1c123aa1dca09ae60c31be2a6dab9a64748eac17 100644
 --- a/include/openssl/digest.h
 +++ b/include/openssl/digest.h
 @@ -48,6 +48,9 @@ OPENSSL_EXPORT const EVP_MD *EVP_blake2b256(void);

patches/boringssl/feat_expose_several_extra_cipher_functions.patch

@@ -64,64 +64,64 @@ index 6513df01c4b3e4d33fc6b521d9aae78ec5499e73..52eb7fea420e3d81d274fd5c1e21e4da
  
  const EVP_CIPHER *EVP_get_cipherbynid(int nid) {
 diff --git a/decrepit/evp/evp_do_all.cc b/decrepit/evp/evp_do_all.cc
-index 891a73f229e3f0838cb2fa99b8fb24fdeac1962b..f7d0c5dc66f016eb9338c15e7f5ef59e6de2969d 100644
+index 8fdf1c624794f568bfc77b7b6b0c510b23905a4d..2e40c031e8c681fe921331b26dbf63f4df2fcf71 100644
 --- a/decrepit/evp/evp_do_all.cc
 +++ b/decrepit/evp/evp_do_all.cc
 @@ -20,8 +20,10 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
                                                 const char *unused, void *arg),
                                void *arg) {
-   callback(EVP_aes_128_cbc(), "AES-128-CBC", nullptr, arg);
-+  callback(EVP_aes_128_cfb128(), "AES-128-CFB", nullptr, arg);
-   callback(EVP_aes_192_cbc(), "AES-192-CBC", nullptr, arg);
-   callback(EVP_aes_256_cbc(), "AES-256-CBC", nullptr, arg);
-+  callback(EVP_aes_256_cfb128(), "AES-256-CFB", nullptr, arg);
-   callback(EVP_aes_128_ctr(), "AES-128-CTR", nullptr, arg);
-   callback(EVP_aes_192_ctr(), "AES-192-CTR", nullptr, arg);
-   callback(EVP_aes_256_ctr(), "AES-256-CTR", nullptr, arg);
+   callback(EVP_aes_128_cbc(), "AES-128-CBC", NULL, arg);
++  callback(EVP_aes_128_cfb128(), "AES-128-CFB", NULL, arg);
+   callback(EVP_aes_192_cbc(), "AES-192-CBC", NULL, arg);
+   callback(EVP_aes_256_cbc(), "AES-256-CBC", NULL, arg);
++  callback(EVP_aes_256_cfb128(), "AES-256-CFB", NULL, arg);
+   callback(EVP_aes_128_ctr(), "AES-128-CTR", NULL, arg);
+   callback(EVP_aes_192_ctr(), "AES-192-CTR", NULL, arg);
+   callback(EVP_aes_256_ctr(), "AES-256-CTR", NULL, arg);
 @@ -34,9 +36,13 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
-   callback(EVP_aes_128_gcm(), "AES-128-GCM", nullptr, arg);
-   callback(EVP_aes_192_gcm(), "AES-192-GCM", nullptr, arg);
-   callback(EVP_aes_256_gcm(), "AES-256-GCM", nullptr, arg);
-+  callback(EVP_bf_cbc(), "BF-CBC", nullptr, arg);
-+  callback(EVP_bf_cfb(), "BF-CFB", nullptr, arg);
-+  callback(EVP_bf_ecb(), "BF-ECB", nullptr, arg);
-   callback(EVP_des_cbc(), "DES-CBC", nullptr, arg);
-   callback(EVP_des_ecb(), "DES-ECB", nullptr, arg);
-   callback(EVP_des_ede(), "DES-EDE", nullptr, arg);
-+  callback(EVP_des_ede3(), "DES-EDE3", nullptr, arg);
-   callback(EVP_des_ede_cbc(), "DES-EDE-CBC", nullptr, arg);
-   callback(EVP_des_ede3_cbc(), "DES-EDE3-CBC", nullptr, arg);
-   callback(EVP_rc2_cbc(), "RC2-CBC", nullptr, arg);
+   callback(EVP_aes_128_gcm(), "AES-128-GCM", NULL, arg);
+   callback(EVP_aes_192_gcm(), "AES-192-GCM", NULL, arg);
+   callback(EVP_aes_256_gcm(), "AES-256-GCM", NULL, arg);
++  callback(EVP_bf_cbc(), "BF-CBC", NULL, arg);
++  callback(EVP_bf_cfb(), "BF-CFB", NULL, arg);
++  callback(EVP_bf_ecb(), "BF-ECB", NULL, arg);
+   callback(EVP_des_cbc(), "DES-CBC", NULL, arg);
+   callback(EVP_des_ecb(), "DES-ECB", NULL, arg);
+   callback(EVP_des_ede(), "DES-EDE", NULL, arg);
++  callback(EVP_des_ede3(), "DES-EDE3", NULL, arg);
+   callback(EVP_des_ede_cbc(), "DES-EDE-CBC", NULL, arg);
+   callback(EVP_des_ede3_cbc(), "DES-EDE3-CBC", NULL, arg);
+   callback(EVP_rc2_cbc(), "RC2-CBC", NULL, arg);
 @@ -44,8 +50,10 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
  
    // OpenSSL returns everything twice, the second time in lower case.
-   callback(EVP_aes_128_cbc(), "aes-128-cbc", nullptr, arg);
-+  callback(EVP_aes_128_cfb128(), "aes-128-cfb", nullptr, arg);
-   callback(EVP_aes_192_cbc(), "aes-192-cbc", nullptr, arg);
-   callback(EVP_aes_256_cbc(), "aes-256-cbc", nullptr, arg);
-+  callback(EVP_aes_256_cfb128(), "aes-256-cfb", nullptr, arg);
-   callback(EVP_aes_128_ctr(), "aes-128-ctr", nullptr, arg);
-   callback(EVP_aes_192_ctr(), "aes-192-ctr", nullptr, arg);
-   callback(EVP_aes_256_ctr(), "aes-256-ctr", nullptr, arg);
+   callback(EVP_aes_128_cbc(), "aes-128-cbc", NULL, arg);
++  callback(EVP_aes_128_cfb128(), "aes-128-cfb", NULL, arg);
+   callback(EVP_aes_192_cbc(), "aes-192-cbc", NULL, arg);
+   callback(EVP_aes_256_cbc(), "aes-256-cbc", NULL, arg);
++  callback(EVP_aes_256_cfb128(), "aes-256-cfb", NULL, arg);
+   callback(EVP_aes_128_ctr(), "aes-128-ctr", NULL, arg);
+   callback(EVP_aes_192_ctr(), "aes-192-ctr", NULL, arg);
+   callback(EVP_aes_256_ctr(), "aes-256-ctr", NULL, arg);
 @@ -58,9 +66,13 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
-   callback(EVP_aes_128_gcm(), "aes-128-gcm", nullptr, arg);
-   callback(EVP_aes_192_gcm(), "aes-192-gcm", nullptr, arg);
-   callback(EVP_aes_256_gcm(), "aes-256-gcm", nullptr, arg);
-+  callback(EVP_bf_cbc(), "bf-cbc", nullptr, arg);
-+  callback(EVP_bf_cfb(), "bf-cfb", nullptr, arg);
-+  callback(EVP_bf_ecb(), "bf-ecb", nullptr, arg);
-   callback(EVP_des_cbc(), "des-cbc", nullptr, arg);
-   callback(EVP_des_ecb(), "des-ecb", nullptr, arg);
-   callback(EVP_des_ede(), "des-ede", nullptr, arg);
-+  callback(EVP_des_ede3(), "des-ede3", nullptr, arg);
-   callback(EVP_des_ede_cbc(), "des-ede-cbc", nullptr, arg);
-   callback(EVP_des_ede3_cbc(), "des-ede3-cbc", nullptr, arg);
-   callback(EVP_rc2_cbc(), "rc2-cbc", nullptr, arg);
+   callback(EVP_aes_128_gcm(), "aes-128-gcm", NULL, arg);
+   callback(EVP_aes_192_gcm(), "aes-192-gcm", NULL, arg);
+   callback(EVP_aes_256_gcm(), "aes-256-gcm", NULL, arg);
++  callback(EVP_bf_cbc(), "bf-cbc", NULL, arg);
++  callback(EVP_bf_cfb(), "bf-cfb", NULL, arg);
++  callback(EVP_bf_ecb(), "bf-ecb", NULL, arg);
+   callback(EVP_des_cbc(), "des-cbc", NULL, arg);
+   callback(EVP_des_ecb(), "des-ecb", NULL, arg);
+   callback(EVP_des_ede(), "des-ede", NULL, arg);
++  callback(EVP_des_ede3(), "des-ede3", NULL, arg);
+   callback(EVP_des_ede_cbc(), "des-ede-cbc", NULL, arg);
+   callback(EVP_des_ede3_cbc(), "des-ede3-cbc", NULL, arg);
+   callback(EVP_rc2_cbc(), "rc2-cbc", NULL, arg);
 diff --git a/include/openssl/cipher.h b/include/openssl/cipher.h
-index a5533caf45eaacc4baef4a73d97e9bc2b6e3a942..35f24c1b22ea2c6b4766c0d87e75b6fc6b459f79 100644
+index 13e68ad20ac08a462bb577d7f99e2c6f167579fa..4960d0eeb8f31bec4347ed2a1b63beba530de700 100644
 --- a/include/openssl/cipher.h
 +++ b/include/openssl/cipher.h
-@@ -461,6 +461,7 @@ OPENSSL_EXPORT const EVP_CIPHER *EVP_des_ede3_ecb(void);
+@@ -448,6 +448,7 @@ OPENSSL_EXPORT const EVP_CIPHER *EVP_des_ede3_ecb(void);
  
  // EVP_aes_128_cfb128 is only available in decrepit.
  OPENSSL_EXPORT const EVP_CIPHER *EVP_aes_128_cfb128(void);

patches/boringssl/revert_track_ssl_error_zero_return_explicitly.patch

@@ -8,7 +8,7 @@ This reverts commit ebd8b8965c74ab06bb91f7a00b23822e1f1f26ca.
 It is causing significant TLS failures in Node.js.
 
 diff --git a/ssl/ssl_buffer.cc b/ssl/ssl_buffer.cc
-index 8c5c7bcd96229cfcfb605bd4728c52c3c03d6062..ad8f1e7a26c665fd471b62bd694aad1655500d33 100644
+index 2cdcbc346175eeee69402ecee7f169e61c655199..f7226fe711e4214b216ea2c5173a02124b80f9ef 100644
 --- a/ssl/ssl_buffer.cc
 +++ b/ssl/ssl_buffer.cc
 @@ -230,7 +230,6 @@ int ssl_handle_open_record(SSL *ssl, bool *out_retry, ssl_open_record_t ret,
@@ -20,7 +20,7 @@ index 8c5c7bcd96229cfcfb605bd4728c52c3c03d6062..ad8f1e7a26c665fd471b62bd694aad16
  
      case ssl_open_record_error:
 diff --git a/ssl/ssl_lib.cc b/ssl/ssl_lib.cc
-index f64b103fbb7a298a22fe0ff4bc95a4415c58e305..9bc3e1c3114ae67c0eb6a31de05b85e517ea6ae2 100644
+index 532744f942301dfd124fa1c2c6fd547fffb7d9c5..0e1d89439fce44077cd6f224742e67ec4b891cad 100644
 --- a/ssl/ssl_lib.cc
 +++ b/ssl/ssl_lib.cc
 @@ -1211,7 +1211,7 @@ int SSL_get_error(const SSL *ssl, int ret_code) {
@@ -32,7 +32,7 @@ index f64b103fbb7a298a22fe0ff4bc95a4415c58e305..9bc3e1c3114ae67c0eb6a31de05b85e5
        return SSL_ERROR_ZERO_RETURN;
      }
      // An EOF was observed which violates the protocol, and the underlying
-@@ -2672,13 +2672,7 @@ void *SSL_CTX_get_ex_data(const SSL_CTX *ctx, int idx) {
+@@ -2662,13 +2662,7 @@ void *SSL_CTX_get_ex_data(const SSL_CTX *ctx, int idx) {
    return CRYPTO_get_ex_data(&ctx->ex_data, idx);
  }
  

patches/chromium/.patches

@@ -131,6 +131,7 @@ chore_grandfather_in_electron_views_and_delegates.patch
 refactor_patch_electron_permissiontypes_into_blink.patch
 revert_views_remove_desktopwindowtreehostwin_window_enlargement.patch
 build_partial_revert_mac_fullscreen_top_chrome_mouse_events.patch
+build_set_mac_sdk_minimum_to_10.patch
 fix_add_macos_memory_query_fallback_to_avoid_crash.patch
 fix_resolve_dynamic_background_material_update_issue_on_windows_11.patch
 feat_add_support_for_embedder_snapshot_validation.patch
@@ -141,6 +142,8 @@ revert_partial_remove_unused_prehandlemouseevent.patch
 allow_electron_to_depend_on_components_os_crypt_sync.patch
 expose_referrerscriptinfo_hostdefinedoptionsindex.patch
 chore_disable_protocol_handler_dcheck.patch
-fix_check_for_file_existence_before_setting_mtime.patch
-revert_cleanup_remove_feature_windelayspellcheckserviceinit.patch
-fix_linux_tray_id.patch
+fix_release_mouse_buttons_on_focus_loss_on_wayland.patch
+viz_fix_visual_artifacts_due_to_resizing_root_render_pass_with_dcomp.patch
+viz_do_not_overallocate_surface_on_initial_render.patch
+viz_create_isbufferqueuesupportedandenabled.patch
+viz_fix_visual_artifacts_while_resizing_window_with_dcomp.patch

patches/chromium/accelerator.patch

@@ -53,17 +53,17 @@ index 5ad9332dd27ceda7d67cd3f571b12218a4415a40..ffe083836c39fb60b4bff1f9fbdd6ceb
    }
  
 diff --git a/ui/base/accelerators/accelerator.h b/ui/base/accelerators/accelerator.h
-index 666ecbc118bec6d51465644ae4e573846c33610b..5f578ea153477379bac69e48fbd4f41a9a24885e 100644
+index 666ecbc118bec6d51465644ae4e573846c33610b..30b3ae49265eb263edda23c68587b46fab72a3ba 100644
 --- a/ui/base/accelerators/accelerator.h
 +++ b/ui/base/accelerators/accelerator.h
-@@ -21,6 +21,7 @@
+@@ -18,6 +18,7 @@
+ #include <vector>
+ 
+ #include "base/component_export.h"
++#include "third_party/abseil-cpp/absl/types/optional.h"
  #include "base/time/time.h"
  #include "build/blink_buildflags.h"
  #include "build/build_config.h"
-+#include "third_party/abseil-cpp/absl/types/optional.h"
- #include "ui/events/event_constants.h"
- #include "ui/events/keycodes/keyboard_codes.h"
- 
 @@ -199,6 +200,8 @@ class COMPONENT_EXPORT(UI_BASE) Accelerator {
                << 18);  // masked to 6 bits
    }

patches/chromium/add_didinstallconditionalfeatures.patch

@@ -10,10 +10,10 @@ DidCreateScriptContext is called, not all JS APIs are available in the
 context, which can cause some preload scripts to trip.
 
 diff --git a/content/public/renderer/render_frame_observer.h b/content/public/renderer/render_frame_observer.h
-index 5196f155cdc641b66c4faa77d8b00097145a1290..bbfac47a74f989482343c222b78f187b70297e4e 100644
+index 88a4c3167e2935a11fc50f4c147fef6b2253abc5..e9e88619c349d018abbf183b16339339c7fb29b6 100644
 --- a/content/public/renderer/render_frame_observer.h
 +++ b/content/public/renderer/render_frame_observer.h
-@@ -141,6 +141,8 @@ class CONTENT_EXPORT RenderFrameObserver {
+@@ -139,6 +139,8 @@ class CONTENT_EXPORT RenderFrameObserver {
    virtual void DidHandleOnloadEvents() {}
    virtual void DidCreateScriptContext(v8::Local<v8::Context> context,
                                        int32_t world_id) {}
@@ -23,10 +23,10 @@ index 5196f155cdc641b66c4faa77d8b00097145a1290..bbfac47a74f989482343c222b78f187b
                                          int32_t world_id) {}
    virtual void DidClearWindowObject() {}
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index 30c2972e1fbc21d382304897c542ecd7fa95b896..3f512dcaec9f1d8a1375277ab8c6649d69070a33 100644
+index 8603f912e83db5211f21701b2f08db07790ea4ba..4816cb344ee9474a663863a5c2668a112c299919 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -4665,6 +4665,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
+@@ -4700,6 +4700,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
      observer.DidCreateScriptContext(context, world_id);
  }
  
@@ -40,7 +40,7 @@ index 30c2972e1fbc21d382304897c542ecd7fa95b896..3f512dcaec9f1d8a1375277ab8c6649d
                                                 int world_id) {
    for (auto& observer : observers_)
 diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
-index c3c45d6a953d7c068c0d6c8bfb6855cd4403aa6d..b3fd71b237c134853f796a1d8d803e4d28519d53 100644
+index 29c0e1703bb7e8e7bf53440a7f0cb7a6ceb4381b..155d2c3d9ce02fa02a655abf8bf7dbb1f83553f3 100644
 --- a/content/renderer/render_frame_impl.h
 +++ b/content/renderer/render_frame_impl.h
 @@ -602,6 +602,8 @@ class CONTENT_EXPORT RenderFrameImpl
@@ -53,10 +53,10 @@ index c3c45d6a953d7c068c0d6c8bfb6855cd4403aa6d..b3fd71b237c134853f796a1d8d803e4d
                                  int world_id) override;
    void DidChangeScrollOffset() override;
 diff --git a/third_party/blink/public/web/web_local_frame_client.h b/third_party/blink/public/web/web_local_frame_client.h
-index 5c1d0c1581b7ef6214f3dde6a4053a23c8673b74..4520c9edccf63bdb9e35bf3a99a8ddb39170da24 100644
+index 101e727b3a97bc764315eb694dc3975f9a408f9c..52e8828d8fffaba8ab05436cb4d727595f18238a 100644
 --- a/third_party/blink/public/web/web_local_frame_client.h
 +++ b/third_party/blink/public/web/web_local_frame_client.h
-@@ -667,6 +667,9 @@ class BLINK_EXPORT WebLocalFrameClient {
+@@ -661,6 +661,9 @@ class BLINK_EXPORT WebLocalFrameClient {
    virtual void DidCreateScriptContext(v8::Local<v8::Context>,
                                        int32_t world_id) {}
  
@@ -67,10 +67,10 @@ index 5c1d0c1581b7ef6214f3dde6a4053a23c8673b74..4520c9edccf63bdb9e35bf3a99a8ddb3
    virtual void WillReleaseScriptContext(v8::Local<v8::Context>,
                                          int32_t world_id) {}
 diff --git a/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc b/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc
-index 3ce1ef340780075951fb8c1b65f2ec90569f34ef..898d7caac98727210ac5780b576526a71ec5a5aa 100644
+index b963abd8c4bf6ffaea1930a8d1f647a8a8c266bc..2e8653654686f4fc775288f059ff27daa38e02d5 100644
 --- a/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc
 +++ b/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc
-@@ -217,6 +217,7 @@ void LocalWindowProxy::Initialize() {
+@@ -216,6 +216,7 @@ void LocalWindowProxy::Initialize() {
    }
  
    InstallConditionalFeatures();
@@ -92,11 +92,11 @@ index 36baf908d3be8aed44ff60b8de2cffe2eee15efe..8d73ddb12013ce195026b9f63050cf33
                                          int32_t world_id) = 0;
    virtual bool AllowScriptExtensions() = 0;
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
-index 019445e625257f909875adffdc5e967fb65a3728..11475d1a22054a884f2f1e7e5c933e9ae8d3379f 100644
+index b02b60ff5f6650332c54ecc66f6fdb274b737aa7..1aacf6f66b543a4ede6ab5d885143dd4a0821e8a 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
-@@ -300,6 +300,13 @@ void LocalFrameClientImpl::DidCreateScriptContext(
-   }
+@@ -295,6 +295,13 @@ void LocalFrameClientImpl::DidCreateScriptContext(
+     web_frame_->Client()->DidCreateScriptContext(context, world_id);
  }
  
 +void LocalFrameClientImpl::DidInstallConditionalFeatures(
@@ -123,10 +123,10 @@ index fcc0928abbc454281b022e0451d993651ecba42f..16066fe34ee0335a0dabe00b6890e584
                                  int32_t world_id) override;
  
 diff --git a/third_party/blink/renderer/core/loader/empty_clients.h b/third_party/blink/renderer/core/loader/empty_clients.h
-index 9ec4431ed035543beb78a3311049886c6d8e03f8..d46f3b764f653c990e57fb2c67121c8fd6b1b115 100644
+index 769b08ca081fe83c50babb2743fde6e8961b65ff..d8f3b11c98fd58baa9995762a29847b9fd760c84 100644
 --- a/third_party/blink/renderer/core/loader/empty_clients.h
 +++ b/third_party/blink/renderer/core/loader/empty_clients.h
-@@ -424,6 +424,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {
+@@ -420,6 +420,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {
  
    void DidCreateScriptContext(v8::Local<v8::Context>,
                                int32_t world_id) override {}

patches/chromium/add_electron_deps_to_license_credits_file.patch

@@ -7,12 +7,12 @@ Ensure that licenses for the dependencies introduced by Electron
 are included in `LICENSES.chromium.html`
 
 diff --git a/tools/licenses/licenses.py b/tools/licenses/licenses.py
-index 514be069768cc1bbd39f2b261cefb1a9f267f89f..0a1ab64914cfaa087e4000fb81bfafd18aa1b98b 100755
+index a8afd4c9a95ad62fa0c8adb6fd53c2783d6eee96..ef8ab7dd5368d79c4bcf1e22fb539029956d4c67 100755
 --- a/tools/licenses/licenses.py
 +++ b/tools/licenses/licenses.py
-@@ -357,6 +357,31 @@ SPECIAL_CASES = {
+@@ -342,6 +342,31 @@ SPECIAL_CASES = {
          "License": "Apache 2.0",
-         "License File": ["//third_party/sample3/the_license"],
+         "License File": ["//third_party/dawn/third_party/khronos/LICENSE"],
      },
 +    os.path.join('third_party', 'electron_node'): {
 +        "Name": "Node.js",

patches/chromium/adjust_accessibility_ui_for_electron.patch

@@ -10,7 +10,7 @@ usage of BrowserList and Browser as we subclass related methods and use our
 WindowList.
 
 diff --git a/chrome/browser/ui/webui/accessibility/accessibility_ui.cc b/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
-index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3b33c3777 100644
+index 8f425bd66fac7b36cee201c3e23c126dd14edf07..6216ad30ed15f11501e1d154258862f57941969e 100644
 --- a/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
 +++ b/chrome/browser/ui/webui/accessibility/accessibility_ui.cc
 @@ -48,6 +48,7 @@
@@ -21,16 +21,16 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
  #include "ui/accessibility/accessibility_features.h"
  #include "ui/accessibility/ax_mode.h"
  #include "ui/accessibility/ax_updates_and_events.h"
-@@ -179,7 +180,7 @@ base::Value::Dict BuildTargetDescriptor(content::RenderViewHost* rvh) {
+@@ -178,7 +179,7 @@ base::Value::Dict BuildTargetDescriptor(content::RenderViewHost* rvh) {
                                 rvh->GetRoutingID(), accessibility_mode);
  }
  
 -#if !BUILDFLAG(IS_ANDROID)
 +#if 0
- base::Value::Dict BuildTargetDescriptor(BrowserWindowInterface* browser) {
+ base::Value::Dict BuildTargetDescriptor(Browser* browser) {
    base::Value::Dict target_data;
-   target_data.Set(kSessionIdField, browser->GetSessionID().id());
-@@ -226,7 +227,7 @@ void HandleAccessibilityRequestCallback(
+   target_data.Set(kSessionIdField, browser->session_id().id());
+@@ -224,7 +225,7 @@ void HandleAccessibilityRequestCallback(
    auto& browser_accessibility_state =
        *content::BrowserAccessibilityState::GetInstance();
    base::Value::Dict data;
@@ -39,7 +39,7 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
    ui::AXMode mode = browser_accessibility_state.GetAccessibilityMode();
    bool native = mode.has_mode(ui::AXMode::kNativeAPIs);
    bool web = mode.has_mode(ui::AXMode::kWebContents);
-@@ -287,7 +288,7 @@ void HandleAccessibilityRequestCallback(
+@@ -285,7 +286,7 @@ void HandleAccessibilityRequestCallback(
    data.Set(kIsScreenReaderActive, is_screen_reader_active);
  
    std::string pref_api_type =
@@ -48,23 +48,21 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
    bool pref_api_type_supported = false;
  
    std::vector<ui::AXApiType::Type> supported_api_types =
-@@ -355,13 +356,13 @@ void HandleAccessibilityRequestCallback(
+@@ -353,11 +354,11 @@ void HandleAccessibilityRequestCallback(
    data.Set(kPagesField, std::move(page_list));
  
    base::Value::List browser_list;
 -#if !BUILDFLAG(IS_ANDROID)
 +#if 0
-   ForEachCurrentBrowserWindowInterfaceOrderedByActivation(
-       [&browser_list](BrowserWindowInterface* browser) {
-         browser_list.Append(BuildTargetDescriptor(browser));
-         return true;
-       });
+   for (Browser* browser : *BrowserList::GetInstance()) {
+     browser_list.Append(BuildTargetDescriptor(browser));
+   }
 -#endif  // !BUILDFLAG(IS_ANDROID)
 +#endif
    data.Set(kBrowsersField, std::move(browser_list));
  
  #if BUILDFLAG(IS_WIN)
-@@ -848,7 +849,8 @@ void AccessibilityUIMessageHandler::SetGlobalString(
+@@ -844,7 +845,8 @@ void AccessibilityUIMessageHandler::SetGlobalString(
    const std::string value = CheckJSValue(data.FindString(kValueField));
  
    if (string_name == kApiTypeField) {
@@ -74,7 +72,7 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
      pref->SetString(prefs::kShownAccessibilityApiType, value);
    }
  }
-@@ -902,7 +904,8 @@ void AccessibilityUIMessageHandler::RequestWebContentsTree(
+@@ -898,7 +900,8 @@ void AccessibilityUIMessageHandler::RequestWebContentsTree(
                       AXPropertyFilter::ALLOW_EMPTY);
    AddPropertyFilters(property_filters, deny, AXPropertyFilter::DENY);
  
@@ -84,25 +82,23 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
    ui::AXApiType::Type api_type =
        ui::AXApiType::From(pref->GetString(prefs::kShownAccessibilityApiType));
    std::string accessibility_contents =
-@@ -922,7 +925,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
+@@ -925,6 +928,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
+                      AXPropertyFilter::ALLOW_EMPTY);
+   AddPropertyFilters(property_filters, deny, AXPropertyFilter::DENY);
  
-   AllowJavascript();
- 
--#if !BUILDFLAG(IS_ANDROID)
 +#if 0
-   std::vector<AXPropertyFilter> property_filters;
-   AddPropertyFilters(property_filters, allow, AXPropertyFilter::ALLOW);
-   AddPropertyFilters(property_filters, allow_empty,
-@@ -949,7 +952,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
-   if (found) {
-     return;
+   for (Browser* browser : *BrowserList::GetInstance()) {
+     if (browser->session_id().id() == session_id) {
+       base::Value::Dict result = BuildTargetDescriptor(browser);
+@@ -937,6 +941,7 @@ void AccessibilityUIMessageHandler::RequestNativeUITree(
+       return;
+     }
    }
--#endif  // !BUILDFLAG(IS_ANDROID)
 +#endif
+ #endif  // !BUILDFLAG(IS_ANDROID)
    // No browser with the specified |session_id| was found.
    base::Value::Dict result;
-   result.Set(kSessionIdField, session_id);
-@@ -992,11 +995,13 @@ void AccessibilityUIMessageHandler::StopRecording(
+@@ -980,11 +985,13 @@ void AccessibilityUIMessageHandler::StopRecording(
  }
  
  ui::AXApiType::Type AccessibilityUIMessageHandler::GetRecordingApiType() {
@@ -119,7 +115,7 @@ index 3a9f87d82212bfeab23b312a593fb855df344780..83b4a7fe7149f2b195e53fcb05f77da3
    // Check to see if it is in the supported types list.
    if (std::find(supported_types.begin(), supported_types.end(), api_type) ==
        supported_types.end()) {
-@@ -1066,10 +1071,13 @@ void AccessibilityUIMessageHandler::RequestAccessibilityEvents(
+@@ -1054,10 +1061,13 @@ void AccessibilityUIMessageHandler::RequestAccessibilityEvents(
  // static
  void AccessibilityUIMessageHandler::RegisterProfilePrefs(
      user_prefs::PrefRegistrySyncable* registry) {

patches/chromium/allow_disabling_blink_scheduler_throttling_per_renderview.patch

@@ -6,11 +6,11 @@ Subject: allow disabling blink scheduler throttling per RenderView
 This allows us to disable throttling for hidden windows.
 
 diff --git a/content/browser/renderer_host/navigation_controller_impl_unittest.cc b/content/browser/renderer_host/navigation_controller_impl_unittest.cc
-index 5765fe8264ecf117d68cdc2c95517f2fcc22715f..37a734f120427571cf5f4f7b6b6eabb881ba59cb 100644
+index 94a67b61edb0bc2f3faa5db44e99d1493f38d5a0..e4a953c199f8c1e5d68e552f73c593d308946957 100644
 --- a/content/browser/renderer_host/navigation_controller_impl_unittest.cc
 +++ b/content/browser/renderer_host/navigation_controller_impl_unittest.cc
 @@ -168,6 +168,12 @@ class MockPageBroadcast : public blink::mojom::PageBroadcast {
-               (bool supports_draggable_regions),
+               (std::optional<blink::NoiseToken> canvas_noise_token),
                (override));
  
 +  MOCK_METHOD(
@@ -23,10 +23,10 @@ index 5765fe8264ecf117d68cdc2c95517f2fcc22715f..37a734f120427571cf5f4f7b6b6eabb8
      return receiver_.BindNewEndpointAndPassDedicatedRemote();
    }
 diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
-index 357dc106e4c53122e87ea09a780f7976ad37f25e..5209b85dc285f5e177377bd06e36b8b175581cbb 100644
+index 270750b9180a8ddab4f3cd2508fd398e07bf6377..20b2ae081a3710443ec919f1487dfbfe8f15de11 100644
 --- a/content/browser/renderer_host/render_view_host_impl.cc
 +++ b/content/browser/renderer_host/render_view_host_impl.cc
-@@ -767,6 +767,11 @@ void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
+@@ -785,6 +785,11 @@ void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
    GetWidget()->GetAssociatedFrameWidget()->SetBackgroundOpaque(opaque);
  }
  
@@ -51,25 +51,25 @@ index 7944fe64e0da112fc670358b75506bb199bb5e4a..0e3c16c6af2a078943e9f39808134ab2
    void SendRendererPreferencesToRenderer(
        const blink::RendererPreferences& preferences);
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
-index 84899b5208f036bd58ba51513820404b6c5a24b9..87fd5aa4fab7ddd0b444a3c8473ae35066c87054 100644
+index e8a0554c4d84a16fc2122cb3e48199b4f43ecf88..34fca79b7c87b2fd098271fb5a4f83c015eeb2bc 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
-@@ -632,8 +632,8 @@ void RenderWidgetHostViewAura::ShowImpl(PageVisibilityState page_visibility) {
+@@ -578,8 +578,8 @@ void RenderWidgetHostViewAura::ShowImpl(PageVisibilityState page_visibility) {
    // OnShowWithPageVisibility will not call NotifyHostAndDelegateOnWasShown,
    // which updates `visibility_`, unless the host is hidden. Make sure no update
    // is needed.
--  CHECK(host_->IsHidden() || visibility_ == Visibility::VISIBLE);
+-  CHECK(host_->is_hidden() || visibility_ == Visibility::VISIBLE);
 -  OnShowWithPageVisibility(page_visibility);
-+  if (host_->IsHidden() || visibility_ == Visibility::VISIBLE)
++  if (host_->is_hidden() || visibility_ == Visibility::VISIBLE)
 +    OnShowWithPageVisibility(page_visibility);
  }
  
  void RenderWidgetHostViewAura::EnsurePlatformVisibility(
 diff --git a/content/public/browser/render_view_host.h b/content/public/browser/render_view_host.h
-index 782bed0fdc08d57eceb059f398f253fab9233b1b..f1ab5b981ea68af1b11313e67f2c5060f0a640b1 100644
+index a599bc306198de0e172134ce4623b32b8fcd72fa..4960c518d49f98b39873d166597bfb4b5619ee02 100644
 --- a/content/public/browser/render_view_host.h
 +++ b/content/public/browser/render_view_host.h
-@@ -73,6 +73,9 @@ class CONTENT_EXPORT RenderViewHost {
+@@ -74,6 +74,9 @@ class CONTENT_EXPORT RenderViewHost {
    virtual void WriteIntoTrace(
        perfetto::TracedProto<TraceProto> context) const = 0;
  
@@ -80,34 +80,34 @@ index 782bed0fdc08d57eceb059f398f253fab9233b1b..f1ab5b981ea68af1b11313e67f2c5060
    // This interface should only be implemented inside content.
    friend class RenderViewHostImpl;
 diff --git a/content/test/test_page_broadcast.h b/content/test/test_page_broadcast.h
-index 4c8d44cdb2fde8e174b78aee7defb980651da18e..f8bf421b5b32af4cd197cbf23f4bd281c3a12514 100644
+index 82ae7ab6279427e492ead6d1d386608eb9d3d844..2b79149bfcc0de968ffb45e310d697c5393f0d43 100644
 --- a/content/test/test_page_broadcast.h
 +++ b/content/test/test_page_broadcast.h
-@@ -52,6 +52,7 @@ class TestPageBroadcast : public blink::mojom::PageBroadcast {
-   void UpdateColorProviders(
+@@ -53,6 +53,7 @@ class TestPageBroadcast : public blink::mojom::PageBroadcast {
        const blink::ColorProviderColorMaps& color_provider_colors) override;
-   void SetSupportsDraggableRegions(bool supports_draggable_regions) override;
+   void UpdateCanvasNoiseToken(
+       std::optional<blink::NoiseToken> canvas_noise_token) override;
 +  void SetSchedulerThrottling(bool allowed) override {}
  
    mojo::AssociatedReceiver<blink::mojom::PageBroadcast> receiver_;
  };
 diff --git a/third_party/blink/public/mojom/page/page.mojom b/third_party/blink/public/mojom/page/page.mojom
-index b00bc8a8a5044fbf46f627f9db56cea7f09d7ef6..114c3a4522d11c1348f681af500c487ccd97eea9 100644
+index e7be05ec6dc5f517b4a6f849a262d12dc6c1ca3d..5f4f425c77c8aadf269edfaec658a8d2ad74b2cd 100644
 --- a/third_party/blink/public/mojom/page/page.mojom
 +++ b/third_party/blink/public/mojom/page/page.mojom
-@@ -180,4 +180,7 @@ interface PageBroadcast {
-   // Indicates that the page's main frame should collect draggable regions set
-   // using the app-region CSS property.
-   SetSupportsDraggableRegions(bool supports_draggable_regions);
+@@ -182,4 +182,7 @@ interface PageBroadcast {
+   // the noise token at ReadyToCommit time and update blink::WebViews that
+   // were made at request time.
+   UpdateCanvasNoiseToken(blink.mojom.NoiseToken? canvas_noise_token);
 +
 +  // Whether to enable the Renderer scheduler background throttling.
 +  SetSchedulerThrottling(bool allowed);
  };
 diff --git a/third_party/blink/public/web/web_view.h b/third_party/blink/public/web/web_view.h
-index 7f995dc1fab7a1b5319f6fe9bb4d37b3851dbf87..58c93c5acf9f63eb3391fafe2904b20284381a85 100644
+index 9c0fe6ad62872f05cfb1179b4b979139008976d2..6aca43e61ef7f1caea74c30e5c3ce4496d4c4188 100644
 --- a/third_party/blink/public/web/web_view.h
 +++ b/third_party/blink/public/web/web_view.h
-@@ -361,6 +361,7 @@ class BLINK_EXPORT WebView {
+@@ -366,6 +366,7 @@ class BLINK_EXPORT WebView {
    // Scheduling -----------------------------------------------------------
  
    virtual PageScheduler* Scheduler() const = 0;
@@ -116,10 +116,10 @@ index 7f995dc1fab7a1b5319f6fe9bb4d37b3851dbf87..58c93c5acf9f63eb3391fafe2904b202
    // Visibility -----------------------------------------------------------
  
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index 2bb50e492558f0130918717605bf48b8a61f1e14..b50e4805af36aa96c0ce69359adcf1b18d80c62a 100644
+index c542810213430164308d8cde71130b0b337996b4..bd09aa1967d04e0be240de38aabdaa9d74f60336 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
-@@ -2499,6 +2499,10 @@ void WebViewImpl::SetPageLifecycleStateInternal(
+@@ -2507,6 +2507,10 @@ void WebViewImpl::SetPageLifecycleStateInternal(
    TRACE_EVENT2("navigation", "WebViewImpl::SetPageLifecycleStateInternal",
                 "old_state", old_state, "new_state", new_state);
  
@@ -130,7 +130,7 @@ index 2bb50e492558f0130918717605bf48b8a61f1e14..b50e4805af36aa96c0ce69359adcf1b1
    bool storing_in_bfcache = new_state->is_in_back_forward_cache &&
                              !old_state->is_in_back_forward_cache;
    bool restoring_from_bfcache = !new_state->is_in_back_forward_cache &&
-@@ -4007,10 +4011,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
+@@ -4019,10 +4023,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
    return GetPage()->GetPageScheduler();
  }
  
@@ -155,10 +155,10 @@ index 2bb50e492558f0130918717605bf48b8a61f1e14..b50e4805af36aa96c0ce69359adcf1b1
    // Do not throttle if the page should be painting.
    bool is_visible =
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.h b/third_party/blink/renderer/core/exported/web_view_impl.h
-index 881e561c0b4c55e30f6b4f69bcbbe092cc449fd1..9afced261ae85244f99dac4372fb7b1c3eabfbaa 100644
+index 83e4be6692496d1d05dcd4110009c68763683128..f8deed2f22387c5dcc35d93c7b45ba54a77625e5 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.h
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.h
-@@ -447,6 +447,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,
+@@ -452,6 +452,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,
    LocalDOMWindow* PagePopupWindow() const;
  
    PageScheduler* Scheduler() const override;
@@ -166,7 +166,7 @@ index 881e561c0b4c55e30f6b4f69bcbbe092cc449fd1..9afced261ae85244f99dac4372fb7b1c
    void SetVisibilityState(mojom::blink::PageVisibilityState visibility_state,
                            bool is_initial_state) override;
    mojom::blink::PageVisibilityState GetVisibilityState() override;
-@@ -939,6 +940,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
+@@ -945,6 +946,8 @@ class CORE_EXPORT WebViewImpl final : public WebView,
    // If true, we send IPC messages when |preferred_size_| changes.
    bool send_preferred_size_changes_ = false;
  

patches/chromium/allow_electron_to_depend_on_components_os_crypt_sync.patch

@@ -10,7 +10,7 @@ so we can remove this patch once we migrate our code to use
 os_crypt async.
 
 diff --git a/components/os_crypt/sync/BUILD.gn b/components/os_crypt/sync/BUILD.gn
-index 23aa391aaf380f87310fb295277809f8b105d6e8..bb308187837371ecfa2482affaf35ac7ed98c1f3 100644
+index 81fc444043b67858371142075f98ad9aff162fc3..7ab1c6d1422e19afa603d9b3eeeb30044fb9c7b3 100644
 --- a/components/os_crypt/sync/BUILD.gn
 +++ b/components/os_crypt/sync/BUILD.gn
 @@ -10,6 +10,7 @@ import("//components/os_crypt/sync/features.gni")
@@ -19,5 +19,5 @@ index 23aa391aaf380f87310fb295277809f8b105d6e8..bb308187837371ecfa2482affaf35ac7
    visibility = [
 +    "//electron:*",
      "//chrome/browser",
-     "//chrome/test:test_support",
-     "//components/os_crypt/async/browser:dpapi_key_provider",
+     "//chrome/browser/prefs:impl",
+     "//chrome/browser/ui",

patches/chromium/allow_in-process_windows_to_have_different_web_prefs.patch

@@ -8,10 +8,10 @@ WebPreferences of in-process child windows, rather than relying on
 process-level command line switches, as before.
 
 diff --git a/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc b/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
-index 42005e4758187331909b87f82e6e008a03a14f7f..f76615d34483b3485d7729889d0a895d13961f57 100644
+index c0362530043cdaffc008d0c90d55cb9522db1557..3eb37d797feccdbb2a9d4b4f26e222b6f837b802 100644
 --- a/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
 +++ b/third_party/blink/common/web_preferences/web_preferences_mojom_traits.cc
-@@ -150,6 +150,19 @@ bool StructTraits<blink::mojom::WebPreferencesDataView,
+@@ -148,6 +148,19 @@ bool StructTraits<blink::mojom::WebPreferencesDataView,
    out->v8_cache_options = data.v8_cache_options();
    out->record_whole_document = data.record_whole_document();
    out->stylus_handwriting_enabled = data.stylus_handwriting_enabled();
@@ -32,7 +32,7 @@ index 42005e4758187331909b87f82e6e008a03a14f7f..f76615d34483b3485d7729889d0a895d
    out->accelerated_video_decode_enabled =
        data.accelerated_video_decode_enabled();
 diff --git a/third_party/blink/public/common/web_preferences/web_preferences.h b/third_party/blink/public/common/web_preferences/web_preferences.h
-index c1f0a4cae029527f9ea966b53fea2faa31c4cd90..e2bfc5356fc824b79231775ad85a45c6634093f7 100644
+index 30572628d5d221e58159391f6bfd8e01525291bd..6020cce84810b9515298b65880091ebb97559688 100644
 --- a/third_party/blink/public/common/web_preferences/web_preferences.h
 +++ b/third_party/blink/public/common/web_preferences/web_preferences.h
 @@ -9,6 +9,7 @@
@@ -43,8 +43,8 @@ index c1f0a4cae029527f9ea966b53fea2faa31c4cd90..e2bfc5356fc824b79231775ad85a45c6
  #include "build/build_config.h"
  #include "net/nqe/effective_connection_type.h"
  #include "third_party/blink/public/common/common_export.h"
-@@ -461,6 +462,19 @@ struct BLINK_COMMON_EXPORT WebPreferences {
-   bool should_screenshot_on_mainframe_same_doc_navigation = true;
+@@ -464,6 +465,19 @@ struct BLINK_COMMON_EXPORT WebPreferences {
+   bool increment_local_surface_id_for_mainframe_same_doc_navigation = true;
  #endif  // BUILDFLAG(IS_ANDROID)
  
 +  // Begin Electron-specific WebPreferences.
@@ -64,7 +64,7 @@ index c1f0a4cae029527f9ea966b53fea2faa31c4cd90..e2bfc5356fc824b79231775ad85a45c6
    // chrome, except for the cases where it would require lots of extra work for
    // the embedder to use the same default value.
 diff --git a/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h b/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
-index 3ab13439f0e03d1777ca78b638b98978d972bda5..c5f6f203d1ba36c3b1bb213d44b17adc472afbc4 100644
+index ccba9b7353c87d2e2bced7770920c976865c0d65..4d93ef8c1976cf533c32bc9c17dbf6b81f2b59c6 100644
 --- a/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
 +++ b/third_party/blink/public/common/web_preferences/web_preferences_mojom_traits.h
 @@ -8,6 +8,7 @@
@@ -75,7 +75,7 @@ index 3ab13439f0e03d1777ca78b638b98978d972bda5..c5f6f203d1ba36c3b1bb213d44b17adc
  #include "mojo/public/cpp/bindings/struct_traits.h"
  #include "net/nqe/effective_connection_type.h"
  #include "third_party/blink/public/common/common_export.h"
-@@ -439,6 +440,52 @@ struct BLINK_COMMON_EXPORT StructTraits<blink::mojom::WebPreferencesDataView,
+@@ -434,6 +435,52 @@ struct BLINK_COMMON_EXPORT StructTraits<blink::mojom::WebPreferencesDataView,
      return r.stylus_handwriting_enabled;
    }
  
@@ -129,18 +129,22 @@ index 3ab13439f0e03d1777ca78b638b98978d972bda5..c5f6f203d1ba36c3b1bb213d44b17adc
      return r.cookie_enabled;
    }
 diff --git a/third_party/blink/public/mojom/webpreferences/web_preferences.mojom b/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
-index 8b8f9837a5efd984ea1bd7b7b0c9462f65f5ac7e..7a3ccc78fc82181e1e9da9004305a827a80ed745 100644
+index 9827715ad3cd306a0ec18fb6b2936ecf8677af21..66cbaf3a5b19a38295cad04d0e978de417984370 100644
 --- a/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
 +++ b/third_party/blink/public/mojom/webpreferences/web_preferences.mojom
-@@ -4,6 +4,7 @@
- 
- module blink.mojom;
- 
+@@ -8,9 +8,11 @@ import "third_party/blink/public/mojom/css/preferred_color_scheme.mojom";
+ import "third_party/blink/public/mojom/css/preferred_contrast.mojom";
+ import "third_party/blink/public/mojom/v8_cache_options.mojom";
+ import "url/mojom/url.mojom";
 +import "mojo/public/mojom/base/file_path.mojom";
  import "mojo/public/mojom/base/string16.mojom";
  import "skia/public/mojom/skcolor.mojom";
- import "third_party/blink/public/mojom/css/preferred_color_scheme.mojom";
-@@ -224,6 +225,19 @@ struct WebPreferences {
+ 
++
+ enum PointerType {
+   kPointerNone                              = 1,             // 1 << 0
+   kPointerFirstType                         = kPointerNone,
+@@ -217,6 +219,19 @@ struct WebPreferences {
    // If true, stylus handwriting recognition to text input will be available in
    // editable input fields which are non-password type.
    bool stylus_handwriting_enabled;

patches/chromium/blink_local_frame.patch

@@ -15,7 +15,7 @@ Refs changes in:
 This patch reverts the changes to fix associated crashes in Electron.
 
 diff --git a/third_party/blink/renderer/core/frame/frame.cc b/third_party/blink/renderer/core/frame/frame.cc
-index 2670ea1361ccd8a9e3bac507e94dd25b7205ecf9..c12f78d925e4ccb4ac2fd3851a9c61e87058dc75 100644
+index cdb5b9246087b5678cf6a0f2713f6238dafc13de..7efbe7524c5ddd3785fff0e2d8901f931f024f48 100644
 --- a/third_party/blink/renderer/core/frame/frame.cc
 +++ b/third_party/blink/renderer/core/frame/frame.cc
 @@ -134,14 +134,6 @@ bool Frame::Detach(FrameDetachType type) {
@@ -49,10 +49,10 @@ index 2670ea1361ccd8a9e3bac507e94dd25b7205ecf9..c12f78d925e4ccb4ac2fd3851a9c61e8
    // its owning reference back to our owning LocalFrame.
    client_->Detached(type);
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
-index ad61f3b044e8ce7591cfe7484af8e3b0c7705673..f42b5f8c7676cda5d73ee035e18165acabb186f3 100644
+index dc1464afab92e4148d8c61f2098d5172e236651b..e96fca375fc3eb2504dd6f82e5be2c025d23089e 100644
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
-@@ -747,10 +747,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
+@@ -746,10 +746,6 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
    }
    DCHECK(!view_ || !view_->IsAttached());
  
@@ -63,7 +63,7 @@ index ad61f3b044e8ce7591cfe7484af8e3b0c7705673..f42b5f8c7676cda5d73ee035e18165ac
    if (!Client())
      return false;
  
-@@ -804,6 +800,11 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
+@@ -803,6 +799,11 @@ bool LocalFrame::DetachImpl(FrameDetachType type) {
    DCHECK(!view_->IsAttached());
    Client()->WillBeDetached();
  

patches/chromium/build_add_electron_tracing_category.patch

@@ -8,10 +8,10 @@ categories in use are known / declared.  This patch is required for us
 to introduce a new Electron category for Electron-specific tracing.
 
 diff --git a/base/trace_event/builtin_categories.h b/base/trace_event/builtin_categories.h
-index 404faaae45884e2347fb3a7a2d77c7b95c7f6b43..e63bfce2d65a2015993de91630928029288738f4 100644
+index 192eee833064a9aafeb9411a2a797d988484ce34..96abc3617810426a6a4c4ac9511a329fc276dca2 100644
 --- a/base/trace_event/builtin_categories.h
 +++ b/base/trace_event/builtin_categories.h
-@@ -131,6 +131,7 @@ PERFETTO_DEFINE_CATEGORIES_IN_NAMESPACE_WITH_ATTRS(
+@@ -128,6 +128,7 @@ PERFETTO_DEFINE_CATEGORIES_IN_NAMESPACE_WITH_ATTRS(
      perfetto::Category("drm"),
      perfetto::Category("drmcursor"),
      perfetto::Category("dwrite"),

patches/chromium/build_allow_electron_mojom_interfaces_to_depend_on_blink.patch

@@ -10,7 +10,7 @@ Needed for:
 2) //electron/shell/common:web_contents_utility
 
 diff --git a/content/public/common/BUILD.gn b/content/public/common/BUILD.gn
-index e463b4c63105d021da2467844c8371eec6b8a836..bd81d75d735f997bf6aa9133e142b50759084b47 100644
+index 8e91c465c68bec818253820ecaeeb7c3feb180a2..fea8bb9f87c007775a2bb6e1abe1ec498a8b19b4 100644
 --- a/content/public/common/BUILD.gn
 +++ b/content/public/common/BUILD.gn
 @@ -371,6 +371,8 @@ mojom("interfaces") {

patches/chromium/build_disable_thin_lto_mac.patch

@@ -11,7 +11,7 @@ This patch can (and should) be removed when we can prevent those symbols
 from being stripped in the release build.
 
 diff --git a/build/config/compiler/compiler.gni b/build/config/compiler/compiler.gni
-index 2cf6def300d9d92d476ca4ca792347a49bafc26a..8e54f1d3e50a2c56b0cf35a8e56f97f6622401d5 100644
+index 21bd22896d7bca4d4a133677286f7f8ad1b224f2..53654e4467fa4ae57ce42bd971b1be3a11654aaf 100644
 --- a/build/config/compiler/compiler.gni
 +++ b/build/config/compiler/compiler.gni
 @@ -85,7 +85,7 @@ declare_args() {

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -11,10 +11,10 @@ if we ever align our .pak file generation with Chrome we can remove this
 patch.
 
 diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
-index c51468e6fdb46634b5458b387d1c78caf2dd083f..7236611d2a392008f43b1b83ae125e945673f31c 100644
+index 9bffa9c8272a81059eb05fa79107bb326029402c..d286e9ab4edf86570418d4b3699c8f2d720597e5 100644
 --- a/chrome/BUILD.gn
 +++ b/chrome/BUILD.gn
-@@ -196,11 +196,16 @@ if (!is_android && !is_mac) {
+@@ -197,11 +197,16 @@ if (!is_android && !is_mac) {
          "common/crash_keys.h",
        ]
  
@@ -33,10 +33,10 @@ index c51468e6fdb46634b5458b387d1c78caf2dd083f..7236611d2a392008f43b1b83ae125e94
          "//base",
          "//build:branding_buildflags",
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index c3e8b9a6d64f4c278fc478cbb45c9cec6897faca..03ad5a81382bb01d62bfdc2279670345b37a7089 100644
+index 7280ef29b85c1b16b11dd9e4d628a9eb579bb4dd..ab56e29d402a400a8c91aa97b6e82ad70340b7fc 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -4816,7 +4816,7 @@ static_library("browser") {
+@@ -4824,7 +4824,7 @@ static_library("browser") {
        ]
      }
  
@@ -46,10 +46,10 @@ index c3e8b9a6d64f4c278fc478cbb45c9cec6897faca..03ad5a81382bb01d62bfdc2279670345
        # than here in :chrome_dll.
        deps += [ "//chrome:packed_resources_integrity_header" ]
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index b1fcad8d0580e3e37036599e758a2cb84a6cf055..bcbf93a6229b6358164a0b9a3c8fee14be2e20d4 100644
+index d8978eb678048850cc0e629d0c978f23417b5be9..219c9ae3dde4f2239b5c1331b99c8f2e9a170628 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -7593,9 +7593,12 @@ test("unit_tests") {
+@@ -7571,9 +7571,12 @@ test("unit_tests") {
        "//chrome/notification_helper",
      ]
  
@@ -63,7 +63,7 @@ index b1fcad8d0580e3e37036599e758a2cb84a6cf055..bcbf93a6229b6358164a0b9a3c8fee14
        "//chrome//services/util_win:unit_tests",
        "//chrome/app:chrome_dll_resources",
        "//chrome/app:win_unit_tests",
-@@ -8530,6 +8533,10 @@ test("unit_tests") {
+@@ -8500,6 +8503,10 @@ test("unit_tests") {
        "../browser/performance_manager/policies/background_tab_loading_policy_unittest.cc",
      ]
  
@@ -74,7 +74,7 @@ index b1fcad8d0580e3e37036599e758a2cb84a6cf055..bcbf93a6229b6358164a0b9a3c8fee14
      sources += [
        # The importer code is not used on Android.
        "../common/importer/firefox_importer_utils_unittest.cc",
-@@ -8586,7 +8593,6 @@ test("unit_tests") {
+@@ -8556,7 +8563,6 @@ test("unit_tests") {
      # TODO(crbug.com/417513088): Maybe merge with the non-android `deps` declaration above?
      deps += [
        "../browser/screen_ai:screen_ai_install_state",

patches/chromium/build_gn.patch

@@ -7,7 +7,7 @@ These are variables we add to the root BUILDCONFIG so that they're available
 everywhere, without having to import("//electron/.../flags.gni").
 
 diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
-index 69f7eb1ac466fbd4e528e3cf2e4e2f96e622424f..05f540daf67de55c09befa81b487a8fb9c45e751 100644
+index 24a1d143954ae05ae0b79b0994b76ef9218fb848..5c9b2ed8ba48a1056560ca1cd1d5b976aee4815c 100644
 --- a/build/config/BUILDCONFIG.gn
 +++ b/build/config/BUILDCONFIG.gn
 @@ -123,6 +123,9 @@ if (current_os == "") {

patches/chromium/build_libc_as_static_library.patch

@@ -7,7 +7,7 @@ Build libc++ as static library to compile and pass
 nan tests
 
 diff --git a/buildtools/third_party/libc++/BUILD.gn b/buildtools/third_party/libc++/BUILD.gn
-index f1ac049db7df5637c94893009287b53c6127158f..ebf028bdb2934ca2f9f2ab7b7c3e6d3daa544d37 100644
+index c0c6cfb94338c6a75010e1b5de4cb6323b5afd12..903a5a0d9f7b7a7f9f4c44ef69e85eb922569365 100644
 --- a/buildtools/third_party/libc++/BUILD.gn
 +++ b/buildtools/third_party/libc++/BUILD.gn
 @@ -481,6 +481,7 @@ target(libcxx_target_type, "libc++") {

patches/chromium/build_run_reclient_cfg_generator_after_chrome.patch

@@ -20,10 +20,10 @@ index 17103061c4752e6fcac07413dbf574e0c6fd6d39..848be71fa6dc81a64b7274b31d461f9d
  /win-cross/
  reproxy.cfg
 diff --git a/buildtools/reclient_cfgs/configure_reclient_cfgs.py b/buildtools/reclient_cfgs/configure_reclient_cfgs.py
-index 8779d4609c9eed155c414a1c97d3598906857b22..731ac034f85c8c5ebee6d29a0395f6e828b41ab0 100755
+index 128bda296c91eac5f0c2fcfeed0c553deb5514dd..f1e33d36810dba80a42608655beb27c6e197a888 100755
 --- a/buildtools/reclient_cfgs/configure_reclient_cfgs.py
 +++ b/buildtools/reclient_cfgs/configure_reclient_cfgs.py
-@@ -334,4 +334,13 @@ def main():
+@@ -344,4 +344,13 @@ def main():
  
  
  if __name__ == "__main__":

patches/chromium/build_set_mac_sdk_minimum_to_10.patch

@@ -0,0 +1,26 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Keeley Hammond <khammond@slack-corp.com>
+Date: Tue, 1 Jul 2025 15:40:02 -0700
+Subject: build: Set MacOS SDK minimum back to 10
+
+This commit reverts 6493969: Update mac_sdk_min to
+match minimum required SDK version |
+https://chromium-review.googlesource.com/c/chromium/src/+/6493969
+
+This patch is purely to unblock nightlies while
+we merge an upstream fix and allocate additional space
+on the Mac runners. If this patch is still in main
+anytime after July 30, 2025, find @VerteDinde and yell
+at her.
+
+diff --git a/build/config/mac/mac_sdk_overrides.gni b/build/config/mac/mac_sdk_overrides.gni
+index 8f8ac1c218ce15fa5c1aecbbcd0b93281f6c52f2..15ddfd5cffbaba0704b3217e1ae4f2825f399d96 100644
+--- a/build/config/mac/mac_sdk_overrides.gni
++++ b/build/config/mac/mac_sdk_overrides.gni
+@@ -7,5 +7,5 @@
+ 
+ declare_args() {
+   # Minimum supported version of the Mac SDK.
+-  mac_sdk_min = "15"
++  mac_sdk_min = "10.15"
+ }

patches/chromium/can_create_window.patch

@@ -9,10 +9,10 @@ potentially prevent a window from being created.
 TODO(loc): this patch is currently broken.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index 289545aae997d5a1458a063e38832484e2f8a11e..5f973dba78748ba2aeaab377534e9866d96a44fe 100644
+index 59c9498a6d42b3fcc3920043a20988f72f7dab5e..afdf8582ae3056e90bfe97727d3632357e6ada13 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -9962,6 +9962,7 @@ void RenderFrameHostImpl::CreateNewWindow(
+@@ -9862,6 +9862,7 @@ void RenderFrameHostImpl::CreateNewWindow(
            last_committed_origin_, params->window_container_type,
            params->target_url, params->referrer.To<Referrer>(),
            params->frame_name, params->disposition, *params->features,
@@ -21,10 +21,10 @@ index 289545aae997d5a1458a063e38832484e2f8a11e..5f973dba78748ba2aeaab377534e9866
            &no_javascript_access);
  
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 5aa061cd96f291eb955892363180e412c495f1d6..f208b31c5e39cb8c4e5e50ed3dd236bdc266baa5 100644
+index b014cd48c9997303e15fc99f2c8370ea044f413c..5d464141ea2e0ef23f37fe262f288b3678501330 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -5356,6 +5356,10 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5323,6 +5323,10 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    create_params.initially_hidden = renderer_started_hidden;
    create_params.initial_popup_url = params.target_url;
  
@@ -35,7 +35,7 @@ index 5aa061cd96f291eb955892363180e412c495f1d6..f208b31c5e39cb8c4e5e50ed3dd236bd
    // Even though all codepaths leading here are in response to a renderer
    // trying to open a new window, if the new window ends up in a different
    // browsing instance, then the RenderViewHost, RenderWidgetHost,
-@@ -5410,6 +5414,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5377,6 +5381,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    // Sets the newly created WebContents WindowOpenDisposition.
    new_contents_impl->original_window_open_disposition_ = params.disposition;
  
@@ -48,7 +48,7 @@ index 5aa061cd96f291eb955892363180e412c495f1d6..f208b31c5e39cb8c4e5e50ed3dd236bd
    // If the new frame has a name, make sure any SiteInstances that can find
    // this named frame have proxies for it.  Must be called after
    // SetSessionStorageNamespace, since this calls CreateRenderView, which uses
-@@ -5451,12 +5461,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5418,12 +5428,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
      AddWebContentsDestructionObserver(new_contents_impl);
    }
  
@@ -62,10 +62,10 @@ index 5aa061cd96f291eb955892363180e412c495f1d6..f208b31c5e39cb8c4e5e50ed3dd236bd
                               new_contents_impl, opener, params.target_url,
                               params.referrer.To<Referrer>(), params.disposition,
 diff --git a/content/common/frame.mojom b/content/common/frame.mojom
-index 599077542beacefc94f9e7ce6167312c9d66aaae..389896afb982dd0fc48274857c18fcd98337b1fc 100644
+index 15a83f61ed4e31ba34cbc19995cd9d68b1599f1d..9cf9fefad46a6c2ead4085adc76e0c07369f641a 100644
 --- a/content/common/frame.mojom
 +++ b/content/common/frame.mojom
-@@ -653,6 +653,10 @@ struct CreateNewWindowParams {
+@@ -662,6 +662,10 @@ struct CreateNewWindowParams {
    pending_associated_remote<blink.mojom.Widget> widget;
    pending_associated_receiver<blink.mojom.FrameWidgetHost> frame_widget_host;
    pending_associated_remote<blink.mojom.FrameWidget> frame_widget;
@@ -77,10 +77,10 @@ index 599077542beacefc94f9e7ce6167312c9d66aaae..389896afb982dd0fc48274857c18fcd9
  
  // Operation result when the renderer asks the browser to create a new window.
 diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
-index 928667b4308ace9b6b6f7d1a9479a1107b061034..eaaa92a4b6dba03422838b8e83364dc8716ba6db 100644
+index 68bafbcd65301fd26f18e433057d69ae9d63a078..8a199da3b79672d900efa3ae2a721ef74481d7fc 100644
 --- a/content/public/browser/content_browser_client.cc
 +++ b/content/public/browser/content_browser_client.cc
-@@ -883,6 +883,8 @@ bool ContentBrowserClient::CanCreateWindow(
+@@ -875,6 +875,8 @@ bool ContentBrowserClient::CanCreateWindow(
      const std::string& frame_name,
      WindowOpenDisposition disposition,
      const blink::mojom::WindowFeatures& features,
@@ -90,10 +90,10 @@ index 928667b4308ace9b6b6f7d1a9479a1107b061034..eaaa92a4b6dba03422838b8e83364dc8
      bool opener_suppressed,
      bool* no_javascript_access) {
 diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
-index 4432cd1a9b0af50398409dbbcbdad80375f429e9..87c78abf57a26c83b153f2ac978024506a32a909 100644
+index 7658c8045ad4687ffc2923061ee8310bf76c1190..22b1bcac984a5f0e7140693a9c8ff586f12afe24 100644
 --- a/content/public/browser/content_browser_client.h
 +++ b/content/public/browser/content_browser_client.h
-@@ -202,6 +202,7 @@ class NetworkService;
+@@ -196,6 +196,7 @@ class NetworkService;
  class TrustedURLLoaderHeaderClient;
  }  // namespace mojom
  struct ResourceRequest;
@@ -101,7 +101,7 @@ index 4432cd1a9b0af50398409dbbcbdad80375f429e9..87c78abf57a26c83b153f2ac97802450
  }  // namespace network
  
  namespace sandbox {
-@@ -1460,6 +1461,8 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1448,6 +1449,8 @@ class CONTENT_EXPORT ContentBrowserClient {
        const std::string& frame_name,
        WindowOpenDisposition disposition,
        const blink::mojom::WindowFeatures& features,
@@ -111,7 +111,7 @@ index 4432cd1a9b0af50398409dbbcbdad80375f429e9..87c78abf57a26c83b153f2ac97802450
        bool opener_suppressed,
        bool* no_javascript_access);
 diff --git a/content/public/browser/web_contents_delegate.cc b/content/public/browser/web_contents_delegate.cc
-index edee20df7f5bb087df9c134c7892f4befe2f14b9..df972f1ce594f2d4651202b650ff2d41fe19ecd0 100644
+index 87e310a5473bec20b1326f3202cf2bf603227c04..968cddc769e2bf0bb56359b36bc03cbce6539da1 100644
 --- a/content/public/browser/web_contents_delegate.cc
 +++ b/content/public/browser/web_contents_delegate.cc
 @@ -34,6 +34,17 @@ namespace content {
@@ -133,7 +133,7 @@ index edee20df7f5bb087df9c134c7892f4befe2f14b9..df972f1ce594f2d4651202b650ff2d41
      WebContents* source,
      const OpenURLParams& params,
 diff --git a/content/public/browser/web_contents_delegate.h b/content/public/browser/web_contents_delegate.h
-index 0c3d4f8ed4df5ca8d9db5424fa2be2d26510c4c9..98492cff13c97388d001fc33cc948261990edef1 100644
+index 9af778e87c14920ae146f115740c9a5400c7879a..bf5169e7a79e74309ff592252914ec012e4178c5 100644
 --- a/content/public/browser/web_contents_delegate.h
 +++ b/content/public/browser/web_contents_delegate.h
 @@ -18,6 +18,7 @@
@@ -152,7 +152,7 @@ index 0c3d4f8ed4df5ca8d9db5424fa2be2d26510c4c9..98492cff13c97388d001fc33cc948261
  #include "content/public/common/window_container_type.mojom-forward.h"
  #include "third_party/blink/public/common/input/web_mouse_event.h"
  #include "third_party/blink/public/common/mediastream/media_stream_request.h"
-@@ -385,6 +387,16 @@ class CONTENT_EXPORT WebContentsDelegate {
+@@ -388,6 +390,16 @@ class CONTENT_EXPORT WebContentsDelegate {
        const StoragePartitionConfig& partition_config,
        SessionStorageNamespace* session_storage_namespace);
  
@@ -170,10 +170,10 @@ index 0c3d4f8ed4df5ca8d9db5424fa2be2d26510c4c9..98492cff13c97388d001fc33cc948261
    // typically happens when popups are created.
    virtual void WebContentsCreated(WebContents* source_contents,
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index ab58f018ba8e4cee5a2cea45407333902f05f438..30c2972e1fbc21d382304897c542ecd7fa95b896 100644
+index 2aa5e359e44588948ce59c417686170328628df6..8603f912e83db5211f21701b2f08db07790ea4ba 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -6746,6 +6746,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
+@@ -6799,6 +6799,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
            request.HasUserGesture(), GetWebFrame()->IsAdFrame(),
            GetWebFrame()->IsAdScriptInStack());
  
@@ -185,10 +185,10 @@ index ab58f018ba8e4cee5a2cea45407333902f05f438..30c2972e1fbc21d382304897c542ecd7
    // moved on send.
    bool is_background_tab =
 diff --git a/content/web_test/browser/web_test_content_browser_client.cc b/content/web_test/browser/web_test_content_browser_client.cc
-index 576fd50ec4c27c6c2da9674e68f65fd0a21d1d68..b44304f128fb97523c9c9046b5edece8c09c5c0f 100644
+index 66a10226b043a490295e518230c20bba0ed71d6c..14b78014d93ce459789fd497dfcfb71e2cc769bd 100644
 --- a/content/web_test/browser/web_test_content_browser_client.cc
 +++ b/content/web_test/browser/web_test_content_browser_client.cc
-@@ -538,6 +538,8 @@ bool WebTestContentBrowserClient::CanCreateWindow(
+@@ -537,6 +537,8 @@ bool WebTestContentBrowserClient::CanCreateWindow(
      const std::string& frame_name,
      WindowOpenDisposition disposition,
      const blink::mojom::WindowFeatures& features,
@@ -232,10 +232,10 @@ index 82e9d3dfb5f7da76d89fe15ae61d379fa46e177d..fd035512099a54dff6cc951a2226c23a
  
  }  // namespace blink
 diff --git a/third_party/blink/renderer/core/frame/local_dom_window.cc b/third_party/blink/renderer/core/frame/local_dom_window.cc
-index 04c6dad1650273f15d60f8ad6bf51ca771f77923..ae64f6f689bdaa1221634b2b434e62c52aa9084f 100644
+index 0dcd971d7176e45ae24112f015e69868fc2cd247..2f757adca556d6a038cba0c1f13265eaf1a41ec4 100644
 --- a/third_party/blink/renderer/core/frame/local_dom_window.cc
 +++ b/third_party/blink/renderer/core/frame/local_dom_window.cc
-@@ -2340,6 +2340,8 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
+@@ -2363,6 +2363,8 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
    WebWindowFeatures window_features =
        GetWindowFeaturesFromString(features, entered_window);
  

patches/chromium/chore_add_electron_objects_to_wrappablepointertag.patch

@@ -8,21 +8,18 @@ electron objects that extend gin::Wrappable and gets
 allocated on the cpp heap
 
 diff --git a/gin/public/wrappable_pointer_tags.h b/gin/public/wrappable_pointer_tags.h
-index 82fc9e311ec84b19a15818a501b3a29329eff004..1199be7426139cdc77cee2e620eb8427092c74dd 100644
+index a507d1d837ab3ec2b2d3ae7978d9d410ab2ec2d1..701b2de3c1a64dea94b752045c145aeda6dde3d7 100644
 --- a/gin/public/wrappable_pointer_tags.h
 +++ b/gin/public/wrappable_pointer_tags.h
-@@ -74,7 +74,13 @@ enum WrappablePointerTag : uint16_t {
+@@ -72,7 +72,10 @@ enum WrappablePointerTag : uint16_t {
    kTextInputControllerBindings,  // content::TextInputControllerBindings
    kWebAXObjectProxy,             // content::WebAXObjectProxy
    kWrappedExceptionHandler,      // extensions::WrappedExceptionHandler
 -  kLastPointerTag = kWrappedExceptionHandler,
 +  kElectronApp,                         // electron::api::App
-+  kElectronDebugger,                    // electron::api::Debugger
-+  kElectronEvent,                       // gin_helper::internal::Event
-+  kElectronMenu,                        // electron::api::Menu
-+  kElectronNetLog,                      // electron::api::NetLog
 +  kElectronSession,                     // electron::api::Session
-+  kLastPointerTag = kElectronSession,
++  kElectronEvent,                       // gin_helper::internal::Event
++  kLastPointerTag = kElectronEvent,
  };
  
  static_assert(kLastPointerTag <

patches/chromium/chore_expose_isolate_parameter_in_script_lifecycle_observers.patch

@@ -8,7 +8,7 @@ where callsites that deal with multiple contexts need to distinguish
 the current isolate.
 
 diff --git a/content/public/renderer/content_renderer_client.h b/content/public/renderer/content_renderer_client.h
-index 1c5a9e693fd3b09213118fb32e4509e1d4a59364..921b7bb4b817ed753e08c2c058a23a2ccdaef40e 100644
+index 79d59c3f4d3d2d5ff39bd65ded489183247656a8..20b49742578ccf363738ee032228f30a4cd676ea 100644
 --- a/content/public/renderer/content_renderer_client.h
 +++ b/content/public/renderer/content_renderer_client.h
 @@ -398,6 +398,7 @@ class CONTENT_EXPORT ContentRendererClient {
@@ -20,10 +20,10 @@ index 1c5a9e693fd3b09213118fb32e4509e1d4a59364..921b7bb4b817ed753e08c2c058a23a2c
        int64_t service_worker_version_id,
        const GURL& service_worker_scope,
 diff --git a/content/public/renderer/render_frame_observer.h b/content/public/renderer/render_frame_observer.h
-index bbfac47a74f989482343c222b78f187b70297e4e..3677ca3345fbc775d139684a12fe36241827a729 100644
+index e9e88619c349d018abbf183b16339339c7fb29b6..e41d285960cb624127509349197f3bbdf8c92878 100644
 --- a/content/public/renderer/render_frame_observer.h
 +++ b/content/public/renderer/render_frame_observer.h
-@@ -143,7 +143,8 @@ class CONTENT_EXPORT RenderFrameObserver {
+@@ -141,7 +141,8 @@ class CONTENT_EXPORT RenderFrameObserver {
                                        int32_t world_id) {}
    virtual void DidInstallConditionalFeatures(v8::Local<v8::Context> context,
                                               int32_t world_id) {}
@@ -34,10 +34,10 @@ index bbfac47a74f989482343c222b78f187b70297e4e..3677ca3345fbc775d139684a12fe3624
    virtual void DidClearWindowObject() {}
    virtual void DidChangeScrollOffset() {}
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index 3f512dcaec9f1d8a1375277ab8c6649d69070a33..45c8978bf9a45c14b15436851cdab9ae3d958f25 100644
+index 4816cb344ee9474a663863a5c2668a112c299919..1cb892f37b0e3a626c84723120a408fe3ec5f4dd 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -4671,10 +4671,11 @@ void RenderFrameImpl::DidInstallConditionalFeatures(
+@@ -4706,10 +4706,11 @@ void RenderFrameImpl::DidInstallConditionalFeatures(
      observer.DidInstallConditionalFeatures(context, world_id);
  }
  
@@ -52,7 +52,7 @@ index 3f512dcaec9f1d8a1375277ab8c6649d69070a33..45c8978bf9a45c14b15436851cdab9ae
  
  void RenderFrameImpl::DidChangeScrollOffset() {
 diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
-index b3fd71b237c134853f796a1d8d803e4d28519d53..0b74cee0213daebef1e66d0abebd23787d764997 100644
+index 155d2c3d9ce02fa02a655abf8bf7dbb1f83553f3..e8b599dbc09b6c1913e361363856b3e0d7955945 100644
 --- a/content/renderer/render_frame_impl.h
 +++ b/content/renderer/render_frame_impl.h
 @@ -604,7 +604,8 @@ class CONTENT_EXPORT RenderFrameImpl
@@ -103,7 +103,7 @@ index 1f5e24bc38d6ced52e4773236522e9520efc6f6d..a22ca5968fce5e6a0c436ec9b40f0e2f
    void WillInitializeWorkerContext() override;
    void WillDestroyWorkerContext(v8::Local<v8::Context> context) override;
 diff --git a/extensions/renderer/dispatcher.cc b/extensions/renderer/dispatcher.cc
-index 7b5398b4199ce6df9e1c9624771a5444d7f07eb3..77f896aa6a53bf7d277b963fba54d623eed8068b 100644
+index 1f656b2b9137c9337c92a53a124ac412b5dedd67..7d919740b36175891e540af2e44b86e3189dbef7 100644
 --- a/extensions/renderer/dispatcher.cc
 +++ b/extensions/renderer/dispatcher.cc
 @@ -615,6 +615,7 @@ void Dispatcher::DidInitializeServiceWorkerContextOnWorkerThread(
@@ -167,10 +167,10 @@ index f96781a047056876b030581b539be0507acc3a1c..cd9be80be2500a001b1895c81ee597dd
    // Called when initial script evaluation finished for the main script.
    // |success| is true if the evaluation completed with no uncaught exception.
 diff --git a/third_party/blink/public/web/web_local_frame_client.h b/third_party/blink/public/web/web_local_frame_client.h
-index 4520c9edccf63bdb9e35bf3a99a8ddb39170da24..dd2c5bd50075c345262b05952ecf3f2aa300b6ff 100644
+index 52e8828d8fffaba8ab05436cb4d727595f18238a..6743653f5018c06d3e173aaacdca7275c6ec703f 100644
 --- a/third_party/blink/public/web/web_local_frame_client.h
 +++ b/third_party/blink/public/web/web_local_frame_client.h
-@@ -671,7 +671,8 @@ class BLINK_EXPORT WebLocalFrameClient {
+@@ -665,7 +665,8 @@ class BLINK_EXPORT WebLocalFrameClient {
                                               int32_t world_id) {}
  
    // WebKit is about to release its reference to a v8 context for a frame.
@@ -181,10 +181,10 @@ index 4520c9edccf63bdb9e35bf3a99a8ddb39170da24..dd2c5bd50075c345262b05952ecf3f2a
  
    // Geometry notifications ----------------------------------------------
 diff --git a/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc b/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc
-index 898d7caac98727210ac5780b576526a71ec5a5aa..3fdd5b3c41fd8d5dc920bed710dc10741e7e7423 100644
+index 2e8653654686f4fc775288f059ff27daa38e02d5..b0e061525f442952e5f8a90fed7002830dbb4bc3 100644
 --- a/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc
 +++ b/third_party/blink/renderer/bindings/core/v8/local_window_proxy.cc
-@@ -109,11 +109,12 @@ void LocalWindowProxy::DisposeContext(Lifecycle next_status,
+@@ -108,11 +108,12 @@ void LocalWindowProxy::DisposeContext(Lifecycle next_status,
  
    ScriptState::Scope scope(script_state_);
    v8::Local<v8::Context> context = script_state_->GetContext();
@@ -214,10 +214,10 @@ index 8d73ddb12013ce195026b9f63050cf33f0bfb0fd..078f0e67e8de6a05178e8e2410f61784
    virtual bool AllowScriptExtensions() = 0;
  
 diff --git a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
-index 11475d1a22054a884f2f1e7e5c933e9ae8d3379f..8d260dead59d366148983a1739b5252fa59b862a 100644
+index 1aacf6f66b543a4ede6ab5d885143dd4a0821e8a..c695d942e295d9137a284e5536a10d49a055bbf4 100644
 --- a/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame_client_impl.cc
-@@ -308,10 +308,11 @@ void LocalFrameClientImpl::DidInstallConditionalFeatures(
+@@ -303,10 +303,11 @@ void LocalFrameClientImpl::DidInstallConditionalFeatures(
  }
  
  void LocalFrameClientImpl::WillReleaseScriptContext(
@@ -245,10 +245,10 @@ index 16066fe34ee0335a0dabe00b6890e5844349c0b5..cc84479f65bdbe56cb4b38bfcef0d752
  
    // Returns true if we should allow register V8 extensions to be added.
 diff --git a/third_party/blink/renderer/core/loader/empty_clients.h b/third_party/blink/renderer/core/loader/empty_clients.h
-index d46f3b764f653c990e57fb2c67121c8fd6b1b115..fe30a119d9befbde7c461637cf670a4b861efe05 100644
+index d8f3b11c98fd58baa9995762a29847b9fd760c84..5a9c9356a2098dfa9d28a5d30b19b492463216c8 100644
 --- a/third_party/blink/renderer/core/loader/empty_clients.h
 +++ b/third_party/blink/renderer/core/loader/empty_clients.h
-@@ -426,7 +426,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {
+@@ -422,7 +422,8 @@ class CORE_EXPORT EmptyLocalFrameClient : public LocalFrameClient {
                                int32_t world_id) override {}
    void DidInstallConditionalFeatures(v8::Local<v8::Context>,
                                       int32_t world_id) override {}

patches/chromium/chore_grandfather_in_electron_views_and_delegates.patch

@@ -10,7 +10,7 @@ Subject: chore: "grandfather in" Electron Views and Delegates
 6448510: Lock further access to View::set_owned_by_client(). | https://chromium-review.googlesource.com/c/chromium/src/+/6448510
 
 diff --git a/ui/views/view.h b/ui/views/view.h
-index a6d23b384136e27eeb8d864af154aa020cab0fb1..bdc88396c84b0cccc2933a19a7772c1483cdb63d 100644
+index 7f70b4f6062e369e2198fc12ff507786283a13c7..22cae8f202357d848bd57aff1ee22abfcc6efed6 100644
 --- a/ui/views/view.h
 +++ b/ui/views/view.h
 @@ -81,6 +81,19 @@ class ArcNotificationContentView;

patches/chromium/chore_introduce_blocking_api_for_electron.patch

@@ -7,7 +7,7 @@ This patch comes after Chromium removed the ScopedAllowIO API in favor
 of explicitly adding ScopedAllowBlocking calls as friends.
 
 diff --git a/base/threading/thread_restrictions.h b/base/threading/thread_restrictions.h
-index 04f3b585ece1ab90d494dbd15874d793f2429771..c659070d53a1bc20f364fc57e79b8c5038691b4f 100644
+index 71850795591e1a479620f1348c6adc705db9e839..8821ee4429727630e6600d7f85f0999d3f4b2270 100644
 --- a/base/threading/thread_restrictions.h
 +++ b/base/threading/thread_restrictions.h
 @@ -133,6 +133,7 @@ class KeyStorageLinux;
@@ -28,7 +28,7 @@ index 04f3b585ece1ab90d494dbd15874d793f2429771..c659070d53a1bc20f364fc57e79b8c50
  namespace enterprise_connectors {
  class LinuxKeyRotationCommand;
  }  // namespace enterprise_connectors
-@@ -576,6 +580,7 @@ class BASE_EXPORT ScopedAllowBlocking {
+@@ -574,6 +578,7 @@ class BASE_EXPORT ScopedAllowBlocking {
    friend class ::DesktopNotificationBalloon;
    friend class ::FirefoxProfileLock;
    friend class ::GaiaConfig;
@@ -36,7 +36,7 @@ index 04f3b585ece1ab90d494dbd15874d793f2429771..c659070d53a1bc20f364fc57e79b8c50
    friend class ::ProfileImpl;
    friend class ::ScopedAllowBlockingForProfile;
    friend class ::StartupTabProviderImpl;
-@@ -618,6 +623,7 @@ class BASE_EXPORT ScopedAllowBlocking {
+@@ -615,6 +620,7 @@ class BASE_EXPORT ScopedAllowBlocking {
    friend class cronet::CronetPrefsManager;
    friend class crypto::ScopedAllowBlockingForNSS;  // http://crbug.com/59847
    friend class drive::FakeDriveService;

patches/chromium/chore_modify_chromium_handling_of_mouse_events.patch

@@ -34,10 +34,10 @@ index 2dc44d4787d5198cff7be2cf98ad5acf2d3a9a0b..27a0335aac2bd4239616cf71f5d015c9
  
  class ScrollEvent;
 diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
-index d2651f4fcbb7991e9ec8f164e5bee51dab405c5a..d58b59288d881a2d74ea357f1e9e27870d24ac72 100644
+index 5dd2b9b0897131897596e88e74701293c69e012d..89287b68398e9121959e7750644d37072e8e489b 100644
 --- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
 +++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
-@@ -1378,6 +1378,10 @@ HBRUSH DesktopWindowTreeHostWin::GetBackgroundPaintBrush() {
+@@ -1382,6 +1382,10 @@ HBRUSH DesktopWindowTreeHostWin::GetBackgroundPaintBrush() {
    return background_paint_brush_;
  }
  
@@ -49,10 +49,10 @@ index d2651f4fcbb7991e9ec8f164e5bee51dab405c5a..d58b59288d881a2d74ea357f1e9e2787
  DesktopWindowTreeHostWin::GetSingletonDesktopNativeCursorManager() {
    return new DesktopNativeCursorManagerWin();
 diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
-index b65ced55f997d5064b9d9338190567f8c264fce8..e8acd2828ed05deefa335ce2bb461f0c3be8d7b7 100644
+index 8b34b44095ba7884947d5e83da847783126b3e62..1e30bce5ca5bf47726fd846f2f26705d52a8ce57 100644
 --- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
 +++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
-@@ -273,6 +273,7 @@ class VIEWS_EXPORT DesktopWindowTreeHostWin
+@@ -274,6 +274,7 @@ class VIEWS_EXPORT DesktopWindowTreeHostWin
    void HandleWindowScaleFactorChanged(float window_scale_factor) override;
    void HandleHeadlessWindowBoundsChanged(const gfx::Rect& bounds) override;
    HBRUSH GetBackgroundPaintBrush() override;
@@ -61,10 +61,10 @@ index b65ced55f997d5064b9d9338190567f8c264fce8..e8acd2828ed05deefa335ce2bb461f0c
    Widget* GetWidget();
    const Widget* GetWidget() const;
 diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
-index 75a21333701b3501f785229ae9a358c5cac685df..579becb9a32704d932b8dfba477515af8529a2d4 100644
+index 5376a8278a4cc784ad69cda6594c5055847c1f22..1005d553d39909bdf7c2c7b1b714c58861ba747d 100644
 --- a/ui/views/win/hwnd_message_handler.cc
 +++ b/ui/views/win/hwnd_message_handler.cc
-@@ -3243,15 +3243,19 @@ LRESULT HWNDMessageHandler::HandleMouseEventInternal(UINT message,
+@@ -3240,15 +3240,19 @@ LRESULT HWNDMessageHandler::HandleMouseEventInternal(UINT message,
      }
      // We must let Windows handle the caption buttons if it's drawing them, or
      // they won't work.
@@ -86,7 +86,7 @@ index 75a21333701b3501f785229ae9a358c5cac685df..579becb9a32704d932b8dfba477515af
        return 0;
      }
    }
-@@ -3274,6 +3278,7 @@ LRESULT HWNDMessageHandler::HandleMouseEventInternal(UINT message,
+@@ -3271,6 +3275,7 @@ LRESULT HWNDMessageHandler::HandleMouseEventInternal(UINT message,
      // handle alt-space, or in the frame itself.
      is_right_mouse_pressed_on_caption_ = false;
      ReleaseCapture();
@@ -94,7 +94,7 @@ index 75a21333701b3501f785229ae9a358c5cac685df..579becb9a32704d932b8dfba477515af
      // |point| is in window coordinates, but WM_NCHITTEST and TrackPopupMenu()
      // expect screen coordinates.
      POINT screen_point = CR_POINT_INITIALIZER_FROM_LPARAM(l_param);
-@@ -3281,7 +3286,17 @@ LRESULT HWNDMessageHandler::HandleMouseEventInternal(UINT message,
+@@ -3278,7 +3283,17 @@ LRESULT HWNDMessageHandler::HandleMouseEventInternal(UINT message,
      w_param = static_cast<WPARAM>(SendMessage(
          hwnd(), WM_NCHITTEST, 0, MAKELPARAM(screen_point.x, screen_point.y)));
      if (w_param == HTCAPTION || w_param == HTSYSMENU) {

patches/chromium/chore_partial_revert_of.patch

@@ -14,10 +14,10 @@ track down the source of this problem & figure out if we can fix it
 by changing something in Electron.
 
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 808e961195a435e747236ce982dea722267a30dc..2798b165fcd0909f7329caa1cb4c8fcbe0934ef9 100644
+index cef686451711a79134486e447bcaa195e08f01e0..cd4681a60d49325c57d3fb961d2909650b4a6ace 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -5327,7 +5327,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5294,7 +5294,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
            : IsGuest();
    // While some guest types do not have a guest SiteInstance, the ones that
    // don't all override WebContents creation above.

patches/chromium/chore_patch_out_partition_attribute_dcheck_for_webviews.patch

@@ -14,10 +14,10 @@ This change patches it out to prevent the DCHECK.
 It can be removed once/if we see a better solution to the problem.
 
 diff --git a/content/browser/site_instance_impl.cc b/content/browser/site_instance_impl.cc
-index ff8cd27f46f49ff3b445becf7cb0c628af147899..8702ca4da61aa296c957a9c50b26e921c5e5b19f 100644
+index 19a127d46584ece213442b24beaa6ec45bf3fa14..d8045edd0a207b41e60dbae66a0f50eec31b2d8a 100644
 --- a/content/browser/site_instance_impl.cc
 +++ b/content/browser/site_instance_impl.cc
-@@ -227,7 +227,7 @@ scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::CreateForGuest(
+@@ -226,7 +226,7 @@ scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::CreateForGuest(
      BrowserContext* browser_context,
      const StoragePartitionConfig& partition_config) {
    DCHECK(browser_context);

patches/chromium/chore_patch_out_profile_methods.patch

@@ -7,7 +7,7 @@ Electron does not support Profiles, so we need to patch it out of any
 code that we use.
 
 diff --git a/chrome/browser/pdf/chrome_pdf_stream_delegate.cc b/chrome/browser/pdf/chrome_pdf_stream_delegate.cc
-index bd19708922b3d9224cc3a05f515c455ce4fb1e69..7198d9f9b22c8725c7ecdf6931ff36859ffaf506 100644
+index c390a83277f564f1a67a7dcffa36b9d77a35bc0b..b13273a4b194ad5e8ca2d1639ebca831f9607b1e 100644
 --- a/chrome/browser/pdf/chrome_pdf_stream_delegate.cc
 +++ b/chrome/browser/pdf/chrome_pdf_stream_delegate.cc
 @@ -45,6 +45,7 @@ namespace {
@@ -84,7 +84,7 @@ index bc0bad82ebcdceadc505e912ff27202b452fefab..6b77c57fccc4619a1df3b4ed661d2bdd
  
  ProfileSelection ProfileSelections::GetProfileSelection(
 diff --git a/chrome/browser/spellchecker/spellcheck_service.cc b/chrome/browser/spellchecker/spellcheck_service.cc
-index f8a36ced14288698849cd5730309e29d47d3d1d4..97b8fc0f38650e816bcae00e074543766f71e0d0 100644
+index 4c52386f9ddf13f1453903cda3954b6c596028f2..8fbb2025d157e58c90c701f9e3478f6c99b88aa1 100644
 --- a/chrome/browser/spellchecker/spellcheck_service.cc
 +++ b/chrome/browser/spellchecker/spellcheck_service.cc
 @@ -21,8 +21,10 @@

patches/chromium/chore_provide_iswebcontentscreationoverridden_with_full_params.patch

@@ -35,7 +35,7 @@ index 231e3595f218aeebe28d0b13ce6182e7a4d6f4e1..609bd205d1cd0404cab3471765bef8b0
        content::RenderFrameHost* requesting_frame,
        const blink::mojom::FullscreenOptions& options) final;
 diff --git a/chrome/browser/ui/ash/keyboard/chrome_keyboard_web_contents.cc b/chrome/browser/ui/ash/keyboard/chrome_keyboard_web_contents.cc
-index 7f99bf8c0c79de2cb8a812a7bfe8b4255697444a..d39aee929900cca756a6293b782a44228725f6fc 100644
+index a17c406b59530a8f57f6cb48905a697dd208a41f..0e22e90c1d570eb4c86ac1f24c5a6e9159be8ea1 100644
 --- a/chrome/browser/ui/ash/keyboard/chrome_keyboard_web_contents.cc
 +++ b/chrome/browser/ui/ash/keyboard/chrome_keyboard_web_contents.cc
 @@ -80,8 +80,7 @@ class ChromeKeyboardContentsDelegate : public content::WebContentsDelegate,
@@ -80,10 +80,10 @@ index 39fa45f0a0f9076bd7ac0be6f455dd540a276512..3d0381d463eed73470b28085830f2a23
        content::WebContents* source,
        const content::OpenURLParams& params,
 diff --git a/chrome/browser/ui/browser.cc b/chrome/browser/ui/browser.cc
-index d27effbf90aba2a888f479b6999fd16e58fdbcbf..1fd7f6166efd55ccc74a91763c87b1fe7987aaff 100644
+index 56dd79709e5b9cb13b5b48ccd312c3c97710eb6c..d22c3f134573a9ba91cedf24aa4dafc48332914f 100644
 --- a/chrome/browser/ui/browser.cc
 +++ b/chrome/browser/ui/browser.cc
-@@ -2376,7 +2376,8 @@ bool Browser::IsWebContentsCreationOverridden(
+@@ -2416,7 +2416,8 @@ bool Browser::IsWebContentsCreationOverridden(
      content::mojom::WindowContainerType window_container_type,
      const GURL& opener_url,
      const std::string& frame_name,
@@ -93,7 +93,7 @@ index d27effbf90aba2a888f479b6999fd16e58fdbcbf..1fd7f6166efd55ccc74a91763c87b1fe
    if (HasActorTask(profile(), opener)) {
      // If an ExecutionEngine is acting on the opener, prevent it from creating a
      // new WebContents. We'll instead force the navigation to happen in the same
-@@ -2389,7 +2390,7 @@ bool Browser::IsWebContentsCreationOverridden(
+@@ -2429,7 +2430,7 @@ bool Browser::IsWebContentsCreationOverridden(
    return (window_container_type ==
                content::mojom::WindowContainerType::BACKGROUND &&
            ShouldCreateBackgroundContents(source_site_instance, opener_url,
@@ -103,10 +103,10 @@ index d27effbf90aba2a888f479b6999fd16e58fdbcbf..1fd7f6166efd55ccc74a91763c87b1fe
  
  WebContents* Browser::CreateCustomWebContents(
 diff --git a/chrome/browser/ui/browser.h b/chrome/browser/ui/browser.h
-index 46715de09311e36046c9d49e6eb0a6444532f49f..0883f12668347f76d20517df95885b2c73d98598 100644
+index 81a247cded1dd321f1003221f02a5c3a0c5a3312..037f5ecdf3a4437c935b90c45ef29536e0bfa2e3 100644
 --- a/chrome/browser/ui/browser.h
 +++ b/chrome/browser/ui/browser.h
-@@ -935,8 +935,7 @@ class Browser : public TabStripModelObserver,
+@@ -954,8 +954,7 @@ class Browser : public TabStripModelObserver,
        content::SiteInstance* source_site_instance,
        content::mojom::WindowContainerType window_container_type,
        const GURL& opener_url,
@@ -145,7 +145,7 @@ index 3fc06be01f20e8cd314d95d73a3f58c2f0742fe9..c07910ae59a185442f37ea6e7b96fdf3
    // The profile used for the presentation.
    raw_ptr<Profile, DanglingUntriaged> otr_profile_;
 diff --git a/chrome/browser/ui/views/hats/hats_next_web_dialog.cc b/chrome/browser/ui/views/hats/hats_next_web_dialog.cc
-index 3bbd4e568ba99245622a96f0801d2b6cd203025f..1e0b7d16b33daed980961dd49c667a3b254c186f 100644
+index 96236cd9bdd3f03ebb7e5428e809f8dff2654e60..d17758e94043afcbd3b45884fac127e0ad82daf5 100644
 --- a/chrome/browser/ui/views/hats/hats_next_web_dialog.cc
 +++ b/chrome/browser/ui/views/hats/hats_next_web_dialog.cc
 @@ -104,8 +104,7 @@ class HatsNextWebDialog::HatsWebView : public views::WebView {
@@ -159,10 +159,10 @@ index 3bbd4e568ba99245622a96f0801d2b6cd203025f..1e0b7d16b33daed980961dd49c667a3b
    }
    content::WebContents* CreateCustomWebContents(
 diff --git a/components/embedder_support/android/delegate/web_contents_delegate_android.cc b/components/embedder_support/android/delegate/web_contents_delegate_android.cc
-index 24f78a1c6b439c2f66683bb43b784f696f9a7419..7a5b6eccffe451787101042673d6efe4456237b4 100644
+index 19d64c899ff85565b7c000d27f60dccd71c43e9d..1f0839b02c39d46fd54e7c780d9c79c3e1fad516 100644
 --- a/components/embedder_support/android/delegate/web_contents_delegate_android.cc
 +++ b/components/embedder_support/android/delegate/web_contents_delegate_android.cc
-@@ -210,15 +210,14 @@ bool WebContentsDelegateAndroid::IsWebContentsCreationOverridden(
+@@ -205,14 +205,13 @@ bool WebContentsDelegateAndroid::IsWebContentsCreationOverridden(
      content::SiteInstance* source_site_instance,
      content::mojom::WindowContainerType window_container_type,
      const GURL& opener_url,
@@ -171,9 +171,8 @@ index 24f78a1c6b439c2f66683bb43b784f696f9a7419..7a5b6eccffe451787101042673d6efe4
 +    const content::mojom::CreateNewWindowParams& params) {
    JNIEnv* env = AttachCurrentThread();
    ScopedJavaLocalRef<jobject> obj = GetJavaDelegate(env);
-   if (obj.is_null()) {
+   if (obj.is_null())
      return false;
-   }
    ScopedJavaLocalRef<jobject> java_gurl =
 -      url::GURLAndroid::FromNativeGURL(env, target_url);
 +      url::GURLAndroid::FromNativeGURL(env, params.target_url.spec());
@@ -181,7 +180,7 @@ index 24f78a1c6b439c2f66683bb43b784f696f9a7419..7a5b6eccffe451787101042673d6efe4
                                                                    java_gurl);
  }
 diff --git a/components/embedder_support/android/delegate/web_contents_delegate_android.h b/components/embedder_support/android/delegate/web_contents_delegate_android.h
-index 261d38394a9ff6f81848b94d6b183b2062c37ba9..0c6a26599bb8fef6f9ee6180fc0a98760d857b19 100644
+index 58bf1a6fc5e42050304d9d16e3414e8f7549c47d..042d2ee5e2c3d77488e7cffb84db548314b64b95 100644
 --- a/components/embedder_support/android/delegate/web_contents_delegate_android.h
 +++ b/components/embedder_support/android/delegate/web_contents_delegate_android.h
 @@ -78,8 +78,7 @@ class WebContentsDelegateAndroid : public content::WebContentsDelegate {
@@ -223,10 +222,10 @@ index b969f1d97b7e3396119b579cfbe61e19ff7d2dd4..b8d6169652da28266a514938b45b39c5
    content::WebContents* AddNewContents(
        content::WebContents* source,
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index c47fe83984ca1c592138acafc354651ce1b559fc..c6f031e408768a31198f7e875d03d59cacaef9a7 100644
+index 9d45b18fca8aeac046f01bcc6076ba9e9e550241..b9a6e3c8002a0a85e4d6a4ad1076a497d9ead0cf 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -5290,8 +5290,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5257,8 +5257,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    if (delegate_ &&
        delegate_->IsWebContentsCreationOverridden(
            opener, source_site_instance, params.window_container_type,
@@ -237,7 +236,7 @@ index c47fe83984ca1c592138acafc354651ce1b559fc..c6f031e408768a31198f7e875d03d59c
          static_cast<WebContentsImpl*>(delegate_->CreateCustomWebContents(
              opener, source_site_instance, is_new_browsing_instance,
 diff --git a/content/public/browser/web_contents_delegate.cc b/content/public/browser/web_contents_delegate.cc
-index df972f1ce594f2d4651202b650ff2d41fe19ecd0..a92305042eef86fbabeae6fe02b48668a349be99 100644
+index 968cddc769e2bf0bb56359b36bc03cbce6539da1..08c983ac6a8e5733431ba00e1288f6d6b087eee6 100644
 --- a/content/public/browser/web_contents_delegate.cc
 +++ b/content/public/browser/web_contents_delegate.cc
 @@ -160,8 +160,7 @@ bool WebContentsDelegate::IsWebContentsCreationOverridden(
@@ -251,10 +250,10 @@ index df972f1ce594f2d4651202b650ff2d41fe19ecd0..a92305042eef86fbabeae6fe02b48668
  }
  
 diff --git a/content/public/browser/web_contents_delegate.h b/content/public/browser/web_contents_delegate.h
-index 98492cff13c97388d001fc33cc948261990edef1..88b4810d3b91df0dd6b932412edd4ff249bedde0 100644
+index bf5169e7a79e74309ff592252914ec012e4178c5..466f78504376c1fb8684faa08aacabba1987ec7a 100644
 --- a/content/public/browser/web_contents_delegate.h
 +++ b/content/public/browser/web_contents_delegate.h
-@@ -365,8 +365,7 @@ class CONTENT_EXPORT WebContentsDelegate {
+@@ -368,8 +368,7 @@ class CONTENT_EXPORT WebContentsDelegate {
        SiteInstance* source_site_instance,
        mojom::WindowContainerType window_container_type,
        const GURL& opener_url,
@@ -265,7 +264,7 @@ index 98492cff13c97388d001fc33cc948261990edef1..88b4810d3b91df0dd6b932412edd4ff2
    // Allow delegate to creates a custom WebContents when
    // WebContents::CreateNewWindow() is called. This function is only called
 diff --git a/extensions/browser/guest_view/app_view/app_view_guest.cc b/extensions/browser/guest_view/app_view/app_view_guest.cc
-index af80323215e2cb6ff7bdb802f8da4bdbe0067f71..187816751bde435e9c622921c457873d4b3172cd 100644
+index 3b1fe9ef59fbcd3684348fb518ce67210a639dc1..dc38462f8e29066bec4970cc820b8d6077106b85 100644
 --- a/extensions/browser/guest_view/app_view/app_view_guest.cc
 +++ b/extensions/browser/guest_view/app_view/app_view_guest.cc
 @@ -153,8 +153,7 @@ bool AppViewGuest::IsWebContentsCreationOverridden(
@@ -301,7 +300,7 @@ index 7695578f626f2a0c7fefae2bc1d5c35e5ac154f2..78958bff12ce41ae5ad77f43279a4b35
        content::RenderFrameHost* opener,
        content::SiteInstance* source_site_instance,
 diff --git a/extensions/browser/guest_view/extension_options/extension_options_guest.cc b/extensions/browser/guest_view/extension_options/extension_options_guest.cc
-index 0ab40dfd23d1071212c4d30d01fa8e7755458d4a..f032127a94c52beb3f509d6ea84c7e55f21084e2 100644
+index 5bd9d59a961a03f3cd3a806bc1af58c3eaee2b58..40d7ae8d6248163524a8c1350b625e107a8ae64a 100644
 --- a/extensions/browser/guest_view/extension_options/extension_options_guest.cc
 +++ b/extensions/browser/guest_view/extension_options/extension_options_guest.cc
 @@ -263,8 +263,7 @@ bool ExtensionOptionsGuest::IsWebContentsCreationOverridden(
@@ -329,7 +328,7 @@ index 56d86e3d1179df2d5f34eb6216989aef2687f49f..236f3ccf8354b156737e03929ee538f9
        content::RenderFrameHost* opener,
        content::SiteInstance* source_site_instance,
 diff --git a/extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc b/extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc
-index 23705fa50cf79865b68d8352f6ec72444ca5233e..efa5e78ed92464a6d47319f7b2087555d683bd8c 100644
+index 3e689ad6bdb51ccd7419eb87e4ba2cdbf2f1a8e9..c219b456721a43d9dfdf69612909a2d4f82cd33d 100644
 --- a/extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc
 +++ b/extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc
 @@ -424,8 +424,7 @@ bool MimeHandlerViewGuest::IsWebContentsCreationOverridden(
@@ -357,10 +356,10 @@ index 7eeffdfbda9611806c6f260f0c68f6d84689cb7e..5d8f6d132068d7fabaa52bc61354c71a
        content::RenderFrameHost* opener,
        content::SiteInstance* source_site_instance,
 diff --git a/fuchsia_web/webengine/browser/frame_impl.cc b/fuchsia_web/webengine/browser/frame_impl.cc
-index 44fdb7377fc4d09137d0718de0f960b0d190c99f..46bde9f83510116f8723d400d5947f9cc6ba3ab5 100644
+index fdc6afbf9048fa254d6f361b36765cf95d5eb521..16d297a3f6bde6bc4c038b79a057700aec68b689 100644
 --- a/fuchsia_web/webengine/browser/frame_impl.cc
 +++ b/fuchsia_web/webengine/browser/frame_impl.cc
-@@ -585,8 +585,7 @@ bool FrameImpl::IsWebContentsCreationOverridden(
+@@ -584,8 +584,7 @@ bool FrameImpl::IsWebContentsCreationOverridden(
      content::SiteInstance* source_site_instance,
      content::mojom::WindowContainerType window_container_type,
      const GURL& opener_url,
@@ -385,10 +384,10 @@ index 756d4192271d6a65cfe8e1511737c565b543cb1f..5688f6f745056565c3c01947f741c4d1
                            int opener_render_process_id,
                            int opener_render_frame_id,
 diff --git a/headless/lib/browser/headless_web_contents_impl.cc b/headless/lib/browser/headless_web_contents_impl.cc
-index d02d9468560eb451753fd56aa46bc4f191535e95..6e5c10f94a16039dc90cb2bdf90c4c854afc8a53 100644
+index 64ecdeb50b861825c9b55a930ff18c36818cad0b..e037d5607f8e1f3acb4ed018080de1b3357647be 100644
 --- a/headless/lib/browser/headless_web_contents_impl.cc
 +++ b/headless/lib/browser/headless_web_contents_impl.cc
-@@ -208,8 +208,7 @@ class HeadlessWebContentsImpl::Delegate : public content::WebContentsDelegate {
+@@ -206,8 +206,7 @@ class HeadlessWebContentsImpl::Delegate : public content::WebContentsDelegate {
        content::SiteInstance* source_site_instance,
        content::mojom::WindowContainerType window_container_type,
        const GURL& opener_url,

patches/chromium/chore_remove_check_is_test_on_script_injection_tracker.patch

@@ -9,7 +9,7 @@ Electron when a session is non persistent we do not initialize the
 ExtensionSystem, so this check is not relevant for Electron.
 
 diff --git a/extensions/browser/script_injection_tracker.cc b/extensions/browser/script_injection_tracker.cc
-index 8331e06da9055fddd647dbe54051584b101286b0..6a9ddc0060dc272cd4511fc96f358005ad0ee043 100644
+index 09e5575f67c0a7484663d0ecbee5963be622cb8f..b206eca9426491921e6cacfad3fb764d474e7945 100644
 --- a/extensions/browser/script_injection_tracker.cc
 +++ b/extensions/browser/script_injection_tracker.cc
 @@ -177,7 +177,6 @@ std::vector<const UserScript*> GetLoadedDynamicScripts(

patches/chromium/chore_restore_some_deprecated_wrapper_utility_in_gin.patch

@@ -9,10 +9,10 @@ Patch can be removed once cppgc migration is complete
 https://github.com/electron/electron/issues/47922
 
 diff --git a/gin/function_template.h b/gin/function_template.h
-index c80020b2bda2af39b38295dad3c6208cb8294b88..873015289db9709c00c32080e5387d9cdfea1f69 100644
+index 84ab9585240a49048774811718f7ebd6f988e485..f062163cdd81def12fae7e507d18a9133dd0804d 100644
 --- a/gin/function_template.h
 +++ b/gin/function_template.h
-@@ -79,6 +79,7 @@ class GIN_EXPORT CallbackHolderBase {
+@@ -77,6 +77,7 @@ class GIN_EXPORT CallbackHolderBase {
                      CallbackHolderBase* holder);
      ~DisposeObserver() override;
      void OnBeforeDispose(v8::Isolate* isolate) override;
@@ -21,7 +21,7 @@ index c80020b2bda2af39b38295dad3c6208cb8294b88..873015289db9709c00c32080e5387d9c
  
     private:
 diff --git a/gin/isolate_holder.cc b/gin/isolate_holder.cc
-index 1943413560f23c212d98fa1b368204c6e062bab2..bf0053833c782c9bc0187bb093a7ffd81ca9d754 100644
+index 083d59f78c542f4900e1b210a0935276516b894b..e32658e386853e2142c325a60ec385635256b758 100644
 --- a/gin/isolate_holder.cc
 +++ b/gin/isolate_holder.cc
 @@ -225,6 +225,7 @@ void IsolateHolder::WillCreateMicrotasksRunner() {
@@ -91,7 +91,7 @@ index 9670f9f904c6c864e82409617ac4c7698c6fc3ef..d1014af4b63da244820ff865a8e824dd
    for (auto& observer : dispose_observers_) {
      observer.OnDisposed();
 diff --git a/gin/per_isolate_data.h b/gin/per_isolate_data.h
-index 9146df7ec5e65401771f452ed44c63369be1d31f..5ae71c795cc98a885090553177f57deccb8bc546 100644
+index 82048c08a14d05e1f9bd6ad6cc16d16f0905f879..e38b0ca134e71a968805a547c1eccbc0cd6f6dda 100644
 --- a/gin/per_isolate_data.h
 +++ b/gin/per_isolate_data.h
 @@ -34,6 +34,10 @@ class GIN_EXPORT PerIsolateData {

patches/chromium/custom_protocols_plzserviceworker.patch

@@ -8,7 +8,7 @@ Allow registering custom protocols to handle service worker main script fetching
 Refs https://bugs.chromium.org/p/chromium/issues/detail?id=996511
 
 diff --git a/content/browser/service_worker/service_worker_context_wrapper.cc b/content/browser/service_worker/service_worker_context_wrapper.cc
-index cb60c976d469958b6d7dbd69dddc91866744c429..88f1cbc3bc7f3efaae01c88c17fa467175d4f8ea 100644
+index 25c9e17bd063cc07fd2727474395a9276c4a000d..413f3019bd55388e8ebc8fe39af766b7c61e9924 100644
 --- a/content/browser/service_worker/service_worker_context_wrapper.cc
 +++ b/content/browser/service_worker/service_worker_context_wrapper.cc
 @@ -1957,6 +1957,26 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
@@ -40,7 +40,7 @@ index cb60c976d469958b6d7dbd69dddc91866744c429..88f1cbc3bc7f3efaae01c88c17fa4671
      // If this is a Service Worker for a WebUI, the WebUI's URLDataSource
 @@ -1976,9 +1996,7 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
              features::kEnableServiceWorkersForChromeScheme) &&
-         scope.scheme() == kChromeUIScheme) {
+         scope.scheme_piece() == kChromeUIScheme) {
        config->RegisterURLDataSource(browser_context());
 -      static_cast<blink::PendingURLLoaderFactoryBundle*>(
 -          loader_factory_bundle_info.get())
@@ -51,7 +51,7 @@ index cb60c976d469958b6d7dbd69dddc91866744c429..88f1cbc3bc7f3efaae01c88c17fa4671
                                          base::flat_set<std::string>()));
 @@ -1986,9 +2004,7 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
                     features::kEnableServiceWorkersForChromeUntrusted) &&
-                scope.scheme() == kChromeUIUntrustedScheme) {
+                scope.scheme_piece() == kChromeUIUntrustedScheme) {
        config->RegisterURLDataSource(browser_context());
 -      static_cast<blink::PendingURLLoaderFactoryBundle*>(
 -          loader_factory_bundle_info.get())

patches/chromium/disable_compositor_recycling.patch

@@ -6,11 +6,11 @@ Subject: fix: disabling compositor recycling
 Compositor recycling is useful for Chrome because there can be many tabs and spinning up a compositor for each one would be costly. In practice, Chrome uses the parent compositor code path of browser_compositor_view_mac.mm; the NSView of each tab is detached when it's hidden and attached when it's shown. For Electron, there is no parent compositor, so we're forced into the "own compositor" code path, which seems to be non-optimal and pretty ruthless in terms of the release of resources. Electron has no real concept of multiple tabs per window, so it should be okay to disable this ruthless recycling altogether in Electron.
 
 diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
-index 00f9abc97d2001fc0bd095d2c62097f2ed1ae047..71fb36989aeb2c3232f624501933ed48a50e06cd 100644
+index 6f1214fc18a2089a6f711bd03bd083fd318e2792..429e567e6f3cacac081cd6fb9b35eeafe965376a 100644
 --- a/content/browser/renderer_host/render_widget_host_view_mac.mm
 +++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
-@@ -559,7 +559,11 @@
-   }
+@@ -558,7 +558,11 @@
+     return;
  
    host()->WasHidden();
 -  browser_compositor_->SetRenderWidgetHostIsHidden(true);

patches/chromium/disable_hidden.patch

@@ -6,10 +6,10 @@ Subject: disable_hidden.patch
 Electron uses this to disable background throttling for hidden windows.
 
 diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
-index 4c3ab7e4a7d35a8933715ae2966768049f28b715..982b5edc933fdf1c4884dd0e0e7b957cee31c5ef 100644
+index b70623b56267fb7df71519a2c19a04a658f766e2..0bae000a3491e03196bbba033621d389c6150225 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.cc
 +++ b/content/browser/renderer_host/render_widget_host_impl.cc
-@@ -841,6 +841,10 @@ void RenderWidgetHostImpl::WasHidden() {
+@@ -840,6 +840,10 @@ void RenderWidgetHostImpl::WasHidden() {
      return;
    }
  
@@ -21,7 +21,7 @@ index 4c3ab7e4a7d35a8933715ae2966768049f28b715..982b5edc933fdf1c4884dd0e0e7b957c
    // Prompts should remain open and functional across tab switches.
    if (!delegate_ || !delegate_->IsWaitingForPointerLockPrompt(this)) {
 diff --git a/content/browser/renderer_host/render_widget_host_impl.h b/content/browser/renderer_host/render_widget_host_impl.h
-index 2d32d91eb98fe749ae262ba06a1a399813aa7bab..8ebf542046ffba6823804b797e373c80bab12873 100644
+index 636f09a8ac86e7c3f7b8dcdc285792f18f5c5989..276852573eade86f1bc9690e3c78a6279e9ff5af 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.h
 +++ b/content/browser/renderer_host/render_widget_host_impl.h
 @@ -1031,6 +1031,8 @@ class CONTENT_EXPORT RenderWidgetHostImpl
@@ -34,15 +34,15 @@ index 2d32d91eb98fe749ae262ba06a1a399813aa7bab..8ebf542046ffba6823804b797e373c80
    // |routing_id| must not be IPC::mojom::kRoutingIdNone.
    // If this object outlives |delegate|, DetachDelegate() must be called when
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
-index 9b1712382e208ef949616243d6ec1feab46f8fb3..84899b5208f036bd58ba51513820404b6c5a24b9 100644
+index b8f74e321a8bd8bd65e89cf9d794651c9f6f8705..e8a0554c4d84a16fc2122cb3e48199b4f43ecf88 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
-@@ -696,7 +696,7 @@ void RenderWidgetHostViewAura::HideImpl() {
+@@ -642,7 +642,7 @@ void RenderWidgetHostViewAura::HideImpl() {
    CHECK(visibility_ == Visibility::HIDDEN ||
          visibility_ == Visibility::OCCLUDED);
  
--  if (!host()->IsHidden()) {
-+  if (!host()->IsHidden() && !host()->disable_hidden_) {
+-  if (!host()->is_hidden()) {
++  if (!host()->is_hidden() && !host()->disable_hidden_) {
      host()->WasHidden();
      aura::WindowTreeHost* host = window_->GetHost();
        aura::Window* parent = window_->parent();

patches/chromium/dom_storage_limits.patch

@@ -9,7 +9,7 @@ Previous versions of this patch attempted to circumvent
 the restriction altogether.
 However, this can lead to other problems, such as crashing
 the Dev Tools when attempting to read or write values that exceed
-`IPC::mojom::kChannelMaximumMessageSize` (128MiB).
+`IPC::Channel::kMaximumMessageSize` (128MiB).
 
 Increasing the quota rather than bypassing it reduces the
 amount of chromium code that needs to be changed for Electron

patches/chromium/enable_reset_aspect_ratio.patch

@@ -6,10 +6,10 @@ Subject: feat: enable setting aspect ratio to 0
 Make SetAspectRatio accept 0 as valid input, which would reset to null.
 
 diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
-index 35469ecb01a680315b2f92e2599a3b56b5fc7549..d2651f4fcbb7991e9ec8f164e5bee51dab405c5a 100644
+index 55caef964e9302e939a1580494e753fac347c99e..5dd2b9b0897131897596e88e74701293c69e012d 100644
 --- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
 +++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
-@@ -614,7 +614,7 @@ void DesktopWindowTreeHostWin::SetOpacity(float opacity) {
+@@ -618,7 +618,7 @@ void DesktopWindowTreeHostWin::SetOpacity(float opacity) {
  void DesktopWindowTreeHostWin::SetAspectRatio(
      const gfx::SizeF& aspect_ratio,
      const gfx::Size& excluded_margin) {
@@ -19,7 +19,7 @@ index 35469ecb01a680315b2f92e2599a3b56b5fc7549..d2651f4fcbb7991e9ec8f164e5bee51d
                                     excluded_margin);
  }
 diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
-index 86aa7d062e6bfc4ceb79f8852bef34998538a338..14c6a37e16d66967a229c08de83c54192ccdc3c5 100644
+index 5246e5bb427f09bccdf53ee4de79bcf7c1c6a702..41b5219bdba3eba8bde935992fe60fc14898f68d 100644
 --- a/ui/views/win/hwnd_message_handler.cc
 +++ b/ui/views/win/hwnd_message_handler.cc
 @@ -1050,8 +1050,11 @@ void HWNDMessageHandler::SetFullscreen(bool fullscreen,

patches/chromium/expose_setuseragent_on_networkcontext.patch

@@ -33,10 +33,10 @@ index 0ab8187b0db8ae6db46d81738f653a2bc4c566f6..de3d55e85c22317f7f9375eb94d0d5d4
  
  }  // namespace net
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
-index 3598823a6400c4e5045621950433d2688cfbba89..66379714141b83a2ded90f88ce8b89bf900ca5a6 100644
+index 985de2b44ed5b2d567a080a1834bbfd8aa7a82a0..b2faaaefe1fd5bde36ca33b759367e648245f1ae 100644
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
-@@ -1911,6 +1911,13 @@ void NetworkContext::EnableDurableMessageCollector(
+@@ -1910,6 +1910,13 @@ void NetworkContext::EnableDurableMessageCollector(
    it->second->AddReceiver(std::move(receiver));
  }
  
@@ -51,7 +51,7 @@ index 3598823a6400c4e5045621950433d2688cfbba89..66379714141b83a2ded90f88ce8b89bf
    // This may only be called on NetworkContexts created with the constructor
    // that calls MakeURLRequestContext().
 diff --git a/services/network/network_context.h b/services/network/network_context.h
-index 90cf1a70c068771ac98b2d5a283cba5e54c05ff4..0dc8de8d4e37e48cb28d8112c0233ac80cfb9ba5 100644
+index df0e1e7ebf4a127e0cc8d8617f293c94862f9783..a014b219a3793b53dc2670d55d6c3f12f23a8a77 100644
 --- a/services/network/network_context.h
 +++ b/services/network/network_context.h
 @@ -336,6 +336,7 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
@@ -63,10 +63,10 @@ index 90cf1a70c068771ac98b2d5a283cba5e54c05ff4..0dc8de8d4e37e48cb28d8112c0233ac8
    void SetEnableReferrers(bool enable_referrers) override;
  #if BUILDFLAG(IS_CT_SUPPORTED)
 diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
-index 58c53f7bab65af0b797f502a4633ca47933e26f0..474baf5e969c4397c9f61c9dea7ec2a466510dd8 100644
+index 71aec1f17c274cdc1151fb81e6ff718abc7f310c..67f177d3d4e5ed852f5dd85ade822d5c62b9a8ea 100644
 --- a/services/network/public/mojom/network_context.mojom
 +++ b/services/network/public/mojom/network_context.mojom
-@@ -1352,6 +1352,9 @@ interface NetworkContext {
+@@ -1355,6 +1355,9 @@ interface NetworkContext {
        mojo_base.mojom.UnguessableToken throttling_profile_id,
        pending_receiver<DurableMessageCollector> receiver);
  
@@ -77,7 +77,7 @@ index 58c53f7bab65af0b797f502a4633ca47933e26f0..474baf5e969c4397c9f61c9dea7ec2a4
    SetAcceptLanguage(string new_accept_language);
  
 diff --git a/services/network/test/test_network_context.h b/services/network/test/test_network_context.h
-index ebcacbcb16057912693a6674e6b9ef5eeb671f91..1f3f18979b76be720a7c202f2a45fcc593c8fc01 100644
+index 6a8d13ed773378b4d5b2c94c78399859dfbeb700..01d07d1d8882a57ecbed85f42f2029db84c25769 100644
 --- a/services/network/test/test_network_context.h
 +++ b/services/network/test/test_network_context.h
 @@ -162,6 +162,7 @@ class TestNetworkContext : public mojom::NetworkContext {

patches/chromium/extend_apply_webpreferences.patch

@@ -15,10 +15,10 @@ Ideally we could add an embedder observer pattern here but that can be
 done in future work.
 
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index b50e4805af36aa96c0ce69359adcf1b18d80c62a..5379c42a81f231592bd8a0dc02b05c67960bcb86 100644
+index bd09aa1967d04e0be240de38aabdaa9d74f60336..c0eb61791d2c60c6dc54d8b73aed347063e0685f 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
-@@ -1899,6 +1899,8 @@ void WebView::ApplyWebPreferences(const web_pref::WebPreferences& prefs,
+@@ -1903,6 +1903,8 @@ void WebView::ApplyWebPreferences(const web_pref::WebPreferences& prefs,
  #if BUILDFLAG(IS_MAC)
    web_view_impl->SetMaximumLegibleScale(
        prefs.default_maximum_page_scale_factor);