fix: video scrubbing on playback (#47971)

fix: video scrubbing on playback (#47703)

* fix: fix video scrubbing on playback

* chore: address review feedback

---------

Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>

.devcontainer/docker-compose.yml

@@ -2,7 +2,7 @@ version: '3'
 
 services:
   buildtools:
-    image: ghcr.io/electron/devcontainer:424eedbf277ad9749ffa9219068aa72ed4a5e373
+    image: ghcr.io/electron/devcontainer:933c7d6ff6802706875270bec2e3c891cf8add3f
 
     volumes:
       - ..:/workspaces/gclient/src/electron:cached

.github/actions/build-electron/action.yml

@@ -38,9 +38,20 @@ runs:
       run: |
         GN_APPENDED_ARGS="$GN_EXTRA_ARGS target_cpu=\"x64\" v8_snapshot_toolchain=\"//build/toolchain/mac:clang_x64\""
         echo "GN_EXTRA_ARGS=$GN_APPENDED_ARGS" >> $GITHUB_ENV
+    - name: Set GN_EXTRA_ARGS for Windows
+      shell: bash
+      if: ${{inputs.target-arch != 'x64' && inputs.target-platform == 'win' }}
+      run: |
+        GN_APPENDED_ARGS="$GN_EXTRA_ARGS target_cpu=\"${{ inputs.target-arch }}\""
+        echo "GN_EXTRA_ARGS=$GN_APPENDED_ARGS" >> $GITHUB_ENV
     - name: Add Clang problem matcher
       shell: bash
       run: echo "::add-matcher::src/electron/.github/problem-matchers/clang.json"
+    - name: Enable long paths for Windows
+      shell: powershell
+      if: ${{ inputs.target-platform == 'win' }}
+      run: |
+        Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" -Name "LongPathsEnabled" -Value 1 -Type DWord
     - name: Build Electron ${{ inputs.step-suffix }}
       shell: bash
       run: |
@@ -184,8 +195,8 @@ runs:
           electron/script/zip-symbols.py -b $BUILD_PATH
         fi
     - name: Generate FFMpeg ${{ inputs.step-suffix }}
-      shell: bash
       if: ${{ inputs.is-release == 'true' }}
+      shell: bash
       run: |
         cd src
         gn gen out/ffmpeg --args="import(\"//electron/build/args/ffmpeg.gn\") use_remoteexec=true $GN_EXTRA_ARGS"

.github/actions/checkout/action.yml

@@ -40,10 +40,10 @@ runs:
     if: ${{ inputs.generate-sas-token == 'true' }}
     shell: bash
     run: |
-      curl --unix-socket /var/run/sas/sas.sock --fail "http://foo/$CACHE_FILE?platform=${{ inputs.target-platform }}" > sas-token
+      curl --unix-socket /var/run/sas/sas.sock --fail "http://foo/$CACHE_FILE?platform=${{ inputs.target-platform }}&getAccountName=true" > sas-token
   - name: Save SAS Key
     if: ${{ inputs.generate-sas-token == 'true' }}
-    uses: actions/cache/save@d4323d4df104b026a6aa633fdb11d772146be0bf
+    uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
     with:
       path: sas-token
       key: sas-key-${{ inputs.target-platform }}-${{ github.run_number }}-${{ github.run_attempt }}
@@ -117,12 +117,7 @@ runs:
         git update-index --refresh || true
         if ! git diff-index --quiet HEAD --; then
           # There are changes to the patches. Make a git commit with the updated patches
-          git add patches
-          GIT_COMMITTER_NAME="PatchUp" GIT_COMMITTER_EMAIL="73610968+patchup[bot]@users.noreply.github.com" git commit -m "chore: update patches" --author="PatchUp <73610968+patchup[bot]@users.noreply.github.com>"
-          # Export it
-          mkdir -p ../../patches
-          git format-patch -1 --stdout --keep-subject --no-stat --full-index > ../../patches/update-patches.patch
-          if node ./script/push-patch.js; then
+          if node ./script/patch-up.js; then
             echo
             echo "======================================================================"
             echo "Changes to the patches when applying, we have auto-pushed the diff to the current branch"
@@ -130,6 +125,11 @@ runs:
             echo "======================================================================"
             exit 1
           else
+            git add patches
+            GIT_COMMITTER_NAME="PatchUp" GIT_COMMITTER_EMAIL="73610968+patchup[bot]@users.noreply.github.com" git commit -m "chore: update patches" --author="PatchUp <73610968+patchup[bot]@users.noreply.github.com>"
+            # Export it
+            mkdir -p ../../patches
+            git format-patch -1 --stdout --keep-subject --no-stat --full-index > ../../patches/update-patches.patch
             echo
             echo "======================================================================"
             echo "There were changes to the patches when applying."

.github/actions/install-build-tools/action.yml

@@ -11,6 +11,7 @@ runs:
         git config --global core.autocrlf false
         git config --global branch.autosetuprebase always
         git config --global core.fscache true
+        git config --global core.longpaths true
         git config --global core.preloadindex true
       fi
       export BUILD_TOOLS_SHA=f2a960b4d82e6b5c9dbbd437378a39489f399c50

.github/actions/install-dependencies/action.yml

@@ -7,7 +7,7 @@ runs:
     shell: bash
     id: yarn-cache-dir-path
     run: echo "dir=$(node src/electron/script/yarn cache dir)" >> $GITHUB_OUTPUT
-  - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
+  - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
     id: yarn-cache
     with:
       path: ${{ steps.yarn-cache-dir-path.outputs.dir }}

.github/actions/restore-cache-azcopy/action.yml

@@ -8,14 +8,14 @@ runs:
   steps:
   - name: Obtain SAS Key
     continue-on-error: true
-    uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf
+    uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
     with:
       path: sas-token
       key: sas-key-${{ inputs.target-platform }}-${{ github.run_number }}-1
       enableCrossOsArchive: true
   - name: Obtain SAS Key
     continue-on-error: true
-    uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf
+    uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
     with:
       path: sas-token
       key: sas-key-${{ inputs.target-platform }}-${{ github.run_number }}-${{ github.run_attempt }}
@@ -32,22 +32,27 @@ runs:
       shell: bash
       command: |
         sas_token=$(cat sas-token)
-        if [ -z $sas-token ]; then
+        if [ -z "$sas_token" ]; then
           echo "SAS Token not found; exiting src cache download early..."
           exit 1
         else
+          echo "const fs = require('fs');" > gettoken.js
+          echo "const fileContents = fs.readFileSync('sas-token', 'utf8');" >> gettoken.js
+          echo "const token = JSON.parse(fileContents);" >> gettoken.js
+          echo "console.log(token[process.argv[2]])" >> gettoken.js
+          sas_token=$(node ./gettoken.js sasToken)
+          account_name=$(node ./gettoken.js accountName)
           if [ "${{ inputs.target-platform }}" = "win" ]; then
             azcopy copy --log-level=ERROR \
-            "https://${{ env.AZURE_AKS_CACHE_STORAGE_ACCOUNT }}.file.core.windows.net/${{ env.AZURE_AKS_WIN_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
+            "https://$account_name.file.core.windows.net/${{ env.AZURE_AKS_WIN_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
           else
             azcopy copy --log-level=ERROR \
-            "https://${{ env.AZURE_AKS_CACHE_STORAGE_ACCOUNT }}.file.core.windows.net/${{ env.AZURE_AKS_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
+            "https://$account_name.file.core.windows.net/${{ env.AZURE_AKS_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
           fi            
         fi
     env:
-      AZURE_AKS_CACHE_STORAGE_ACCOUNT: f723719aa87a34622b5f7f3
-      AZURE_AKS_CACHE_SHARE_NAME: pvc-f6a4089f-b082-4bee-a3f9-c3e1c0c02d8f
-      AZURE_AKS_WIN_CACHE_SHARE_NAME: pvc-71dec4f2-0d44-4fd1-a2c3-add049d70bdf
+      AZURE_AKS_CACHE_SHARE_NAME: linux-cache
+      AZURE_AKS_WIN_CACHE_SHARE_NAME: windows-cache
   - name: Clean SAS Key
     shell: bash
     run: rm -f sas-token
@@ -96,7 +101,7 @@ runs:
 
       $TEMP_DIR=New-Item -ItemType Directory -Path temp-cache
       $TEMP_DIR_PATH = $TEMP_DIR.FullName
-      C:\ProgramData\Chocolatey\bin\7z.exe -y x $src_cache -o"$TEMP_DIR_PATH"
+      C:\ProgramData\Chocolatey\bin\7z.exe -y -snld x $src_cache -o"$TEMP_DIR_PATH"
 
   - name: Move Src Cache (Windows)
     if: ${{ inputs.target-platform == 'win' }}

.github/actions/ssh-debug/action.yml

@@ -0,0 +1,20 @@
+name: Debug via SSH
+description: Setup a SSH server with a tunnel to access it to debug via SSH.
+inputs:
+  tunnel:
+    description: 'Enable SSH tunneling via cloudflared'
+    required: true
+    default: 'false'
+  timeout:
+    description: 'SSH session timeout in minutes'
+    required: false
+    type: number
+    default: 60
+runs:
+  using: composite
+  steps:
+    - run: $GITHUB_ACTION_PATH/setup-ssh.sh
+      shell: bash
+      env:
+        TUNNEL: ${{ inputs.tunnel }}
+        TIMEOUT: ${{ inputs.timeout }}

.github/actions/ssh-debug/bashrc

@@ -0,0 +1,4 @@
+# If we're in an interactive SSH session and we're not already in tmux and there's no explicit SSH command, auto attach tmux
+if [ -n "$SSH_TTY" ] && [ -z "$TMUX" ] && [ -z "$SSH_ORIGINAL_COMMAND" ]; then
+    exec tmux attach || exec tmux
+fi

.github/actions/ssh-debug/setup-ssh.sh

@@ -0,0 +1,140 @@
+#!/bin/bash -e
+
+get_authorized_keys() {
+    if [ -z "$AUTHORIZED_USERS" ] || ! echo "$AUTHORIZED_USERS" | grep -q "\b$GITHUB_ACTOR\b"; then
+        return 1
+    fi
+
+    api_response=$(curl -s "https://api.github.com/users/$GITHUB_ACTOR/keys")
+
+    if echo "$api_response" | jq -e 'type == "object" and has("message")' >/dev/null; then
+        error_msg=$(echo "$api_response" | jq -r '.message')
+        echo "Error: $error_msg"
+        return 1
+    else
+        echo "$api_response" | jq -r '.[].key'
+    fi
+}
+
+authorized_keys=$(get_authorized_keys "$GITHUB_ACTOR")
+
+if [ -n "$authorized_keys" ]; then
+    echo "Configured SSH key(s) for user: $GITHUB_ACTOR"
+else
+    echo "Error: User '$GITHUB_ACTOR' is not authorized to access this debug session."
+    echo "Authorized users: $AUTHORIZED_USERS"
+    exit 1
+fi
+
+if [ "$TUNNEL" != "true" ]; then
+    echo "SSH tunneling is disabled. Set enable-tunnel: true to enable remote access."
+    echo "Local SSH server would be available on localhost:2222 if this were a local environment."
+    exit 0
+fi
+
+echo "SSH tunneling enabled. Setting up remote access..."
+
+EXTERNAL_DEPS="curl jq ssh-keygen"
+
+for dep in $EXTERNAL_DEPS; do
+    if ! command -v "$dep" > /dev/null 2>&1; then
+       echo "Command $dep not installed on the system!" >&2
+       exit 1
+    fi
+done
+
+cd "$GITHUB_ACTION_PATH"
+
+bashrc_path=$(pwd)/bashrc
+
+# Source `bashrc` to auto start tmux on SSH login.
+if ! grep -q "$bashrc_path" ~/.bash_profile; then
+    echo >> ~/.bash_profile # On macOS runner there's no newline at the end of the file
+    echo "source \"$bashrc_path\"" >> ~/.bash_profile
+fi
+
+OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+ARCH=$(uname -m)
+
+if [ "$ARCH" = "x86_64" ]; then
+    ARCH="amd64"
+elif [ "$ARCH" = "aarch64" ]; then
+    ARCH="arm64"
+fi
+
+# Install tmux on macOS runners if not present.
+if [ "$OS" = "darwin" ] && ! command -v tmux > /dev/null 2>&1; then
+    echo "Installing tmux..."
+    brew install tmux
+fi
+
+if [ "$OS" = "darwin" ]; then
+    cloudflared_url="https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${OS}-${ARCH}.tgz"
+    echo "Downloading \`cloudflared\` from <$cloudflared_url>..."
+    curl --location --silent --output cloudflared.tgz "$cloudflared_url"
+    tar xf cloudflared.tgz
+    rm cloudflared.tgz
+else
+    cloudflared_url="https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${OS}-${ARCH}"
+    echo "Downloading \`cloudflared\` from <$cloudflared_url>..."
+    curl --location --silent --output cloudflared "$cloudflared_url"
+fi
+
+chmod +x cloudflared
+
+echo "Setting up SSH key for authorized user: $GITHUB_ACTOR"
+echo "$authorized_keys" > authorized_keys
+
+echo 'Creating SSH server key...'
+ssh-keygen -q -f ssh_host_rsa_key -N ''
+
+echo 'Creating SSH server config...'
+sed "s,\$PWD,$PWD,;s,\$USER,$USER," sshd_config.template > sshd_config
+
+echo 'Starting SSH server...'
+/usr/sbin/sshd -f sshd_config -D &
+sshd_pid=$!
+
+echo 'Starting tmux session...'
+(cd "$GITHUB_WORKSPACE" && tmux new-session -d -s debug)
+
+#if no cloudflare tunnel token is provided, exit
+if [ -z "$CLOUDFLARE_TUNNEL_TOKEN" ]; then
+    echo "Error: required CLOUDFLARE_TUNNEL_TOKEN not found"
+    exit 1
+fi
+
+echo 'Starting Cloudflare tunnel...'
+
+./cloudflared tunnel --no-autoupdate run --token "$CLOUDFLARE_TUNNEL_TOKEN" 2>&1 | tee cloudflared.log | sed -u 's/^/cloudflared: /' &
+cloudflared_pid=$!
+
+url="$TUNNEL_HOSTNAME"
+
+public_key=$(cut -d' ' -f1,2 < ssh_host_rsa_key.pub)
+
+(
+    echo '    '
+    echo '    '
+    echo '🔗 SSH Debug Session Ready!'
+    echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
+    echo '    '
+    echo '📋 Copy and run this command to connect:'
+    echo '    '
+    if [ -n "$TUNNEL_HOSTNAME" ]; then
+        echo "ssh-keygen -R action-ssh-debug && echo 'action-ssh-debug $public_key' >> ~/.ssh/known_hosts && ssh -o ProxyCommand='cloudflared access tcp --hostname $url' runner@action-ssh-debug"
+    else
+        echo "ssh-keygen -R action-ssh-debug && echo 'action-ssh-debug $public_key' >> ~/.ssh/known_hosts && ssh -o ProxyCommand='cloudflared access tcp --hostname $url' runner@action-ssh-debug"
+    fi
+    echo '    '
+    echo "⏰ Session expires automatically in $TIMEOUT minutes"
+    echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
+    echo '    '
+    echo '    '
+) | cat
+
+echo 'Starting SSH session in background...'
+./ssh-session.sh "$sshd_pid" "$cloudflared_pid" $TIMEOUT &
+
+echo 'SSH session is running in background. GitHub Action will continue.'
+echo 'Session will auto-cleanup after timeout or when processes end.'

.github/actions/ssh-debug/ssh-session.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+SSHD_PID=$1
+CLOUDFLARED_PID=$2
+SESSION_TIMEOUT=${3:-3600}
+
+# Wait for timeout or until processes die.
+sleep "$SESSION_TIMEOUT" &
+SLEEP_PID=$!
+
+# Monitor if SSH or cloudflared dies early.
+while kill -0 "$SSHD_PID" 2>/dev/null && kill -0 "$CLOUDFLARED_PID" 2>/dev/null && kill -0 "$SLEEP_PID" 2>/dev/null; do
+  sleep 10
+done
+
+# Cleanup.
+kill "$SLEEP_PID" 2>/dev/null || true
+kill "$SSHD_PID" 2>/dev/null || true
+kill "$CLOUDFLARED_PID" 2>/dev/null || true
+
+echo "SSH session ended"

.github/actions/ssh-debug/sshd_config.template

@@ -0,0 +1,9 @@
+Port 2222
+HostKey $PWD/ssh_host_rsa_key
+PidFile $PWD/sshd.pid
+
+# Only allow single user
+AllowUsers $USER
+
+# Only allow those keys
+AuthorizedKeysFile $PWD/authorized_keys

.github/workflows/build-git-cache.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   build-git-cache-linux:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root
@@ -29,7 +29,7 @@ jobs:
         target-platform: linux
 
   build-git-cache-windows:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -51,7 +51,7 @@ jobs:
         target-platform: win
 
   build-git-cache-macos:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     # This job updates the same git cache as linux, so it needs to run after the linux one.
     needs: build-git-cache-linux
     container:

.github/workflows/build.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
         required: true
       skip-macos:
         type: boolean
@@ -64,7 +64,7 @@ jobs:
       id: set-output
       run: |
         if [ -z "${{ inputs.build-image-sha }}" ]; then
-          echo "build-image-sha=424eedbf277ad9749ffa9219068aa72ed4a5e373" >> "$GITHUB_OUTPUT"
+          echo "build-image-sha=933c7d6ff6802706875270bec2e3c891cf8add3f" >> "$GITHUB_OUTPUT"
         else
           echo "build-image-sha=${{ inputs.build-image-sha }}" >> "$GITHUB_OUTPUT"
         fi
@@ -92,7 +92,7 @@ jobs:
   checkout-macos:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-macos}}
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -120,7 +120,7 @@ jobs:
   checkout-linux:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-linux}}
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -146,7 +146,7 @@ jobs:
   checkout-windows:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -191,7 +191,7 @@ jobs:
     with:
       target-platform: linux
       target-archs: x64 arm arm64
-      check-runs-on: electron-arc-linux-amd64-8core
+      check-runs-on: electron-arc-centralus-linux-amd64-8core
       check-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       gn-build-type: testing
     secrets: inherit
@@ -202,7 +202,7 @@ jobs:
     with:
       target-platform: win
       target-archs: x64 x86 arm64
-      check-runs-on: electron-arc-linux-amd64-8core
+      check-runs-on: electron-arc-centralus-linux-amd64-8core
       check-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-windows.outputs.build-image-sha }}","options":"--user root --device /dev/fuse --cap-add SYS_ADMIN","volumes":["/mnt/win-cache:/mnt/win-cache"]}'
       gn-build-type: testing
     secrets: inherit
@@ -252,8 +252,8 @@ jobs:
     uses: ./.github/workflows/pipeline-electron-build-and-test-and-nan.yml
     needs: checkout-linux
     with:
-      build-runs-on: electron-arc-linux-amd64-32core
-      test-runs-on: electron-arc-linux-amd64-4core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: electron-arc-centralus-linux-amd64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
       target-platform: linux
@@ -272,8 +272,8 @@ jobs:
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
     with:
-      build-runs-on: electron-arc-linux-amd64-32core
-      test-runs-on: electron-arc-linux-amd64-4core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: electron-arc-centralus-linux-amd64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
       target-platform: linux
@@ -293,8 +293,8 @@ jobs:
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
     with:
-      build-runs-on: electron-arc-linux-amd64-32core
-      test-runs-on: electron-arc-linux-arm64-4core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: electron-arc-centralus-linux-arm64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/test:arm32v7-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init","volumes":["/home/runner/externals:/mnt/runner-externals"]}'
       target-platform: linux
@@ -313,8 +313,8 @@ jobs:
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
     with:
-      build-runs-on: electron-arc-linux-amd64-32core
-      test-runs-on: electron-arc-linux-arm64-4core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: electron-arc-centralus-linux-arm64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/test:arm64v8-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
       target-platform: linux
@@ -334,7 +334,7 @@ jobs:
     needs: checkout-windows
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     with:
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       test-runs-on: windows-latest
       target-platform: win
       target-arch: x64
@@ -353,7 +353,7 @@ jobs:
     needs: checkout-windows
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     with:
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       test-runs-on: windows-latest
       target-platform: win
       target-arch: x86
@@ -372,7 +372,7 @@ jobs:
     needs: checkout-windows
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     with:
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       test-runs-on: electron-hosted-windows-arm64-4core
       target-platform: win
       target-arch: arm64

.github/workflows/clean-src-cache.yml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   clean-src-cache:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root

.github/workflows/linux-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
       upload-to-storage:
         description: 'Uploads to Azure storage'
         required: false
@@ -19,7 +19,7 @@ on:
 
 jobs:
   checkout-linux:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root
@@ -43,7 +43,7 @@ jobs:
     needs: checkout-linux
     with:
       environment: production-release
-      build-runs-on: electron-arc-linux-amd64-32core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
       build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       target-platform: linux
       target-arch: x64
@@ -59,7 +59,7 @@ jobs:
     needs: checkout-linux
     with:
       environment: production-release
-      build-runs-on: electron-arc-linux-amd64-32core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
       build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       target-platform: linux
       target-arch: arm
@@ -75,7 +75,7 @@ jobs:
     needs: checkout-linux
     with:
       environment: production-release
-      build-runs-on: electron-arc-linux-amd64-32core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
       build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       target-platform: linux
       target-arch: arm64

.github/workflows/macos-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
         required: true
       upload-to-storage:
         description: 'Uploads to Azure storage'
@@ -20,7 +20,7 @@ on:
 
 jobs:
   checkout-macos:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root

.github/workflows/pipeline-electron-docs-only.yml

@@ -15,7 +15,7 @@ concurrency:
 jobs:
   docs-only:
     name: Docs Only Compile
-    runs-on: electron-arc-linux-amd64-4core
+    runs-on: electron-arc-centralus-linux-amd64-4core
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:

.github/workflows/pipeline-electron-lint.yml

@@ -18,7 +18,7 @@ env:
 jobs:
   lint:
     name: Lint
-    runs-on: electron-arc-linux-amd64-4core
+    runs-on: electron-arc-centralus-linux-amd64-4core
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:

.github/workflows/pipeline-segment-electron-build.yml

@@ -73,6 +73,7 @@ env:
   SUDOWOODO_EXCHANGE_TOKEN: ${{ secrets.SUDOWOODO_EXCHANGE_TOKEN }}
   GCLIENT_EXTRA_ARGS: ${{ inputs.target-platform == 'macos' && '--custom-var=checkout_mac=True --custom-var=host_os=mac' || inputs.target-platform == 'win' && '--custom-var=checkout_win=True' || '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True' }}
   ELECTRON_OUT_DIR: Default
+  ACTIONS_STEP_DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }}
 
 jobs:
   build:
@@ -94,6 +95,15 @@ jobs:
         path: src/electron
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
+    - name: Setup SSH Debugging
+      if: ${{ inputs.target-platform == 'macos' && env.ACTIONS_STEP_DEBUG == 'true' }}
+      uses: ./src/electron/.github/actions/ssh-debug
+      with:
+        tunnel: 'true'
+      env:
+        CLOUDFLARE_TUNNEL_TOKEN: ${{ secrets.CLOUDFLARE_TUNNEL_TOKEN }}
+        TUNNEL_HOSTNAME: ${{ secrets.CLOUDFLARED_SSH_HOSTNAME }}
+        AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
     - name: Free up space (macOS)
       if: ${{ inputs.target-platform == 'macos' }}
       uses: ./src/electron/.github/actions/free-space-macos

.github/workflows/pipeline-segment-electron-test.yml

@@ -40,6 +40,7 @@ env:
   CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
   ELECTRON_OUT_DIR: Default
   ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
+  ACTIONS_STEP_DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }}
 
 jobs:
   test:
@@ -100,9 +101,9 @@ jobs:
         }
 
         userValuesArray=(
-            "'kTCCServiceMicrophone','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
             "'kTCCServiceCamera','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
             "'kTCCServiceBluetoothAlways','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
+            "'kTCCServiceAppleEvents','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
         )
         for values in "${userValuesArray[@]}"; do
           # Sonoma and higher have a few extra values
@@ -124,6 +125,15 @@ jobs:
         path: src/electron
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
+    - name: Setup SSH Debugging
+      if: ${{ inputs.target-platform == 'macos' && env.ACTIONS_STEP_DEBUG == 'true' }}
+      uses: ./src/electron/.github/actions/ssh-debug
+      with:
+        tunnel: 'true'
+      env:
+        CLOUDFLARE_TUNNEL_TOKEN: ${{ secrets.CLOUDFLARE_TUNNEL_TOKEN }}
+        TUNNEL_HOSTNAME: ${{ secrets.CLOUDFLARED_SSH_HOSTNAME }}
+        AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
     - name: Set Chromium Git Cookie
@@ -135,6 +145,7 @@ jobs:
         git config --global core.autocrlf false
         git config --global branch.autosetuprebase always
         git config --global core.fscache true
+        git config --global core.longpaths true
         git config --global core.preloadindex true
         git clone --filter=tree:0 https://chromium.googlesource.com/chromium/tools/depot_tools.git
         # Ensure depot_tools does not update.
@@ -192,7 +203,6 @@ jobs:
         MOCHA_REPORTER: mocha-multi-reporters
         MOCHA_MULTI_REPORTERS: mocha-junit-reporter, tap
         ELECTRON_DISABLE_SECURITY_WARNINGS: 1
-        ELECTRON_SKIP_NATIVE_MODULE_TESTS: true
         DISPLAY: ':99.0'
         NPM_CONFIG_MSVS_VERSION: '2022'
       run: |

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -38,7 +38,7 @@ env:
 jobs:
   node-tests:
     name: Run Node.js Tests
-    runs-on: electron-arc-linux-amd64-8core
+    runs-on: electron-arc-centralus-linux-amd64-8core
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}
@@ -92,7 +92,7 @@ jobs:
         done
   nan-tests:
     name: Run Nan Tests
-    runs-on: electron-arc-linux-amd64-4core
+    runs-on: electron-arc-centralus-linux-amd64-4core
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}

.github/workflows/windows-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
         required: true
       upload-to-storage:
         description: 'Uploads to Azure storage'
@@ -20,7 +20,7 @@ on:
 
 jobs:
   checkout-windows:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -51,7 +51,7 @@ jobs:
     needs: checkout-windows
     with:
       environment: production-release
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       target-platform: win
       target-arch: x64
       is-release: true
@@ -65,7 +65,7 @@ jobs:
     needs: checkout-windows
     with:
       environment: production-release
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       target-platform: win
       target-arch: arm64
       is-release: true
@@ -79,7 +79,7 @@ jobs:
     needs: checkout-windows
     with:
       environment: production-release
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       target-platform: win
       target-arch: x86
       is-release: true

DEPS

@@ -2,9 +2,9 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '138.0.7204.23',
+    '138.0.7204.185',
   'node_version':
-    'v22.16.0',
+    'v22.17.1',
   'nan_version':
     'e14bdcd1f72d62bca1d541b66da43130384ec213',
   'squirrel.mac_version':
@@ -31,7 +31,7 @@ vars = {
   'sysroots_json_path': 'electron/script/sysroots.json',
 
   # KEEP IN SYNC WITH utils.js FILE
-  'yarn_version': '1.15.2',
+  'yarn_version': '1.22.22',
 
   # To be able to build clean Chromium from sources.
   'apply_patches': True,

build/.eslintrc.json

@@ -1,8 +1,8 @@
 {
   "plugins": [
-    "unicorn"
+    "import"
   ],
   "rules": {
-    "unicorn/prefer-node-protocol": "error"
+    "import/enforce-node-protocol-usage": ["error", "always"]
   }
 }

default_app/.eslintrc.json

@@ -1,8 +1,8 @@
 {
   "plugins": [
-    "unicorn"
+    "import"
   ],
   "rules": {
-    "unicorn/prefer-node-protocol": "error"
+    "import/enforce-node-protocol-usage": ["error", "always"]
   }
 }

docs/api/browser-window.md

@@ -1527,8 +1527,8 @@ events.
 
 Prevents the window contents from being captured by other apps.
 
-On macOS it sets the NSWindow's sharingType to NSWindowSharingNone.
-On Windows it calls SetWindowDisplayAffinity with `WDA_EXCLUDEFROMCAPTURE`.
+On macOS it sets the NSWindow's [`sharingType`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.property?language=objc) to [`NSWindowSharingNone`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.enum/none?language=objc).
+On Windows it calls [`SetWindowDisplayAffinity`](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowdisplayaffinity) with `WDA_EXCLUDEFROMCAPTURE`.
 For Windows 10 version 2004 and up the window will be removed from capture entirely,
 older Windows versions behave as if `WDA_MONITOR` is applied capturing a black window.
 

docs/api/command-line-switches.md

@@ -290,7 +290,7 @@ Specify ways of the inspector web socket url exposure.
 
 By default inspector websocket url is available in stderr and under /json/list endpoint on `http://host:port/json/list`.
 
-### `--experimental-network-inspector`
+### `--experimental-network-inspection`
 
 Enable support for devtools network inspector events, for visibility into requests made by the nodejs `http` and `https` modules.
 
@@ -325,6 +325,10 @@ Set the directory to which all Node.js diagnostic output files are written. Defa
 
 Affects the default output directory of [v8.setHeapSnapshotNearHeapLimit](https://nodejs.org/docs/latest/api/v8.html#v8setheapsnapshotnearheaplimitlimit).
 
+### `--no-experimental-global-navigator`
+
+Disable exposition of [Navigator API][] on the global scope from Node.js.
+
 [app]: app.md
 [append-switch]: command-line.md#commandlineappendswitchswitch-value
 [debugging-main-process]: ../tutorial/debugging-main-process.md
@@ -333,3 +337,4 @@ Affects the default output directory of [v8.setHeapSnapshotNearHeapLimit](https:
 [play-silent-audio]: https://github.com/atom/atom/pull/9485/files
 [ready]: app.md#event-ready
 [severities]: https://source.chromium.org/chromium/chromium/src/+/main:base/logging.h?q=logging::LogSeverity&ss=chromium
+[Navigator API]: https://github.com/nodejs/node/blob/main/doc/api/globals.md#navigator

docs/api/corner-smoothing-css.md

@@ -51,19 +51,17 @@ Use the `system-ui` keyword to match the smoothness to the OS design language.
 
 ### Controlling availibility
 
-This CSS rule can be disabled by setting [the `cornerSmoothingCSS` web preference](./structures/web-preferences.md) to `false`.
+This CSS rule can be disabled using the Blink feature flag `ElectronCSSCornerSmoothing`.
 
 ```js
 const myWindow = new BrowserWindow({
   // [...]
   webPreferences: {
-    enableCornerSmoothingCSS: false // Disables the `-electron-corner-smoothing` CSS rule
+    disableBlinkFeatures: 'ElectronCSSCornerSmoothing' // Disables the `-electron-corner-smoothing` CSS rule
   }
 })
 ```
 
-The CSS rule will still parse, but will have no visual effect.
-
 ### Formal reference
 
 * **Initial value**: `0%`

docs/api/crash-reporter.md

@@ -63,7 +63,7 @@ The `crashReporter` module has the following methods:
   * `extra` Record\<string, string\> (optional) - Extra string key/value
     annotations that will be sent along with crash reports that are generated
     in the main process. Only string values are supported. Crashes generated in
-    child processes will not contain these extra
+    child processes will not include these extra parameters. To add extra
     parameters to crash reports generated from child processes, call
     [`addExtraParameter`](#crashreporteraddextraparameterkey-value) from the
     child process.

docs/api/menu-item.md

@@ -20,8 +20,14 @@ See [`Menu`](menu.md) for examples.
     * `event` [KeyboardEvent](structures/keyboard-event.md)
   * `role` string (optional) - Can be `undo`, `redo`, `cut`, `copy`, `paste`, `pasteAndMatchStyle`, `delete`, `selectAll`, `reload`, `forceReload`, `toggleDevTools`, `resetZoom`, `zoomIn`, `zoomOut`, `toggleSpellChecker`, `togglefullscreen`, `window`, `minimize`, `close`, `help`, `about`, `services`, `hide`, `hideOthers`, `unhide`, `quit`, `showSubstitutions`, `toggleSmartQuotes`, `toggleSmartDashes`, `toggleTextReplacement`, `startSpeaking`, `stopSpeaking`, `zoom`, `front`, `appMenu`, `fileMenu`, `editMenu`, `viewMenu`, `shareMenu`, `recentDocuments`, `toggleTabBar`, `selectNextTab`, `selectPreviousTab`, `showAllTabs`, `mergeAllWindows`, `clearRecentDocuments`, `moveTabToNewWindow` or `windowMenu` - Define the action of the menu item, when specified the
     `click` property will be ignored. See [roles](#roles).
-  * `type` string (optional) - Can be `normal`, `separator`, `submenu`, `checkbox` or
-    `radio`.
+  * `type` string (optional)
+    * `normal`
+    * `separator`
+    * `submenu`
+    * `checkbox`
+    * `radio`
+    * `header` - Only available on macOS 14 and up.
+    * `palette` - Only available on macOS 14 and up.
   * `label` string (optional)
   * `sublabel` string (optional) _macOS_ - Available in macOS >= 14.4
   * `toolTip` string (optional) _macOS_ - Hover text for this menu item.
@@ -162,7 +168,10 @@ item's submenu, if present.
 
 #### `menuItem.type`
 
-A `string` indicating the type of the item. Can be `normal`, `separator`, `submenu`, `checkbox` or `radio`.
+A `string` indicating the type of the item. Can be `normal`, `separator`, `submenu`, `checkbox`, `radio`, `header` or `palette`.
+
+> [!NOTE]
+> `header` and `palette` are only available on macOS 14 and up.
 
 #### `menuItem.role`
 

docs/api/structures/base-window-options.md

@@ -95,6 +95,7 @@
   * `color` String (optional) _Windows_ _Linux_ - The CSS color of the Window Controls Overlay when enabled. Default is the system color.
   * `symbolColor` String (optional) _Windows_ _Linux_ - The CSS color of the symbols on the Window Controls Overlay when enabled. Default is the system color.
   * `height` Integer (optional) - The height of the title bar and Window Controls Overlay in pixels. Default is system height.
+* `accentColor` boolean | string (optional) _Windows_ - The accent color for the window. By default, follows user preference in System Settings. Set to `false` to explicitly disable, or set the color in Hex, RGB, RGBA, HSL, HSLA or named CSS color format. Alpha values will be ignored.
 * `trafficLightPosition` [Point](point.md) (optional) _macOS_ -
   Set a custom position for the traffic light buttons in frameless windows.
 * `roundedCorners` boolean (optional) _macOS_ _Windows_ - Whether frameless window

docs/api/structures/web-preferences.md

@@ -149,7 +149,6 @@
   `WebContents` when the preferred size changes. Default is `false`.
 * `transparent` boolean (optional) - Whether to enable background transparency for the guest page. Default is `true`. **Note:** The guest page's text and background colors are derived from the [color scheme](https://developer.mozilla.org/en-US/docs/Web/CSS/color-scheme) of its root element. When transparency is enabled, the text color will still change accordingly but the background will remain transparent.
 * `enableDeprecatedPaste` boolean (optional) _Deprecated_ - Whether to enable the `paste` [execCommand](https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand). Default is `false`.
-* `enableCornerSmoothingCSS` boolean (optional) _Experimental_ - Whether the [`-electron-corner-smoothing` CSS rule](../corner-smoothing-css.md) is enabled. Default is `true`.
 
 [chrome-content-scripts]: https://developer.chrome.com/extensions/content_scripts#execution-environment
 [runtime-enabled-features]: https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/platform/runtime_enabled_features.json5

docs/development/build-instructions-linux.md

@@ -7,11 +7,8 @@ Follow the guidelines below for building **Electron itself** on Linux, for the p
 ## Prerequisites
 
 * At least 25GB disk space and 8GB RAM.
-* Python >= 3.7.
-* Node.js. There are various ways to install Node. You can download
-  source code from [nodejs.org](https://nodejs.org) and compile it.
-  Doing so permits installing Node on your own home directory as a standard user.
-  Or try repositories such as [NodeSource](https://nodesource.com/blog/nodejs-v012-iojs-and-the-nodesource-linux-repositories).
+* Python >= 3.9.
+* [Node.js](https://nodejs.org/download/) >= 22.12.0
 * [clang](https://clang.llvm.org/get_started.html) 3.4 or later.
 * Development headers of GTK 3 and libnotify.
 

docs/development/build-instructions-macos.md

@@ -10,8 +10,8 @@ Follow the guidelines below for building **Electron itself** on macOS, for the p
 * [Xcode](https://developer.apple.com/technologies/tools/). The exact version
   needed depends on what branch you are building, but the latest version of
   Xcode is generally a good bet for building `main`.
-* [node.js](https://nodejs.org) (external)
-* Python >= 3.7
+* Python >= 3.9
+* [Node.js](https://nodejs.org/download/) >= 22.12.0
 
 ### Arm64-specific prerequisites
 

docs/development/build-instructions-windows.md

@@ -14,7 +14,7 @@ Follow the guidelines below for building **Electron itself** on Windows, for the
   set a few environment variables to point the toolchains to your installation path.
     * `vs2022_install = DRIVE:\path\to\Microsoft Visual Studio\2022\Community`, replacing `2022` and `Community` with your installed versions and replacing `DRIVE:` with the drive that Visual Studio is on. Often, this will be `C:`.
     * `WINDOWSSDKDIR = DRIVE:\path\to\Windows Kits\10`, replacing `DRIVE:` with the drive that Windows Kits is on. Often, this will be `C:`.
-* [Node.js](https://nodejs.org/download/)
+* [Node.js](https://nodejs.org/download/) >= 22.12.0
 * [Git](https://git-scm.com)
 * Debugging Tools for Windows of Windows SDK 10.0.15063.468 if you plan on
 creating a full distribution since `symstore.exe` is used for creating a symbol

docs/tutorial/electron-timelines.md

@@ -9,10 +9,11 @@ check out our [Electron Versioning](./electron-versioning.md) doc.
 
 | Electron | Alpha | Beta | Stable | EOL | Chrome | Node | Supported |
 | ------- | ----- | ------- | ------ | ------ | ---- | ---- | ---- |
-| 37.0.0 |  2025-May-01 | 2025-May-28 | 2025-Jun-24 | 2026-Jan-13 | M138 | TBD | ✅ |
+| 38.0.0 |  2025-Jun-26 | 2025-Aug-06 | 2025-Sep-02 | 2026-Mar-10 | M140 | TBD | ✅ |
+| 37.0.0 |  2025-May-01 | 2025-May-28 | 2025-Jun-24 | 2026-Jan-13 | M138 | v22.16 | ✅ |
 | 36.0.0 |  2025-Mar-06 | 2025-Apr-02 | 2025-Apr-29 | 2025-Oct-28 | M136 | v22.14 | ✅ |
 | 35.0.0 |  2025-Jan-16 | 2025-Feb-05 | 2025-Mar-04 | 2025-Sep-02 | M134 | v22.14 | ✅ |
-| 34.0.0 |  2024-Oct-17 | 2024-Nov-13 | 2025-Jan-14 | 2025-Jun-24 | M132 | v20.18 | ✅ |
+| 34.0.0 |  2024-Oct-17 | 2024-Nov-13 | 2025-Jan-14 | 2025-Jun-24 | M132 | v20.18 | 🚫 |
 | 33.0.0 |  2024-Aug-22 | 2024-Sep-18 | 2024-Oct-15 | 2025-Apr-29 | M130 | v20.18 | 🚫 |
 | 32.0.0 |  2024-Jun-14 | 2024-Jul-24 | 2024-Aug-20 | 2025-Mar-04 | M128 | v20.16 | 🚫 |
 | 31.0.0 |  2024-Apr-18 | 2024-May-15 | 2024-Jun-11 | 2025-Jan-14 | M126 | v20.14 | 🚫 |

docs/tutorial/electron-versioning.md

@@ -143,7 +143,7 @@ The `electron/electron` repository also enforces squash merging, so you only nee
 
 ## Historical versioning (Electron 1.X)
 
-Electron versions _< 2.0_ did not conform to the [SemVer](https://semver.org) spec: major versions corresponded to end-user API changes, minor versions corresponded to Chromium major releases, and patch versions corresponded to new features and bug fixes. While convenient for developers merging features, it creates problems for developers of client-facing applications. The QA testing cycles of major apps like Slack, Teams, Skype, VS Code, and GitHub Desktop can be lengthy and stability is a highly desired outcome. There is a high risk in adopting new features while trying to absorb bug fixes.
+Electron versions _< 2.0_ did not conform to the [SemVer](https://semver.org) spec: major versions corresponded to end-user API changes, minor versions corresponded to Chromium major releases, and patch versions corresponded to new features and bug fixes. While convenient for developers merging features, it creates problems for developers of client-facing applications. The QA testing cycles of major apps like Slack, Teams, VS Code, and GitHub Desktop can be lengthy and stability is a highly desired outcome. There is a high risk in adopting new features while trying to absorb bug fixes.
 
 Here is an example of the 1.x strategy:
 

docs/tutorial/fuses.md

@@ -48,7 +48,7 @@ The nodeCliInspect fuse toggles whether the `--inspect`, `--inspect-brk`, etc. f
 
 **@electron/fuses:** `FuseV1Options.EnableEmbeddedAsarIntegrityValidation`
 
-The embeddedAsarIntegrityValidation fuse toggles an experimental feature on macOS that validates the content of the `app.asar` file when it is loaded.  This feature is designed to have a minimal performance impact but may marginally slow down file reads from inside the `app.asar` archive.
+The embeddedAsarIntegrityValidation fuse toggles an experimental feature on macOS and Windows that validates the content of the `app.asar` file when it is loaded.  This feature is designed to have a minimal performance impact but may marginally slow down file reads from inside the `app.asar` archive.
 
 For more information on how to use asar integrity validation please read the [Asar Integrity](asar-integrity.md) documentation.
 

docs/why-electron.md

@@ -44,7 +44,7 @@ Electron combines Chromium, Node.js, and the ability to write custom native code
 
 ### Enterprise-grade
 
-Electron is reliable, secure, stable, and mature. It is the premier choice for companies building their flagship product. We have a list of some of those companies on our homepage, but just among chat apps, Slack, Discord, and Skype are built with Electron. Among AI applications, both OpenAI’s ChatGPT and Anthropic’s Claude use Electron. Visual Studio Code, Loom, Canva, Notion, Docker, and countless other leading developers of software bet on Electron.
+Electron is reliable, secure, stable, and mature. It is the premier choice for companies building their flagship product. We have a list of some of those companies on our homepage, but just among chat apps, Slack, Discord, and Signal are built with Electron. Among AI applications, both OpenAI’s ChatGPT and Anthropic’s Claude use Electron. Visual Studio Code, Loom, Canva, Notion, Docker, and countless other leading developers of software bet on Electron.
 
 We did make it a priority to make Electron easy to work with and a delight for developers. That’s likely the main reason why Electron became as popular as it is today — but what keeps Electron alive and thriving is the maintainer’s focus on making Electron as stable, secure, performant, and capable of mission-critical use cases for end users as possible. We’re building an Electron that is ready to be used in scenarios where unfixable bugs, unpatched security holes, and outages of any kind are worst-case scenarios.
 

lib/browser/api/menu-item.ts

@@ -71,7 +71,7 @@ const MenuItem = function (this: any, options: any) {
   };
 };
 
-MenuItem.types = ['normal', 'separator', 'submenu', 'checkbox', 'radio'];
+MenuItem.types = ['normal', 'separator', 'submenu', 'checkbox', 'radio', 'header', 'palette'];
 
 MenuItem.prototype.getDefaultRoleAccelerator = function () {
   return roles.getDefaultAccelerator(this.role);

lib/browser/api/menu.ts

@@ -143,6 +143,9 @@ Menu.prototype.insert = function (pos, item) {
   if (item.toolTip) this.setToolTip(pos, item.toolTip);
   if (item.icon) this.setIcon(pos, item.icon);
   if (item.role) this.setRole(pos, item.role);
+  if (item.type === 'palette' || item.type === 'header') {
+    this.setCustomType(pos, item.type);
+  }
 
   // Make menu accessible to items.
   item.overrideReadOnlyProperty('menu', this);
@@ -264,9 +267,11 @@ function removeExtraSeparators (items: (MenuItemConstructorOptions | MenuItem)[]
 function insertItemByType (this: MenuType, item: MenuItem, pos: number) {
   const types = {
     normal: () => this.insertItem(pos, item.commandId, item.label),
+    header: () => this.insertItem(pos, item.commandId, item.label),
     checkbox: () => this.insertCheckItem(pos, item.commandId, item.label),
     separator: () => this.insertSeparator(pos),
     submenu: () => this.insertSubMenu(pos, item.commandId, item.label, item.submenu),
+    palette: () => this.insertSubMenu(pos, item.commandId, item.label, item.submenu),
     radio: () => {
       // Grouping radio menu items
       item.overrideReadOnlyProperty('groupId', generateGroupId(this.items, pos));

lib/node/asar-fs-wrapper.ts

@@ -54,6 +54,10 @@ const {
   getDirent
 } = __non_webpack_require__('internal/fs/utils');
 
+const {
+  assignFunctionName
+} = __non_webpack_require__('internal/util');
+
 const {
   validateBoolean,
   validateFunction
@@ -235,7 +239,10 @@ const overrideAPI = function (module: Record<string, any>, name: string, pathArg
   };
 
   if (old[util.promisify.custom]) {
-    module[name][util.promisify.custom] = makePromiseFunction(old[util.promisify.custom], pathArgumentIndex);
+    module[name][util.promisify.custom] = assignFunctionName(
+      name,
+      makePromiseFunction(old[util.promisify.custom], pathArgumentIndex)
+    );
   }
 
   if (module.promises && module.promises[name]) {
@@ -1238,7 +1245,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     // command as a single path to an archive.
     const { exec, execSync } = childProcess;
     childProcess.exec = invokeWithNoAsar(exec);
-    childProcess.exec[util.promisify.custom] = invokeWithNoAsar(exec[util.promisify.custom]);
+    childProcess.exec[util.promisify.custom] = assignFunctionName('exec', invokeWithNoAsar(exec[util.promisify.custom]));
     childProcess.execSync = invokeWithNoAsar(execSync);
 
     overrideAPI(childProcess, 'execFile');

package.json

@@ -18,7 +18,6 @@
     "@types/semver": "^7.5.8",
     "@types/stream-json": "^1.7.7",
     "@types/temp": "^0.9.4",
-    "@types/webpack": "^5.28.5",
     "@types/webpack-env": "^1.18.5",
     "@typescript-eslint/eslint-plugin": "^8.7.0",
     "@typescript-eslint/parser": "^8.7.0",
@@ -28,13 +27,12 @@
     "dugite": "^2.7.1",
     "eslint": "^8.57.1",
     "eslint-config-standard": "^17.1.0",
-    "eslint-plugin-import": "^2.30.0",
+    "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-mocha": "^10.5.0",
     "eslint-plugin-n": "^16.6.2",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-promise": "^6.6.0",
     "eslint-plugin-standard": "^5.0.0",
-    "eslint-plugin-unicorn": "^55.0.0",
     "events": "^3.2.0",
     "folder-hash": "^2.1.1",
     "got": "^11.8.5",

patches/chromium/.patches

@@ -109,7 +109,6 @@ fix_use_delegated_generic_capturer_when_available.patch
 expose_webblob_path_to_allow_embedders_to_get_file_paths.patch
 fix_move_autopipsettingshelper_behind_branding_buildflag.patch
 revert_remove_the_allowaggressivethrottlingwithwebsocket_feature.patch
-fix_activate_background_material_on_windows.patch
 feat_allow_passing_of_objecttemplate_to_objecttemplatebuilder.patch
 chore_remove_check_is_test_on_script_injection_tracker.patch
 fix_restore_original_resize_performance_on_macos.patch
@@ -138,7 +137,8 @@ ignore_parse_errors_for_resolveshortcutproperties.patch
 feat_add_signals_when_embedder_cleanup_callbacks_run_for.patch
 feat_separate_content_settings_callback_for_sync_and_async_clipboard.patch
 fix_win32_synchronous_spellcheck.patch
-fix_enable_wrap_iter_in_string_view_and_array.patch
 fix_linter_error.patch
 chore_grandfather_in_electron_views_and_delegates.patch
 refactor_patch_electron_permissiontypes_into_blink.patch
+fix_add_macos_memory_query_fallback_to_avoid_crash.patch
+fix_resolve_dynamic_background_material_update_issue_on_windows_11.patch

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -46,7 +46,7 @@ index 36fe07a692e9be5b99f9e59157b90963a6485f8b..d8cf68e953213f309537e74d954d8749
        # than here in :chrome_dll.
        deps += [ "//chrome:packed_resources_integrity_header" ]
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 0f493aeb49901e2917009b942f9b1e14e3fcf758..349079dc25f91fd426d523345ba66271c42ea084 100644
+index 6fba5b32b266455d308ac11e2711588b78092c33..5905f62c8b516483026ee95a3dea4cda5f1161b1 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
 @@ -7243,9 +7243,12 @@ test("unit_tests") {

patches/chromium/build_make_libcxx_abi_unstable_false_for_electron.patch

@@ -5,16 +5,20 @@ Subject: build: make libcxx_abi_unstable false for electron
 
 https://nornagon.medium.com/a-libc-odyssey-973e51649063
 
+See also https://github.com/electron/electron/issues/45810#issuecomment-2691417213.
+
 diff --git a/buildtools/third_party/libc++/__config_site b/buildtools/third_party/libc++/__config_site
-index 67075bd8b4d42e6e6d651cb0988d64eccb64cc23..e240ff6fff94a6cebf8662996712fe7eb22e5fff 100644
+index 67075bd8b4d42e6e6d651cb0988d64eccb64cc23..ddf1693002aa171b3d91aa4ef08f5b360e4adddc 100644
 --- a/buildtools/third_party/libc++/__config_site
 +++ b/buildtools/third_party/libc++/__config_site
-@@ -18,7 +18,7 @@
+@@ -18,7 +18,9 @@
  //    _LIBCPP_ABI_NAMESPACE to a shorter value.
  #define _LIBCPP_ABI_NAMESPACE __Cr
  
 -#define _LIBCPP_ABI_VERSION 2
 +#define _LIBCPP_ABI_VERSION 1
++#define _LIBCPP_ABI_USE_WRAP_ITER_IN_STD_ARRAY
++#define _LIBCPP_ABI_USE_WRAP_ITER_IN_STD_STRING_VIEW
  
  #define _LIBCPP_ABI_FORCE_ITANIUM 0
  #define _LIBCPP_ABI_FORCE_MICROSOFT 0

patches/chromium/custom_protocols_plzserviceworker.patch

@@ -8,10 +8,10 @@ Allow registering custom protocols to handle service worker main script fetching
 Refs https://bugs.chromium.org/p/chromium/issues/detail?id=996511
 
 diff --git a/content/browser/service_worker/service_worker_context_wrapper.cc b/content/browser/service_worker/service_worker_context_wrapper.cc
-index bc49553c298d548a3c09a5e65a44cac1a42e893e..fd11dbf8117cc173fd8bb268b391ddbb8ad36f49 100644
+index 8d92bd66121e43992a1e26f7d5860b803ec8c3cb..edbf15cdbc45918d5ec86220cfe8c5398fa1af2c 100644
 --- a/content/browser/service_worker/service_worker_context_wrapper.cc
 +++ b/content/browser/service_worker/service_worker_context_wrapper.cc
-@@ -1972,6 +1972,26 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
+@@ -1979,6 +1979,26 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
        loader_factory_bundle_info =
            context()->loader_factory_bundle_for_update_check()->Clone();
  
@@ -38,7 +38,7 @@ index bc49553c298d548a3c09a5e65a44cac1a42e893e..fd11dbf8117cc173fd8bb268b391ddbb
    if (auto* config = content::WebUIConfigMap::GetInstance().GetConfig(
            browser_context(), scope)) {
      // If this is a Service Worker for a WebUI, the WebUI's URLDataSource
-@@ -1991,9 +2011,7 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
+@@ -1998,9 +2018,7 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
              features::kEnableServiceWorkersForChromeScheme) &&
          scope.scheme_piece() == kChromeUIScheme) {
        config->RegisterURLDataSource(browser_context());
@@ -49,7 +49,7 @@ index bc49553c298d548a3c09a5e65a44cac1a42e893e..fd11dbf8117cc173fd8bb268b391ddbb
            .emplace(kChromeUIScheme, CreateWebUIServiceWorkerLoaderFactory(
                                          browser_context(), kChromeUIScheme,
                                          base::flat_set<std::string>()));
-@@ -2001,9 +2019,7 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
+@@ -2008,9 +2026,7 @@ ServiceWorkerContextWrapper::GetLoaderFactoryForBrowserInitiatedRequest(
                     features::kEnableServiceWorkersForChromeUntrusted) &&
                 scope.scheme_piece() == kChromeUIUntrustedScheme) {
        config->RegisterURLDataSource(browser_context());

patches/chromium/feat_add_streaming-protocol_registry_to_multibuffer_data_source.patch

@@ -12,8 +12,12 @@ This patch adds a list of "streaming protocols" to the MultibufferDataSource in
 other protocols to register their streaming behavior. MultibufferDataSource::AssumeFullyBuffered()
 then refers to the list so that it can correctly determine the data source's settings.
 
+This patch also reverts https://chromium-review.googlesource.com/c/chromium/src/+/6431846,
+which removed range-requests-supported on non-http protocols. See https://issues.chromium.org/issues/41161335
+for more information.
+
 diff --git a/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc b/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc
-index 3e010fbec46d799839a2c50ed14c1d5744e99a30..ed98c853ba013acb8908a1651742d510bc8e4475 100644
+index 3e010fbec46d799839a2c50ed14c1d5744e99a30..e691db48e0a88aef7ada167ca09e7495f5bada5a 100644
 --- a/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc
 +++ b/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc
 @@ -11,8 +11,10 @@
@@ -27,11 +31,23 @@ index 3e010fbec46d799839a2c50ed14c1d5744e99a30..ed98c853ba013acb8908a1651742d510
  #include "media/base/media_log.h"
  #include "net/base/net_errors.h"
  #include "third_party/blink/renderer/platform/media/buffered_data_source_host_impl.h"
-@@ -67,8 +69,20 @@ const int kUpdateBufferSizeFrequency = 32;
- // How long to we delay a seek after a read?
- constexpr base::TimeDelta kSeekDelay = base::Milliseconds(20);
+@@ -69,6 +71,10 @@ constexpr base::TimeDelta kSeekDelay = base::Milliseconds(20);
  
-+std::vector<std::string>* GetStreamingSchemes() {
+ }  // namespace
+ 
++void AddStreamingScheme(const char* new_scheme) {
++  MultiBufferDataSource::GetStreamingSchemes()->push_back(new_scheme);
++}
++
+ class MultiBufferDataSource::ReadOperation {
+  public:
+   ReadOperation() = delete;
+@@ -143,13 +149,29 @@ MultiBufferDataSource::~MultiBufferDataSource() {
+   DCHECK(render_task_runner_->BelongsToCurrentThread());
+ }
+ 
++// static
++std::vector<std::string>* MultiBufferDataSource::GetStreamingSchemes() {
 +  static base::NoDestructor<std::vector<std::string>> streaming_schemes({
 +    url::kHttpsScheme,
 +    url::kHttpScheme
@@ -39,16 +55,9 @@ index 3e010fbec46d799839a2c50ed14c1d5744e99a30..ed98c853ba013acb8908a1651742d510
 +  return streaming_schemes.get();
 +}
 +
- }  // namespace
- 
-+void AddStreamingScheme(const char* new_scheme) {
-+  GetStreamingSchemes()->push_back(new_scheme);
-+}
-+
- class MultiBufferDataSource::ReadOperation {
-  public:
-   ReadOperation() = delete;
-@@ -149,7 +163,14 @@ bool MultiBufferDataSource::media_has_played() const {
+ bool MultiBufferDataSource::media_has_played() const {
+   return media_has_played_;
+ }
  
  bool MultiBufferDataSource::AssumeFullyBuffered() const {
    DCHECK(url_data_);
@@ -65,7 +74,7 @@ index 3e010fbec46d799839a2c50ed14c1d5744e99a30..ed98c853ba013acb8908a1651742d510
  
  void MultiBufferDataSource::SetReader(
 diff --git a/third_party/blink/renderer/platform/media/multi_buffer_data_source.h b/third_party/blink/renderer/platform/media/multi_buffer_data_source.h
-index e886847425b1ea0b620a60e7b477249efac3c689..92dea7a9f491bb548f68d918ebde60cbf2a7d67f 100644
+index e886847425b1ea0b620a60e7b477249efac3c689..249416683c5381d4263f5f59202ca1687adf4407 100644
 --- a/third_party/blink/renderer/platform/media/multi_buffer_data_source.h
 +++ b/third_party/blink/renderer/platform/media/multi_buffer_data_source.h
 @@ -17,6 +17,7 @@
@@ -85,3 +94,49 @@ index e886847425b1ea0b620a60e7b477249efac3c689..92dea7a9f491bb548f68d918ebde60cb
  // A data source capable of loading URLs and buffering the data using an
  // in-memory sliding window.
  //
+@@ -65,6 +68,8 @@ class PLATFORM_EXPORT MultiBufferDataSource
+     return url_data_->mime_type();
+   }
+ 
++  static std::vector<std::string>* GetStreamingSchemes();
++
+   // Method called on the render thread.
+   using InitializeCB = base::OnceCallback<void(bool)>;
+   void Initialize(InitializeCB init_cb) override;
+diff --git a/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc b/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc
+index 34cee8e0f399468ae23a2ab4108bd65a6f12395c..be35c71dc0c7e0ae85c3f42f0b93375c09e43ddb 100644
+--- a/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc
++++ b/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc
+@@ -8,6 +8,7 @@
+ #include <stddef.h>
+ 
+ #include <utility>
++#include <algorithm>
+ 
+ #include "base/containers/contains.h"
+ #include "base/location.h"
+@@ -27,6 +28,7 @@
+ #include "third_party/blink/public/platform/web_url_response.h"
+ #include "third_party/blink/public/web/web_associated_url_loader.h"
+ #include "third_party/blink/renderer/platform/media/cache_util.h"
++#include "third_party/blink/renderer/platform/media/multi_buffer_data_source.h"
+ #include "third_party/blink/renderer/platform/media/resource_fetch_context.h"
+ #include "third_party/blink/renderer/platform/media/url_index.h"
+ #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
+@@ -320,6 +322,16 @@ void ResourceMultiBufferDataProvider::DidReceiveResponse(
+       do_fail = true;
+     }
+   } else {
++    // For non-HTTP protocols, only set range_supported for registered streaming schemes
++    const std::string scheme = destination_url_data->url().Protocol().Ascii();
++
++    if (std::ranges::any_of(*MultiBufferDataSource::GetStreamingSchemes(),
++                         [&scheme](const std::string& streaming_scheme) {
++                           return base::EqualsCaseInsensitiveASCII(scheme, streaming_scheme);
++                         })) {
++      destination_url_data->set_range_supported();
++    }
++
+     if (content_length != kPositionNotSpecified) {
+       destination_url_data->set_length(content_length + byte_pos());
+     }

patches/chromium/feat_corner_smoothing_css_rule_and_blink_painting.patch

@@ -16,64 +16,9 @@ making three primary changes to Blink:
     * Modifies graphics to handle smooth `ContouredRect`s, delegating to
       `//electron/shell/renderer/electron_smooth_round_rect`.
 
-3. Adds a renderer preference / web setting:
+3. Adds a renderer feature:
     * Controls whether the CSS rule is available.
-    * Mostly simple "plumbing" for the setting through blink.
 
-diff --git a/third_party/blink/common/renderer_preferences/renderer_preferences_mojom_traits.cc b/third_party/blink/common/renderer_preferences/renderer_preferences_mojom_traits.cc
-index c13dfd7f20e6f281f51ae373ceebeb86104c5cd9..fac89df9f23f3f098096d2a07a07e623b1067270 100644
---- a/third_party/blink/common/renderer_preferences/renderer_preferences_mojom_traits.cc
-+++ b/third_party/blink/common/renderer_preferences/renderer_preferences_mojom_traits.cc
-@@ -128,6 +128,8 @@ bool StructTraits<blink::mojom::RendererPreferencesDataView,
-     return false;
-   }
- 
-+  out->electron_corner_smoothing_css = data.electron_corner_smoothing_css();
-+
-   out->canvas_noise_token = data.canvas_noise_token();
- 
-   out->view_source_line_wrap_enabled = data.view_source_line_wrap_enabled();
-diff --git a/third_party/blink/public/common/renderer_preferences/renderer_preferences.h b/third_party/blink/public/common/renderer_preferences/renderer_preferences.h
-index 75acd696a5258e52f5c17b88559dfb3f6373c669..34b5ed725702dca72c383c1def08fdb835f7fa6b 100644
---- a/third_party/blink/public/common/renderer_preferences/renderer_preferences.h
-+++ b/third_party/blink/public/common/renderer_preferences/renderer_preferences.h
-@@ -91,6 +91,7 @@ struct BLINK_COMMON_EXPORT RendererPreferences {
-   bool caret_browsing_enabled{false};
-   bool uses_platform_autofill{false};
-   std::vector<uint16_t> explicitly_allowed_network_ports;
-+  bool electron_corner_smoothing_css{true};
-   uint64_t canvas_noise_token{0};
-   // The default value must be false to avoid performance problems on very large
-   // source pages.
-diff --git a/third_party/blink/public/common/renderer_preferences/renderer_preferences_mojom_traits.h b/third_party/blink/public/common/renderer_preferences/renderer_preferences_mojom_traits.h
-index defe40d7091cb4ba4b099a22aeaee71f78ff5e77..e8326fa7a3c45c08c7d9250edd52a6d73fcc3ff9 100644
---- a/third_party/blink/public/common/renderer_preferences/renderer_preferences_mojom_traits.h
-+++ b/third_party/blink/public/common/renderer_preferences/renderer_preferences_mojom_traits.h
-@@ -275,6 +275,11 @@ struct BLINK_COMMON_EXPORT
-     return data.explicitly_allowed_network_ports;
-   }
- 
-+  static const bool& electron_corner_smoothing_css(
-+      const ::blink::RendererPreferences& data) {
-+    return data.electron_corner_smoothing_css;
-+  }
-+
-   static const uint64_t& canvas_noise_token(
-       const ::blink::RendererPreferences& data) {
-     return data.canvas_noise_token;
-diff --git a/third_party/blink/public/mojom/renderer_preferences.mojom b/third_party/blink/public/mojom/renderer_preferences.mojom
-index f8361faf6151210d65a597562c533aaa0a5235df..328238c34a9381fbbeb5970af3de721c8412104e 100644
---- a/third_party/blink/public/mojom/renderer_preferences.mojom
-+++ b/third_party/blink/public/mojom/renderer_preferences.mojom
-@@ -202,6 +202,8 @@ struct RendererPreferences {
- 
-   array<uint16> explicitly_allowed_network_ports;
- 
-+  bool electron_corner_smoothing_css;
-+
-   // A randomized 64 bit token that is generated per browser session,
-   // used for canvas noising.
-   uint64 canvas_noise_token = 0;
 diff --git a/third_party/blink/public/mojom/use_counter/metrics/css_property_id.mojom b/third_party/blink/public/mojom/use_counter/metrics/css_property_id.mojom
 index a96527c653d2108de572d1e94c3ce703b45f2830..f8eb2af2c97f888307f2be588c336d4209f6cb3e 100644
 --- a/third_party/blink/public/mojom/use_counter/metrics/css_property_id.mojom
@@ -86,18 +31,6 @@ index a96527c653d2108de572d1e94c3ce703b45f2830..f8eb2af2c97f888307f2be588c336d42
  
      // This CSSSampleId represents page load for CSS histograms. It is recorded once
      // per page visit for each CSS histogram being logged on the blink side and the
-diff --git a/third_party/blink/public/web/web_settings.h b/third_party/blink/public/web/web_settings.h
-index c37f784a1309da14354881d48a5a76a965930926..bffd221d2b3f3701710025103fa564c233e203d1 100644
---- a/third_party/blink/public/web/web_settings.h
-+++ b/third_party/blink/public/web/web_settings.h
-@@ -287,6 +287,7 @@ class WebSettings {
-   virtual void SetRequireTransientActivationAndAuthorizationForSubAppsAPIs(
-       bool) = 0;
-   virtual void SetRootScrollbarThemeColor(std::optional<SkColor>) = 0;
-+  virtual void SetCornerSmoothingCSS(bool) = 0;
- 
-  protected:
-   ~WebSettings() = default;
 diff --git a/third_party/blink/renderer/build/scripts/core/css/css_properties.py b/third_party/blink/renderer/build/scripts/core/css/css_properties.py
 index 6e991652d242795e292cea4c94cff59aaea078fa..b6834c78575520bb6e584dd2ce3333ac17299fef 100755
 --- a/third_party/blink/renderer/build/scripts/core/css/css_properties.py
@@ -112,16 +45,17 @@ index 6e991652d242795e292cea4c94cff59aaea078fa..b6834c78575520bb6e584dd2ce3333ac
                      'internal-forced-visited-'):
                  internal_visited_order = 0
 diff --git a/third_party/blink/renderer/core/css/css_properties.json5 b/third_party/blink/renderer/core/css/css_properties.json5
-index 5619eae5a36f63627df605eeff049866ea846477..50bad85a916e5bb097d687cbc4d1721ecefa6c39 100644
+index 5619eae5a36f63627df605eeff049866ea846477..2fe353e68972493ac99d0d040902e25f0c6499fb 100644
 --- a/third_party/blink/renderer/core/css/css_properties.json5
 +++ b/third_party/blink/renderer/core/css/css_properties.json5
-@@ -8866,6 +8866,24 @@
+@@ -8866,6 +8866,26 @@
        property_methods: ["ParseShorthand", "CSSValueFromComputedStyleInternal"],
      },
  
 +    {
 +      name: "-electron-corner-smoothing",
-+      property_methods: ["ParseSingleValue"],
++      property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
++      interpolable: true,
 +      field_group: "*",
 +      field_template: "external",
 +      // To keep this patch small, Length is used instead of a more descriptive
@@ -129,12 +63,13 @@ index 5619eae5a36f63627df605eeff049866ea846477..50bad85a916e5bb097d687cbc4d1721e
 +      // - `system-ui` = `Length::Auto()`
 +      // - percent     = `Length::Percent`
 +      type_name: "Length",
-+      converter: "ConvertCornerSmoothing",
-+      keywords: ["system-ui"],
 +      default_value: "Length::None()",
-+      typedom_types: ["Keyword", "Percentage"],
-+      is_border_radius: true,
-+      invalidate: ["paint", "border-radius", "clip"],
++      keywords: ["system-ui"],
++      converter: "ConvertCornerSmoothing",
++      runtime_flag: "ElectronCSSCornerSmoothing",
++      valid_for_permission_element: true,
++      valid_for_page_context: true,
++      invalidate: ["border-radius", "paint", "corner-shape"],
 +    },
 +
      // Visited properties.
@@ -154,10 +89,10 @@ index 9ec4976d64834bd4c09f3740edcd28334dd4ec50..e47da0a85670e800e74da957d6441d70
        return a.EmptyCells() == b.EmptyCells();
      case CSSPropertyID::kFill:
 diff --git a/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc
-index e519e13fea11950cc619e384f774b61a6e2385c0..8289ca0a41da1532692673a3e426e8688d93b32e 100644
+index e519e13fea11950cc619e384f774b61a6e2385c0..04746566454401402c21f6381a7a7f0f4652ae4b 100644
 --- a/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc
 +++ b/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc
-@@ -12175,5 +12175,25 @@ const CSSValue* InternalEmptyLineHeight::ParseSingleValue(
+@@ -12175,5 +12175,36 @@ const CSSValue* InternalEmptyLineHeight::ParseSingleValue(
                                           CSSValueID::kNone>(stream);
  }
  
@@ -165,12 +100,6 @@ index e519e13fea11950cc619e384f774b61a6e2385c0..8289ca0a41da1532692673a3e426e868
 +    CSSParserTokenStream& stream,
 +    const CSSParserContext& context,
 +    const CSSParserLocalContext&) const {
-+  // Fail parsing if this rule is disabled by document settings.
-+  if (Settings* settings = context.GetDocument()->GetSettings();
-+      settings && !settings->GetElectronCornerSmoothingCSS()) {
-+    return nullptr;
-+  }
-+
 +  // Try to parse `system-ui` keyword first.
 +  if (auto* ident =
 +          css_parsing_utils::ConsumeIdent<CSSValueID::kSystemUi>(stream)) {
@@ -180,18 +109,36 @@ index e519e13fea11950cc619e384f774b61a6e2385c0..8289ca0a41da1532692673a3e426e868
 +  return css_parsing_utils::ConsumePercent(
 +      stream, context, CSSPrimitiveValue::ValueRange::kNonNegative);
 +}
++
++const CSSValue* ElectronCornerSmoothing::CSSValueFromComputedStyleInternal(
++    const ComputedStyle& style,
++    const LayoutObject*,
++    bool allow_visited_style,
++    CSSValuePhase value_phase) const {
++  const Length& length = style.ElectronCornerSmoothing();
++  switch (length.GetType()) {
++    case Length::kAuto:
++      return CSSIdentifierValue::Create(CSSValueID::kSystemUi);
++    case Length::kPercent:
++      return CSSNumericLiteralValue::Create(
++          length.Percent(), CSSPrimitiveValue::UnitType::kPercentage);
++    default:
++      return CSSIdentifierValue::Create(CSSValueID::kNone);
++  }
++}
 +
  }  // namespace css_longhand
  }  // namespace blink
 diff --git a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
-index 5618121a0b5621290a19f147bfbe9bf316fb3f27..bb1bd90371ce847d48ff9a228b098a26d28f5c6d 100644
+index 501ef6ba6203fc2661ab36825c4a1b4eee172841..1314bfc4c368be031200fc1555a4db51d27491a7 100644
 --- a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
 +++ b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
-@@ -3962,4 +3962,12 @@ FitText StyleBuilderConverter::ConvertFitText(StyleResolverState& state,
-   return FitText(target, method, size_limit);
+@@ -3920,6 +3920,15 @@ PositionArea StyleBuilderConverter::ConvertPositionArea(
+   return PositionArea(span[0], span[1], span[2], span[3]);
  }
  
-+Length StyleBuilderConverter::ConvertCornerSmoothing(StyleResolverState& state, const CSSValue& value) {
++Length StyleBuilderConverter::ConvertCornerSmoothing(StyleResolverState& state,
++                                                     const CSSValue& value) {
 +  auto* ident = DynamicTo<CSSIdentifierValue>(value);
 +  if (ident && ident->GetValueID() == CSSValueID::kSystemUi) {
 +    return Length::Auto();
@@ -199,74 +146,21 @@ index 5618121a0b5621290a19f147bfbe9bf316fb3f27..bb1bd90371ce847d48ff9a228b098a26
 +  return ConvertLength(state, value);
 +}
 +
- }  // namespace blink
+ FitText StyleBuilderConverter::ConvertFitText(StyleResolverState& state,
+                                               const CSSValue& value) {
+   const auto& list = To<CSSValueList>(value);
 diff --git a/third_party/blink/renderer/core/css/resolver/style_builder_converter.h b/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
-index 7104b5866a9bac0cdd26518eddcf80322280ad92..692b186f302130155fbb1b163bb195c0253276af 100644
+index 141de7c9f9d630125cf37be73347a05a6a475aba..b07129478590b6aad6f054be09c22f8f48c60920 100644
 --- a/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
 +++ b/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
-@@ -422,6 +422,8 @@ class StyleBuilderConverter {
+@@ -421,6 +421,7 @@ class StyleBuilderConverter {
+                                                  const CSSValue&);
  
    static PositionArea ConvertPositionArea(StyleResolverState&, const CSSValue&);
-   static FitText ConvertFitText(StyleResolverState&, const CSSValue&);
-+
 +  static Length ConvertCornerSmoothing(StyleResolverState&, const CSSValue&);
+   static FitText ConvertFitText(StyleResolverState&, const CSSValue&);
  };
  
- template <typename T>
-diff --git a/third_party/blink/renderer/core/exported/web_settings_impl.cc b/third_party/blink/renderer/core/exported/web_settings_impl.cc
-index 90692da7bddd9e26e58cb26d8b29dbddf958fbca..6bcd9d736edab85572e405ab74d57adc0fcce921 100644
---- a/third_party/blink/renderer/core/exported/web_settings_impl.cc
-+++ b/third_party/blink/renderer/core/exported/web_settings_impl.cc
-@@ -820,4 +820,8 @@ void WebSettingsImpl::SetRootScrollbarThemeColor(
-   settings_->SetRootScrollbarThemeColor(theme_color);
- }
- 
-+void WebSettingsImpl::SetCornerSmoothingCSS(bool available) {
-+  settings_->SetElectronCornerSmoothingCSS(available);
-+}
-+
- }  // namespace blink
-diff --git a/third_party/blink/renderer/core/exported/web_settings_impl.h b/third_party/blink/renderer/core/exported/web_settings_impl.h
-index aa8b248b94ea7f6c0e04dc66e976dc7923ff3a98..868630ed2adb8f40fb7f002d45b260c0881ef10f 100644
---- a/third_party/blink/renderer/core/exported/web_settings_impl.h
-+++ b/third_party/blink/renderer/core/exported/web_settings_impl.h
-@@ -238,6 +238,7 @@ class CORE_EXPORT WebSettingsImpl final : public WebSettings {
-   void SetRequireTransientActivationAndAuthorizationForSubAppsAPIs(
-       bool) override;
-   void SetRootScrollbarThemeColor(std::optional<SkColor>) override;
-+  void SetCornerSmoothingCSS(bool) override;
- 
-   bool RenderVSyncNotificationEnabled() const {
-     return render_v_sync_notification_enabled_;
-diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index f8fae134e122a223440530bd696db899dce2fe56..cec68a428fbf63932066ceb296c3db3eb9e34166 100644
---- a/third_party/blink/renderer/core/exported/web_view_impl.cc
-+++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
-@@ -3579,6 +3579,9 @@ void WebViewImpl::UpdateRendererPreferences(
-       renderer_preferences_.view_source_line_wrap_enabled);
- 
-   MaybePreloadSystemFonts(GetPage());
-+
-+  GetSettings()->SetCornerSmoothingCSS(
-+      renderer_preferences_.electron_corner_smoothing_css);
- }
- 
- void WebViewImpl::SetHistoryIndexAndLength(int32_t history_index,
-diff --git a/third_party/blink/renderer/core/frame/settings.json5 b/third_party/blink/renderer/core/frame/settings.json5
-index c96100f7d26c14b8be1329cdb4d8a007b14d9c00..8b2429d5ac958f9a2c7aae546b44da903def8e69 100644
---- a/third_party/blink/renderer/core/frame/settings.json5
-+++ b/third_party/blink/renderer/core/frame/settings.json5
-@@ -1265,5 +1265,10 @@
-       initial: false,
-       type: "bool"
-     },
-+    {
-+      name: "electronCornerSmoothingCSS",
-+      initial: true,
-+      invalidate: ["Style"],
-+    },
-   ],
- }
 diff --git a/third_party/blink/renderer/core/paint/contoured_border_geometry.cc b/third_party/blink/renderer/core/paint/contoured_border_geometry.cc
 index 2c2f4f405074e5baa4a26f255283404f86b40e21..ebeb7d6988ee9e6a4e78cb82fc01fdad6721eaef 100644
 --- a/third_party/blink/renderer/core/paint/contoured_border_geometry.cc
@@ -307,7 +201,7 @@ index 2c2f4f405074e5baa4a26f255283404f86b40e21..ebeb7d6988ee9e6a4e78cb82fc01fdad
  
  ContouredRect PixelSnappedContouredBorderInternal(
 diff --git a/third_party/blink/renderer/platform/BUILD.gn b/third_party/blink/renderer/platform/BUILD.gn
-index e8db5553065fd9a8ea03ec9d6cee136a8ea666dc..05eafec9e86846469e1877fe2a84b75a0dfe23ee 100644
+index 0b166b8dc52c87d41d4e0a9c7be04d10ef67ca97..67b634759de01995a99a2bb89eb20ad7e6651b42 100644
 --- a/third_party/blink/renderer/platform/BUILD.gn
 +++ b/third_party/blink/renderer/platform/BUILD.gn
 @@ -1652,6 +1652,8 @@ component("platform") {
@@ -373,7 +267,7 @@ index 0dbfffdfbea2cb75f7f3ea94ead20cc8bbe08bb3..021b9cdebb023941e7a78afbc1c3c939
  
    // A Corner is a axis-aligned quad, with the points ordered (start, outer,
 diff --git a/third_party/blink/renderer/platform/geometry/path_builder.cc b/third_party/blink/renderer/platform/geometry/path_builder.cc
-index 171cb3dd87609f5ecab79a25fe0978cd6e4b04f4..7e7deae45bfb66c3a3702f30092a23fb5b79bf4b 100644
+index 171cb3dd87609f5ecab79a25fe0978cd6e4b04f4..e454999a4ef64156a86cc8e15c11616e563e2489 100644
 --- a/third_party/blink/renderer/platform/geometry/path_builder.cc
 +++ b/third_party/blink/renderer/platform/geometry/path_builder.cc
 @@ -4,6 +4,7 @@
@@ -384,7 +278,7 @@ index 171cb3dd87609f5ecab79a25fe0978cd6e4b04f4..7e7deae45bfb66c3a3702f30092a23fb
  #include "third_party/blink/renderer/platform/geometry/contoured_rect.h"
  #include "third_party/blink/renderer/platform/geometry/infinite_int_rect.h"
  #include "third_party/blink/renderer/platform/geometry/path.h"
-@@ -247,6 +248,26 @@ PathBuilder& PathBuilder::AddContouredRect(
+@@ -247,6 +248,32 @@ PathBuilder& PathBuilder::AddContouredRect(
      AddRoundedRect(target_rect);
      return *this;
    }
@@ -400,10 +294,16 @@ index 171cb3dd87609f5ecab79a25fe0978cd6e4b04f4..7e7deae45bfb66c3a3702f30092a23fb
 +    float smoothness = std::clamp(
 +        contoured_rect.GetCornerCurvature().Smoothness(), 0.0f, 1.0f);
 +
++    // Since the Electron implementation of DrawSmoothRoundRect uses one radius
++    // for both dimensions, we need to use the minimum of the two supplied.
++    auto min_radius = [](const gfx::SizeF& radius) -> float {
++      return std::min(radius.width(), radius.height());
++    };
++
 +    builder_.addPath(electron::DrawSmoothRoundRect(
 +        box.x(), box.y(), box.width(), box.height(), smoothness,
-+        radii.TopLeft().width(), radii.TopRight().width(),
-+        radii.BottomRight().width(), radii.BottomLeft().width()));
++        min_radius(radii.TopLeft()), min_radius(radii.TopRight()),
++        min_radius(radii.BottomRight()), min_radius(radii.BottomLeft())));
 +
 +    return *this;
 +  }
@@ -411,3 +311,18 @@ index 171cb3dd87609f5ecab79a25fe0978cd6e4b04f4..7e7deae45bfb66c3a3702f30092a23fb
    const FloatRoundedRect& origin_rect = contoured_rect.GetOriginRect();
  
    // This would include the outer border of the rect, as well as shadow and
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+index 7b24b556fcfc16ccb67e28e2d8a0753355d07497..ceb5c8e46515a9a8345c0feee801708bfca71310 100644
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
++++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -214,6 +214,10 @@
+   },
+ 
+   data: [
++    {
++      name: "ElectronCSSCornerSmoothing",
++      status: "stable",
++    },
+     {
+       name: "Accelerated2dCanvas",
+       settable_from_internals: true,

patches/chromium/feat_expose_raw_response_headers_from_urlloader.patch

@@ -49,7 +49,7 @@ index df29c7cb739a488684c0c50bc5343df101911a31..86b5576c9c10e5544347117e4f6b09d7
      mojo::PendingRemote<mojom::TrustTokenAccessObserver> trust_token_observer;
      mojo::PendingRemote<mojom::URLLoaderNetworkServiceObserver>
 diff --git a/services/network/public/cpp/url_request_mojom_traits.cc b/services/network/public/cpp/url_request_mojom_traits.cc
-index 1fbe54bda8198423b42cb5eba291d7346a76873c..71b58ec4e11317a4da1c89d9407ab439ff1629c3 100644
+index 088517d1a9800de0d09c745bbe1ef2fe416c3425..2303ede53f1ee7a827befec560069d97601c2b80 100644
 --- a/services/network/public/cpp/url_request_mojom_traits.cc
 +++ b/services/network/public/cpp/url_request_mojom_traits.cc
 @@ -50,6 +50,7 @@ bool StructTraits<network::mojom::TrustedUrlRequestParamsDataView,
@@ -61,7 +61,7 @@ index 1fbe54bda8198423b42cb5eba291d7346a76873c..71b58ec4e11317a4da1c89d9407ab439
        mojo::PendingRemote<network::mojom::CookieAccessObserver>>();
    out->trust_token_observer = data.TakeTrustTokenObserver<
 diff --git a/services/network/public/cpp/url_request_mojom_traits.h b/services/network/public/cpp/url_request_mojom_traits.h
-index 1d6f7cb0347c2d1156052f43b82f22130c4750aa..ef6625a9148107772f94d2f62478914fc84d6b89 100644
+index 45defbfca47574ed002052a2ba2b1517a3ea89f4..a4f7a0cc7346b2e413cec1f56ec1d0484f94ed34 100644
 --- a/services/network/public/cpp/url_request_mojom_traits.h
 +++ b/services/network/public/cpp/url_request_mojom_traits.h
 @@ -72,6 +72,10 @@ struct COMPONENT_EXPORT(NETWORK_CPP_BASE)

patches/chromium/fix_activate_background_material_on_windows.patch

@@ -1,68 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: clavin <clavin@electronjs.org>
-Date: Mon, 11 Dec 2023 20:43:34 -0300
-Subject: fix: activate background material on windows
-
-This patch adds a condition to the HWND message handler to allow windows
-with translucent background materials to become activated.
-
-It also ensures the lParam of WM_NCACTIVATE is set to -1 so as to not repaint
-the client area, which can lead to a title bar incorrectly being displayed in
-frameless windows.
-
-This patch likely can't be upstreamed as-is, as Chromium doesn't have
-this use case in mind currently.
-
-diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
-index 1a10bd1a6c527633f97d6eee6525b1e45a3fcd3d..2b983ae3ec3e1d17951add818c2610582d586377 100644
---- a/ui/views/win/hwnd_message_handler.cc
-+++ b/ui/views/win/hwnd_message_handler.cc
-@@ -937,13 +937,13 @@ void HWNDMessageHandler::FrameTypeChanged() {
- 
- void HWNDMessageHandler::PaintAsActiveChanged() {
-   if (!delegate_->HasNonClientView() || !delegate_->CanActivate() ||
--      !delegate_->HasFrame() ||
-+      (!delegate_->HasFrame() && !is_translucent_) ||
-       (delegate_->GetFrameMode() == FrameMode::CUSTOM_DRAWN)) {
-     return;
-   }
- 
-   DefWindowProcWithRedrawLock(WM_NCACTIVATE, delegate_->ShouldPaintAsActive(),
--                              0);
-+                              delegate_->HasFrame() ? 0 : -1);
- }
- 
- void HWNDMessageHandler::SetWindowIcons(const gfx::ImageSkia& window_icon,
-@@ -1732,7 +1732,7 @@ void HWNDMessageHandler::OnActivateApp(BOOL active, DWORD thread_id) {
-   if (delegate_->HasNonClientView() && !active &&
-       thread_id != GetCurrentThreadId()) {
-     // Update the native frame if it is rendering the non-client area.
--    if (HasSystemFrame()) {
-+    if (is_translucent_ || HasSystemFrame()) {
-       DefWindowProcWithRedrawLock(WM_NCACTIVATE, FALSE, 0);
-     }
-   }
-@@ -2340,17 +2340,18 @@ LRESULT HWNDMessageHandler::OnNCActivate(UINT message,
-     delegate_->SchedulePaint();
-   }
- 
--  // Calling DefWindowProc is only necessary if there's a system frame being
--  // drawn. Otherwise it can draw an incorrect title bar and cause visual
--  // corruption.
--  if (!delegate_->HasFrame() ||
-+  // If the window is translucent, it may have the Mica background.
-+  // In that case, it's necessary to call |DefWindowProc|, but we can
-+  // pass -1 in the lParam to prevent any non-client area elements from
-+  // being displayed.
-+  if ((!delegate_->HasFrame() && !is_translucent_) ||
-       delegate_->GetFrameMode() == FrameMode::CUSTOM_DRAWN) {
-     SetMsgHandled(TRUE);
-     return TRUE;
-   }
- 
-   return DefWindowProcWithRedrawLock(WM_NCACTIVATE, paint_as_active || active,
--                                     0);
-+                                     delegate_->HasFrame() ? 0 : -1);
- }
- 
- LRESULT HWNDMessageHandler::OnNCCalcSize(BOOL mode, LPARAM l_param) {

patches/chromium/fix_add_macos_memory_query_fallback_to_avoid_crash.patch

@@ -0,0 +1,61 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Calvin Watford <watfordcalvin@gmail.com>
+Date: Tue, 15 Jul 2025 21:06:52 -0600
+Subject: fix: add macos memory query fallback to avoid crash
+
+In https://crrev.com/c/6274964 the implementation for querying the physical memory on macOS was changed to use a sysctl call. In that same change the sysctl call was added to the sanbox allowlist.
+
+This causes a problematic behavior: if an app that's running the old implementation (no sandbox exclusion for that sysctl call) gets swapped with the new implementation (uses new sysctl call) while it's running, then new child processes will trigger a sandbox permission error when calling the new method.
+
+While this "hot-swapping" behavior isn't supported, many enterprise update scripts may do this anyways, triggering an unfortunate user experience where child processes can never spawn but the browser process continues to live and terminate them (untl the app is restarted).
+
+This patch should be removed after the new implementation has been present since the beginning of a stable release. The new implementation was released with Electron 37.0.0, but this fallback was not added until after 37.2.2. That means 38.0.0 would be the first safe release to remove this fallback, giving developers a 1-major-version buffer to safely transition implementations.
+
+diff --git a/base/system/sys_info_apple.mm b/base/system/sys_info_apple.mm
+index 02670cbc829a1d8c540c6e0a4bce2f81177eab18..e58f70100b96ff83af4388900946db9962c2a254 100644
+--- a/base/system/sys_info_apple.mm
++++ b/base/system/sys_info_apple.mm
+@@ -6,11 +6,31 @@
+ 
+ #include <sys/sysctl.h>
+ 
++#include "base/apple/scoped_mach_port.h"
+ #include "base/strings/stringprintf.h"
+ #include "base/system/sys_info_internal.h"
+ 
+ namespace base {
+ 
++namespace {
++
++// Implementation of AmountOfPhysicalMemoryImpl before https://crrev.com/c/6274964.
++// See Electron patch adding this fallback for more details.
++uint64_t AmountOfPhysicalMemoryFallback() {
++  struct host_basic_info hostinfo;
++  mach_msg_type_number_t count = HOST_BASIC_INFO_COUNT;
++  base::apple::ScopedMachSendRight host(mach_host_self());
++  int result = host_info(host.get(), HOST_BASIC_INFO,
++                         reinterpret_cast<host_info_t>(&hostinfo), &count);
++  if (result != KERN_SUCCESS) {
++    NOTREACHED();
++  }
++  DCHECK_EQ(HOST_BASIC_INFO_COUNT, count);
++  return hostinfo.max_mem;
++}
++
++}
++
+ namespace internal {
+ 
+ // Queries sysctlbyname() for the given key and returns the 32 bit integer value
+@@ -54,7 +74,10 @@
+   uint64_t physical_memory;
+   size_t size = sizeof(physical_memory);
+   int rv = sysctlbyname("hw.memsize", &physical_memory, &size, nullptr, 0);
+-  PCHECK(rv == 0) << "sysctlbyname(\"hw.memsize\")";
++  // Instead of crashing, fallback to the old implementation.
++  if (rv != 0) {
++    return AmountOfPhysicalMemoryFallback();
++  }
+   return physical_memory;
+ }
+ 

patches/chromium/fix_enable_wrap_iter_in_string_view_and_array.patch

@@ -1,22 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: deepak1556 <hop2deep@gmail.com>
-Date: Sat, 1 Mar 2025 05:11:41 +0900
-Subject: fix: enable __wrap_iter in string_view and array
-
-Refs https://github.com/electron/electron/issues/45810#issuecomment-2691417213
-
-Patch can be removed when build_make_libcxx_abi_unstable_false_for_electron.patch is removed.
-
-diff --git a/buildtools/third_party/libc++/__config_site b/buildtools/third_party/libc++/__config_site
-index e240ff6fff94a6cebf8662996712fe7eb22e5fff..ddf1693002aa171b3d91aa4ef08f5b360e4adddc 100644
---- a/buildtools/third_party/libc++/__config_site
-+++ b/buildtools/third_party/libc++/__config_site
-@@ -19,6 +19,8 @@
- #define _LIBCPP_ABI_NAMESPACE __Cr
- 
- #define _LIBCPP_ABI_VERSION 1
-+#define _LIBCPP_ABI_USE_WRAP_ITER_IN_STD_ARRAY
-+#define _LIBCPP_ABI_USE_WRAP_ITER_IN_STD_STRING_VIEW
- 
- #define _LIBCPP_ABI_FORCE_ITANIUM 0
- #define _LIBCPP_ABI_FORCE_MICROSOFT 0

patches/chromium/fix_resolve_dynamic_background_material_update_issue_on_windows_11.patch

@@ -0,0 +1,115 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: zoy <zoy-l@outlook.com>
+Date: Mon, 5 May 2025 23:28:53 +0800
+Subject: fix: resolve dynamic background material update issue on Windows 11
+
+This patch addresses issues with background materials on Windows 11,
+such as the background turning black when maximizing the window and
+dynamic background material settings not taking effect.
+
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+index a415140b94e467adfbc3dbbaa026e897a0f66c06..41470fd55bf2053eb6d523bda3b544f448bfb094 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+@@ -176,6 +176,10 @@ void DesktopWindowTreeHostWin::FinishTouchDrag(gfx::Point screen_point) {
+   }
+ }
+ 
++void DesktopWindowTreeHostWin::SetIsTranslucent(bool is_translucent) {
++  message_handler_->set_is_translucent(is_translucent);
++}
++
+ // DesktopWindowTreeHostWin, DesktopWindowTreeHost implementation:
+ 
+ void DesktopWindowTreeHostWin::Init(const Widget::InitParams& params) {
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
+index b85d1cdec49b10628d2f3d3d2e07513beb830456..232b5121fc2b138c91559d740c5178f0562df66b 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
+@@ -94,6 +94,8 @@ class VIEWS_EXPORT DesktopWindowTreeHostWin
+   // false.
+   void FinishTouchDrag(gfx::Point screen_point);
+ 
++  void SetIsTranslucent(bool is_translucent);
++
+  protected:
+   // Overridden from DesktopWindowTreeHost:
+   void Init(const Widget::InitParams& params) override;
+diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
+index 1a10bd1a6c527633f97d6eee6525b1e45a3fcd3d..7de4e205fede08d6e0d38ec4aa72c4fa47ac6d9e 100644
+--- a/ui/views/win/hwnd_message_handler.cc
++++ b/ui/views/win/hwnd_message_handler.cc
+@@ -937,13 +937,13 @@ void HWNDMessageHandler::FrameTypeChanged() {
+ 
+ void HWNDMessageHandler::PaintAsActiveChanged() {
+   if (!delegate_->HasNonClientView() || !delegate_->CanActivate() ||
+-      !delegate_->HasFrame() ||
++      (!delegate_->HasFrame() && !is_translucent_) ||
+       (delegate_->GetFrameMode() == FrameMode::CUSTOM_DRAWN)) {
+     return;
+   }
+ 
+   DefWindowProcWithRedrawLock(WM_NCACTIVATE, delegate_->ShouldPaintAsActive(),
+-                              0);
++                              delegate_->HasFrame() ? 0 : -1);
+ }
+ 
+ void HWNDMessageHandler::SetWindowIcons(const gfx::ImageSkia& window_icon,
+@@ -1027,7 +1027,14 @@ void HWNDMessageHandler::SizeConstraintsChanged() {
+   //   allowing ui::GetResizableFrameThickness() to be used consistently when
+   //   removing the visible system frame.
+   const bool had_caption_on_init = window_style() & WS_CAPTION;
+-  const bool can_resize = !is_translucent_ && delegate_->CanResize();
++
++  // In Chromium, the !is_translucent_ check was introduced for Glic-specific
++  // behavior. Since Electron does not use Glic, this restriction can be safely
++  // removed. Keeping the is_translucent_ check disables maximization for
++  // translucent framed windows. Original code: !is_translucent_ &&
++  // delegate_->CanResize() See:
++  // https://chromium-review.googlesource.com/c/chromium/src/+/6372329
++  const bool can_resize = delegate_->CanResize();
+   const bool can_maximize = can_resize && delegate_->CanMaximize();
+ 
+   auto set_style_func = [&style](LONG bit, bool should_set) {
+@@ -1622,11 +1629,16 @@ void HWNDMessageHandler::ResetWindowRegion(bool force, bool redraw) {
+   // through, but that isn't the case when using Direct3D to draw transparent
+   // windows. So we route translucent windows throught to the delegate to
+   // allow for a custom hit mask.
+-  if (!is_translucent_ && !custom_window_region_.is_valid() &&
++  // patch: fix_resolve_dynamic_background_material_update_issue_on_windows_11
++  // Our translucent windows use the native frame by default, and we should not
++  // set a custom region when the window is maximized; otherwise, it will cause
++  // a white title bar to appear under Windows 11.
++  if (!custom_window_region_.is_valid() &&
+       (IsFrameSystemDrawn() || !delegate_->HasNonClientView())) {
+     if (force) {
+       SetWindowRgn(hwnd(), nullptr, redraw);
+     }
++
+     return;
+   }
+ 
+@@ -2340,17 +2352,18 @@ LRESULT HWNDMessageHandler::OnNCActivate(UINT message,
+     delegate_->SchedulePaint();
+   }
+ 
+-  // Calling DefWindowProc is only necessary if there's a system frame being
+-  // drawn. Otherwise it can draw an incorrect title bar and cause visual
+-  // corruption.
+-  if (!delegate_->HasFrame() ||
++  // If the window is translucent, it may have the Mica background.
++  // In that case, it's necessary to call |DefWindowProc|, but we can
++  // pass -1 in the lParam to prevent any non-client area elements from
++  // being displayed.
++  if ((!delegate_->HasFrame() && !is_translucent_) ||
+       delegate_->GetFrameMode() == FrameMode::CUSTOM_DRAWN) {
+     SetMsgHandled(TRUE);
+     return TRUE;
+   }
+ 
+   return DefWindowProcWithRedrawLock(WM_NCACTIVATE, paint_as_active || active,
+-                                     0);
++                                     delegate_->HasFrame() ? 0 : -1);
+ }
+ 
+ LRESULT HWNDMessageHandler::OnNCCalcSize(BOOL mode, LPARAM l_param) {

patches/chromium/fix_select_the_first_menu_item_when_opened_via_keyboard.patch

@@ -6,7 +6,7 @@ Subject: fix: select the first menu item when opened via keyboard
 This fixes an accessibility issue where the root view is 'focused' to the screen reader instead of the first menu item as with all other native menus. This patch will be upstreamed.
 
 diff --git a/ui/views/controls/menu/menu_controller.cc b/ui/views/controls/menu/menu_controller.cc
-index 05dfc40b27072ee8f67930508e9005a9ba569348..9d5ad3940c1dd2228cc651d6d99cb52137626a7e 100644
+index d3e06148b22f06e6676bcda5fd8907595389887e..35f22b679494940ae1b1d64fa4eb17c41c0cc623 100644
 --- a/ui/views/controls/menu/menu_controller.cc
 +++ b/ui/views/controls/menu/menu_controller.cc
 @@ -711,6 +711,16 @@ void MenuController::Run(Widget* parent,
@@ -26,7 +26,7 @@ index 05dfc40b27072ee8f67930508e9005a9ba569348..9d5ad3940c1dd2228cc651d6d99cb521
    if (button_controller) {
      pressed_lock_ = button_controller->TakeLock(
          false, ui::LocatedEvent::FromIfValid(event));
-@@ -2440,19 +2450,15 @@ void MenuController::OpenMenuImpl(MenuItemView* item, bool show) {
+@@ -2426,19 +2436,15 @@ void MenuController::OpenMenuImpl(MenuItemView* item, bool show) {
      }
      item->GetSubmenu()->ShowAt(params);
  

patches/chromium/make_gtk_getlibgtk_public.patch

@@ -7,10 +7,10 @@ Allows embedders to get a handle to the gdk_pixbuf
 library already loaded in the process.
 
 diff --git a/ui/gtk/gtk_compat.cc b/ui/gtk/gtk_compat.cc
-index 37bb48273cf4833c88622f1158aebfee9423d085..2009a095abfae3207d73c47245e061ff3f9cef80 100644
+index bcd86e7a9e870b274d0c6487a691f23ad1888079..4b192c90ce82ddddaedf14970919447e8f43dd7c 100644
 --- a/ui/gtk/gtk_compat.cc
 +++ b/ui/gtk/gtk_compat.cc
-@@ -69,11 +69,6 @@ void* GetLibGio() {
+@@ -68,11 +68,6 @@ void* GetLibGio() {
    return libgio;
  }
  
@@ -22,7 +22,7 @@ index 37bb48273cf4833c88622f1158aebfee9423d085..2009a095abfae3207d73c47245e061ff
  void* GetLibGdk3() {
    static void* libgdk3 = DlOpen("libgdk-3.so.0");
    return libgdk3;
-@@ -169,6 +164,11 @@ gfx::Insets InsetsFromGtkBorder(const GtkBorder& border) {
+@@ -165,6 +160,11 @@ gfx::Insets InsetsFromGtkBorder(const GtkBorder& border) {
  
  }  // namespace
  
@@ -31,14 +31,14 @@ index 37bb48273cf4833c88622f1158aebfee9423d085..2009a095abfae3207d73c47245e061ff
 +  return libgdk_pixbuf;
 +}
 +
- bool LoadGtk() {
-   static bool loaded = LoadGtkImpl();
+ bool LoadGtk(ui::LinuxUiBackend backend) {
+   static bool loaded = LoadGtkImpl(backend);
    return loaded;
 diff --git a/ui/gtk/gtk_compat.h b/ui/gtk/gtk_compat.h
-index 19f73cc179d82a3729c5fe37883460ac05f4d0c3..17aa0b95bd6158ed02c03095c1687185a057fe62 100644
+index 841e2e8fcdbe2da4aac487badd4d352476e461a2..e458df649546fa3bee10e24f0edac147186cc152 100644
 --- a/ui/gtk/gtk_compat.h
 +++ b/ui/gtk/gtk_compat.h
-@@ -41,6 +41,9 @@ using SkColor = uint32_t;
+@@ -42,6 +42,9 @@ using SkColor = uint32_t;
  
  namespace gtk {
  
@@ -46,5 +46,5 @@ index 19f73cc179d82a3729c5fe37883460ac05f4d0c3..17aa0b95bd6158ed02c03095c1687185
 +void* GetLibGdkPixbuf();
 +
  // Loads libgtk and related libraries and returns true on success.
- bool LoadGtk();
+ bool LoadGtk(ui::LinuxUiBackend backend);
  

patches/chromium/refactor_expose_file_system_access_blocklist.patch

@@ -8,10 +8,18 @@ it in Electron and prevent drift from Chrome's blocklist. We should look for a w
 to upstream this change to Chrome.
 
 diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
-index 5b543e82abb17cbb91bf37fa6bac016b6053eb93..117b6b05b3a1c39183a45830b97255cab529c646 100644
+index 3514864559de0d2f2f36fda9b0add0b7b88f3b2a..44318ce3bed67e6f83f3687d11500ddfecd4aef4 100644
 --- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
 +++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
-@@ -82,11 +82,13 @@
+@@ -45,7 +45,6 @@
+ #include "chrome/browser/ui/file_system_access/file_system_access_dangerous_file_dialog.h"
+ #include "chrome/browser/ui/file_system_access/file_system_access_dialogs.h"
+ #include "chrome/browser/ui/file_system_access/file_system_access_restricted_directory_dialog.h"
+-#include "chrome/common/chrome_paths.h"
+ #include "chrome/grit/generated_resources.h"
+ #include "components/content_settings/core/browser/host_content_settings_map.h"
+ #include "components/content_settings/core/common/content_settings.h"
+@@ -81,11 +80,13 @@
  #include "chrome/browser/ui/browser_window.h"
  #include "chrome/browser/ui/tabs/public/tab_features.h"
  #include "chrome/browser/ui/views/file_system_access/file_system_access_page_action_controller.h"
@@ -25,7 +33,7 @@ index 5b543e82abb17cbb91bf37fa6bac016b6053eb93..117b6b05b3a1c39183a45830b97255ca
  #include "components/tabs/public/tab_interface.h"
  #if BUILDFLAG(ENABLE_PLATFORM_APPS)
  #include "extensions/browser/extension_registry.h"  // nogncheck
-@@ -262,182 +264,10 @@ bool MaybeIsLocalUNCPath(const base::FilePath& path) {
+@@ -261,129 +262,10 @@ bool MaybeIsLocalUNCPath(const base::FilePath& path) {
  }
  #endif
  
@@ -33,6 +41,111 @@ index 5b543e82abb17cbb91bf37fa6bac016b6053eb93..117b6b05b3a1c39183a45830b97255ca
 -// the struct below.
 -constexpr const int kNoBasePathKey = -1;
 -
+-using BlockType = ChromeFileSystemAccessPermissionContext::BlockType;
+-
+-std::vector<ChromeFileSystemAccessPermissionContext::BlockedPath>
+-GenerateBlockedPath() {
+-  return {
+-      // Don't allow users to share their entire home directory, entire desktop
+-      // or entire documents folder, but do allow sharing anything inside those
+-      // directories not otherwise blocked.
+-      {base::DIR_HOME, nullptr, BlockType::kDontBlockChildren},
+-      {base::DIR_USER_DESKTOP, nullptr, BlockType::kDontBlockChildren},
+-      {chrome::DIR_USER_DOCUMENTS, nullptr, BlockType::kDontBlockChildren},
+-      // Similar restrictions for the downloads directory.
+-      {chrome::DIR_DEFAULT_DOWNLOADS, nullptr, BlockType::kDontBlockChildren},
+-      {chrome::DIR_DEFAULT_DOWNLOADS_SAFE, nullptr,
+-       BlockType::kDontBlockChildren},
+-      // The Chrome installation itself should not be modified by the web.
+-      {base::DIR_EXE, nullptr, BlockType::kBlockAllChildren},
+-      {base::DIR_MODULE, nullptr, BlockType::kBlockAllChildren},
+-      {base::DIR_ASSETS, nullptr, BlockType::kBlockAllChildren},
+-      // And neither should the configuration of at least the currently running
+-      // Chrome instance (note that this does not take --user-data-dir command
+-      // line overrides into account).
+-      {chrome::DIR_USER_DATA, nullptr, BlockType::kBlockAllChildren},
+-      // ~/.ssh is pretty sensitive on all platforms, so block access to that.
+-      {base::DIR_HOME, FILE_PATH_LITERAL(".ssh"), BlockType::kBlockAllChildren},
+-      // And limit access to ~/.gnupg as well.
+-      {base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"),
+-       BlockType::kBlockAllChildren},
+-#if BUILDFLAG(IS_WIN)
+-      // Some Windows specific directories to block, basically all apps, the
+-      // operating system itself, as well as configuration data for apps.
+-      {base::DIR_PROGRAM_FILES, nullptr, BlockType::kBlockAllChildren},
+-      {base::DIR_PROGRAM_FILESX86, nullptr, BlockType::kBlockAllChildren},
+-      {base::DIR_PROGRAM_FILES6432, nullptr, BlockType::kBlockAllChildren},
+-      {base::DIR_WINDOWS, nullptr, BlockType::kBlockAllChildren},
+-      {base::DIR_ROAMING_APP_DATA, nullptr, BlockType::kBlockAllChildren},
+-      {base::DIR_LOCAL_APP_DATA, nullptr, BlockType::kBlockAllChildren},
+-      {base::DIR_COMMON_APP_DATA, nullptr, BlockType::kBlockAllChildren},
+-      // Opening a file from an MTP device, such as a smartphone or a camera, is
+-      // implemented by Windows as opening a file in the temporary internet
+-      // files directory. To support that, allow opening files in that
+-      // directory, but not whole directories.
+-      {base::DIR_IE_INTERNET_CACHE, nullptr,
+-       BlockType::kBlockNestedDirectories},
+-#endif
+-#if BUILDFLAG(IS_MAC)
+-      // Similar Mac specific blocks.
+-      {base::DIR_APP_DATA, nullptr, BlockType::kBlockAllChildren},
+-      // Block access to the current bundle directory.
+-      {chrome::DIR_OUTER_BUNDLE, nullptr, BlockType::kBlockAllChildren},
+-      // Block access to the user's Applications directory.
+-      {base::DIR_HOME, FILE_PATH_LITERAL("Applications"),
+-       BlockType::kBlockAllChildren},
+-      // Block access to the root Applications directory.
+-      {kNoBasePathKey, FILE_PATH_LITERAL("/Applications"),
+-       BlockType::kBlockAllChildren},
+-      {base::DIR_HOME, FILE_PATH_LITERAL("Library"),
+-       BlockType::kBlockAllChildren},
+-      // Allow access to other cloud files, such as Google Drive.
+-      {base::DIR_HOME, FILE_PATH_LITERAL("Library/CloudStorage"),
+-       BlockType::kDontBlockChildren},
+-      // Allow the site to interact with data from its corresponding natively
+-      // installed (sandboxed) application. It would be nice to limit a site to
+-      // access only _its_ corresponding natively installed application, but
+-      // unfortunately there's no straightforward way to do that. See
+-      // https://crbug.com/984641#c22.
+-      {base::DIR_HOME, FILE_PATH_LITERAL("Library/Containers"),
+-       BlockType::kDontBlockChildren},
+-      // Allow access to iCloud files...
+-      {base::DIR_HOME, FILE_PATH_LITERAL("Library/Mobile Documents"),
+-       BlockType::kDontBlockChildren},
+-      // ... which may also appear at this directory.
+-      {base::DIR_HOME,
+-       FILE_PATH_LITERAL("Library/Mobile Documents/com~apple~CloudDocs"),
+-       BlockType::kDontBlockChildren},
+-#endif
+-#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID)
+-      // On Linux also block access to devices via /dev.
+-      {kNoBasePathKey, FILE_PATH_LITERAL("/dev"), BlockType::kBlockAllChildren},
+-      // And security sensitive data in /proc and /sys.
+-      {kNoBasePathKey, FILE_PATH_LITERAL("/proc"),
+-       BlockType::kBlockAllChildren},
+-      {kNoBasePathKey, FILE_PATH_LITERAL("/sys"), BlockType::kBlockAllChildren},
+-      // And system files in /boot and /etc.
+-      {kNoBasePathKey, FILE_PATH_LITERAL("/boot"),
+-       BlockType::kBlockAllChildren},
+-      {kNoBasePathKey, FILE_PATH_LITERAL("/etc"), BlockType::kBlockAllChildren},
+-      // And block all of ~/.config, matching the similar restrictions on mac
+-      // and windows.
+-      {base::DIR_HOME, FILE_PATH_LITERAL(".config"),
+-       BlockType::kBlockAllChildren},
+-      // Block ~/.dbus as well, just in case, although there probably isn't much
+-      // a website can do with access to that directory and its contents.
+-      {base::DIR_HOME, FILE_PATH_LITERAL(".dbus"),
+-       BlockType::kBlockAllChildren},
+-#endif
+-#if BUILDFLAG(IS_ANDROID)
+-      {base::DIR_ANDROID_APP_DATA, nullptr, BlockType::kBlockAllChildren},
+-      {base::DIR_CACHE, nullptr, BlockType::kBlockAllChildren},
+-#endif
+-      // TODO(crbug.com/40095723): Refine this list, for example add
+-      // XDG_CONFIG_HOME when it is not set ~/.config?
+-  };
+-}
+-
 -// A wrapper around `base::NormalizeFilePath` that returns its result instead of
 -// using an out parameter.
 -base::FilePath NormalizeFilePath(const base::FilePath& path) {
@@ -47,164 +160,6 @@ index 5b543e82abb17cbb91bf37fa6bac016b6053eb93..117b6b05b3a1c39183a45830b97255ca
 -  CHECK_EQ(path.empty(), normalized_path.empty());
 -  return normalized_path;
 -}
--
--using BlockType = ChromeFileSystemAccessPermissionContext::BlockType;
--
--std::unique_ptr<ChromeFileSystemAccessPermissionContext::BlockPathRules>
--GenerateBlockPaths(bool should_normalize_file_path) {
--  static constexpr ChromeFileSystemAccessPermissionContext::BlockPath
--      kBlockPaths[] = {
--          // Don't allow users to share their entire home directory, entire
--          // desktop or entire documents folder, but do allow sharing anything
--          // inside those directories not otherwise blocked.
--          {base::DIR_HOME, nullptr, BlockType::kDontBlockChildren},
--          {base::DIR_USER_DESKTOP, nullptr, BlockType::kDontBlockChildren},
--          {chrome::DIR_USER_DOCUMENTS, nullptr, BlockType::kDontBlockChildren},
--          // Similar restrictions for the downloads directory.
--          {chrome::DIR_DEFAULT_DOWNLOADS, nullptr,
--           BlockType::kDontBlockChildren},
--          {chrome::DIR_DEFAULT_DOWNLOADS_SAFE, nullptr,
--           BlockType::kDontBlockChildren},
--          // The Chrome installation itself should not be modified by the web.
--          {base::DIR_EXE, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_MODULE, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_ASSETS, nullptr, BlockType::kBlockAllChildren},
--          // And neither should the configuration of at least the currently
--          // running
--          // Chrome instance (note that this does not take --user-data-dir
--          // command
--          // line overrides into account).
--          {chrome::DIR_USER_DATA, nullptr, BlockType::kBlockAllChildren},
--          // ~/.ssh is pretty sensitive on all platforms, so block access to
--          // that.
--          {base::DIR_HOME, FILE_PATH_LITERAL(".ssh"),
--           BlockType::kBlockAllChildren},
--          // And limit access to ~/.gnupg as well.
--          {base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"),
--           BlockType::kBlockAllChildren},
--#if BUILDFLAG(IS_WIN)
--          // Some Windows specific directories to block, basically all apps, the
--          // operating system itself, as well as configuration data for apps.
--          {base::DIR_PROGRAM_FILES, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_PROGRAM_FILESX86, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_PROGRAM_FILES6432, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_WINDOWS, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_ROAMING_APP_DATA, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_LOCAL_APP_DATA, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_COMMON_APP_DATA, nullptr, BlockType::kBlockAllChildren},
--          // Opening a file from an MTP device, such as a smartphone or a
--          // camera, is
--          // implemented by Windows as opening a file in the temporary internet
--          // files directory. To support that, allow opening files in that
--          // directory, but not whole directories.
--          {base::DIR_IE_INTERNET_CACHE, nullptr,
--           BlockType::kBlockNestedDirectories},
--#endif
--#if BUILDFLAG(IS_MAC)
--          // Similar Mac specific blocks.
--          {base::DIR_APP_DATA, nullptr, BlockType::kBlockAllChildren},
--          // Block access to the current bundle directory.
--          {chrome::DIR_OUTER_BUNDLE, nullptr, BlockType::kBlockAllChildren},
--          // Block access to the user's Applications directory.
--          {base::DIR_HOME, FILE_PATH_LITERAL("Applications"),
--           BlockType::kBlockAllChildren},
--          // Block access to the root Applications directory.
--          {kNoBasePathKey, FILE_PATH_LITERAL("/Applications"),
--           BlockType::kBlockAllChildren},
--          {base::DIR_HOME, FILE_PATH_LITERAL("Library"),
--           BlockType::kBlockAllChildren},
--          // Allow access to other cloud files, such as Google Drive.
--          {base::DIR_HOME, FILE_PATH_LITERAL("Library/CloudStorage"),
--           BlockType::kDontBlockChildren},
--          // Allow the site to interact with data from its corresponding
--          // natively
--          // installed (sandboxed) application. It would be nice to limit a site
--          // to
--          // access only _its_ corresponding natively installed application, but
--          // unfortunately there's no straightforward way to do that. See
--          // https://crbug.com/984641#c22.
--          {base::DIR_HOME, FILE_PATH_LITERAL("Library/Containers"),
--           BlockType::kDontBlockChildren},
--          // Allow access to iCloud files...
--          {base::DIR_HOME, FILE_PATH_LITERAL("Library/Mobile Documents"),
--           BlockType::kDontBlockChildren},
--          // ... which may also appear at this directory.
--          {base::DIR_HOME,
--           FILE_PATH_LITERAL("Library/Mobile Documents/com~apple~CloudDocs"),
--           BlockType::kDontBlockChildren},
--#endif
--#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID)
--          // On Linux also block access to devices via /dev.
--          {kNoBasePathKey, FILE_PATH_LITERAL("/dev"),
--           BlockType::kBlockAllChildren},
--          // And security sensitive data in /proc and /sys.
--          {kNoBasePathKey, FILE_PATH_LITERAL("/proc"),
--           BlockType::kBlockAllChildren},
--          {kNoBasePathKey, FILE_PATH_LITERAL("/sys"),
--           BlockType::kBlockAllChildren},
--          // And system files in /boot and /etc.
--          {kNoBasePathKey, FILE_PATH_LITERAL("/boot"),
--           BlockType::kBlockAllChildren},
--          {kNoBasePathKey, FILE_PATH_LITERAL("/etc"),
--           BlockType::kBlockAllChildren},
--          // And block all of ~/.config, matching the similar restrictions on
--          // mac
--          // and windows.
--          {base::DIR_HOME, FILE_PATH_LITERAL(".config"),
--           BlockType::kBlockAllChildren},
--          // Block ~/.dbus as well, just in case, although there probably isn't
--          // much
--          // a website can do with access to that directory and its contents.
--          {base::DIR_HOME, FILE_PATH_LITERAL(".dbus"),
--           BlockType::kBlockAllChildren},
--#endif
--#if BUILDFLAG(IS_ANDROID)
--          {base::DIR_ANDROID_APP_DATA, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_CACHE, nullptr, BlockType::kBlockAllChildren},
--#endif
--          // TODO(crbug.com/40095723): Refine this list, for example add
--          // XDG_CONFIG_HOME when it is not set ~/.config?
--      };
--
--  // ChromeOS supports multi-user sign-in. base::DIR_HOME only returns the
--  // profile path for the primary user, the first user to sign in. We want to
--  // use the `profile_path` instead since that's associated with user that
--  // initiated this blocklist check.
--  //
--  // TODO(crbug.com/375490221): Improve the ChromeOS blocklist logic.
--  constexpr bool kUseProfilePathForDirHome = BUILDFLAG(IS_CHROMEOS);
--  // Populate the hard-coded rules.
--  auto block_path_rules = std::make_unique<
--      ChromeFileSystemAccessPermissionContext::BlockPathRules>();
--
--  for (const auto& blocked_path : kBlockPaths) {
--    base::FilePath path;
--    if (blocked_path.base_path_key != kNoBasePathKey) {
--      if (kUseProfilePathForDirHome &&
--          blocked_path.base_path_key == base::DIR_HOME) {
--        block_path_rules->profile_based_block_path_rules_.emplace_back(
--            blocked_path.path, blocked_path.type);
--        continue;
--      }
--
--      if (!base::PathService::Get(blocked_path.base_path_key, &path)) {
--        continue;
--      }
--
--      if (blocked_path.path) {
--        path = path.Append(blocked_path.path);
--      }
--    } else {
--      DCHECK(blocked_path.path);
--      path = base::FilePath(blocked_path.path);
--    }
--    block_path_rules->block_path_rules_.emplace_back(
--        should_normalize_file_path ? NormalizeFilePath(path) : path,
--        blocked_path.type);
--  }
--
--  return block_path_rules;
--}
 +// This patch moves the deleted content from this file over to
 +// chrome/browser/file_system_access/chrome_file_system_access_permission_context.h.
 +// NOTE IF THERE IS A CONFLICT ABOVE, you will need to copy the changes in the
@@ -212,24 +167,7 @@ index 5b543e82abb17cbb91bf37fa6bac016b6053eb93..117b6b05b3a1c39183a45830b97255ca
  
  // Checks if `path` should be blocked by the `rules`.
  // The BlockType of the nearest ancestor of a path to check is what
-@@ -1261,16 +1091,6 @@ struct ChromeFileSystemAccessPermissionContext::OriginState {
-   std::unique_ptr<base::RetainingOneShotTimer> cleanup_timer;
- };
- 
--ChromeFileSystemAccessPermissionContext::BlockPathRules::BlockPathRules() =
--    default;
--ChromeFileSystemAccessPermissionContext::BlockPathRules::~BlockPathRules() =
--    default;
--ChromeFileSystemAccessPermissionContext::BlockPathRules::BlockPathRules(
--    const BlockPathRules& other) = default;
--ChromeFileSystemAccessPermissionContext::BlockPathRules&
--ChromeFileSystemAccessPermissionContext::BlockPathRules::operator=(
--    const BlockPathRules& other) = default;
--
- ChromeFileSystemAccessPermissionContext::
-     ChromeFileSystemAccessPermissionContext(content::BrowserContext* context,
-                                             const base::Clock* clock)
-@@ -1289,7 +1109,7 @@ ChromeFileSystemAccessPermissionContext::
+@@ -1237,7 +1119,7 @@ ChromeFileSystemAccessPermissionContext::
  #if BUILDFLAG(IS_ANDROID)
    one_time_permissions_tracker_.Observe(
        OneTimePermissionsTrackerFactory::GetForBrowserContext(context));
@@ -238,7 +176,7 @@ index 5b543e82abb17cbb91bf37fa6bac016b6053eb93..117b6b05b3a1c39183a45830b97255ca
    auto* provider = web_app::WebAppProvider::GetForWebApps(
        Profile::FromBrowserContext(profile_));
    if (provider) {
-@@ -2551,7 +2371,7 @@ void ChromeFileSystemAccessPermissionContext::OnShutdown() {
+@@ -2443,7 +2325,7 @@ void ChromeFileSystemAccessPermissionContext::OnShutdown() {
    one_time_permissions_tracker_.Reset();
  }
  
@@ -247,7 +185,7 @@ index 5b543e82abb17cbb91bf37fa6bac016b6053eb93..117b6b05b3a1c39183a45830b97255ca
  void ChromeFileSystemAccessPermissionContext::OnWebAppInstalled(
      const webapps::AppId& app_id) {
    if (!base::FeatureList::IsEnabled(
-@@ -3108,11 +2928,7 @@ bool ChromeFileSystemAccessPermissionContext::OriginHasExtendedPermission(
+@@ -3000,11 +2882,7 @@ bool ChromeFileSystemAccessPermissionContext::OriginHasExtendedPermission(
      const url::Origin& origin) {
    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
  
@@ -260,7 +198,7 @@ index 5b543e82abb17cbb91bf37fa6bac016b6053eb93..117b6b05b3a1c39183a45830b97255ca
    if (!base::FeatureList::IsEnabled(
            features::kFileSystemAccessPersistentPermissions)) {
      return false;
-@@ -3156,6 +2972,7 @@ bool ChromeFileSystemAccessPermissionContext::OriginHasExtendedPermission(
+@@ -3048,6 +2926,7 @@ bool ChromeFileSystemAccessPermissionContext::OriginHasExtendedPermission(
                                              : WebAppInstallStatus::kUninstalled;
    return app_has_os_integration;
  #endif  // BUILDFLAG(IS_ANDROID)
@@ -269,10 +207,10 @@ index 5b543e82abb17cbb91bf37fa6bac016b6053eb93..117b6b05b3a1c39183a45830b97255ca
  
  void ChromeFileSystemAccessPermissionContext::SetOriginExtendedPermissionByUser(
 diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
-index f647100981fd98d8511d07a6d7e100910e38a0f2..14e1b3c8ec78429f5a845f54cc973e7c77ea8bc4 100644
+index 46a2019587b534add3c89f464cdf7261a67e7cce..57e3f7c966a45114b17701a851b191be88d72e7c 100644
 --- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
 +++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
-@@ -9,10 +9,13 @@
+@@ -9,9 +9,12 @@
  #include <vector>
  
  #include "base/auto_reset.h"
@@ -281,30 +219,144 @@ index f647100981fd98d8511d07a6d7e100910e38a0f2..14e1b3c8ec78429f5a845f54cc973e7c
  #include "base/files/file_path.h"
 +#include "base/files/file_util.h"
  #include "base/memory/raw_ptr.h"
- #include "base/memory/weak_ptr.h"
 +#include "base/path_service.h"
  #include "base/scoped_observation.h"
  #include "base/sequence_checker.h"
  #include "base/time/clock.h"
-@@ -22,6 +25,7 @@
+@@ -21,7 +24,7 @@
  #include "chrome/browser/file_system_access/file_system_access_permission_request_manager.h"
  #include "chrome/browser/permissions/one_time_permissions_tracker.h"
  #include "chrome/browser/permissions/one_time_permissions_tracker_observer.h"
+-#include "components/enterprise/buildflags/buildflags.h"
 +#include "chrome/common/chrome_paths.h"
- #include "components/enterprise/buildflags/buildflags.h"
  #include "components/permissions/features.h"
  #include "components/permissions/object_permission_context_base.h"
-@@ -403,6 +407,183 @@ class ChromeFileSystemAccessPermissionContext
-     return is_block_path_rules_init_complete_;
-   }
+ #include "content/public/browser/file_system_access_permission_context.h"
+@@ -31,7 +34,7 @@
+ #include "chrome/browser/web_applications/web_app_install_manager_observer.h"
+ #endif
+ 
+-#if BUILDFLAG(ENTERPRISE_CLOUD_CONTENT_ANALYSIS)
++#if 0
+ #include "components/enterprise/common/files_scan_data.h"
+ #endif
+ 
+@@ -371,6 +374,130 @@ class ChromeFileSystemAccessPermissionContext
+   // KeyedService:
+   void Shutdown() override;
  
 +  // Sentinel used to indicate that no PathService key is specified for a path in
 +  // the struct below.
 +  static constexpr const int kNoBasePathKey = -1;
 +
++  using BlockType = ChromeFileSystemAccessPermissionContext::BlockType;
++
++  static std::vector<ChromeFileSystemAccessPermissionContext::BlockedPath>
++  GenerateBlockedPath() {
++    return {
++        // Don't allow users to share their entire home directory, entire desktop
++        // or entire documents folder, but do allow sharing anything inside those
++        // directories not otherwise blocked.
++        {base::DIR_HOME, nullptr, BlockType::kDontBlockChildren},
++        {base::DIR_USER_DESKTOP, nullptr, BlockType::kDontBlockChildren},
++        {chrome::DIR_USER_DOCUMENTS, nullptr, BlockType::kDontBlockChildren},
++        // Similar restrictions for the downloads directory.
++        {chrome::DIR_DEFAULT_DOWNLOADS, nullptr, BlockType::kDontBlockChildren},
++        {chrome::DIR_DEFAULT_DOWNLOADS_SAFE, nullptr,
++        BlockType::kDontBlockChildren},
++        // The Chrome installation itself should not be modified by the web.
++        {base::DIR_EXE, nullptr, BlockType::kBlockAllChildren},
++        {base::DIR_MODULE, nullptr, BlockType::kBlockAllChildren},
++        {base::DIR_ASSETS, nullptr, BlockType::kBlockAllChildren},
++        // And neither should the configuration of at least the currently running
++        // Chrome instance (note that this does not take --user-data-dir command
++        // line overrides into account).
++        {chrome::DIR_USER_DATA, nullptr, BlockType::kBlockAllChildren},
++        // ~/.ssh is pretty sensitive on all platforms, so block access to that.
++        {base::DIR_HOME, FILE_PATH_LITERAL(".ssh"), BlockType::kBlockAllChildren},
++        // And limit access to ~/.gnupg as well.
++        {base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"),
++        BlockType::kBlockAllChildren},
++  #if BUILDFLAG(IS_WIN)
++        // Some Windows specific directories to block, basically all apps, the
++        // operating system itself, as well as configuration data for apps.
++        {base::DIR_PROGRAM_FILES, nullptr, BlockType::kBlockAllChildren},
++        {base::DIR_PROGRAM_FILESX86, nullptr, BlockType::kBlockAllChildren},
++        {base::DIR_PROGRAM_FILES6432, nullptr, BlockType::kBlockAllChildren},
++        {base::DIR_WINDOWS, nullptr, BlockType::kBlockAllChildren},
++        {base::DIR_ROAMING_APP_DATA, nullptr, BlockType::kBlockAllChildren},
++        {base::DIR_LOCAL_APP_DATA, nullptr, BlockType::kBlockAllChildren},
++        {base::DIR_COMMON_APP_DATA, nullptr, BlockType::kBlockAllChildren},
++        // Opening a file from an MTP device, such as a smartphone or a camera, is
++        // implemented by Windows as opening a file in the temporary internet
++        // files directory. To support that, allow opening files in that
++        // directory, but not whole directories.
++        {base::DIR_IE_INTERNET_CACHE, nullptr,
++        BlockType::kBlockNestedDirectories},
++  #endif
++  #if BUILDFLAG(IS_MAC)
++        // Similar Mac specific blocks.
++        {base::DIR_APP_DATA, nullptr, BlockType::kBlockAllChildren},
++        // Block access to the current bundle directory.
++        {chrome::DIR_OUTER_BUNDLE, nullptr, BlockType::kBlockAllChildren},
++        // Block access to the user's Applications directory.
++        {base::DIR_HOME, FILE_PATH_LITERAL("Applications"),
++        BlockType::kBlockAllChildren},
++        // Block access to the root Applications directory.
++        {kNoBasePathKey, FILE_PATH_LITERAL("/Applications"),
++        BlockType::kBlockAllChildren},
++        {base::DIR_HOME, FILE_PATH_LITERAL("Library"),
++        BlockType::kBlockAllChildren},
++        // Allow access to other cloud files, such as Google Drive.
++        {base::DIR_HOME, FILE_PATH_LITERAL("Library/CloudStorage"),
++        BlockType::kDontBlockChildren},
++        // Allow the site to interact with data from its corresponding natively
++        // installed (sandboxed) application. It would be nice to limit a site to
++        // access only _its_ corresponding natively installed application, but
++        // unfortunately there's no straightforward way to do that. See
++        // https://crbug.com/984641#c22.
++        {base::DIR_HOME, FILE_PATH_LITERAL("Library/Containers"),
++        BlockType::kDontBlockChildren},
++        // Allow access to iCloud files...
++        {base::DIR_HOME, FILE_PATH_LITERAL("Library/Mobile Documents"),
++        BlockType::kDontBlockChildren},
++        // ... which may also appear at this directory.
++        {base::DIR_HOME,
++        FILE_PATH_LITERAL("Library/Mobile Documents/com~apple~CloudDocs"),
++        BlockType::kDontBlockChildren},
++  #endif
++  #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID)
++        // On Linux also block access to devices via /dev.
++        {kNoBasePathKey, FILE_PATH_LITERAL("/dev"), BlockType::kBlockAllChildren},
++        // And security sensitive data in /proc and /sys.
++        {kNoBasePathKey, FILE_PATH_LITERAL("/proc"),
++        BlockType::kBlockAllChildren},
++        {kNoBasePathKey, FILE_PATH_LITERAL("/sys"), BlockType::kBlockAllChildren},
++        // And system files in /boot and /etc.
++        {kNoBasePathKey, FILE_PATH_LITERAL("/boot"),
++        BlockType::kBlockAllChildren},
++        {kNoBasePathKey, FILE_PATH_LITERAL("/etc"), BlockType::kBlockAllChildren},
++        // And block all of ~/.config, matching the similar restrictions on mac
++        // and windows.
++        {base::DIR_HOME, FILE_PATH_LITERAL(".config"),
++        BlockType::kBlockAllChildren},
++        // Block ~/.dbus as well, just in case, although there probably isn't much
++        // a website can do with access to that directory and its contents.
++        {base::DIR_HOME, FILE_PATH_LITERAL(".dbus"),
++        BlockType::kBlockAllChildren},
++  #endif
++  #if BUILDFLAG(IS_ANDROID)
++        {base::DIR_ANDROID_APP_DATA, nullptr, BlockType::kBlockAllChildren},
++        {base::DIR_CACHE, nullptr, BlockType::kBlockAllChildren},
++  #endif
++        // TODO(crbug.com/40095723): Refine this list, for example add
++        // XDG_CONFIG_HOME when it is not set ~/.config?
++    };
++  }
++
 +  // A wrapper around `base::NormalizeFilePath` that returns its result instead of
 +  // using an out parameter.
-+  static base::FilePath NormalizeFilePath(const base::FilePath& path) {
++  base::FilePath NormalizeFilePath(const base::FilePath& path) {
 +    CHECK(path.IsAbsolute());
 +    // TODO(crbug.com/368130513O): On Windows, this call will fail if the target
 +    // file path is greater than MAX_PATH. We should decide how to handle this
@@ -316,165 +368,16 @@ index f647100981fd98d8511d07a6d7e100910e38a0f2..14e1b3c8ec78429f5a845f54cc973e7c
 +    CHECK_EQ(path.empty(), normalized_path.empty());
 +    return normalized_path;
 +  }
-+
-+  using BlockType = ChromeFileSystemAccessPermissionContext::BlockType;
-+
-+  static std::unique_ptr<ChromeFileSystemAccessPermissionContext::BlockPathRules>
-+  GenerateBlockPaths(bool should_normalize_file_path) {
-+    static constexpr ChromeFileSystemAccessPermissionContext::BlockPath
-+        kBlockPaths[] = {
-+            // Don't allow users to share their entire home directory, entire
-+            // desktop or entire documents folder, but do allow sharing anything
-+            // inside those directories not otherwise blocked.
-+            {base::DIR_HOME, nullptr, BlockType::kDontBlockChildren},
-+            {base::DIR_USER_DESKTOP, nullptr, BlockType::kDontBlockChildren},
-+            {chrome::DIR_USER_DOCUMENTS, nullptr, BlockType::kDontBlockChildren},
-+            // Similar restrictions for the downloads directory.
-+            {chrome::DIR_DEFAULT_DOWNLOADS, nullptr,
-+            BlockType::kDontBlockChildren},
-+            {chrome::DIR_DEFAULT_DOWNLOADS_SAFE, nullptr,
-+            BlockType::kDontBlockChildren},
-+            // The Chrome installation itself should not be modified by the web.
-+            {base::DIR_EXE, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_MODULE, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_ASSETS, nullptr, BlockType::kBlockAllChildren},
-+            // And neither should the configuration of at least the currently
-+            // running
-+            // Chrome instance (note that this does not take --user-data-dir
-+            // command
-+            // line overrides into account).
-+            {chrome::DIR_USER_DATA, nullptr, BlockType::kBlockAllChildren},
-+            // ~/.ssh is pretty sensitive on all platforms, so block access to
-+            // that.
-+            {base::DIR_HOME, FILE_PATH_LITERAL(".ssh"),
-+            BlockType::kBlockAllChildren},
-+            // And limit access to ~/.gnupg as well.
-+            {base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"),
-+            BlockType::kBlockAllChildren},
-+  #if BUILDFLAG(IS_WIN)
-+            // Some Windows specific directories to block, basically all apps, the
-+            // operating system itself, as well as configuration data for apps.
-+            {base::DIR_PROGRAM_FILES, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_PROGRAM_FILESX86, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_PROGRAM_FILES6432, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_WINDOWS, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_ROAMING_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_LOCAL_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_COMMON_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-+            // Opening a file from an MTP device, such as a smartphone or a
-+            // camera, is
-+            // implemented by Windows as opening a file in the temporary internet
-+            // files directory. To support that, allow opening files in that
-+            // directory, but not whole directories.
-+            {base::DIR_IE_INTERNET_CACHE, nullptr,
-+            BlockType::kBlockNestedDirectories},
-+  #endif
-+  #if BUILDFLAG(IS_MAC)
-+            // Similar Mac specific blocks.
-+            {base::DIR_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-+            // Block access to the current bundle directory.
-+            {chrome::DIR_OUTER_BUNDLE, nullptr, BlockType::kBlockAllChildren},
-+            // Block access to the user's Applications directory.
-+            {base::DIR_HOME, FILE_PATH_LITERAL("Applications"),
-+            BlockType::kBlockAllChildren},
-+            // Block access to the root Applications directory.
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/Applications"),
-+            BlockType::kBlockAllChildren},
-+            {base::DIR_HOME, FILE_PATH_LITERAL("Library"),
-+            BlockType::kBlockAllChildren},
-+            // Allow access to other cloud files, such as Google Drive.
-+            {base::DIR_HOME, FILE_PATH_LITERAL("Library/CloudStorage"),
-+            BlockType::kDontBlockChildren},
-+            // Allow the site to interact with data from its corresponding
-+            // natively
-+            // installed (sandboxed) application. It would be nice to limit a site
-+            // to
-+            // access only _its_ corresponding natively installed application, but
-+            // unfortunately there's no straightforward way to do that. See
-+            // https://crbug.com/984641#c22.
-+            {base::DIR_HOME, FILE_PATH_LITERAL("Library/Containers"),
-+            BlockType::kDontBlockChildren},
-+            // Allow access to iCloud files...
-+            {base::DIR_HOME, FILE_PATH_LITERAL("Library/Mobile Documents"),
-+            BlockType::kDontBlockChildren},
-+            // ... which may also appear at this directory.
-+            {base::DIR_HOME,
-+            FILE_PATH_LITERAL("Library/Mobile Documents/com~apple~CloudDocs"),
-+            BlockType::kDontBlockChildren},
-+  #endif
-+  #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID)
-+            // On Linux also block access to devices via /dev.
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/dev"),
-+            BlockType::kBlockAllChildren},
-+            // And security sensitive data in /proc and /sys.
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/proc"),
-+            BlockType::kBlockAllChildren},
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/sys"),
-+            BlockType::kBlockAllChildren},
-+            // And system files in /boot and /etc.
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/boot"),
-+            BlockType::kBlockAllChildren},
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/etc"),
-+            BlockType::kBlockAllChildren},
-+            // And block all of ~/.config, matching the similar restrictions on
-+            // mac
-+            // and windows.
-+            {base::DIR_HOME, FILE_PATH_LITERAL(".config"),
-+            BlockType::kBlockAllChildren},
-+            // Block ~/.dbus as well, just in case, although there probably isn't
-+            // much
-+            // a website can do with access to that directory and its contents.
-+            {base::DIR_HOME, FILE_PATH_LITERAL(".dbus"),
-+            BlockType::kBlockAllChildren},
-+  #endif
-+  #if BUILDFLAG(IS_ANDROID)
-+            {base::DIR_ANDROID_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_CACHE, nullptr, BlockType::kBlockAllChildren},
-+  #endif
-+            // TODO(crbug.com/40095723): Refine this list, for example add
-+            // XDG_CONFIG_HOME when it is not set ~/.config?
-+        };
-+
-+    // ChromeOS supports multi-user sign-in. base::DIR_HOME only returns the
-+    // profile path for the primary user, the first user to sign in. We want to
-+    // use the `profile_path` instead since that's associated with user that
-+    // initiated this blocklist check.
-+    //
-+    // TODO(crbug.com/375490221): Improve the ChromeOS blocklist logic.
-+    constexpr bool kUseProfilePathForDirHome = BUILDFLAG(IS_CHROMEOS);
-+    // Populate the hard-coded rules.
-+    auto block_path_rules = std::make_unique<
-+        ChromeFileSystemAccessPermissionContext::BlockPathRules>();
-+
-+    for (const auto& blocked_path : kBlockPaths) {
-+      base::FilePath path;
-+      if (blocked_path.base_path_key != kNoBasePathKey) {
-+        if (kUseProfilePathForDirHome &&
-+            blocked_path.base_path_key == base::DIR_HOME) {
-+          block_path_rules->profile_based_block_path_rules_.emplace_back(
-+              blocked_path.path, blocked_path.type);
-+          continue;
-+        }
-+
-+        if (!base::PathService::Get(blocked_path.base_path_key, &path)) {
-+          continue;
-+        }
-+
-+        if (blocked_path.path) {
-+          path = path.Append(blocked_path.path);
-+        }
-+      } else {
-+        DCHECK(blocked_path.path);
-+        path = base::FilePath(blocked_path.path);
-+      }
-+      block_path_rules->block_path_rules_.emplace_back(
-+          should_normalize_file_path ? NormalizeFilePath(path) : path,
-+          blocked_path.type);
-+    }
-+
-+    return block_path_rules;
-+  }
 +
   protected:
    SEQUENCE_CHECKER(sequence_checker_);
  
+@@ -390,7 +517,7 @@ class ChromeFileSystemAccessPermissionContext
+ 
+   void PermissionGrantDestroyed(PermissionGrantImpl* grant);
+ 
+-#if BUILDFLAG(ENTERPRISE_CLOUD_CONTENT_ANALYSIS)
++#if 0
+   void OnContentAnalysisComplete(
+       std::vector<content::PathInfo> entries,
+       EntriesAllowedByEnterprisePolicyCallback callback,

patches/node/.patches

@@ -34,10 +34,8 @@ fix_remove_harmony-import-assertions_from_node_cc.patch
 chore_disable_deprecation_ftbfs_in_simdjson_header.patch
 build_allow_unbundling_of_node_js_dependencies.patch
 test_use_static_method_names_in_call_stacks.patch
-build_use_third_party_simdutf.patch
 fix_remove_fastapitypedarray_usage.patch
 test_handle_explicit_resource_management_globals.patch
-linux_try_preadv64_pwritev64_before_preadv_pwritev_4683.patch
 build_change_crdtp_protocoltypetraits_signatures_to_avoid_conflict.patch
 build_option_to_use_custom_inspector_protocol_path.patch
 fix_adjust_wpt_and_webidl_tests_for_enabled_float16array.patch
@@ -48,4 +46,5 @@ cli_move_--trace-atomics-wait_to_eol.patch
 fix_cppgc_initializing_twice.patch
 fix_task_starvation_in_inspector_context_test.patch
 fix_expose_readfilesync_override_for_modules.patch
-test_force_slow_json_stringify_path_for_overflow.patch
+chore_remove_protocol_maybe_from_node_string.patch
+fix_-wmismatched-new-delete_in_debug_utils_cc.patch

patches/node/build_add_gn_build_files.patch

@@ -10,8 +10,21 @@ however those files were cherry-picked from main branch and do not
 really in 20/21. We have to wait until 22 is released to be able to
 build with upstream GN files.
 
+diff --git a/configure.py b/configure.py
+index 4560bac7b8e3c707ecea5a425f642efb9de9ed36..e9c2a4391f4058a21a259cacaac4fde5d199288e 100755
+--- a/configure.py
++++ b/configure.py
+@@ -1722,7 +1722,7 @@ def configure_v8(o, configs):
+   # Until we manage to get rid of all those, v8_enable_sandbox cannot be used.
+   # Note that enabling pointer compression without enabling sandbox is unsupported by V8,
+   # so this can be broken at any time.
+-  o['variables']['v8_enable_sandbox'] = 0
++  o['variables']['v8_enable_sandbox'] = 1 if options.enable_pointer_compression else 0
+   o['variables']['v8_enable_pointer_compression_shared_cage'] = 1 if options.enable_pointer_compression else 0
+   o['variables']['v8_enable_external_code_space'] = 1 if options.enable_pointer_compression else 0
+   o['variables']['v8_enable_31bit_smis_on_64bit_arch'] = 1 if options.enable_pointer_compression else 0
 diff --git a/node.gni b/node.gni
-index a2123cc6c6d21c53fafc8934203b3720393e7b11..245a43920c7baf000ba63192a84a4c3fd219be7d 100644
+index 35ccd0487f20cece033d58827ecb7ed016908ee4..62cd49c6a87074912a1cb6792576c8d4f239b669 100644
 --- a/node.gni
 +++ b/node.gni
 @@ -5,10 +5,10 @@
@@ -27,7 +40,15 @@ index a2123cc6c6d21c53fafc8934203b3720393e7b11..245a43920c7baf000ba63192a84a4c3f
  
    # The location of OpenSSL - use the one from node's deps by default.
    node_openssl_path = "$node_path/deps/openssl"
-@@ -44,7 +44,7 @@ declare_args() {
+@@ -39,12 +39,15 @@ declare_args() {
+   # The variable is called "openssl" for parity with node's GYP build.
+   node_use_openssl = true
+ 
++  # Build node with SQLite support.
++  node_use_sqlite = true
++
+   # Use the specified path to system CA (PEM format) in addition to
+   # the BoringSSL supplied CA store or compiled-in Mozilla CA copy.
    node_openssl_system_ca_path = ""
  
    # Initialize v8 platform during node.js startup.
@@ -36,7 +57,7 @@ index a2123cc6c6d21c53fafc8934203b3720393e7b11..245a43920c7baf000ba63192a84a4c3f
  
    # Custom build tag.
    node_tag = ""
-@@ -64,10 +64,16 @@ declare_args() {
+@@ -64,10 +67,16 @@ declare_args() {
    # TODO(zcbenz): There are few broken things for now:
    #   1. cross-os compilation is not supported.
    #   2. node_mksnapshot crashes when cross-compiling for x64 from arm64.
@@ -55,10 +76,10 @@ index a2123cc6c6d21c53fafc8934203b3720393e7b11..245a43920c7baf000ba63192a84a4c3f
  
  assert(!node_enable_inspector || node_use_openssl,
 diff --git a/src/node_builtins.cc b/src/node_builtins.cc
-index defb657a62a0316224a02b68505ac1142fd89d03..d637faac88875bfa110e2b8d1f53962061d98279 100644
+index 092341dbfbabe15b15ed43057d399f754505f6fd..f14b45850e42585f5686b7201e2b8281ed8c24e1 100644
 --- a/src/node_builtins.cc
 +++ b/src/node_builtins.cc
-@@ -785,6 +785,7 @@ void BuiltinLoader::RegisterExternalReferences(
+@@ -788,6 +788,7 @@ void BuiltinLoader::RegisterExternalReferences(
    registry->Register(GetNatives);
  
    RegisterExternalReferencesForInternalizedBuiltinCode(registry);
@@ -80,10 +101,10 @@ index f9426599f2d5dc6ad061407f0c4eb2c9203a4433..302030f610965f07dd6998d282275c1b
  // Handles compilation and caching of built-in JavaScript modules and
  // bootstrap scripts, whose source are bundled into the binary as static data.
 diff --git a/tools/install.py b/tools/install.py
-index 17515720ba9c85d533465365188021074a8d30f4..92f83a83be67aafc9ead6923b868dbb0de39db34 100755
+index 8797b59e59c85a8877b977fa3281e50165e6f6b2..0af01e075616195f38fb242626dcab770ec1eb57 100755
 --- a/tools/install.py
 +++ b/tools/install.py
-@@ -212,6 +212,7 @@ def headers(options, action):
+@@ -222,6 +222,7 @@ def headers(options, action):
        'include/cppgc/internal/caged-heap-local-data.h',
        'include/cppgc/internal/caged-heap.h',
        'include/cppgc/internal/compiler-specific.h',
@@ -91,7 +112,7 @@ index 17515720ba9c85d533465365188021074a8d30f4..92f83a83be67aafc9ead6923b868dbb0
        'include/cppgc/internal/finalizer-trait.h',
        'include/cppgc/internal/gc-info.h',
        'include/cppgc/internal/logging.h',
-@@ -291,6 +292,7 @@ def headers(options, action):
+@@ -301,6 +302,7 @@ def headers(options, action):
        'include/v8-promise.h',
        'include/v8-proxy.h',
        'include/v8-regexp.h',
@@ -258,10 +279,22 @@ index 856878c33681a73d41016729dabe48b0a6a80589..91a11852d206b65485fe90fd037a0bd1
      if sys.platform == 'win32':
        files = [ x.replace('\\', '/') for x in files ]
 diff --git a/unofficial.gni b/unofficial.gni
-index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187f3c04c5c 100644
+index 44641b92678ab2f28e6f5de75a92878f9f3d322d..a6cfd45b109c7b38fcf1529468ff64d3c1c8bd1b 100644
 --- a/unofficial.gni
 +++ b/unofficial.gni
-@@ -142,32 +142,42 @@ template("node_gn_build") {
+@@ -22,6 +22,11 @@ template("node_gn_build") {
+     } else {
+       defines += [ "HAVE_OPENSSL=0" ]
+     }
++    if (node_use_sqlite) {
++      defines += [ "HAVE_SQLITE=1" ]
++    } else {
++      defines += [ "HAVE_SQLITE=0" ]
++    }
+     if (node_use_amaro) {
+       defines += [ "HAVE_AMARO=1" ]
+     } else {
+@@ -142,32 +147,41 @@ template("node_gn_build") {
      public_configs = [
        ":node_external_config",
        "deps/googletest:googletest_config",
@@ -284,7 +317,7 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
        "deps/nghttp2",
 -      "deps/ngtcp2",
        "deps/postject",
-       "deps/sqlite",
+-      "deps/sqlite",
        "deps/uvwasi",
 -      "deps/zstd",
        "//third_party/zlib",
@@ -307,7 +340,7 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
        "$target_gen_dir/node_javascript.cc",
      ] + gypi_values.node_sources
  
-@@ -190,7 +200,7 @@ template("node_gn_build") {
+@@ -190,9 +204,13 @@ template("node_gn_build") {
      }
      if (node_use_openssl) {
        deps += [ "deps/ncrypto" ]
@@ -315,8 +348,14 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
 +      public_deps += [ "//third_party/boringssl" ]
        sources += gypi_values.node_crypto_sources
      }
++    if (node_use_sqlite) {
++      deps += [ "deps/sqlite" ]
++      sources += gypi_values.node_sqlite_sources
++    }
      if (node_enable_inspector) {
-@@ -214,6 +224,10 @@ template("node_gn_build") {
+       deps += [
+         "src/inspector:crdtp",
+@@ -214,6 +232,10 @@ template("node_gn_build") {
      }
    }
  
@@ -327,7 +366,7 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
    executable(target_name) {
      forward_variables_from(invoker, "*")
  
-@@ -288,6 +302,7 @@ template("node_gn_build") {
+@@ -288,6 +310,7 @@ template("node_gn_build") {
    }
  
    executable("node_js2c") {
@@ -335,7 +374,7 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
      deps = [
        "deps/uv",
        "$node_simdutf_path",
-@@ -298,26 +313,75 @@ template("node_gn_build") {
+@@ -298,26 +321,75 @@ template("node_gn_build") {
        "src/embedded_data.cc",
        "src/embedded_data.h",
      ]
@@ -421,7 +460,7 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
      outputs = [ "$target_gen_dir/node_javascript.cc" ]
  
      # Get the path to node_js2c executable of the host toolchain.
-@@ -331,11 +395,11 @@ template("node_gn_build") {
+@@ -331,11 +403,11 @@ template("node_gn_build") {
          get_label_info(":node_js2c($host_toolchain)", "name") +
          host_executable_suffix
  

patches/node/build_allow_unbundling_of_node_js_dependencies.patch

@@ -14,10 +14,10 @@ We don't need to do this for zlib, as the existing gn workflow uses the same
 Upstreamed at https://github.com/nodejs/node/pull/55903
 
 diff --git a/unofficial.gni b/unofficial.gni
-index e17e4f043af6e4047ab82723ffd83187f3c04c5c..d591dfc99fdea4f830008502786ee44d863a31fc 100644
+index a6cfd45b109c7b38fcf1529468ff64d3c1c8bd1b..332c9ee7262108ae9616e9bc8bd950a4940a858c 100644
 --- a/unofficial.gni
 +++ b/unofficial.gni
-@@ -155,7 +155,6 @@ template("node_gn_build") {
+@@ -160,7 +160,6 @@ template("node_gn_build") {
        ":run_node_js2c",
        "deps/cares",
        "deps/histogram",
@@ -25,7 +25,7 @@ index e17e4f043af6e4047ab82723ffd83187f3c04c5c..d591dfc99fdea4f830008502786ee44d
        "deps/nbytes",
        "deps/nghttp2",
        "deps/postject",
-@@ -194,7 +193,17 @@ template("node_gn_build") {
+@@ -198,7 +197,17 @@ template("node_gn_build") {
        configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
        configs += [ "//build/config/gcc:symbol_visibility_default" ]
      }
@@ -44,7 +44,7 @@ index e17e4f043af6e4047ab82723ffd83187f3c04c5c..d591dfc99fdea4f830008502786ee44d
      if (v8_enable_i18n_support) {
        deps += [ "//third_party/icu" ]
      }
-@@ -222,6 +231,19 @@ template("node_gn_build") {
+@@ -230,6 +239,19 @@ template("node_gn_build") {
        sources += node_inspector.node_inspector_sources +
                   node_inspector.node_inspector_generated_sources
      }

patches/node/build_change_crdtp_protocoltypetraits_signatures_to_avoid_conflict.patch

@@ -1,6 +1,6 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Shelley Vohr <shelley.vohr@gmail.com>
-Date: Wed, 12 Feb 2025 15:31:07 +0100
+Date: Thu, 26 Jun 2025 09:25:24 +0000
 Subject: build: change crdtp::ProtocolTypeTraits signatures to avoid conflict
 
 After https://github.com/nodejs/node/pull/56649 we see conflicts with the
@@ -14,7 +14,7 @@ error: duplicate symbol: crdtp::ProtocolTypeTraits<std::__Cr::basic_string<char,
 Some distinguishing change should be upstreamed to Node.js.
 
 diff --git a/src/inspector/node_string.cc b/src/inspector/node_string.cc
-index 6db4bee1072bfe911a4179c3edb2bbaf18f1a182..c603f95f1f93438bd55bce3ff7f5bb314eb33666 100644
+index 8521730bd03cdfce47e9b5d0f5d68a568bc3de8c..28f4598aa7ea0e93350f79566c06d0f08313be9f 100644
 --- a/src/inspector/node_string.cc
 +++ b/src/inspector/node_string.cc
 @@ -7,7 +7,8 @@
@@ -27,7 +27,7 @@ index 6db4bee1072bfe911a4179c3edb2bbaf18f1a182..c603f95f1f93438bd55bce3ff7f5bb31
    if (state->tokenizer()->TokenTag() == cbor::CBORTokenTag::STRING8) {
      span<uint8_t> cbor_span = state->tokenizer()->GetString8();
      value->assign(reinterpret_cast<const char*>(cbor_span.data()),
-@@ -24,12 +25,13 @@ bool ProtocolTypeTraits<std::string>::Deserialize(DeserializerState* state,
+@@ -24,7 +25,8 @@ bool ProtocolTypeTraits<std::string>::Deserialize(DeserializerState* state,
  }
  
  void ProtocolTypeTraits<std::string>::Serialize(const std::string& value,
@@ -36,18 +36,12 @@ index 6db4bee1072bfe911a4179c3edb2bbaf18f1a182..c603f95f1f93438bd55bce3ff7f5bb31
 +                                                void* extra) {
    cbor::EncodeString8(SpanFrom(value), bytes);
  }
--
- }  // namespace crdtp
  
-+
- namespace node {
- namespace inspector {
- namespace protocol {
 diff --git a/src/inspector/node_string.h b/src/inspector/node_string.h
-index 38cf96e874dcc49cde87137b2737c35a84f418d0..b2f67c224acc7b3a3b867867e251a7c62833f46e 100644
+index 94ec9b2301998c4c5aad9ca3dae72ecf323fa0bb..a0d19a592d7bf9b00d6b98ef1ae931626ebb945c 100644
 --- a/src/inspector/node_string.h
 +++ b/src/inspector/node_string.h
-@@ -15,8 +15,8 @@ namespace crdtp {
+@@ -19,8 +19,8 @@ namespace crdtp {
  
  template <>
  struct ProtocolTypeTraits<std::string> {
@@ -57,4 +51,4 @@ index 38cf96e874dcc49cde87137b2737c35a84f418d0..b2f67c224acc7b3a3b867867e251a7c6
 +  static void Serialize(const std::string& value, std::vector<uint8_t>* bytes, void* extra = nullptr);
  };
  
- }  // namespace crdtp
+ template <>

patches/node/build_compile_with_c_20_support.patch

@@ -10,10 +10,10 @@ V8 requires C++20 support as of https://chromium-review.googlesource.com/c/v8/v8
 This can be removed when Electron upgrades to a version of Node.js containing the required V8 version.
 
 diff --git a/common.gypi b/common.gypi
-index f3476a91e4c3cda7cecf49e07bb594a167ac46ef..de73f6c18131f43e6fe3107c866599aa3398cf10 100644
+index acfc02510ee1ce34a3f410a7a4ce53adb42abd35..b9264bfb1170928431848bb2b99e4f0dfbe8f95a 100644
 --- a/common.gypi
 +++ b/common.gypi
-@@ -530,7 +530,7 @@
+@@ -538,7 +538,7 @@
            '-fno-rtti',
            '-fno-exceptions',
            '-fno-strict-aliasing',
@@ -22,7 +22,7 @@ index f3476a91e4c3cda7cecf49e07bb594a167ac46ef..de73f6c18131f43e6fe3107c866599aa
          ],
          'defines': [ '__STDC_FORMAT_MACROS' ],
          'ldflags': [ '-rdynamic' ],
-@@ -700,7 +700,7 @@
+@@ -708,7 +708,7 @@
            ['clang==1', {
              'xcode_settings': {
                'GCC_VERSION': 'com.apple.compilers.llvm.clang.1_0',

patches/node/build_enable_perfetto.patch

@@ -64,10 +64,10 @@ index 251f51ec454f9cba4023b8b6729241ee753aac13..1de8cac6e3953ce9cab9db03530da327
  
  module.exports = {
 diff --git a/node.gyp b/node.gyp
-index ad010a8d99cf08013b7202eddce66e5b3885652d..d735b887d05ddfadec8e56dd8eae09646890aa84 100644
+index 0434887c363a586cbfa0438765fc8800d4237057..20fbf03cee24e66f9ad0d394dbcfa3ad03348890 100644
 --- a/node.gyp
 +++ b/node.gyp
-@@ -176,7 +176,6 @@
+@@ -175,7 +175,6 @@
        'src/timers.cc',
        'src/timer_wrap.cc',
        'src/tracing/agent.cc',
@@ -75,7 +75,7 @@ index ad010a8d99cf08013b7202eddce66e5b3885652d..d735b887d05ddfadec8e56dd8eae0964
        'src/tracing/node_trace_writer.cc',
        'src/tracing/trace_event.cc',
        'src/tracing/traced_value.cc',
-@@ -305,7 +304,6 @@
+@@ -302,7 +301,6 @@
        'src/tcp_wrap.h',
        'src/timers.h',
        'src/tracing/agent.h',

patches/node/build_ensure_native_module_compilation_fails_if_not_using_a_new.patch

@@ -7,10 +7,10 @@ Subject: build: ensure native module compilation fails if not using a new
 This should not be upstreamed, it is a quality-of-life patch for downstream module builders.
 
 diff --git a/common.gypi b/common.gypi
-index d9c0b721fe0a629a30efb3c4e04905176ca0a7f5..f3476a91e4c3cda7cecf49e07bb594a167ac46ef 100644
+index cf643bcd0bc9080b80bf12afeebc69f2db74bb54..acfc02510ee1ce34a3f410a7a4ce53adb42abd35 100644
 --- a/common.gypi
 +++ b/common.gypi
-@@ -88,6 +88,8 @@
+@@ -89,6 +89,8 @@
      'v8_use_perfetto': 0,
      'tsan%': 0,
  
@@ -19,15 +19,17 @@ index d9c0b721fe0a629a30efb3c4e04905176ca0a7f5..f3476a91e4c3cda7cecf49e07bb594a1
      ##### end V8 defaults #####
  
      # When building native modules using 'npm install' with the system npm,
-@@ -293,6 +295,7 @@
-     # Defines these mostly for node-gyp to pickup.
-     'defines': [
+@@ -297,7 +299,8 @@
        '_GLIBCXX_USE_CXX11_ABI=1',
+       # This help forks when building Node.js on a 32-bit arch as
+       # libuv is always compiled with _FILE_OFFSET_BITS=64
+-      '_FILE_OFFSET_BITS=64'
++      '_FILE_OFFSET_BITS=64',
 +      'ELECTRON_ENSURE_CONFIG_GYPI',
      ],
  
      # Forcibly disable -Werror.  We support a wide range of compilers, it's
-@@ -449,6 +452,11 @@
+@@ -454,6 +457,11 @@
            }],
          ],
        }],
@@ -40,10 +42,10 @@ index d9c0b721fe0a629a30efb3c4e04905176ca0a7f5..f3476a91e4c3cda7cecf49e07bb594a1
        # list in v8/BUILD.gn.
        ['v8_enable_v8_checks == 1', {
 diff --git a/configure.py b/configure.py
-index 932484674e5b15b765b8bfe307bdf99b49b5039f..befaa85527b9ebebad226e603586e23d04ec1e51 100755
+index e9c2a4391f4058a21a259cacaac4fde5d199288e..7821a0d3a7179a9e7fa9e48a062c2b0e7705ca6f 100755
 --- a/configure.py
 +++ b/configure.py
-@@ -1698,6 +1698,7 @@ def configure_library(lib, output, pkgname=None):
+@@ -1704,6 +1704,7 @@ def configure_library(lib, output, pkgname=None):
  def configure_v8(o, configs):
    set_configuration_variable(configs, 'v8_enable_v8_checks', release=1, debug=0)
  

patches/node/build_modify_js2c_py_to_allow_injection_of_original-fs_and_custom_embedder_js.patch

@@ -34,7 +34,7 @@ index 411eab8136d5957ae8a491bc38ffbdc88e59f5da..63c93b5be09692d0d4b6bfbb214b173b
  let kResistStopPropagation;
  
 diff --git a/src/node_builtins.cc b/src/node_builtins.cc
-index d637faac88875bfa110e2b8d1f53962061d98279..e0b58c4d0ac5640a677c22d710f88f1b318378d7 100644
+index f14b45850e42585f5686b7201e2b8281ed8c24e1..915b8cba6d512096e6090272ab3fbc63d5c61ce8 100644
 --- a/src/node_builtins.cc
 +++ b/src/node_builtins.cc
 @@ -35,6 +35,7 @@ using v8::Value;

patches/node/build_option_to_use_custom_inspector_protocol_path.patch

@@ -12,7 +12,7 @@ protocol deps to contain https://chromium-review.googlesource.com/c/v8/v8/+/5996
 Rest of the changes can be upstreamed.
 
 diff --git a/node.gni b/node.gni
-index 203b4abbc44df9e58083c819f61f9025104abdc6..73bf3839866a2652ca660f1117e8f249d33fa46a 100644
+index 165b26a79a7f2b74d2a2252dc2350b2e10c091e6..c64761b730e61edcdc0e46a48699f2fd5bb1c0a6 100644
 --- a/node.gni
 +++ b/node.gni
 @@ -16,6 +16,9 @@ declare_args() {
@@ -25,32 +25,6 @@ index 203b4abbc44df9e58083c819f61f9025104abdc6..73bf3839866a2652ca660f1117e8f249
    # The NODE_MODULE_VERSION defined in node_version.h.
    node_module_version = exec_script("$node_path/tools/getmoduleversion.py", [], "value")
  
-diff --git a/src/inspector/node_json.cc b/src/inspector/node_json.cc
-index d8aacbdf1a8fc858c792ad3ce17ca2f46baebe7e..4625008c048532c2c3340130670647d2877430bd 100644
---- a/src/inspector/node_json.cc
-+++ b/src/inspector/node_json.cc
-@@ -72,7 +72,7 @@ class ValueParserHandler : public ParserHandler {
- 
-   void HandleBinary(span<uint8_t> bytes) override {
-     AddValueToParent(
--        BinaryValue::create(Binary::fromSpan(bytes.data(), bytes.size())));
-+        BinaryValue::create(Binary::fromSpan(bytes)));
-   }
- 
-   void HandleDouble(double value) override {
-diff --git a/src/inspector/node_string.h b/src/inspector/node_string.h
-index b2f67c224acc7b3a3b867867e251a7c62833f46e..33e93ce5bf7dda7e30b7b1b198ff3b53ccfac22a 100644
---- a/src/inspector/node_string.h
-+++ b/src/inspector/node_string.h
-@@ -66,7 +66,7 @@ class Binary {
-   static Binary fromBase64(const std::string_view base64, bool* success) {
-     UNREACHABLE();
-   }
--  static Binary fromSpan(const uint8_t* data, size_t size) { UNREACHABLE(); }
-+  static Binary fromSpan(crdtp::span<const uint8_t> data) { UNREACHABLE(); }
- };
- 
- }  // namespace protocol
 diff --git a/src/inspector/unofficial.gni b/src/inspector/unofficial.gni
 index 3d7aa148678b2646b88fa7c32abec91791b02b82..4810d93eb971b253f7dadff7011a632f6dbe6a2b 100644
 --- a/src/inspector/unofficial.gni
@@ -65,10 +39,10 @@ index 3d7aa148678b2646b88fa7c32abec91791b02b82..4810d93eb971b253f7dadff7011a632f
    gypi_values = exec_script(
        "../../tools/gypi_to_gn.py",
 diff --git a/unofficial.gni b/unofficial.gni
-index d591dfc99fdea4f830008502786ee44d863a31fc..9e26399482d6a1cdb843efb72c152d5cdd5e08ea 100644
+index 332c9ee7262108ae9616e9bc8bd950a4940a858c..8886f2a79ae77614789d6ae0defd4f18fc756456 100644
 --- a/unofficial.gni
 +++ b/unofficial.gni
-@@ -214,13 +214,14 @@ template("node_gn_build") {
+@@ -222,13 +222,14 @@ template("node_gn_build") {
      }
      if (node_enable_inspector) {
        deps += [

patches/node/build_restore_clang_as_default_compiler_on_macos.patch

@@ -11,10 +11,10 @@ node-gyp will use the result of `process.config` that reflects the environment
 in which the binary got built.
 
 diff --git a/common.gypi b/common.gypi
-index de73f6c18131f43e6fe3107c866599aa3398cf10..e2171e14b9e29dfc3c629f8164545d56d5e9057e 100644
+index b9264bfb1170928431848bb2b99e4f0dfbe8f95a..836d96a1bd9c1d5568f0045bbddddca1edb1a0ce 100644
 --- a/common.gypi
 +++ b/common.gypi
-@@ -127,6 +127,7 @@
+@@ -128,6 +128,7 @@
          'v8_base': '<(PRODUCT_DIR)/obj.target/tools/v8_gypfiles/libv8_snapshot.a',
        }],
        ['OS=="mac"', {

patches/node/build_use_third_party_simdutf.patch

@@ -1,20 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Charles Kerr <charles@charleskerr.com>
-Date: Mon, 9 Dec 2024 11:18:51 -0600
-Subject: build: use third_party/simdutf
-
-use the Chromium version of simdutf to avoid duplicate symbols
-
-diff --git a/node.gni b/node.gni
-index 56a554175b805c1703f13d62041f8c80d6e94dd9..203b4abbc44df9e58083c819f61f9025104abdc6 100644
---- a/node.gni
-+++ b/node.gni
-@@ -14,7 +14,7 @@ declare_args() {
-   node_openssl_path = "//third_party/boringssl"
- 
-   # The location of simdutf - use the one from node's deps by default.
--  node_simdutf_path = "$node_path/deps/simdutf"
-+  node_simdutf_path = "//third_party/simdutf"
- 
-   # The NODE_MODULE_VERSION defined in node_version.h.
-   node_module_version = exec_script("$node_path/tools/getmoduleversion.py", [], "value")

patches/node/chore_disable_deprecation_ftbfs_in_simdjson_header.patch

@@ -11,10 +11,10 @@ Without this patch, building with simdjson fails with
 This patch can be removed once this is fixed upstream in simdjson.
 
 diff --git a/deps/simdjson/simdjson.h b/deps/simdjson/simdjson.h
-index c1535ee81300b9cb93eb9ee6e769246793f936c3..3350287401e181e1d4ee432b8bd16081d0d7a73e 100644
+index a0d449975224a3e0db5c05de79b290763d6e390c..e77e47f972b4609e38aa8b68ab0d81ed1575effb 100644
 --- a/deps/simdjson/simdjson.h
 +++ b/deps/simdjson/simdjson.h
-@@ -3837,12 +3837,17 @@ inline std::ostream& operator<<(std::ostream& out, simdjson_result<padded_string
+@@ -3868,12 +3868,17 @@ inline std::ostream& operator<<(std::ostream& out, simdjson_result<padded_string
  
  } // namespace simdjson
  
@@ -32,7 +32,7 @@ index c1535ee81300b9cb93eb9ee6e769246793f936c3..3350287401e181e1d4ee432b8bd16081
  namespace simdjson {
  namespace internal {
  
-@@ -4242,6 +4247,9 @@ inline simdjson_result<padded_string> padded_string::load(std::string_view filen
+@@ -4273,6 +4278,9 @@ inline simdjson_result<padded_string> padded_string::load(std::string_view filen
  
  } // namespace simdjson
  
@@ -42,7 +42,7 @@ index c1535ee81300b9cb93eb9ee6e769246793f936c3..3350287401e181e1d4ee432b8bd16081
  inline simdjson::padded_string operator ""_padded(const char *str, size_t len) {
    return simdjson::padded_string(str, len);
  }
-@@ -4250,6 +4258,8 @@ inline simdjson::padded_string operator ""_padded(const char8_t *str, size_t len
+@@ -4281,6 +4289,8 @@ inline simdjson::padded_string operator ""_padded(const char8_t *str, size_t len
    return simdjson::padded_string(reinterpret_cast<const char8_t *>(str), len);
  }
  #endif

patches/node/chore_expose_importmoduledynamically_and.patch

@@ -11,7 +11,7 @@ its own blended handler between Node and Blink.
 Not upstreamable.
 
 diff --git a/lib/internal/modules/esm/utils.js b/lib/internal/modules/esm/utils.js
-index fd17ce8695c55f8f38ed19d59960acc1a7692bc8..96754db3277b3a0445b69275368602166c6d5423 100644
+index 9d6f850f667c5186efe6855bc3d5f5af332bdaa7..8521759e20adf53024e5893dbf3cb36e1752085e 100644
 --- a/lib/internal/modules/esm/utils.js
 +++ b/lib/internal/modules/esm/utils.js
 @@ -30,7 +30,7 @@ const {
@@ -40,10 +40,10 @@ index fd17ce8695c55f8f38ed19d59960acc1a7692bc8..96754db3277b3a0445b6927536860216
  
  /**
 diff --git a/src/module_wrap.cc b/src/module_wrap.cc
-index 912acc8da815405531d8b527383f19c3731be100..8d48f4693c3b5f0d1d94d3edadc48c4f36d1bf97 100644
+index cdd0ba00eb0cafbc79b816017423f9021ca2979d..6916497f6feb14e482cf5080b57d639ae7292d20 100644
 --- a/src/module_wrap.cc
 +++ b/src/module_wrap.cc
-@@ -858,7 +858,7 @@ MaybeLocal<Module> ModuleWrap::ResolveModuleCallback(
+@@ -875,7 +875,7 @@ MaybeLocal<Module> ModuleWrap::ResolveModuleCallback(
    return module->module_.Get(isolate);
  }
  
@@ -52,7 +52,7 @@ index 912acc8da815405531d8b527383f19c3731be100..8d48f4693c3b5f0d1d94d3edadc48c4f
      Local<Context> context,
      Local<Data> host_defined_options,
      Local<Value> resource_name,
-@@ -923,12 +923,13 @@ void ModuleWrap::SetImportModuleDynamicallyCallback(
+@@ -947,12 +947,13 @@ void ModuleWrap::SetImportModuleDynamicallyCallback(
    Realm* realm = Realm::GetCurrent(args);
    HandleScope handle_scope(isolate);
  
@@ -68,7 +68,7 @@ index 912acc8da815405531d8b527383f19c3731be100..8d48f4693c3b5f0d1d94d3edadc48c4f
  }
  
  void ModuleWrap::HostInitializeImportMetaObjectCallback(
-@@ -970,13 +971,14 @@ void ModuleWrap::SetInitializeImportMetaObjectCallback(
+@@ -994,13 +995,14 @@ void ModuleWrap::SetInitializeImportMetaObjectCallback(
    Realm* realm = Realm::GetCurrent(args);
    Isolate* isolate = realm->isolate();
  
@@ -87,7 +87,7 @@ index 912acc8da815405531d8b527383f19c3731be100..8d48f4693c3b5f0d1d94d3edadc48c4f
  
  MaybeLocal<Value> ModuleWrap::SyntheticModuleEvaluationStepsCallback(
 diff --git a/src/module_wrap.h b/src/module_wrap.h
-index 83b5793013cbc453cf92c0a006fc7be3c06ad276..90353954bc497cb4ae413dc134850f8abb4efc7c 100644
+index ef4dfd1d6b091d2b0f71b946904a47415b6435ba..862f946a75f2a2949d7eeb7f97e96289beab8078 100644
 --- a/src/module_wrap.h
 +++ b/src/module_wrap.h
 @@ -8,6 +8,7 @@
@@ -123,7 +123,7 @@ index 83b5793013cbc453cf92c0a006fc7be3c06ad276..90353954bc497cb4ae413dc134850f8a
   private:
    ModuleWrap(Realm* realm,
               v8::Local<v8::Object> object,
-@@ -129,7 +139,6 @@ class ModuleWrap : public BaseObject {
+@@ -130,7 +140,6 @@ class ModuleWrap : public BaseObject {
        v8::Local<v8::String> specifier,
        v8::Local<v8::FixedArray> import_attributes,
        v8::Local<v8::Module> referrer);

patches/node/chore_remove_protocol_maybe_from_node_string.patch

@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shelley Vohr <shelley.vohr@gmail.com>
+Date: Thu, 26 Jun 2025 09:20:43 +0000
+Subject: chore: remove protocol::Maybe from node_string
+
+It was removed upstream in https://chromium-review.googlesource.com/c/chromium/src/+/6049967.
+
+This should be upstreamed.
+
+diff --git a/src/inspector/node_string.h b/src/inspector/node_string.h
+index a0d19a592d7bf9b00d6b98ef1ae931626ebb945c..ddedca4a5b9b35258050f8b4cb446ceeba956896 100644
+--- a/src/inspector/node_string.h
++++ b/src/inspector/node_string.h
+@@ -6,7 +6,6 @@
+ #include <cstring>
+ #include <sstream>
+ #include <string>
+-#include "crdtp/maybe.h"
+ #include "crdtp/protocol_core.h"
+ #include "util.h"
+ #include "v8-inspector.h"
+@@ -31,11 +30,6 @@ struct ProtocolTypeTraits<node::inspector::protocol::Binary> {
+                         std::vector<uint8_t>* bytes);
+ };
+ 
+-template <>
+-struct detail::MaybeTypedef<node::inspector::protocol::Binary> {
+-  typedef ValueMaybe<node::inspector::protocol::Binary> type;
+-};
+-
+ }  // namespace crdtp
+ 
+ namespace node {

patches/node/cli_move_--trace-atomics-wait_to_eol.patch

@@ -15,10 +15,10 @@ Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index 121d8f2bbd2b1d93067a06a902b1e7b986bcdb49..3460ad33c6186dcc3aa3281d80b723a1cc1d50dd 100644
+index d924287df3ca29681cf71e2fbd402314ce8edd97..f2f4d25a838b9758234cd667b0fb537d0d0fcced 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -3367,7 +3367,6 @@ one is included in the list below.
+@@ -3386,7 +3386,6 @@ one is included in the list below.
  * `--tls-min-v1.1`
  * `--tls-min-v1.2`
  * `--tls-min-v1.3`
@@ -43,7 +43,7 @@ index 663d123ac728f097e8a76c94cf10c53d059983d7..497f5a61182beafbaa26b94518105635
  Print stack traces for deprecations.
  .
 diff --git a/src/node.cc b/src/node.cc
-index 6f8f6386d0db8aef1e2e0126cc9064101cbe6112..bc670a6c8b5027417cdc35e1cd94a60f63fd342d 100644
+index 0c2a4d344c991c2ca0d9d90934cf7921abf2a629..19d9fb77f1aaf003e43b7d7016f45e6c35df06b3 100644
 --- a/src/node.cc
 +++ b/src/node.cc
 @@ -232,44 +232,6 @@ void Environment::WaitForInspectorFrontendByOptions() {
@@ -110,10 +110,10 @@ index 6f8f6386d0db8aef1e2e0126cc9064101cbe6112..bc670a6c8b5027417cdc35e1cd94a60f
      isolate_->SetPromiseHook(TracePromises);
    }
 diff --git a/src/node_options.cc b/src/node_options.cc
-index a9500716f2a955fc591628a969c5fba40783a2e7..b153d2c6a771e80bcdf5ed6adbc1cd225b3bf97e 100644
+index 9829b0b2b2d013b93ac14d3ec6d46c35abcc4635..5fb2e713a50185b997935cb15fddd7b8b65a5b82 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
-@@ -770,10 +770,6 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
+@@ -773,10 +773,6 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
              "throw an exception on deprecations",
              &EnvironmentOptions::throw_deprecation,
              kAllowedInEnvvar);
@@ -125,10 +125,10 @@ index a9500716f2a955fc591628a969c5fba40783a2e7..b153d2c6a771e80bcdf5ed6adbc1cd22
              "show stack traces on deprecations",
              &EnvironmentOptions::trace_deprecation,
 diff --git a/src/node_options.h b/src/node_options.h
-index 60068b008b2e2a034c3f0c58b947a8d04d55e3b2..d821bc6a9adf28ea312a9c446f8acfc8ed586ae3 100644
+index eb18fdd617fd19e5b97cd67f351e70c28fee3e75..216c0f92167bd131e5ef2ea96ad47425ff51c3f7 100644
 --- a/src/node_options.h
 +++ b/src/node_options.h
-@@ -203,7 +203,6 @@ class EnvironmentOptions : public Options {
+@@ -204,7 +204,6 @@ class EnvironmentOptions : public Options {
    std::vector<std::string> coverage_include_pattern;
    std::vector<std::string> coverage_exclude_pattern;
    bool throw_deprecation = false;

patches/node/cli_remove_deprecated_v8_flag.patch

@@ -18,10 +18,10 @@ Reviewed-By: Michaël Zasso <targos@protonmail.com>
 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index 6f984926a62973ba36bd3c27cc39b01f2bcac819..121d8f2bbd2b1d93067a06a902b1e7b986bcdb49 100644
+index cc311472678108f21eed70281e91b0d40c5fe7b6..d924287df3ca29681cf71e2fbd402314ce8edd97 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -3404,7 +3404,6 @@ V8 options that are allowed are:
+@@ -3423,7 +3423,6 @@ V8 options that are allowed are:
  * `--disallow-code-generation-from-strings`
  * `--enable-etw-stack-walking`
  * `--expose-gc`
@@ -30,10 +30,10 @@ index 6f984926a62973ba36bd3c27cc39b01f2bcac819..121d8f2bbd2b1d93067a06a902b1e7b9
  * `--jitless`
  * `--max-old-space-size`
 diff --git a/src/node_options.cc b/src/node_options.cc
-index bb1e80ece4158dfed1b8bab7dc6d00dd56505aac..a9500716f2a955fc591628a969c5fba40783a2e7 100644
+index d2e945b1d6ef6729709cc73c238cfae46d4e56b6..9829b0b2b2d013b93ac14d3ec6d46c35abcc4635 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
-@@ -992,11 +992,6 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
+@@ -995,11 +995,6 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
              "disallow eval and friends",
              V8Option{},
              kAllowedInEnvvar);

patches/node/enable_crashpad_linux_node_processes.patch

@@ -8,10 +8,10 @@ to child processes spawned with `ELECTRON_RUN_AS_NODE` which is used
 by the crashpad client to connect with the handler process.
 
 diff --git a/lib/child_process.js b/lib/child_process.js
-index bb27670112c1ea42c7ff00883fe4b684544d9cd4..4d4da798ce59ce42e42d1f05fccf07699c033d46 100644
+index e848b3d5ee9b13ea3ea303eb3b57ef47ef951580..5b89c420f1a917526ab311fed52bff01637a86fe 100644
 --- a/lib/child_process.js
 +++ b/lib/child_process.js
-@@ -61,6 +61,7 @@ let debug = require('internal/util/debuglog').debuglog(
+@@ -62,6 +62,7 @@ let debug = require('internal/util/debuglog').debuglog(
  );
  const { Buffer } = require('buffer');
  const { Pipe, constants: PipeConstants } = internalBinding('pipe_wrap');
@@ -19,7 +19,7 @@ index bb27670112c1ea42c7ff00883fe4b684544d9cd4..4d4da798ce59ce42e42d1f05fccf0769
  
  const {
    AbortError,
-@@ -153,7 +154,6 @@ function fork(modulePath, args = [], options) {
+@@ -154,7 +155,6 @@ function fork(modulePath, args = [], options) {
        ArrayPrototypeSplice(execArgv, index - 1, 2);
      }
    }
@@ -27,7 +27,7 @@ index bb27670112c1ea42c7ff00883fe4b684544d9cd4..4d4da798ce59ce42e42d1f05fccf0769
    args = [...execArgv, modulePath, ...args];
  
    if (typeof options.stdio === 'string') {
-@@ -609,6 +609,22 @@ function normalizeSpawnArguments(file, args, options) {
+@@ -610,6 +610,22 @@ function normalizeSpawnArguments(file, args, options) {
                      'options.windowsVerbatimArguments');
    }
  
@@ -50,7 +50,7 @@ index bb27670112c1ea42c7ff00883fe4b684544d9cd4..4d4da798ce59ce42e42d1f05fccf0769
    if (options.shell) {
      validateArgumentNullCheck(options.shell, 'options.shell');
      const command = ArrayPrototypeJoin([file, ...args], ' ');
-@@ -642,7 +658,6 @@ function normalizeSpawnArguments(file, args, options) {
+@@ -643,7 +659,6 @@ function normalizeSpawnArguments(file, args, options) {
      ArrayPrototypeUnshift(args, file);
    }
  

patches/node/expose_get_builtin_module_function.patch

@@ -9,10 +9,10 @@ modules to sandboxed renderers.
 TODO(codebytere): remove and replace with a public facing API.
 
 diff --git a/src/node_binding.cc b/src/node_binding.cc
-index 6c337232149ccb8bdb1188e72d59a052b1cb79c1..44ad4a480a33a2c39494a7d961318270a25620d8 100644
+index aa4213c3622eab077fa8d764775c1f95c6313e34..11f722d2d7c21079cbc65033429086231a786ca7 100644
 --- a/src/node_binding.cc
 +++ b/src/node_binding.cc
-@@ -653,6 +653,10 @@ void GetInternalBinding(const FunctionCallbackInfo<Value>& args) {
+@@ -652,6 +652,10 @@ void GetInternalBinding(const FunctionCallbackInfo<Value>& args) {
    args.GetReturnValue().Set(exports);
  }
  
@@ -24,10 +24,10 @@ index 6c337232149ccb8bdb1188e72d59a052b1cb79c1..44ad4a480a33a2c39494a7d961318270
    Environment* env = Environment::GetCurrent(args);
  
 diff --git a/src/node_binding.h b/src/node_binding.h
-index eb1364cb01a2bea52bce768056e73b0f3a86ae35..d421a2773403e7b22fcca2fcf8275ef2d9654c55 100644
+index 611f38ef5e21cc303127326d50c648fbb557b4da..3d95ad2733dc83d0b7d37d57c337732c8a0e83d7 100644
 --- a/src/node_binding.h
 +++ b/src/node_binding.h
-@@ -146,6 +146,8 @@ void GetInternalBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
+@@ -154,6 +154,8 @@ void GetInternalBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
  void GetLinkedBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
  void DLOpen(const v8::FunctionCallbackInfo<v8::Value>& args);
  

patches/node/feat_add_uv_loop_interrupt_on_io_change_option_to_uv_loop_configure.patch

@@ -23,10 +23,10 @@ index d1f41e1c9f44838410326df23b1b175fa16ba199..dcf69093469b611a6f9db2bb84530456
        asynchronous file system operations.
  
 diff --git a/deps/uv/include/uv.h b/deps/uv/include/uv.h
-index 9e450c5110fe57117b686bf683cc6631f37efaeb..f75a496071ac3396cbc6dec819eaab7294609deb 100644
+index 938e998fdc54d17c8d0d4b1949087b968044829f..0295eeddbb4eb1cffd9dbcd02e037907fadc1b7e 100644
 --- a/deps/uv/include/uv.h
 +++ b/deps/uv/include/uv.h
-@@ -261,6 +261,7 @@ typedef struct uv_metrics_s uv_metrics_t;
+@@ -263,6 +263,7 @@ typedef struct uv_metrics_s uv_metrics_t;
  typedef enum {
    UV_LOOP_BLOCK_SIGNAL = 0,
    UV_METRICS_IDLE_TIME,
@@ -35,18 +35,27 @@ index 9e450c5110fe57117b686bf683cc6631f37efaeb..f75a496071ac3396cbc6dec819eaab72
  #define UV_LOOP_USE_IO_URING_SQPOLL UV_LOOP_USE_IO_URING_SQPOLL
  } uv_loop_option;
 diff --git a/deps/uv/src/unix/async.c b/deps/uv/src/unix/async.c
-index 0ff2669e30a628dbb2df9e28ba14b38cf14114e5..117190ef26338944b78dbed7380c631de8057223 100644
+index 538ae7876f2b2463716459b179d74843383295be..6ce53f12834c7a34241ea0865bda99af0541ea5f 100644
 --- a/deps/uv/src/unix/async.c
 +++ b/deps/uv/src/unix/async.c
-@@ -38,7 +38,6 @@
- #include <sys/eventfd.h>
+@@ -40,7 +40,7 @@
+ 
+ #if UV__KQUEUE_EVFILT_USER
+ static uv_once_t kqueue_runtime_detection_guard = UV_ONCE_INIT;
+-static int kqueue_evfilt_user_support = 1;
++int kqueue_evfilt_user_support = 1;
+ 
+ 
+ static void uv__kqueue_runtime_detection(void) {
+@@ -66,7 +66,6 @@ static void uv__kqueue_runtime_detection(void) {
+ }
  #endif
  
 -static void uv__async_send(uv_loop_t* loop);
  static int uv__async_start(uv_loop_t* loop);
  static void uv__cpu_relax(void);
  
-@@ -78,7 +77,7 @@ int uv_async_send(uv_async_t* handle) {
+@@ -106,7 +105,7 @@ int uv_async_send(uv_async_t* handle) {
  
    /* Wake up the other thread's event loop. */
    if (atomic_exchange(pending, 1) == 0)
@@ -55,7 +64,7 @@ index 0ff2669e30a628dbb2df9e28ba14b38cf14114e5..117190ef26338944b78dbed7380c631d
  
    /* Set the loop to not-busy. */
    atomic_fetch_add(busy, -1);
-@@ -178,39 +177,6 @@ static void uv__async_io(uv_loop_t* loop, uv__io_t* w, unsigned int events) {
+@@ -210,50 +209,6 @@ static void uv__async_io(uv_loop_t* loop, uv__io_t* w, unsigned int events) {
  }
  
  
@@ -76,6 +85,17 @@ index 0ff2669e30a628dbb2df9e28ba14b38cf14114e5..117190ef26338944b78dbed7380c631d
 -    len = sizeof(val);
 -    fd = loop->async_io_watcher.fd;  /* eventfd */
 -  }
+-#elif UV__KQUEUE_EVFILT_USER
+-  struct kevent ev;
+-
+-  if (kqueue_evfilt_user_support) {
+-    fd = loop->async_io_watcher.fd; /* magic number for EVFILT_USER */
+-    EV_SET(&ev, fd, EVFILT_USER, 0, NOTE_TRIGGER, 0, 0);
+-    r = kevent(loop->backend_fd, &ev, 1, NULL, 0, NULL);
+-    if (r == 0)
+-      return;
+-    abort();
+-  }
 -#endif
 -
 -  do
@@ -96,20 +116,20 @@ index 0ff2669e30a628dbb2df9e28ba14b38cf14114e5..117190ef26338944b78dbed7380c631d
  static int uv__async_start(uv_loop_t* loop) {
    int pipefd[2];
 diff --git a/deps/uv/src/unix/core.c b/deps/uv/src/unix/core.c
-index 0c52ccf2ad7b2dcae77a7bc4b3af9d1a1346ce18..13cd33a7d3031c5e19c9418a18217d1e4158c82e 100644
+index bd51b69b8120e878f3342c2812fb1f4c0fd35071..4c005360c8d83955b727bde3c0ff0bc3e32061a4 100644
 --- a/deps/uv/src/unix/core.c
 +++ b/deps/uv/src/unix/core.c
-@@ -937,6 +937,9 @@ void uv__io_start(uv_loop_t* loop, uv__io_t* w, unsigned int events) {
-     loop->watchers[w->fd] = w;
+@@ -944,6 +944,9 @@ int uv__io_start(uv_loop_t* loop, uv__io_t* w, unsigned int events) {
      loop->nfds++;
    }
-+
+ 
 +  if (uv__get_internal_fields(loop)->flags & UV_LOOP_INTERRUPT_ON_IO_CHANGE)
 +    uv__loop_interrupt(loop);
++
+   return 0;
  }
  
- 
-@@ -968,6 +971,9 @@ void uv__io_stop(uv_loop_t* loop, uv__io_t* w, unsigned int events) {
+@@ -993,6 +996,9 @@ void uv__io_stop(uv_loop_t* loop, uv__io_t* w, unsigned int events) {
    }
    else if (uv__queue_empty(&w->watcher_queue))
      uv__queue_insert_tail(&loop->watcher_queue, &w->watcher_queue);
@@ -119,7 +139,7 @@ index 0c52ccf2ad7b2dcae77a7bc4b3af9d1a1346ce18..13cd33a7d3031c5e19c9418a18217d1e
  }
  
  
-@@ -984,6 +990,9 @@ void uv__io_close(uv_loop_t* loop, uv__io_t* w) {
+@@ -1009,6 +1015,9 @@ void uv__io_close(uv_loop_t* loop, uv__io_t* w) {
  void uv__io_feed(uv_loop_t* loop, uv__io_t* w) {
    if (uv__queue_empty(&w->pending_queue))
      uv__queue_insert_tail(&loop->pending_queue, &w->pending_queue);
@@ -129,11 +149,24 @@ index 0c52ccf2ad7b2dcae77a7bc4b3af9d1a1346ce18..13cd33a7d3031c5e19c9418a18217d1e
  }
  
  
+diff --git a/deps/uv/src/unix/internal.h b/deps/uv/src/unix/internal.h
+index a1d7d4366308acb6ba8d2b84b7a2be4b89abe2ce..a86505eba1243a8c89d77a1d036d16ac8313a785 100644
+--- a/deps/uv/src/unix/internal.h
++++ b/deps/uv/src/unix/internal.h
+@@ -523,6 +523,8 @@ int uv__get_constrained_cpu(long long* quota);
+  * people will be directed here if this number gets printed due to some
+  * kqueue error and they google for help. */
+ #define UV__KQUEUE_EVFILT_USER_IDENT 0x1e7e7711
++/* Global variable to cache kqueue EVFILT_USER support detection result */
++extern int kqueue_evfilt_user_support;
+ #else
+ #define UV__KQUEUE_EVFILT_USER 0
+ #endif
 diff --git a/deps/uv/src/unix/loop.c b/deps/uv/src/unix/loop.c
-index 179ee999d8052e779dc692aeb5b673d210aaa997..03cca2c491015e5ef958f61a0167d29dfc56e247 100644
+index 5d3f0c7a348b334e5651bf8682fe29b355ec0cb9..d0b8686783d009365e89731366afee1878a6757b 100644
 --- a/deps/uv/src/unix/loop.c
 +++ b/deps/uv/src/unix/loop.c
-@@ -224,6 +224,10 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap) {
+@@ -228,6 +228,10 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap) {
    }
  #endif
  
@@ -144,7 +177,7 @@ index 179ee999d8052e779dc692aeb5b673d210aaa997..03cca2c491015e5ef958f61a0167d29d
  
    if (option != UV_LOOP_BLOCK_SIGNAL)
      return UV_ENOSYS;
-@@ -234,3 +238,40 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap) {
+@@ -238,3 +242,51 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap) {
    loop->flags |= UV_LOOP_BLOCK_SIGPROF;
    return 0;
  }
@@ -167,6 +200,17 @@ index 179ee999d8052e779dc692aeb5b673d210aaa997..03cca2c491015e5ef958f61a0167d29d
 +    len = sizeof(val);
 +    fd = loop->async_io_watcher.fd;  /* eventfd */
 +  }
++#elif UV__KQUEUE_EVFILT_USER
++  struct kevent ev;
++
++  if (kqueue_evfilt_user_support) {
++    fd = loop->async_io_watcher.fd; /* magic number for EVFILT_USER */
++    EV_SET(&ev, fd, EVFILT_USER, 0, NOTE_TRIGGER, 0, 0);
++    r = kevent(loop->backend_fd, &ev, 1, NULL, 0, NULL);
++    if (r == 0)
++      return;
++    abort();
++  }
 +#endif
 +
 +  do
@@ -186,10 +230,10 @@ index 179ee999d8052e779dc692aeb5b673d210aaa997..03cca2c491015e5ef958f61a0167d29d
 +  abort();
 +}
 diff --git a/deps/uv/src/uv-common.h b/deps/uv/src/uv-common.h
-index 4baede2e506ee1787d554a0ec75bc9eb346fc8f2..385d4f420b50bfd2dc23f119d535c0442a3ce4e7 100644
+index b9a8e976eefdd62cfad31f6d3ed9b6179776eaa4..985b8fa3f2594f729af1845334b4afade3e054ee 100644
 --- a/deps/uv/src/uv-common.h
 +++ b/deps/uv/src/uv-common.h
-@@ -144,6 +144,8 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap);
+@@ -149,6 +149,8 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap);
  
  void uv__loop_close(uv_loop_t* loop);
  
@@ -198,7 +242,7 @@ index 4baede2e506ee1787d554a0ec75bc9eb346fc8f2..385d4f420b50bfd2dc23f119d535c044
  int uv__read_start(uv_stream_t* stream,
                     uv_alloc_cb alloc_cb,
                     uv_read_cb read_cb);
-@@ -280,6 +282,10 @@ void uv__threadpool_cleanup(void);
+@@ -291,6 +293,10 @@ void uv__threadpool_cleanup(void);
      if (((h)->flags & UV_HANDLE_ACTIVE) != 0) break;                          \
      (h)->flags |= UV_HANDLE_ACTIVE;                                           \
      if (((h)->flags & UV_HANDLE_REF) != 0) uv__active_handle_add(h);          \
@@ -210,7 +254,7 @@ index 4baede2e506ee1787d554a0ec75bc9eb346fc8f2..385d4f420b50bfd2dc23f119d535c044
    while (0)
  
 diff --git a/deps/uv/src/win/core.c b/deps/uv/src/win/core.c
-index e9885a0f1ff3890a8d957c8793e22b01cedc0e97..ae3d09878253fe7169ad7b74b3faea0223f89de5 100644
+index 5f41c87ad5ed137c51b43e4941414c89ddff5216..73f26c68e5734d340fe210b4418f0161dc172182 100644
 --- a/deps/uv/src/win/core.c
 +++ b/deps/uv/src/win/core.c
 @@ -384,10 +384,20 @@ int uv__loop_configure(uv_loop_t* loop, uv_loop_option option, va_list ap) {
@@ -459,10 +503,10 @@ index 6e9917239aa5626dd56fffd6eb2469d3e63224bf..b0da9d1cddc69428e9fb3379d1338cf8
    MAKE_VALGRIND_HAPPY(loop);
    return 0;
 diff --git a/deps/uv/test/test-list.h b/deps/uv/test/test-list.h
-index e07bd61ecf73c122a553d5d8232a7478980751a5..21cf8c09edac15ba5ea010d54d3e158e0d1b7e5b 100644
+index 0dea544699d75fcf11d4a8b6a7f0d5f4242f892a..6f8c70bc8b6cb2d2ffc1f63fe60920f8fb8a1abe 100644
 --- a/deps/uv/test/test-list.h
 +++ b/deps/uv/test/test-list.h
-@@ -279,6 +279,7 @@ TEST_DECLARE   (process_priority)
+@@ -281,6 +281,7 @@ TEST_DECLARE   (process_priority)
  TEST_DECLARE   (has_ref)
  TEST_DECLARE   (active)
  TEST_DECLARE   (embed)
@@ -470,7 +514,7 @@ index e07bd61ecf73c122a553d5d8232a7478980751a5..21cf8c09edac15ba5ea010d54d3e158e
  TEST_DECLARE   (async)
  TEST_DECLARE   (async_null_cb)
  TEST_DECLARE   (eintr_handling)
-@@ -919,6 +920,7 @@ TASK_LIST_START
+@@ -929,6 +930,7 @@ TASK_LIST_START
    TEST_ENTRY  (active)
  
    TEST_ENTRY  (embed)

patches/node/fix_-wmismatched-new-delete_in_debug_utils_cc.patch

@@ -0,0 +1,31 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Shelley Vohr <shelley.vohr@gmail.com>
+Date: Thu, 26 Jun 2025 12:46:41 +0000
+Subject: fix: -Wmismatched-new-delete in debug_utils.cc
+
+Fixes the following error:
+
+Error: ../../third_party/electron_node/src/debug_utils.cc(491,11): error: 'delete' applied to a pointer that was allocated with 'new[]'; did you mean 'delete[]'? [-Werror,-Wmismatched-new-delete]
+  491 |           delete str;
+      |           ^
+      |                 []
+../../third_party/electron_node/src/debug_utils.cc(487,23): note: allocated with 'new[]' here
+  487 |           char* str = new char[size];
+      |                       ^
+1 error generated.
+
+Upstreamed in https://github.com/nodejs/node/pull/58844.
+
+diff --git a/src/debug_utils.cc b/src/debug_utils.cc
+index 97884b9a0f8d6d88e36da06b05642505c767338d..65283ef31da35d0f08fcff7a5e79bf960d861126 100644
+--- a/src/debug_utils.cc
++++ b/src/debug_utils.cc
+@@ -488,7 +488,7 @@ std::vector<std::string> NativeSymbolDebuggingContext::GetLoadedLibraries() {
+           WideCharToMultiByte(
+               CP_UTF8, 0, module_name, -1, str, size, nullptr, nullptr);
+           list.emplace_back(str);
+-          delete str;
++          delete[] str;
+         }
+       }
+     }

patches/node/fix_add_default_values_for_variables_in_common_gypi.patch

@@ -7,10 +7,10 @@ common.gypi is a file that's included in the node header bundle, despite
 the fact that we do not build node with gyp.
 
 diff --git a/common.gypi b/common.gypi
-index 393fe32765794fbc5e92690e968e3c18f0d749fa..d9c0b721fe0a629a30efb3c4e04905176ca0a7f5 100644
+index b88371ec13da5a287e18f7224bb4970fc94dce66..cf643bcd0bc9080b80bf12afeebc69f2db74bb54 100644
 --- a/common.gypi
 +++ b/common.gypi
-@@ -90,6 +90,23 @@
+@@ -91,6 +91,23 @@
  
      ##### end V8 defaults #####
  

patches/node/fix_allow_passing_fileexists_fn_to_legacymainresolve.patch

@@ -53,10 +53,10 @@ index 2879e5cf541fb4d226cfd7cc0fe367ca448fb926..03082f0ec4f91382933eec48e77331cd
    const maybeMain = resolvedOption <= legacyMainResolveExtensionsIndexes.kResolvedByMainIndexNode ?
      packageConfig.main || './' : '';
 diff --git a/src/node_file.cc b/src/node_file.cc
-index 49816349d8bab37fea1d84e5326ee5a11acad7a2..5aea65d6800494def62829432ee48f9c06e65d63 100644
+index fe28c340c9b50384e79fe14263d8b3807f49e0b3..37172158d318d6569194fd3c5441d107e155e54c 100644
 --- a/src/node_file.cc
 +++ b/src/node_file.cc
-@@ -3237,13 +3237,25 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
+@@ -3523,13 +3523,25 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
  }
  
  BindingData::FilePathIsFileReturnType BindingData::FilePathIsFile(
@@ -83,7 +83,7 @@ index 49816349d8bab37fea1d84e5326ee5a11acad7a2..5aea65d6800494def62829432ee48f9c
    uv_fs_t req;
  
    int rc = uv_fs_stat(env->event_loop(), &req, file_path.c_str(), nullptr);
-@@ -3301,6 +3313,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3587,6 +3599,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
    std::optional<std::string> initial_file_path;
    std::string file_path;
  
@@ -95,7 +95,7 @@ index 49816349d8bab37fea1d84e5326ee5a11acad7a2..5aea65d6800494def62829432ee48f9c
    if (args.Length() >= 2 && args[1]->IsString()) {
      auto package_config_main = Utf8Value(isolate, args[1]).ToString();
  
-@@ -3321,7 +3338,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3607,7 +3624,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
        BufferValue buff_file_path(isolate, local_file_path);
        ToNamespacedPath(env, &buff_file_path);
  
@@ -104,7 +104,7 @@ index 49816349d8bab37fea1d84e5326ee5a11acad7a2..5aea65d6800494def62829432ee48f9c
          case BindingData::FilePathIsFileReturnType::kIsFile:
            return args.GetReturnValue().Set(i);
          case BindingData::FilePathIsFileReturnType::kIsNotFile:
-@@ -3358,7 +3375,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3644,7 +3661,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
      BufferValue buff_file_path(isolate, local_file_path);
      ToNamespacedPath(env, &buff_file_path);
  

patches/node/fix_assert_module_in_the_renderer_process.patch

@@ -44,10 +44,10 @@ index 59b5a16f1309a5e4055bccfdb7a529045ad30402..bfdaf6211466a01b64b7942f7b16c480
    let filename = call.getFileName();
    const line = call.getLineNumber() - 1;
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 8be78889e8234eb3100f309829bf7470db544dcd..bb1e80ece4158dfed1b8bab7dc6d00dd56505aac 100644
+index 14f7764c995e8de6582faf58c9b98a9cbe4fab73..d2e945b1d6ef6729709cc73c238cfae46d4e56b6 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
-@@ -1557,14 +1557,16 @@ void GetEmbedderOptions(const FunctionCallbackInfo<Value>& args) {
+@@ -1560,14 +1560,16 @@ void GetEmbedderOptions(const FunctionCallbackInfo<Value>& args) {
    }
    Isolate* isolate = args.GetIsolate();
  

patches/node/fix_cppgc_initializing_twice.patch

@@ -12,10 +12,10 @@ This can be removed/refactored once Node.js upgrades to a version of V8
 containing the above CL.
 
 diff --git a/src/node.cc b/src/node.cc
-index bc670a6c8b5027417cdc35e1cd94a60f63fd342d..49a9670de72c222d6b4a681be001efb4a2651ea3 100644
+index 19d9fb77f1aaf003e43b7d7016f45e6c35df06b3..9fad3198757ce639eb491eb628c6264a17002bf2 100644
 --- a/src/node.cc
 +++ b/src/node.cc
-@@ -1209,7 +1209,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
+@@ -1208,7 +1208,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
      result->platform_ = per_process::v8_platform.Platform();
    }
  

patches/node/fix_crypto_tests_to_run_with_bssl.patch

@@ -10,50 +10,15 @@ This should be upstreamed in some form, though it may need to be tweaked
 before it's acceptable to upstream, as this patch comments out a couple
 of tests that upstream probably cares about.
 
-diff --git a/test/common/index.js b/test/common/index.js
-index 8f5af57a83dc6b426f1b11bd2e3a8c6c0f2d9a85..f6e00c9f3f3ac4b42662eed6c8d190586f92ab99 100644
---- a/test/common/index.js
-+++ b/test/common/index.js
-@@ -56,6 +56,8 @@ const hasCrypto = Boolean(process.versions.openssl) &&
- 
- const hasQuic = hasCrypto && !!process.config.variables.openssl_quic;
- 
-+const openSSLIsBoringSSL = process.versions.openssl === '0.0.0';
-+
- function parseTestFlags(filename = process.argv[1]) {
-   // The copyright notice is relatively big and the flags could come afterwards.
-   const bytesToRead = 1500;
-@@ -901,6 +903,7 @@ const common = {
-   mustNotMutateObjectDeep,
-   mustSucceed,
-   nodeProcessAborted,
-+  openSSLIsBoringSSL,
-   PIPE,
-   parseTestFlags,
-   platformTimeout,
-diff --git a/test/parallel/test-buffer-tostring-range.js b/test/parallel/test-buffer-tostring-range.js
-index d033cd204b3200cdd736b581abe027d6e46e4ff3..73fec107a36c3db4af6f492137d0ca174f2d0547 100644
---- a/test/parallel/test-buffer-tostring-range.js
-+++ b/test/parallel/test-buffer-tostring-range.js
-@@ -102,7 +102,8 @@ assert.throws(() => {
- // Must not throw when start and end are within kMaxLength
- // Cannot test on 32bit machine as we are testing the case
- // when start and end are above the threshold
--common.skipIf32Bits();
-+if (!common.openSSLIsBoringSSL) {
- const threshold = 0xFFFFFFFF;
- const largeBuffer = Buffer.alloc(threshold + 20);
- largeBuffer.toString('utf8', threshold, threshold + 20);
-+}
 diff --git a/test/parallel/test-crypto-async-sign-verify.js b/test/parallel/test-crypto-async-sign-verify.js
-index b35dd08e6c49796418cd9d10eb5cc9d02b39961e..a49fdde82ea4cbadd60307cdc99439be892ef5a6 100644
+index b35dd08e6c49796418cd9d10eb5cc9d02b39961e..97bcd79b331db140d157e6b1faf92625597edc98 100644
 --- a/test/parallel/test-crypto-async-sign-verify.js
 +++ b/test/parallel/test-crypto-async-sign-verify.js
 @@ -89,6 +89,7 @@ test('rsa_public.pem', 'rsa_private.pem', 'sha256', false,
  // ED25519
  test('ed25519_public.pem', 'ed25519_private.pem', undefined, true);
  // ED448
-+if (!common.openSSLIsBoringSSL) {
++if (!process.features.openssl_is_boringssl) {
  test('ed448_public.pem', 'ed448_private.pem', undefined, true);
  
  // ECDSA w/ der signature encoding
@@ -72,7 +37,7 @@ index b35dd08e6c49796418cd9d10eb5cc9d02b39961e..a49fdde82ea4cbadd60307cdc99439be
 -  const expected = hasOpenSSL3 ?
 -    /operation not supported for this keytype/ : /no default digest/;
 +  let expected = /no default digest/;
-+  if (hasOpenSSL3 || common.openSSLIsBoringSSL) {
++  if (hasOpenSSL3 || process.features.openssl_is_boringssl) {
 +    expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
 +  }
  
@@ -144,23 +109,29 @@ index 81a469c226c261564dee1e0b06b6571b18a41f1f..58b66045dba4201b7ebedd78b129420f
  
  const availableCurves = new Set(crypto.getCurves());
 diff --git a/test/parallel/test-crypto-dh-errors.js b/test/parallel/test-crypto-dh-errors.js
-index 0af4db0310750cea9350ecff7fc44404c6df6c83..85ab03f6019989ad4fe93b779c3b4772ce1f5130 100644
+index 0af4db0310750cea9350ecff7fc44404c6df6c83..b14b4bbf88b902b6de916b92e3d48335c01df911 100644
 --- a/test/parallel/test-crypto-dh-errors.js
 +++ b/test/parallel/test-crypto-dh-errors.js
-@@ -33,9 +33,9 @@ for (const bits of [-1, 0, 1]) {
-     });
-   } else {
+@@ -27,7 +27,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), {
+ for (const bits of [-1, 0, 1]) {
+   if (hasOpenSSL3) {
      assert.throws(() => crypto.createDiffieHellman(bits), {
--      code: 'ERR_OSSL_BN_BITS_TOO_SMALL',
-+      code: /ERR_OSSL_BN_BITS_TOO_SMALL|ERR_OSSL_DH_MODULUS_TOO_LARGE/,
+-      code: 'ERR_OSSL_DH_MODULUS_TOO_SMALL',
++      code: 'ERR_OSSL_BN_BITS_TOO_SMALL',
+       name: 'Error',
+       message: /modulus too small/,
+     });
+@@ -35,7 +35,7 @@ for (const bits of [-1, 0, 1]) {
+     assert.throws(() => crypto.createDiffieHellman(bits), {
+       code: 'ERR_OSSL_BN_BITS_TOO_SMALL',
        name: 'Error',
 -      message: /bits too small/,
-+      message: /bits too small|BITS_TOO_SMALL|MODULUS_TOO_LARGE/,
++      message: /bits[\s_]too[\s_]small/i,
      });
    }
  }
 diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
-index d7ffbe5eca92734aa2380f482c7f9bfe7e2a36c7..21ab2333431ea70bdf98dde43624e0b712566395 100644
+index d7ffbe5eca92734aa2380f482c7f9bfe7e2a36c7..b4e7002d862907d2af3b4f8e985700bd03300809 100644
 --- a/test/parallel/test-crypto-dh.js
 +++ b/test/parallel/test-crypto-dh.js
 @@ -60,18 +60,17 @@ const {
@@ -171,10 +142,10 @@ index d7ffbe5eca92734aa2380f482c7f9bfe7e2a36c7..21ab2333431ea70bdf98dde43624e0b7
 -      code: 'ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH',
 -      library: 'Provider routines',
 -      reason: 'wrong final block length'
-+      message: /error:1C80006B:Provider routines::wrong final block length|error:1e00007b:Cipher functions:OPENSSL_internal:WRONG_FINAL_BLOCK_LENGTH/,
++      message: /wrong[\s_]final[\s_]block[\s_]length/i,
 +      code: /ERR_OSSL_(EVP_)?WRONG_FINAL_BLOCK_LENGTH/,
-+      library: /digital envelope routines|Cipher functions/,
-+      reason: /wrong final block length|WRONG_FINAL_BLOCK_LENGTH/
++      library: /Provider routines|Cipher functions/,
++      reason: /wrong[\s_]final[\s_]block[\s_]length/i,
      };
    } else {
      wrongBlockLength = {
@@ -183,10 +154,10 @@ index d7ffbe5eca92734aa2380f482c7f9bfe7e2a36c7..21ab2333431ea70bdf98dde43624e0b7
 -      code: 'ERR_OSSL_EVP_WRONG_FINAL_BLOCK_LENGTH',
 -      library: 'digital envelope routines',
 -      reason: 'wrong final block length'
-+      message: /error:0606506D:digital envelope routines:EVP_DecryptFinal_ex:wrong final block length|error:1e00007b:Cipher functions:OPENSSL_internal:WRONG_FINAL_BLOCK_LENGTH/,
++      message: /wrong[\s_]final[\s_]block[\s_]length/i,
 +      code: /ERR_OSSL_(EVP_)?WRONG_FINAL_BLOCK_LENGTH/,
 +      library: /digital envelope routines|Cipher functions/,
-+      reason: /wrong final block length|WRONG_FINAL_BLOCK_LENGTH/
++      reason: /wrong[\s_]final[\s_]block[\s_]length/i,
      };
    }
  
@@ -217,25 +188,6 @@ index d7ffbe5eca92734aa2380f482c7f9bfe7e2a36c7..21ab2333431ea70bdf98dde43624e0b7
 +    name: 'Error'
 +  });
  }
-diff --git a/test/parallel/test-crypto-getcipherinfo.js b/test/parallel/test-crypto-getcipherinfo.js
-index 64b79fc36ccf4d38f763fcd8c1930473c82cefd7..1c6717ebd46497384b9b13174b65894ca89e7f2d 100644
---- a/test/parallel/test-crypto-getcipherinfo.js
-+++ b/test/parallel/test-crypto-getcipherinfo.js
-@@ -62,9 +62,13 @@ assert(getCipherInfo('aes-128-cbc', { ivLength: 16 }));
- 
- assert(!getCipherInfo('aes-128-ccm', { ivLength: 1 }));
- assert(!getCipherInfo('aes-128-ccm', { ivLength: 14 }));
-+if (!common.openSSLIsBoringSSL) {
- for (let n = 7; n <= 13; n++)
-   assert(getCipherInfo('aes-128-ccm', { ivLength: n }));
-+}
- 
- assert(!getCipherInfo('aes-128-ocb', { ivLength: 16 }));
-+if (!common.openSSLIsBoringSSL) {
- for (let n = 1; n < 16; n++)
-   assert(getCipherInfo('aes-128-ocb', { ivLength: n }));
-+}
-\ No newline at end of file
 diff --git a/test/parallel/test-crypto-hash-stream-pipe.js b/test/parallel/test-crypto-hash-stream-pipe.js
 index d22281abbd5c3cab3aaa3ac494301fa6b4a8a968..5f0c6a4aed2e868a1a1049212edf218791cd6868 100644
 --- a/test/parallel/test-crypto-hash-stream-pipe.js
@@ -258,7 +210,7 @@ index d22281abbd5c3cab3aaa3ac494301fa6b4a8a968..5f0c6a4aed2e868a1a1049212edf2187
  s.pipe(h).on('data', common.mustCall(function(c) {
    assert.strictEqual(c, expect);
 diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
-index 61145aee0727fbe0b9781acdb3eeb641e7010729..fd7d4bd7d3f86caa30ffd03ea880eeac023bbcbb 100644
+index 61145aee0727fbe0b9781acdb3eeb641e7010729..51693e637b310981f76f23c2f35d43e4d2d9c4ef 100644
 --- a/test/parallel/test-crypto-hash.js
 +++ b/test/parallel/test-crypto-hash.js
 @@ -183,7 +183,7 @@ assert.throws(
@@ -266,57 +218,57 @@ index 61145aee0727fbe0b9781acdb3eeb641e7010729..fd7d4bd7d3f86caa30ffd03ea880eeac
  
  // Test XOF hash functions and the outputLength option.
 -{
-+if (!common.openSSLIsBoringSSL) {
++if (!process.features.openssl_is_boringssl) {
    // Default outputLengths. Since OpenSSL 3.4 an outputLength is mandatory
    if (!hasOpenSSL(3, 4)) {
      assert.strictEqual(crypto.createHash('shake128').digest('hex'),
-diff --git a/test/parallel/test-crypto-hkdf.js b/test/parallel/test-crypto-hkdf.js
-index 3f7e61e9b2ebc0ca7c367d7c229afe9ab87762b8..36bd78105d153b75b42e4736f11d80a257916607 100644
---- a/test/parallel/test-crypto-hkdf.js
-+++ b/test/parallel/test-crypto-hkdf.js
-@@ -125,7 +125,7 @@ const algorithms = [
-   ['sha256', '', 'salt', '', 10],
-   ['sha512', 'secret', 'salt', '', 15],
- ];
--if (!hasOpenSSL3)
-+if (!hasOpenSSL3 && !common.openSSLIsBoringSSL)
-   algorithms.push(['whirlpool', 'secret', '', 'info', 20]);
- 
- algorithms.forEach(([ hash, secret, salt, info, length ]) => {
 diff --git a/test/parallel/test-crypto-padding.js b/test/parallel/test-crypto-padding.js
-index 48cd1ed4df61aaddeee8785cb90f83bdd9628187..a18aeb2bdffcc7a7e9ef12328b849994e39d6c27 100644
+index 48cd1ed4df61aaddeee8785cb90f83bdd9628187..d09e01712c617597833bb1320a32a967bcf1d318 100644
 --- a/test/parallel/test-crypto-padding.js
 +++ b/test/parallel/test-crypto-padding.js
-@@ -88,10 +88,9 @@ assert.throws(function() {
-   code: 'ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH',
-   reason: 'wrong final block length',
+@@ -84,14 +84,13 @@ assert.throws(function() {
+   // Input must have block length %.
+   enc(ODD_LENGTH_PLAIN, false);
+ }, hasOpenSSL3 ? {
+-  message: 'error:1C80006B:Provider routines::wrong final block length',
+-  code: 'ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH',
+-  reason: 'wrong final block length',
++  message: /wrong[\s_]final[\s_]block[\s_]length/i,
++  code: /ERR_OSSL(_EVP)?_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH/,
++  message: /wrong[\s_]final[\s_]block[\s_]length/i,
  } : {
 -  message: 'error:0607F08A:digital envelope routines:EVP_EncryptFinal_ex:' +
 -    'data not multiple of block length',
 -  code: 'ERR_OSSL_EVP_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH',
 -  reason: 'data not multiple of block length',
-+  message: /error:0607F08A:digital envelope routines:EVP_EncryptFinal_ex:data not multiple of block length|error:1e00006a:Cipher functions:OPENSSL_internal:DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH/,
++  message: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i,
 +  code: /ERR_OSSL(_EVP)?_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH/,
-+  reason: /data not multiple of block length|DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH/,
++  reason: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i,
  }
  );
  
-@@ -115,10 +114,9 @@ assert.throws(function() {
-   reason: 'bad decrypt',
-   code: 'ERR_OSSL_BAD_DECRYPT',
- } : {
+@@ -110,15 +109,10 @@ assert.strictEqual(dec(EVEN_LENGTH_ENCRYPTED, false).length, 48);
+ assert.throws(function() {
+   // Must have at least 1 byte of padding (PKCS):
+   assert.strictEqual(dec(EVEN_LENGTH_ENCRYPTED_NOPAD, true), EVEN_LENGTH_PLAIN);
+-}, hasOpenSSL3 ? {
+-  message: 'error:1C800064:Provider routines::bad decrypt',
+-  reason: 'bad decrypt',
+-  code: 'ERR_OSSL_BAD_DECRYPT',
+-} : {
 -  message: 'error:06065064:digital envelope routines:EVP_DecryptFinal_ex:' +
 -    'bad decrypt',
 -  reason: 'bad decrypt',
 -  code: 'ERR_OSSL_EVP_BAD_DECRYPT',
-+  message: /error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt|error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT/,
-+  reason: /bad decrypt|BAD_DECRYPT/,
++}, {
++  message: /bad[\s_]decrypt/i,
++  reason: /bad[\s_]decrypt/i,
 +  code: /ERR_OSSL(_EVP)?_BAD_DECRYPT/,
  });
  
  // No-pad encrypted string should return the same:
 diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
-index dcd5045daaf58c60e27c1e2f7941033302241339..6ac75565792b92a97c622baba73f821d754b8d01 100644
+index dcd5045daaf58c60e27c1e2f7941033302241339..b52ec0e2cd5d6b1c9a0fee3064f2f8ff3b6e4308 100644
 --- a/test/parallel/test-crypto-rsa-dsa.js
 +++ b/test/parallel/test-crypto-rsa-dsa.js
 @@ -29,12 +29,11 @@ const dsaPkcs8KeyPem = fixtures.readKey('dsa_private_pkcs8.pem');
@@ -342,7 +294,7 @@ index dcd5045daaf58c60e27c1e2f7941033302241339..6ac75565792b92a97c622baba73f821d
  
  
 -  if (padding === constants.RSA_PKCS1_PADDING) {
-+  if (!common.openSSLIsBoringSSL) {
++  if (!process.features.openssl_is_boringssl) {
      if (!process.config.variables.node_shared_openssl) {
        assert.throws(() => {
          crypto.privateDecrypt({
@@ -351,7 +303,7 @@ index dcd5045daaf58c60e27c1e2f7941033302241339..6ac75565792b92a97c622baba73f821d
  // Test DSA signing and verification
  //
 -{
-+if (!common.openSSLIsBoringSSL) {
++if (!process.features.openssl_is_boringssl) {
    const input = 'I AM THE WALRUS';
  
    // DSA signatures vary across runs so there is no static string to verify
@@ -369,7 +321,7 @@ index 03a18c7522531c7317f12705550117dc389a0245..2f0f46f2c6ddc62de89877cfa0ca8094
    };
    assert.throws(() => crypto.scrypt('pass', 'salt', 1, options, () => {}),
 diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
-index 0589d60736e377f24dc8550f87a6b7624173fc44..547f22cdc130cf0c68d117f92068e3ac53a0efc2 100644
+index 0589d60736e377f24dc8550f87a6b7624173fc44..113003826fc47a589cf2334f7345e33d3e189d0a 100644
 --- a/test/parallel/test-crypto-sign-verify.js
 +++ b/test/parallel/test-crypto-sign-verify.js
 @@ -33,7 +33,7 @@ const keySize = 2048;
@@ -377,7 +329,7 @@ index 0589d60736e377f24dc8550f87a6b7624173fc44..547f22cdc130cf0c68d117f92068e3ac
  
  // Test handling of exceptional conditions
 -{
-+if (!common.openSSLIsBoringSSL) {
++if (!process.features.openssl_is_boringssl) {
    const library = {
      configurable: true,
      set() {
@@ -426,77 +378,24 @@ index 0589d60736e377f24dc8550f87a6b7624173fc44..547f22cdc130cf0c68d117f92068e3ac
    for (const [file, length] of keys) {
      const privKey = fixtures.readKey(file);
 diff --git a/test/parallel/test-crypto-stream.js b/test/parallel/test-crypto-stream.js
-index 62be4eaf6edfb01ce275e7db3e56b51d09ac66ce..3fb6cd833d959d1c3c8522ebacc8f18352672628 100644
+index 747af780469c22eb8e4c6c35424043e868f75c3d..ed0916b036a9af23d805007ebd609973ee954473 100644
 --- a/test/parallel/test-crypto-stream.js
 +++ b/test/parallel/test-crypto-stream.js
-@@ -78,10 +78,10 @@ cipher.pipe(decipher)
-     library: 'Provider routines',
-     reason: 'bad decrypt',
+@@ -73,9 +73,9 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv);
+ const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv);
+ 
+ cipher.pipe(decipher)
+-  .on('error', common.expectsError(hasOpenSSL3 ? {
+-    message: /bad[\s_]decrypt/,
+-    library: 'Provider routines',
++  .on('error', common.expectsError((hasOpenSSL3 || process.features.openssl_is_boringssl) ? {
++    message: /bad[\s_]decrypt/i,
++    library: /Provider routines|Cipher functions/,
+     reason: /bad[\s_]decrypt/i,
    } : {
--    message: /bad decrypt/,
--    function: 'EVP_DecryptFinal_ex',
--    library: 'digital envelope routines',
--    reason: 'bad decrypt',
-+    message: /bad decrypt|BAD_DECRYPT/,
-+    function: /EVP_DecryptFinal_ex|OPENSSL_internal/,
-+    library: /digital envelope routines|Cipher functions/,
-+    reason: /bad decrypt|BAD_DECRYPT/,
-   }));
- 
- cipher.end('Papaya!');  // Should not cause an unhandled exception.
-diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js
-index f75e1d63470bfb7ce7fb354118b87a1a6fe5e4cc..5c0852e83a466ab4b255e8c9c9a33aca1beb9b94 100644
---- a/test/parallel/test-crypto-x509.js
-+++ b/test/parallel/test-crypto-x509.js
-@@ -97,8 +97,10 @@ const der = Buffer.from(
-   assert.strictEqual(x509.infoAccess, infoAccessCheck);
-   assert.strictEqual(x509.validFrom, 'Sep  3 21:40:37 2022 GMT');
-   assert.strictEqual(x509.validTo, 'Jun 17 21:40:37 2296 GMT');
-+  if (!common.openSSLIsBoringSSL) {
-   assert.deepStrictEqual(x509.validFromDate, new Date('2022-09-03T21:40:37Z'));
-   assert.deepStrictEqual(x509.validToDate, new Date('2296-06-17T21:40:37Z'));
-+  }
-   assert.strictEqual(
-     x509.fingerprint,
-     '8B:89:16:C4:99:87:D2:13:1A:64:94:36:38:A5:32:01:F0:95:3B:53');
-@@ -326,6 +328,7 @@ oans248kpal88CGqsN2so/wZKxVnpiXlPHMdiNL7hRSUqlHkUi07FrP2Htg8kjI=
-     legacyObjectCheck.serialNumberPattern);
- }
- 
-+if (!common.openSSLIsBoringSSL) {
- {
-   // This X.509 Certificate can be parsed by OpenSSL because it contains a
-   // structurally sound TBSCertificate structure. However, the SPKI field of the
-@@ -364,6 +367,7 @@ UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0
- 
-   assert.strictEqual(cert.checkIssued(cert), false);
- }
-+}
- 
- {
-   // Test date parsing of `validFromDate` and `validToDate` fields, according to RFC 5280.
-@@ -401,8 +405,10 @@ UidvpWWipVLZgK+oDks+bKTobcoXGW9oXobiIYqslXPy
- -----END CERTIFICATE-----`.trim();
-   const c1 = new X509Certificate(certPemUTCTime);
- 
-+  if (!common.openSSLIsBoringSSL) {
-   assert.deepStrictEqual(c1.validFromDate, new Date('1949-12-25T23:59:58Z'));
-   assert.deepStrictEqual(c1.validToDate, new Date('1950-01-01T23:59:58Z'));
-+  }
- 
-   // The GeneralizedTime format is used for dates in 2050 or later.
-   const certPemGeneralizedTime = `-----BEGIN CERTIFICATE-----
-@@ -436,6 +442,8 @@ CWwQO8JZjJqFtqtuzy2n+gLCvqePgG/gmSqHOPm2ZbLW
- -----END CERTIFICATE-----`.trim();
-   const c2 = new X509Certificate(certPemGeneralizedTime);
- 
-+  if (!common.openSSLIsBoringSSL) {
-   assert.deepStrictEqual(c2.validFromDate, new Date('2049-12-26T00:00:01Z'));
-   assert.deepStrictEqual(c2.validToDate, new Date('2050-01-02T00:00:01Z'));
-+  }
- }
+     message: /bad[\s_]decrypt/i,
 diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
-index 93644e016de447d2aadc519123f18cd72b7a5750..8b16c83cd47bd8969654242296c987ecc97ccaeb 100644
+index 84111740cd9ef6425b747e24e984e66e46b0b2ef..b1621d310536fae3fdec91a6a9d275ec8fc99a98 100644
 --- a/test/parallel/test-crypto.js
 +++ b/test/parallel/test-crypto.js
 @@ -62,7 +62,7 @@ assert.throws(() => {
@@ -539,25 +438,10 @@ index 93644e016de447d2aadc519123f18cd72b7a5750..8b16c83cd47bd8969654242296c987ec
    }
  );
  
-+if (!common.openSSLIsBoringSSL) {
++if (!process.features.openssl_is_boringssl) {
  assert.throws(() => {
    const priv = [
      '-----BEGIN RSA PRIVATE KEY-----',
-@@ -217,10 +216,10 @@ assert.throws(() => {
-     library: 'rsa routines',
-   } : {
-     name: 'Error',
--    message: /routines:RSA_sign:digest too big for rsa key$/,
--    library: 'rsa routines',
--    function: 'RSA_sign',
--    reason: 'digest too big for rsa key',
-+    message: /routines:RSA_sign:digest too big for rsa key$|routines:OPENSSL_internal:DIGEST_TOO_BIG_FOR_RSA_KEY$/,
-+    library: /rsa routines|RSA routines/,
-+    function: /RSA_sign|OPENSSL_internal/,
-+    reason: /digest too big for rsa key|DIGEST_TOO_BIG_FOR_RSA_KEY/,
-     code: 'ERR_OSSL_RSA_DIGEST_TOO_BIG_FOR_RSA_KEY'
-   });
-   return true;
 @@ -253,7 +252,7 @@ if (!hasOpenSSL3) {
      return true;
    });
@@ -567,162 +451,29 @@ index 93644e016de447d2aadc519123f18cd72b7a5750..8b16c83cd47bd8969654242296c987ec
  // Make sure memory isn't released before being returned
  console.log(crypto.randomBytes(16));
  
-diff --git a/test/parallel/test-https-agent-additional-options.js b/test/parallel/test-https-agent-additional-options.js
-index 543ee176fb6af38874fee9f14be76f3fdda11060..fef9f1bc2f9fc6c220cf47847e86e03882b51b1d 100644
---- a/test/parallel/test-https-agent-additional-options.js
-+++ b/test/parallel/test-https-agent-additional-options.js
-@@ -13,7 +13,7 @@ const options = {
-   cert: fixtures.readKey('agent1-cert.pem'),
-   ca: fixtures.readKey('ca1-cert.pem'),
-   minVersion: 'TLSv1.1',
--  ciphers: 'ALL@SECLEVEL=0'
-+  // ciphers: 'ALL@SECLEVEL=0'
- };
- 
- const server = https.Server(options, (req, res) => {
-@@ -28,7 +28,7 @@ function getBaseOptions(port) {
-     ca: options.ca,
-     rejectUnauthorized: true,
-     servername: 'agent1',
--    ciphers: 'ALL@SECLEVEL=0'
-+    // ciphers: 'ALL@SECLEVEL=0'
-   };
- }
- 
-diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js
-index 6f88e81e9ff29defe73800fc038b0d96d1ebd846..c0b92e2bdf86d3d2638c973f8be3110d5ae31f78 100644
---- a/test/parallel/test-https-agent-session-eviction.js
-+++ b/test/parallel/test-https-agent-session-eviction.js
-@@ -17,7 +17,7 @@ const options = {
-   key: readKey('agent1-key.pem'),
-   cert: readKey('agent1-cert.pem'),
-   secureOptions: SSL_OP_NO_TICKET,
--  ciphers: 'RSA@SECLEVEL=0'
-+  // ciphers: 'RSA@SECLEVEL=0'
- };
- 
- // Create TLS1.2 server
 diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js
-index cba5bebaa29b6f8ac4fd0fcedaadb2f7bb3eb321..019d95df499892b14ab088f99013ee32c432779c 100644
+index 7bd42bbe721c4c9442410d524c5ca740078fc72c..de49dbdc2b75517f497af353a6b24b1beb11ed69 100644
 --- a/test/parallel/test-tls-alert-handling.js
 +++ b/test/parallel/test-tls-alert-handling.js
-@@ -35,7 +35,7 @@ let iter = 0;
- 
- const errorHandler = common.mustCall((err) => {
-   let expectedErrorCode = 'ERR_SSL_WRONG_VERSION_NUMBER';
--  let expectedErrorReason = 'wrong version number';
-+  let expectedErrorReason = /wrong[\s_]version[\s_]number/i;
-   if (hasOpenSSL(3, 2)) {
-     expectedErrorCode = 'ERR_SSL_PACKET_LENGTH_TOO_LONG';
-     expectedErrorReason = 'packet length too long';
-@@ -43,8 +43,8 @@ const errorHandler = common.mustCall((err) => {
+@@ -43,7 +43,8 @@ const errorHandler = common.mustCall((err) => {
  
    assert.strictEqual(err.code, expectedErrorCode);
    assert.strictEqual(err.library, 'SSL routines');
 -  if (!hasOpenSSL3) assert.strictEqual(err.function, 'ssl3_get_record');
--  assert.strictEqual(err.reason, expectedErrorReason);
-+  if (!hasOpenSSL3 && !common.openSSLIsBoringSSL) assert.strictEqual(err.function, 'ssl3_get_record');
-+  assert.match(err.reason, expectedErrorReason);
++  if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
++    assert.strictEqual(err.function, 'ssl3_get_record');
+   assert.match(err.reason, expectedErrorReason);
    errorReceived = true;
    if (canCloseServer())
-     server.close();
-@@ -98,15 +98,15 @@ function sendBADTLSRecord() {
-   }));
-   client.on('error', common.mustCall((err) => {
-     let expectedErrorCode = 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION';
--    let expectedErrorReason = 'tlsv1 alert protocol version';
-+    let expectedErrorReason = /tlsv1[\s_]alert[\s_]protocol[\s_]version/i;
-     if (hasOpenSSL(3, 2)) {
-       expectedErrorCode = 'ERR_SSL_TLSV1_ALERT_RECORD_OVERFLOW';
-       expectedErrorReason = 'tlsv1 alert record overflow';
+@@ -105,7 +106,7 @@ function sendBADTLSRecord() {
      }
      assert.strictEqual(err.code, expectedErrorCode);
      assert.strictEqual(err.library, 'SSL routines');
 -    if (!hasOpenSSL3)
-+    if (!hasOpenSSL3 && !common.openSSLIsBoringSSL)
++    if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
        assert.strictEqual(err.function, 'ssl3_read_bytes');
--    assert.strictEqual(err.reason, expectedErrorReason);
-+    assert.match(err.reason, expectedErrorReason);
+     assert.match(err.reason, expectedErrorReason);
    }));
- }
-diff --git a/test/parallel/test-tls-getprotocol.js b/test/parallel/test-tls-getprotocol.js
-index b1eab88fd6517e3698934dea17752ef2bb8d8d54..3ad6db20316baa8490e3787dd55903b58a54ad06 100644
---- a/test/parallel/test-tls-getprotocol.js
-+++ b/test/parallel/test-tls-getprotocol.js
-@@ -29,7 +29,7 @@ const clientConfigs = [
- 
- const serverConfig = {
-   secureProtocol: 'TLS_method',
--  ciphers: 'RSA@SECLEVEL=0',
-+  // ciphers: 'RSA@SECLEVEL=0',
-   key: fixtures.readKey('agent2-key.pem'),
-   cert: fixtures.readKey('agent2-cert.pem')
- };
-diff --git a/test/parallel/test-tls-write-error.js b/test/parallel/test-tls-write-error.js
-index b06f2fa2c53ea72f9a66f0d002dd9281d0259a0f..864fffeebfad75d95416fd47efdea7f222c507a2 100644
---- a/test/parallel/test-tls-write-error.js
-+++ b/test/parallel/test-tls-write-error.js
-@@ -17,7 +17,7 @@ const server_cert = fixtures.readKey('agent1-cert.pem');
- const opts = {
-   key: server_key,
-   cert: server_cert,
--  ciphers: 'ALL@SECLEVEL=0'
-+  // ciphers: 'ALL@SECLEVEL=0'
- };
- 
- const server = https.createServer(opts, (req, res) => {
-diff --git a/test/parallel/test-webcrypto-derivebits.js b/test/parallel/test-webcrypto-derivebits.js
-index eb09bc24f0cb8244b05987e3a7c1d203360d3a38..8c251ff2371fb59bf679160574e1c5dc1b4b2665 100644
---- a/test/parallel/test-webcrypto-derivebits.js
-+++ b/test/parallel/test-webcrypto-derivebits.js
-@@ -101,8 +101,9 @@ const { subtle } = globalThis.crypto;
-   tests.then(common.mustCall());
- }
- 
-+
- // Test X25519 and X448 bit derivation
--{
-+if (!common.openSSLIsBoringSSL) {
-   async function test(name) {
-     const [alice, bob] = await Promise.all([
-       subtle.generateKey({ name }, true, ['deriveBits']),
-diff --git a/test/parallel/test-webcrypto-derivekey.js b/test/parallel/test-webcrypto-derivekey.js
-index 558d37d90d5796b30101d1b512c9df3e7661d0db..f42bf8f4be0b439dd7e7c8d0f6f8a41e01588870 100644
---- a/test/parallel/test-webcrypto-derivekey.js
-+++ b/test/parallel/test-webcrypto-derivekey.js
-@@ -176,7 +176,7 @@ const { KeyObject } = require('crypto');
- }
- 
- // Test X25519 and X448 key derivation
--{
-+if (!common.openSSLIsBoringSSL) {
-   async function test(name) {
-     const [alice, bob] = await Promise.all([
-       subtle.generateKey({ name }, true, ['deriveKey']),
-diff --git a/test/parallel/test-webcrypto-sign-verify.js b/test/parallel/test-webcrypto-sign-verify.js
-index de736102bdcb71a5560c95f7041537f25026aed4..12d7fa39446c196bdf1479dbe74c9ee8ab02f949 100644
---- a/test/parallel/test-webcrypto-sign-verify.js
-+++ b/test/parallel/test-webcrypto-sign-verify.js
-@@ -105,8 +105,9 @@ const { subtle } = globalThis.crypto;
-   test('hello world').then(common.mustCall());
- }
- 
-+
- // Test Sign/Verify Ed25519
--{
-+if (!common.openSSLIsBoringSSL) {
-   async function test(data) {
-     const ec = new TextEncoder();
-     const { publicKey, privateKey } = await subtle.generateKey({
-@@ -126,7 +127,7 @@ const { subtle } = globalThis.crypto;
- }
- 
- // Test Sign/Verify Ed448
--{
-+if (!common.openSSLIsBoringSSL) {
-   async function test(data) {
-     const ec = new TextEncoder();
-     const { publicKey, privateKey } = await subtle.generateKey({
 diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js
 index d1ca571af4be713082d32093bfb8a65f2aef9800..57b8df2ce18df58ff54b2d828af67e3c2e082fe0 100644
 --- a/test/parallel/test-webcrypto-wrap-unwrap.js

patches/node/fix_do_not_resolve_electron_entrypoints.patch

@@ -6,7 +6,7 @@ Subject: fix: do not resolve electron entrypoints
 This wastes fs cycles and can result in strange behavior if this path actually exists on disk
 
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 49aacb6262502ced54e817f99dd596db85b9659c..f9f065bb743275e9b2ce71375e6a9f06e00c0f36 100644
+index bbd3085cfbf14aefd611954fa836f6c96d7e402c..9e71d2d0b79656e212fb21efdb3efcf988529f5e 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
 @@ -291,6 +291,9 @@ function cjsPreparseModuleExports(filename, source, isMain, format) {

patches/node/fix_expose_readfilesync_override_for_modules.patch

@@ -8,10 +8,10 @@ an API override to replace the native `ReadFileSync` in the `modules`
 binding.
 
 diff --git a/src/env_properties.h b/src/env_properties.h
-index cbb7eab2df0416087cd3e6fb80eef2079143d9c8..7e9f5e977506149d69c6015e85d031770325e1da 100644
+index 3df4e303e05105b43a542456546cbc050d0445fa..4f7aee6cb64b4c1d25e98b43d13e747c4546adaa 100644
 --- a/src/env_properties.h
 +++ b/src/env_properties.h
-@@ -501,6 +501,7 @@
+@@ -502,6 +502,7 @@
    V(maybe_cache_generated_source_map, v8::Function)                            \
    V(messaging_deserialize_create_object, v8::Function)                         \
    V(message_port, v8::Object)                                                  \

patches/node/fix_expose_the_built-in_electron_module_via_the_esm_loader.patch

@@ -64,7 +64,7 @@ index 5ba13096b98047ff33e4d44167c2a069ccc5e69d..09a332c0999086b30fd952d9456f7889
    }
  }
 diff --git a/lib/internal/modules/esm/loader.js b/lib/internal/modules/esm/loader.js
-index aff686577df3c366f06f90666e23a03fc376cf53..e8857a151428acd6f8ece74d92774a18accc1e13 100644
+index 5a817ed0434b8bc08f9b9bd260c978bbe5ddc664..f9dba42cddb08f69e02834f76d6d80c5e47a637d 100644
 --- a/lib/internal/modules/esm/loader.js
 +++ b/lib/internal/modules/esm/loader.js
 @@ -492,7 +492,7 @@ class ModuleLoader {
@@ -101,7 +101,7 @@ index bfd9bd3d127404de1cbb6f30c43ab0342590759d..9e7d8ef0adef3b68a3ec186e4b218f59
  
    const packageConfig = packageJsonReader.read(packageJSONPath, { __proto__: null, specifier, base, isESM: true });
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 7dcd7afe8ce3c25ceb314cdf15c330f3d66eb84f..4445bcc4c4c6c6f87ac45e693012a18a93739f9b 100644
+index 0695b47a8a8f78451c20c025a3d9dac7cadab686..1db58d31dad24cd2da6bdc5e45e9dd4f0b899a23 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
 @@ -186,7 +186,7 @@ function createCJSModuleWrap(url, source, isMain, format, loadCJS = loadCJSModul

patches/node/fix_handle_boringssl_and_openssl_incompatibilities.patch

@@ -172,7 +172,7 @@ index e5bf2b529bf23914677e25d7468aad58a4684557..9a3c6029ff3319cce58c79782a7bd5d1
    };
    // Check to see if the given public key is suitable for this DH instance.
 diff --git a/node.gni b/node.gni
-index 245a43920c7baf000ba63192a84a4c3fd219be7d..56a554175b805c1703f13d62041f8c80d6e94dd9 100644
+index 62cd49c6a87074912a1cb6792576c8d4f239b669..165b26a79a7f2b74d2a2252dc2350b2e10c091e6 100644
 --- a/node.gni
 +++ b/node.gni
 @@ -11,7 +11,7 @@ declare_args() {
@@ -183,7 +183,7 @@ index 245a43920c7baf000ba63192a84a4c3fd219be7d..56a554175b805c1703f13d62041f8c80
 +  node_openssl_path = "//third_party/boringssl"
  
    # The location of simdutf - use the one from node's deps by default.
-   node_simdutf_path = "$node_path/deps/simdutf"
+   node_simdutf_path = "//third_party/simdutf"
 diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
 index 2176fb6982484e2c42538478eeb4dd81c9d50ee1..c00d3616e08b00b1e0a3a29b2dbb5278e1e14fcc 100644
 --- a/src/crypto/crypto_cipher.cc
@@ -520,7 +520,7 @@ index 7c548d32b40365343f0e208c3aa856a1c847f4c3..6346f8f7199cf7b7d3736c59571606ff
  }  // namespace
  
 diff --git a/src/env.h b/src/env.h
-index b6bdff9b8580d2588a39f00b594c4c480157d78a..cfe917c797a6e4bb0f0284ec56be82637f840129 100644
+index c42493ad958508f650917bf5ca92088714a5056c..07accfbcca491966c6c8ad9c20e146dbd22347f0 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -50,7 +50,7 @@
@@ -532,7 +532,7 @@ index b6bdff9b8580d2588a39f00b594c4c480157d78a..cfe917c797a6e4bb0f0284ec56be8263
  #include <openssl/evp.h>
  #endif
  
-@@ -1073,7 +1073,7 @@ class Environment final : public MemoryRetainer {
+@@ -1076,7 +1076,7 @@ class Environment final : public MemoryRetainer {
      kExitInfoFieldCount
    };
  
@@ -541,8 +541,23 @@ index b6bdff9b8580d2588a39f00b594c4c480157d78a..cfe917c797a6e4bb0f0284ec56be8263
  #if OPENSSL_VERSION_MAJOR >= 3
    // We declare another alias here to avoid having to include crypto_util.h
    using EVPMDPointer = DeleteFnPtr<EVP_MD, EVP_MD_free>;
+diff --git a/src/node_config.cc b/src/node_config.cc
+index 6032bbd10f41da7bae44828a8e908c1bec0ea0b6..2013de54f0f6a036e8378deefbff8d7cb5f7cfb2 100644
+--- a/src/node_config.cc
++++ b/src/node_config.cc
+@@ -7,6 +7,10 @@
+ #include "node_options.h"
+ #include "util-inl.h"
+ 
++#if HAVE_OPENSSL
++#include <openssl/base.h>
++#endif
++
+ namespace node {
+ 
+ using v8::Context;
 diff --git a/src/node_metadata.h b/src/node_metadata.h
-index 6f8cb433ff8059c63d5cf16c8783139ae92fbf61..603ac3dde7d1a1109afbc451b69c8d0935b81641 100644
+index 7b2072ad39c3f1a7c73101b25b69beb781141e26..d23536d88d21255d348175425a59e2424332cd19 100644
 --- a/src/node_metadata.h
 +++ b/src/node_metadata.h
 @@ -6,7 +6,7 @@
@@ -555,7 +570,7 @@ index 6f8cb433ff8059c63d5cf16c8783139ae92fbf61..603ac3dde7d1a1109afbc451b69c8d09
  #if NODE_OPENSSL_HAS_QUIC
  #include <openssl/quic.h>
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 3fc8194475ec0e8a9047c1f3da5d120f25d66190..8be78889e8234eb3100f309829bf7470db544dcd 100644
+index da39abf79c53fcc3d83d3431deda9dbdf3b0621e..14f7764c995e8de6582faf58c9b98a9cbe4fab73 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -7,7 +7,7 @@
@@ -568,7 +583,7 @@ index 3fc8194475ec0e8a9047c1f3da5d120f25d66190..8be78889e8234eb3100f309829bf7470
  #endif
  
 diff --git a/src/node_options.h b/src/node_options.h
-index 7d14f06370d936a3866f0d988123de9fe614ce09..60068b008b2e2a034c3f0c58b947a8d04d55e3b2 100644
+index 165950c207ca752ec942ef27a671af66cbd2b938..eb18fdd617fd19e5b97cd67f351e70c28fee3e75 100644
 --- a/src/node_options.h
 +++ b/src/node_options.h
 @@ -11,7 +11,7 @@

patches/node/fix_lazyload_fs_in_esm_loaders_to_apply_asar_patches.patch

@@ -60,7 +60,7 @@ index 9e7d8ef0adef3b68a3ec186e4b218f591aa69266..2879e5cf541fb4d226cfd7cc0fe367ca
      });
      const { search, hash } = resolved;
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 4445bcc4c4c6c6f87ac45e693012a18a93739f9b..49aacb6262502ced54e817f99dd596db85b9659c 100644
+index 1db58d31dad24cd2da6bdc5e45e9dd4f0b899a23..bbd3085cfbf14aefd611954fa836f6c96d7e402c 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
 @@ -24,7 +24,7 @@ const {

patches/node/fix_remove_deprecated_errno_constants.patch

@@ -10,19 +10,19 @@ This change removes the usage of these constants to fix a compilation failure du
 See: https://github.com/llvm/llvm-project/pull/80542
 
 diff --git a/deps/uv/include/uv.h b/deps/uv/include/uv.h
-index f75a496071ac3396cbc6dec819eaab7294609deb..30f9a05f2f508b55a7d7ae036612660068c8400e 100644
+index 0295eeddbb4eb1cffd9dbcd02e037907fadc1b7e..7c2f9d2a8b13584ff6b33cd3ff4745e9fb3c4170 100644
 --- a/deps/uv/include/uv.h
 +++ b/deps/uv/include/uv.h
-@@ -155,7 +155,6 @@ struct uv__queue {
+@@ -156,7 +156,6 @@ struct uv__queue {
    XX(EFTYPE, "inappropriate file type or format")                             \
    XX(EILSEQ, "illegal byte sequence")                                         \
    XX(ESOCKTNOSUPPORT, "socket type not supported")                            \
 -  XX(ENODATA, "no data available")                                            \
    XX(EUNATCH, "protocol driver not attached")                                 \
+   XX(ENOEXEC, "exec format error")                                            \
  
- #define UV_HANDLE_TYPE_MAP(XX)                                                \
 diff --git a/deps/uv/include/uv/errno.h b/deps/uv/include/uv/errno.h
-index 127278ef916161a96e23e645927d16bedfdaca5b..b36da3daa5744e6f994e32d9d82aaef689008a5f 100644
+index ac00778cfc59fb55e361b24fc81a965a5e8f97e7..f0c4d6dfc9f03bee59e656b2da9ac325bced7b69 100644
 --- a/deps/uv/include/uv/errno.h
 +++ b/deps/uv/include/uv/errno.h
 @@ -456,18 +456,6 @@
@@ -45,7 +45,7 @@ index 127278ef916161a96e23e645927d16bedfdaca5b..b36da3daa5744e6f994e32d9d82aaef6
  # define UV__EUNATCH UV__ERR(EUNATCH)
  #else
 diff --git a/src/node_constants.cc b/src/node_constants.cc
-index 13263149c111beede83b7063fa54f56655aea54c..99068098e1867af4846e18a5d039a25689722a4a 100644
+index 8c44e32381a44675792ca0922e47df1adda48e41..d193725ea9a3270ed9affea12d11467fb14efdf8 100644
 --- a/src/node_constants.cc
 +++ b/src/node_constants.cc
 @@ -241,10 +241,6 @@ void DefineErrnoConstants(Local<Object> target) {

patches/node/fix_remove_fastapitypedarray_usage.patch

@@ -48,7 +48,7 @@ index 867a1c4aca54b9d41490d23a5eb55088b7e941cc..09f4c65a18efea262b1f854f993c6f18
  
  static v8::CFunction fast_equal(v8::CFunction::Make(FastTimingSafeEqual));
 diff --git a/src/node_buffer.cc b/src/node_buffer.cc
-index 5bdffc0a4d7f8f643343593a543f2064b670c1b9..6931404b75dbe17bf3c7b561430b8d7c0921d085 100644
+index b8021c079ca6b141ea99a4abbc828430da9d3093..98ade40ec7a6bc805acb579c8a51dcd5468c2893 100644
 --- a/src/node_buffer.cc
 +++ b/src/node_buffer.cc
 @@ -44,6 +44,14 @@
@@ -194,7 +194,7 @@ index 5bdffc0a4d7f8f643343593a543f2064b670c1b9..6931404b75dbe17bf3c7b561430b8d7c
  
  static const v8::CFunction fast_write_string_ascii(
 diff --git a/src/node_external_reference.h b/src/node_external_reference.h
-index bb007dbdcce486659afeed07b78103e44b00307b..314a4ded6908a94107de1ae1e550b7d46afdce75 100644
+index 3bc7b2cab5a12e281058b79a7d0f734eb527986c..4218eaf365c739a4c04ca94e29d6d2a33a637d44 100644
 --- a/src/node_external_reference.h
 +++ b/src/node_external_reference.h
 @@ -43,16 +43,16 @@ using CFunctionCallbackWithStrings =
@@ -219,7 +219,7 @@ index bb007dbdcce486659afeed07b78103e44b00307b..314a4ded6908a94107de1ae1e550b7d4
                  uint32_t,
                  int64_t,
                  bool);
-@@ -71,18 +71,20 @@ using CFunctionWithBool = void (*)(v8::Local<v8::Value>,
+@@ -73,18 +73,20 @@ using CFunctionWithBool = void (*)(v8::Local<v8::Value>,
  
  using CFunctionWriteString =
      uint32_t (*)(v8::Local<v8::Value> receiver,
@@ -246,7 +246,7 @@ index bb007dbdcce486659afeed07b78103e44b00307b..314a4ded6908a94107de1ae1e550b7d4
  // This class manages the external references from the V8 heap
  // to the C++ addresses in Node.js.
 diff --git a/src/util.h b/src/util.h
-index a77332f583402af956cc886fd5b9771390cc4827..f0d7571caa458a3f9a9c252a95f72eb5fbddd06d 100644
+index 6376cf4f81113cdb2e3c179b800f1c79b51ab762..cc7ad99f981f564fba0395159d9d8b39901050ff 100644
 --- a/src/util.h
 +++ b/src/util.h
 @@ -60,6 +60,7 @@

patches/node/fix_remove_harmony-import-assertions_from_node_cc.patch

@@ -11,10 +11,10 @@ This patch can be removed when we upgrade to a V8 version that
 contains the above CL.
 
 diff --git a/src/node.cc b/src/node.cc
-index 0fbcd55d674b1d0cae88f04fe337cfcca702255f..092b1c525c7d4d50a09f99dc088d0698afcaf8a6 100644
+index c0d0b734edfa729c91a8112189c480e3f2382988..a43d36c731693b9d2ed1ba13f6b4bb33bf6c4ca4 100644
 --- a/src/node.cc
 +++ b/src/node.cc
-@@ -814,7 +814,7 @@ static ExitCode ProcessGlobalArgsInternal(std::vector<std::string>* args,
+@@ -816,7 +816,7 @@ static ExitCode ProcessGlobalArgsInternal(std::vector<std::string>* args,
    }
    // TODO(nicolo-ribaudo): remove this once V8 doesn't enable it by default
    // anymore.

patches/node/linux_try_preadv64_pwritev64_before_preadv_pwritev_4683.patch

@@ -1,51 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Ben Noordhuis <info@bnoordhuis.nl>
-Date: Tue, 28 Jan 2025 09:27:58 +0100
-Subject: linux: try preadv64/pwritev64 before preadv/pwritev (#4683)
-
-Fixes: https://github.com/libuv/libuv/issues/4678
-Refs: https://github.com/libuv/libuv/issues/4532
-
-diff --git a/deps/uv/src/unix/fs.c b/deps/uv/src/unix/fs.c
-index 239ecda16a7eb9b40453502cf0362ae66366cf72..1631d9340bc10c2ac4c3d53a63ed9bc10f3e1c7c 100644
---- a/deps/uv/src/unix/fs.c
-+++ b/deps/uv/src/unix/fs.c
-@@ -461,12 +461,7 @@ static ssize_t uv__pwritev_emul(int fd,
- 
- /* The function pointer cache is an uintptr_t because _Atomic void*
-  * doesn't work on macos/ios/etc...
-- * Disable optimization on armv7 to work around the bug described in
-- * https://github.com/libuv/libuv/issues/4532
-  */
--#if defined(__arm__) && (__ARM_ARCH == 7)
--__attribute__((optimize("O0")))
--#endif
- static ssize_t uv__preadv_or_pwritev(int fd,
-                                      const struct iovec* bufs,
-                                      size_t nbufs,
-@@ -479,7 +474,12 @@ static ssize_t uv__preadv_or_pwritev(int fd,
-   p = (void*) atomic_load_explicit(cache, memory_order_relaxed);
-   if (p == NULL) {
- #ifdef RTLD_DEFAULT
--    p = dlsym(RTLD_DEFAULT, is_pread ? "preadv" : "pwritev");
-+    /* Try _LARGEFILE_SOURCE version of preadv/pwritev first,
-+     * then fall back to the plain version, for libcs like musl.
-+     */
-+    p = dlsym(RTLD_DEFAULT, is_pread ? "preadv64" : "pwritev64");
-+    if (p == NULL)
-+      p = dlsym(RTLD_DEFAULT, is_pread ? "preadv" : "pwritev");
-     dlerror();  /* Clear errors. */
- #endif  /* RTLD_DEFAULT */
-     if (p == NULL)
-@@ -487,10 +487,7 @@ static ssize_t uv__preadv_or_pwritev(int fd,
-     atomic_store_explicit(cache, (uintptr_t) p, memory_order_relaxed);
-   }
- 
--  /* Use memcpy instead of `f = p` to work around a compiler bug,
--   * see https://github.com/libuv/libuv/issues/4532
--   */
--  memcpy(&f, &p, sizeof(p));
-+  f = p;
-   return f(fd, bufs, nbufs, off);
- }
- 

patches/node/pass_all_globals_through_require.patch

@@ -6,7 +6,7 @@ Subject: Pass all globals through "require"
 (cherry picked from commit 7d015419cb7a0ecfe6728431a4ed2056cd411d62)
 
 diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
-index ccd2b4ced3134d81ddd37b8b5b90218457633421..a19fc5e52109bf2ad63fbe554c02a458c3096081 100644
+index d90476addb3f7cc2d0b8d8686386873894e75c25..e647bdda4624317615490cedd8d4edbcebbca8bc 100644
 --- a/lib/internal/modules/cjs/loader.js
 +++ b/lib/internal/modules/cjs/loader.js
 @@ -200,6 +200,13 @@ const {

patches/node/refactor_allow_embedder_overriding_of_internal_fs_calls.patch

@@ -7,7 +7,7 @@ We use this to allow node's 'fs' module to read from ASAR files as if they were
 a real filesystem.
 
 diff --git a/lib/internal/bootstrap/node.js b/lib/internal/bootstrap/node.js
-index 4fd535f730e6382672b853bf2098b3fefc1f83b4..bd6724de52ee1f01fa42084c7652c71054f0a9c6 100644
+index dd9e3e58d72fb9ada1528212f80e0e911292a266..5758c74f6139dbe4fbeeae9d1e9b078688261257 100644
 --- a/lib/internal/bootstrap/node.js
 +++ b/lib/internal/bootstrap/node.js
 @@ -132,6 +132,10 @@ process.domain = null;

patches/node/refactor_attach_cppgc_heap_on_v8_isolate_creation.patch

@@ -47,7 +47,7 @@ index 5b7f6e0609c8414c686d2d5ca603ea5c8bc484d0..6c9c81ff3c08fc28dc35578229a78552
                      event_loop,
                      platform,
 diff --git a/src/env.cc b/src/env.cc
-index ddf82c8a18c29c355641e33974c1e5e67867379d..ae43803d8c2de90fb191a8e10605f6f3b18816ed 100644
+index 400ff494f4e153408a2fce343d7b156d7ccefc7b..cac2d97323d131451eab4ca68ce771cb936447e4 100644
 --- a/src/env.cc
 +++ b/src/env.cc
 @@ -577,14 +577,6 @@ IsolateData::IsolateData(Isolate* isolate,
@@ -82,7 +82,7 @@ index ddf82c8a18c29c355641e33974c1e5e67867379d..ae43803d8c2de90fb191a8e10605f6f3
  void SetCppgcReference(Isolate* isolate,
                         Local<Object> object,
 diff --git a/src/env.h b/src/env.h
-index 9f1c7ef45b6df10f811936a78ea6d9fcc13fef4f..c429eecd937d1df32a2ff90bc0a22a2e58df3a3d 100644
+index 1079e3beb02e5f5d71a15fd2db65cb93ebd175d6..a7be609c3ab9093cec5145367b95ae6859936a24 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -155,7 +155,6 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
@@ -102,10 +102,10 @@ index 9f1c7ef45b6df10f811936a78ea6d9fcc13fef4f..c429eecd937d1df32a2ff90bc0a22a2e
    worker::Worker* worker_context_ = nullptr;
    PerIsolateWrapperData* wrapper_data_;
 diff --git a/src/node.cc b/src/node.cc
-index 092b1c525c7d4d50a09f99dc088d0698afcaf8a6..6f8f6386d0db8aef1e2e0126cc9064101cbe6112 100644
+index a43d36c731693b9d2ed1ba13f6b4bb33bf6c4ca4..0c2a4d344c991c2ca0d9d90934cf7921abf2a629 100644
 --- a/src/node.cc
 +++ b/src/node.cc
-@@ -1258,6 +1258,14 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
+@@ -1257,6 +1257,14 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
      result->platform_ = per_process::v8_platform.Platform();
    }
  
@@ -120,7 +120,7 @@ index 092b1c525c7d4d50a09f99dc088d0698afcaf8a6..6f8f6386d0db8aef1e2e0126cc906410
    if (!(flags & ProcessInitializationFlags::kNoInitializeV8)) {
      V8::Initialize();
  
-@@ -1267,14 +1275,6 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
+@@ -1266,14 +1274,6 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
      absl::SetMutexDeadlockDetectionMode(absl::OnDeadlockCycle::kIgnore);
    }
  

patches/node/src_remove_dependency_on_wrapper-descriptor-based_cppheap.patch

@@ -16,7 +16,7 @@ patch:
 (cherry picked from commit 30329d06235a9f9733b1d4da479b403462d1b326)
 
 diff --git a/src/env-inl.h b/src/env-inl.h
-index d4b211dfb2f77a65f311701d95365e66d92f8875..4c1a5f2b92d7fdddb8c2e7bbfd6788fdff3645b9 100644
+index 0d32d9f5a55da257a5e5a895a2ff002b780f96fe..9567d9499c62ea44cca651e87ab912ad55e2d90b 100644
 --- a/src/env-inl.h
 +++ b/src/env-inl.h
 @@ -62,31 +62,6 @@ inline uv_loop_t* IsolateData::event_loop() const {
@@ -52,7 +52,7 @@ index d4b211dfb2f77a65f311701d95365e66d92f8875..4c1a5f2b92d7fdddb8c2e7bbfd6788fd
    return &(wrapper_data_->cppgc_id);
  }
 diff --git a/src/env.cc b/src/env.cc
-index f8c24e422756d5101a258175a2f28a96648bea47..ddf82c8a18c29c355641e33974c1e5e67867379d 100644
+index 99bd3e37853f99ecb2e45df373f17c10b3bd1561..400ff494f4e153408a2fce343d7b156d7ccefc7b 100644
 --- a/src/env.cc
 +++ b/src/env.cc
 @@ -23,6 +23,7 @@
@@ -146,7 +146,7 @@ index f8c24e422756d5101a258175a2f28a96648bea47..ddf82c8a18c29c355641e33974c1e5e6
  
  void IsolateData::MemoryInfo(MemoryTracker* tracker) const {
 diff --git a/src/env.h b/src/env.h
-index cfe917c797a6e4bb0f0284ec56be82637f840129..9f1c7ef45b6df10f811936a78ea6d9fcc13fef4f 100644
+index 07accfbcca491966c6c8ad9c20e146dbd22347f0..1079e3beb02e5f5d71a15fd2db65cb93ebd175d6 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -175,10 +175,6 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {

patches/node/src_stop_using_deprecated_fields_of_fastapicallbackoptions.patch

@@ -40,10 +40,10 @@ index 5641990e0bac455c33ddf7b9a865deba871516e7..bd757f42e02391abbeec007d9c4cea60
    }
    HistogramBase* histogram;
 diff --git a/src/node_file.cc b/src/node_file.cc
-index 5aea65d6800494def62829432ee48f9c06e65d63..80cf6648ed99241eea8c176c5c958d76fe33aa14 100644
+index 37172158d318d6569194fd3c5441d107e155e54c..41498615a37945111348e22b18214c3bcc9533a0 100644
 --- a/src/node_file.cc
 +++ b/src/node_file.cc
-@@ -1071,13 +1071,8 @@ static int32_t FastInternalModuleStat(
+@@ -1074,13 +1074,8 @@ static int32_t FastInternalModuleStat(
      // NOLINTNEXTLINE(runtime/references) This is V8 api.
      FastApiCallbackOptions& options) {
    // This needs a HandleScope which needs an isolate.

patches/node/support_v8_sandboxed_pointers.patch

@@ -189,7 +189,7 @@ index f616223cfb0f6e10f7cf57ada9704316bde2797e..eb6dad44a49d997097c8fb5009eeb60a
    Local<Value> ret;
    if (!Buffer::New(env, ab, 0, ab->ByteLength()).ToLocal(&ret)) return {};
 diff --git a/src/node_i18n.cc b/src/node_i18n.cc
-index ea7810e41e2667713a896250dc1b904b0a7cf198..865b3128c1edfe7074769f25a0b87878ca094f31 100644
+index 61b6ecd240c9500f21f683065a2f920af3afb502..ad2b1c76325cb5c8f18a618c5a85ae87b6a7bbe7 100644
 --- a/src/node_i18n.cc
 +++ b/src/node_i18n.cc
 @@ -104,7 +104,7 @@ namespace {
@@ -384,18 +384,3 @@ index 9787b14352753c5e0f8dc2b90093680e7cd10f1a..31af9e62396368af1b81f8841a705fd3
    auto ab = ArrayBuffer::New(isolate, std::move(bs));
    v8::Local<Uint8Array> u8 = v8::Uint8Array::New(ab, 0, 1);
  
-diff --git a/test/parallel/test-buffer-tostring-range.js b/test/parallel/test-buffer-tostring-range.js
-index 73fec107a36c3db4af6f492137d0ca174f2d0547..a1153ec381f7b12a1640b611073f6997e1ec5696 100644
---- a/test/parallel/test-buffer-tostring-range.js
-+++ b/test/parallel/test-buffer-tostring-range.js
-@@ -102,8 +102,8 @@ assert.throws(() => {
- // Must not throw when start and end are within kMaxLength
- // Cannot test on 32bit machine as we are testing the case
- // when start and end are above the threshold
--if (!common.openSSLIsBoringSSL) {
-+/*
- const threshold = 0xFFFFFFFF;
- const largeBuffer = Buffer.alloc(threshold + 20);
- largeBuffer.toString('utf8', threshold, threshold + 20);
--}
-+*/

patches/node/test_force_slow_json_stringify_path_for_overflow.patch

@@ -1,38 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Shelley Vohr <shelley.vohr@gmail.com>
-Date: Mon, 5 May 2025 13:04:14 +0000
-Subject: test: force slow JSON.stringify path for overflow
-
-Refs https://chromium-review.googlesource.com/c/v8/v8/+/6011806
-
-The V8 team just enabled the JSON.stringify fast path by default,
-which is iterative and won't throw. Pre-emptively preserve test
-functionality by forcing the slow path. See above linked PR for
-approach this is borrowed from.
-
-Upstreamed in https://github.com/nodejs/node/pull/58181.
-
-diff --git a/test/fixtures/console/stack_overflow.js b/test/fixtures/console/stack_overflow.js
-index 565692b6d6e4ba4c439a38250407004c5aa21df9..14bceef878b5cf27609b29c8cc7852cab4dd63ff 100644
---- a/test/fixtures/console/stack_overflow.js
-+++ b/test/fixtures/console/stack_overflow.js
-@@ -26,11 +26,15 @@ Error.stackTraceLimit = 0;
- 
- console.error('before');
- 
-+// Invalidate elements protector to force slow-path.
-+// The fast-path of JSON.stringify is iterative and won't throw.
-+Array.prototype[2] = 'foo';
-+
- // Trigger stack overflow by stringifying a deeply nested array.
--let array = [];
--for (let i = 0; i < 100000; i++) {
--  array = [ array ];
--}
-+// eslint-disable-next-line no-sparse-arrays
-+let array = [,];
-+for (let i = 0; i < 10000; i++)
-+  array = [array];
- 
- JSON.stringify(array);
- 

patches/node/test_formally_mark_some_tests_as_flaky.patch

@@ -7,7 +7,7 @@ Instead of disabling the tests, flag them as flaky so they still run
 but don't cause CI failures on flakes.
 
 diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
-index cc99efd7a743d683d5210ad83e258560c28cbd16..b2f0f7fb49665f0dc924cdd3e344c2579d617fbf 100644
+index 8b9a4e80a08031085dde8a6952224e6ca3ca052e..2e83f166a34930083e697aaf06271e79cefe3f23 100644
 --- a/test/parallel/parallel.status
 +++ b/test/parallel/parallel.status
 @@ -5,6 +5,16 @@ prefix parallel