docs: add PipeWire integration instructions for snaps (#40068)

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Athul Iddya <athul@iddya.com>

.circleci/config.yml

@@ -65,6 +65,9 @@ jobs:
             curl -fLSs https://raw.githubusercontent.com/CircleCI-Public/circleci-cli/main/install.sh | DESTDIR=$CIRCLECI_BINARY bash
             node build.js
           name: Pack config.yml
+      - run:
+          name: Set params
+          command: node .circleci/config/params.js
       - continuation/continue:
           configuration_path: .circleci/config-staging/built.yml
           parameters: /tmp/pipeline-parameters.json

.circleci/config/base.yml

@@ -35,6 +35,16 @@ parameters:
     default: all
     enum: ["all", "osx-x64", "osx-arm64", "mas-x64", "mas-arm64"]
 
+  medium-linux-executor:
+    type: enum
+    default: electronjs/aks-linux-medium
+    enum: ["electronjs/aks-linux-medium", "medium"]
+  
+  large-linux-executor:
+    type: enum
+    default: electronjs/aks-linux-large
+    enum: ["electronjs/aks-linux-large", "2xlarge"]
+
 # Executors
 executors:
   linux-docker:
@@ -42,9 +52,9 @@ executors:
       size:
         description: "Docker executor size"
         type: enum
-        # aks-linux-medium === 8 core (32 core host, shared with other builds)
         # aks-linux-large === 32 core
-        enum: ["medium", "xlarge", "electronjs/aks-linux-medium", "electronjs/aks-linux-large"]
+        # 2xlarge should not be used directly, use the pipeline param instead
+        enum: ["medium", "electronjs/aks-linux-medium", "xlarge", "electronjs/aks-linux-large", "2xlarge"]
     docker:
       - image: ghcr.io/electron/build:e6bebd08a51a0d78ec23e5b3fd7e7c0846412328
     resource_class: << parameters.size >>
@@ -349,7 +359,7 @@ step-setup-goma-for-build: &step-setup-goma-for-build
         exit 1
       fi
       echo 'export GN_GOMA_FILE='`node -e "console.log(require('./src/utils/goma.js').gnFilePath)"` >> $BASH_ENV
-      echo 'export LOCAL_GOMA_DIR='`node -e "console.log(require('./src/utils/goma.js').dir)"` >> $BASH_ENV
+      echo 'export GOMA_DIR='`node -e "console.log(require('./src/utils/goma.js').dir)"` >> $BASH_ENV
       echo 'export GOMA_FALLBACK_ON_AUTH_FAILURE=true' >> $BASH_ENV
       cd ..
       touch "${TMPDIR:=/tmp}"/.goma-ready
@@ -744,8 +754,8 @@ step-show-goma-stats: &step-show-goma-stats
     command: |
       set +e
       set +o pipefail
-      $LOCAL_GOMA_DIR/goma_ctl.py stat
-      $LOCAL_GOMA_DIR/diagnose_goma_log.py
+      $GOMA_DIR/goma_ctl.py stat
+      $GOMA_DIR/diagnose_goma_log.py
       true
     when: always
     background: true
@@ -895,14 +905,26 @@ step-touch-sync-done: &step-touch-sync-done
 step-maybe-restore-src-cache: &step-maybe-restore-src-cache
   restore_cache:
     keys:
-      - v16-src-cache-{{ checksum "src/electron/.depshash" }}
+      - v17-src-cache-{{ checksum "src/electron/.depshash" }}
     name: Restoring src cache
 step-maybe-restore-src-cache-marker: &step-maybe-restore-src-cache-marker
   restore_cache:
     keys:
-      - v16-src-cache-marker-{{ checksum "src/electron/.depshash" }}
+      - v17-src-cache-marker-{{ checksum "src/electron/.depshash" }}
     name: Restoring src cache marker
 
+step-maybe-restore-src-cache-aks: &step-maybe-restore-src-cache-aks
+  restore_cache_aks:
+    step-name: Restoring src cache
+    cache_key: v17-src-cache-$(shasum src/electron/.depshash | cut -f1 -d' ')
+    cache_path: /var/portal
+
+step-maybe-restore-src-cache-marker-aks: &step-maybe-restore-src-cache-marker-aks
+  restore_cache_aks:
+    step-name: Restoring src cache marker
+    cache_key: v17-src-cache-marker-$(shasum src/electron/.depshash | cut -f1 -d' ')
+    cache_path: "."
+
 # Restore exact or closest git cache based on the hash of DEPS and .circle-sync-done
 # If the src cache was restored above then this will match an empty cache
 # If the src cache was not restored above then this will match a close git cache
@@ -915,6 +937,12 @@ step-maybe-restore-git-cache: &step-maybe-restore-git-cache
       - v1-git-cache-{{ checksum "src/electron/.circle-sync-done" }}
     name: Conditionally restoring git cache
 
+step-maybe-restore-git-cache-aks: &step-maybe-restore-git-cache-aks
+  restore_cache_aks:
+    step-name: Conditionally restoring git cache (aks)
+    cache_key: v1-git-cache-$(shasum src/electron/.circle-sync-done | cut -f1 -d' ')-$(shasum src/electron/DEPS | cut -f1 -d' ') v1-git-cache-$(shasum src/electron/.circle-sync-done | cut -f1 -d' ')
+    cache_path: git-cache
+
 step-set-git-cache-path: &step-set-git-cache-path
   run:
     name: Set GIT_CACHE_PATH to make gclient to use the cache
@@ -932,6 +960,12 @@ step-save-git-cache: &step-save-git-cache
     key: v1-git-cache-{{ checksum "src/electron/.circle-sync-done" }}-{{ checksum "src/electron/DEPS" }}
     name: Persisting git cache
 
+step-save-git-cache-aks: &step-save-git-cache-aks
+  save_cache_aks:
+    step-name: Persisting git cache (AKS)
+    cache_key: v1-git-cache-$(shasum src/electron/.circle-sync-done | cut -f1 -d' ')-$(shasum src/electron/DEPS | cut -f1 -d' ')
+    cache_path: git-cache
+
 step-run-electron-only-hooks: &step-run-electron-only-hooks
   run:
     name: Run Electron Only Hooks
@@ -969,7 +1003,7 @@ step-save-src-cache: &step-save-src-cache
   save_cache:
     paths:
       - /var/portal
-    key: v16-src-cache-{{ checksum "/var/portal/src/electron/.depshash" }}
+    key: v17-src-cache-{{ checksum "/var/portal/src/electron/.depshash" }}
     name: Persisting src cache
 step-make-src-cache-marker: &step-make-src-cache-marker
   run:
@@ -979,7 +1013,17 @@ step-save-src-cache-marker: &step-save-src-cache-marker
   save_cache:
     paths:
       - .src-cache-marker
-    key: v16-src-cache-marker-{{ checksum "/var/portal/src/electron/.depshash" }}
+    key: v17-src-cache-marker-{{ checksum "/var/portal/src/electron/.depshash" }}
+step-save-src-cache-aks: &step-save-src-cache-aks
+  save_cache_aks:
+    step-name: Persisting src cache (aks)
+    cache_key: v17-src-cache-$(shasum /var/portal/src/electron/.depshash | cut -f1 -d' ')
+    cache_path: /var/portal
+step-save-src-cache-marker-aks: &step-save-src-cache-marker-aks
+  save_cache_aks:
+    step-name: Persisting src cache marker (aks)
+    cache_key: v17-src-cache-marker-$(shasum /var/portal/src/electron/.depshash | cut -f1 -d' ')
+    cache_path: .src-cache-marker
 
 step-maybe-early-exit-no-doc-change: &step-maybe-early-exit-no-doc-change
   run:
@@ -1005,15 +1049,6 @@ step-ts-compile: &step-ts-compile
       done
 
 # List of all steps.
-steps-electron-gn-check: &steps-electron-gn-check
-  steps:
-    - *step-setup-goma-for-build
-    - checkout-from-cache
-    - *step-setup-env-for-build
-    - *step-wait-for-goma
-    - *step-gn-gen-default
-    - *step-gn-check
-
 steps-electron-ts-compile-for-doc-change: &steps-electron-ts-compile-for-doc-change
   steps:
     # Checkout - Copied from steps-checkout
@@ -1025,11 +1060,92 @@ steps-electron-ts-compile-for-doc-change: &steps-electron-ts-compile-for-doc-cha
 
 # Command Aliases
 commands:
+  aks-specific-step:
+    parameters:
+      circle:
+        type: steps
+      aks:
+        type: steps
+      could-be-aks:
+        type: boolean
+        description: Only set this to true on linux hosts
+    steps:
+      - when:
+          condition:
+            or:
+              - equal: [<< parameters.could-be-aks >>, false]
+              - equal: [<< pipeline.parameters.large-linux-executor >>, 2xlarge]
+          steps: << parameters.circle >>
+      - when:
+          condition:
+            and:
+              - equal: [<< parameters.could-be-aks >>, true]
+              - equal: [<< pipeline.parameters.large-linux-executor >>, electronjs/aks-linux-large]
+          steps: << parameters.aks >>
+  save_cache_aks:
+    parameters:
+      step-name:
+        type: string
+      cache_key:
+        type: string
+      cache_path:
+        type: string
+    steps:
+      - run:
+          name: << parameters.step-name >>
+          command: |
+            cache_key="<< parameters.cache_key >>"
+            final_cache_path=/mnt/cross-instance-cache/${cache_key}.tar
+            echo "Using cache key: $cache_key"
+            echo "Checking path: $final_cache_path"
+            if [ ! -f "$final_cache_path" ]; then
+              echo "Cache key not founding, storing tarball"
+              tmp_container=/mnt/cross-instance-cache/tmp/$CIRCLE_WORKFLOW_JOB_ID
+              tmp_cache_path=$tmp_container/${cache_key}.tar
+              mkdir -p $tmp_container
+              if [ -f "<< parameters.cache_path >>" ]; then
+                tar -cf $tmp_cache_path -C $(dirname << parameters.cache_path >>) ./$(basename << parameters.cache_path >>)
+              else
+                tar -cf $tmp_cache_path -C << parameters.cache_path >>/ ./
+              fi
+              mv -vn $tmp_cache_path $final_cache_path
+              rm -rf $tmp_container
+            else
+              echo "Cache key already exists, skipping.."
+            fi
+  restore_cache_aks:
+    parameters:
+      step-name:
+        type: string
+      cache_key:
+        type: string
+      cache_path:
+        type: string
+    steps:
+      - run:
+          name: << parameters.step-name >>
+          command: |
+            df -h
+            for cache_key in << parameters.cache_key >>; do
+              cache_path=/mnt/cross-instance-cache/${cache_key}.tar
+              echo "Using cache key: $cache_key"
+              echo "Checking path: $cache_path"
+              if [ ! -f "$cache_path" ]; then
+                echo "Cache key not found, nothing to restore..."
+              else
+                echo "Cache key found, restoring to path..."
+                mkdir -p << parameters.cache_path >>/
+                tar -xf /mnt/cross-instance-cache/${cache_key}.tar -C << parameters.cache_path >>/
+                exit 0
+              fi
+            done
   maybe-restore-portaled-src-cache:
     parameters:
       halt-if-successful:
         type: boolean
         default: false
+      could-be-aks:
+        type: boolean
     steps:
       - run:
           name: Prepare for cross-OS sync restore
@@ -1039,23 +1155,44 @@ commands:
       - when:
           condition: << parameters.halt-if-successful >>
           steps:
-            - *step-maybe-restore-src-cache-marker
+            - aks-specific-step:
+                circle:
+                  - *step-maybe-restore-src-cache-marker
+                aks:
+                  - *step-maybe-restore-src-cache-marker-aks
+                could-be-aks: << parameters.could-be-aks >>
             - run:
                 name: Halt the job early if the src cache exists
                 command: |
                   if [ -f ".src-cache-marker" ]; then
                     circleci-agent step halt
                   fi
-      - *step-maybe-restore-src-cache
+      - aks-specific-step:
+          circle:
+            - *step-maybe-restore-src-cache
+          aks:
+            - *step-maybe-restore-src-cache-aks
+          could-be-aks: << parameters.could-be-aks >>
       - run:
-          name: Fix the src cache restore point on macOS
+          name: Fix the src cache restore point
           command: |
             if [ -d "/var/portal/src" ]; then
               echo Relocating Cache
               rm -rf src
               mv /var/portal/src ./
             fi
-
+  run-gn-check:
+    parameters:
+      could-be-aks:
+        type: boolean
+    steps:
+      - *step-setup-goma-for-build
+      - checkout-from-cache:
+          could-be-aks: << parameters.could-be-aks >>
+      - *step-setup-env-for-build
+      - *step-wait-for-goma
+      - *step-gn-gen-default
+      - *step-gn-check
   build_and_save_artifacts:
     parameters:
       artifact-key:
@@ -1169,12 +1306,16 @@ commands:
             mv_if_exist cross-arch-snapshots src
 
   checkout-from-cache:
+    parameters:
+      could-be-aks:
+        type: boolean
     steps:
       - *step-checkout-electron
       - *step-depot-tools-get
       - *step-depot-tools-add-to-path
       - *step-generate-deps-hash
-      - maybe-restore-portaled-src-cache
+      - maybe-restore-portaled-src-cache:
+          could-be-aks: << parameters.could-be-aks >>
       - run:
           name: Ensure src checkout worked
           command: |
@@ -1286,6 +1427,8 @@ commands:
       after-persist:
         type: steps
         default: []
+      could-be-aks:
+        type: boolean
     steps:
       - when:
           condition: << parameters.attach >>
@@ -1303,7 +1446,8 @@ commands:
       - when:
           condition: << parameters.checkout-and-assume-cache >>
           steps:
-            - checkout-from-cache
+            - checkout-from-cache:
+                could-be-aks: << parameters.could-be-aks >>
       - when:
           condition: << parameters.checkout >>
           steps:
@@ -1319,8 +1463,15 @@ commands:
                 steps:
                   - maybe-restore-portaled-src-cache:
                       halt-if-successful: << parameters.checkout-to-create-src-cache >>
-            - *step-maybe-restore-git-cache
+                      could-be-aks: << parameters.could-be-aks >>
+            - aks-specific-step:
+                circle:
+                  - *step-maybe-restore-git-cache
+                aks:
+                  - *step-maybe-restore-git-cache-aks
+                could-be-aks: << parameters.could-be-aks >>
             - *step-set-git-cache-path
+            - *step-fix-known-hosts-linux
             # This sync call only runs if .circle-sync-done is an EMPTY file
             - *step-gclient-sync
             - store_artifacts:
@@ -1336,7 +1487,12 @@ commands:
             - when:
                 condition: << parameters.save-git-cache >>
                 steps:
-                  - *step-save-git-cache
+                  - aks-specific-step:
+                      circle:
+                        - *step-save-git-cache
+                      aks:
+                        - *step-save-git-cache-aks
+                      could-be-aks: << parameters.could-be-aks >>
             # Mark sync as done _after_ saving the git cache so that it is uploaded
             # only when the src cache was not present
             # Their are theoretically two cases for this cache key
@@ -1386,9 +1542,19 @@ commands:
                         sudo mkdir -p /var/portal
                         sudo chown -R $(id -u):$(id -g) /var/portal
                         mv ./src /var/portal
-                  - *step-save-src-cache
+                  - aks-specific-step:
+                      circle:
+                        - *step-save-src-cache
+                      aks:
+                        - *step-save-src-cache-aks
+                      could-be-aks: << parameters.could-be-aks >>
                   - *step-make-src-cache-marker
-                  - *step-save-src-cache-marker
+                  - aks-specific-step:
+                      circle:
+                        - *step-save-src-cache-marker
+                      aks:
+                        - *step-save-src-cache-marker-aks
+                      could-be-aks: << parameters.could-be-aks >>
 
       - when:
           condition: << parameters.build >>
@@ -1442,6 +1608,18 @@ commands:
           condition: << parameters.build >>
           steps:
             - *step-maybe-notify-slack-failure
+      - when:
+          condition: << parameters.could-be-aks >>
+          steps:
+            - run:
+                name: Wait for active debug sessions
+                command: |
+                  while [ -f /var/.ssh-lock ]
+                  do
+                    sleep 60
+                  done
+                no_output_timeout: 2h
+                when: always
 
   electron-tests:
     parameters:
@@ -1628,7 +1806,7 @@ jobs:
   linux-make-src-cache:
     executor:
       name: linux-docker
-      size: xlarge
+      size: << pipeline.parameters.large-linux-executor >>
     environment:
       <<: *env-linux-2xlarge
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
@@ -1641,6 +1819,7 @@ jobs:
           checkout-to-create-src-cache: true
           artifact-key: 'nil'
           build-type: 'nil'
+          could-be-aks: true
 
   mac-checkout:
     executor:
@@ -1660,6 +1839,7 @@ jobs:
           restore-src-cache: false
           artifact-key: 'nil'
           build-type: 'nil'
+          could-be-aks: false
 
   mac-make-src-cache-x64:
     executor:
@@ -1679,6 +1859,7 @@ jobs:
           checkout-to-create-src-cache: true
           artifact-key: 'nil'
           build-type: 'nil'
+          could-be-aks: false
 
   mac-make-src-cache-arm64:
     executor:
@@ -1698,12 +1879,13 @@ jobs:
           checkout-to-create-src-cache: true
           artifact-key: 'nil'
           build-type: 'nil'
+          could-be-aks: false
 
   # Layer 2: Builds.
   linux-x64-testing:
     executor:
       name: linux-docker
-      size: electronjs/aks-linux-large
+      size: << pipeline.parameters.large-linux-executor >>
     environment:
       <<: *env-global
       <<: *env-testing-build
@@ -1716,11 +1898,12 @@ jobs:
           checkout-and-assume-cache: true
           artifact-key: 'linux-x64'
           build-type: 'Linux'
+          could-be-aks: true
 
   linux-x64-testing-asan:
     executor:
       name: linux-docker
-      size: electronjs/aks-linux-large
+      size: << pipeline.parameters.large-linux-executor >>
     environment:
       <<: *env-global
       <<: *env-testing-build
@@ -1731,25 +1914,29 @@ jobs:
     steps:
       - electron-build:
           persist: true
-          checkout: true
+          checkout: false
+          checkout-and-assume-cache: true
           build-nonproprietary-ffmpeg: false
           artifact-key: 'linux-x64-asan'
           build-type: 'Linux'
+          could-be-aks: true
 
   linux-x64-testing-gn-check:
     executor:
       name: linux-docker
-      size: medium
+      size: << pipeline.parameters.medium-linux-executor >>
     environment:
       <<: *env-linux-medium
       <<: *env-testing-build
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
-    <<: *steps-electron-gn-check
+    steps:
+      - run-gn-check:
+          could-be-aks: true
 
   linux-x64-publish:
     executor:
       name: linux-docker
-      size: electronjs/aks-linux-large
+      size: << pipeline.parameters.large-linux-executor >>
     environment:
       <<: *env-linux-2xlarge-release
       <<: *env-release-build
@@ -1772,7 +1959,7 @@ jobs:
   linux-arm-testing:
     executor:
       name: linux-docker
-      size: electronjs/aks-linux-large
+      size: << pipeline.parameters.large-linux-executor >>
     environment:
       <<: *env-global
       <<: *env-arm
@@ -1788,11 +1975,12 @@ jobs:
           checkout-and-assume-cache: true
           artifact-key: 'linux-arm'
           build-type: 'Linux ARM'
+          could-be-aks: true
 
   linux-arm-publish:
     executor:
       name: linux-docker
-      size: electronjs/aks-linux-large
+      size: << pipeline.parameters.large-linux-executor >>
     environment:
       <<: *env-linux-2xlarge-release
       <<: *env-arm
@@ -1817,7 +2005,7 @@ jobs:
   linux-arm64-testing:
     executor:
       name: linux-docker
-      size: electronjs/aks-linux-large
+      size: << pipeline.parameters.large-linux-executor >>
     environment:
       <<: *env-global
       <<: *env-arm64
@@ -1833,22 +2021,25 @@ jobs:
           checkout-and-assume-cache: true
           artifact-key: 'linux-arm64'
           build-type: 'Linux ARM64'
+          could-be-aks: true
 
   linux-arm64-testing-gn-check:
     executor:
       name: linux-docker
-      size: medium
+      size: << pipeline.parameters.medium-linux-executor >>
     environment:
       <<: *env-linux-medium
       <<: *env-arm64
       <<: *env-testing-build
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
-    <<: *steps-electron-gn-check
+    steps:
+      - run-gn-check:
+          could-be-aks: true
 
   linux-arm64-publish:
     executor:
       name: linux-docker
-      size: electronjs/aks-linux-large
+      size: << pipeline.parameters.large-linux-executor >>
     environment:
       <<: *env-linux-2xlarge-release
       <<: *env-arm64
@@ -1903,6 +2094,7 @@ jobs:
                 root: .
                 paths:
                   - generated_artifacts_mas-x64
+          could-be-aks: false
 
   osx-testing-x64-gn-check:
     executor:
@@ -1912,7 +2104,9 @@ jobs:
       <<: *env-machine-mac
       <<: *env-testing-build
       GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
-    <<: *steps-electron-gn-check
+    steps:
+      - run-gn-check:
+          could-be-aks: false
 
   osx-publish-x64:
     executor:
@@ -1994,6 +2188,7 @@ jobs:
                 root: .
                 paths:
                   - generated_artifacts_mas-arm64
+          could-be-aks: false
 
   mas-publish-x64:
     executor:

.circleci/config/params.js

@@ -0,0 +1,12 @@
+const fs = require('fs');
+
+const PARAMS_PATH = '/tmp/pipeline-parameters.json';
+
+const content = JSON.parse(fs.readFileSync(PARAMS_PATH, 'utf-8'));
+
+// Choose resource class for linux hosts
+const currentBranch = process.env.CIRCLE_BRANCH || '';
+content['large-linux-executor'] = /^pull\/[0-9-]+$/.test(currentBranch) ? '2xlarge' : 'electronjs/aks-linux-large';
+content['medium-linux-executor'] = /^pull\/[0-9-]+$/.test(currentBranch) ? 'medium' : 'electronjs/aks-linux-medium';
+
+fs.writeFileSync(PARAMS_PATH, JSON.stringify(content));

DEPS

@@ -2,7 +2,7 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '118.0.5993.5',
+    '118.0.5993.18',
   'node_version':
     'v18.17.1',
   'nan_version':

chromium_src/BUILD.gn

@@ -202,6 +202,10 @@ static_library("chrome") {
       "//chrome/browser/ui/views/status_icons/status_icon_linux_dbus.cc",
       "//chrome/browser/ui/views/status_icons/status_icon_linux_dbus.h",
     ]
+    sources += [
+      "//chrome/browser/ui/views/dark_mode_manager_linux.cc",
+      "//chrome/browser/ui/views/dark_mode_manager_linux.h",
+    ]
     public_deps += [
       "//components/dbus/menu",
       "//components/dbus/thread_linux",

docs/api/cookies.md

@@ -119,4 +119,8 @@ Removes the cookies matching `url` and `name`
 
 Returns `Promise<void>` - A promise which resolves when the cookie store has been flushed
 
-Writes any unwritten cookies data to disk.
+Writes any unwritten cookies data to disk
+
+Cookies written by any method will not be written to disk immediately, but will be written every 30 seconds or 512 operations
+
+Calling this method can cause the cookie to be written to disk immediately.

docs/api/system-preferences.md

@@ -273,7 +273,6 @@ This API is only available on macOS 10.14 Mojave or newer.
     * `window-frame` - Window frame.
     * `window-text` - Text in windows.
   * On **macOS**
-    * `alternate-selected-control-text` - The text on a selected surface in a list or table. _Deprecated_
     * `control-background` - The background of a large interface element, such as a browser or table.
     * `control` - The surface of a control.
     * `control-text` -The text of a control that isn’t disabled.
@@ -339,21 +338,6 @@ Returns `string` - Can be `dark`, `light` or `unknown`.
 Gets the macOS appearance setting that is currently applied to your application,
 maps to [NSApplication.effectiveAppearance](https://developer.apple.com/documentation/appkit/nsapplication/2967171-effectiveappearance?language=objc)
 
-### `systemPreferences.getAppLevelAppearance()` _macOS_ _Deprecated_
-
-Returns `string` | `null` - Can be `dark`, `light` or `unknown`.
-
-Gets the macOS appearance setting that you have declared you want for
-your application, maps to [NSApplication.appearance](https://developer.apple.com/documentation/appkit/nsapplication/2967170-appearance?language=objc).
-You can use the `setAppLevelAppearance` API to set this value.
-
-### `systemPreferences.setAppLevelAppearance(appearance)` _macOS_ _Deprecated_
-
-* `appearance` string | null - Can be `dark` or `light`
-
-Sets the appearance setting for your application, this should override the
-system default and override the value of `getEffectiveAppearance`.
-
 ### `systemPreferences.canPromptTouchID()` _macOS_
 
 Returns `boolean` - whether or not this device has the ability to use Touch ID.
@@ -417,16 +401,6 @@ Returns an object with system animation settings.
 
 ## Properties
 
-### `systemPreferences.appLevelAppearance` _macOS_ _Deprecated_
-
-A `string` property that can be `dark`, `light` or `unknown`. It determines the macOS appearance setting for
-your application. This maps to values in: [NSApplication.appearance](https://developer.apple.com/documentation/appkit/nsapplication/2967170-appearance?language=objc). Setting this will override the
-system default as well as the value of `getEffectiveAppearance`.
-
-Possible values that can be set are `dark` and `light`, and possible return values are `dark`, `light`, and `unknown`.
-
-This property is only available on macOS 10.14 Mojave or newer.
-
 ### `systemPreferences.effectiveAppearance` _macOS_ _Readonly_
 
 A `string` property that can be `dark`, `light` or `unknown`.

docs/breaking-changes.md

@@ -61,6 +61,41 @@ w.webContents.getPrintersAsync().then((printers) => {
 })
 ```
 
+### Removed: `systemPreferences.{get,set}AppLevelAppearance` and `systemPreferences.appLevelAppearance`
+
+The `systemPreferences.getAppLevelAppearance` and `systemPreferences.setAppLevelAppearance`
+methods have been removed, as well as the `systemPreferences.appLevelAppearance` property.
+Use the `nativeTheme` module instead.
+
+```js
+// Removed
+systemPreferences.getAppLevelAppearance()
+// Replace with
+nativeTheme.shouldUseDarkColors
+
+// Removed
+systemPreferences.appLevelAppearance
+// Replace with
+nativeTheme.shouldUseDarkColors
+
+// Removed
+systemPreferences.setAppLevelAppearance('dark')
+// Replace with
+nativeTheme.themeSource = 'dark'
+```
+
+### Removed: `alternate-selected-control-text` value for `systemPreferences.getColor`
+
+The `alternate-selected-control-text` value for `systemPreferences.getColor`
+has been removed. Use `selected-content-background` instead.
+
+```js
+// Removed
+systemPreferences.getColor('alternate-selected-control-text')
+// Replace with
+systemPreferences.getColor('selected-content-background')
+```
+
 ## Planned Breaking API Changes (26.0)
 
 ### Deprecated: `webContents.getPrinters`
@@ -635,6 +670,18 @@ to open synchronously scriptable child windows, among other incompatibilities.
 See the documentation for [window.open in Electron](api/window-open.md)
 for more details.
 
+### Deprecated: `app.runningUnderRosettaTranslation`
+
+The `app.runningUnderRosettaTranslation` property has been deprecated.
+Use `app.runningUnderARM64Translation` instead.
+
+```js
+// Deprecated
+console.log(app.runningUnderRosettaTranslation)
+// Replace with
+console.log(app.runningUnderARM64Translation)
+```
+
 ## Planned Breaking API Changes (14.0)
 
 ### Removed: `remote` module

docs/tutorial/electron-timelines.md

@@ -12,7 +12,7 @@ check out our [Electron Versioning](./electron-versioning.md) doc.
 | 27.0.0 |  2023-Aug-17 | 2023-Sep-13 | 2023-Oct-10 | TBD | M118 | TBD | ✅ |
 | 26.0.0 | 2023-Jun-01 | 2023-Jun-27 | 2023-Aug-15 | 2024-Feb-27 | M116 | v18.16 | ✅ |
 | 25.0.0 | 2023-Apr-10 | 2023-May-02 | 2023-May-30 | 2024-Jan-02 | M114 | v18.15 | ✅ |
-| 24.0.0 | 2022-Feb-09 | 2023-Mar-07 | 2023-Apr-04 | 2023-Oct-10 | M112 | v18.14 | ✅ |
+| 24.0.0 | 2023-Feb-09 | 2023-Mar-07 | 2023-Apr-04 | 2023-Oct-10 | M112 | v18.14 | ✅ |
 | 23.0.0 | 2022-Dec-01 | 2023-Jan-10 | 2023-Feb-07 | 2023-Aug-15 | M110 | v18.12 | 🚫 |
 | 22.0.0 | 2022-Sep-29 | 2022-Oct-25 | 2022-Nov-29 | 2023-Oct-10 | M108 | v16.17 | ✅ |
 | 21.0.0 | 2022-Aug-04 | 2022-Aug-30 | 2022-Sep-27 | 2023-Apr-04 | M106 | v16.16 | 🚫 |

docs/tutorial/process-model.md

@@ -228,6 +228,23 @@ channel with a renderer process using [`MessagePort`][]s. An Electron app can
 always prefer the [UtilityProcess][] API over Node.js [`child_process.fork`][] API when
 there is need to fork a child process from the main process.
 
+## Process-specific module aliases (TypeScript)
+
+Electron's npm package also exports subpaths that contain a subset of
+Electron's TypeScript type definitions.
+
+- `electron/main` includes types for all main process modules.
+- `electron/renderer` includes types for all renderer process modules.
+- `electron/common` includes types for modules that can run in main and renderer processes.
+
+These aliases have no impact on runtime, but can be used for typechecking
+and autocomplete.
+
+```js title="Usage example"
+const { app } = require('electron/main')
+const { shell } = require('electron/common')
+```
+
 [window-mdn]: https://developer.mozilla.org/en-US/docs/Web/API/Window
 [`MessagePort`]: https://developer.mozilla.org/en-US/docs/Web/API/MessagePort
 [`child_process.fork`]: https://nodejs.org/dist/latest-v16.x/docs/api/child_process.html#child_processforkmodulepath-args-options

docs/tutorial/snapcraft.md

@@ -91,14 +91,14 @@ version: '0.1'
 summary: Hello World Electron app
 description: |
   Simple Hello World Electron app as an example
-base: core18
+base: core22
 confinement: strict
 grade: stable
 
 apps:
   electron-packager-hello-world:
     command: electron-quick-start/electron-quick-start --no-sandbox
-    extensions: [gnome-3-34]
+    extensions: [gnome]
     plugs:
     - browser-support
     - network
@@ -237,6 +237,34 @@ apps:
     desktop: usr/share/applications/desktop.desktop
 ```
 
+## Optional: Enabling desktop capture
+
+Capturing the desktop requires PipeWire library in some Linux configurations that use
+the Wayland protocol. To bundle PipeWire with your application, ensure that the base
+snap is set to `core22` or newer. Next, create a part called `pipewire` and add it to
+the `after` section of your application:
+
+```yaml
+  pipewire:
+    plugin: nil
+    build-packages: [libpipewire-0.3-dev]
+    stage-packages: [pipewire]
+    prime:
+      - usr/lib/*/pipewire-*
+      - usr/lib/*/spa-*
+      - usr/lib/*/libpipewire*.so*
+      - usr/share/pipewire
+```
+
+Finally, configure your application's environment for PipeWire:
+
+```yaml
+    environment:
+      SPA_PLUGIN_DIR: $SNAP/usr/lib/$CRAFT_ARCH_TRIPLET/spa-0.2
+      PIPEWIRE_CONFIG_NAME: $SNAP/usr/share/pipewire/pipewire.conf
+      PIPEWIRE_MODULE_DIR: $SNAP/usr/lib/$CRAFT_ARCH_TRIPLET/pipewire-0.3
+```
+
 [snapcraft-syntax]: https://docs.snapcraft.io/build-snaps/syntax
 [electron-packager]: https://github.com/electron/electron-packager
 [electron-forge]: https://github.com/electron/forge

docs/tutorial/tutorial-2-first-app.md

@@ -222,14 +222,26 @@ with CommonJS module syntax:
 - [app][app], which controls your application's event lifecycle.
 - [BrowserWindow][browser-window], which creates and manages app windows.
 
-:::info Capitalization conventions
+<details><summary>Module capitalization conventions</summary>
 
 You might have noticed the capitalization difference between the **a**pp
 and **B**rowser**W**indow modules. Electron follows typical JavaScript conventions here,
 where PascalCase modules are instantiable class constructors (e.g. BrowserWindow, Tray,
 Notification) whereas camelCase modules are not instantiable (e.g. app, ipcRenderer, webContents).
 
-:::
+</details>
+
+<details><summary>Typed import aliases</summary>
+
+For better type checking when writing TypeScript code, you can choose to import
+main process modules from <code>electron/main</code>.
+
+```js
+const { app, BrowserWindow } = require('electron/main')
+```
+
+For more information, see the [Process Model docs](../tutorial/process-model.md#process-specific-module-aliases-typescript).
+</details>
 
 :::warning ES Modules in Electron
 

lib/asar/fs-wrapper.ts

@@ -1,4 +1,5 @@
 import { Buffer } from 'buffer';
+import { constants } from 'fs';
 import * as path from 'path';
 import * as util from 'util';
 import type * as Crypto from 'crypto';
@@ -67,18 +68,22 @@ const gid = process.getgid?.() ?? 0;
 
 const fakeTime = new Date();
 
+enum AsarFileType {
+  kFile = (constants as any).UV_DIRENT_FILE,
+  kDirectory = (constants as any).UV_DIRENT_DIR,
+  kLink = (constants as any).UV_DIRENT_LINK,
+}
+
+const fileTypeToMode = new Map<AsarFileType, number>([
+  [AsarFileType.kFile, constants.S_IFREG],
+  [AsarFileType.kDirectory, constants.S_IFDIR],
+  [AsarFileType.kLink, constants.S_IFLNK]
+]);
+
 const asarStatsToFsStats = function (stats: NodeJS.AsarFileStat) {
-  const { Stats, constants } = require('fs');
+  const { Stats } = require('fs');
 
-  let mode = constants.S_IROTH ^ constants.S_IRGRP ^ constants.S_IRUSR ^ constants.S_IWUSR;
-
-  if (stats.isFile) {
-    mode ^= constants.S_IFREG;
-  } else if (stats.isDirectory) {
-    mode ^= constants.S_IFDIR;
-  } else if (stats.isLink) {
-    mode ^= constants.S_IFLNK;
-  }
+  const mode = constants.S_IROTH | constants.S_IRGRP | constants.S_IRUSR | constants.S_IWUSR | fileTypeToMode.get(stats.type)!;
 
   return new Stats(
     1, // dev
@@ -241,7 +246,6 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
   const logASARAccess = (asarPath: string, filePath: string, offset: number) => {
     if (!process.env.ELECTRON_LOG_ASAR_READS) return;
     if (!logFDs.has(asarPath)) {
-      const path = require('path');
       const logFilename = `${path.basename(asarPath, '.asar')}-access-log.txt`;
       const logPath = path.join(require('os').tmpdir(), logFilename);
       logFDs.set(asarPath, fs.openSync(logPath, 'a'));
@@ -657,13 +661,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
           nextTick(callback!, [error]);
           return;
         }
-        if (stats.isFile) {
-          dirents.push(new fs.Dirent(file, fs.constants.UV_DIRENT_FILE));
-        } else if (stats.isDirectory) {
-          dirents.push(new fs.Dirent(file, fs.constants.UV_DIRENT_DIR));
-        } else if (stats.isLink) {
-          dirents.push(new fs.Dirent(file, fs.constants.UV_DIRENT_LINK));
-        }
+        dirents.push(new fs.Dirent(file, stats.type));
       }
       nextTick(callback!, [null, dirents]);
       return;
@@ -700,13 +698,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
         if (!stats) {
           throw createError(AsarError.NOT_FOUND, { asarPath, filePath: childPath });
         }
-        if (stats.isFile) {
-          dirents.push(new fs.Dirent(file, fs.constants.UV_DIRENT_FILE));
-        } else if (stats.isDirectory) {
-          dirents.push(new fs.Dirent(file, fs.constants.UV_DIRENT_DIR));
-        } else if (stats.isLink) {
-          dirents.push(new fs.Dirent(file, fs.constants.UV_DIRENT_LINK));
-        }
+        dirents.push(new fs.Dirent(file, stats.type));
       }
       return dirents;
     }
@@ -757,7 +749,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     const stats = archive.stat(filePath);
     if (!stats) return -34;
 
-    return (stats.isDirectory) ? 1 : 0;
+    return (stats.type === AsarFileType.kDirectory) ? 1 : 0;
   };
 
   // Calling mkdir for directory inside asar archive should throw ENOTDIR

lib/browser/api/system-preferences.ts

@@ -1,33 +1,5 @@
-import * as deprecate from '@electron/internal/common/deprecate';
-
 const { systemPreferences } = process._linkedBinding('electron_browser_system_preferences');
 
-if ('getAppLevelAppearance' in systemPreferences) {
-  const nativeALAGetter = systemPreferences.getAppLevelAppearance;
-  const nativeALASetter = systemPreferences.setAppLevelAppearance;
-  const warnALA = deprecate.warnOnce('appLevelAppearance');
-  const warnALAGetter = deprecate.warnOnce('getAppLevelAppearance function');
-  const warnALASetter = deprecate.warnOnce('setAppLevelAppearance function');
-  Object.defineProperty(systemPreferences, 'appLevelAppearance', {
-    get: () => {
-      warnALA();
-      return nativeALAGetter.call(systemPreferences);
-    },
-    set: (appearance) => {
-      warnALA();
-      nativeALASetter.call(systemPreferences, appearance);
-    }
-  });
-  systemPreferences.getAppLevelAppearance = () => {
-    warnALAGetter();
-    return nativeALAGetter.call(systemPreferences);
-  };
-  systemPreferences.setAppLevelAppearance = (appearance) => {
-    warnALASetter();
-    nativeALASetter.call(systemPreferences, appearance);
-  };
-}
-
 if ('getEffectiveAppearance' in systemPreferences) {
   const nativeEAGetter = systemPreferences.getEffectiveAppearance;
   Object.defineProperty(systemPreferences, 'effectiveAppearance', {

lib/browser/api/web-contents.ts

@@ -337,49 +337,53 @@ WebContents.prototype.printToPDF = async function (options) {
 // TODO(codebytere): deduplicate argument sanitization by moving rest of
 // print param logic into new file shared between printToPDF and print
 WebContents.prototype.print = function (options: ElectronInternal.WebContentsPrintOptions, callback) {
-  if (typeof options === 'object') {
-    const pageSize = options.pageSize ?? 'A4';
-    if (typeof pageSize === 'object') {
-      if (!pageSize.height || !pageSize.width) {
-        throw new Error('height and width properties are required for pageSize');
-      }
+  if (typeof options !== 'object') {
+    throw new Error('webContents.print(): Invalid print settings specified.');
+  }
 
-      // Dimensions in Microns - 1 meter = 10^6 microns
-      const height = Math.ceil(pageSize.height);
-      const width = Math.ceil(pageSize.width);
-      if (!isValidCustomPageSize(width, height)) {
-        throw new Error('height and width properties must be minimum 352 microns.');
-      }
+  const printSettings: Record<string, any> = { ...options };
 
-      options.mediaSize = {
-        name: 'CUSTOM',
-        custom_display_name: 'Custom',
-        height_microns: height,
-        width_microns: width,
-        imageable_area_left_microns: 0,
-        imageable_area_bottom_microns: 0,
-        imageable_area_right_microns: width,
-        imageable_area_top_microns: height
-      };
-    } else if (typeof pageSize === 'string' && PDFPageSizes[pageSize]) {
-      const mediaSize = PDFPageSizes[pageSize];
-      options.mediaSize = {
-        ...mediaSize,
-        imageable_area_left_microns: 0,
-        imageable_area_bottom_microns: 0,
-        imageable_area_right_microns: mediaSize.width_microns,
-        imageable_area_top_microns: mediaSize.height_microns
-      };
-    } else {
-      throw new Error(`Unsupported pageSize: ${pageSize}`);
+  const pageSize = options.pageSize ?? 'A4';
+  if (typeof pageSize === 'object') {
+    if (!pageSize.height || !pageSize.width) {
+      throw new Error('height and width properties are required for pageSize');
     }
+
+    // Dimensions in Microns - 1 meter = 10^6 microns
+    const height = Math.ceil(pageSize.height);
+    const width = Math.ceil(pageSize.width);
+    if (!isValidCustomPageSize(width, height)) {
+      throw new Error('height and width properties must be minimum 352 microns.');
+    }
+
+    printSettings.mediaSize = {
+      name: 'CUSTOM',
+      custom_display_name: 'Custom',
+      height_microns: height,
+      width_microns: width,
+      imageable_area_left_microns: 0,
+      imageable_area_bottom_microns: 0,
+      imageable_area_right_microns: width,
+      imageable_area_top_microns: height
+    };
+  } else if (typeof pageSize === 'string' && PDFPageSizes[pageSize]) {
+    const mediaSize = PDFPageSizes[pageSize];
+    printSettings.mediaSize = {
+      ...mediaSize,
+      imageable_area_left_microns: 0,
+      imageable_area_bottom_microns: 0,
+      imageable_area_right_microns: mediaSize.width_microns,
+      imageable_area_top_microns: mediaSize.height_microns
+    };
+  } else {
+    throw new Error(`Unsupported pageSize: ${pageSize}`);
   }
 
   if (this._print) {
     if (callback) {
-      this._print(options, callback);
+      this._print(printSettings, callback);
     } else {
-      this._print(options);
+      this._print(printSettings);
     }
   } else {
     console.error('Error: Printing feature is disabled.');

patches/chromium/.patches

@@ -131,3 +131,4 @@ build_remove_ent_content_analysis_assert.patch
 fix_activate_background_material_on_windows.patch
 fix_move_autopipsettingshelper_behind_branding_buildflag.patch
 revert_remove_the_allowaggressivethrottlingwithwebsocket_feature.patch
+revert_same_party_cookie_attribute_removal.patch

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -33,10 +33,10 @@ index 41ce32113ec2679b76d5a4fd69a7109c832ac7a1..1cd35794bf78f3d92b42634d9494c85a
            "//base",
            "//build:branding_buildflags",
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
-index 1a9bff4a3efb7fd802db7ae9696027ee318eb7eb..85d2bc48117c7e41cfa49ea204d2c46f79a1c117 100644
+index 9ab6c039d18f8759b8d7db9742d3570a7734f893..ae347df7a1b1a48723160787f71cfd1340f430ef 100644
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -4723,7 +4723,7 @@ static_library("browser") {
+@@ -4725,7 +4725,7 @@ static_library("browser") {
  
      # On Windows, the hashes are embedded in //chrome:chrome_initial rather
      # than here in :chrome_dll.
@@ -46,10 +46,10 @@ index 1a9bff4a3efb7fd802db7ae9696027ee318eb7eb..85d2bc48117c7e41cfa49ea204d2c46f
        sources += [ "certificate_viewer_stub.cc" ]
      }
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 6a2501dde4552c2b0d96dd54fc1b94ba1e610b0c..8d3cb67ae6d4fe65cfbb907309af734906b49949 100644
+index 8f9b476a538dd5a0e91edc725eed4463b4a92e05..be625ce71f271aa47444fff1dc8d861c6cf2f43a 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -6838,7 +6838,6 @@ test("unit_tests") {
+@@ -6841,7 +6841,6 @@ test("unit_tests") {
  
      deps += [
        "//chrome:other_version",
@@ -57,7 +57,7 @@ index 6a2501dde4552c2b0d96dd54fc1b94ba1e610b0c..8d3cb67ae6d4fe65cfbb907309af7349
        "//chrome//services/util_win:unit_tests",
        "//chrome/app:chrome_dll_resources",
        "//chrome/app:win_unit_tests",
-@@ -6864,6 +6863,10 @@ test("unit_tests") {
+@@ -6867,6 +6866,10 @@ test("unit_tests") {
        "//ui/resources",
      ]
  
@@ -68,7 +68,7 @@ index 6a2501dde4552c2b0d96dd54fc1b94ba1e610b0c..8d3cb67ae6d4fe65cfbb907309af7349
      ldflags = [
        "/DELAYLOAD:api-ms-win-core-winrt-error-l1-1-0.dll",
        "/DELAYLOAD:api-ms-win-core-winrt-l1-1-0.dll",
-@@ -7831,7 +7834,6 @@ test("unit_tests") {
+@@ -7834,7 +7837,6 @@ test("unit_tests") {
      }
  
      deps += [
@@ -76,7 +76,7 @@ index 6a2501dde4552c2b0d96dd54fc1b94ba1e610b0c..8d3cb67ae6d4fe65cfbb907309af7349
        "//chrome/browser/apps:icon_standardizer",
        "//chrome/browser/apps/app_service",
        "//chrome/browser/apps/app_service:app_registry_cache_waiter",
-@@ -7918,6 +7920,10 @@ test("unit_tests") {
+@@ -7921,6 +7923,10 @@ test("unit_tests") {
        "//ui/webui/resources/js/browser_command:mojo_bindings",
      ]
  

patches/chromium/build_only_use_the_mas_build_config_in_the_required_components.patch

@@ -74,7 +74,7 @@ index 729753a72edd761ec831f79828742a26f9dd2417..45858456c9c8c82870c41b0edd1359d1
  
    if (is_win) {
 diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
-index 718ad3e088f6730bb00f1e3674effae6c429b9b6..77af941f2dd2d3074f5596cee24be47dc8175434 100644
+index 368cf7aaffeef5f9796f78a72f13eddb6c44dec9..ade39af8ac41c91d4fd4b9a905ce5d836bea7d87 100644
 --- a/content/browser/BUILD.gn
 +++ b/content/browser/BUILD.gn
 @@ -56,6 +56,7 @@ source_set("browser") {
@@ -110,10 +110,10 @@ index b16be8f9992b23ce93d174531f2debd7f18bb436..119038743dc222907cb74c2c3ea34d23
  
    public_deps = [
 diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
-index 581571b6bb1a655319b247d7cc85bb2a4dd7db1c..09779610326da207062a59ba572b2d7c13efd26f 100644
+index 9efe02bc63033f9d2e39a97c95038eb27a1c2f93..1535e9346218c4b0dd71be53e8830b8d299561cc 100644
 --- a/content/test/BUILD.gn
 +++ b/content/test/BUILD.gn
-@@ -480,6 +480,7 @@ static_library("test_support") {
+@@ -481,6 +481,7 @@ static_library("test_support") {
    configs += [
      "//build/config:precompiled_headers",
      "//v8:external_startup_data",

patches/chromium/can_create_window.patch

@@ -9,7 +9,7 @@ potentially prevent a window from being created.
 TODO(loc): this patch is currently broken.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index 50d873e238b04eb6d461dc929d98dfe171cc491c..586aa87098bd3db10440fe865a02c05e7b3be14f 100644
+index ad0d9cd11022f4f35e717efc088593df41d46496..40b63b1fbde84b8b3f854ce763474cd044f6ea96 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
 @@ -8206,6 +8206,7 @@ void RenderFrameHostImpl::CreateNewWindow(

patches/chromium/chore_patch_out_profile_methods_in_titlebar_config.patch

@@ -6,7 +6,7 @@ Subject: chore: patch out Profile methods in titlebar_config
 Make this code linkable in Electron by removing Profile references.
 
 diff --git a/chrome/browser/win/titlebar_config.cc b/chrome/browser/win/titlebar_config.cc
-index 92d0e8165a264c7ef2701a66e0f7179f0d080f47..b0c91778399f811a5d1b0f208488667cb38459e1 100644
+index f088a7071b1e0e1e05aee5637484b1dea3e2a6fa..8d411e550f6a8ca1a4070bf5d5719703f90b3dfa 100644
 --- a/chrome/browser/win/titlebar_config.cc
 +++ b/chrome/browser/win/titlebar_config.cc
 @@ -19,8 +19,10 @@ BASE_FEATURE(kWindows11MicaTitlebar,

patches/chromium/desktop_media_list.patch

@@ -22,7 +22,7 @@ index 42da00a0f473928263df89f11d80830b6986292b..6a556939d0acfbd910ebb0923e198e2f
    virtual int GetSourceCount() const = 0;
    virtual const Source& GetSource(int index) const = 0;
 diff --git a/chrome/browser/media/webrtc/desktop_media_list_base.cc b/chrome/browser/media/webrtc/desktop_media_list_base.cc
-index 0389599ac786b6abd61ca921347fe12ddd5d0ee7..780927301744ea7312f230cec76a24a33d71f767 100644
+index 489e6f7b7b0bb52b938a4fc137b983f3330cd4d2..1f2754dae9b81a7d233539a7e4e6ac77b3c5941f 100644
 --- a/chrome/browser/media/webrtc/desktop_media_list_base.cc
 +++ b/chrome/browser/media/webrtc/desktop_media_list_base.cc
 @@ -69,12 +69,12 @@ void DesktopMediaListBase::StartUpdating(DesktopMediaListObserver* observer) {
@@ -41,7 +41,7 @@ index 0389599ac786b6abd61ca921347fe12ddd5d0ee7..780927301744ea7312f230cec76a24a3
  
  int DesktopMediaListBase::GetSourceCount() const {
 diff --git a/chrome/browser/media/webrtc/desktop_media_list_base.h b/chrome/browser/media/webrtc/desktop_media_list_base.h
-index b65012985ff1797203160d9e26af17fefee5c244..9ee211fb487007bd37b57cfa7b4ffbe5307af637 100644
+index 2cd1000b90fb5af464f81ac25b63092b638c6d40..8f18adb5641b3fa5f9defd3490e20a5d86b672e9 100644
 --- a/chrome/browser/media/webrtc/desktop_media_list_base.h
 +++ b/chrome/browser/media/webrtc/desktop_media_list_base.h
 @@ -39,7 +39,7 @@ class DesktopMediaListBase : public DesktopMediaList {
@@ -82,10 +82,10 @@ index 33ca7a53dfb6d2c9e3a33f0065a3acd806e82e01..9fdf2e8ff0056ff407015b914c6b03eb
    const Source& GetSource(int index) const override;
    DesktopMediaList::Type GetMediaListType() const override;
 diff --git a/chrome/browser/media/webrtc/native_desktop_media_list.cc b/chrome/browser/media/webrtc/native_desktop_media_list.cc
-index 81d4416e270e1a4548866a56222c47cb616385e3..22f55d22b0406f0d1aa642dcea44403ac1636057 100644
+index c2c7d86ed1f089ca6abbb026b4cf4e2857ef66c1..d65182dbae1447d95230a581943d23ee144d9dbe 100644
 --- a/chrome/browser/media/webrtc/native_desktop_media_list.cc
 +++ b/chrome/browser/media/webrtc/native_desktop_media_list.cc
-@@ -159,7 +159,7 @@ BOOL CALLBACK AllHwndCollector(HWND hwnd, LPARAM param) {
+@@ -160,7 +160,7 @@ BOOL CALLBACK AllHwndCollector(HWND hwnd, LPARAM param) {
  #if BUILDFLAG(IS_MAC)
  BASE_FEATURE(kWindowCaptureMacV2,
               "WindowCaptureMacV2",
@@ -94,7 +94,7 @@ index 81d4416e270e1a4548866a56222c47cb616385e3..22f55d22b0406f0d1aa642dcea44403a
  #endif
  
  }  // namespace
-@@ -235,7 +235,7 @@ class NativeDesktopMediaList::Worker
+@@ -244,7 +244,7 @@ class NativeDesktopMediaList::Worker
    base::WeakPtr<NativeDesktopMediaList> media_list_;
  
    DesktopMediaList::Type type_;
@@ -103,7 +103,7 @@ index 81d4416e270e1a4548866a56222c47cb616385e3..22f55d22b0406f0d1aa642dcea44403a
    const ThumbnailCapturer::FrameDeliveryMethod frame_delivery_method_;
    const bool add_current_process_windows_;
  
-@@ -529,6 +529,12 @@ void NativeDesktopMediaList::Worker::RefreshNextThumbnail() {
+@@ -531,6 +531,12 @@ void NativeDesktopMediaList::Worker::RefreshNextThumbnail() {
        FROM_HERE,
        base::BindOnce(&NativeDesktopMediaList::UpdateNativeThumbnailsFinished,
                       media_list_));
@@ -116,7 +116,7 @@ index 81d4416e270e1a4548866a56222c47cb616385e3..22f55d22b0406f0d1aa642dcea44403a
  }
  
  void NativeDesktopMediaList::Worker::OnCaptureResult(
-@@ -935,6 +941,11 @@ void NativeDesktopMediaList::RefreshForVizFrameSinkWindows(
+@@ -964,6 +970,11 @@ void NativeDesktopMediaList::RefreshForVizFrameSinkWindows(
          FROM_HERE, base::BindOnce(&Worker::RefreshThumbnails,
                                    base::Unretained(worker_.get()),
                                    std::move(native_ids), thumbnail_size_));

patches/chromium/disable_color_correct_rendering.patch

@@ -148,7 +148,7 @@ index 6892376fa33d006453977c354734d880a7ef7c91..4cd7b762d5fe1c54f5b06cc0d8f50560
  }
  
 diff --git a/third_party/blink/renderer/platform/widget/compositing/layer_tree_settings.cc b/third_party/blink/renderer/platform/widget/compositing/layer_tree_settings.cc
-index 368105b62e1650255e28cf71fcac2b956e811658..2dbbef93571ff5d41fc70a339d22470fdc5f5529 100644
+index b35f43f7051c2aabf6a49dd9af6627c9fbb2e99f..688954856aaf12565f4c63b3ffbb5459fe634693 100644
 --- a/third_party/blink/renderer/platform/widget/compositing/layer_tree_settings.cc
 +++ b/third_party/blink/renderer/platform/widget/compositing/layer_tree_settings.cc
 @@ -30,6 +30,7 @@
@@ -159,7 +159,7 @@ index 368105b62e1650255e28cf71fcac2b956e811658..2dbbef93571ff5d41fc70a339d22470f
  #include "ui/native_theme/native_theme_features.h"
  #include "ui/native_theme/overlay_scrollbar_constants_aura.h"
  
-@@ -332,6 +333,9 @@ cc::LayerTreeSettings GenerateLayerTreeSettings(
+@@ -318,6 +319,9 @@ cc::LayerTreeSettings GenerateLayerTreeSettings(
    settings.main_frame_before_activation_enabled =
        cmd.HasSwitch(cc::switches::kEnableMainFrameBeforeActivation);
  

patches/chromium/expose_setuseragent_on_networkcontext.patch

@@ -33,10 +33,10 @@ index 0ab8187b0db8ae6db46d81738f653a2bc4c566f6..de3d55e85c22317f7f9375eb94d0d5d4
  
  }  // namespace net
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
-index cb05975b622eee25217d9f2477c5e53ace017db8..e264713f4361a588e0ec8b4f6f37ab76ad642116 100644
+index 30c2fb786dac5f38104ecdac170bdd2e76f1ab6f..f857ea2d258a5ee734ec9e0d40696d5feacbf23a 100644
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
-@@ -1559,6 +1559,13 @@ void NetworkContext::SetNetworkConditions(
+@@ -1561,6 +1561,13 @@ void NetworkContext::SetNetworkConditions(
                                        std::move(network_conditions));
  }
  
@@ -51,7 +51,7 @@ index cb05975b622eee25217d9f2477c5e53ace017db8..e264713f4361a588e0ec8b4f6f37ab76
    // This may only be called on NetworkContexts created with the constructor
    // that calls MakeURLRequestContext().
 diff --git a/services/network/network_context.h b/services/network/network_context.h
-index 25f9dab24b27ad2b3d6ca01690e9f5c3fea96d32..b230036559cdc44b97b3a5ca5f359a0b4512ccd7 100644
+index 17ecfd109db3e9dbcc27ec291f6c6021c9b6f0eb..80a75a25595718a2c4e655f75620d18b274b24cd 100644
 --- a/services/network/network_context.h
 +++ b/services/network/network_context.h
 @@ -316,6 +316,7 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
@@ -63,7 +63,7 @@ index 25f9dab24b27ad2b3d6ca01690e9f5c3fea96d32..b230036559cdc44b97b3a5ca5f359a0b
    void SetEnableReferrers(bool enable_referrers) override;
  #if BUILDFLAG(IS_CHROMEOS)
 diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
-index 6ebade992b628fee18d23e5e29d2d7d6190261a7..21039664d38fb228a9319d296276c33de7a0a265 100644
+index 64a840b13bc6c07112060f48d4f77507eb84994a..7482c19600f48bf7ae4a37ce55ffcbea922b8d42 100644
 --- a/services/network/public/mojom/network_context.mojom
 +++ b/services/network/public/mojom/network_context.mojom
 @@ -1233,6 +1233,9 @@ interface NetworkContext {

patches/chromium/feat_add_set_theme_source_to_allow_apps_to.patch

@@ -13,10 +13,10 @@ uses internally for things like menus and devtools.
 We can remove this patch once it has in some shape been upstreamed.
 
 diff --git a/ui/native_theme/native_theme.cc b/ui/native_theme/native_theme.cc
-index f6556e141a76b0766f672bfa5819256e635c60af..06c7ac178cefc149732294ed790f2b7cbb328d34 100644
+index af49c133fb2b176139263553d2afff33e96a94b1..699c38b2046e267619eef103c83eff258887e0c0 100644
 --- a/ui/native_theme/native_theme.cc
 +++ b/ui/native_theme/native_theme.cc
-@@ -153,6 +153,8 @@ NativeTheme::NativeTheme(bool should_use_dark_colors,
+@@ -156,6 +156,8 @@ NativeTheme::NativeTheme(bool should_use_dark_colors,
  NativeTheme::~NativeTheme() = default;
  
  bool NativeTheme::ShouldUseDarkColors() const {
@@ -26,7 +26,7 @@ index f6556e141a76b0766f672bfa5819256e635c60af..06c7ac178cefc149732294ed790f2b7c
  }
  
 diff --git a/ui/native_theme/native_theme.h b/ui/native_theme/native_theme.h
-index 6f51a8ffec973d6c2acacabb951c7cc4e36b639c..889e655fccc115faae932236cc28c6386cf19c1e 100644
+index 341248a6b15b280c382c965009540fbdb64b0978..c9bead90658ac0e2d503c90c6ce380a318fee457 100644
 --- a/ui/native_theme/native_theme.h
 +++ b/ui/native_theme/native_theme.h
 @@ -433,6 +433,23 @@ class NATIVE_THEME_EXPORT NativeTheme {
@@ -53,7 +53,7 @@ index 6f51a8ffec973d6c2acacabb951c7cc4e36b639c..889e655fccc115faae932236cc28c638
    // Returns a shared instance of the native theme that should be used for web
    // rendering. Do not use it in a normal application context (i.e. browser).
    // The returned object should not be deleted by the caller. This function is
-@@ -643,6 +660,7 @@ class NATIVE_THEME_EXPORT NativeTheme {
+@@ -654,6 +671,7 @@ class NATIVE_THEME_EXPORT NativeTheme {
    bool inverted_colors_ = false;
    PreferredColorScheme preferred_color_scheme_ = PreferredColorScheme::kLight;
    PreferredContrast preferred_contrast_ = PreferredContrast::kNoPreference;
@@ -62,10 +62,10 @@ index 6f51a8ffec973d6c2acacabb951c7cc4e36b639c..889e655fccc115faae932236cc28c638
    SEQUENCE_CHECKER(sequence_checker_);
  };
 diff --git a/ui/native_theme/native_theme_win.cc b/ui/native_theme/native_theme_win.cc
-index faa15be0b3e08360c702b32968d3b1633038d776..7a6c284143e873b408333fa2052e05863935cb89 100644
+index 595b7185832126dd3d8ca85c445b835e5969adcb..58c64b98a0f94b0be7e7819999cf81dedf9bbe08 100644
 --- a/ui/native_theme/native_theme_win.cc
 +++ b/ui/native_theme/native_theme_win.cc
-@@ -658,6 +658,8 @@ bool NativeThemeWin::ShouldUseDarkColors() const {
+@@ -663,6 +663,8 @@ bool NativeThemeWin::ShouldUseDarkColors() const {
    // ...unless --force-dark-mode was specified in which case caveat emptor.
    if (InForcedColorsMode() && !IsForcedDarkMode())
      return false;

patches/chromium/fix_properly_honor_printing_page_ranges.patch

@@ -100,10 +100,10 @@ index 07847521e7217c78480205812a73cc89503c00d2..586e866ca7ec0eb0b573d23e3bd95792
    } else {
      // No need to bother, we don't know how many pages are available.
 diff --git a/ui/gtk/printing/print_dialog_gtk.cc b/ui/gtk/printing/print_dialog_gtk.cc
-index e270fa36d775333aaa30f1ff0104062c544d1058..e4a6213e19e4f23834802784a43db22c9d02d891 100644
+index dcabfdab6cc5a0f0a79f797d3660118b780bd110..bcbfeef775e40c1b0c1bbac49dd520e602bc4cb9 100644
 --- a/ui/gtk/printing/print_dialog_gtk.cc
 +++ b/ui/gtk/printing/print_dialog_gtk.cc
-@@ -245,6 +245,24 @@ void PrintDialogGtk::UpdateSettings(
+@@ -248,6 +248,24 @@ void PrintDialogGtk::UpdateSettings(
  
    gtk_print_settings_set_n_copies(gtk_settings_, settings->copies());
    gtk_print_settings_set_collate(gtk_settings_, settings->collate());

patches/chromium/network_service_allow_remote_certificate_verification_logic.patch

@@ -7,7 +7,7 @@ This adds a callback from the network service that's used to implement
 session.setCertificateVerifyCallback.
 
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
-index f076c5dc62ca5975865e3966381257684503eeb8..cb05975b622eee25217d9f2477c5e53ace017db8 100644
+index a107e19d2aa1cab31c88688904db128e61bcdc5e..30c2fb786dac5f38104ecdac170bdd2e76f1ab6f 100644
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
 @@ -146,6 +146,11 @@
@@ -122,7 +122,7 @@ index f076c5dc62ca5975865e3966381257684503eeb8..cb05975b622eee25217d9f2477c5e53a
  constexpr uint32_t NetworkContext::kMaxOutstandingRequestsPerProcess;
  
  NetworkContext::NetworkContextHttpAuthPreferences::
-@@ -824,6 +922,13 @@ void NetworkContext::SetClient(
+@@ -826,6 +924,13 @@ void NetworkContext::SetClient(
    client_.Bind(std::move(client));
  }
  
@@ -136,7 +136,7 @@ index f076c5dc62ca5975865e3966381257684503eeb8..cb05975b622eee25217d9f2477c5e53a
  void NetworkContext::CreateURLLoaderFactory(
      mojo::PendingReceiver<mojom::URLLoaderFactory> receiver,
      mojom::URLLoaderFactoryParamsPtr params) {
-@@ -2383,6 +2488,9 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
+@@ -2385,6 +2490,9 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
          std::move(cert_verifier));
      cert_verifier = base::WrapUnique(cert_verifier_with_trust_anchors_.get());
  #endif  // BUILDFLAG(IS_CHROMEOS)
@@ -147,7 +147,7 @@ index f076c5dc62ca5975865e3966381257684503eeb8..cb05975b622eee25217d9f2477c5e53a
  
    builder.SetCertVerifier(IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
 diff --git a/services/network/network_context.h b/services/network/network_context.h
-index d046d6909a9e648ddc86cbed9cb118d29223155e..25f9dab24b27ad2b3d6ca01690e9f5c3fea96d32 100644
+index a1ac41b0850de88c3334d7b7aa3bfc470365b873..17ecfd109db3e9dbcc27ec291f6c6021c9b6f0eb 100644
 --- a/services/network/network_context.h
 +++ b/services/network/network_context.h
 @@ -114,6 +114,7 @@ class URLMatcher;
@@ -177,7 +177,7 @@ index d046d6909a9e648ddc86cbed9cb118d29223155e..25f9dab24b27ad2b3d6ca01690e9f5c3
    std::unique_ptr<HostResolver> internal_host_resolver_;
    // Map values set to non-null only if that HostResolver has its own private
 diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
-index 039407080ba9b234b0472afd7d56d44802fd3c0e..6ebade992b628fee18d23e5e29d2d7d6190261a7 100644
+index 6164ab364a4044b9ca63d78dd5cc8c94ede7894c..64a840b13bc6c07112060f48d4f77507eb84994a 100644
 --- a/services/network/public/mojom/network_context.mojom
 +++ b/services/network/public/mojom/network_context.mojom
 @@ -317,6 +317,17 @@ struct NetworkContextFilePaths {

patches/chromium/port_autofill_colors_to_the_color_pipeline.patch

@@ -61,10 +61,10 @@ index f1aadfefe2b35ff4f292a04d834679e1c3fe89e9..7cb39e4059719a4fc323586e83aba47d
  }
  
 diff --git a/ui/color/win/native_color_mixers_win.cc b/ui/color/win/native_color_mixers_win.cc
-index d9df0c0be6abf72c4756fb8e0f1e4b8c308a09f3..07ad3bf7e422272f017695c8b0e0aebedb8d8330 100644
+index a0eb66d2a28b19ee92e2c3c23fd3eff5d64d502d..1d3b62d504884e036365256443c1a1b4f0c796ab 100644
 --- a/ui/color/win/native_color_mixers_win.cc
 +++ b/ui/color/win/native_color_mixers_win.cc
-@@ -202,6 +202,10 @@ void AddNativeUiColorMixer(ColorProvider* provider,
+@@ -205,6 +205,10 @@ void AddNativeUiColorMixer(ColorProvider* provider,
        SetAlpha(kColorNotificationInputForeground, gfx::kGoogleGreyAlpha700);
    mixer[kColorSliderTrack] = AlphaBlend(
        kColorNativeHighlight, kColorNativeWindow, gfx::kGoogleGreyAlpha400);
@@ -75,7 +75,7 @@ index d9df0c0be6abf72c4756fb8e0f1e4b8c308a09f3..07ad3bf7e422272f017695c8b0e0aebe
  
    // Window Background
    mixer[kColorBubbleFooterBackground] = {kColorNativeWindow};
-@@ -211,6 +215,7 @@ void AddNativeUiColorMixer(ColorProvider* provider,
+@@ -214,6 +218,7 @@ void AddNativeUiColorMixer(ColorProvider* provider,
    mixer[kColorFrameInactive] = {kColorNativeWindow};
    mixer[kColorPrimaryBackground] = {kColorNativeWindow};
    mixer[kColorTooltipBackground] = {kColorNativeWindow};
@@ -83,7 +83,7 @@ index d9df0c0be6abf72c4756fb8e0f1e4b8c308a09f3..07ad3bf7e422272f017695c8b0e0aebe
  
    // Window Text
    mixer[kColorAlertLowSeverity] = {kColorNativeWindowText};
-@@ -225,6 +230,7 @@ void AddNativeUiColorMixer(ColorProvider* provider,
+@@ -228,6 +233,7 @@ void AddNativeUiColorMixer(ColorProvider* provider,
    mixer[kColorTableGroupingIndicator] = {kColorNativeWindowText};
    mixer[kColorThrobber] = {kColorNativeWindowText};
    mixer[kColorTooltipForeground] = {kColorNativeWindowText};
@@ -91,7 +91,7 @@ index d9df0c0be6abf72c4756fb8e0f1e4b8c308a09f3..07ad3bf7e422272f017695c8b0e0aebe
  
    // Hyperlinks
    mixer[kColorForcedHotlight] = {kColorNativeHotlight};
-@@ -271,6 +277,7 @@ void AddNativeUiColorMixer(ColorProvider* provider,
+@@ -274,6 +280,7 @@ void AddNativeUiColorMixer(ColorProvider* provider,
    mixer[kColorTextfieldForeground] = {kColorNativeBtnText};
    mixer[kColorTextfieldForegroundPlaceholder] = {kColorNativeBtnText};
    mixer[kColorTextfieldForegroundDisabled] = {kColorNativeBtnText};

patches/chromium/printing.patch

@@ -706,7 +706,7 @@ index 3f9a514fb41d72c5d06de6ac989f9d7c0513a4e7..0e7ada9df962808dad7caf074a08ebde
    // Tells the browser printing failed.
    PrintingFailed(int32 cookie, PrintFailureReason reason);
 diff --git a/components/printing/renderer/print_render_frame_helper.cc b/components/printing/renderer/print_render_frame_helper.cc
-index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc86a1777cd 100644
+index ec3c62f88268d6cf0d8abadf483dacb31ff09d3d..b0af8b9f2286c95efabe66ecfc0eaa8a6700c81d 100644
 --- a/components/printing/renderer/print_render_frame_helper.cc
 +++ b/components/printing/renderer/print_render_frame_helper.cc
 @@ -45,6 +45,7 @@
@@ -717,7 +717,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
  #include "printing/units.h"
  #include "services/metrics/public/cpp/ukm_source_id.h"
  #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
-@@ -1322,14 +1323,14 @@ void PrintRenderFrameHelper::ScriptedPrint(bool user_initiated) {
+@@ -1279,14 +1280,14 @@ void PrintRenderFrameHelper::ScriptedPrint(bool user_initiated) {
    }
  
    print_in_progress_ = true;
@@ -734,7 +734,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
    if (!weak_this) {
      return;
    }
-@@ -1360,7 +1361,7 @@ void PrintRenderFrameHelper::BindPrintRenderFrameReceiver(
+@@ -1317,7 +1318,7 @@ void PrintRenderFrameHelper::BindPrintRenderFrameReceiver(
    receivers_.Add(this, std::move(receiver));
  }
  
@@ -743,7 +743,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
    ScopedIPC scoped_ipc(weak_ptr_factory_.GetWeakPtr());
    if (ipc_nesting_level_ > kAllowedIpcDepthForPrint)
      return;
-@@ -1375,7 +1376,7 @@ void PrintRenderFrameHelper::PrintRequestedPages() {
+@@ -1332,7 +1333,7 @@ void PrintRenderFrameHelper::PrintRequestedPages() {
    // plugin node and print that instead.
    auto plugin = delegate_->GetPdfElement(frame);
  
@@ -752,7 +752,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
  
    if (render_frame_gone_) {
      return;
-@@ -1462,7 +1463,8 @@ void PrintRenderFrameHelper::PrintForSystemDialog() {
+@@ -1419,7 +1420,8 @@ void PrintRenderFrameHelper::PrintForSystemDialog() {
    }
  
    Print(frame, print_preview_context_.source_node(),
@@ -762,7 +762,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
    if (render_frame_gone_) {
      return;
    }
-@@ -1525,6 +1527,8 @@ void PrintRenderFrameHelper::PrintPreview(base::Value::Dict settings) {
+@@ -1482,6 +1484,8 @@ void PrintRenderFrameHelper::PrintPreview(base::Value::Dict settings) {
    if (ipc_nesting_level_ > kAllowedIpcDepthForPrint)
      return;
  
@@ -771,7 +771,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
    print_preview_context_.OnPrintPreview();
  
  #if BUILDFLAG(IS_CHROMEOS_ASH)
-@@ -2158,7 +2162,8 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
+@@ -2107,7 +2111,8 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
    }
  
    Print(duplicate_node.GetDocument().GetFrame(), duplicate_node,
@@ -781,7 +781,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
    // Check if `this` is still valid.
    if (!weak_this) {
      return;
-@@ -2174,7 +2179,9 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
+@@ -2123,7 +2128,9 @@ void PrintRenderFrameHelper::PrintNode(const blink::WebNode& node) {
  
  void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
                                     const blink::WebNode& node,
@@ -792,7 +792,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
    // If still not finished with earlier print request simply ignore.
    if (prep_frame_view_)
      return;
-@@ -2182,7 +2189,7 @@ void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
+@@ -2131,7 +2138,7 @@ void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
    FrameReference frame_ref(frame);
  
    uint32_t expected_page_count = 0;
@@ -801,7 +801,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
      DidFinishPrinting(PrintingResult::kFailPrintInit);
      return;  // Failed to init print page settings.
    }
-@@ -2201,8 +2208,15 @@ void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
+@@ -2150,8 +2157,15 @@ void PrintRenderFrameHelper::Print(blink::WebLocalFrame* frame,
          print_pages_params_->params->print_scaling_option;
  
      auto self = weak_ptr_factory_.GetWeakPtr();
@@ -818,7 +818,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
      // Check if `this` is still valid.
      if (!self)
        return;
-@@ -2446,35 +2460,47 @@ void PrintRenderFrameHelper::IPCProcessed() {
+@@ -2391,35 +2405,47 @@ void PrintRenderFrameHelper::IPCProcessed() {
    }
  }
  
@@ -876,7 +876,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
      return false;
    }
  
-@@ -2579,7 +2605,7 @@ mojom::PrintPagesParamsPtr PrintRenderFrameHelper::GetPrintSettingsFromUser(
+@@ -2524,7 +2550,7 @@ mojom::PrintPagesParamsPtr PrintRenderFrameHelper::GetPrintSettingsFromUser(
        std::move(params),
        base::BindOnce(
            [](base::OnceClosure quit_closure, mojom::PrintPagesParamsPtr* output,
@@ -886,7 +886,7 @@ index 658a3c59993ac30feaea4d86148ed5adc9dcbdb1..afa788bbefc8f814af9b70ff5b5ebbc8
              std::move(quit_closure).Run();
            },
 diff --git a/components/printing/renderer/print_render_frame_helper.h b/components/printing/renderer/print_render_frame_helper.h
-index 8d65b7b6440c8e653eb1b3f9c50b40944b7ae61b..eb6b4a42d507ff216fc07328c1907815a082ef19 100644
+index 5cbb2940f83af329ea38efca5bf3216056269654..8cf783d37589fdca88592eeb9b8cc91b6ae60203 100644
 --- a/components/printing/renderer/print_render_frame_helper.h
 +++ b/components/printing/renderer/print_render_frame_helper.h
 @@ -247,7 +247,7 @@ class PrintRenderFrameHelper
@@ -927,10 +927,10 @@ index 8d65b7b6440c8e653eb1b3f9c50b40944b7ae61b..eb6b4a42d507ff216fc07328c1907815
  #if BUILDFLAG(ENABLE_PRINT_PREVIEW)
    // Set options for print preset from source PDF document.
 diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
-index 89b2e2bd7d6091501756b4d31726c49b00ffd0c7..718ad3e088f6730bb00f1e3674effae6c429b9b6 100644
+index 755bfcc4ed84f44d0d8bb53615637ccd69a858e7..368cf7aaffeef5f9796f78a72f13eddb6c44dec9 100644
 --- a/content/browser/BUILD.gn
 +++ b/content/browser/BUILD.gn
-@@ -2953,8 +2953,9 @@ source_set("browser") {
+@@ -2955,8 +2955,9 @@ source_set("browser") {
        "//ppapi/shared_impl",
      ]
  

patches/chromium/webview_fullscreen.patch

@@ -15,7 +15,7 @@ Note that we also need to manually update embedder's
 `api::WebContents::IsFullscreenForTabOrPending` value.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index 586aa87098bd3db10440fe865a02c05e7b3be14f..cb372df065f83614ff6c2954035795e67eb69d0c 100644
+index 40b63b1fbde84b8b3f854ce763474cd044f6ea96..5e95682e793616c4d88f62ad4d69c8c9f547e000 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
 @@ -7417,6 +7417,17 @@ void RenderFrameHostImpl::EnterFullscreen(

patches/config.json

@@ -23,5 +23,5 @@
 
   "src/electron/patches/webrtc": "src/third_party/webrtc",
 
-  "src/electron/patches/libwebp": "src/third_party/libwebp/src"
+  "src/electron/patches/libvpx": "src/third_party/libvpx/source/libvpx"
 }

patches/libvpx/.patches

@@ -0,0 +1 @@
+cherry-pick-3fbd1dca6a4d.patch

patches/libvpx/cherry-pick-3fbd1dca6a4d.patch

@@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: James Zern <jzern@google.com>
+Date: Mon, 25 Sep 2023 18:55:59 -0700
+Subject: VP8: disallow thread count changes
+
+Currently allocations are done at encoder creation time. Going from
+threaded to non-threaded would cause a crash.
+
+Bug: chromium:1486441
+Change-Id: Ie301c2a70847dff2f0daae408fbef1e4d42e73d4
+
+diff --git a/vp8/encoder/onyx_if.c b/vp8/encoder/onyx_if.c
+index c65afc643bf681219343bf25a71f326a9ff33738..c5e9970c3cc8c8bd7b91246f413372d7254ef713 100644
+--- a/vp8/encoder/onyx_if.c
++++ b/vp8/encoder/onyx_if.c
+@@ -1447,6 +1447,11 @@ void vp8_change_config(VP8_COMP *cpi, VP8_CONFIG *oxcf) {
+   last_h = cpi->oxcf.Height;
+   prev_number_of_layers = cpi->oxcf.number_of_layers;
+ 
++  if (cpi->initial_width) {
++    // TODO(https://crbug.com/1486441): Allow changing thread counts; the
++    // allocation is done once in vp8_create_compressor().
++    oxcf->multi_threaded = cpi->oxcf.multi_threaded;
++  }
+   cpi->oxcf = *oxcf;
+ 
+   switch (cpi->oxcf.Mode) {

patches/libwebp/.patches

@@ -1 +0,0 @@
-fix_oob_write_in_buildhuffmantable.patch

patches/libwebp/fix_oob_write_in_buildhuffmantable.patch

@@ -1,354 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Vincent Rabaud <vrabaud@google.com>
-Date: Thu, 7 Sep 2023 21:16:03 +0200
-Subject: Fix OOB write in BuildHuffmanTable.
-
-First, BuildHuffmanTable is called to check if the data is valid.
-If it is and the table is not big enough, more memory is allocated.
-
-This will make sure that valid (but unoptimized because of unbalanced
-codes) streams are still decodable.
-
-Bug: chromium:1479274
-Change-Id: I31c36dbf3aa78d35ecf38706b50464fd3d375741
-(cherry picked from commit 902bc9190331343b2017211debcec8d2ab87e17a)
-(cherry picked from commit 2af26267cdfcb63a88e5c74a85927a12d6ca1d76)
-(cherry picked from commit 4619a48fc3292743d7ce9658bee4245406734109)
-
-diff --git a/src/dec/vp8l_dec.c b/src/dec/vp8l_dec.c
-index c0ea0181e52e31e8c03d6abe5597f3c50b8e4c09..7995313fa19cafe3b48bb6e3ad6160c8cac407e6 100644
---- a/src/dec/vp8l_dec.c
-+++ b/src/dec/vp8l_dec.c
-@@ -253,11 +253,11 @@ static int ReadHuffmanCodeLengths(
-   int symbol;
-   int max_symbol;
-   int prev_code_len = DEFAULT_CODE_LENGTH;
--  HuffmanCode table[1 << LENGTHS_TABLE_BITS];
-+  HuffmanTables tables;
- 
--  if (!VP8LBuildHuffmanTable(table, LENGTHS_TABLE_BITS,
--                             code_length_code_lengths,
--                             NUM_CODE_LENGTH_CODES)) {
-+  if (!VP8LHuffmanTablesAllocate(1 << LENGTHS_TABLE_BITS, &tables) ||
-+      !VP8LBuildHuffmanTable(&tables, LENGTHS_TABLE_BITS,
-+                             code_length_code_lengths, NUM_CODE_LENGTH_CODES)) {
-     goto End;
-   }
- 
-@@ -277,7 +277,7 @@ static int ReadHuffmanCodeLengths(
-     int code_len;
-     if (max_symbol-- == 0) break;
-     VP8LFillBitWindow(br);
--    p = &table[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK];
-+    p = &tables.curr_segment->start[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK];
-     VP8LSetBitPos(br, br->bit_pos_ + p->bits);
-     code_len = p->value;
-     if (code_len < kCodeLengthLiterals) {
-@@ -300,6 +300,7 @@ static int ReadHuffmanCodeLengths(
-   ok = 1;
- 
-  End:
-+  VP8LHuffmanTablesDeallocate(&tables);
-   if (!ok) dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
-   return ok;
- }
-@@ -307,7 +308,8 @@ static int ReadHuffmanCodeLengths(
- // 'code_lengths' is pre-allocated temporary buffer, used for creating Huffman
- // tree.
- static int ReadHuffmanCode(int alphabet_size, VP8LDecoder* const dec,
--                           int* const code_lengths, HuffmanCode* const table) {
-+                           int* const code_lengths,
-+                           HuffmanTables* const table) {
-   int ok = 0;
-   int size = 0;
-   VP8LBitReader* const br = &dec->br_;
-@@ -362,8 +364,7 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-   VP8LMetadata* const hdr = &dec->hdr_;
-   uint32_t* huffman_image = NULL;
-   HTreeGroup* htree_groups = NULL;
--  HuffmanCode* huffman_tables = NULL;
--  HuffmanCode* huffman_table = NULL;
-+  HuffmanTables* huffman_tables = &hdr->huffman_tables_;
-   int num_htree_groups = 1;
-   int num_htree_groups_max = 1;
-   int max_alphabet_size = 0;
-@@ -372,6 +373,10 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-   int* mapping = NULL;
-   int ok = 0;
- 
-+  // Check the table has been 0 initialized (through InitMetadata).
-+  assert(huffman_tables->root.start == NULL);
-+  assert(huffman_tables->curr_segment == NULL);
-+
-   if (allow_recursion && VP8LReadBits(br, 1)) {
-     // use meta Huffman codes.
-     const int huffman_precision = VP8LReadBits(br, 3) + 2;
-@@ -434,16 +439,15 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
- 
-   code_lengths = (int*)WebPSafeCalloc((uint64_t)max_alphabet_size,
-                                       sizeof(*code_lengths));
--  huffman_tables = (HuffmanCode*)WebPSafeMalloc(num_htree_groups * table_size,
--                                                sizeof(*huffman_tables));
-   htree_groups = VP8LHtreeGroupsNew(num_htree_groups);
- 
--  if (htree_groups == NULL || code_lengths == NULL || huffman_tables == NULL) {
-+  if (htree_groups == NULL || code_lengths == NULL ||
-+      !VP8LHuffmanTablesAllocate(num_htree_groups * table_size,
-+                                 huffman_tables)) {
-     dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
-     goto Error;
-   }
- 
--  huffman_table = huffman_tables;
-   for (i = 0; i < num_htree_groups_max; ++i) {
-     // If the index "i" is unused in the Huffman image, just make sure the
-     // coefficients are valid but do not store them.
-@@ -468,19 +472,20 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-       int max_bits = 0;
-       for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) {
-         int alphabet_size = kAlphabetSize[j];
--        htrees[j] = huffman_table;
-         if (j == 0 && color_cache_bits > 0) {
-           alphabet_size += (1 << color_cache_bits);
-         }
--        size = ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_table);
-+        size =
-+            ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_tables);
-+        htrees[j] = huffman_tables->curr_segment->curr_table;
-         if (size == 0) {
-           goto Error;
-         }
-         if (is_trivial_literal && kLiteralMap[j] == 1) {
--          is_trivial_literal = (huffman_table->bits == 0);
-+          is_trivial_literal = (htrees[j]->bits == 0);
-         }
--        total_size += huffman_table->bits;
--        huffman_table += size;
-+        total_size += htrees[j]->bits;
-+        huffman_tables->curr_segment->curr_table += size;
-         if (j <= ALPHA) {
-           int local_max_bits = code_lengths[0];
-           int k;
-@@ -515,14 +520,13 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-   hdr->huffman_image_ = huffman_image;
-   hdr->num_htree_groups_ = num_htree_groups;
-   hdr->htree_groups_ = htree_groups;
--  hdr->huffman_tables_ = huffman_tables;
- 
-  Error:
-   WebPSafeFree(code_lengths);
-   WebPSafeFree(mapping);
-   if (!ok) {
-     WebPSafeFree(huffman_image);
--    WebPSafeFree(huffman_tables);
-+    VP8LHuffmanTablesDeallocate(huffman_tables);
-     VP8LHtreeGroupsFree(htree_groups);
-   }
-   return ok;
-@@ -1358,7 +1362,7 @@ static void ClearMetadata(VP8LMetadata* const hdr) {
-   assert(hdr != NULL);
- 
-   WebPSafeFree(hdr->huffman_image_);
--  WebPSafeFree(hdr->huffman_tables_);
-+  VP8LHuffmanTablesDeallocate(&hdr->huffman_tables_);
-   VP8LHtreeGroupsFree(hdr->htree_groups_);
-   VP8LColorCacheClear(&hdr->color_cache_);
-   VP8LColorCacheClear(&hdr->saved_color_cache_);
-@@ -1673,7 +1677,7 @@ int VP8LDecodeImage(VP8LDecoder* const dec) {
- 
-   if (dec == NULL) return 0;
- 
--  assert(dec->hdr_.huffman_tables_ != NULL);
-+  assert(dec->hdr_.huffman_tables_.root.start != NULL);
-   assert(dec->hdr_.htree_groups_ != NULL);
-   assert(dec->hdr_.num_htree_groups_ > 0);
- 
-diff --git a/src/dec/vp8li_dec.h b/src/dec/vp8li_dec.h
-index 72b2e861208447f45e5ee12eac57b9c36ff2cd31..32540a4b88a05cc74b88f11da3f143e83be81c9c 100644
---- a/src/dec/vp8li_dec.h
-+++ b/src/dec/vp8li_dec.h
-@@ -51,7 +51,7 @@ typedef struct {
-   uint32_t*       huffman_image_;
-   int             num_htree_groups_;
-   HTreeGroup*     htree_groups_;
--  HuffmanCode*    huffman_tables_;
-+  HuffmanTables   huffman_tables_;
- } VP8LMetadata;
- 
- typedef struct VP8LDecoder VP8LDecoder;
-diff --git a/src/utils/huffman_utils.c b/src/utils/huffman_utils.c
-index 90c2fbf7c18c79ccb3597fe7cbbc332dbd1b2548..cf73abd437d02173f43c61c8877a5f467997774a 100644
---- a/src/utils/huffman_utils.c
-+++ b/src/utils/huffman_utils.c
-@@ -177,21 +177,24 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-       if (num_open < 0) {
-         return 0;
-       }
--      if (root_table == NULL) continue;
-       for (; count[len] > 0; --count[len]) {
-         HuffmanCode code;
-         if ((key & mask) != low) {
--          table += table_size;
-+          if (root_table != NULL) table += table_size;
-           table_bits = NextTableBitSize(count, len, root_bits);
-           table_size = 1 << table_bits;
-           total_size += table_size;
-           low = key & mask;
--          root_table[low].bits = (uint8_t)(table_bits + root_bits);
--          root_table[low].value = (uint16_t)((table - root_table) - low);
-+          if (root_table != NULL) {
-+            root_table[low].bits = (uint8_t)(table_bits + root_bits);
-+            root_table[low].value = (uint16_t)((table - root_table) - low);
-+          }
-+        }
-+        if (root_table != NULL) {
-+          code.bits = (uint8_t)(len - root_bits);
-+          code.value = (uint16_t)sorted[symbol++];
-+          ReplicateValue(&table[key >> root_bits], step, table_size, code);
-         }
--        code.bits = (uint8_t)(len - root_bits);
--        code.value = (uint16_t)sorted[symbol++];
--        ReplicateValue(&table[key >> root_bits], step, table_size, code);
-         key = GetNextKey(key, len);
-       }
-     }
-@@ -211,25 +214,83 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-   ((1 << MAX_CACHE_BITS) + NUM_LITERAL_CODES + NUM_LENGTH_CODES)
- // Cut-off value for switching between heap and stack allocation.
- #define SORTED_SIZE_CUTOFF 512
--int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-+int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits,
-                           const int code_lengths[], int code_lengths_size) {
--  int total_size;
-+  const int total_size =
-+      BuildHuffmanTable(NULL, root_bits, code_lengths, code_lengths_size, NULL);
-   assert(code_lengths_size <= MAX_CODE_LENGTHS_SIZE);
--  if (root_table == NULL) {
--    total_size = BuildHuffmanTable(NULL, root_bits,
--                                   code_lengths, code_lengths_size, NULL);
--  } else if (code_lengths_size <= SORTED_SIZE_CUTOFF) {
-+  if (total_size == 0 || root_table == NULL) return total_size;
-+
-+  if (root_table->curr_segment->curr_table + total_size >=
-+      root_table->curr_segment->start + root_table->curr_segment->size) {
-+    // If 'root_table' does not have enough memory, allocate a new segment.
-+    // The available part of root_table->curr_segment is left unused because we
-+    // need a contiguous buffer.
-+    const int segment_size = root_table->curr_segment->size;
-+    struct HuffmanTablesSegment* next =
-+        (HuffmanTablesSegment*)WebPSafeMalloc(1, sizeof(*next));
-+    if (next == NULL) return 0;
-+    // Fill the new segment.
-+    // We need at least 'total_size' but if that value is small, it is better to
-+    // allocate a big chunk to prevent more allocations later. 'segment_size' is
-+    // therefore chosen (any other arbitrary value could be chosen).
-+    next->size = total_size > segment_size ? total_size : segment_size;
-+    next->start =
-+        (HuffmanCode*)WebPSafeMalloc(next->size, sizeof(*next->start));
-+    if (next->start == NULL) {
-+      WebPSafeFree(next);
-+      return 0;
-+    }
-+    next->curr_table = next->start;
-+    next->next = NULL;
-+    // Point to the new segment.
-+    root_table->curr_segment->next = next;
-+    root_table->curr_segment = next;
-+  }
-+  if (code_lengths_size <= SORTED_SIZE_CUTOFF) {
-     // use local stack-allocated array.
-     uint16_t sorted[SORTED_SIZE_CUTOFF];
--    total_size = BuildHuffmanTable(root_table, root_bits,
--                                   code_lengths, code_lengths_size, sorted);
--  } else {   // rare case. Use heap allocation.
-+    BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits,
-+                      code_lengths, code_lengths_size, sorted);
-+  } else {  // rare case. Use heap allocation.
-     uint16_t* const sorted =
-         (uint16_t*)WebPSafeMalloc(code_lengths_size, sizeof(*sorted));
-     if (sorted == NULL) return 0;
--    total_size = BuildHuffmanTable(root_table, root_bits,
--                                   code_lengths, code_lengths_size, sorted);
-+    BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits,
-+                      code_lengths, code_lengths_size, sorted);
-     WebPSafeFree(sorted);
-   }
-   return total_size;
- }
-+
-+int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables) {
-+  // Have 'segment' point to the first segment for now, 'root'.
-+  HuffmanTablesSegment* const root = &huffman_tables->root;
-+  huffman_tables->curr_segment = root;
-+  // Allocate root.
-+  root->start = (HuffmanCode*)WebPSafeMalloc(size, sizeof(*root->start));
-+  if (root->start == NULL) return 0;
-+  root->curr_table = root->start;
-+  root->next = NULL;
-+  root->size = size;
-+  return 1;
-+}
-+
-+void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables) {
-+  HuffmanTablesSegment *current, *next;
-+  if (huffman_tables == NULL) return;
-+  // Free the root node.
-+  current = &huffman_tables->root;
-+  next = current->next;
-+  WebPSafeFree(current->start);
-+  current->start = NULL;
-+  current->next = NULL;
-+  current = next;
-+  // Free the following nodes.
-+  while (current != NULL) {
-+    next = current->next;
-+    WebPSafeFree(current->start);
-+    WebPSafeFree(current);
-+    current = next;
-+  }
-+}
-diff --git a/src/utils/huffman_utils.h b/src/utils/huffman_utils.h
-index 13b7ad1ac40c5316f5506d9b4cbf5039c9fd5600..98415c532895374ea28fc1dc5c9a15c751ea9ba0 100644
---- a/src/utils/huffman_utils.h
-+++ b/src/utils/huffman_utils.h
-@@ -43,6 +43,29 @@ typedef struct {
-                     // or non-literal symbol otherwise
- } HuffmanCode32;
- 
-+// Contiguous memory segment of HuffmanCodes.
-+typedef struct HuffmanTablesSegment {
-+  HuffmanCode* start;
-+  // Pointer to where we are writing into the segment. Starts at 'start' and
-+  // cannot go beyond 'start' + 'size'.
-+  HuffmanCode* curr_table;
-+  // Pointer to the next segment in the chain.
-+  struct HuffmanTablesSegment* next;
-+  int size;
-+} HuffmanTablesSegment;
-+
-+// Chained memory segments of HuffmanCodes.
-+typedef struct HuffmanTables {
-+  HuffmanTablesSegment root;
-+  // Currently processed segment. At first, this is 'root'.
-+  HuffmanTablesSegment* curr_segment;
-+} HuffmanTables;
-+
-+// Allocates a HuffmanTables with 'size' contiguous HuffmanCodes. Returns 0 on
-+// memory allocation error, 1 otherwise.
-+int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables);
-+void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables);
-+
- #define HUFFMAN_PACKED_BITS 6
- #define HUFFMAN_PACKED_TABLE_SIZE (1u << HUFFMAN_PACKED_BITS)
- 
-@@ -78,9 +101,7 @@ void VP8LHtreeGroupsFree(HTreeGroup* const htree_groups);
- // the huffman table.
- // Returns built table size or 0 in case of error (invalid tree or
- // memory error).
--// If root_table is NULL, it returns 0 if a lookup cannot be built, something
--// > 0 otherwise (but not the table size).
--int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-+int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits,
-                           const int code_lengths[], int code_lengths_size);
- 
- #ifdef __cplusplus

patches/node/.patches

@@ -42,3 +42,8 @@ fix_isurl_implementation.patch
 ci_ensure_node_tests_set_electron_run_as_node.patch
 chore_update_fixtures_errors_force_colors_snapshot.patch
 fix_assert_module_in_the_renderer_process.patch
+tls_ensure_tls_sockets_are_closed_if_the_underlying_wrap_closes.patch
+test_deflake_test-tls-socket-close.patch
+net_fix_crash_due_to_simultaneous_close_shutdown_on_js_stream.patch
+net_use_asserts_in_js_socket_stream_to_catch_races_in_future.patch
+lib_fix_broadcastchannel_initialization_location.patch

patches/node/chore_update_fixtures_errors_force_colors_snapshot.patch

@@ -11,7 +11,7 @@ trying to see whether or not the lines are greyed out. One possibility
 would be to upstream a changed test that doesn't hardcode line numbers.
 
 diff --git a/test/fixtures/errors/force_colors.snapshot b/test/fixtures/errors/force_colors.snapshot
-index 0334a0b4faa3633aa8617b9538873e7f3540513b..7f85ddc507c9c38ce85ed2a48f8152eef168717b 100644
+index 0334a0b4faa3633aa8617b9538873e7f3540513b..fa9989f55980aeddd3fa944318488c0289e3ab6e 100644
 --- a/test/fixtures/errors/force_colors.snapshot
 +++ b/test/fixtures/errors/force_colors.snapshot
 @@ -4,11 +4,12 @@ throw new Error('Should include grayed stack trace')
@@ -27,7 +27,7 @@ index 0334a0b4faa3633aa8617b9538873e7f3540513b..7f85ddc507c9c38ce85ed2a48f8152ee
 +    at Object..js (node:internal*modules*cjs*loader:1326:10)
 +    at Module.load (node:internal*modules*cjs*loader:1126:32)
 +    at node:internal*modules*cjs*loader:967:12
-+    at Function._load (node:electron*js2c*asar_bundle:757:32)
++    at Function._load (node:electron*js2c*asar_bundle:743:32)
 +    at Function.executeUserEntryPoint [as runMain] (node:internal*modules*run_main:96:12)
      at node:internal*main*run_main_module:23:47
  

patches/node/lib_fix_broadcastchannel_initialization_location.patch

@@ -0,0 +1,44 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shelley Vohr <shelley.vohr@gmail.com>
+Date: Mon, 27 Feb 2023 12:56:15 +0100
+Subject: lib: fix BroadcastChannel initialization location
+
+Refs https://github.com/nodejs/node/pull/40532.
+
+Fixes a bug in the above, wherein BroadcastChannel should have been
+initialized in bootstrap/browser instead of bootstrap/node. That
+inadvertently made it such that there was incorrect handling of the
+DOM vs Node.js implementations of BroadcastChannel.
+
+This will be upstreamed.
+
+diff --git a/lib/internal/bootstrap/browser.js b/lib/internal/bootstrap/browser.js
+index 5be4dd6176482c724455cbbeeaa9680e849a091b..29ccee75d77da072735032f0a25363ac88a023ba 100644
+--- a/lib/internal/bootstrap/browser.js
++++ b/lib/internal/bootstrap/browser.js
+@@ -12,6 +12,10 @@ const {
+ } = require('internal/util');
+ const config = internalBinding('config');
+ 
++// Non-standard extensions:
++const { BroadcastChannel } = require('internal/worker/io');
++exposeInterface(globalThis, 'BroadcastChannel', BroadcastChannel);
++
+ // https://console.spec.whatwg.org/#console-namespace
+ exposeNamespace(globalThis, 'console',
+                 createGlobalConsole());
+diff --git a/lib/internal/bootstrap/node.js b/lib/internal/bootstrap/node.js
+index 13ea68c96fd415f976aab0f291a1b7c688db1c58..0ca3de08fffb344c0330ce0f8d28b2d3d0b24350 100644
+--- a/lib/internal/bootstrap/node.js
++++ b/lib/internal/bootstrap/node.js
+@@ -238,10 +238,6 @@ const {
+   queueMicrotask,
+ } = require('internal/process/task_queues');
+ 
+-// Non-standard extensions:
+-const { BroadcastChannel } = require('internal/worker/io');
+-exposeInterface(globalThis, 'BroadcastChannel', BroadcastChannel);
+-
+ defineOperation(globalThis, 'queueMicrotask', queueMicrotask);
+ 
+ const timers = require('timers');

patches/node/net_fix_crash_due_to_simultaneous_close_shutdown_on_js_stream.patch

@@ -0,0 +1,171 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tim Perry <pimterry@gmail.com>
+Date: Thu, 24 Aug 2023 16:05:02 +0100
+Subject: net: fix crash due to simultaneous close/shutdown on JS Stream
+ Sockets
+
+A JS stream socket wraps a stream, exposing it as a socket for something
+on top which needs a socket specifically (e.g. an HTTP server).
+
+If the internal stream is closed in the same tick as the layer on top
+attempts to close this stream, the race between doShutdown and doClose
+results in an uncatchable exception. A similar race can happen with
+doClose and doWrite.
+
+It seems legitimate these can happen in parallel, so this resolves that
+by explicitly detecting and handling that situation: if a close is in
+progress, both doShutdown & doWrite allow doClose to run
+finishShutdown/Write for them, cancelling the operation, without trying
+to use this._handle (which will be null) in the meantime.
+
+PR-URL: https://github.com/nodejs/node/pull/49400
+Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
+Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
+
+diff --git a/lib/internal/js_stream_socket.js b/lib/internal/js_stream_socket.js
+index 8bc19296620b3fd0e5487165743f0f1bc2d342e7..68e1802a63b012b59418b79a0e68de5147543a23 100644
+--- a/lib/internal/js_stream_socket.js
++++ b/lib/internal/js_stream_socket.js
+@@ -21,6 +21,7 @@ const { ERR_STREAM_WRAP } = require('internal/errors').codes;
+ const kCurrentWriteRequest = Symbol('kCurrentWriteRequest');
+ const kCurrentShutdownRequest = Symbol('kCurrentShutdownRequest');
+ const kPendingShutdownRequest = Symbol('kPendingShutdownRequest');
++const kPendingClose = Symbol('kPendingClose');
+ 
+ function isClosing() { return this[owner_symbol].isClosing(); }
+ 
+@@ -94,6 +95,7 @@ class JSStreamSocket extends Socket {
+     this[kCurrentWriteRequest] = null;
+     this[kCurrentShutdownRequest] = null;
+     this[kPendingShutdownRequest] = null;
++    this[kPendingClose] = false;
+     this.readable = stream.readable;
+     this.writable = stream.writable;
+ 
+@@ -135,10 +137,17 @@ class JSStreamSocket extends Socket {
+       this[kPendingShutdownRequest] = req;
+       return 0;
+     }
++
+     assert(this[kCurrentWriteRequest] === null);
+     assert(this[kCurrentShutdownRequest] === null);
+     this[kCurrentShutdownRequest] = req;
+ 
++    if (this[kPendingClose]) {
++      // If doClose is pending, the stream & this._handle are gone. We can't do
++      // anything. doClose will call finishShutdown with ECANCELED for us shortly.
++      return 0;
++    }
++
+     const handle = this._handle;
+ 
+     process.nextTick(() => {
+@@ -164,6 +173,13 @@ class JSStreamSocket extends Socket {
+     assert(this[kCurrentWriteRequest] === null);
+     assert(this[kCurrentShutdownRequest] === null);
+ 
++    if (this[kPendingClose]) {
++      // If doClose is pending, the stream & this._handle are gone. We can't do
++      // anything. doClose will call finishWrite with ECANCELED for us shortly.
++      this[kCurrentWriteRequest] = req; // Store req, for doClose to cancel
++      return 0;
++    }
++
+     const handle = this._handle;
+     const self = this;
+ 
+@@ -217,6 +233,8 @@ class JSStreamSocket extends Socket {
+   }
+ 
+   doClose(cb) {
++    this[kPendingClose] = true;
++
+     const handle = this._handle;
+ 
+     // When sockets of the "net" module destroyed, they will call
+@@ -234,6 +252,8 @@ class JSStreamSocket extends Socket {
+       this.finishWrite(handle, uv.UV_ECANCELED);
+       this.finishShutdown(handle, uv.UV_ECANCELED);
+ 
++      this[kPendingClose] = false;
++
+       cb();
+     });
+   }
+diff --git a/test/parallel/test-http2-client-connection-tunnelling.js b/test/parallel/test-http2-client-connection-tunnelling.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..6e04121ca71ea81f49c7f50ec11d7fac735c80a9
+--- /dev/null
++++ b/test/parallel/test-http2-client-connection-tunnelling.js
+@@ -0,0 +1,71 @@
++'use strict';
++
++const common = require('../common');
++const fixtures = require('../common/fixtures');
++if (!common.hasCrypto)
++  common.skip('missing crypto');
++const assert = require('assert');
++const net = require('net');
++const tls = require('tls');
++const h2 = require('http2');
++
++// This test sets up an H2 proxy server, and tunnels a request over one of its streams
++// back to itself, via TLS, and then closes the TLS connection. On some Node versions
++// (v18 & v20 up to 20.5.1) the resulting JS Stream Socket fails to shutdown correctly
++// in this case, and crashes due to a null pointer in finishShutdown.
++
++const tlsOptions = {
++  key: fixtures.readKey('agent1-key.pem'),
++  cert: fixtures.readKey('agent1-cert.pem'),
++  ALPNProtocols: ['h2']
++};
++
++const netServer = net.createServer((socket) => {
++  socket.allowHalfOpen = false;
++  // ^ This allows us to trigger this reliably, but it's not strictly required
++  // for the bug and crash to happen, skipping this just fails elsewhere later.
++
++  h2Server.emit('connection', socket);
++});
++
++const h2Server = h2.createSecureServer(tlsOptions, (req, res) => {
++  res.writeHead(200);
++  res.end();
++});
++
++h2Server.on('connect', (req, res) => {
++  res.writeHead(200, {});
++  netServer.emit('connection', res.stream);
++});
++
++netServer.listen(0, common.mustCall(() => {
++  const proxyClient = h2.connect(`https://localhost:${netServer.address().port}`, {
++    rejectUnauthorized: false
++  });
++
++  const proxyReq = proxyClient.request({
++    ':method': 'CONNECT',
++    ':authority': 'example.com:443'
++  });
++
++  proxyReq.on('response', common.mustCall((response) => {
++    assert.strictEqual(response[':status'], 200);
++
++    // Create a TLS socket within the tunnel, and start sending a request:
++    const tlsSocket = tls.connect({
++      socket: proxyReq,
++      ALPNProtocols: ['h2'],
++      rejectUnauthorized: false
++    });
++
++    proxyReq.on('close', common.mustCall(() => {
++      proxyClient.close();
++      netServer.close();
++    }));
++
++    // Forcibly kill the TLS socket
++    tlsSocket.destroy();
++
++    // This results in an async error in affected Node versions, before the 'close' event
++  }));
++}));

patches/node/net_use_asserts_in_js_socket_stream_to_catch_races_in_future.patch

@@ -0,0 +1,30 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tim Perry <pimterry@gmail.com>
+Date: Fri, 25 Aug 2023 14:16:35 +0100
+Subject: net: use asserts in JS Socket Stream to catch races in future
+
+PR-URL: https://github.com/nodejs/node/pull/49400
+Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
+Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
+
+diff --git a/lib/internal/js_stream_socket.js b/lib/internal/js_stream_socket.js
+index 68e1802a63b012b59418b79a0e68de5147543a23..70d6d03069f3f1e85e66864c6c1e6de6084f5ea6 100644
+--- a/lib/internal/js_stream_socket.js
++++ b/lib/internal/js_stream_socket.js
+@@ -149,6 +149,7 @@ class JSStreamSocket extends Socket {
+     }
+ 
+     const handle = this._handle;
++    assert(handle !== null);
+ 
+     process.nextTick(() => {
+       // Ensure that write is dispatched asynchronously.
+@@ -181,6 +182,8 @@ class JSStreamSocket extends Socket {
+     }
+ 
+     const handle = this._handle;
++    assert(handle !== null);
++
+     const self = this;
+ 
+     let pending = bufs.length;

patches/node/test_deflake_test-tls-socket-close.patch

@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Luigi Pinca <luigipinca@gmail.com>
+Date: Wed, 13 Sep 2023 08:04:39 +0200
+Subject: test: deflake test-tls-socket-close
+
+Move the check for the destroyed state of the remote socket to the inner
+`setImmediate()`.
+
+Refs: https://github.com/nodejs/node/pull/49327#issuecomment-1712525257
+PR-URL: https://github.com/nodejs/node/pull/49575
+Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
+Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
+
+diff --git a/test/parallel/test-tls-socket-close.js b/test/parallel/test-tls-socket-close.js
+index 667b291309a4c5636a2c658fa8204b32c2e4df46..70af760d53bb4ddab62c99180d505e943ec269f6 100644
+--- a/test/parallel/test-tls-socket-close.js
++++ b/test/parallel/test-tls-socket-close.js
+@@ -44,9 +44,9 @@ function connectClient(server) {
+ 
+       setImmediate(() => {
+         assert.strictEqual(netSocket.destroyed, true);
+-        assert.strictEqual(clientTlsSocket.destroyed, true);
+ 
+         setImmediate(() => {
++          assert.strictEqual(clientTlsSocket.destroyed, true);
+           assert.strictEqual(serverTlsSocket.destroyed, true);
+ 
+           tlsServer.close();

patches/node/test_formally_mark_some_tests_as_flaky.patch

@@ -7,10 +7,10 @@ Instead of disabling the tests, flag them as flaky so they still run
 but don't cause CI failures on flakes.
 
 diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
-index 913ae4b0b10a7d508d864539cf075fa9c2f9362c..985f1c0d0c0c6afc049bf1d89f91412ecf431215 100644
+index 913ae4b0b10a7d508d864539cf075fa9c2f9362c..0539a599e57d40c5da650dcf5ffe9a67763506e1 100644
 --- a/test/parallel/parallel.status
 +++ b/test/parallel/parallel.status
-@@ -5,6 +5,12 @@ prefix parallel
+@@ -5,6 +5,13 @@ prefix parallel
  # sample-test                        : PASS,FLAKY
  
  [true] # This section applies to all platforms
@@ -20,6 +20,7 @@ index 913ae4b0b10a7d508d864539cf075fa9c2f9362c..985f1c0d0c0c6afc049bf1d89f91412e
 +test-fetch: PASS, FLAKY
 +test-cluster-bind-privileged-port: PASS, FLAKY
 +test-cluster-shared-handle-bind-privileged-port: PASS, FLAKY
++test-debugger-random-port-with-inspect-port: PASS, FLAKY
  
  [$system==win32]
  # https://github.com/nodejs/node/issues/24497

patches/node/tls_ensure_tls_sockets_are_closed_if_the_underlying_wrap_closes.patch

@@ -0,0 +1,204 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tim Perry <1526883+pimterry@users.noreply.github.com>
+Date: Fri, 1 Sep 2023 09:00:05 +0200
+Subject: tls: ensure TLS Sockets are closed if the underlying wrap closes
+
+This fixes a potential segfault, among various other likely-related
+issues, which all occur because TLSSockets were not informed if their
+underlying stream was closed in many cases.
+
+This also significantly modifies an existing TLS test. With this change
+in place, that test no longer works, as it tries to mess with internals
+to trigger a race, and those internals are now cleaned up earlier. This
+test has been simplified to a more general TLS shutdown test.
+
+PR-URL: https://github.com/nodejs/node/pull/49327
+Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
+Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
+
+diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
+index 1eff3b3fba8a05d5fade43c6cb00b6621daa8c3d..5bed23e1355e5e5a1965f15ca270fb372f751d66 100644
+--- a/lib/_tls_wrap.js
++++ b/lib/_tls_wrap.js
+@@ -629,6 +629,9 @@ TLSSocket.prototype._wrapHandle = function(wrap, handle) {
+   defineHandleReading(this, handle);
+ 
+   this.on('close', onSocketCloseDestroySSL);
++  if (wrap) {
++    wrap.on('close', () => this.destroy());
++  }
+ 
+   return res;
+ };
+diff --git a/test/parallel/test-http2-socket-close.js b/test/parallel/test-http2-socket-close.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..02db77bcf8480c79c77175ba802f9fe10ffc4efe
+--- /dev/null
++++ b/test/parallel/test-http2-socket-close.js
+@@ -0,0 +1,67 @@
++'use strict';
++
++const common = require('../common');
++const fixtures = require('../common/fixtures');
++if (!common.hasCrypto)
++  common.skip('missing crypto');
++const assert = require('assert');
++const net = require('net');
++const h2 = require('http2');
++
++const tlsOptions = {
++  key: fixtures.readKey('agent1-key.pem'),
++  cert: fixtures.readKey('agent1-cert.pem'),
++  ALPNProtocols: ['h2']
++};
++
++// Create a net server that upgrades sockets to HTTP/2 manually, handles the
++// request, and then shuts down via a short socket timeout and a longer H2 session
++// timeout. This is an unconventional way to shut down a session (the underlying
++// socket closing first) but it should work - critically, it shouldn't segfault
++// (as it did until Node v20.5.1).
++
++let serverRawSocket;
++let serverH2Session;
++
++const netServer = net.createServer((socket) => {
++  serverRawSocket = socket;
++  h2Server.emit('connection', socket);
++});
++
++const h2Server = h2.createSecureServer(tlsOptions, (req, res) => {
++  res.writeHead(200);
++  res.end();
++});
++
++h2Server.on('session', (session) => {
++  serverH2Session = session;
++});
++
++netServer.listen(0, common.mustCall(() => {
++  const proxyClient = h2.connect(`https://localhost:${netServer.address().port}`, {
++    rejectUnauthorized: false
++  });
++
++  proxyClient.on('close', common.mustCall(() => {
++    netServer.close();
++  }));
++
++  const req = proxyClient.request({
++    ':method': 'GET',
++    ':path': '/'
++  });
++
++  req.on('response', common.mustCall((response) => {
++    assert.strictEqual(response[':status'], 200);
++
++    // Asynchronously shut down the server's connections after the response,
++    // but not in the order it typically expects:
++    setTimeout(() => {
++      serverRawSocket.destroy();
++
++      setTimeout(() => {
++        serverH2Session.close();
++      }, 10);
++    }, 10);
++  }));
++}));
+diff --git a/test/parallel/test-tls-socket-close.js b/test/parallel/test-tls-socket-close.js
+index 87355cf8d7bd2d07bb0fab59491b68f3963f8809..667b291309a4c5636a2c658fa8204b32c2e4df46 100644
+--- a/test/parallel/test-tls-socket-close.js
++++ b/test/parallel/test-tls-socket-close.js
+@@ -8,37 +8,18 @@ const tls = require('tls');
+ const net = require('net');
+ const fixtures = require('../common/fixtures');
+ 
+-// Regression test for https://github.com/nodejs/node/issues/8074
+-//
+-// This test has a dependency on the order in which the TCP connection is made,
+-// and TLS server handshake completes. It assumes those server side events occur
+-// before the client side write callback, which is not guaranteed by the TLS
+-// API. It usually passes with TLS1.3, but TLS1.3 didn't exist at the time the
+-// bug existed.
+-//
+-// Pin the test to TLS1.2, since the test shouldn't be changed in a way that
+-// doesn't trigger a segfault in Node.js 7.7.3:
+-//   https://github.com/nodejs/node/issues/13184#issuecomment-303700377
+-tls.DEFAULT_MAX_VERSION = 'TLSv1.2';
+-
+ const key = fixtures.readKey('agent2-key.pem');
+ const cert = fixtures.readKey('agent2-cert.pem');
+ 
+-let tlsSocket;
+-// tls server
++let serverTlsSocket;
+ const tlsServer = tls.createServer({ cert, key }, (socket) => {
+-  tlsSocket = socket;
+-  socket.on('error', common.mustCall((error) => {
+-    assert.strictEqual(error.code, 'EINVAL');
+-    tlsServer.close();
+-    netServer.close();
+-  }));
++  serverTlsSocket = socket;
+ });
+ 
++// A plain net server, that manually passes connections to the TLS
++// server to be upgraded
+ let netSocket;
+-// plain tcp server
+ const netServer = net.createServer((socket) => {
+-  // If client wants to use tls
+   tlsServer.emit('connection', socket);
+ 
+   netSocket = socket;
+@@ -46,35 +27,32 @@ const netServer = net.createServer((socket) => {
+   connectClient(netServer);
+ }));
+ 
++// A client that connects, sends one message, and closes the raw connection:
+ function connectClient(server) {
+-  const tlsConnection = tls.connect({
++  const clientTlsSocket = tls.connect({
+     host: 'localhost',
+     port: server.address().port,
+     rejectUnauthorized: false
+   });
+ 
+-  tlsConnection.write('foo', 'utf8', common.mustCall(() => {
++  clientTlsSocket.write('foo', 'utf8', common.mustCall(() => {
+     assert(netSocket);
+     netSocket.setTimeout(common.platformTimeout(10), common.mustCall(() => {
+-      assert(tlsSocket);
+-      // This breaks if TLSSocket is already managing the socket:
++      assert(serverTlsSocket);
++
+       netSocket.destroy();
+-      const interval = setInterval(() => {
+-        // Checking this way allows us to do the write at a time that causes a
+-        // segmentation fault (not always, but often) in Node.js 7.7.3 and
+-        // earlier. If we instead, for example, wait on the `close` event, then
+-        // it will not segmentation fault, which is what this test is all about.
+-        if (tlsSocket._handle._parent.bytesRead === 0) {
+-          tlsSocket.write('bar');
+-          clearInterval(interval);
+-        }
+-      }, 1);
++
++      setImmediate(() => {
++        assert.strictEqual(netSocket.destroyed, true);
++        assert.strictEqual(clientTlsSocket.destroyed, true);
++
++        setImmediate(() => {
++          assert.strictEqual(serverTlsSocket.destroyed, true);
++
++          tlsServer.close();
++          netServer.close();
++        });
++      });
+     }));
+   }));
+-  tlsConnection.on('error', (e) => {
+-    // Tolerate the occasional ECONNRESET.
+-    // Ref: https://github.com/nodejs/node/issues/13184
+-    if (e.code !== 'ECONNRESET')
+-      throw e;
+-  });
+ }

patches/webrtc/.patches

@@ -1,2 +1,3 @@
 fix_fallback_to_x11_capturer_on_wayland.patch
 fix_mark_pipewire_capturer_as_failed_after_session_is_closed.patch
+fix_check_pipewire_init_before_creating_generic_capturer.patch

patches/webrtc/fix_check_pipewire_init_before_creating_generic_capturer.patch

@@ -0,0 +1,23 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Athul Iddya <athul@iddya.com>
+Date: Tue, 12 Sep 2023 22:19:46 -0700
+Subject: fix: check PipeWire init before creating generic capturer
+
+Check if PipeWire can be initialized before creating generic capturer.
+This harmonizes the conditions with the ones used in Linux
+implementations of DesktopCapturer::CreateRawScreenCapturer and
+DesktopCapturer::CreateRawWindowCapturer.
+
+diff --git a/modules/desktop_capture/desktop_capturer.cc b/modules/desktop_capture/desktop_capturer.cc
+index a52a76c2625cf0a2eae7ab5b841e0bf4ff499d88..099313bc1b4e75ebbe62c30190a068f68bfe5366 100644
+--- a/modules/desktop_capture/desktop_capturer.cc
++++ b/modules/desktop_capture/desktop_capturer.cc
+@@ -113,7 +113,7 @@ std::unique_ptr<DesktopCapturer> DesktopCapturer::CreateGenericCapturer(
+   std::unique_ptr<DesktopCapturer> capturer;
+ 
+ #if defined(WEBRTC_USE_PIPEWIRE)
+-  if (options.allow_pipewire() && DesktopCapturer::IsRunningUnderWayland()) {
++  if (options.allow_pipewire() && BaseCapturerPipeWire::IsSupported()) {
+     capturer = std::make_unique<BaseCapturerPipeWire>(
+         options, CaptureType::kAnyScreenContent);
+   }

shell/browser/api/electron_api_app.cc

@@ -19,6 +19,7 @@
 #include "base/path_service.h"
 #include "base/system/sys_info.h"
 #include "base/values.h"
+#include "base/win/windows_version.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/icon_manager.h"
 #include "chrome/common/chrome_features.h"
@@ -1478,23 +1479,8 @@ void App::SetUserAgentFallback(const std::string& user_agent) {
 }
 
 #if BUILDFLAG(IS_WIN)
-
 bool App::IsRunningUnderARM64Translation() const {
-  USHORT processMachine = 0;
-  USHORT nativeMachine = 0;
-
-  auto IsWow64Process2 = reinterpret_cast<decltype(&::IsWow64Process2)>(
-      GetProcAddress(GetModuleHandle(L"kernel32.dll"), "IsWow64Process2"));
-
-  if (IsWow64Process2 == nullptr) {
-    return false;
-  }
-
-  if (!IsWow64Process2(GetCurrentProcess(), &processMachine, &nativeMachine)) {
-    return false;
-  }
-
-  return nativeMachine == IMAGE_FILE_MACHINE_ARM64;
+  return base::win::OSInfo::IsRunningEmulatedOnArm64();
 }
 #endif
 

shell/browser/api/electron_api_system_preferences.cc

@@ -90,10 +90,6 @@ gin::ObjectTemplateBuilder SystemPreferences::GetObjectTemplateBuilder(
                  &SystemPreferences::IsSwipeTrackingFromScrollEventsEnabled)
       .SetMethod("getEffectiveAppearance",
                  &SystemPreferences::GetEffectiveAppearance)
-      .SetMethod("getAppLevelAppearance",
-                 &SystemPreferences::GetAppLevelAppearance)
-      .SetMethod("setAppLevelAppearance",
-                 &SystemPreferences::SetAppLevelAppearance)
       .SetMethod("getSystemColor", &SystemPreferences::GetSystemColor)
       .SetMethod("canPromptTouchID", &SystemPreferences::CanPromptTouchID)
       .SetMethod("promptTouchID", &SystemPreferences::PromptTouchID)

shell/browser/api/electron_api_system_preferences.h

@@ -112,8 +112,6 @@ class SystemPreferences
   // TODO(MarshallOfSound): Write tests for these methods once we
   // are running tests on a Mojave machine
   v8::Local<v8::Value> GetEffectiveAppearance(v8::Isolate* isolate);
-  v8::Local<v8::Value> GetAppLevelAppearance(v8::Isolate* isolate);
-  void SetAppLevelAppearance(gin::Arguments* args);
 #endif
   v8::Local<v8::Value> GetAnimationSettings(v8::Isolate* isolate);
 

shell/browser/api/electron_api_system_preferences_mac.mm

@@ -475,14 +475,7 @@ bool SystemPreferences::IsTrustedAccessibilityClient(bool prompt) {
 std::string SystemPreferences::GetColor(gin_helper::ErrorThrower thrower,
                                         const std::string& color) {
   NSColor* sysColor = nil;
-  if (color == "alternate-selected-control-text") {
-    sysColor = [NSColor alternateSelectedControlTextColor];
-    EmitWarning(
-        node::Environment::GetCurrent(thrower.isolate()),
-        "'alternate-selected-control-text' is deprecated as an input to "
-        "getColor.  Use 'selected-content-background' instead.",
-        "electron");
-  } else if (color == "control-background") {
+  if (color == "control-background") {
     sysColor = [NSColor controlBackgroundColor];
   } else if (color == "control") {
     sysColor = [NSColor controlColor];
@@ -609,19 +602,4 @@ v8::Local<v8::Value> SystemPreferences::GetEffectiveAppearance(
       isolate, [NSApplication sharedApplication].effectiveAppearance);
 }
 
-v8::Local<v8::Value> SystemPreferences::GetAppLevelAppearance(
-    v8::Isolate* isolate) {
-  return gin::ConvertToV8(isolate,
-                          [NSApplication sharedApplication].appearance);
-}
-
-void SystemPreferences::SetAppLevelAppearance(gin::Arguments* args) {
-  NSAppearance* appearance;
-  if (args->GetNext(&appearance)) {
-    [[NSApplication sharedApplication] setAppearance:appearance];
-  } else {
-    args->ThrowError();
-  }
-}
-
 }  // namespace electron::api

shell/browser/electron_browser_main_parts.cc

@@ -79,12 +79,12 @@
 
 #if BUILDFLAG(IS_LINUX)
 #include "base/environment.h"
+#include "chrome/browser/ui/views/dark_mode_manager_linux.h"
 #include "device/bluetooth/bluetooth_adapter_factory.h"
 #include "device/bluetooth/dbus/dbus_bluez_manager_wrapper_linux.h"
 #include "electron/electron_gtk_stubs.h"
 #include "ui/base/cursor/cursor_factory.h"
 #include "ui/base/ime/linux/linux_input_method_context_factory.h"
-#include "ui/gfx/color_utils.h"
 #include "ui/gtk/gtk_compat.h"  // nogncheck
 #include "ui/gtk/gtk_util.h"    // nogncheck
 #include "ui/linux/linux_ui.h"
@@ -169,36 +169,8 @@ std::u16string MediaStringProvider(media::MessageId id) {
   }
 }
 
-#if BUILDFLAG(IS_LINUX)
-// GTK does not provide a way to check if current theme is dark, so we compare
-// the text and background luminosity to get a result.
-// This trick comes from FireFox.
-void UpdateDarkThemeSetting() {
-  float bg = color_utils::GetRelativeLuminance(gtk::GetBgColor("GtkLabel"));
-  float fg = color_utils::GetRelativeLuminance(gtk::GetFgColor("GtkLabel"));
-  bool is_dark = fg > bg;
-  // Pass it to NativeUi theme, which is used by the nativeTheme module and most
-  // places in Electron.
-  ui::NativeTheme::GetInstanceForNativeUi()->set_use_dark_colors(is_dark);
-  // Pass it to Web Theme, to make "prefers-color-scheme" media query work.
-  ui::NativeTheme::GetInstanceForWeb()->set_use_dark_colors(is_dark);
-}
-#endif
-
 }  // namespace
 
-#if BUILDFLAG(IS_LINUX)
-class DarkThemeObserver : public ui::NativeThemeObserver {
- public:
-  DarkThemeObserver() = default;
-
-  // ui::NativeThemeObserver:
-  void OnNativeThemeUpdated(ui::NativeTheme* observed_theme) override {
-    UpdateDarkThemeSetting();
-  }
-};
-#endif
-
 // static
 ElectronBrowserMainParts* ElectronBrowserMainParts::self_ = nullptr;
 
@@ -432,17 +404,10 @@ void ElectronBrowserMainParts::ToolkitInitialized() {
   CHECK(electron::IsElectron_gdk_pixbufInitialized())
       << "Failed to initialize libgdk_pixbuf-2.0.so.0";
 
-  // Chromium does not respect GTK dark theme setting, but they may change
-  // in future and this code might be no longer needed. Check the Chromium
-  // issue to keep updated:
-  // https://bugs.chromium.org/p/chromium/issues/detail?id=998903
-  UpdateDarkThemeSetting();
-  // Update the native theme when GTK theme changes. The GetNativeTheme
-  // here returns a NativeThemeGtk, which monitors GTK settings.
-  dark_theme_observer_ = std::make_unique<DarkThemeObserver>();
-  auto* linux_ui_theme = ui::LinuxUiTheme::GetForProfile(nullptr);
-  CHECK(linux_ui_theme);
-  linux_ui_theme->GetNativeTheme()->AddObserver(dark_theme_observer_.get());
+  // source theme changes from system settings, including settings portal:
+  // https://flatpak.github.io/xdg-desktop-portal/#gdbus-org.freedesktop.portal.Settings
+  dark_mode_manager_ = std::make_unique<ui::DarkModeManagerLinux>();
+
   ui::LinuxUi::SetInstance(linux_ui);
 
   // Cursor theme changes are tracked by LinuxUI (via a CursorThemeManager

shell/browser/electron_browser_main_parts.h

@@ -43,7 +43,8 @@ class Environment;
 
 namespace ui {
 class LinuxUiGetter;
-}
+class DarkModeManagerLinux;
+}  // namespace ui
 
 namespace electron {
 
@@ -65,10 +66,6 @@ class ViewsDelegate;
 class ViewsDelegateMac;
 #endif
 
-#if BUILDFLAG(IS_LINUX)
-class DarkThemeObserver;
-#endif
-
 class ElectronBrowserMainParts : public content::BrowserMainParts {
  public:
   ElectronBrowserMainParts();
@@ -145,9 +142,7 @@ class ElectronBrowserMainParts : public content::BrowserMainParts {
 #endif
 
 #if BUILDFLAG(IS_LINUX)
-  // Used to notify the native theme of changes to dark mode.
-  std::unique_ptr<DarkThemeObserver> dark_theme_observer_;
-
+  std::unique_ptr<ui::DarkModeManagerLinux> dark_mode_manager_;
   std::unique_ptr<ui::LinuxUiGetter> linux_ui_getter_;
 #endif
 

shell/browser/extensions/api/resources_private/resources_private_api.cc

@@ -13,15 +13,15 @@
 #include "chrome/grit/generated_resources.h"
 #include "components/strings/grit/components_strings.h"
 #include "components/zoom/page_zoom_constants.h"
-#include "pdf/buildflags.h"
+#include "electron/buildflags/buildflags.h"
 #include "printing/buildflags/buildflags.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/webui/web_ui_util.h"
 
-#if BUILDFLAG(ENABLE_PDF)
+#if BUILDFLAG(ENABLE_PDF_VIEWER)
 #include "chrome/browser/pdf/pdf_extension_util.h"
 #include "pdf/pdf_features.h"
-#endif  // BUILDFLAG(ENABLE_PDF)
+#endif  // BUILDFLAG(ENABLE_PDF_VIEWER)
 
 // To add a new component to this API, simply:
 // 1. Add your component to the Component enum in
@@ -48,7 +48,7 @@ ExtensionFunction::ResponseAction ResourcesPrivateGetStringsFunction::Run() {
 
   switch (component) {
     case api::resources_private::COMPONENT_PDF:
-#if BUILDFLAG(ENABLE_PDF)
+#if BUILDFLAG(ENABLE_PDF_VIEWER)
       pdf_extension_util::AddStrings(
           pdf_extension_util::PdfViewerContext::kPdfViewer, &dict);
       pdf_extension_util::AddAdditionalData(true, false, &dict);

shell/browser/extensions/api/tabs/tabs_api.cc

@@ -7,20 +7,27 @@
 #include <memory>
 #include <utility>
 
+#include "base/command_line.h"
 #include "base/strings/pattern.h"
+#include "base/types/expected_macros.h"
 #include "chrome/common/url_constants.h"
 #include "components/url_formatter/url_fixer.h"
 #include "content/public/browser/navigation_entry.h"
 #include "extensions/browser/extension_api_frame_id_map.h"
+#include "extensions/browser/extension_prefs.h"
 #include "extensions/common/error_utils.h"
+#include "extensions/common/extension_features.h"
+#include "extensions/common/feature_switch.h"
 #include "extensions/common/manifest_constants.h"
 #include "extensions/common/mojom/host_id.mojom.h"
 #include "extensions/common/permissions/permissions_data.h"
+#include "extensions/common/switches.h"
 #include "shell/browser/api/electron_api_web_contents.h"
 #include "shell/browser/native_window.h"
 #include "shell/browser/web_contents_zoom_controller.h"
 #include "shell/browser/window_list.h"
 #include "shell/common/extensions/api/tabs.h"
+#include "third_party/blink/public/common/chrome_debug_urls.h"
 #include "third_party/blink/public/common/page/page_zoom.h"
 #include "url/gurl.h"
 
@@ -468,17 +475,25 @@ bool IsKillURL(const GURL& url) {
     DCHECK(url.IsAboutBlank() || url.IsAboutSrcdoc());
 #endif
 
-  static const char* const kill_hosts[] = {
-      chrome::kChromeUICrashHost,         chrome::kChromeUIDelayedHangUIHost,
-      chrome::kChromeUIHangUIHost,        chrome::kChromeUIKillHost,
+  // Disallow common renderer debug URLs.
+  // Note: this would also disallow JavaScript URLs, but we already explicitly
+  // check for those before calling into here from PrepareURLForNavigation.
+  if (blink::IsRendererDebugURL(url)) {
+    return true;
+  }
+
+  if (!url.SchemeIs(content::kChromeUIScheme)) {
+    return false;
+  }
+
+  // Also disallow a few more hosts which are not covered by the check above.
+  static const char* const kKillHosts[] = {
+      chrome::kChromeUIDelayedHangUIHost, chrome::kChromeUIHangUIHost,
       chrome::kChromeUIQuitHost,          chrome::kChromeUIRestartHost,
       content::kChromeUIBrowserCrashHost, content::kChromeUIMemoryExhaustHost,
   };
 
-  if (!url.SchemeIs(content::kChromeUIScheme))
-    return false;
-
-  return base::Contains(kill_hosts, url.host_piece());
+  return base::Contains(kKillHosts, url.host_piece());
 }
 
 GURL ResolvePossiblyRelativeURL(const std::string& url_string,
@@ -489,10 +504,18 @@ GURL ResolvePossiblyRelativeURL(const std::string& url_string,
 
   return url;
 }
-bool PrepareURLForNavigation(const std::string& url_string,
-                             const Extension* extension,
-                             GURL* return_url,
-                             std::string* error) {
+
+bool AllowFileAccess(const ExtensionId& extension_id,
+                     content::BrowserContext* context) {
+  return base::CommandLine::ForCurrentProcess()->HasSwitch(
+             switches::kDisableExtensionsFileAccessCheck) ||
+         ExtensionPrefs::Get(context)->AllowFileAccess(extension_id);
+}
+
+base::expected<GURL, std::string> PrepareURLForNavigation(
+    const std::string& url_string,
+    const Extension* extension,
+    content::BrowserContext* browser_context) {
   GURL url = ResolvePossiblyRelativeURL(url_string, extension);
 
   // Ideally, the URL would only be "fixed" for user input (e.g. for URLs
@@ -504,34 +527,62 @@ bool PrepareURLForNavigation(const std::string& url_string,
   // Reject invalid URLs.
   if (!url.is_valid()) {
     const char kInvalidUrlError[] = "Invalid url: \"*\".";
-    *error = ErrorUtils::FormatErrorMessage(kInvalidUrlError, url_string);
-    return false;
+    return base::unexpected(
+        ErrorUtils::FormatErrorMessage(kInvalidUrlError, url_string));
+  }
+
+  // Don't let the extension use JavaScript URLs in API triggered navigations.
+  if (url.SchemeIs(url::kJavaScriptScheme)) {
+    const char kJavaScriptUrlsNotAllowedInExtensionNavigations[] =
+        "JavaScript URLs are not allowed in API based extension navigations. "
+        "Use "
+        "chrome.scripting.executeScript instead.";
+    return base::unexpected(kJavaScriptUrlsNotAllowedInExtensionNavigations);
   }
 
   // Don't let the extension crash the browser or renderers.
   if (IsKillURL(url)) {
     const char kNoCrashBrowserError[] =
         "I'm sorry. I'm afraid I can't do that.";
-    *error = kNoCrashBrowserError;
-    return false;
+    return base::unexpected(kNoCrashBrowserError);
   }
 
   // Don't let the extension navigate directly to devtools scheme pages, unless
   // they have applicable permissions.
-  if (url.SchemeIs(content::kChromeDevToolsScheme) &&
-      !(extension->permissions_data()->HasAPIPermission(
-            extensions::mojom::APIPermissionID::kDevtools) ||
-        extension->permissions_data()->HasAPIPermission(
-            extensions::mojom::APIPermissionID::kDebugger))) {
-    const char kCannotNavigateToDevtools[] =
-        "Cannot navigate to a devtools:// page without either the devtools or "
-        "debugger permission.";
-    *error = kCannotNavigateToDevtools;
-    return false;
+  if (url.SchemeIs(content::kChromeDevToolsScheme)) {
+    bool has_permission =
+        extension && (extension->permissions_data()->HasAPIPermission(
+                          mojom::APIPermissionID::kDevtools) ||
+                      extension->permissions_data()->HasAPIPermission(
+                          mojom::APIPermissionID::kDebugger));
+    if (!has_permission) {
+      const char kCannotNavigateToDevtools[] =
+          "Cannot navigate to a devtools:// page without either the devtools "
+          "or "
+          "debugger permission.";
+      return base::unexpected(kCannotNavigateToDevtools);
+    }
   }
 
-  return_url->Swap(&url);
-  return true;
+  // Don't let the extension navigate directly to chrome-untrusted scheme pages.
+  if (url.SchemeIs(content::kChromeUIUntrustedScheme)) {
+    const char kCannotNavigateToChromeUntrusted[] =
+        "Cannot navigate to a chrome-untrusted:// page.";
+    return base::unexpected(kCannotNavigateToChromeUntrusted);
+  }
+
+  // Don't let the extension navigate directly to file scheme pages, unless
+  // they have file access.
+  if (url.SchemeIsFile() &&
+      !AllowFileAccess(extension->id(), browser_context) &&
+      base::FeatureList::IsEnabled(
+          extensions_features::kRestrictFileURLNavigation)) {
+    const char kFileUrlsNotAllowedInExtensionNavigations[] =
+        "Cannot navigate to a file URL without local file access.";
+    return base::unexpected(kFileUrlsNotAllowedInExtensionNavigations);
+  }
+
+  return url;
 }
 
 TabsUpdateFunction::TabsUpdateFunction() : web_contents_(nullptr) {}
@@ -566,22 +617,14 @@ ExtensionFunction::ResponseAction TabsUpdateFunction::Run() {
 bool TabsUpdateFunction::UpdateURL(const std::string& url_string,
                                    int tab_id,
                                    std::string* error) {
-  GURL url;
-  if (!PrepareURLForNavigation(url_string, extension(), &url, error)) {
+  auto url =
+      PrepareURLForNavigation(url_string, extension(), browser_context());
+  if (!url.has_value()) {
+    *error = std::move(url.error());
     return false;
   }
 
-  const bool is_javascript_scheme = url.SchemeIs(url::kJavaScriptScheme);
-  // JavaScript URLs are forbidden in chrome.tabs.update().
-  if (is_javascript_scheme) {
-    const char kJavaScriptUrlsNotAllowedInTabsUpdate[] =
-        "JavaScript URLs are not allowed in chrome.tabs.update. Use "
-        "chrome.tabs.executeScript instead.";
-    *error = kJavaScriptUrlsNotAllowedInTabsUpdate;
-    return false;
-  }
-
-  content::NavigationController::LoadURLParams load_params(url);
+  content::NavigationController::LoadURLParams load_params(*url);
 
   // Treat extension-initiated navigations as renderer-initiated so that the URL
   // does not show in the omnibox until it commits.  This avoids URL spoofs

shell/browser/native_window.cc

@@ -352,10 +352,14 @@ void NativeWindow::SetContentSizeConstraints(
   size_constraints_.reset();
 }
 
+// Windows/Linux:
 // The return value of GetContentSizeConstraints will be passed to Chromium
 // to set min/max sizes of window. Note that we are returning content size
 // instead of window size because that is what Chromium expects, see the
 // comment of |WidgetSizeIsClientSize| in Chromium's codebase to learn more.
+//
+// macOS:
+// The min/max sizes are set directly by calling NSWindow's methods.
 extensions::SizeConstraints NativeWindow::GetContentSizeConstraints() const {
   if (content_size_constraints_)
     return *content_size_constraints_;

shell/browser/native_window_mac.h

@@ -58,6 +58,8 @@ class NativeWindowMac : public NativeWindow,
   gfx::Rect GetBounds() override;
   bool IsNormal() override;
   gfx::Rect GetNormalBounds() override;
+  void SetSizeConstraints(
+      const extensions::SizeConstraints& window_constraints) override;
   void SetContentSizeConstraints(
       const extensions::SizeConstraints& size_constraints) override;
   void SetResizable(bool resizable) override;

shell/browser/native_window_mac.mm

@@ -774,6 +774,16 @@ gfx::Rect NativeWindowMac::GetNormalBounds() {
   // return widget()->GetRestoredBounds();
 }
 
+void NativeWindowMac::SetSizeConstraints(
+    const extensions::SizeConstraints& window_constraints) {
+  // Apply the size constraints to NSWindow.
+  if (window_constraints.HasMinimumSize())
+    [window_ setMinSize:window_constraints.GetMinimumSize().ToCGSize()];
+  if (window_constraints.HasMaximumSize())
+    [window_ setMaxSize:window_constraints.GetMaximumSize().ToCGSize()];
+  NativeWindow::SetSizeConstraints(window_constraints);
+}
+
 void NativeWindowMac::SetContentSizeConstraints(
     const extensions::SizeConstraints& size_constraints) {
   auto convertSize = [this](const gfx::Size& size) {
@@ -788,6 +798,7 @@ void NativeWindowMac::SetContentSizeConstraints(
     }
   };
 
+  // Apply the size constraints to NSWindow.
   NSView* content = [window_ contentView];
   if (size_constraints.HasMinimumSize()) {
     NSSize min_size = convertSize(size_constraints.GetMinimumSize());
@@ -1422,11 +1433,21 @@ void NativeWindowMac::UpdateVibrancyRadii(bool fullscreen) {
 
   if (vibrantView != nil && !vibrancy_type_.empty()) {
     const bool no_rounded_corner = !HasStyleMask(NSWindowStyleMaskTitled);
-    if (!has_frame() && !is_modal() && !no_rounded_corner) {
+    const int macos_version = base::mac::MacOSMajorVersion();
+
+    // Modal window corners are rounded on macOS >= 11 or higher if the user
+    // hasn't passed noRoundedCorners.
+    bool should_round_modal =
+        !no_rounded_corner && (macos_version >= 11 ? true : !is_modal());
+    // Nonmodal window corners are rounded if they're frameless and the user
+    // hasn't passed noRoundedCorners.
+    bool should_round_nonmodal = !no_rounded_corner && !has_frame();
+
+    if (should_round_nonmodal || should_round_modal) {
       CGFloat radius;
       if (fullscreen) {
         radius = 0.0f;
-      } else if (@available(macOS 11.0, *)) {
+      } else if (macos_version >= 11) {
         radius = 9.0f;
       } else {
         // Smaller corner radius on versions prior to Big Sur.

shell/browser/native_window_views_win.cc

@@ -7,6 +7,7 @@
 #include <wrl/client.h>
 
 #include "base/win/atl.h"  // Must be before UIAutomationCore.h
+#include "base/win/scoped_handle.h"
 #include "content/public/browser/browser_accessibility_state.h"
 #include "shell/browser/browser.h"
 #include "shell/browser/native_window_views.h"
@@ -165,10 +166,41 @@ gfx::ResizeEdge GetWindowResizeEdge(WPARAM param) {
   }
 }
 
+bool IsMutexPresent(const wchar_t* name) {
+  base::win::ScopedHandle mutex_holder(::CreateMutex(nullptr, false, name));
+  return ::GetLastError() == ERROR_ALREADY_EXISTS;
+}
+
+bool IsLibraryLoaded(const wchar_t* name) {
+  HMODULE hmodule = nullptr;
+  ::GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, name,
+                      &hmodule);
+  return hmodule != nullptr;
+}
+
+// The official way to get screen reader status is to call:
+// SystemParametersInfo(SPI_GETSCREENREADER) && UiaClientsAreListening()
+// However it has false positives (for example when user is using touch screens)
+// and will cause performance issues in some apps.
 bool IsScreenReaderActive() {
-  UINT screenReader = 0;
-  SystemParametersInfo(SPI_GETSCREENREADER, 0, &screenReader, 0);
-  return screenReader && UiaClientsAreListening();
+  if (IsMutexPresent(L"NarratorRunning"))
+    return true;
+
+  static const wchar_t* names[] = {// NVDA
+                                   L"nvdaHelperRemote.dll",
+                                   // JAWS
+                                   L"jhook.dll",
+                                   // Window-Eyes
+                                   L"gwhk64.dll", L"gwmhook.dll",
+                                   // ZoomText
+                                   L"AiSquared.Infuser.HookLib.dll"};
+
+  for (auto* name : names) {
+    if (IsLibraryLoaded(name))
+      return true;
+  }
+
+  return false;
 }
 
 }  // namespace

shell/browser/ui/views/inspectable_web_contents_view_views.cc

@@ -216,6 +216,8 @@ const std::u16string InspectableWebContentsViewViews::GetTitle() {
 void InspectableWebContentsViewViews::Layout() {
   if (!devtools_web_view_->GetVisible()) {
     contents_web_view_->SetBoundsRect(GetContentsBounds());
+    // Propagate layout call to all children, for example browser views.
+    View::Layout();
     return;
   }
 
@@ -233,6 +235,9 @@ void InspectableWebContentsViewViews::Layout() {
   devtools_web_view_->SetBoundsRect(new_devtools_bounds);
   contents_web_view_->SetBoundsRect(new_contents_bounds);
 
+  // Propagate layout call to all children, for example browser views.
+  View::Layout();
+
   if (GetDelegate())
     GetDelegate()->DevToolsResized();
 }

shell/browser/ui/win/electron_desktop_window_tree_host_win.cc

@@ -133,4 +133,14 @@ void ElectronDesktopWindowTreeHostWin::OnNativeThemeUpdated(
   }
 }
 
+bool ElectronDesktopWindowTreeHostWin::ShouldWindowContentsBeTransparent()
+    const {
+  // Window should be marked as opaque if no transparency setting has been set,
+  // otherwise videos rendered in the window will trigger a DirectComposition
+  // redraw for every frame.
+  // https://github.com/electron/electron/pull/39895
+  return native_window_view_->GetOpacity() < 1.0 ||
+         native_window_view_->transparent();
+}
+
 }  // namespace electron

shell/browser/ui/win/electron_desktop_window_tree_host_win.h

@@ -40,6 +40,7 @@ class ElectronDesktopWindowTreeHostWin : public views::DesktopWindowTreeHostWin,
 
   // ui::NativeThemeObserver:
   void OnNativeThemeUpdated(ui::NativeTheme* observed_theme) override;
+  bool ShouldWindowContentsBeTransparent() const override;
 
  private:
   raw_ptr<NativeWindowViews> native_window_view_;  // weak ref

shell/common/api/electron_api_asar.cc

@@ -121,9 +121,7 @@ class Archive : public node::ObjectWrap {
     gin_helper::Dictionary dict(isolate, v8::Object::New(isolate));
     dict.Set("size", stats.size);
     dict.Set("offset", stats.offset);
-    dict.Set("isFile", stats.is_file);
-    dict.Set("isDirectory", stats.is_directory);
-    dict.Set("isLink", stats.is_link);
+    dict.Set("type", static_cast<int>(stats.type));
     args.GetReturnValue().Set(dict.GetHandle());
   }
 

shell/common/asar/archive.cc

@@ -311,14 +311,12 @@ bool Archive::Stat(const base::FilePath& path, Stats* stats) const {
     return false;
 
   if (node->Find("link")) {
-    stats->is_file = false;
-    stats->is_link = true;
+    stats->type = FileType::kLink;
     return true;
   }
 
   if (node->Find("files")) {
-    stats->is_file = false;
-    stats->is_directory = true;
+    stats->type = FileType::kDirectory;
     return true;
   }
 

shell/common/asar/archive.h

@@ -10,6 +10,8 @@
 #include <unordered_map>
 #include <vector>
 
+#include <uv.h>
+
 #include "base/files/file.h"
 #include "base/files/file_path.h"
 #include "base/synchronization/lock.h"
@@ -49,11 +51,14 @@ class Archive {
     absl::optional<IntegrityPayload> integrity;
   };
 
+  enum class FileType {
+    kFile = UV_DIRENT_FILE,
+    kDirectory = UV_DIRENT_DIR,
+    kLink = UV_DIRENT_LINK,
+  };
+
   struct Stats : public FileInfo {
-    Stats() : is_file(true), is_directory(false), is_link(false) {}
-    bool is_file;
-    bool is_directory;
-    bool is_link;
+    FileType type = FileType::kFile;
   };
 
   explicit Archive(const base::FilePath& path);

shell/common/gin_helper/locker.h

@@ -21,6 +21,10 @@ class Locker {
   Locker(const Locker&) = delete;
   Locker& operator=(const Locker&) = delete;
 
+  // prevent heap allocation
+  void* operator new(size_t size) = delete;
+  void operator delete(void*, size_t) = delete;
+
  private:
   const std::unique_ptr<v8::Locker> locker_;
 };

spec/api-native-theme-spec.ts

@@ -1,11 +1,9 @@
 import { expect } from 'chai';
-import { nativeTheme, systemPreferences, BrowserWindow, ipcMain } from 'electron/main';
+import { nativeTheme, BrowserWindow, ipcMain } from 'electron/main';
 import { once } from 'node:events';
 import * as path from 'node:path';
 import { setTimeout } from 'node:timers/promises';
 
-import { expectDeprecationMessages } from './lib/deprecate-helpers';
-import { ifdescribe } from './lib/spec-helpers';
 import { closeAllWindows } from './lib/window-helpers';
 
 describe('nativeTheme module', () => {
@@ -59,20 +57,6 @@ describe('nativeTheme module', () => {
       expect(called).to.equal(false);
     });
 
-    ifdescribe(process.platform === 'darwin')('on macOS', () => {
-      it('should update appLevelAppearance when set', async () => {
-        await expectDeprecationMessages(
-          () => {
-            nativeTheme.themeSource = 'dark';
-            expect(systemPreferences.appLevelAppearance).to.equal('dark');
-            nativeTheme.themeSource = 'light';
-            expect(systemPreferences.appLevelAppearance).to.equal('light');
-          },
-          "(electron) 'appLevelAppearance' is deprecated and will be removed."
-        );
-      });
-    });
-
     const getPrefersColorSchemeIsDark = async (w: Electron.BrowserWindow) => {
       const isDark: boolean = await w.webContents.executeJavaScript(
         'matchMedia("(prefers-color-scheme: dark)").matches'

spec/api-system-preferences-spec.ts

@@ -1,6 +1,5 @@
 import { expect } from 'chai';
 import { systemPreferences } from 'electron/main';
-import { expectDeprecationMessages } from './lib/deprecate-helpers';
 import { ifdescribe } from './lib/spec-helpers';
 
 describe('systemPreferences module', () => {
@@ -215,52 +214,6 @@ describe('systemPreferences module', () => {
         const sysColor = systemPreferences.getColor(color);
         expect(sysColor).to.be.a('string');
       });
-
-      await expectDeprecationMessages(
-        () => {
-          const sysColor = systemPreferences.getColor('alternate-selected-control-text');
-          expect(sysColor).to.be.a('string');
-        },
-        "'alternate-selected-control-text' is deprecated as an input to getColor.  Use 'selected-content-background' instead."
-      );
-    });
-  });
-
-  ifdescribe(process.platform === 'darwin')('systemPreferences.appLevelAppearance', () => {
-    const options = ['dark', 'light', 'unknown', null];
-    describe('with properties', () => {
-      it('returns a valid appearance', () => {
-        const appearance = systemPreferences.appLevelAppearance;
-        expect(options).to.include(appearance);
-      });
-
-      it('can be changed', () => {
-        systemPreferences.appLevelAppearance = 'dark';
-        expect(systemPreferences.appLevelAppearance).to.eql('dark');
-      });
-    });
-
-    describe('with functions', () => {
-      it('returns a valid appearance', async () => {
-        await expectDeprecationMessages(
-          () => {
-            const appearance = systemPreferences.getAppLevelAppearance();
-            expect(options).to.include(appearance);
-          },
-          "(electron) 'getAppLevelAppearance function' is deprecated and will be removed."
-        );
-      });
-
-      it('can be changed', async () => {
-        await expectDeprecationMessages(
-          () => {
-            systemPreferences.setAppLevelAppearance('dark');
-            const appearance = systemPreferences.getAppLevelAppearance();
-            expect(appearance).to.eql('dark');
-          },
-          "(electron) 'setAppLevelAppearance function' is deprecated and will be removed."
-        );
-      });
     });
   });
 

spec/extensions-spec.ts

@@ -1039,33 +1039,77 @@ describe('chrome extensions', () => {
         });
       });
 
-      it('update', async () => {
-        await w.loadURL(url);
+      describe('update', () => {
+        it('can update muted status', async () => {
+          await w.loadURL(url);
 
-        const message = { method: 'update', args: [{ muted: true }] };
-        w.webContents.executeJavaScript(`window.postMessage('${JSON.stringify(message)}', '*')`);
+          const message = { method: 'update', args: [{ muted: true }] };
+          w.webContents.executeJavaScript(`window.postMessage('${JSON.stringify(message)}', '*')`);
 
-        const [,, responseString] = await once(w.webContents, 'console-message');
-        const response = JSON.parse(responseString);
+          const [,, responseString] = await once(w.webContents, 'console-message');
+          const response = JSON.parse(responseString);
 
-        expect(response).to.have.property('url').that.is.a('string');
-        expect(response).to.have.property('title').that.is.a('string');
-        expect(response).to.have.property('active').that.is.a('boolean');
-        expect(response).to.have.property('autoDiscardable').that.is.a('boolean');
-        expect(response).to.have.property('discarded').that.is.a('boolean');
-        expect(response).to.have.property('groupId').that.is.a('number');
-        expect(response).to.have.property('highlighted').that.is.a('boolean');
-        expect(response).to.have.property('id').that.is.a('number');
-        expect(response).to.have.property('incognito').that.is.a('boolean');
-        expect(response).to.have.property('index').that.is.a('number');
-        expect(response).to.have.property('pinned').that.is.a('boolean');
-        expect(response).to.have.property('selected').that.is.a('boolean');
-        expect(response).to.have.property('windowId').that.is.a('number');
-        expect(response).to.have.property('mutedInfo').that.is.a('object');
-        const { mutedInfo } = response;
-        expect(mutedInfo).to.deep.eq({
-          muted: true,
-          reason: 'user'
+          expect(response).to.have.property('mutedInfo').that.is.a('object');
+          const { mutedInfo } = response;
+          expect(mutedInfo).to.deep.eq({
+            muted: true,
+            reason: 'user'
+          });
+        });
+
+        it('fails when navigating to an invalid url', async () => {
+          await w.loadURL(url);
+
+          const message = { method: 'update', args: [{ url: 'chrome://crash' }] };
+          w.webContents.executeJavaScript(`window.postMessage('${JSON.stringify(message)}', '*')`);
+
+          const [,, responseString] = await once(w.webContents, 'console-message');
+          const { error } = JSON.parse(responseString);
+          expect(error).to.eq('I\'m sorry. I\'m afraid I can\'t do that.');
+        });
+
+        it('fails when navigating to prohibited url', async () => {
+          await w.loadURL(url);
+
+          const message = { method: 'update', args: [{ url: 'chrome://crash' }] };
+          w.webContents.executeJavaScript(`window.postMessage('${JSON.stringify(message)}', '*')`);
+
+          const [,, responseString] = await once(w.webContents, 'console-message');
+          const { error } = JSON.parse(responseString);
+          expect(error).to.eq('I\'m sorry. I\'m afraid I can\'t do that.');
+        });
+
+        it('fails when navigating to a devtools url without permission', async () => {
+          await w.loadURL(url);
+
+          const message = { method: 'update', args: [{ url: 'devtools://blah' }] };
+          w.webContents.executeJavaScript(`window.postMessage('${JSON.stringify(message)}', '*')`);
+
+          const [, , responseString] = await once(w.webContents, 'console-message');
+          const { error } = JSON.parse(responseString);
+          expect(error).to.eq('Cannot navigate to a devtools:// page without either the devtools or debugger permission.');
+        });
+
+        it('fails when navigating to a chrome-untrusted url', async () => {
+          await w.loadURL(url);
+
+          const message = { method: 'update', args: [{ url: 'chrome-untrusted://blah' }] };
+          w.webContents.executeJavaScript(`window.postMessage('${JSON.stringify(message)}', '*')`);
+
+          const [, , responseString] = await once(w.webContents, 'console-message');
+          const { error } = JSON.parse(responseString);
+          expect(error).to.eq('Cannot navigate to a chrome-untrusted:// page.');
+        });
+
+        it('fails when navigating to a file url withotut file access', async () => {
+          await w.loadURL(url);
+
+          const message = { method: 'update', args: [{ url: 'file://blah' }] };
+          w.webContents.executeJavaScript(`window.postMessage('${JSON.stringify(message)}', '*')`);
+
+          const [, , responseString] = await once(w.webContents, 'console-message');
+          const { error } = JSON.parse(responseString);
+          expect(error).to.eq('Cannot navigate to a file URL without local file access.');
         });
       });
 

spec/fixtures/extensions/chrome-tabs/api-async/background.js

@@ -1,6 +1,6 @@
 /* global chrome */
 
-const handleRequest = (request, sender, sendResponse) => {
+const handleRequest = async (request, sender, sendResponse) => {
   const { method, args = [] } = request;
   const tabId = sender.tab.id;
 
@@ -53,7 +53,12 @@ const handleRequest = (request, sender, sendResponse) => {
 
     case 'update': {
       const [params] = args;
-      chrome.tabs.update(tabId, params).then(sendResponse);
+      try {
+        const response = await chrome.tabs.update(tabId, params);
+        sendResponse(response);
+      } catch (error) {
+        sendResponse({ error: error.message });
+      }
       break;
     }
   }

spec/ts-smoke/electron/main.ts

@@ -377,6 +377,14 @@ if (process.platform === 'darwin') {
   console.log(value);
   const value2 = systemPreferences.getUserDefault('Foo', 'boolean');
   console.log(value2);
+  // @ts-expect-error Removed API
+  console.log(systemPreferences.getAppLevelAppearance());
+  // @ts-expect-error Removed API
+  systemPreferences.setAppLevelAppearance('dark');
+  // @ts-expect-error Removed API
+  console.log(systemPreferences.appLevelAppearance);
+  // @ts-expect-error Removed API
+  console.log(systemPreferences.getColor('alternate-selected-control-text'));
 }
 
 // Create the window.

typings/internal-ambient.d.ts

@@ -62,9 +62,7 @@ declare namespace NodeJS {
   type AsarFileStat = {
     size: number;
     offset: number;
-    isFile: boolean;
-    isDirectory: boolean;
-    isLink: boolean;
+    type: number;
   }
 
   interface AsarArchive {