fix: app.accessibilitySupportEnabled (#48061)

fix: app.accessibilitySupportEnabled on macOS

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>

.devcontainer/docker-compose.yml

@@ -2,7 +2,7 @@ version: '3'
 
 services:
   buildtools:
-    image: ghcr.io/electron/devcontainer:424eedbf277ad9749ffa9219068aa72ed4a5e373
+    image: ghcr.io/electron/devcontainer:933c7d6ff6802706875270bec2e3c891cf8add3f
 
     volumes:
       - ..:/workspaces/gclient/src/electron:cached

.github/actions/build-electron/action.yml

@@ -38,6 +38,12 @@ runs:
       run: |
         GN_APPENDED_ARGS="$GN_EXTRA_ARGS target_cpu=\"x64\" v8_snapshot_toolchain=\"//build/toolchain/mac:clang_x64\""
         echo "GN_EXTRA_ARGS=$GN_APPENDED_ARGS" >> $GITHUB_ENV
+    - name: Set GN_EXTRA_ARGS for Windows
+      shell: bash
+      if: ${{inputs.target-arch != 'x64' && inputs.target-platform == 'win' }}
+      run: |
+        GN_APPENDED_ARGS="$GN_EXTRA_ARGS target_cpu=\"${{ inputs.target-arch }}\""
+        echo "GN_EXTRA_ARGS=$GN_APPENDED_ARGS" >> $GITHUB_ENV
     - name: Add Clang problem matcher
       shell: bash
       run: echo "::add-matcher::src/electron/.github/problem-matchers/clang.json"
@@ -184,8 +190,8 @@ runs:
           electron/script/zip-symbols.py -b $BUILD_PATH
         fi
     - name: Generate FFMpeg ${{ inputs.step-suffix }}
-      shell: bash
       if: ${{ inputs.is-release == 'true' }}
+      shell: bash
       run: |
         cd src
         gn gen out/ffmpeg --args="import(\"//electron/build/args/ffmpeg.gn\") use_remoteexec=true $GN_EXTRA_ARGS"

.github/actions/checkout/action.yml

@@ -40,7 +40,7 @@ runs:
     if: ${{ inputs.generate-sas-token == 'true' }}
     shell: bash
     run: |
-      curl --unix-socket /var/run/sas/sas.sock --fail "http://foo/$CACHE_FILE?platform=${{ inputs.target-platform }}" > sas-token
+      curl --unix-socket /var/run/sas/sas.sock --fail "http://foo/$CACHE_FILE?platform=${{ inputs.target-platform }}&getAccountName=true" > sas-token
   - name: Save SAS Key
     if: ${{ inputs.generate-sas-token == 'true' }}
     uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3

.github/actions/free-space-macos/action.yml

@@ -6,6 +6,8 @@ runs:
     - name: Free Space on MacOS
       shell: bash
       run: |
+        echo "Disk usage before cleanup:"
+        df -h
         sudo mkdir -p $TMPDIR/del-target
 
         tmpify() {
@@ -62,4 +64,5 @@ runs:
 
         # lipo off some huge binaries arm64 versions to save space
         strip_universal_deep $(xcode-select -p)/../SharedFrameworks
-        # strip_arm_deep /System/Volumes/Data/Library/Developer/CommandLineTools/usr
+        # strip_arm_deep /System/Volumes/Data/Library/Developer/CommandLineTools/usr
+        sudo mdutil -a -i off

.github/actions/install-build-tools/action.yml

@@ -11,6 +11,7 @@ runs:
         git config --global core.autocrlf false
         git config --global branch.autosetuprebase always
         git config --global core.fscache true
+        git config --global core.longpaths true
         git config --global core.preloadindex true
       fi
       export BUILD_TOOLS_SHA=f2a960b4d82e6b5c9dbbd437378a39489f399c50

.github/actions/restore-cache-azcopy/action.yml

@@ -36,18 +36,19 @@ runs:
           echo "SAS Token not found; exiting src cache download early..."
           exit 1
         else
+          sas_token=$(jq -r '.sasToken' sas-token)
+          account_name=$(jq -r '.accountName' sas-token)
           if [ "${{ inputs.target-platform }}" = "win" ]; then
             azcopy copy --log-level=ERROR \
-            "https://${{ env.AZURE_AKS_CACHE_STORAGE_ACCOUNT }}.file.core.windows.net/${{ env.AZURE_AKS_WIN_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
+            "https://$account_name.file.core.windows.net/${{ env.AZURE_AKS_WIN_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
           else
             azcopy copy --log-level=ERROR \
-            "https://${{ env.AZURE_AKS_CACHE_STORAGE_ACCOUNT }}.file.core.windows.net/${{ env.AZURE_AKS_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
+            "https://$account_name.file.core.windows.net/${{ env.AZURE_AKS_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
           fi            
         fi
     env:
-      AZURE_AKS_CACHE_STORAGE_ACCOUNT: f723719aa87a34622b5f7f3
-      AZURE_AKS_CACHE_SHARE_NAME: pvc-f6a4089f-b082-4bee-a3f9-c3e1c0c02d8f
-      AZURE_AKS_WIN_CACHE_SHARE_NAME: pvc-71dec4f2-0d44-4fd1-a2c3-add049d70bdf
+      AZURE_AKS_CACHE_SHARE_NAME: linux-cache
+      AZURE_AKS_WIN_CACHE_SHARE_NAME: windows-cache
   - name: Clean SAS Key
     shell: bash
     run: rm -f sas-token
@@ -96,7 +97,7 @@ runs:
 
       $TEMP_DIR=New-Item -ItemType Directory -Path temp-cache
       $TEMP_DIR_PATH = $TEMP_DIR.FullName
-      C:\ProgramData\Chocolatey\bin\7z.exe -y x $src_cache -o"$TEMP_DIR_PATH"
+      C:\ProgramData\Chocolatey\bin\7z.exe -y -snld x $src_cache -o"$TEMP_DIR_PATH"
 
   - name: Move Src Cache (Windows)
     if: ${{ inputs.target-platform == 'win' }}

.github/actions/ssh-debug/action.yml

@@ -0,0 +1,20 @@
+name: Debug via SSH
+description: Setup a SSH server with a tunnel to access it to debug via SSH.
+inputs:
+  tunnel:
+    description: 'Enable SSH tunneling via cloudflared'
+    required: true
+    default: 'false'
+  timeout:
+    description: 'SSH session timeout in minutes'
+    required: false
+    type: number
+    default: 60
+runs:
+  using: composite
+  steps:
+    - run: $GITHUB_ACTION_PATH/setup-ssh.sh
+      shell: bash
+      env:
+        TUNNEL: ${{ inputs.tunnel }}
+        TIMEOUT: ${{ inputs.timeout }}

.github/actions/ssh-debug/bashrc

@@ -0,0 +1,4 @@
+# If we're in an interactive SSH session and we're not already in tmux and there's no explicit SSH command, auto attach tmux
+if [ -n "$SSH_TTY" ] && [ -z "$TMUX" ] && [ -z "$SSH_ORIGINAL_COMMAND" ]; then
+    exec tmux attach || exec tmux
+fi

.github/actions/ssh-debug/setup-ssh.sh

@@ -0,0 +1,140 @@
+#!/bin/bash -e
+
+get_authorized_keys() {
+    if [ -z "$AUTHORIZED_USERS" ] || ! echo "$AUTHORIZED_USERS" | grep -q "\b$GITHUB_ACTOR\b"; then
+        return 1
+    fi
+
+    api_response=$(curl -s "https://api.github.com/users/$GITHUB_ACTOR/keys")
+
+    if echo "$api_response" | jq -e 'type == "object" and has("message")' >/dev/null; then
+        error_msg=$(echo "$api_response" | jq -r '.message')
+        echo "Error: $error_msg"
+        return 1
+    else
+        echo "$api_response" | jq -r '.[].key'
+    fi
+}
+
+authorized_keys=$(get_authorized_keys "$GITHUB_ACTOR")
+
+if [ -n "$authorized_keys" ]; then
+    echo "Configured SSH key(s) for user: $GITHUB_ACTOR"
+else
+    echo "Error: User '$GITHUB_ACTOR' is not authorized to access this debug session."
+    echo "Authorized users: $AUTHORIZED_USERS"
+    exit 1
+fi
+
+if [ "$TUNNEL" != "true" ]; then
+    echo "SSH tunneling is disabled. Set enable-tunnel: true to enable remote access."
+    echo "Local SSH server would be available on localhost:2222 if this were a local environment."
+    exit 0
+fi
+
+echo "SSH tunneling enabled. Setting up remote access..."
+
+EXTERNAL_DEPS="curl jq ssh-keygen"
+
+for dep in $EXTERNAL_DEPS; do
+    if ! command -v "$dep" > /dev/null 2>&1; then
+       echo "Command $dep not installed on the system!" >&2
+       exit 1
+    fi
+done
+
+cd "$GITHUB_ACTION_PATH"
+
+bashrc_path=$(pwd)/bashrc
+
+# Source `bashrc` to auto start tmux on SSH login.
+if ! grep -q "$bashrc_path" ~/.bash_profile; then
+    echo >> ~/.bash_profile # On macOS runner there's no newline at the end of the file
+    echo "source \"$bashrc_path\"" >> ~/.bash_profile
+fi
+
+OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+ARCH=$(uname -m)
+
+if [ "$ARCH" = "x86_64" ]; then
+    ARCH="amd64"
+elif [ "$ARCH" = "aarch64" ]; then
+    ARCH="arm64"
+fi
+
+# Install tmux on macOS runners if not present.
+if [ "$OS" = "darwin" ] && ! command -v tmux > /dev/null 2>&1; then
+    echo "Installing tmux..."
+    brew install tmux
+fi
+
+if [ "$OS" = "darwin" ]; then
+    cloudflared_url="https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${OS}-${ARCH}.tgz"
+    echo "Downloading \`cloudflared\` from <$cloudflared_url>..."
+    curl --location --silent --output cloudflared.tgz "$cloudflared_url"
+    tar xf cloudflared.tgz
+    rm cloudflared.tgz
+else
+    cloudflared_url="https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${OS}-${ARCH}"
+    echo "Downloading \`cloudflared\` from <$cloudflared_url>..."
+    curl --location --silent --output cloudflared "$cloudflared_url"
+fi
+
+chmod +x cloudflared
+
+echo "Setting up SSH key for authorized user: $GITHUB_ACTOR"
+echo "$authorized_keys" > authorized_keys
+
+echo 'Creating SSH server key...'
+ssh-keygen -q -f ssh_host_rsa_key -N ''
+
+echo 'Creating SSH server config...'
+sed "s,\$PWD,$PWD,;s,\$USER,$USER," sshd_config.template > sshd_config
+
+echo 'Starting SSH server...'
+/usr/sbin/sshd -f sshd_config -D &
+sshd_pid=$!
+
+echo 'Starting tmux session...'
+(cd "$GITHUB_WORKSPACE" && tmux new-session -d -s debug)
+
+#if no cloudflare tunnel token is provided, exit
+if [ -z "$CLOUDFLARE_TUNNEL_TOKEN" ]; then
+    echo "Error: required CLOUDFLARE_TUNNEL_TOKEN not found"
+    exit 1
+fi
+
+echo 'Starting Cloudflare tunnel...'
+
+./cloudflared tunnel --no-autoupdate run --token "$CLOUDFLARE_TUNNEL_TOKEN" 2>&1 | tee cloudflared.log | sed -u 's/^/cloudflared: /' &
+cloudflared_pid=$!
+
+url="$TUNNEL_HOSTNAME"
+
+public_key=$(cut -d' ' -f1,2 < ssh_host_rsa_key.pub)
+
+(
+    echo '    '
+    echo '    '
+    echo '🔗 SSH Debug Session Ready!'
+    echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
+    echo '    '
+    echo '📋 Copy and run this command to connect:'
+    echo '    '
+    if [ -n "$TUNNEL_HOSTNAME" ]; then
+        echo "ssh-keygen -R action-ssh-debug && echo 'action-ssh-debug $public_key' >> ~/.ssh/known_hosts && ssh -o ProxyCommand='cloudflared access tcp --hostname $url' runner@action-ssh-debug"
+    else
+        echo "ssh-keygen -R action-ssh-debug && echo 'action-ssh-debug $public_key' >> ~/.ssh/known_hosts && ssh -o ProxyCommand='cloudflared access tcp --hostname $url' runner@action-ssh-debug"
+    fi
+    echo '    '
+    echo "⏰ Session expires automatically in $TIMEOUT minutes"
+    echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
+    echo '    '
+    echo '    '
+) | cat
+
+echo 'Starting SSH session in background...'
+./ssh-session.sh "$sshd_pid" "$cloudflared_pid" $TIMEOUT &
+
+echo 'SSH session is running in background. GitHub Action will continue.'
+echo 'Session will auto-cleanup after timeout or when processes end.'

.github/actions/ssh-debug/ssh-session.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+SSHD_PID=$1
+CLOUDFLARED_PID=$2
+SESSION_TIMEOUT=${3:-3600}
+
+# Wait for timeout or until processes die.
+sleep "$SESSION_TIMEOUT" &
+SLEEP_PID=$!
+
+# Monitor if SSH or cloudflared dies early.
+while kill -0 "$SSHD_PID" 2>/dev/null && kill -0 "$CLOUDFLARED_PID" 2>/dev/null && kill -0 "$SLEEP_PID" 2>/dev/null; do
+  sleep 10
+done
+
+# Cleanup.
+kill "$SLEEP_PID" 2>/dev/null || true
+kill "$SSHD_PID" 2>/dev/null || true
+kill "$CLOUDFLARED_PID" 2>/dev/null || true
+
+echo "SSH session ended"

.github/actions/ssh-debug/sshd_config.template

@@ -0,0 +1,9 @@
+Port 2222
+HostKey $PWD/ssh_host_rsa_key
+PidFile $PWD/sshd.pid
+
+# Only allow single user
+AllowUsers $USER
+
+# Only allow those keys
+AuthorizedKeysFile $PWD/authorized_keys

.github/workflows/build-git-cache.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   build-git-cache-linux:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root
@@ -29,7 +29,7 @@ jobs:
         target-platform: linux
 
   build-git-cache-windows:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -51,7 +51,7 @@ jobs:
         target-platform: win
 
   build-git-cache-macos:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     # This job updates the same git cache as linux, so it needs to run after the linux one.
     needs: build-git-cache-linux
     container:

.github/workflows/build.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
         required: true
       skip-macos:
         type: boolean
@@ -64,7 +64,7 @@ jobs:
       id: set-output
       run: |
         if [ -z "${{ inputs.build-image-sha }}" ]; then
-          echo "build-image-sha=424eedbf277ad9749ffa9219068aa72ed4a5e373" >> "$GITHUB_OUTPUT"
+          echo "build-image-sha=933c7d6ff6802706875270bec2e3c891cf8add3f" >> "$GITHUB_OUTPUT"
         else
           echo "build-image-sha=${{ inputs.build-image-sha }}" >> "$GITHUB_OUTPUT"
         fi
@@ -92,7 +92,7 @@ jobs:
   checkout-macos:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-macos}}
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -120,7 +120,7 @@ jobs:
   checkout-linux:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-linux}}
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -146,7 +146,7 @@ jobs:
   checkout-windows:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -191,7 +191,7 @@ jobs:
     with:
       target-platform: linux
       target-archs: x64 arm arm64
-      check-runs-on: electron-arc-linux-amd64-8core
+      check-runs-on: electron-arc-centralus-linux-amd64-8core
       check-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       gn-build-type: testing
     secrets: inherit
@@ -202,7 +202,7 @@ jobs:
     with:
       target-platform: win
       target-archs: x64 x86 arm64
-      check-runs-on: electron-arc-linux-amd64-8core
+      check-runs-on: electron-arc-centralus-linux-amd64-8core
       check-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-windows.outputs.build-image-sha }}","options":"--user root --device /dev/fuse --cap-add SYS_ADMIN","volumes":["/mnt/win-cache:/mnt/win-cache"]}'
       gn-build-type: testing
     secrets: inherit
@@ -252,8 +252,8 @@ jobs:
     uses: ./.github/workflows/pipeline-electron-build-and-test-and-nan.yml
     needs: checkout-linux
     with:
-      build-runs-on: electron-arc-linux-amd64-32core
-      test-runs-on: electron-arc-linux-amd64-4core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: electron-arc-centralus-linux-amd64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
       target-platform: linux
@@ -272,8 +272,8 @@ jobs:
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
     with:
-      build-runs-on: electron-arc-linux-amd64-32core
-      test-runs-on: electron-arc-linux-amd64-4core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: electron-arc-centralus-linux-amd64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
       target-platform: linux
@@ -293,8 +293,8 @@ jobs:
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
     with:
-      build-runs-on: electron-arc-linux-amd64-32core
-      test-runs-on: electron-arc-linux-arm64-4core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: electron-arc-centralus-linux-arm64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/test:arm32v7-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init","volumes":["/home/runner/externals:/mnt/runner-externals"]}'
       target-platform: linux
@@ -313,8 +313,8 @@ jobs:
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
     with:
-      build-runs-on: electron-arc-linux-amd64-32core
-      test-runs-on: electron-arc-linux-arm64-4core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: electron-arc-centralus-linux-arm64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/test:arm64v8-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
       target-platform: linux
@@ -334,7 +334,7 @@ jobs:
     needs: checkout-windows
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     with:
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       test-runs-on: windows-latest
       target-platform: win
       target-arch: x64
@@ -353,7 +353,7 @@ jobs:
     needs: checkout-windows
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     with:
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       test-runs-on: windows-latest
       target-platform: win
       target-arch: x86
@@ -372,7 +372,7 @@ jobs:
     needs: checkout-windows
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     with:
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       test-runs-on: electron-hosted-windows-arm64-4core
       target-platform: win
       target-arch: arm64

.github/workflows/clean-src-cache.yml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   clean-src-cache:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root

.github/workflows/linux-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
       upload-to-storage:
         description: 'Uploads to Azure storage'
         required: false
@@ -19,7 +19,7 @@ on:
 
 jobs:
   checkout-linux:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root
@@ -43,7 +43,7 @@ jobs:
     needs: checkout-linux
     with:
       environment: production-release
-      build-runs-on: electron-arc-linux-amd64-32core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
       build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       target-platform: linux
       target-arch: x64
@@ -59,7 +59,7 @@ jobs:
     needs: checkout-linux
     with:
       environment: production-release
-      build-runs-on: electron-arc-linux-amd64-32core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
       build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       target-platform: linux
       target-arch: arm
@@ -75,7 +75,7 @@ jobs:
     needs: checkout-linux
     with:
       environment: production-release
-      build-runs-on: electron-arc-linux-amd64-32core
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
       build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       target-platform: linux
       target-arch: arm64

.github/workflows/macos-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
         required: true
       upload-to-storage:
         description: 'Uploads to Azure storage'
@@ -20,7 +20,7 @@ on:
 
 jobs:
   checkout-macos:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root

.github/workflows/pipeline-electron-docs-only.yml

@@ -15,7 +15,7 @@ concurrency:
 jobs:
   docs-only:
     name: Docs Only Compile
-    runs-on: electron-arc-linux-amd64-4core
+    runs-on: electron-arc-centralus-linux-amd64-4core
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:

.github/workflows/pipeline-electron-lint.yml

@@ -18,7 +18,7 @@ env:
 jobs:
   lint:
     name: Lint
-    runs-on: electron-arc-linux-amd64-4core
+    runs-on: electron-arc-centralus-linux-amd64-4core
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:

.github/workflows/pipeline-segment-electron-build.yml

@@ -73,6 +73,7 @@ env:
   SUDOWOODO_EXCHANGE_TOKEN: ${{ secrets.SUDOWOODO_EXCHANGE_TOKEN }}
   GCLIENT_EXTRA_ARGS: ${{ inputs.target-platform == 'macos' && '--custom-var=checkout_mac=True --custom-var=host_os=mac' || inputs.target-platform == 'win' && '--custom-var=checkout_win=True' || '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True' }}
   ELECTRON_OUT_DIR: Default
+  ACTIONS_STEP_DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }}
 
 jobs:
   build:
@@ -94,6 +95,15 @@ jobs:
         path: src/electron
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
+    - name: Setup SSH Debugging
+      if: ${{ inputs.target-platform == 'macos' && env.ACTIONS_STEP_DEBUG == 'true' }}
+      uses: ./src/electron/.github/actions/ssh-debug
+      with:
+        tunnel: 'true'
+      env:
+        CLOUDFLARE_TUNNEL_TOKEN: ${{ secrets.CLOUDFLARE_TUNNEL_TOKEN }}
+        TUNNEL_HOSTNAME: ${{ secrets.CLOUDFLARED_SSH_HOSTNAME }}
+        AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
     - name: Free up space (macOS)
       if: ${{ inputs.target-platform == 'macos' }}
       uses: ./src/electron/.github/actions/free-space-macos

.github/workflows/pipeline-segment-electron-test.yml

@@ -40,6 +40,7 @@ env:
   CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
   ELECTRON_OUT_DIR: Default
   ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
+  ACTIONS_STEP_DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }}
 
 jobs:
   test:
@@ -100,9 +101,11 @@ jobs:
         }
 
         userValuesArray=(
-            "'kTCCServiceMicrophone','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
             "'kTCCServiceCamera','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
             "'kTCCServiceBluetoothAlways','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
+            "'kTCCServiceAppleEvents','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
+            "'kTCCServiceCamera','/opt/hca/hosted-compute-agent',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
+            "'kTCCServiceBluetoothAlways','/opt/hca/hosted-compute-agent',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
         )
         for values in "${userValuesArray[@]}"; do
           # Sonoma and higher have a few extra values
@@ -124,6 +127,15 @@ jobs:
         path: src/electron
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
+    - name: Setup SSH Debugging
+      if: ${{ inputs.target-platform == 'macos' && env.ACTIONS_STEP_DEBUG == 'true' }}
+      uses: ./src/electron/.github/actions/ssh-debug
+      with:
+        tunnel: 'true'
+      env:
+        CLOUDFLARE_TUNNEL_TOKEN: ${{ secrets.CLOUDFLARE_TUNNEL_TOKEN }}
+        TUNNEL_HOSTNAME: ${{ secrets.CLOUDFLARED_SSH_HOSTNAME }}
+        AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
     - name: Set Chromium Git Cookie
@@ -135,6 +147,7 @@ jobs:
         git config --global core.autocrlf false
         git config --global branch.autosetuprebase always
         git config --global core.fscache true
+        git config --global core.longpaths true
         git config --global core.preloadindex true
         git clone --filter=tree:0 https://chromium.googlesource.com/chromium/tools/depot_tools.git
         # Ensure depot_tools does not update.
@@ -192,7 +205,6 @@ jobs:
         MOCHA_REPORTER: mocha-multi-reporters
         MOCHA_MULTI_REPORTERS: mocha-junit-reporter, tap
         ELECTRON_DISABLE_SECURITY_WARNINGS: 1
-        ELECTRON_SKIP_NATIVE_MODULE_TESTS: true
         DISPLAY: ':99.0'
         NPM_CONFIG_MSVS_VERSION: '2022'
       run: |

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -38,7 +38,7 @@ env:
 jobs:
   node-tests:
     name: Run Node.js Tests
-    runs-on: electron-arc-linux-amd64-8core
+    runs-on: electron-arc-centralus-linux-amd64-8core
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}
@@ -92,7 +92,7 @@ jobs:
         done
   nan-tests:
     name: Run Nan Tests
-    runs-on: electron-arc-linux-amd64-4core
+    runs-on: electron-arc-centralus-linux-amd64-4core
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}

.github/workflows/windows-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
+        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
         required: true
       upload-to-storage:
         description: 'Uploads to Azure storage'
@@ -20,7 +20,7 @@ on:
 
 jobs:
   checkout-windows:
-    runs-on: electron-arc-linux-amd64-32core
+    runs-on: electron-arc-centralus-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -51,7 +51,7 @@ jobs:
     needs: checkout-windows
     with:
       environment: production-release
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       target-platform: win
       target-arch: x64
       is-release: true
@@ -65,7 +65,7 @@ jobs:
     needs: checkout-windows
     with:
       environment: production-release
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       target-platform: win
       target-arch: arm64
       is-release: true
@@ -79,7 +79,7 @@ jobs:
     needs: checkout-windows
     with:
       environment: production-release
-      build-runs-on: electron-arc-windows-amd64-16core
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
       target-platform: win
       target-arch: x86
       is-release: true

DEPS

@@ -2,9 +2,9 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '138.0.7204.97',
+    '138.0.7204.224',
   'node_version':
-    'v22.17.0',
+    'v22.18.0',
   'nan_version':
     'e14bdcd1f72d62bca1d541b66da43130384ec213',
   'squirrel.mac_version':
@@ -31,7 +31,7 @@ vars = {
   'sysroots_json_path': 'electron/script/sysroots.json',
 
   # KEEP IN SYNC WITH utils.js FILE
-  'yarn_version': '1.15.2',
+  'yarn_version': '1.22.22',
 
   # To be able to build clean Chromium from sources.
   'apply_patches': True,

build/.eslintrc.json

@@ -1,8 +1,8 @@
 {
   "plugins": [
-    "unicorn"
+    "import"
   ],
   "rules": {
-    "unicorn/prefer-node-protocol": "error"
+    "import/enforce-node-protocol-usage": ["error", "always"]
   }
 }

build/webpack/webpack.config.base.js

@@ -121,6 +121,7 @@ if ((globalThis.process || binding.process).argv.includes("--profile-electron-in
           'electron/main$': electronAPIFile,
           'electron/renderer$': electronAPIFile,
           'electron/common$': electronAPIFile,
+          'electron/utility$': electronAPIFile,
           // Force timers to resolve to our dependency that doesn't use window.postMessage
           timers: path.resolve(electronRoot, 'node_modules', 'timers-browserify', 'main.js')
         },
@@ -143,7 +144,9 @@ if ((globalThis.process || binding.process).argv.includes("--profile-electron-in
             transpileOnly: onlyPrintingGraph,
             ignoreDiagnostics: [
               // File '{0}' is not under 'rootDir' '{1}'.
-              6059
+              6059,
+              // Private field '{0}' must be declared in an enclosing class.
+              1111
             ]
           }
         }]

default_app/.eslintrc.json

@@ -1,8 +1,8 @@
 {
   "plugins": [
-    "unicorn"
+    "import"
   ],
   "rules": {
-    "unicorn/prefer-node-protocol": "error"
+    "import/enforce-node-protocol-usage": ["error", "always"]
   }
 }

docs/api/app.md

@@ -601,6 +601,7 @@ Returns `string` - The current application directory.
     * `%APPDATA%` on Windows
     * `$XDG_CONFIG_HOME` or `~/.config` on Linux
     * `~/Library/Application Support` on macOS
+  * `assets` The directory where app assets such as `resources.pak` are stored. By default this is the same as the folder containing the `exe` path. Available on Windows and Linux only.
   * `userData` The directory for storing your app's configuration files, which
     by default is the `appData` directory appended with your app's name. By
     convention files storing user data should be written to this directory, and
@@ -615,7 +616,7 @@ Returns `string` - The current application directory.
     directory.
   * `temp` Temporary directory.
   * `exe` The current executable file.
-  * `module` The `libchromiumcontent` library.
+  * `module` The location of the Chromium module. By default this is synonymous with `exe`.
   * `desktop` The current user's Desktop directory.
   * `documents` Directory for a user's "My Documents".
   * `downloads` Directory for a user's downloads.
@@ -775,6 +776,22 @@ bar, and on macOS, you can visit it from dock menu.
 
 Clears the recent documents list.
 
+### `app.getRecentDocuments()` _macOS_ _Windows_
+
+Returns `string[]` - An array containing documents in the most recent documents list.
+
+```js
+const { app } = require('electron')
+
+const path = require('node:path')
+
+const file = path.join(app.getPath('desktop'), 'foo.txt')
+app.addRecentDocument(file)
+
+const recents = app.getRecentDocuments()
+console.log(recents) // ['/path/to/desktop/foo.txt'}
+```
+
 ### `app.setAsDefaultProtocolClient(protocol[, path, args])`
 
 * `protocol` string - The name of your protocol, without `://`. For example,

docs/api/base-window.md

@@ -1256,6 +1256,43 @@ Sets the properties for the window's taskbar button.
 > `relaunchCommand` and `relaunchDisplayName` must always be set
 > together. If one of those properties is not set, then neither will be used.
 
+#### `win.setAccentColor(accentColor)` _Windows_
+
+* `accentColor` boolean | string - The accent color for the window. By default, follows user preference in System Settings.
+
+Sets the system accent color and highlighting of active window border.
+
+The `accentColor` parameter accepts the following values:
+
+* **Color string** - Sets a custom accent color using standard CSS color formats (Hex, RGB, RGBA, HSL, HSLA, or named colors). Alpha values in RGBA/HSLA formats are ignored and the color is treated as fully opaque.
+* **`true`** - Uses the system's default accent color from user preferences in System Settings.
+* **`false`** - Explicitly disables accent color highlighting for the window.
+
+Examples:
+
+```js
+const win = new BrowserWindow({ frame: false })
+
+// Set red accent color.
+win.setAccentColor('#ff0000')
+
+// RGB format (alpha ignored if present).
+win.setAccentColor('rgba(255,0,0,0.5)')
+
+// Use system accent color.
+win.setAccentColor(true)
+
+// Disable accent color.
+win.setAccentColor(false)
+```
+
+#### `win.getAccentColor()` _Windows_
+
+Returns `string | boolean` - the system accent color and highlighting of active window border in Hex RGB format.
+
+If a color has been set for the window that differs from the system accent color, the window accent color will
+be returned. Otherwise, a boolean will be returned, with `true` indicating that the window uses the global system accent color, and `false` indicating that accent color highlighting is disabled for this window.
+
 #### `win.setIcon(icon)` _Windows_ _Linux_
 
 * `icon` [NativeImage](native-image.md) | string

docs/api/browser-window.md

@@ -1434,6 +1434,43 @@ Sets the properties for the window's taskbar button.
 > `relaunchCommand` and `relaunchDisplayName` must always be set
 > together. If one of those properties is not set, then neither will be used.
 
+#### `win.setAccentColor(accentColor)` _Windows_
+
+* `accentColor` boolean | string - The accent color for the window. By default, follows user preference in System Settings.
+
+Sets the system accent color and highlighting of active window border.
+
+The `accentColor` parameter accepts the following values:
+
+* **Color string** - Sets a custom accent color using standard CSS color formats (Hex, RGB, RGBA, HSL, HSLA, or named colors). Alpha values in RGBA/HSLA formats are ignored and the color is treated as fully opaque.
+* **`true`** - Uses the system's default accent color from user preferences in System Settings.
+* **`false`** - Explicitly disables accent color highlighting for the window.
+
+Examples:
+
+```js
+const win = new BrowserWindow({ frame: false })
+
+// Set red accent color.
+win.setAccentColor('#ff0000')
+
+// RGB format (alpha ignored if present).
+win.setAccentColor('rgba(255,0,0,0.5)')
+
+// Use system accent color.
+win.setAccentColor(true)
+
+// Disable accent color.
+win.setAccentColor(false)
+```
+
+#### `win.getAccentColor()` _Windows_
+
+Returns `string | boolean` - the system accent color and highlighting of active window border in Hex RGB format.
+
+If a color has been set for the window that differs from the system accent color, the window accent color will
+be returned. Otherwise, a boolean will be returned, with `true` indicating that the window uses the global system accent color, and `false` indicating that accent color highlighting is disabled for this window.
+
 #### `win.showDefinitionForSelection()` _macOS_
 
 Same as `webContents.showDefinitionForSelection()`.
@@ -1527,8 +1564,8 @@ events.
 
 Prevents the window contents from being captured by other apps.
 
-On macOS it sets the NSWindow's sharingType to NSWindowSharingNone.
-On Windows it calls SetWindowDisplayAffinity with `WDA_EXCLUDEFROMCAPTURE`.
+On macOS it sets the NSWindow's [`sharingType`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.property?language=objc) to [`NSWindowSharingNone`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.enum/none?language=objc).
+On Windows it calls [`SetWindowDisplayAffinity`](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowdisplayaffinity) with `WDA_EXCLUDEFROMCAPTURE`.
 For Windows 10 version 2004 and up the window will be removed from capture entirely,
 older Windows versions behave as if `WDA_MONITOR` is applied capturing a black window.
 

docs/api/corner-smoothing-css.md

@@ -51,19 +51,17 @@ Use the `system-ui` keyword to match the smoothness to the OS design language.
 
 ### Controlling availibility
 
-This CSS rule can be disabled by setting [the `cornerSmoothingCSS` web preference](./structures/web-preferences.md) to `false`.
+This CSS rule can be disabled using the Blink feature flag `ElectronCSSCornerSmoothing`.
 
 ```js
 const myWindow = new BrowserWindow({
   // [...]
   webPreferences: {
-    enableCornerSmoothingCSS: false // Disables the `-electron-corner-smoothing` CSS rule
+    disableBlinkFeatures: 'ElectronCSSCornerSmoothing' // Disables the `-electron-corner-smoothing` CSS rule
   }
 })
 ```
 
-The CSS rule will still parse, but will have no visual effect.
-
 ### Formal reference
 
 * **Initial value**: `0%`

docs/api/crash-reporter.md

@@ -63,7 +63,7 @@ The `crashReporter` module has the following methods:
   * `extra` Record\<string, string\> (optional) - Extra string key/value
     annotations that will be sent along with crash reports that are generated
     in the main process. Only string values are supported. Crashes generated in
-    child processes will not contain these extra
+    child processes will not include these extra parameters. To add extra
     parameters to crash reports generated from child processes, call
     [`addExtraParameter`](#crashreporteraddextraparameterkey-value) from the
     child process.

docs/api/structures/web-preferences.md

@@ -149,7 +149,6 @@
   `WebContents` when the preferred size changes. Default is `false`.
 * `transparent` boolean (optional) - Whether to enable background transparency for the guest page. Default is `true`. **Note:** The guest page's text and background colors are derived from the [color scheme](https://developer.mozilla.org/en-US/docs/Web/CSS/color-scheme) of its root element. When transparency is enabled, the text color will still change accordingly but the background will remain transparent.
 * `enableDeprecatedPaste` boolean (optional) _Deprecated_ - Whether to enable the `paste` [execCommand](https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand). Default is `false`.
-* `enableCornerSmoothingCSS` boolean (optional) _Experimental_ - Whether the [`-electron-corner-smoothing` CSS rule](../corner-smoothing-css.md) is enabled. Default is `true`.
 
 [chrome-content-scripts]: https://developer.chrome.com/extensions/content_scripts#execution-environment
 [runtime-enabled-features]: https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/platform/runtime_enabled_features.json5

docs/development/build-instructions-linux.md

@@ -7,11 +7,8 @@ Follow the guidelines below for building **Electron itself** on Linux, for the p
 ## Prerequisites
 
 * At least 25GB disk space and 8GB RAM.
-* Python >= 3.7.
-* Node.js. There are various ways to install Node. You can download
-  source code from [nodejs.org](https://nodejs.org) and compile it.
-  Doing so permits installing Node on your own home directory as a standard user.
-  Or try repositories such as [NodeSource](https://nodesource.com/blog/nodejs-v012-iojs-and-the-nodesource-linux-repositories).
+* Python >= 3.9.
+* [Node.js](https://nodejs.org/download/) >= 22.12.0
 * [clang](https://clang.llvm.org/get_started.html) 3.4 or later.
 * Development headers of GTK 3 and libnotify.
 

docs/development/build-instructions-macos.md

@@ -10,8 +10,8 @@ Follow the guidelines below for building **Electron itself** on macOS, for the p
 * [Xcode](https://developer.apple.com/technologies/tools/). The exact version
   needed depends on what branch you are building, but the latest version of
   Xcode is generally a good bet for building `main`.
-* [node.js](https://nodejs.org) (external)
-* Python >= 3.7
+* Python >= 3.9
+* [Node.js](https://nodejs.org/download/) >= 22.12.0
 
 ### Arm64-specific prerequisites
 

docs/development/build-instructions-windows.md

@@ -14,7 +14,7 @@ Follow the guidelines below for building **Electron itself** on Windows, for the
   set a few environment variables to point the toolchains to your installation path.
     * `vs2022_install = DRIVE:\path\to\Microsoft Visual Studio\2022\Community`, replacing `2022` and `Community` with your installed versions and replacing `DRIVE:` with the drive that Visual Studio is on. Often, this will be `C:`.
     * `WINDOWSSDKDIR = DRIVE:\path\to\Windows Kits\10`, replacing `DRIVE:` with the drive that Windows Kits is on. Often, this will be `C:`.
-* [Node.js](https://nodejs.org/download/)
+* [Node.js](https://nodejs.org/download/) >= 22.12.0
 * [Git](https://git-scm.com)
 * Debugging Tools for Windows of Windows SDK 10.0.15063.468 if you plan on
 creating a full distribution since `symstore.exe` is used for creating a symbol

docs/tutorial/recent-documents.md

@@ -77,6 +77,11 @@ To clear the list of recent documents, use the
 In this guide, the list of documents is cleared once all windows have been
 closed.
 
+#### Accessing the list of recent documents
+
+To access the list of recent documents, use the
+[app.getRecentDocuments][getrecentdocuments] API.
+
 ## Additional information
 
 ### Windows Notes
@@ -138,5 +143,6 @@ of `app` module will be emitted for it.
 [dock-menu-image]: https://cloud.githubusercontent.com/assets/639601/5069610/2aa80758-6e97-11e4-8cfb-c1a414a10774.png
 [addrecentdocument]: ../api/app.md#appaddrecentdocumentpath-macos-windows
 [clearrecentdocuments]: ../api/app.md#appclearrecentdocuments-macos-windows
+[getrecentdocuments]: ../api/app.md#appgetrecentdocuments-macos-windows
 [app-registration]: https://learn.microsoft.com/en-us/windows/win32/shell/app-registration
 [menu-item-image]: https://user-images.githubusercontent.com/3168941/33003655-ea601c3a-cd70-11e7-97fa-7c062149cfb1.png

lib/browser/init.ts

@@ -204,7 +204,7 @@ delete process.appCodeLoaded;
 if (packagePath) {
   // Finally load app's main.js and transfer control to C++.
   if ((packageJson.type === 'module' && !mainStartupScript.endsWith('.cjs')) || mainStartupScript.endsWith('.mjs')) {
-    const { runEntryPointWithESMLoader } = __non_webpack_require__('internal/modules/run_main');
+    const { runEntryPointWithESMLoader } = __non_webpack_require__('internal/modules/run_main') as typeof import('@node/lib/internal/modules/run_main');
     const main = (require('url') as typeof url).pathToFileURL(path.join(packagePath, mainStartupScript));
     runEntryPointWithESMLoader(async (cascadedLoader: any) => {
       try {

lib/common/init.ts

@@ -93,20 +93,23 @@ makeElectronModule('electron');
 makeElectronModule('electron/common');
 if (process.type === 'browser') {
   makeElectronModule('electron/main');
-}
-if (process.type === 'renderer') {
+} else if (process.type === 'renderer') {
   makeElectronModule('electron/renderer');
+} else if (process.type === 'utility') {
+  makeElectronModule('electron/utility');
 }
 
 const originalResolveFilename = Module._resolveFilename;
 
-// 'electron/main', 'electron/renderer' and 'electron/common' are module aliases
+// 'electron/{common,main,renderer,utility}' are module aliases
 // of the 'electron' module for TypeScript purposes, i.e., the types for
 // 'electron/main' consist of only main process modules, etc. It is intentional
 // that these can be `require()`-ed from both the main process as well as the
 // renderer process regardless of the names, they're superficial for TypeScript
 // only.
-const electronModuleNames = new Set(['electron', 'electron/main', 'electron/renderer', 'electron/common']);
+const electronModuleNames = new Set([
+  'electron', 'electron/main', 'electron/renderer', 'electron/common', 'electron/utility'
+]);
 Module._resolveFilename = function (request, parent, isMain, options) {
   if (electronModuleNames.has(request)) {
     return 'electron';

lib/node/asar-fs-wrapper.ts

@@ -52,20 +52,20 @@ const {
   getValidatedPath,
   getOptions,
   getDirent
-} = __non_webpack_require__('internal/fs/utils');
+} = __non_webpack_require__('internal/fs/utils') as typeof import('@node/lib/internal/fs/utils');
 
 const {
   assignFunctionName
-} = __non_webpack_require__('internal/util');
+} = __non_webpack_require__('internal/util') as typeof import('@node/lib/internal/util');
 
 const {
   validateBoolean,
   validateFunction
-} = __non_webpack_require__('internal/validators');
+} = __non_webpack_require__('internal/validators') as typeof import('@node/lib/internal/validators');
 
 // In the renderer node internals use the node global URL but we do not set that to be
 // the global URL instance.  We need to do instanceof checks against the internal URL impl
-const { URL: NodeURL } = __non_webpack_require__('internal/url');
+const { URL: NodeURL } = __non_webpack_require__('internal/url') as typeof import('@node/lib/internal/url');
 
 // Separate asar package's path from full path.
 const splitPath = (archivePathOrBuffer: string | Buffer | URL) => {
@@ -742,11 +742,11 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
       }
 
       const dirent = getDirent(currentPath, result[0][i], type);
-      const stat = internalBinding('fs').internalModuleStat(binding, resultPath);
+      const stat = internalBinding('fs').internalModuleStat(resultPath);
 
       context.readdirResults.push(dirent);
-      if (dirent.isDirectory() || stat === 1) {
-        context.pathsQueue.push(path.join(dirent.path, dirent.name));
+      if (dirent!.isDirectory() || stat === 1) {
+        context.pathsQueue.push(path.join(dirent!.path, dirent!.name));
       }
     }
   }
@@ -755,7 +755,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     for (let i = 0; i < result.length; i++) {
       const resultPath = path.join(currentPath, result[i]);
       const relativeResultPath = path.relative(context.basePath, resultPath);
-      const stat = internalBinding('fs').internalModuleStat(binding, resultPath);
+      const stat = internalBinding('fs').internalModuleStat(resultPath);
       context.readdirResults.push(relativeResultPath);
 
       if (stat === 1) {
@@ -825,7 +825,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
         if (context.withFileTypes) {
           readdirResult = [
             [...readdirResult], readdirResult.map((p: string) => {
-              return internalBinding('fs').internalModuleStat(binding, path.join(pathArg, p));
+              return internalBinding('fs').internalModuleStat(path.join(pathArg, p));
             })
           ];
         }
@@ -857,13 +857,13 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
   const { readdir } = fs;
   fs.readdir = function (pathArgument: string, options: ReaddirOptions, callback: ReaddirCallback) {
     callback = typeof options === 'function' ? options : callback;
-    validateFunction(callback, 'callback');
+    validateFunction(callback, 'callback')!;
 
     options = getOptions(options);
     pathArgument = getValidatedPath(pathArgument);
 
     if (options?.recursive != null) {
-      validateBoolean(options?.recursive, 'options.recursive');
+      validateBoolean(options?.recursive, 'options.recursive')!;
     }
 
     if (options?.recursive) {
@@ -914,7 +914,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     pathArgument = getValidatedPath(pathArgument);
 
     if (options?.recursive != null) {
-      validateBoolean(options?.recursive, 'options.recursive');
+      validateBoolean(options?.recursive, 'options.recursive')!;
     }
 
     if (options?.recursive) {
@@ -957,7 +957,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
     pathArgument = getValidatedPath(pathArgument);
 
     if (options?.recursive != null) {
-      validateBoolean(options?.recursive, 'options.recursive');
+      validateBoolean(options?.recursive, 'options.recursive')!;
     }
 
     if (options?.recursive) {
@@ -1010,9 +1010,9 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
   });
 
   const { internalModuleStat } = binding;
-  internalBinding('fs').internalModuleStat = (receiver: unknown, pathArgument: string) => {
+  internalBinding('fs').internalModuleStat = (pathArgument: string) => {
     const pathInfo = splitPath(pathArgument);
-    if (!pathInfo.isAsar) return internalModuleStat(receiver, pathArgument);
+    if (!pathInfo.isAsar) return internalModuleStat(pathArgument);
     const { asarPath, filePath } = pathInfo;
 
     // -ENOENT
@@ -1047,7 +1047,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
       if (withFileTypes) {
         initialItem = [
           [...initialItem], initialItem.map((p: string) => {
-            return internalBinding('fs').internalModuleStat(binding, path.join(originalPath, p));
+            return internalBinding('fs').internalModuleStat(path.join(originalPath, p));
           })
         ];
       }
@@ -1080,7 +1080,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
 
               readdirResult = [
                 [...files], files.map((p: string) => {
-                  return internalBinding('fs').internalModuleStat(binding, path.join(direntPath, p));
+                  return internalBinding('fs').internalModuleStat(path.join(direntPath, p));
                 })
               ];
             } else {
@@ -1101,7 +1101,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
         const { 0: pathArg, 1: readDir } = queue.pop();
         for (const ent of readDir) {
           const direntPath = path.join(pathArg, ent);
-          const stat = internalBinding('fs').internalModuleStat(binding, direntPath);
+          const stat = internalBinding('fs').internalModuleStat(direntPath);
           result.push(path.relative(originalPath, direntPath));
 
           if (stat === 1) {
@@ -1155,7 +1155,7 @@ export const wrapFsWithAsar = (fs: Record<string, any>) => {
         if (context.withFileTypes) {
           readdirResult = [
             [...readdirResult], readdirResult.map((p: string) => {
-              return internalBinding('fs').internalModuleStat(binding, path.join(pathArg, p));
+              return internalBinding('fs').internalModuleStat(path.join(pathArg, p));
             })
           ];
         }

lib/renderer/init.ts

@@ -65,9 +65,9 @@ require('@electron/internal/renderer/common-init');
 
 if (nodeIntegration) {
   // Export node bindings to global.
-  const { makeRequireFunction } = __non_webpack_require__('internal/modules/helpers');
+  const { makeRequireFunction } = __non_webpack_require__('internal/modules/helpers') as typeof import('@node/lib/internal/modules/helpers');
   global.module = new Module('electron/js2c/renderer_init');
-  global.require = makeRequireFunction(global.module);
+  global.require = makeRequireFunction(global.module) as NodeRequire;
 
   // Set the __filename to the path of html file if it is file: protocol.
   if (window.location.protocol === 'file:') {
@@ -150,7 +150,7 @@ if (cjsPreloads.length) {
   }
 }
 if (esmPreloads.length) {
-  const { runEntryPointWithESMLoader } = __non_webpack_require__('internal/modules/run_main');
+  const { runEntryPointWithESMLoader } = __non_webpack_require__('internal/modules/run_main') as typeof import('@node/lib/internal/modules/run_main');
 
   runEntryPointWithESMLoader(async (cascadedLoader: any) => {
     // Load the preload scripts.

lib/utility/api/net.ts

@@ -1,8 +1,7 @@
 import { fetchWithSession } from '@electron/internal/browser/api/net-fetch';
 import { ClientRequest } from '@electron/internal/common/api/net-client-request';
 
-import { IncomingMessage } from 'electron/utility';
-import type { ClientRequestConstructorOptions } from 'electron/utility';
+import type { ClientRequestConstructorOptions, IncomingMessage } from 'electron/utility';
 
 const { isOnline, resolveHost } = process._linkedBinding('electron_common_net');
 

lib/utility/init.ts

@@ -36,7 +36,7 @@ parentPort.on('removeListener', (name: string) => {
 });
 
 // Finally load entry script.
-const { runEntryPointWithESMLoader } = __non_webpack_require__('internal/modules/run_main');
+const { runEntryPointWithESMLoader } = __non_webpack_require__('internal/modules/run_main') as typeof import('@node/lib/internal/modules/run_main');
 const mainEntry = pathToFileURL(entryScript);
 
 runEntryPointWithESMLoader(async (cascadedLoader: any) => {

lib/worker/init.ts

@@ -13,9 +13,9 @@ require('@electron/internal/common/init');
 const { hasSwitch, getSwitchValue } = process._linkedBinding('electron_common_command_line');
 
 // Export node bindings to global.
-const { makeRequireFunction } = __non_webpack_require__('internal/modules/helpers');
+const { makeRequireFunction } = __non_webpack_require__('internal/modules/helpers') as typeof import('@node/lib/internal/modules/helpers');
 global.module = new Module('electron/js2c/worker_init');
-global.require = makeRequireFunction(global.module);
+global.require = makeRequireFunction(global.module) as NodeRequire;
 
 // See WebWorkerObserver::WorkerScriptReadyForEvaluation.
 if ((globalThis as any).blinkfetch) {

package.json

@@ -18,8 +18,6 @@
     "@types/semver": "^7.5.8",
     "@types/stream-json": "^1.7.7",
     "@types/temp": "^0.9.4",
-    "@types/webpack": "^5.28.5",
-    "@types/webpack-env": "^1.18.5",
     "@typescript-eslint/eslint-plugin": "^8.7.0",
     "@typescript-eslint/parser": "^8.7.0",
     "buffer": "^6.0.3",
@@ -28,13 +26,12 @@
     "dugite": "^2.7.1",
     "eslint": "^8.57.1",
     "eslint-config-standard": "^17.1.0",
-    "eslint-plugin-import": "^2.30.0",
+    "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-mocha": "^10.5.0",
     "eslint-plugin-n": "^16.6.2",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-promise": "^6.6.0",
     "eslint-plugin-standard": "^5.0.0",
-    "eslint-plugin-unicorn": "^55.0.0",
     "events": "^3.2.0",
     "folder-hash": "^2.1.1",
     "got": "^11.8.5",

patches/chromium/.patches

@@ -109,7 +109,6 @@ fix_use_delegated_generic_capturer_when_available.patch
 expose_webblob_path_to_allow_embedders_to_get_file_paths.patch
 fix_move_autopipsettingshelper_behind_branding_buildflag.patch
 revert_remove_the_allowaggressivethrottlingwithwebsocket_feature.patch
-fix_activate_background_material_on_windows.patch
 feat_allow_passing_of_objecttemplate_to_objecttemplatebuilder.patch
 chore_remove_check_is_test_on_script_injection_tracker.patch
 fix_restore_original_resize_performance_on_macos.patch
@@ -141,3 +140,5 @@ fix_win32_synchronous_spellcheck.patch
 fix_linter_error.patch
 chore_grandfather_in_electron_views_and_delegates.patch
 refactor_patch_electron_permissiontypes_into_blink.patch
+fix_add_macos_memory_query_fallback_to_avoid_crash.patch
+fix_resolve_dynamic_background_material_update_issue_on_windows_11.patch

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -46,7 +46,7 @@ index 36fe07a692e9be5b99f9e59157b90963a6485f8b..d8cf68e953213f309537e74d954d8749
        # than here in :chrome_dll.
        deps += [ "//chrome:packed_resources_integrity_header" ]
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 0f493aeb49901e2917009b942f9b1e14e3fcf758..349079dc25f91fd426d523345ba66271c42ea084 100644
+index 6fba5b32b266455d308ac11e2711588b78092c33..5905f62c8b516483026ee95a3dea4cda5f1161b1 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
 @@ -7243,9 +7243,12 @@ test("unit_tests") {

patches/chromium/feat_add_streaming-protocol_registry_to_multibuffer_data_source.patch

@@ -12,8 +12,12 @@ This patch adds a list of "streaming protocols" to the MultibufferDataSource in
 other protocols to register their streaming behavior. MultibufferDataSource::AssumeFullyBuffered()
 then refers to the list so that it can correctly determine the data source's settings.
 
+This patch also reverts https://chromium-review.googlesource.com/c/chromium/src/+/6431846,
+which removed range-requests-supported on non-http protocols. See https://issues.chromium.org/issues/41161335
+for more information.
+
 diff --git a/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc b/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc
-index 3e010fbec46d799839a2c50ed14c1d5744e99a30..ed98c853ba013acb8908a1651742d510bc8e4475 100644
+index 3e010fbec46d799839a2c50ed14c1d5744e99a30..e691db48e0a88aef7ada167ca09e7495f5bada5a 100644
 --- a/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc
 +++ b/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc
 @@ -11,8 +11,10 @@
@@ -27,11 +31,23 @@ index 3e010fbec46d799839a2c50ed14c1d5744e99a30..ed98c853ba013acb8908a1651742d510
  #include "media/base/media_log.h"
  #include "net/base/net_errors.h"
  #include "third_party/blink/renderer/platform/media/buffered_data_source_host_impl.h"
-@@ -67,8 +69,20 @@ const int kUpdateBufferSizeFrequency = 32;
- // How long to we delay a seek after a read?
- constexpr base::TimeDelta kSeekDelay = base::Milliseconds(20);
+@@ -69,6 +71,10 @@ constexpr base::TimeDelta kSeekDelay = base::Milliseconds(20);
  
-+std::vector<std::string>* GetStreamingSchemes() {
+ }  // namespace
+ 
++void AddStreamingScheme(const char* new_scheme) {
++  MultiBufferDataSource::GetStreamingSchemes()->push_back(new_scheme);
++}
++
+ class MultiBufferDataSource::ReadOperation {
+  public:
+   ReadOperation() = delete;
+@@ -143,13 +149,29 @@ MultiBufferDataSource::~MultiBufferDataSource() {
+   DCHECK(render_task_runner_->BelongsToCurrentThread());
+ }
+ 
++// static
++std::vector<std::string>* MultiBufferDataSource::GetStreamingSchemes() {
 +  static base::NoDestructor<std::vector<std::string>> streaming_schemes({
 +    url::kHttpsScheme,
 +    url::kHttpScheme
@@ -39,16 +55,9 @@ index 3e010fbec46d799839a2c50ed14c1d5744e99a30..ed98c853ba013acb8908a1651742d510
 +  return streaming_schemes.get();
 +}
 +
- }  // namespace
- 
-+void AddStreamingScheme(const char* new_scheme) {
-+  GetStreamingSchemes()->push_back(new_scheme);
-+}
-+
- class MultiBufferDataSource::ReadOperation {
-  public:
-   ReadOperation() = delete;
-@@ -149,7 +163,14 @@ bool MultiBufferDataSource::media_has_played() const {
+ bool MultiBufferDataSource::media_has_played() const {
+   return media_has_played_;
+ }
  
  bool MultiBufferDataSource::AssumeFullyBuffered() const {
    DCHECK(url_data_);
@@ -65,7 +74,7 @@ index 3e010fbec46d799839a2c50ed14c1d5744e99a30..ed98c853ba013acb8908a1651742d510
  
  void MultiBufferDataSource::SetReader(
 diff --git a/third_party/blink/renderer/platform/media/multi_buffer_data_source.h b/third_party/blink/renderer/platform/media/multi_buffer_data_source.h
-index e886847425b1ea0b620a60e7b477249efac3c689..92dea7a9f491bb548f68d918ebde60cbf2a7d67f 100644
+index e886847425b1ea0b620a60e7b477249efac3c689..249416683c5381d4263f5f59202ca1687adf4407 100644
 --- a/third_party/blink/renderer/platform/media/multi_buffer_data_source.h
 +++ b/third_party/blink/renderer/platform/media/multi_buffer_data_source.h
 @@ -17,6 +17,7 @@
@@ -85,3 +94,49 @@ index e886847425b1ea0b620a60e7b477249efac3c689..92dea7a9f491bb548f68d918ebde60cb
  // A data source capable of loading URLs and buffering the data using an
  // in-memory sliding window.
  //
+@@ -65,6 +68,8 @@ class PLATFORM_EXPORT MultiBufferDataSource
+     return url_data_->mime_type();
+   }
+ 
++  static std::vector<std::string>* GetStreamingSchemes();
++
+   // Method called on the render thread.
+   using InitializeCB = base::OnceCallback<void(bool)>;
+   void Initialize(InitializeCB init_cb) override;
+diff --git a/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc b/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc
+index 34cee8e0f399468ae23a2ab4108bd65a6f12395c..be35c71dc0c7e0ae85c3f42f0b93375c09e43ddb 100644
+--- a/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc
++++ b/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc
+@@ -8,6 +8,7 @@
+ #include <stddef.h>
+ 
+ #include <utility>
++#include <algorithm>
+ 
+ #include "base/containers/contains.h"
+ #include "base/location.h"
+@@ -27,6 +28,7 @@
+ #include "third_party/blink/public/platform/web_url_response.h"
+ #include "third_party/blink/public/web/web_associated_url_loader.h"
+ #include "third_party/blink/renderer/platform/media/cache_util.h"
++#include "third_party/blink/renderer/platform/media/multi_buffer_data_source.h"
+ #include "third_party/blink/renderer/platform/media/resource_fetch_context.h"
+ #include "third_party/blink/renderer/platform/media/url_index.h"
+ #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
+@@ -320,6 +322,16 @@ void ResourceMultiBufferDataProvider::DidReceiveResponse(
+       do_fail = true;
+     }
+   } else {
++    // For non-HTTP protocols, only set range_supported for registered streaming schemes
++    const std::string scheme = destination_url_data->url().Protocol().Ascii();
++
++    if (std::ranges::any_of(*MultiBufferDataSource::GetStreamingSchemes(),
++                         [&scheme](const std::string& streaming_scheme) {
++                           return base::EqualsCaseInsensitiveASCII(scheme, streaming_scheme);
++                         })) {
++      destination_url_data->set_range_supported();
++    }
++
+     if (content_length != kPositionNotSpecified) {
+       destination_url_data->set_length(content_length + byte_pos());
+     }

patches/chromium/feat_corner_smoothing_css_rule_and_blink_painting.patch

@@ -16,64 +16,9 @@ making three primary changes to Blink:
     * Modifies graphics to handle smooth `ContouredRect`s, delegating to
       `//electron/shell/renderer/electron_smooth_round_rect`.
 
-3. Adds a renderer preference / web setting:
+3. Adds a renderer feature:
     * Controls whether the CSS rule is available.
-    * Mostly simple "plumbing" for the setting through blink.
 
-diff --git a/third_party/blink/common/renderer_preferences/renderer_preferences_mojom_traits.cc b/third_party/blink/common/renderer_preferences/renderer_preferences_mojom_traits.cc
-index c13dfd7f20e6f281f51ae373ceebeb86104c5cd9..fac89df9f23f3f098096d2a07a07e623b1067270 100644
---- a/third_party/blink/common/renderer_preferences/renderer_preferences_mojom_traits.cc
-+++ b/third_party/blink/common/renderer_preferences/renderer_preferences_mojom_traits.cc
-@@ -128,6 +128,8 @@ bool StructTraits<blink::mojom::RendererPreferencesDataView,
-     return false;
-   }
- 
-+  out->electron_corner_smoothing_css = data.electron_corner_smoothing_css();
-+
-   out->canvas_noise_token = data.canvas_noise_token();
- 
-   out->view_source_line_wrap_enabled = data.view_source_line_wrap_enabled();
-diff --git a/third_party/blink/public/common/renderer_preferences/renderer_preferences.h b/third_party/blink/public/common/renderer_preferences/renderer_preferences.h
-index 75acd696a5258e52f5c17b88559dfb3f6373c669..34b5ed725702dca72c383c1def08fdb835f7fa6b 100644
---- a/third_party/blink/public/common/renderer_preferences/renderer_preferences.h
-+++ b/third_party/blink/public/common/renderer_preferences/renderer_preferences.h
-@@ -91,6 +91,7 @@ struct BLINK_COMMON_EXPORT RendererPreferences {
-   bool caret_browsing_enabled{false};
-   bool uses_platform_autofill{false};
-   std::vector<uint16_t> explicitly_allowed_network_ports;
-+  bool electron_corner_smoothing_css{true};
-   uint64_t canvas_noise_token{0};
-   // The default value must be false to avoid performance problems on very large
-   // source pages.
-diff --git a/third_party/blink/public/common/renderer_preferences/renderer_preferences_mojom_traits.h b/third_party/blink/public/common/renderer_preferences/renderer_preferences_mojom_traits.h
-index defe40d7091cb4ba4b099a22aeaee71f78ff5e77..e8326fa7a3c45c08c7d9250edd52a6d73fcc3ff9 100644
---- a/third_party/blink/public/common/renderer_preferences/renderer_preferences_mojom_traits.h
-+++ b/third_party/blink/public/common/renderer_preferences/renderer_preferences_mojom_traits.h
-@@ -275,6 +275,11 @@ struct BLINK_COMMON_EXPORT
-     return data.explicitly_allowed_network_ports;
-   }
- 
-+  static const bool& electron_corner_smoothing_css(
-+      const ::blink::RendererPreferences& data) {
-+    return data.electron_corner_smoothing_css;
-+  }
-+
-   static const uint64_t& canvas_noise_token(
-       const ::blink::RendererPreferences& data) {
-     return data.canvas_noise_token;
-diff --git a/third_party/blink/public/mojom/renderer_preferences.mojom b/third_party/blink/public/mojom/renderer_preferences.mojom
-index f8361faf6151210d65a597562c533aaa0a5235df..328238c34a9381fbbeb5970af3de721c8412104e 100644
---- a/third_party/blink/public/mojom/renderer_preferences.mojom
-+++ b/third_party/blink/public/mojom/renderer_preferences.mojom
-@@ -202,6 +202,8 @@ struct RendererPreferences {
- 
-   array<uint16> explicitly_allowed_network_ports;
- 
-+  bool electron_corner_smoothing_css;
-+
-   // A randomized 64 bit token that is generated per browser session,
-   // used for canvas noising.
-   uint64 canvas_noise_token = 0;
 diff --git a/third_party/blink/public/mojom/use_counter/metrics/css_property_id.mojom b/third_party/blink/public/mojom/use_counter/metrics/css_property_id.mojom
 index a96527c653d2108de572d1e94c3ce703b45f2830..f8eb2af2c97f888307f2be588c336d4209f6cb3e 100644
 --- a/third_party/blink/public/mojom/use_counter/metrics/css_property_id.mojom
@@ -86,18 +31,6 @@ index a96527c653d2108de572d1e94c3ce703b45f2830..f8eb2af2c97f888307f2be588c336d42
  
      // This CSSSampleId represents page load for CSS histograms. It is recorded once
      // per page visit for each CSS histogram being logged on the blink side and the
-diff --git a/third_party/blink/public/web/web_settings.h b/third_party/blink/public/web/web_settings.h
-index c37f784a1309da14354881d48a5a76a965930926..bffd221d2b3f3701710025103fa564c233e203d1 100644
---- a/third_party/blink/public/web/web_settings.h
-+++ b/third_party/blink/public/web/web_settings.h
-@@ -287,6 +287,7 @@ class WebSettings {
-   virtual void SetRequireTransientActivationAndAuthorizationForSubAppsAPIs(
-       bool) = 0;
-   virtual void SetRootScrollbarThemeColor(std::optional<SkColor>) = 0;
-+  virtual void SetCornerSmoothingCSS(bool) = 0;
- 
-  protected:
-   ~WebSettings() = default;
 diff --git a/third_party/blink/renderer/build/scripts/core/css/css_properties.py b/third_party/blink/renderer/build/scripts/core/css/css_properties.py
 index 6e991652d242795e292cea4c94cff59aaea078fa..b6834c78575520bb6e584dd2ce3333ac17299fef 100755
 --- a/third_party/blink/renderer/build/scripts/core/css/css_properties.py
@@ -112,16 +45,17 @@ index 6e991652d242795e292cea4c94cff59aaea078fa..b6834c78575520bb6e584dd2ce3333ac
                      'internal-forced-visited-'):
                  internal_visited_order = 0
 diff --git a/third_party/blink/renderer/core/css/css_properties.json5 b/third_party/blink/renderer/core/css/css_properties.json5
-index 5619eae5a36f63627df605eeff049866ea846477..50bad85a916e5bb097d687cbc4d1721ecefa6c39 100644
+index 5619eae5a36f63627df605eeff049866ea846477..2fe353e68972493ac99d0d040902e25f0c6499fb 100644
 --- a/third_party/blink/renderer/core/css/css_properties.json5
 +++ b/third_party/blink/renderer/core/css/css_properties.json5
-@@ -8866,6 +8866,24 @@
+@@ -8866,6 +8866,26 @@
        property_methods: ["ParseShorthand", "CSSValueFromComputedStyleInternal"],
      },
  
 +    {
 +      name: "-electron-corner-smoothing",
-+      property_methods: ["ParseSingleValue"],
++      property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
++      interpolable: true,
 +      field_group: "*",
 +      field_template: "external",
 +      // To keep this patch small, Length is used instead of a more descriptive
@@ -129,12 +63,13 @@ index 5619eae5a36f63627df605eeff049866ea846477..50bad85a916e5bb097d687cbc4d1721e
 +      // - `system-ui` = `Length::Auto()`
 +      // - percent     = `Length::Percent`
 +      type_name: "Length",
-+      converter: "ConvertCornerSmoothing",
-+      keywords: ["system-ui"],
 +      default_value: "Length::None()",
-+      typedom_types: ["Keyword", "Percentage"],
-+      is_border_radius: true,
-+      invalidate: ["paint", "border-radius", "clip"],
++      keywords: ["system-ui"],
++      converter: "ConvertCornerSmoothing",
++      runtime_flag: "ElectronCSSCornerSmoothing",
++      valid_for_permission_element: true,
++      valid_for_page_context: true,
++      invalidate: ["border-radius", "paint", "corner-shape"],
 +    },
 +
      // Visited properties.
@@ -154,10 +89,10 @@ index 9ec4976d64834bd4c09f3740edcd28334dd4ec50..e47da0a85670e800e74da957d6441d70
        return a.EmptyCells() == b.EmptyCells();
      case CSSPropertyID::kFill:
 diff --git a/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc
-index e519e13fea11950cc619e384f774b61a6e2385c0..8289ca0a41da1532692673a3e426e8688d93b32e 100644
+index e519e13fea11950cc619e384f774b61a6e2385c0..04746566454401402c21f6381a7a7f0f4652ae4b 100644
 --- a/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc
 +++ b/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc
-@@ -12175,5 +12175,25 @@ const CSSValue* InternalEmptyLineHeight::ParseSingleValue(
+@@ -12175,5 +12175,36 @@ const CSSValue* InternalEmptyLineHeight::ParseSingleValue(
                                           CSSValueID::kNone>(stream);
  }
  
@@ -165,12 +100,6 @@ index e519e13fea11950cc619e384f774b61a6e2385c0..8289ca0a41da1532692673a3e426e868
 +    CSSParserTokenStream& stream,
 +    const CSSParserContext& context,
 +    const CSSParserLocalContext&) const {
-+  // Fail parsing if this rule is disabled by document settings.
-+  if (Settings* settings = context.GetDocument()->GetSettings();
-+      settings && !settings->GetElectronCornerSmoothingCSS()) {
-+    return nullptr;
-+  }
-+
 +  // Try to parse `system-ui` keyword first.
 +  if (auto* ident =
 +          css_parsing_utils::ConsumeIdent<CSSValueID::kSystemUi>(stream)) {
@@ -180,18 +109,36 @@ index e519e13fea11950cc619e384f774b61a6e2385c0..8289ca0a41da1532692673a3e426e868
 +  return css_parsing_utils::ConsumePercent(
 +      stream, context, CSSPrimitiveValue::ValueRange::kNonNegative);
 +}
++
++const CSSValue* ElectronCornerSmoothing::CSSValueFromComputedStyleInternal(
++    const ComputedStyle& style,
++    const LayoutObject*,
++    bool allow_visited_style,
++    CSSValuePhase value_phase) const {
++  const Length& length = style.ElectronCornerSmoothing();
++  switch (length.GetType()) {
++    case Length::kAuto:
++      return CSSIdentifierValue::Create(CSSValueID::kSystemUi);
++    case Length::kPercent:
++      return CSSNumericLiteralValue::Create(
++          length.Percent(), CSSPrimitiveValue::UnitType::kPercentage);
++    default:
++      return CSSIdentifierValue::Create(CSSValueID::kNone);
++  }
++}
 +
  }  // namespace css_longhand
  }  // namespace blink
 diff --git a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
-index 5618121a0b5621290a19f147bfbe9bf316fb3f27..bb1bd90371ce847d48ff9a228b098a26d28f5c6d 100644
+index 501ef6ba6203fc2661ab36825c4a1b4eee172841..1314bfc4c368be031200fc1555a4db51d27491a7 100644
 --- a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
 +++ b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
-@@ -3962,4 +3962,12 @@ FitText StyleBuilderConverter::ConvertFitText(StyleResolverState& state,
-   return FitText(target, method, size_limit);
+@@ -3920,6 +3920,15 @@ PositionArea StyleBuilderConverter::ConvertPositionArea(
+   return PositionArea(span[0], span[1], span[2], span[3]);
  }
  
-+Length StyleBuilderConverter::ConvertCornerSmoothing(StyleResolverState& state, const CSSValue& value) {
++Length StyleBuilderConverter::ConvertCornerSmoothing(StyleResolverState& state,
++                                                     const CSSValue& value) {
 +  auto* ident = DynamicTo<CSSIdentifierValue>(value);
 +  if (ident && ident->GetValueID() == CSSValueID::kSystemUi) {
 +    return Length::Auto();
@@ -199,74 +146,21 @@ index 5618121a0b5621290a19f147bfbe9bf316fb3f27..bb1bd90371ce847d48ff9a228b098a26
 +  return ConvertLength(state, value);
 +}
 +
- }  // namespace blink
+ FitText StyleBuilderConverter::ConvertFitText(StyleResolverState& state,
+                                               const CSSValue& value) {
+   const auto& list = To<CSSValueList>(value);
 diff --git a/third_party/blink/renderer/core/css/resolver/style_builder_converter.h b/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
-index 7104b5866a9bac0cdd26518eddcf80322280ad92..692b186f302130155fbb1b163bb195c0253276af 100644
+index 141de7c9f9d630125cf37be73347a05a6a475aba..b07129478590b6aad6f054be09c22f8f48c60920 100644
 --- a/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
 +++ b/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
-@@ -422,6 +422,8 @@ class StyleBuilderConverter {
+@@ -421,6 +421,7 @@ class StyleBuilderConverter {
+                                                  const CSSValue&);
  
    static PositionArea ConvertPositionArea(StyleResolverState&, const CSSValue&);
-   static FitText ConvertFitText(StyleResolverState&, const CSSValue&);
-+
 +  static Length ConvertCornerSmoothing(StyleResolverState&, const CSSValue&);
+   static FitText ConvertFitText(StyleResolverState&, const CSSValue&);
  };
  
- template <typename T>
-diff --git a/third_party/blink/renderer/core/exported/web_settings_impl.cc b/third_party/blink/renderer/core/exported/web_settings_impl.cc
-index 90692da7bddd9e26e58cb26d8b29dbddf958fbca..6bcd9d736edab85572e405ab74d57adc0fcce921 100644
---- a/third_party/blink/renderer/core/exported/web_settings_impl.cc
-+++ b/third_party/blink/renderer/core/exported/web_settings_impl.cc
-@@ -820,4 +820,8 @@ void WebSettingsImpl::SetRootScrollbarThemeColor(
-   settings_->SetRootScrollbarThemeColor(theme_color);
- }
- 
-+void WebSettingsImpl::SetCornerSmoothingCSS(bool available) {
-+  settings_->SetElectronCornerSmoothingCSS(available);
-+}
-+
- }  // namespace blink
-diff --git a/third_party/blink/renderer/core/exported/web_settings_impl.h b/third_party/blink/renderer/core/exported/web_settings_impl.h
-index aa8b248b94ea7f6c0e04dc66e976dc7923ff3a98..868630ed2adb8f40fb7f002d45b260c0881ef10f 100644
---- a/third_party/blink/renderer/core/exported/web_settings_impl.h
-+++ b/third_party/blink/renderer/core/exported/web_settings_impl.h
-@@ -238,6 +238,7 @@ class CORE_EXPORT WebSettingsImpl final : public WebSettings {
-   void SetRequireTransientActivationAndAuthorizationForSubAppsAPIs(
-       bool) override;
-   void SetRootScrollbarThemeColor(std::optional<SkColor>) override;
-+  void SetCornerSmoothingCSS(bool) override;
- 
-   bool RenderVSyncNotificationEnabled() const {
-     return render_v_sync_notification_enabled_;
-diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index f8fae134e122a223440530bd696db899dce2fe56..cec68a428fbf63932066ceb296c3db3eb9e34166 100644
---- a/third_party/blink/renderer/core/exported/web_view_impl.cc
-+++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
-@@ -3579,6 +3579,9 @@ void WebViewImpl::UpdateRendererPreferences(
-       renderer_preferences_.view_source_line_wrap_enabled);
- 
-   MaybePreloadSystemFonts(GetPage());
-+
-+  GetSettings()->SetCornerSmoothingCSS(
-+      renderer_preferences_.electron_corner_smoothing_css);
- }
- 
- void WebViewImpl::SetHistoryIndexAndLength(int32_t history_index,
-diff --git a/third_party/blink/renderer/core/frame/settings.json5 b/third_party/blink/renderer/core/frame/settings.json5
-index c96100f7d26c14b8be1329cdb4d8a007b14d9c00..8b2429d5ac958f9a2c7aae546b44da903def8e69 100644
---- a/third_party/blink/renderer/core/frame/settings.json5
-+++ b/third_party/blink/renderer/core/frame/settings.json5
-@@ -1265,5 +1265,10 @@
-       initial: false,
-       type: "bool"
-     },
-+    {
-+      name: "electronCornerSmoothingCSS",
-+      initial: true,
-+      invalidate: ["Style"],
-+    },
-   ],
- }
 diff --git a/third_party/blink/renderer/core/paint/contoured_border_geometry.cc b/third_party/blink/renderer/core/paint/contoured_border_geometry.cc
 index 2c2f4f405074e5baa4a26f255283404f86b40e21..ebeb7d6988ee9e6a4e78cb82fc01fdad6721eaef 100644
 --- a/third_party/blink/renderer/core/paint/contoured_border_geometry.cc
@@ -373,7 +267,7 @@ index 0dbfffdfbea2cb75f7f3ea94ead20cc8bbe08bb3..021b9cdebb023941e7a78afbc1c3c939
  
    // A Corner is a axis-aligned quad, with the points ordered (start, outer,
 diff --git a/third_party/blink/renderer/platform/geometry/path_builder.cc b/third_party/blink/renderer/platform/geometry/path_builder.cc
-index 171cb3dd87609f5ecab79a25fe0978cd6e4b04f4..7e7deae45bfb66c3a3702f30092a23fb5b79bf4b 100644
+index 171cb3dd87609f5ecab79a25fe0978cd6e4b04f4..e454999a4ef64156a86cc8e15c11616e563e2489 100644
 --- a/third_party/blink/renderer/platform/geometry/path_builder.cc
 +++ b/third_party/blink/renderer/platform/geometry/path_builder.cc
 @@ -4,6 +4,7 @@
@@ -384,7 +278,7 @@ index 171cb3dd87609f5ecab79a25fe0978cd6e4b04f4..7e7deae45bfb66c3a3702f30092a23fb
  #include "third_party/blink/renderer/platform/geometry/contoured_rect.h"
  #include "third_party/blink/renderer/platform/geometry/infinite_int_rect.h"
  #include "third_party/blink/renderer/platform/geometry/path.h"
-@@ -247,6 +248,26 @@ PathBuilder& PathBuilder::AddContouredRect(
+@@ -247,6 +248,32 @@ PathBuilder& PathBuilder::AddContouredRect(
      AddRoundedRect(target_rect);
      return *this;
    }
@@ -400,10 +294,16 @@ index 171cb3dd87609f5ecab79a25fe0978cd6e4b04f4..7e7deae45bfb66c3a3702f30092a23fb
 +    float smoothness = std::clamp(
 +        contoured_rect.GetCornerCurvature().Smoothness(), 0.0f, 1.0f);
 +
++    // Since the Electron implementation of DrawSmoothRoundRect uses one radius
++    // for both dimensions, we need to use the minimum of the two supplied.
++    auto min_radius = [](const gfx::SizeF& radius) -> float {
++      return std::min(radius.width(), radius.height());
++    };
++
 +    builder_.addPath(electron::DrawSmoothRoundRect(
 +        box.x(), box.y(), box.width(), box.height(), smoothness,
-+        radii.TopLeft().width(), radii.TopRight().width(),
-+        radii.BottomRight().width(), radii.BottomLeft().width()));
++        min_radius(radii.TopLeft()), min_radius(radii.TopRight()),
++        min_radius(radii.BottomRight()), min_radius(radii.BottomLeft())));
 +
 +    return *this;
 +  }
@@ -411,3 +311,18 @@ index 171cb3dd87609f5ecab79a25fe0978cd6e4b04f4..7e7deae45bfb66c3a3702f30092a23fb
    const FloatRoundedRect& origin_rect = contoured_rect.GetOriginRect();
  
    // This would include the outer border of the rect, as well as shadow and
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+index 7b24b556fcfc16ccb67e28e2d8a0753355d07497..ceb5c8e46515a9a8345c0feee801708bfca71310 100644
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
++++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -214,6 +214,10 @@
+   },
+ 
+   data: [
++    {
++      name: "ElectronCSSCornerSmoothing",
++      status: "stable",
++    },
+     {
+       name: "Accelerated2dCanvas",
+       settable_from_internals: true,

patches/chromium/fix_activate_background_material_on_windows.patch

@@ -1,68 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: clavin <clavin@electronjs.org>
-Date: Mon, 11 Dec 2023 20:43:34 -0300
-Subject: fix: activate background material on windows
-
-This patch adds a condition to the HWND message handler to allow windows
-with translucent background materials to become activated.
-
-It also ensures the lParam of WM_NCACTIVATE is set to -1 so as to not repaint
-the client area, which can lead to a title bar incorrectly being displayed in
-frameless windows.
-
-This patch likely can't be upstreamed as-is, as Chromium doesn't have
-this use case in mind currently.
-
-diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
-index 1a10bd1a6c527633f97d6eee6525b1e45a3fcd3d..2b983ae3ec3e1d17951add818c2610582d586377 100644
---- a/ui/views/win/hwnd_message_handler.cc
-+++ b/ui/views/win/hwnd_message_handler.cc
-@@ -937,13 +937,13 @@ void HWNDMessageHandler::FrameTypeChanged() {
- 
- void HWNDMessageHandler::PaintAsActiveChanged() {
-   if (!delegate_->HasNonClientView() || !delegate_->CanActivate() ||
--      !delegate_->HasFrame() ||
-+      (!delegate_->HasFrame() && !is_translucent_) ||
-       (delegate_->GetFrameMode() == FrameMode::CUSTOM_DRAWN)) {
-     return;
-   }
- 
-   DefWindowProcWithRedrawLock(WM_NCACTIVATE, delegate_->ShouldPaintAsActive(),
--                              0);
-+                              delegate_->HasFrame() ? 0 : -1);
- }
- 
- void HWNDMessageHandler::SetWindowIcons(const gfx::ImageSkia& window_icon,
-@@ -1732,7 +1732,7 @@ void HWNDMessageHandler::OnActivateApp(BOOL active, DWORD thread_id) {
-   if (delegate_->HasNonClientView() && !active &&
-       thread_id != GetCurrentThreadId()) {
-     // Update the native frame if it is rendering the non-client area.
--    if (HasSystemFrame()) {
-+    if (is_translucent_ || HasSystemFrame()) {
-       DefWindowProcWithRedrawLock(WM_NCACTIVATE, FALSE, 0);
-     }
-   }
-@@ -2340,17 +2340,18 @@ LRESULT HWNDMessageHandler::OnNCActivate(UINT message,
-     delegate_->SchedulePaint();
-   }
- 
--  // Calling DefWindowProc is only necessary if there's a system frame being
--  // drawn. Otherwise it can draw an incorrect title bar and cause visual
--  // corruption.
--  if (!delegate_->HasFrame() ||
-+  // If the window is translucent, it may have the Mica background.
-+  // In that case, it's necessary to call |DefWindowProc|, but we can
-+  // pass -1 in the lParam to prevent any non-client area elements from
-+  // being displayed.
-+  if ((!delegate_->HasFrame() && !is_translucent_) ||
-       delegate_->GetFrameMode() == FrameMode::CUSTOM_DRAWN) {
-     SetMsgHandled(TRUE);
-     return TRUE;
-   }
- 
-   return DefWindowProcWithRedrawLock(WM_NCACTIVATE, paint_as_active || active,
--                                     0);
-+                                     delegate_->HasFrame() ? 0 : -1);
- }
- 
- LRESULT HWNDMessageHandler::OnNCCalcSize(BOOL mode, LPARAM l_param) {

patches/chromium/fix_add_macos_memory_query_fallback_to_avoid_crash.patch

@@ -0,0 +1,61 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Calvin Watford <watfordcalvin@gmail.com>
+Date: Tue, 15 Jul 2025 21:06:52 -0600
+Subject: fix: add macos memory query fallback to avoid crash
+
+In https://crrev.com/c/6274964 the implementation for querying the physical memory on macOS was changed to use a sysctl call. In that same change the sysctl call was added to the sanbox allowlist.
+
+This causes a problematic behavior: if an app that's running the old implementation (no sandbox exclusion for that sysctl call) gets swapped with the new implementation (uses new sysctl call) while it's running, then new child processes will trigger a sandbox permission error when calling the new method.
+
+While this "hot-swapping" behavior isn't supported, many enterprise update scripts may do this anyways, triggering an unfortunate user experience where child processes can never spawn but the browser process continues to live and terminate them (untl the app is restarted).
+
+This patch should be removed after the new implementation has been present since the beginning of a stable release. The new implementation was released with Electron 37.0.0, but this fallback was not added until after 37.2.2. That means 38.0.0 would be the first safe release to remove this fallback, giving developers a 1-major-version buffer to safely transition implementations.
+
+diff --git a/base/system/sys_info_apple.mm b/base/system/sys_info_apple.mm
+index 02670cbc829a1d8c540c6e0a4bce2f81177eab18..e58f70100b96ff83af4388900946db9962c2a254 100644
+--- a/base/system/sys_info_apple.mm
++++ b/base/system/sys_info_apple.mm
+@@ -6,11 +6,31 @@
+ 
+ #include <sys/sysctl.h>
+ 
++#include "base/apple/scoped_mach_port.h"
+ #include "base/strings/stringprintf.h"
+ #include "base/system/sys_info_internal.h"
+ 
+ namespace base {
+ 
++namespace {
++
++// Implementation of AmountOfPhysicalMemoryImpl before https://crrev.com/c/6274964.
++// See Electron patch adding this fallback for more details.
++uint64_t AmountOfPhysicalMemoryFallback() {
++  struct host_basic_info hostinfo;
++  mach_msg_type_number_t count = HOST_BASIC_INFO_COUNT;
++  base::apple::ScopedMachSendRight host(mach_host_self());
++  int result = host_info(host.get(), HOST_BASIC_INFO,
++                         reinterpret_cast<host_info_t>(&hostinfo), &count);
++  if (result != KERN_SUCCESS) {
++    NOTREACHED();
++  }
++  DCHECK_EQ(HOST_BASIC_INFO_COUNT, count);
++  return hostinfo.max_mem;
++}
++
++}
++
+ namespace internal {
+ 
+ // Queries sysctlbyname() for the given key and returns the 32 bit integer value
+@@ -54,7 +74,10 @@
+   uint64_t physical_memory;
+   size_t size = sizeof(physical_memory);
+   int rv = sysctlbyname("hw.memsize", &physical_memory, &size, nullptr, 0);
+-  PCHECK(rv == 0) << "sysctlbyname(\"hw.memsize\")";
++  // Instead of crashing, fallback to the old implementation.
++  if (rv != 0) {
++    return AmountOfPhysicalMemoryFallback();
++  }
+   return physical_memory;
+ }
+ 

patches/chromium/fix_resolve_dynamic_background_material_update_issue_on_windows_11.patch

@@ -0,0 +1,115 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: zoy <zoy-l@outlook.com>
+Date: Mon, 5 May 2025 23:28:53 +0800
+Subject: fix: resolve dynamic background material update issue on Windows 11
+
+This patch addresses issues with background materials on Windows 11,
+such as the background turning black when maximizing the window and
+dynamic background material settings not taking effect.
+
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+index a415140b94e467adfbc3dbbaa026e897a0f66c06..41470fd55bf2053eb6d523bda3b544f448bfb094 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc
+@@ -176,6 +176,10 @@ void DesktopWindowTreeHostWin::FinishTouchDrag(gfx::Point screen_point) {
+   }
+ }
+ 
++void DesktopWindowTreeHostWin::SetIsTranslucent(bool is_translucent) {
++  message_handler_->set_is_translucent(is_translucent);
++}
++
+ // DesktopWindowTreeHostWin, DesktopWindowTreeHost implementation:
+ 
+ void DesktopWindowTreeHostWin::Init(const Widget::InitParams& params) {
+diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
+index b85d1cdec49b10628d2f3d3d2e07513beb830456..232b5121fc2b138c91559d740c5178f0562df66b 100644
+--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
++++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.h
+@@ -94,6 +94,8 @@ class VIEWS_EXPORT DesktopWindowTreeHostWin
+   // false.
+   void FinishTouchDrag(gfx::Point screen_point);
+ 
++  void SetIsTranslucent(bool is_translucent);
++
+  protected:
+   // Overridden from DesktopWindowTreeHost:
+   void Init(const Widget::InitParams& params) override;
+diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
+index 1a10bd1a6c527633f97d6eee6525b1e45a3fcd3d..7de4e205fede08d6e0d38ec4aa72c4fa47ac6d9e 100644
+--- a/ui/views/win/hwnd_message_handler.cc
++++ b/ui/views/win/hwnd_message_handler.cc
+@@ -937,13 +937,13 @@ void HWNDMessageHandler::FrameTypeChanged() {
+ 
+ void HWNDMessageHandler::PaintAsActiveChanged() {
+   if (!delegate_->HasNonClientView() || !delegate_->CanActivate() ||
+-      !delegate_->HasFrame() ||
++      (!delegate_->HasFrame() && !is_translucent_) ||
+       (delegate_->GetFrameMode() == FrameMode::CUSTOM_DRAWN)) {
+     return;
+   }
+ 
+   DefWindowProcWithRedrawLock(WM_NCACTIVATE, delegate_->ShouldPaintAsActive(),
+-                              0);
++                              delegate_->HasFrame() ? 0 : -1);
+ }
+ 
+ void HWNDMessageHandler::SetWindowIcons(const gfx::ImageSkia& window_icon,
+@@ -1027,7 +1027,14 @@ void HWNDMessageHandler::SizeConstraintsChanged() {
+   //   allowing ui::GetResizableFrameThickness() to be used consistently when
+   //   removing the visible system frame.
+   const bool had_caption_on_init = window_style() & WS_CAPTION;
+-  const bool can_resize = !is_translucent_ && delegate_->CanResize();
++
++  // In Chromium, the !is_translucent_ check was introduced for Glic-specific
++  // behavior. Since Electron does not use Glic, this restriction can be safely
++  // removed. Keeping the is_translucent_ check disables maximization for
++  // translucent framed windows. Original code: !is_translucent_ &&
++  // delegate_->CanResize() See:
++  // https://chromium-review.googlesource.com/c/chromium/src/+/6372329
++  const bool can_resize = delegate_->CanResize();
+   const bool can_maximize = can_resize && delegate_->CanMaximize();
+ 
+   auto set_style_func = [&style](LONG bit, bool should_set) {
+@@ -1622,11 +1629,16 @@ void HWNDMessageHandler::ResetWindowRegion(bool force, bool redraw) {
+   // through, but that isn't the case when using Direct3D to draw transparent
+   // windows. So we route translucent windows throught to the delegate to
+   // allow for a custom hit mask.
+-  if (!is_translucent_ && !custom_window_region_.is_valid() &&
++  // patch: fix_resolve_dynamic_background_material_update_issue_on_windows_11
++  // Our translucent windows use the native frame by default, and we should not
++  // set a custom region when the window is maximized; otherwise, it will cause
++  // a white title bar to appear under Windows 11.
++  if (!custom_window_region_.is_valid() &&
+       (IsFrameSystemDrawn() || !delegate_->HasNonClientView())) {
+     if (force) {
+       SetWindowRgn(hwnd(), nullptr, redraw);
+     }
++
+     return;
+   }
+ 
+@@ -2340,17 +2352,18 @@ LRESULT HWNDMessageHandler::OnNCActivate(UINT message,
+     delegate_->SchedulePaint();
+   }
+ 
+-  // Calling DefWindowProc is only necessary if there's a system frame being
+-  // drawn. Otherwise it can draw an incorrect title bar and cause visual
+-  // corruption.
+-  if (!delegate_->HasFrame() ||
++  // If the window is translucent, it may have the Mica background.
++  // In that case, it's necessary to call |DefWindowProc|, but we can
++  // pass -1 in the lParam to prevent any non-client area elements from
++  // being displayed.
++  if ((!delegate_->HasFrame() && !is_translucent_) ||
+       delegate_->GetFrameMode() == FrameMode::CUSTOM_DRAWN) {
+     SetMsgHandled(TRUE);
+     return TRUE;
+   }
+ 
+   return DefWindowProcWithRedrawLock(WM_NCACTIVATE, paint_as_active || active,
+-                                     0);
++                                     delegate_->HasFrame() ? 0 : -1);
+ }
+ 
+ LRESULT HWNDMessageHandler::OnNCCalcSize(BOOL mode, LPARAM l_param) {

patches/chromium/make_gtk_getlibgtk_public.patch

@@ -7,10 +7,10 @@ Allows embedders to get a handle to the gdk_pixbuf
 library already loaded in the process.
 
 diff --git a/ui/gtk/gtk_compat.cc b/ui/gtk/gtk_compat.cc
-index 37bb48273cf4833c88622f1158aebfee9423d085..2009a095abfae3207d73c47245e061ff3f9cef80 100644
+index bcd86e7a9e870b274d0c6487a691f23ad1888079..4b192c90ce82ddddaedf14970919447e8f43dd7c 100644
 --- a/ui/gtk/gtk_compat.cc
 +++ b/ui/gtk/gtk_compat.cc
-@@ -69,11 +69,6 @@ void* GetLibGio() {
+@@ -68,11 +68,6 @@ void* GetLibGio() {
    return libgio;
  }
  
@@ -22,7 +22,7 @@ index 37bb48273cf4833c88622f1158aebfee9423d085..2009a095abfae3207d73c47245e061ff
  void* GetLibGdk3() {
    static void* libgdk3 = DlOpen("libgdk-3.so.0");
    return libgdk3;
-@@ -169,6 +164,11 @@ gfx::Insets InsetsFromGtkBorder(const GtkBorder& border) {
+@@ -165,6 +160,11 @@ gfx::Insets InsetsFromGtkBorder(const GtkBorder& border) {
  
  }  // namespace
  
@@ -31,14 +31,14 @@ index 37bb48273cf4833c88622f1158aebfee9423d085..2009a095abfae3207d73c47245e061ff
 +  return libgdk_pixbuf;
 +}
 +
- bool LoadGtk() {
-   static bool loaded = LoadGtkImpl();
+ bool LoadGtk(ui::LinuxUiBackend backend) {
+   static bool loaded = LoadGtkImpl(backend);
    return loaded;
 diff --git a/ui/gtk/gtk_compat.h b/ui/gtk/gtk_compat.h
-index 19f73cc179d82a3729c5fe37883460ac05f4d0c3..17aa0b95bd6158ed02c03095c1687185a057fe62 100644
+index 841e2e8fcdbe2da4aac487badd4d352476e461a2..e458df649546fa3bee10e24f0edac147186cc152 100644
 --- a/ui/gtk/gtk_compat.h
 +++ b/ui/gtk/gtk_compat.h
-@@ -41,6 +41,9 @@ using SkColor = uint32_t;
+@@ -42,6 +42,9 @@ using SkColor = uint32_t;
  
  namespace gtk {
  
@@ -46,5 +46,5 @@ index 19f73cc179d82a3729c5fe37883460ac05f4d0c3..17aa0b95bd6158ed02c03095c1687185
 +void* GetLibGdkPixbuf();
 +
  // Loads libgtk and related libraries and returns true on success.
- bool LoadGtk();
+ bool LoadGtk(ui::LinuxUiBackend backend);
  

patches/node/.patches

@@ -37,7 +37,6 @@ test_use_static_method_names_in_call_stacks.patch
 fix_remove_fastapitypedarray_usage.patch
 test_handle_explicit_resource_management_globals.patch
 build_change_crdtp_protocoltypetraits_signatures_to_avoid_conflict.patch
-build_option_to_use_custom_inspector_protocol_path.patch
 fix_adjust_wpt_and_webidl_tests_for_enabled_float16array.patch
 chore_add_createexternalizabletwobytestring_to_globals.patch
 refactor_attach_cppgc_heap_on_v8_isolate_creation.patch
@@ -46,5 +45,3 @@ cli_move_--trace-atomics-wait_to_eol.patch
 fix_cppgc_initializing_twice.patch
 fix_task_starvation_in_inspector_context_test.patch
 fix_expose_readfilesync_override_for_modules.patch
-chore_remove_protocol_maybe_from_node_string.patch
-fix_-wmismatched-new-delete_in_debug_utils_cc.patch

patches/node/build_add_gn_build_files.patch

@@ -11,7 +11,7 @@ really in 20/21. We have to wait until 22 is released to be able to
 build with upstream GN files.
 
 diff --git a/configure.py b/configure.py
-index 4560bac7b8e3c707ecea5a425f642efb9de9ed36..e9c2a4391f4058a21a259cacaac4fde5d199288e 100755
+index 2415940835036226799a7ea14c6687cc0d56c523..0feb07afbccad97a92cee00954443407eb20ac67 100755
 --- a/configure.py
 +++ b/configure.py
 @@ -1722,7 +1722,7 @@ def configure_v8(o, configs):
@@ -24,7 +24,7 @@ index 4560bac7b8e3c707ecea5a425f642efb9de9ed36..e9c2a4391f4058a21a259cacaac4fde5
    o['variables']['v8_enable_external_code_space'] = 1 if options.enable_pointer_compression else 0
    o['variables']['v8_enable_31bit_smis_on_64bit_arch'] = 1 if options.enable_pointer_compression else 0
 diff --git a/node.gni b/node.gni
-index 35ccd0487f20cece033d58827ecb7ed016908ee4..b4450e3dd17994d1eaf59eb5cff5912545e89793 100644
+index b049f0692980c3e26771c3209c3bdd2e9a4d637b..e2407027ab05e59b2f0f1c213b98ea469db7a91b 100644
 --- a/node.gni
 +++ b/node.gni
 @@ -5,10 +5,10 @@
@@ -40,7 +40,15 @@ index 35ccd0487f20cece033d58827ecb7ed016908ee4..b4450e3dd17994d1eaf59eb5cff59125
  
    # The location of OpenSSL - use the one from node's deps by default.
    node_openssl_path = "$node_path/deps/openssl"
-@@ -44,7 +44,7 @@ declare_args() {
+@@ -42,12 +42,15 @@ declare_args() {
+   # The variable is called "openssl" for parity with node's GYP build.
+   node_use_openssl = true
+ 
++  # Build node with SQLite support.
++  node_use_sqlite = true
++
+   # Use the specified path to system CA (PEM format) in addition to
+   # the BoringSSL supplied CA store or compiled-in Mozilla CA copy.
    node_openssl_system_ca_path = ""
  
    # Initialize v8 platform during node.js startup.
@@ -49,7 +57,7 @@ index 35ccd0487f20cece033d58827ecb7ed016908ee4..b4450e3dd17994d1eaf59eb5cff59125
  
    # Custom build tag.
    node_tag = ""
-@@ -64,10 +64,16 @@ declare_args() {
+@@ -67,10 +70,16 @@ declare_args() {
    # TODO(zcbenz): There are few broken things for now:
    #   1. cross-os compilation is not supported.
    #   2. node_mksnapshot crashes when cross-compiling for x64 from arm64.
@@ -68,10 +76,10 @@ index 35ccd0487f20cece033d58827ecb7ed016908ee4..b4450e3dd17994d1eaf59eb5cff59125
  
  assert(!node_enable_inspector || node_use_openssl,
 diff --git a/src/node_builtins.cc b/src/node_builtins.cc
-index 092341dbfbabe15b15ed43057d399f754505f6fd..f14b45850e42585f5686b7201e2b8281ed8c24e1 100644
+index abf1583cdac9f139056cf4809f14e28e62f6d24c..8b104e175ccf8de90c138337f83f8f6ce1348ac7 100644
 --- a/src/node_builtins.cc
 +++ b/src/node_builtins.cc
-@@ -788,6 +788,7 @@ void BuiltinLoader::RegisterExternalReferences(
+@@ -789,6 +789,7 @@ void BuiltinLoader::RegisterExternalReferences(
    registry->Register(GetNatives);
  
    RegisterExternalReferencesForInternalizedBuiltinCode(registry);
@@ -271,10 +279,22 @@ index 856878c33681a73d41016729dabe48b0a6a80589..91a11852d206b65485fe90fd037a0bd1
      if sys.platform == 'win32':
        files = [ x.replace('\\', '/') for x in files ]
 diff --git a/unofficial.gni b/unofficial.gni
-index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187f3c04c5c 100644
+index da565473f1ae96b4d009935f7733e6ab15ea9de2..26ebc811272ef2990f8d090c54e7f5294aab9d37 100644
 --- a/unofficial.gni
 +++ b/unofficial.gni
-@@ -142,32 +142,42 @@ template("node_gn_build") {
+@@ -22,6 +22,11 @@ template("node_gn_build") {
+     } else {
+       defines += [ "HAVE_OPENSSL=0" ]
+     }
++    if (node_use_sqlite) {
++      defines += [ "HAVE_SQLITE=1" ]
++    } else {
++      defines += [ "HAVE_SQLITE=0" ]
++    }
+     if (node_use_amaro) {
+       defines += [ "HAVE_AMARO=1" ]
+     } else {
+@@ -142,32 +147,41 @@ template("node_gn_build") {
      public_configs = [
        ":node_external_config",
        "deps/googletest:googletest_config",
@@ -297,7 +317,7 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
        "deps/nghttp2",
 -      "deps/ngtcp2",
        "deps/postject",
-       "deps/sqlite",
+-      "deps/sqlite",
        "deps/uvwasi",
 -      "deps/zstd",
        "//third_party/zlib",
@@ -320,7 +340,7 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
        "$target_gen_dir/node_javascript.cc",
      ] + gypi_values.node_sources
  
-@@ -190,7 +200,7 @@ template("node_gn_build") {
+@@ -190,9 +204,13 @@ template("node_gn_build") {
      }
      if (node_use_openssl) {
        deps += [ "deps/ncrypto" ]
@@ -328,8 +348,14 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
 +      public_deps += [ "//third_party/boringssl" ]
        sources += gypi_values.node_crypto_sources
      }
++    if (node_use_sqlite) {
++      deps += [ "deps/sqlite" ]
++      sources += gypi_values.node_sqlite_sources
++    }
      if (node_enable_inspector) {
-@@ -214,6 +224,10 @@ template("node_gn_build") {
+       deps += [
+         "$node_inspector_protocol_path:crdtp",
+@@ -215,6 +233,10 @@ template("node_gn_build") {
      }
    }
  
@@ -340,7 +366,7 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
    executable(target_name) {
      forward_variables_from(invoker, "*")
  
-@@ -288,6 +302,7 @@ template("node_gn_build") {
+@@ -289,6 +311,7 @@ template("node_gn_build") {
    }
  
    executable("node_js2c") {
@@ -348,7 +374,7 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
      deps = [
        "deps/uv",
        "$node_simdutf_path",
-@@ -298,26 +313,75 @@ template("node_gn_build") {
+@@ -299,26 +322,75 @@ template("node_gn_build") {
        "src/embedded_data.cc",
        "src/embedded_data.h",
      ]
@@ -434,7 +460,7 @@ index 44641b92678ab2f28e6f5de75a92878f9f3d322d..e17e4f043af6e4047ab82723ffd83187
      outputs = [ "$target_gen_dir/node_javascript.cc" ]
  
      # Get the path to node_js2c executable of the host toolchain.
-@@ -331,11 +395,11 @@ template("node_gn_build") {
+@@ -332,11 +404,11 @@ template("node_gn_build") {
          get_label_info(":node_js2c($host_toolchain)", "name") +
          host_executable_suffix
  

patches/node/build_allow_unbundling_of_node_js_dependencies.patch

@@ -14,10 +14,10 @@ We don't need to do this for zlib, as the existing gn workflow uses the same
 Upstreamed at https://github.com/nodejs/node/pull/55903
 
 diff --git a/unofficial.gni b/unofficial.gni
-index e17e4f043af6e4047ab82723ffd83187f3c04c5c..d591dfc99fdea4f830008502786ee44d863a31fc 100644
+index 26ebc811272ef2990f8d090c54e7f5294aab9d37..8886f2a79ae77614789d6ae0defd4f18fc756456 100644
 --- a/unofficial.gni
 +++ b/unofficial.gni
-@@ -155,7 +155,6 @@ template("node_gn_build") {
+@@ -160,7 +160,6 @@ template("node_gn_build") {
        ":run_node_js2c",
        "deps/cares",
        "deps/histogram",
@@ -25,7 +25,7 @@ index e17e4f043af6e4047ab82723ffd83187f3c04c5c..d591dfc99fdea4f830008502786ee44d
        "deps/nbytes",
        "deps/nghttp2",
        "deps/postject",
-@@ -194,7 +193,17 @@ template("node_gn_build") {
+@@ -198,7 +197,17 @@ template("node_gn_build") {
        configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
        configs += [ "//build/config/gcc:symbol_visibility_default" ]
      }
@@ -44,7 +44,7 @@ index e17e4f043af6e4047ab82723ffd83187f3c04c5c..d591dfc99fdea4f830008502786ee44d
      if (v8_enable_i18n_support) {
        deps += [ "//third_party/icu" ]
      }
-@@ -222,6 +231,19 @@ template("node_gn_build") {
+@@ -231,6 +240,19 @@ template("node_gn_build") {
        sources += node_inspector.node_inspector_sources +
                   node_inspector.node_inspector_generated_sources
      }

patches/node/build_change_crdtp_protocoltypetraits_signatures_to_avoid_conflict.patch

@@ -38,10 +38,10 @@ index 8521730bd03cdfce47e9b5d0f5d68a568bc3de8c..28f4598aa7ea0e93350f79566c06d0f0
  }
  
 diff --git a/src/inspector/node_string.h b/src/inspector/node_string.h
-index 94ec9b2301998c4c5aad9ca3dae72ecf323fa0bb..a0d19a592d7bf9b00d6b98ef1ae931626ebb945c 100644
+index bcdedaa2ae4ab1d3267d7a1347f15e0405261277..ddedca4a5b9b35258050f8b4cb446ceeba956896 100644
 --- a/src/inspector/node_string.h
 +++ b/src/inspector/node_string.h
-@@ -19,8 +19,8 @@ namespace crdtp {
+@@ -18,8 +18,8 @@ namespace crdtp {
  
  template <>
  struct ProtocolTypeTraits<std::string> {

patches/node/build_compile_with_c_20_support.patch

@@ -10,10 +10,10 @@ V8 requires C++20 support as of https://chromium-review.googlesource.com/c/v8/v8
 This can be removed when Electron upgrades to a version of Node.js containing the required V8 version.
 
 diff --git a/common.gypi b/common.gypi
-index 03fefab4b0a9727925411b95310831ffdc33e8d9..f9b5e47f1d67807435529c99d12f419d0fd4269f 100644
+index 679633dc6b4ce2a1f5f88e93d1a1c1feb4bbadb4..2caa183213d5632be81b763e894e37c09384391f 100644
 --- a/common.gypi
 +++ b/common.gypi
-@@ -538,7 +538,7 @@
+@@ -539,7 +539,7 @@
            '-fno-rtti',
            '-fno-exceptions',
            '-fno-strict-aliasing',
@@ -22,7 +22,7 @@ index 03fefab4b0a9727925411b95310831ffdc33e8d9..f9b5e47f1d67807435529c99d12f419d
          ],
          'defines': [ '__STDC_FORMAT_MACROS' ],
          'ldflags': [ '-rdynamic' ],
-@@ -708,7 +708,7 @@
+@@ -709,7 +709,7 @@
            ['clang==1', {
              'xcode_settings': {
                'GCC_VERSION': 'com.apple.compilers.llvm.clang.1_0',

patches/node/build_enable_perfetto.patch

@@ -64,10 +64,10 @@ index 251f51ec454f9cba4023b8b6729241ee753aac13..1de8cac6e3953ce9cab9db03530da327
  
  module.exports = {
 diff --git a/node.gyp b/node.gyp
-index 0434887c363a586cbfa0438765fc8800d4237057..20fbf03cee24e66f9ad0d394dbcfa3ad03348890 100644
+index 442c1e7a6ddafbb7a7ec7a42a97ec04b28ea4d93..3a66c11d39dd2fd129c8f54098a9607e080ecca0 100644
 --- a/node.gyp
 +++ b/node.gyp
-@@ -175,7 +175,6 @@
+@@ -176,7 +176,6 @@
        'src/timers.cc',
        'src/timer_wrap.cc',
        'src/tracing/agent.cc',
@@ -75,7 +75,7 @@ index 0434887c363a586cbfa0438765fc8800d4237057..20fbf03cee24e66f9ad0d394dbcfa3ad
        'src/tracing/node_trace_writer.cc',
        'src/tracing/trace_event.cc',
        'src/tracing/traced_value.cc',
-@@ -302,7 +301,6 @@
+@@ -304,7 +303,6 @@
        'src/tcp_wrap.h',
        'src/timers.h',
        'src/tracing/agent.h',

patches/node/build_ensure_native_module_compilation_fails_if_not_using_a_new.patch

@@ -7,7 +7,7 @@ Subject: build: ensure native module compilation fails if not using a new
 This should not be upstreamed, it is a quality-of-life patch for downstream module builders.
 
 diff --git a/common.gypi b/common.gypi
-index bfe567e016cf102d2087f7647e64cc051116ab8d..03fefab4b0a9727925411b95310831ffdc33e8d9 100644
+index 33af43cd768c24b26d523f3db66eb8b9eb26859a..679633dc6b4ce2a1f5f88e93d1a1c1feb4bbadb4 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -89,6 +89,8 @@
@@ -19,7 +19,7 @@ index bfe567e016cf102d2087f7647e64cc051116ab8d..03fefab4b0a9727925411b95310831ff
      ##### end V8 defaults #####
  
      # When building native modules using 'npm install' with the system npm,
-@@ -297,7 +299,8 @@
+@@ -298,7 +300,8 @@
        '_GLIBCXX_USE_CXX11_ABI=1',
        # This help forks when building Node.js on a 32-bit arch as
        # libuv is always compiled with _FILE_OFFSET_BITS=64
@@ -29,7 +29,7 @@ index bfe567e016cf102d2087f7647e64cc051116ab8d..03fefab4b0a9727925411b95310831ff
      ],
  
      # Forcibly disable -Werror.  We support a wide range of compilers, it's
-@@ -454,6 +457,11 @@
+@@ -455,6 +458,11 @@
            }],
          ],
        }],
@@ -42,7 +42,7 @@ index bfe567e016cf102d2087f7647e64cc051116ab8d..03fefab4b0a9727925411b95310831ff
        # list in v8/BUILD.gn.
        ['v8_enable_v8_checks == 1', {
 diff --git a/configure.py b/configure.py
-index e9c2a4391f4058a21a259cacaac4fde5d199288e..7821a0d3a7179a9e7fa9e48a062c2b0e7705ca6f 100755
+index 0feb07afbccad97a92cee00954443407eb20ac67..5eccced7cf0212f229db68c76cc824a37e4a29bc 100755
 --- a/configure.py
 +++ b/configure.py
 @@ -1704,6 +1704,7 @@ def configure_library(lib, output, pkgname=None):

patches/node/build_modify_js2c_py_to_allow_injection_of_original-fs_and_custom_embedder_js.patch

@@ -10,10 +10,10 @@ JS errors and ensures embedder JS is loaded via LoadEmbedderJavaScriptSource.
 That method is generated by our modifications to js2c.cc in the BUILD.gn patch
 
 diff --git a/lib/internal/fs/watchers.js b/lib/internal/fs/watchers.js
-index 411eab8136d5957ae8a491bc38ffbdc88e59f5da..63c93b5be09692d0d4b6bfbb214b173b50ccca43 100644
+index 0244a214b187e67e0cb89f26cd019855963ec93a..b65a3be6bcb0e28f7f43367d0fa9da533db9d0d1 100644
 --- a/lib/internal/fs/watchers.js
 +++ b/lib/internal/fs/watchers.js
-@@ -292,12 +292,13 @@ function emitCloseNT(self) {
+@@ -299,12 +299,13 @@ function emitCloseNT(self) {
  }
  
  // Legacy alias on the C++ wrapper object. This is not public API, so we may
@@ -34,7 +34,7 @@ index 411eab8136d5957ae8a491bc38ffbdc88e59f5da..63c93b5be09692d0d4b6bfbb214b173b
  let kResistStopPropagation;
  
 diff --git a/src/node_builtins.cc b/src/node_builtins.cc
-index f14b45850e42585f5686b7201e2b8281ed8c24e1..915b8cba6d512096e6090272ab3fbc63d5c61ce8 100644
+index 8b104e175ccf8de90c138337f83f8f6ce1348ac7..35cf42a5e533cb799bf129df0c8370bfe8310233 100644
 --- a/src/node_builtins.cc
 +++ b/src/node_builtins.cc
 @@ -35,6 +35,7 @@ using v8::Value;

patches/node/build_option_to_use_custom_inspector_protocol_path.patch

@@ -1,60 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: deepak1556 <hop2deep@gmail.com>
-Date: Mon, 17 Feb 2025 20:57:05 +0900
-Subject: build: option to use custom inspector_protocol path
-
-This allows building against //third_party/inspector_protocol
-which would align us when building with chromium shared dependencies.
-
-The span changes will be auto-removed when Node.js bumps their
-protocol deps to contain https://chromium-review.googlesource.com/c/v8/v8/+/5996636
-
-Rest of the changes can be upstreamed.
-
-diff --git a/node.gni b/node.gni
-index 203b4abbc44df9e58083c819f61f9025104abdc6..73bf3839866a2652ca660f1117e8f249d33fa46a 100644
---- a/node.gni
-+++ b/node.gni
-@@ -16,6 +16,9 @@ declare_args() {
-   # The location of simdutf - use the one from node's deps by default.
-   node_simdutf_path = "//third_party/simdutf"
- 
-+  # The location of inspector_protocol - use the one from node's deps by default.
-+  node_inspector_protocol_path = "//third_party/inspector_protocol"
-+
-   # The NODE_MODULE_VERSION defined in node_version.h.
-   node_module_version = exec_script("$node_path/tools/getmoduleversion.py", [], "value")
- 
-diff --git a/src/inspector/unofficial.gni b/src/inspector/unofficial.gni
-index 3d7aa148678b2646b88fa7c32abec91791b02b82..4810d93eb971b253f7dadff7011a632f6dbe6a2b 100644
---- a/src/inspector/unofficial.gni
-+++ b/src/inspector/unofficial.gni
-@@ -13,7 +13,7 @@ template("inspector_gn_build") {
-   }
- 
-   node_gen_dir = get_label_info("../..", "target_gen_dir")
--  protocol_tool_path = "../../deps/inspector_protocol"
-+  protocol_tool_path = "$node_inspector_protocol_path"
- 
-   gypi_values = exec_script(
-       "../../tools/gypi_to_gn.py",
-diff --git a/unofficial.gni b/unofficial.gni
-index d591dfc99fdea4f830008502786ee44d863a31fc..9e26399482d6a1cdb843efb72c152d5cdd5e08ea 100644
---- a/unofficial.gni
-+++ b/unofficial.gni
-@@ -214,13 +214,14 @@ template("node_gn_build") {
-     }
-     if (node_enable_inspector) {
-       deps += [
--        "src/inspector:crdtp",
-+        "$node_inspector_protocol_path:crdtp",
-         "src/inspector:node_protocol_generated_sources",
-         "src/inspector:v8_inspector_compress_protocol_json",
-       ]
-       include_dirs = [
-         "$target_gen_dir/src",
-         "$target_gen_dir/src/inspector",
-+        "$node_inspector_protocol_path",
-       ]
-       node_inspector = exec_script(
-           "./tools/gypi_to_gn.py",

patches/node/build_restore_clang_as_default_compiler_on_macos.patch

@@ -11,7 +11,7 @@ node-gyp will use the result of `process.config` that reflects the environment
 in which the binary got built.
 
 diff --git a/common.gypi b/common.gypi
-index f9b5e47f1d67807435529c99d12f419d0fd4269f..c99f583d3674347dd6eb9a5eea1ed5588e376d31 100644
+index 2caa183213d5632be81b763e894e37c09384391f..2cce436c4a9e3d942f957f6c94a4ef9e3db391ce 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -128,6 +128,7 @@

patches/node/chore_allow_the_node_entrypoint_to_be_a_builtin_module.patch

@@ -8,7 +8,7 @@ they use themselves as the entry point. We should try to upstream some form
 of this.
 
 diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
-index 4e7be0594ca1e1ceaf1963debbce46783893ed77..a6df0672bf6ae6e9a74ebbb0e4debff63599cc99 100644
+index 0cda54fd85e1e0bff13d4718a269eb3e7c60312a..6b165062a5eaa40f6e5614bca50bc33ccbdb85cc 100644
 --- a/lib/internal/process/pre_execution.js
 +++ b/lib/internal/process/pre_execution.js
 @@ -245,12 +245,14 @@ function patchProcessObject(expandArgv1) {

patches/node/chore_disable_deprecation_ftbfs_in_simdjson_header.patch

@@ -11,10 +11,10 @@ Without this patch, building with simdjson fails with
 This patch can be removed once this is fixed upstream in simdjson.
 
 diff --git a/deps/simdjson/simdjson.h b/deps/simdjson/simdjson.h
-index a0d449975224a3e0db5c05de79b290763d6e390c..e77e47f972b4609e38aa8b68ab0d81ed1575effb 100644
+index 8f52a4331d59996786450eec982659da9244cac1..74729673d87b068dff5f24166bbb77d844f15f42 100644
 --- a/deps/simdjson/simdjson.h
 +++ b/deps/simdjson/simdjson.h
-@@ -3868,12 +3868,17 @@ inline std::ostream& operator<<(std::ostream& out, simdjson_result<padded_string
+@@ -3899,12 +3899,17 @@ inline std::ostream& operator<<(std::ostream& out, simdjson_result<padded_string
  
  } // namespace simdjson
  
@@ -32,7 +32,7 @@ index a0d449975224a3e0db5c05de79b290763d6e390c..e77e47f972b4609e38aa8b68ab0d81ed
  namespace simdjson {
  namespace internal {
  
-@@ -4273,6 +4278,9 @@ inline simdjson_result<padded_string> padded_string::load(std::string_view filen
+@@ -4304,6 +4309,9 @@ inline simdjson_result<padded_string> padded_string::load(std::string_view filen
  
  } // namespace simdjson
  
@@ -42,7 +42,7 @@ index a0d449975224a3e0db5c05de79b290763d6e390c..e77e47f972b4609e38aa8b68ab0d81ed
  inline simdjson::padded_string operator ""_padded(const char *str, size_t len) {
    return simdjson::padded_string(str, len);
  }
-@@ -4281,6 +4289,8 @@ inline simdjson::padded_string operator ""_padded(const char8_t *str, size_t len
+@@ -4312,6 +4320,8 @@ inline simdjson::padded_string operator ""_padded(const char8_t *str, size_t len
    return simdjson::padded_string(reinterpret_cast<const char8_t *>(str), len);
  }
  #endif

patches/node/chore_expose_importmoduledynamically_and.patch

@@ -11,7 +11,7 @@ its own blended handler between Node and Blink.
 Not upstreamable.
 
 diff --git a/lib/internal/modules/esm/utils.js b/lib/internal/modules/esm/utils.js
-index 9d6f850f667c5186efe6855bc3d5f5af332bdaa7..8521759e20adf53024e5893dbf3cb36e1752085e 100644
+index 9b41db8b0714b7408f79cbd5b4c460d9bc08f239..35ecfb9bbaf2c8e7351e1c69da84c82a4a7cb049 100644
 --- a/lib/internal/modules/esm/utils.js
 +++ b/lib/internal/modules/esm/utils.js
 @@ -30,7 +30,7 @@ const {
@@ -23,7 +23,7 @@ index 9d6f850f667c5186efe6855bc3d5f5af332bdaa7..8521759e20adf53024e5893dbf3cb36e
  const {
    loadPreloadModules,
    initializeFrozenIntrinsics,
-@@ -280,12 +280,13 @@ let _forceDefaultLoader = false;
+@@ -281,12 +281,13 @@ let _forceDefaultLoader = false;
   * @param {boolean} [forceDefaultLoader=false] - A boolean indicating disabling custom loaders.
   */
  function initializeESM(forceDefaultLoader = false) {
@@ -40,10 +40,10 @@ index 9d6f850f667c5186efe6855bc3d5f5af332bdaa7..8521759e20adf53024e5893dbf3cb36e
  
  /**
 diff --git a/src/module_wrap.cc b/src/module_wrap.cc
-index cdd0ba00eb0cafbc79b816017423f9021ca2979d..6916497f6feb14e482cf5080b57d639ae7292d20 100644
+index e317a84e55714af0a93719336d02ac26410ad724..e3880111172363feafb53b51deb08c93596cd4f4 100644
 --- a/src/module_wrap.cc
 +++ b/src/module_wrap.cc
-@@ -875,7 +875,7 @@ MaybeLocal<Module> ModuleWrap::ResolveModuleCallback(
+@@ -895,7 +895,7 @@ MaybeLocal<Module> ModuleWrap::ResolveModuleCallback(
    return module->module_.Get(isolate);
  }
  
@@ -52,7 +52,7 @@ index cdd0ba00eb0cafbc79b816017423f9021ca2979d..6916497f6feb14e482cf5080b57d639a
      Local<Context> context,
      Local<Data> host_defined_options,
      Local<Value> resource_name,
-@@ -947,12 +947,13 @@ void ModuleWrap::SetImportModuleDynamicallyCallback(
+@@ -967,12 +967,13 @@ void ModuleWrap::SetImportModuleDynamicallyCallback(
    Realm* realm = Realm::GetCurrent(args);
    HandleScope handle_scope(isolate);
  
@@ -68,7 +68,7 @@ index cdd0ba00eb0cafbc79b816017423f9021ca2979d..6916497f6feb14e482cf5080b57d639a
  }
  
  void ModuleWrap::HostInitializeImportMetaObjectCallback(
-@@ -994,13 +995,14 @@ void ModuleWrap::SetInitializeImportMetaObjectCallback(
+@@ -1014,13 +1015,14 @@ void ModuleWrap::SetInitializeImportMetaObjectCallback(
    Realm* realm = Realm::GetCurrent(args);
    Isolate* isolate = realm->isolate();
  
@@ -87,7 +87,7 @@ index cdd0ba00eb0cafbc79b816017423f9021ca2979d..6916497f6feb14e482cf5080b57d639a
  
  MaybeLocal<Value> ModuleWrap::SyntheticModuleEvaluationStepsCallback(
 diff --git a/src/module_wrap.h b/src/module_wrap.h
-index ef4dfd1d6b091d2b0f71b946904a47415b6435ba..862f946a75f2a2949d7eeb7f97e96289beab8078 100644
+index 9363ce73e51cde3d3a94f9912f072d532d0f8560..c0e972ed293157726efc5fa76dfa62d3da51c22a 100644
 --- a/src/module_wrap.h
 +++ b/src/module_wrap.h
 @@ -8,6 +8,7 @@
@@ -114,7 +114,7 @@ index ef4dfd1d6b091d2b0f71b946904a47415b6435ba..862f946a75f2a2949d7eeb7f97e96289
   public:
    enum InternalFields {
      kModuleSlot = BaseObject::kInternalFieldCount,
-@@ -91,6 +99,8 @@ class ModuleWrap : public BaseObject {
+@@ -92,6 +100,8 @@ class ModuleWrap : public BaseObject {
    static void CreateRequiredModuleFacade(
        const v8::FunctionCallbackInfo<v8::Value>& args);
  
@@ -123,7 +123,7 @@ index ef4dfd1d6b091d2b0f71b946904a47415b6435ba..862f946a75f2a2949d7eeb7f97e96289
   private:
    ModuleWrap(Realm* realm,
               v8::Local<v8::Object> object,
-@@ -130,7 +140,6 @@ class ModuleWrap : public BaseObject {
+@@ -131,7 +141,6 @@ class ModuleWrap : public BaseObject {
        v8::Local<v8::String> specifier,
        v8::Local<v8::FixedArray> import_attributes,
        v8::Local<v8::Module> referrer);

patches/node/chore_remove_protocol_maybe_from_node_string.patch

@@ -1,33 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Shelley Vohr <shelley.vohr@gmail.com>
-Date: Thu, 26 Jun 2025 09:20:43 +0000
-Subject: chore: remove protocol::Maybe from node_string
-
-It was removed upstream in https://chromium-review.googlesource.com/c/chromium/src/+/6049967.
-
-This should be upstreamed.
-
-diff --git a/src/inspector/node_string.h b/src/inspector/node_string.h
-index a0d19a592d7bf9b00d6b98ef1ae931626ebb945c..ddedca4a5b9b35258050f8b4cb446ceeba956896 100644
---- a/src/inspector/node_string.h
-+++ b/src/inspector/node_string.h
-@@ -6,7 +6,6 @@
- #include <cstring>
- #include <sstream>
- #include <string>
--#include "crdtp/maybe.h"
- #include "crdtp/protocol_core.h"
- #include "util.h"
- #include "v8-inspector.h"
-@@ -31,11 +30,6 @@ struct ProtocolTypeTraits<node::inspector::protocol::Binary> {
-                         std::vector<uint8_t>* bytes);
- };
- 
--template <>
--struct detail::MaybeTypedef<node::inspector::protocol::Binary> {
--  typedef ValueMaybe<node::inspector::protocol::Binary> type;
--};
--
- }  // namespace crdtp
- 
- namespace node {

patches/node/cli_move_--trace-atomics-wait_to_eol.patch

@@ -15,10 +15,50 @@ Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index d924287df3ca29681cf71e2fbd402314ce8edd97..f2f4d25a838b9758234cd667b0fb537d0d0fcced 100644
+index 404e87e6d1237b5ee79cafd8a959c1b6d9d23fe5..7deda572c940f7b2e8c6813f1826796a13e4db38 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -3386,7 +3386,6 @@ one is included in the list below.
+@@ -2709,39 +2709,6 @@ added: v12.0.0
+ Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.3'. Use to disable support
+ for TLSv1.2, which is not as secure as TLSv1.3.
+ 
+-### `--trace-atomics-wait`
+-
+-<!-- YAML
+-added: v14.3.0
+-deprecated:
+-  - v18.8.0
+-  - v16.18.0
+--->
+-
+-> Stability: 0 - Deprecated
+-
+-Print short summaries of calls to [`Atomics.wait()`][] to stderr.
+-The output could look like this:
+-
+-```text
+-(node:15701) [Thread 0] Atomics.wait(&lt;address> + 0, 1, inf) started
+-(node:15701) [Thread 0] Atomics.wait(&lt;address> + 0, 1, inf) did not wait because the values mismatched
+-(node:15701) [Thread 0] Atomics.wait(&lt;address> + 0, 0, 10) started
+-(node:15701) [Thread 0] Atomics.wait(&lt;address> + 0, 0, 10) timed out
+-(node:15701) [Thread 0] Atomics.wait(&lt;address> + 4, 0, inf) started
+-(node:15701) [Thread 1] Atomics.wait(&lt;address> + 4, -1, inf) started
+-(node:15701) [Thread 0] Atomics.wait(&lt;address> + 4, 0, inf) was woken up by another thread
+-(node:15701) [Thread 1] Atomics.wait(&lt;address> + 4, -1, inf) was woken up by another thread
+-```
+-
+-The fields here correspond to:
+-
+-* The thread id as given by [`worker_threads.threadId`][]
+-* The base address of the `SharedArrayBuffer` in question, as well as the
+-  byte offset corresponding to the index passed to `Atomics.wait()`
+-* The expected value that was passed to `Atomics.wait()`
+-* The timeout passed to `Atomics.wait`
+-
+ ### `--trace-deprecation`
+ 
+ <!-- YAML
+@@ -3423,7 +3390,6 @@ one is included in the list below.
  * `--tls-min-v1.1`
  * `--tls-min-v1.2`
  * `--tls-min-v1.3`
@@ -27,7 +67,7 @@ index d924287df3ca29681cf71e2fbd402314ce8edd97..f2f4d25a838b9758234cd667b0fb537d
  * `--trace-env-js-stack`
  * `--trace-env-native-stack`
 diff --git a/doc/node.1 b/doc/node.1
-index 663d123ac728f097e8a76c94cf10c53d059983d7..497f5a61182beafbaa26b945181056353674cfc3 100644
+index f41323c799ad34c8e17a36d81e4cc2b16e50e9ee..a9ff54edfad1d053ec1ac544f28e14a1898ac177 100644
 --- a/doc/node.1
 +++ b/doc/node.1
 @@ -539,11 +539,6 @@ but the option is supported for compatibility with older Node.js versions.
@@ -110,7 +150,7 @@ index 0c2a4d344c991c2ca0d9d90934cf7921abf2a629..19d9fb77f1aaf003e43b7d7016f45e6c
      isolate_->SetPromiseHook(TracePromises);
    }
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 9829b0b2b2d013b93ac14d3ec6d46c35abcc4635..5fb2e713a50185b997935cb15fddd7b8b65a5b82 100644
+index d6988a5a8c068022d10607c32e57ac667f821337..4deaa52a8a4688bca32d41b74124604b6e33c80b 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -773,10 +773,6 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
@@ -125,7 +165,7 @@ index 9829b0b2b2d013b93ac14d3ec6d46c35abcc4635..5fb2e713a50185b997935cb15fddd7b8
              "show stack traces on deprecations",
              &EnvironmentOptions::trace_deprecation,
 diff --git a/src/node_options.h b/src/node_options.h
-index eb18fdd617fd19e5b97cd67f351e70c28fee3e75..216c0f92167bd131e5ef2ea96ad47425ff51c3f7 100644
+index 2b7df46312b8be58d6062b6a2f6084247e075c37..2d52cde518926577834f77424fa5b2231ca3374e 100644
 --- a/src/node_options.h
 +++ b/src/node_options.h
 @@ -204,7 +204,6 @@ class EnvironmentOptions : public Options {

patches/node/cli_remove_deprecated_v8_flag.patch

@@ -18,10 +18,10 @@ Reviewed-By: Michaël Zasso <targos@protonmail.com>
 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index cc311472678108f21eed70281e91b0d40c5fe7b6..d924287df3ca29681cf71e2fbd402314ce8edd97 100644
+index 78c0794a57fd4fdcdd8a64fe98a6b13f9ef3f23a..404e87e6d1237b5ee79cafd8a959c1b6d9d23fe5 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -3423,7 +3423,6 @@ V8 options that are allowed are:
+@@ -3461,7 +3461,6 @@ V8 options that are allowed are:
  * `--disallow-code-generation-from-strings`
  * `--enable-etw-stack-walking`
  * `--expose-gc`
@@ -30,10 +30,10 @@ index cc311472678108f21eed70281e91b0d40c5fe7b6..d924287df3ca29681cf71e2fbd402314
  * `--jitless`
  * `--max-old-space-size`
 diff --git a/src/node_options.cc b/src/node_options.cc
-index d2e945b1d6ef6729709cc73c238cfae46d4e56b6..9829b0b2b2d013b93ac14d3ec6d46c35abcc4635 100644
+index 367f7d9b1450e4d9e6d8fef36a2234e7d1344804..d6988a5a8c068022d10607c32e57ac667f821337 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
-@@ -995,11 +995,6 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
+@@ -1001,11 +1001,6 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
              "disallow eval and friends",
              V8Option{},
              kAllowedInEnvvar);

patches/node/enable_crashpad_linux_node_processes.patch

@@ -8,7 +8,7 @@ to child processes spawned with `ELECTRON_RUN_AS_NODE` which is used
 by the crashpad client to connect with the handler process.
 
 diff --git a/lib/child_process.js b/lib/child_process.js
-index e848b3d5ee9b13ea3ea303eb3b57ef47ef951580..5b89c420f1a917526ab311fed52bff01637a86fe 100644
+index 655349b6fa17217a9202616224032a36fd01e284..bf62c5adf0e0d75cb50636f365f71db82c29ba29 100644
 --- a/lib/child_process.js
 +++ b/lib/child_process.js
 @@ -62,6 +62,7 @@ let debug = require('internal/util/debuglog').debuglog(
@@ -19,7 +19,7 @@ index e848b3d5ee9b13ea3ea303eb3b57ef47ef951580..5b89c420f1a917526ab311fed52bff01
  
  const {
    AbortError,
-@@ -154,7 +155,6 @@ function fork(modulePath, args = [], options) {
+@@ -156,7 +157,6 @@ function fork(modulePath, args = [], options) {
        ArrayPrototypeSplice(execArgv, index - 1, 2);
      }
    }
@@ -27,11 +27,11 @@ index e848b3d5ee9b13ea3ea303eb3b57ef47ef951580..5b89c420f1a917526ab311fed52bff01
    args = [...execArgv, modulePath, ...args];
  
    if (typeof options.stdio === 'string') {
-@@ -610,6 +610,22 @@ function normalizeSpawnArguments(file, args, options) {
+@@ -637,6 +637,22 @@ function normalizeSpawnArguments(file, args, options) {
                      'options.windowsVerbatimArguments');
    }
  
-+  const env = options.env || process.env;
++  const env = options.env || { ...process.env };
 +
 +  if ((process.platform === 'linux') &&
 +      ObjectPrototypeHasOwnProperty(env, 'ELECTRON_RUN_AS_NODE') &&
@@ -50,11 +50,12 @@ index e848b3d5ee9b13ea3ea303eb3b57ef47ef951580..5b89c420f1a917526ab311fed52bff01
    if (options.shell) {
      validateArgumentNullCheck(options.shell, 'options.shell');
      const command = ArrayPrototypeJoin([file, ...args], ' ');
-@@ -643,7 +659,6 @@ function normalizeSpawnArguments(file, args, options) {
+@@ -670,8 +686,6 @@ function normalizeSpawnArguments(file, args, options) {
      ArrayPrototypeUnshift(args, file);
    }
  
--  const env = options.env || process.env;
+-  // Shallow copy to guarantee changes won't impact process.env
+-  const env = options.env || { ...process.env };
    const envPairs = [];
  
    // process.env.NODE_V8_COVERAGE always propagates, making it possible to

patches/node/fix_-wmismatched-new-delete_in_debug_utils_cc.patch

@@ -1,31 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Shelley Vohr <shelley.vohr@gmail.com>
-Date: Thu, 26 Jun 2025 12:46:41 +0000
-Subject: fix: -Wmismatched-new-delete in debug_utils.cc
-
-Fixes the following error:
-
-Error: ../../third_party/electron_node/src/debug_utils.cc(491,11): error: 'delete' applied to a pointer that was allocated with 'new[]'; did you mean 'delete[]'? [-Werror,-Wmismatched-new-delete]
-  491 |           delete str;
-      |           ^
-      |                 []
-../../third_party/electron_node/src/debug_utils.cc(487,23): note: allocated with 'new[]' here
-  487 |           char* str = new char[size];
-      |                       ^
-1 error generated.
-
-Upstreamed in https://github.com/nodejs/node/pull/58844.
-
-diff --git a/src/debug_utils.cc b/src/debug_utils.cc
-index 97884b9a0f8d6d88e36da06b05642505c767338d..65283ef31da35d0f08fcff7a5e79bf960d861126 100644
---- a/src/debug_utils.cc
-+++ b/src/debug_utils.cc
-@@ -488,7 +488,7 @@ std::vector<std::string> NativeSymbolDebuggingContext::GetLoadedLibraries() {
-           WideCharToMultiByte(
-               CP_UTF8, 0, module_name, -1, str, size, nullptr, nullptr);
-           list.emplace_back(str);
--          delete str;
-+          delete[] str;
-         }
-       }
-     }

patches/node/fix_add_default_values_for_variables_in_common_gypi.patch

@@ -7,7 +7,7 @@ common.gypi is a file that's included in the node header bundle, despite
 the fact that we do not build node with gyp.
 
 diff --git a/common.gypi b/common.gypi
-index a73d4401f26d8493802d3ecec3e015a77717720a..bfe567e016cf102d2087f7647e64cc051116ab8d 100644
+index 20135003dd040ebfb3661c81c89fde93ce00fbfb..33af43cd768c24b26d523f3db66eb8b9eb26859a 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -91,6 +91,23 @@

patches/node/fix_allow_passing_fileexists_fn_to_legacymainresolve.patch

@@ -11,7 +11,7 @@ We can fix this by allowing the C++ implementation of legacyMainResolve to use
 a fileExists function that does take Asar into account.
 
 diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
-index 2879e5cf541fb4d226cfd7cc0fe367ca448fb926..03082f0ec4f91382933eec48e77331cdf6f04943 100644
+index e3afd30ba1f591d0298793bc42fd7166a4219bce..408dc96307d7f52f92db41004b358051a81c627c 100644
 --- a/lib/internal/modules/esm/resolve.js
 +++ b/lib/internal/modules/esm/resolve.js
 @@ -28,14 +28,13 @@ const { BuiltinModule } = require('internal/bootstrap/realm');
@@ -37,7 +37,7 @@ index 2879e5cf541fb4d226cfd7cc0fe367ca448fb926..03082f0ec4f91382933eec48e77331cd
  
 +function fileExists(url) {
 +  const namespaced = toNamespacedPath(toPathIfFileURL(url));
-+  return internalFsBinding.internalModuleStat(internalFsBinding, namespaced) === 0;
++  return internalFsBinding.internalModuleStat(namespaced) === 0;
 +}
 +
  /**
@@ -53,10 +53,10 @@ index 2879e5cf541fb4d226cfd7cc0fe367ca448fb926..03082f0ec4f91382933eec48e77331cd
    const maybeMain = resolvedOption <= legacyMainResolveExtensionsIndexes.kResolvedByMainIndexNode ?
      packageConfig.main || './' : '';
 diff --git a/src/node_file.cc b/src/node_file.cc
-index fe28c340c9b50384e79fe14263d8b3807f49e0b3..37172158d318d6569194fd3c5441d107e155e54c 100644
+index 7d174113a22cb26e767f8756ce0f0cdedd68d7d7..f3142dab526064114771af154c3389961771b5dc 100644
 --- a/src/node_file.cc
 +++ b/src/node_file.cc
-@@ -3523,13 +3523,25 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
+@@ -3482,13 +3482,25 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
  }
  
  BindingData::FilePathIsFileReturnType BindingData::FilePathIsFile(
@@ -83,7 +83,7 @@ index fe28c340c9b50384e79fe14263d8b3807f49e0b3..37172158d318d6569194fd3c5441d107
    uv_fs_t req;
  
    int rc = uv_fs_stat(env->event_loop(), &req, file_path.c_str(), nullptr);
-@@ -3587,6 +3599,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3546,6 +3558,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
    std::optional<std::string> initial_file_path;
    std::string file_path;
  
@@ -95,7 +95,7 @@ index fe28c340c9b50384e79fe14263d8b3807f49e0b3..37172158d318d6569194fd3c5441d107
    if (args.Length() >= 2 && args[1]->IsString()) {
      auto package_config_main = Utf8Value(isolate, args[1]).ToString();
  
-@@ -3607,7 +3624,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3566,7 +3583,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
        BufferValue buff_file_path(isolate, local_file_path);
        ToNamespacedPath(env, &buff_file_path);
  
@@ -104,7 +104,7 @@ index fe28c340c9b50384e79fe14263d8b3807f49e0b3..37172158d318d6569194fd3c5441d107
          case BindingData::FilePathIsFileReturnType::kIsFile:
            return args.GetReturnValue().Set(i);
          case BindingData::FilePathIsFileReturnType::kIsNotFile:
-@@ -3644,7 +3661,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3603,7 +3620,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
      BufferValue buff_file_path(isolate, local_file_path);
      ToNamespacedPath(env, &buff_file_path);
  

patches/node/fix_assert_module_in_the_renderer_process.patch

@@ -13,10 +13,10 @@ if the override has been disabled.
 This will be upstreamed.
 
 diff --git a/lib/internal/assert/utils.js b/lib/internal/assert/utils.js
-index 59b5a16f1309a5e4055bccfdb7a529045ad30402..bfdaf6211466a01b64b7942f7b16c480283278ff 100644
+index d059fa89baf7d4f7d921d00871a97494be4a166a..a0f7fd2e4512e9b4196bbf5fe4390b00e5e2d9a8 100644
 --- a/lib/internal/assert/utils.js
 +++ b/lib/internal/assert/utils.js
-@@ -25,6 +25,7 @@ const AssertionError = require('internal/assert/assertion_error');
+@@ -24,6 +24,7 @@ const AssertionError = require('internal/assert/assertion_error');
  const { openSync, closeSync, readSync } = require('fs');
  const { EOL } = require('internal/constants');
  const { BuiltinModule } = require('internal/bootstrap/realm');
@@ -24,7 +24,7 @@ index 59b5a16f1309a5e4055bccfdb7a529045ad30402..bfdaf6211466a01b64b7942f7b16c480
  const { isError } = require('internal/util');
  
  const errorCache = new SafeMap();
-@@ -167,8 +168,16 @@ function getErrMessage(message, fn) {
+@@ -166,8 +167,16 @@ function getErrMessage(message, fn) {
    ErrorCaptureStackTrace(err, fn);
    if (errorStackTraceLimitIsWritable) Error.stackTraceLimit = tmpLimit;
  
@@ -44,10 +44,10 @@ index 59b5a16f1309a5e4055bccfdb7a529045ad30402..bfdaf6211466a01b64b7942f7b16c480
    let filename = call.getFileName();
    const line = call.getLineNumber() - 1;
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 14f7764c995e8de6582faf58c9b98a9cbe4fab73..d2e945b1d6ef6729709cc73c238cfae46d4e56b6 100644
+index 9cf107b1048208ffcb69ff91e0d36ffacc741805..367f7d9b1450e4d9e6d8fef36a2234e7d1344804 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
-@@ -1560,14 +1560,16 @@ void GetEmbedderOptions(const FunctionCallbackInfo<Value>& args) {
+@@ -1566,14 +1566,16 @@ void GetEmbedderOptions(const FunctionCallbackInfo<Value>& args) {
    }
    Isolate* isolate = args.GetIsolate();
  

patches/node/fix_crypto_tests_to_run_with_bssl.patch

@@ -210,18 +210,18 @@ index d22281abbd5c3cab3aaa3ac494301fa6b4a8a968..5f0c6a4aed2e868a1a1049212edf2187
  s.pipe(h).on('data', common.mustCall(function(c) {
    assert.strictEqual(c, expect);
 diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
-index 61145aee0727fbe0b9781acdb3eeb641e7010729..51693e637b310981f76f23c2f35d43e4d2d9c4ef 100644
+index 929dd36c669239804f2cfc5168bd3bf6e15855e6..8ebe599bbd21ad30e5041e0eab1e5898caf33e49 100644
 --- a/test/parallel/test-crypto-hash.js
 +++ b/test/parallel/test-crypto-hash.js
-@@ -183,7 +183,7 @@ assert.throws(
+@@ -182,7 +182,7 @@ assert.throws(
  }
  
  // Test XOF hash functions and the outputLength option.
 -{
 +if (!process.features.openssl_is_boringssl) {
-   // Default outputLengths. Since OpenSSL 3.4 an outputLength is mandatory
-   if (!hasOpenSSL(3, 4)) {
-     assert.strictEqual(crypto.createHash('shake128').digest('hex'),
+   // Default outputLengths.
+   assert.strictEqual(crypto.createHash('shake128').digest('hex'),
+                      '7f9c2ba4e88f827d616045507605853e');
 diff --git a/test/parallel/test-crypto-padding.js b/test/parallel/test-crypto-padding.js
 index 48cd1ed4df61aaddeee8785cb90f83bdd9628187..d09e01712c617597833bb1320a32a967bcf1d318 100644
 --- a/test/parallel/test-crypto-padding.js

patches/node/fix_do_not_resolve_electron_entrypoints.patch

@@ -6,10 +6,10 @@ Subject: fix: do not resolve electron entrypoints
 This wastes fs cycles and can result in strange behavior if this path actually exists on disk
 
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index bbd3085cfbf14aefd611954fa836f6c96d7e402c..9e71d2d0b79656e212fb21efdb3efcf988529f5e 100644
+index 8b55082d2bb0ce743b190a601aff0651095049cd..eb71a78c91b277157980aa1359578390c9fd1ae3 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -291,6 +291,9 @@ function cjsPreparseModuleExports(filename, source, isMain, format) {
+@@ -293,6 +293,9 @@ function cjsPreparseModuleExports(filename, source, isMain, format) {
    if (module && module[kModuleExportNames] !== undefined) {
      return { module, exportNames: module[kModuleExportNames] };
    }

patches/node/fix_expose_readfilesync_override_for_modules.patch

@@ -8,10 +8,10 @@ an API override to replace the native `ReadFileSync` in the `modules`
 binding.
 
 diff --git a/src/env_properties.h b/src/env_properties.h
-index 3df4e303e05105b43a542456546cbc050d0445fa..4f7aee6cb64b4c1d25e98b43d13e747c4546adaa 100644
+index d4961ac90fbc7fffe44f7d494bfae37ba0fa07e0..7b414e6733adff5740bd8e661846824962048c3e 100644
 --- a/src/env_properties.h
 +++ b/src/env_properties.h
-@@ -502,6 +502,7 @@
+@@ -505,6 +505,7 @@
    V(maybe_cache_generated_source_map, v8::Function)                            \
    V(messaging_deserialize_create_object, v8::Function)                         \
    V(message_port, v8::Object)                                                  \

patches/node/fix_expose_the_built-in_electron_module_via_the_esm_loader.patch

@@ -18,10 +18,10 @@ index 9519f947b8dfdc69808839948c9cb8434a0acf0e..23ce72d479f638c33edffcea7c35f5da
  
  /**
 diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
-index 5ba13096b98047ff33e4d44167c2a069ccc5e69d..09a332c0999086b30fd952d9456f788925240e27 100644
+index e718d7b3e7c11addc78cf7af33c93f63a9cb247b..3334818153068468967baa5adc1ed2382592ec76 100644
 --- a/lib/internal/modules/esm/load.js
 +++ b/lib/internal/modules/esm/load.js
-@@ -106,7 +106,7 @@ async function defaultLoad(url, context = kEmptyObject) {
+@@ -81,7 +81,7 @@ function defaultLoad(url, context = kEmptyObject) {
  
    throwIfUnsupportedURLScheme(urlInstance);
  
@@ -30,16 +30,16 @@ index 5ba13096b98047ff33e4d44167c2a069ccc5e69d..09a332c0999086b30fd952d9456f7889
      source = null;
      format ??= 'builtin';
    } else if (format !== 'commonjs' || defaultType === 'module') {
-@@ -119,7 +119,7 @@ async function defaultLoad(url, context = kEmptyObject) {
+@@ -94,7 +94,7 @@ function defaultLoad(url, context = kEmptyObject) {
        // Now that we have the source for the module, run `defaultGetFormat` to detect its format.
-       format = await defaultGetFormat(urlInstance, context);
+       format = defaultGetFormat(urlInstance, context);
  
 -      if (format === 'commonjs') {
 +      if (format === 'electron' || format === 'commonjs') {
          // For backward compatibility reasons, we need to discard the source in
          // order for the CJS loader to re-fetch it.
          source = null;
-@@ -167,7 +167,7 @@ function defaultLoadSync(url, context = kEmptyObject) {
+@@ -142,7 +142,7 @@ function defaultLoadSync(url, context = kEmptyObject) {
  
    throwIfUnsupportedURLScheme(urlInstance, false);
  
@@ -48,7 +48,7 @@ index 5ba13096b98047ff33e4d44167c2a069ccc5e69d..09a332c0999086b30fd952d9456f7889
      source = null;
    } else if (source == null) {
      ({ responseURL, source } = getSourceSync(urlInstance, context));
-@@ -200,12 +200,13 @@ function throwIfUnsupportedURLScheme(parsed) {
+@@ -175,12 +175,13 @@ function throwIfUnsupportedURLScheme(parsed) {
      protocol !== 'file:' &&
      protocol !== 'data:' &&
      protocol !== 'node:' &&
@@ -64,10 +64,10 @@ index 5ba13096b98047ff33e4d44167c2a069ccc5e69d..09a332c0999086b30fd952d9456f7889
    }
  }
 diff --git a/lib/internal/modules/esm/loader.js b/lib/internal/modules/esm/loader.js
-index 5a817ed0434b8bc08f9b9bd260c978bbe5ddc664..f9dba42cddb08f69e02834f76d6d80c5e47a637d 100644
+index 8d98d50395cf7fbbaf9ae30387727bff5c6cd550..ed3b3c02bbdac78c163d589557651618814685a5 100644
 --- a/lib/internal/modules/esm/loader.js
 +++ b/lib/internal/modules/esm/loader.js
-@@ -492,7 +492,7 @@ class ModuleLoader {
+@@ -494,7 +494,7 @@ class ModuleLoader {
      }
  
      const cjsModule = wrap[imported_cjs_symbol];
@@ -77,18 +77,20 @@ index 5a817ed0434b8bc08f9b9bd260c978bbe5ddc664..f9dba42cddb08f69e02834f76d6d80c5
        // Check if the ESM initiating import CJS is being required by the same CJS module.
        if (cjsModule?.[kIsExecuting]) {
 diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
-index bfd9bd3d127404de1cbb6f30c43ab0342590759d..9e7d8ef0adef3b68a3ec186e4b218f591aa69266 100644
+index 859b6bfedac4bbee2df054f9ebca7cbaaed45f18..5aa946f66c71beff0b7a43c30638ab28a1a5dfc0 100644
 --- a/lib/internal/modules/esm/resolve.js
 +++ b/lib/internal/modules/esm/resolve.js
-@@ -751,6 +751,7 @@ function packageImportsResolve(name, base, conditions) {
+@@ -750,6 +750,9 @@ function packageImportsResolve(name, base, conditions) {
    throw importNotDefined(name, packageJSONUrl, base);
  }
  
-+const electronTypes = ['electron', 'electron/main', 'electron/common', 'electron/renderer'];
++const electronTypes = [
++  'electron', 'electron/main', 'electron/common', 'electron/renderer', 'electron/utility'
++];
  
  /**
   * Resolves a package specifier to a URL.
-@@ -765,6 +766,11 @@ function packageResolve(specifier, base, conditions) {
+@@ -764,6 +767,11 @@ function packageResolve(specifier, base, conditions) {
      return new URL('node:' + specifier);
    }
  
@@ -101,10 +103,10 @@ index bfd9bd3d127404de1cbb6f30c43ab0342590759d..9e7d8ef0adef3b68a3ec186e4b218f59
  
    const packageConfig = packageJsonReader.read(packageJSONPath, { __proto__: null, specifier, base, isESM: true });
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 0695b47a8a8f78451c20c025a3d9dac7cadab686..1db58d31dad24cd2da6bdc5e45e9dd4f0b899a23 100644
+index 3a69558d7a3dba5bfcb7d3c13299f698fe6c18a1..de1539cebeb1874cbafbe76a4f03217693db2aa1 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -186,7 +186,7 @@ function createCJSModuleWrap(url, source, isMain, format, loadCJS = loadCJSModul
+@@ -188,7 +188,7 @@ function createCJSModuleWrap(url, source, isMain, format, loadCJS = loadCJSModul
  
    const { exportNames, module } = cjsPreparseModuleExports(filename, source, isMain, format);
    cjsCache.set(url, module);
@@ -113,7 +115,7 @@ index 0695b47a8a8f78451c20c025a3d9dac7cadab686..1db58d31dad24cd2da6bdc5e45e9dd4f
      [...exportNames] : ['default', ...exportNames];
  
    if (isMain) {
-@@ -208,8 +208,8 @@ function createCJSModuleWrap(url, source, isMain, format, loadCJS = loadCJSModul
+@@ -210,8 +210,8 @@ function createCJSModuleWrap(url, source, isMain, format, loadCJS = loadCJSModul
        ({ exports } = module);
      }
      for (const exportName of exportNames) {
@@ -124,7 +126,7 @@ index 0695b47a8a8f78451c20c025a3d9dac7cadab686..1db58d31dad24cd2da6bdc5e45e9dd4f
          continue;
        }
        // We might trigger a getter -> dont fail.
-@@ -243,6 +243,10 @@ translators.set('require-commonjs', (url, source, isMain) => {
+@@ -245,6 +245,10 @@ translators.set('require-commonjs', (url, source, isMain) => {
    return createCJSModuleWrap(url, source, isMain, 'commonjs');
  });
  
@@ -136,10 +138,10 @@ index 0695b47a8a8f78451c20c025a3d9dac7cadab686..1db58d31dad24cd2da6bdc5e45e9dd4f
  // This translator function must be sync, as `require` is sync.
  translators.set('require-commonjs-typescript', (url, source, isMain) => {
 diff --git a/lib/internal/url.js b/lib/internal/url.js
-index f6e58e196860fc9321e3367f8461ec2647d7e8f8..a80ecee888222e02f5d03f42f7af2c1ab9750cab 100644
+index b6057ae6656e03d98ea40c018369419749409c6d..9bd9abd49523406fd9ac77f2b5efe311da1fa9aa 100644
 --- a/lib/internal/url.js
 +++ b/lib/internal/url.js
-@@ -1505,6 +1505,8 @@ function fileURLToPath(path, options = kEmptyObject) {
+@@ -1604,6 +1604,8 @@ function fileURLToPath(path, options = kEmptyObject) {
      path = new URL(path);
    else if (!isURL(path))
      throw new ERR_INVALID_ARG_TYPE('path', ['string', 'URL'], path);

patches/node/fix_handle_boringssl_and_openssl_incompatibilities.patch

@@ -172,7 +172,7 @@ index e5bf2b529bf23914677e25d7468aad58a4684557..9a3c6029ff3319cce58c79782a7bd5d1
    };
    // Check to see if the given public key is suitable for this DH instance.
 diff --git a/node.gni b/node.gni
-index b4450e3dd17994d1eaf59eb5cff5912545e89793..203b4abbc44df9e58083c819f61f9025104abdc6 100644
+index e2407027ab05e59b2f0f1c213b98ea469db7a91b..c64761b730e61edcdc0e46a48699f2fd5bb1c0a6 100644
 --- a/node.gni
 +++ b/node.gni
 @@ -11,7 +11,7 @@ declare_args() {
@@ -228,10 +228,10 @@ index d94f6e1c82c4a62547b3b395f375c86ce4deb5de..b81b9005365272217c77e2b9289bd9f8
        X509View ca(sk_X509_value(peer_certs.get(), i));
        if (!cert->view().isIssuedBy(ca)) continue;
 diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index a054e4c1285208c9ba8b9679c284f459f1ace690..3de8ef4fafcdbdc2cb0ce31de162663d5272340f 100644
+index 64b850089ec837915910a243b1d5e4ed68655f63..508f7c1a49a0812583363c9e35244c3f5fbf5f89 100644
 --- a/src/crypto/crypto_context.cc
 +++ b/src/crypto/crypto_context.cc
-@@ -123,7 +123,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
+@@ -121,7 +121,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
      // the CA certificates.
      SSL_CTX_clear_extra_chain_certs(ctx);
  
@@ -396,7 +396,7 @@ index 471fee77531139ce988292470dff443fdfb05b07..931f7c2ae3d7e12afce471545d610d22
      return EVPKeyCtxPointer();
  
 diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
-index b38a9a377738fd5fe6cc89c3a27c403bf6a97715..0cd43c2005b431e180b7483cb89825a75e1fe03f 100644
+index 7238cda445fd663e6b45fa134f31d017bb267dfc..522655555cdb2ab2083797f736bf167d1f42c15e 100644
 --- a/src/crypto/crypto_keys.cc
 +++ b/src/crypto/crypto_keys.cc
 @@ -949,6 +949,7 @@ void KeyObjectHandle::GetAsymmetricKeyType(
@@ -541,21 +541,6 @@ index c42493ad958508f650917bf5ca92088714a5056c..07accfbcca491966c6c8ad9c20e146db
  #if OPENSSL_VERSION_MAJOR >= 3
    // We declare another alias here to avoid having to include crypto_util.h
    using EVPMDPointer = DeleteFnPtr<EVP_MD, EVP_MD_free>;
-diff --git a/src/node_config.cc b/src/node_config.cc
-index 6032bbd10f41da7bae44828a8e908c1bec0ea0b6..2013de54f0f6a036e8378deefbff8d7cb5f7cfb2 100644
---- a/src/node_config.cc
-+++ b/src/node_config.cc
-@@ -7,6 +7,10 @@
- #include "node_options.h"
- #include "util-inl.h"
- 
-+#if HAVE_OPENSSL
-+#include <openssl/base.h>
-+#endif
-+
- namespace node {
- 
- using v8::Context;
 diff --git a/src/node_metadata.h b/src/node_metadata.h
 index 7b2072ad39c3f1a7c73101b25b69beb781141e26..d23536d88d21255d348175425a59e2424332cd19 100644
 --- a/src/node_metadata.h
@@ -570,7 +555,7 @@ index 7b2072ad39c3f1a7c73101b25b69beb781141e26..d23536d88d21255d348175425a59e242
  #if NODE_OPENSSL_HAS_QUIC
  #include <openssl/quic.h>
 diff --git a/src/node_options.cc b/src/node_options.cc
-index da39abf79c53fcc3d83d3431deda9dbdf3b0621e..14f7764c995e8de6582faf58c9b98a9cbe4fab73 100644
+index 228fbe645587ab2d36574b46f1a4f6668bd56177..9cf107b1048208ffcb69ff91e0d36ffacc741805 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -7,7 +7,7 @@
@@ -583,7 +568,7 @@ index da39abf79c53fcc3d83d3431deda9dbdf3b0621e..14f7764c995e8de6582faf58c9b98a9c
  #endif
  
 diff --git a/src/node_options.h b/src/node_options.h
-index 165950c207ca752ec942ef27a671af66cbd2b938..eb18fdd617fd19e5b97cd67f351e70c28fee3e75 100644
+index 0b75516eb426929dc95b7531a00bdb01d1c39185..2b7df46312b8be58d6062b6a2f6084247e075c37 100644
 --- a/src/node_options.h
 +++ b/src/node_options.h
 @@ -11,7 +11,7 @@

patches/node/fix_lazyload_fs_in_esm_loaders_to_apply_asar_patches.patch

@@ -6,7 +6,7 @@ Subject: fix: lazyload fs in esm loaders to apply asar patches
 Changes { foo } from fs to just "fs.foo" so that our patching of fs is applied to esm loaders
 
 diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
-index 09a332c0999086b30fd952d9456f788925240e27..910ac85cdc86e7fb3f850f7edf0b95ea09d464dc 100644
+index 3334818153068468967baa5adc1ed2382592ec76..ab4c8a4d00f1813e72f1ea8349850b40f55a393e 100644
 --- a/lib/internal/modules/esm/load.js
 +++ b/lib/internal/modules/esm/load.js
 @@ -10,7 +10,7 @@ const {
@@ -18,17 +18,7 @@ index 09a332c0999086b30fd952d9456f788925240e27..910ac85cdc86e7fb3f850f7edf0b95ea
  
  const defaultType =
    getOptionValue('--experimental-default-type');
-@@ -38,8 +38,7 @@ async function getSource(url, context) {
-   const responseURL = href;
-   let source;
-   if (protocol === 'file:') {
--    const { readFile: readFileAsync } = require('internal/fs/promises').exports;
--    source = await readFileAsync(url);
-+    source = await fs.promises.readFile(url);
-   } else if (protocol === 'data:') {
-     const result = dataURLProcessor(url);
-     if (result === 'failure') {
-@@ -63,7 +62,7 @@ function getSourceSync(url, context) {
+@@ -38,7 +38,7 @@ function getSourceSync(url, context) {
    const responseURL = href;
    let source;
    if (protocol === 'file:') {
@@ -38,7 +28,7 @@ index 09a332c0999086b30fd952d9456f788925240e27..910ac85cdc86e7fb3f850f7edf0b95ea
      const result = dataURLProcessor(url);
      if (result === 'failure') {
 diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
-index 9e7d8ef0adef3b68a3ec186e4b218f591aa69266..2879e5cf541fb4d226cfd7cc0fe367ca448fb926 100644
+index 5aa946f66c71beff0b7a43c30638ab28a1a5dfc0..e3afd30ba1f591d0298793bc42fd7166a4219bce 100644
 --- a/lib/internal/modules/esm/resolve.js
 +++ b/lib/internal/modules/esm/resolve.js
 @@ -25,7 +25,7 @@ const {
@@ -50,7 +40,7 @@ index 9e7d8ef0adef3b68a3ec186e4b218f591aa69266..2879e5cf541fb4d226cfd7cc0fe367ca
  const { getOptionValue } = require('internal/options');
  // Do not eagerly grab .manifest, it may be in TDZ
  const { sep, posix: { relative: relativePosixPath }, resolve } = require('path');
-@@ -277,7 +277,7 @@ function finalizeResolution(resolved, base, preserveSymlinks) {
+@@ -276,7 +276,7 @@ function finalizeResolution(resolved, base, preserveSymlinks) {
    }
  
    if (!preserveSymlinks) {
@@ -60,10 +50,10 @@ index 9e7d8ef0adef3b68a3ec186e4b218f591aa69266..2879e5cf541fb4d226cfd7cc0fe367ca
      });
      const { search, hash } = resolved;
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 1db58d31dad24cd2da6bdc5e45e9dd4f0b899a23..bbd3085cfbf14aefd611954fa836f6c96d7e402c 100644
+index de1539cebeb1874cbafbe76a4f03217693db2aa1..8b55082d2bb0ce743b190a601aff0651095049cd 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -24,7 +24,7 @@ const {
+@@ -25,7 +25,7 @@ const {
  
  const { BuiltinModule } = require('internal/bootstrap/realm');
  const assert = require('internal/assert');
@@ -72,7 +62,7 @@ index 1db58d31dad24cd2da6bdc5e45e9dd4f0b899a23..bbd3085cfbf14aefd611954fa836f6c9
  const { dirname, extname } = require('path');
  const {
    assertBufferSource,
-@@ -272,7 +272,7 @@ translators.set('commonjs', function commonjsStrategy(url, source, isMain) {
+@@ -274,7 +274,7 @@ translators.set('commonjs', function commonjsStrategy(url, source, isMain) {
  
    try {
      // We still need to read the FS to detect the exports.

patches/node/fix_remove_fastapitypedarray_usage.patch

@@ -7,18 +7,18 @@ Refs https://github.com/electron/electron/pull/45055#issuecomment-2559095439
 Can be removed when upstream adopts relevant V8 version.
 
 diff --git a/src/crypto/crypto_timing.cc b/src/crypto/crypto_timing.cc
-index 867a1c4aca54b9d41490d23a5eb55088b7e941cc..09f4c65a18efea262b1f854f993c6f18273f48f5 100644
+index fe669d40c31a29334b047b9cfee3067f64ef0a7b..9e5de7bbe574add017cd12ee091304d01e6458d6 100644
 --- a/src/crypto/crypto_timing.cc
 +++ b/src/crypto/crypto_timing.cc
-@@ -11,7 +11,6 @@
- namespace node {
+@@ -12,7 +12,6 @@ namespace node {
  
+ using v8::CFunction;
  using v8::FastApiCallbackOptions;
 -using v8::FastApiTypedArray;
  using v8::FunctionCallbackInfo;
  using v8::Local;
  using v8::Object;
-@@ -50,14 +49,13 @@ void TimingSafeEqual(const FunctionCallbackInfo<Value>& args) {
+@@ -51,14 +50,13 @@ void TimingSafeEqual(const FunctionCallbackInfo<Value>& args) {
  }
  
  bool FastTimingSafeEqual(Local<Value> receiver,
@@ -38,7 +38,7 @@ index 867a1c4aca54b9d41490d23a5eb55088b7e941cc..09f4c65a18efea262b1f854f993c6f18
      TRACK_V8_FAST_API_CALL("crypto.timingSafeEqual.error");
      v8::HandleScope scope(options.isolate);
      THROW_ERR_CRYPTO_TIMING_SAFE_EQUAL_LENGTH(options.isolate);
-@@ -65,7 +63,7 @@ bool FastTimingSafeEqual(Local<Value> receiver,
+@@ -66,7 +64,7 @@ bool FastTimingSafeEqual(Local<Value> receiver,
    }
  
    TRACK_V8_FAST_API_CALL("crypto.timingSafeEqual.ok");
@@ -46,9 +46,9 @@ index 867a1c4aca54b9d41490d23a5eb55088b7e941cc..09f4c65a18efea262b1f854f993c6f18
 +  return CRYPTO_memcmp(a_buffer_data, b_buffer_data, a_buffer_length) == 0;
  }
  
- static v8::CFunction fast_equal(v8::CFunction::Make(FastTimingSafeEqual));
+ static CFunction fast_timing_safe_equal(CFunction::Make(FastTimingSafeEqual));
 diff --git a/src/node_buffer.cc b/src/node_buffer.cc
-index b8021c079ca6b141ea99a4abbc828430da9d3093..98ade40ec7a6bc805acb579c8a51dcd5468c2893 100644
+index d0338b8a2d9cd3fd9f6db1f0f16f83b198ce0e7e..c4a87539dab49ff40e0951616777b132d4059e01 100644
 --- a/src/node_buffer.cc
 +++ b/src/node_buffer.cc
 @@ -44,6 +44,14 @@
@@ -193,58 +193,6 @@ index b8021c079ca6b141ea99a4abbc828430da9d3093..98ade40ec7a6bc805acb579c8a51dcd5
  }
  
  static const v8::CFunction fast_write_string_ascii(
-diff --git a/src/node_external_reference.h b/src/node_external_reference.h
-index 3bc7b2cab5a12e281058b79a7d0f734eb527986c..4218eaf365c739a4c04ca94e29d6d2a33a637d44 100644
---- a/src/node_external_reference.h
-+++ b/src/node_external_reference.h
-@@ -43,16 +43,16 @@ using CFunctionCallbackWithStrings =
-              const v8::FastOneByteString& base);
- using CFunctionCallbackWithTwoUint8Arrays =
-     int32_t (*)(v8::Local<v8::Value>,
--                const v8::FastApiTypedArray<uint8_t>&,
--                const v8::FastApiTypedArray<uint8_t>&);
-+                v8::Local<v8::Value>,
-+                v8::Local<v8::Value>);
- using CFunctionCallbackWithTwoUint8ArraysFallback =
-     bool (*)(v8::Local<v8::Value>,
--             const v8::FastApiTypedArray<uint8_t>&,
--             const v8::FastApiTypedArray<uint8_t>&,
-+             v8::Local<v8::Value>,
-+             v8::Local<v8::Value>,
-              v8::FastApiCallbackOptions&);
- using CFunctionCallbackWithUint8ArrayUint32Int64Bool =
-     int32_t (*)(v8::Local<v8::Value>,
--                const v8::FastApiTypedArray<uint8_t>&,
-+                v8::Local<v8::Value>,
-                 uint32_t,
-                 int64_t,
-                 bool);
-@@ -73,18 +73,20 @@ using CFunctionWithBool = void (*)(v8::Local<v8::Value>,
- 
- using CFunctionWriteString =
-     uint32_t (*)(v8::Local<v8::Value> receiver,
--                 const v8::FastApiTypedArray<uint8_t>& dst,
-+                 v8::Local<v8::Value> dst,
-                  const v8::FastOneByteString& src,
-                  uint32_t offset,
--                 uint32_t max_length);
-+                 uint32_t max_length,
-+                 v8::FastApiCallbackOptions&);
- 
- using CFunctionBufferCopy =
-     uint32_t (*)(v8::Local<v8::Value> receiver,
--                 const v8::FastApiTypedArray<uint8_t>& source,
--                 const v8::FastApiTypedArray<uint8_t>& target,
-+                 v8::Local<v8::Value> source,
-+                 v8::Local<v8::Value> target,
-                  uint32_t target_start,
-                  uint32_t source_start,
--                 uint32_t to_copy);
-+                 uint32_t to_copy,
-+                 v8::FastApiCallbackOptions&);
- 
- // This class manages the external references from the V8 heap
- // to the C++ addresses in Node.js.
 diff --git a/src/util.h b/src/util.h
 index 6376cf4f81113cdb2e3c179b800f1c79b51ab762..cc7ad99f981f564fba0395159d9d8b39901050ff 100644
 --- a/src/util.h

patches/node/pass_all_globals_through_require.patch

@@ -6,7 +6,7 @@ Subject: Pass all globals through "require"
 (cherry picked from commit 7d015419cb7a0ecfe6728431a4ed2056cd411d62)
 
 diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
-index d90476addb3f7cc2d0b8d8686386873894e75c25..e647bdda4624317615490cedd8d4edbcebbca8bc 100644
+index 9b51e5bf4cdfbc8127efc7d5882581daa1cbd81f..aca7c36e9b566847228bd4f13f2c8237509207db 100644
 --- a/lib/internal/modules/cjs/loader.js
 +++ b/lib/internal/modules/cjs/loader.js
 @@ -200,6 +200,13 @@ const {
@@ -23,7 +23,7 @@ index d90476addb3f7cc2d0b8d8686386873894e75c25..e647bdda4624317615490cedd8d4edbc
  const {
    isProxy,
  } = require('internal/util/types');
-@@ -1725,10 +1732,12 @@ Module.prototype._compile = function(content, filename, format) {
+@@ -1683,10 +1690,12 @@ Module.prototype._compile = function(content, filename, format) {
    if (this[kIsMainSymbol] && getOptionValue('--inspect-brk')) {
      const { callAndPauseOnStart } = internalBinding('inspector');
      result = callAndPauseOnStart(compiledWrapper, thisValue, exports,

patches/node/refactor_attach_cppgc_heap_on_v8_isolate_creation.patch

@@ -18,7 +18,7 @@ This can be removed when Node.js upgrades to a version of V8 containing CLs
 from the above issue.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 5b7f6e0609c8414c686d2d5ca603ea5c8bc484d0..6c9c81ff3c08fc28dc35578229a785521322b5dc 100644
+index 9e1b8d147a99fda962d75c343d0687ffea3c9c69..244d747f010c51366e44dec705ae304423038a85 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
 @@ -313,6 +313,10 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
@@ -47,7 +47,7 @@ index 5b7f6e0609c8414c686d2d5ca603ea5c8bc484d0..6c9c81ff3c08fc28dc35578229a78552
                      event_loop,
                      platform,
 diff --git a/src/env.cc b/src/env.cc
-index 400ff494f4e153408a2fce343d7b156d7ccefc7b..cac2d97323d131451eab4ca68ce771cb936447e4 100644
+index b6ad3ca99c8b0c656ce726fbc3455ba554bc3bd1..0922f7fb9c120482b6ee825f5f1ad10dea11fe30 100644
 --- a/src/env.cc
 +++ b/src/env.cc
 @@ -577,14 +577,6 @@ IsolateData::IsolateData(Isolate* isolate,

patches/node/src_remove_dependency_on_wrapper-descriptor-based_cppheap.patch

@@ -52,7 +52,7 @@ index 0d32d9f5a55da257a5e5a895a2ff002b780f96fe..9567d9499c62ea44cca651e87ab912ad
    return &(wrapper_data_->cppgc_id);
  }
 diff --git a/src/env.cc b/src/env.cc
-index 99bd3e37853f99ecb2e45df373f17c10b3bd1561..400ff494f4e153408a2fce343d7b156d7ccefc7b 100644
+index 63fdeeb26ba89284e74ca37050dfd170e7963331..b6ad3ca99c8b0c656ce726fbc3455ba554bc3bd1 100644
 --- a/src/env.cc
 +++ b/src/env.cc
 @@ -23,6 +23,7 @@

patches/node/src_stop_using_deprecated_fields_of_fastapicallbackoptions.patch

@@ -12,10 +12,10 @@ branch of Node.js. This patch can be removed when Electron upgrades to
 a stable Node release that contains the change. -- Charles)
 
 diff --git a/src/crypto/crypto_timing.cc b/src/crypto/crypto_timing.cc
-index 3d8ccc77b5952a999c5fe48792259d32b402c460..867a1c4aca54b9d41490d23a5eb55088b7e941cc 100644
+index dbc46400501b61814d5be0ec1cb01b0dcd94e1d0..fe669d40c31a29334b047b9cfee3067f64ef0a7b 100644
 --- a/src/crypto/crypto_timing.cc
 +++ b/src/crypto/crypto_timing.cc
-@@ -59,7 +59,8 @@ bool FastTimingSafeEqual(Local<Value> receiver,
+@@ -60,7 +60,8 @@ bool FastTimingSafeEqual(Local<Value> receiver,
    if (a.length() != b.length() || !a.getStorageIfAligned(&data_a) ||
        !b.getStorageIfAligned(&data_b)) {
      TRACK_V8_FAST_API_CALL("crypto.timingSafeEqual.error");
@@ -26,10 +26,10 @@ index 3d8ccc77b5952a999c5fe48792259d32b402c460..867a1c4aca54b9d41490d23a5eb55088
    }
  
 diff --git a/src/histogram.cc b/src/histogram.cc
-index 5641990e0bac455c33ddf7b9a865deba871516e7..bd757f42e02391abbeec007d9c4cea60bcdfa6a4 100644
+index b655808e43d7c700ddeab7690e287bdbc9bfa50a..b0f7ae4e3af652c6dfe09f66d88485c5783f4037 100644
 --- a/src/histogram.cc
 +++ b/src/histogram.cc
-@@ -195,7 +195,8 @@ void HistogramBase::FastRecord(Local<Value> unused,
+@@ -187,7 +187,8 @@ void HistogramBase::FastRecord(Local<Value> unused,
                                 const int64_t value,
                                 FastApiCallbackOptions& options) {
    if (value < 1) {
@@ -39,26 +39,6 @@ index 5641990e0bac455c33ddf7b9a865deba871516e7..bd757f42e02391abbeec007d9c4cea60
      return;
    }
    HistogramBase* histogram;
-diff --git a/src/node_file.cc b/src/node_file.cc
-index 37172158d318d6569194fd3c5441d107e155e54c..41498615a37945111348e22b18214c3bcc9533a0 100644
---- a/src/node_file.cc
-+++ b/src/node_file.cc
-@@ -1074,13 +1074,8 @@ static int32_t FastInternalModuleStat(
-     // NOLINTNEXTLINE(runtime/references) This is V8 api.
-     FastApiCallbackOptions& options) {
-   // This needs a HandleScope which needs an isolate.
--  Isolate* isolate = Isolate::TryGetCurrent();
--  if (!isolate) {
--    options.fallback = true;
--    return -1;
--  }
--
--  HandleScope scope(isolate);
-+  Environment* env = Environment::GetCurrent(options.isolate);
-+  HandleScope scope(env->isolate());
- 
-   auto path = std::filesystem::path(input.data, input.data + input.length);
- 
 diff --git a/src/node_wasi.cc b/src/node_wasi.cc
 index 090866960beb8f1759c99e95536924b8b61fb723..3f91b651b83a20e70d5b368e012f5ee4b9d16092 100644
 --- a/src/node_wasi.cc

patches/node/support_v8_sandboxed_pointers.patch

@@ -7,7 +7,7 @@ This refactors several allocators to allocate within the V8 memory cage,
 allowing them to be compatible with the V8_SANDBOXED_POINTERS feature.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index df5fb942aa893c22d14d7eb21a5211a46a472a5f..5b7f6e0609c8414c686d2d5ca603ea5c8bc484d0 100644
+index 50accbf4052da11d47a5200997f1098ed9d85354..9e1b8d147a99fda962d75c343d0687ffea3c9c69 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
 @@ -103,6 +103,14 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,

patches/node/test_formally_mark_some_tests_as_flaky.patch

@@ -7,7 +7,7 @@ Instead of disabling the tests, flag them as flaky so they still run
 but don't cause CI failures on flakes.
 
 diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
-index 8b9a4e80a08031085dde8a6952224e6ca3ca052e..2e83f166a34930083e697aaf06271e79cefe3f23 100644
+index 6303908ce180db4d409707ae1f049319358642fb..d487497417e20c778dde57197dc18373799df36a 100644
 --- a/test/parallel/parallel.status
 +++ b/test/parallel/parallel.status
 @@ -5,6 +5,16 @@ prefix parallel
@@ -28,7 +28,7 @@ index 8b9a4e80a08031085dde8a6952224e6ca3ca052e..2e83f166a34930083e697aaf06271e79
  test-net-write-fully-async-hex-string: PASS, FLAKY
  # https://github.com/nodejs/node/issues/52273
 diff --git a/test/sequential/sequential.status b/test/sequential/sequential.status
-index a3199b385dd99de57ac0fc25b1b3ecfebfcb5e61..725457846899583698ae37a8ba6088c694b09053 100644
+index 6893abfe6e1c03d455099099f0d7e6b6930372a6..24aab3bad500ce4b9d43bf693c5efa6d563fe858 100644
 --- a/test/sequential/sequential.status
 +++ b/test/sequential/sequential.status
 @@ -7,6 +7,18 @@ prefix sequential

script/.eslintrc.json

@@ -1,8 +1,8 @@
 {
   "plugins": [
-    "unicorn"
+    "import"
   ],
   "rules": {
-    "unicorn/prefer-node-protocol": "error"
+    "import/enforce-node-protocol-usage": ["error", "always"]
   }
 }

script/node-disabled-tests.json

@@ -11,6 +11,7 @@
   "parallel/test-crypto-aes-wrap",
   "parallel/test-crypto-authenticated",
   "parallel/test-crypto-authenticated-stream",
+  "parallel/test-crypto-default-shake-lengths",
   "parallel/test-crypto-des3-wrap",
   "parallel/test-crypto-dh-group-setters",
   "parallel/test-crypto-dh-modp2",

script/zip_manifests/check-zip-manifest.py

@@ -2,24 +2,79 @@
 
 import zipfile
 import sys
+import os
 
-def main(zip_path, manifest_in):
-  with open(manifest_in, 'r', encoding='utf-8') as manifest, \
-      zipfile.ZipFile(zip_path, 'r', allowZip64=True) as z:
-    files_in_zip = set(z.namelist())
-    files_in_manifest = {l.strip() for l in manifest.readlines()}
-  added_files = files_in_zip - files_in_manifest
-  removed_files = files_in_manifest - files_in_zip
-  if added_files:
-    print("Files added to bundle:")
-    for f in sorted(list(added_files)):
-      print('+' + f)
-  if removed_files:
-    print("Files removed from bundle:")
-    for f in sorted(list(removed_files)):
-      print('-' + f)
+def main(zip_path, manifest_path):
+    """
+    Compare a zip file's contents against a manifest file.
+    Returns 0 if they match, 1 if there are differences.
+    """
 
-  return 1 if added_files or removed_files else 0
+    if not os.path.exists(zip_path):
+        print(f"ERROR: Zip file not found: {zip_path}", file=sys.stderr)
+        return 1
+
+    if not os.path.exists(manifest_path):
+        print(f"ERROR: Manifest file not found: {manifest_path}", file=sys.stderr)
+        return 1
+
+    try:
+        with zipfile.ZipFile(zip_path, 'r', allowZip64=True) as z:
+            files_in_zip = set(z.namelist())
+    except zipfile.BadZipFile:
+        print(f"ERROR: Invalid zip file: {zip_path}", file=sys.stderr)
+        return 1
+    except Exception as e:
+        print(f"ERROR: Failed to read zip file {zip_path}: {e}", file=sys.stderr)
+        return 1
+
+    try:
+        with open(manifest_path, 'r', encoding='utf-8') as manifest:
+            files_in_manifest = {line.strip() for line in manifest.readlines() if line.strip()}
+    except Exception as e:
+        print(f"ERROR: Failed to read manifest file {manifest_path}: {e}", file=sys.stderr)
+        return 1
+
+    added_files = files_in_zip - files_in_manifest
+    removed_files = files_in_manifest - files_in_zip
+
+    if not added_files and not removed_files:
+        print("OK: Zip contents match manifest - no differences found")
+        return 0
+
+    print("ERROR: Zip contents do not match manifest!")
+    print(f"Zip file: {zip_path}")
+    print(f"Manifest: {manifest_path}")
+    print()
+
+    if added_files:
+        print(f"Files in zip but NOT in manifest ({len(added_files)} files):")
+        for f in sorted(added_files):
+            print(f"  + {f}")
+        print()
+
+    if removed_files:
+        print(f"Files in manifest but NOT in zip ({len(removed_files)} files):")
+        for f in sorted(removed_files):
+            print(f"  - {f}")
+        print()
+
+    print("ACTION REQUIRED:")
+    if added_files:
+        print("- Add the new files to the manifest, or")
+        print("- Remove them from the zip if they shouldn't be included")
+    if removed_files:
+        print("- Remove the missing files from the manifest, or")
+        print("- Add them to the zip if they should be included")
+
+    return 1
 
 if __name__ == '__main__':
-  sys.exit(main(sys.argv[1], sys.argv[2]))
+    if len(sys.argv) != 3:
+        print("Usage: check-zip-manifest.py <zip_file> <manifest_file>", file=sys.stderr)
+        print("", file=sys.stderr)
+        print("Compares the contents of a zip file against a manifest file.", file=sys.stderr)
+        print("Returns 0 if they match, 1 if there are differences or errors.", file=sys.stderr)
+        sys.exit(1)
+
+    sys.exit(main(sys.argv[1], sys.argv[2]))

shell/app/electron_main_delegate.cc

@@ -220,7 +220,7 @@ std::string LoadResourceBundle(const std::string& locale) {
   pak_dir =
       base::apple::FrameworkBundlePath().Append(FILE_PATH_LITERAL("Resources"));
 #else
-  base::PathService::Get(base::DIR_MODULE, &pak_dir);
+  base::PathService::Get(base::DIR_ASSETS, &pak_dir);
 #endif
 
   std::string loaded_locale = ui::ResourceBundle::InitSharedInstanceWithLocale(

shell/browser/api/electron_api_app.cc

@@ -382,6 +382,9 @@ int GetPathConstant(std::string_view name) {
   // clang-format off
   constexpr auto Lookup = base::MakeFixedFlatMap<std::string_view, int>({
       {"appData", DIR_APP_DATA},
+#if !BUILDFLAG(IS_MAC)
+      {"assets", base::DIR_ASSETS},
+#endif
 #if BUILDFLAG(IS_POSIX)
       {"cache", base::DIR_CACHE},
 #else
@@ -1155,7 +1158,8 @@ void App::DisableDomainBlockingFor3DAPIs(gin_helper::ErrorThrower thrower) {
 
 bool App::IsAccessibilitySupportEnabled() {
   auto* ax_state = content::BrowserAccessibilityState::GetInstance();
-  return ax_state->GetAccessibilityMode() == ui::kAXModeComplete;
+  auto mode = ax_state->GetAccessibilityMode();
+  return mode.has_mode(ui::kAXModeComplete.flags());
 }
 
 void App::SetAccessibilitySupportEnabled(gin_helper::ErrorThrower thrower,
@@ -1719,6 +1723,8 @@ gin::ObjectTemplateBuilder App::GetObjectTemplateBuilder(v8::Isolate* isolate) {
                  base::BindRepeating(&Browser::AddRecentDocument, browser))
       .SetMethod("clearRecentDocuments",
                  base::BindRepeating(&Browser::ClearRecentDocuments, browser))
+      .SetMethod("getRecentDocuments",
+                 base::BindRepeating(&Browser::GetRecentDocuments, browser))
 #if BUILDFLAG(IS_WIN)
       .SetMethod("setAppUserModelId",
                  base::BindRepeating(&Browser::SetAppUserModelID, browser))

shell/browser/api/electron_api_base_window.cc

@@ -656,7 +656,7 @@ bool BaseWindow::IsTabletMode() const {
 }
 
 void BaseWindow::SetBackgroundColor(const std::string& color_name) {
-  SkColor color = ParseCSSColor(color_name);
+  SkColor color = ParseCSSColor(color_name).value_or(SK_ColorWHITE);
   window_->SetBackgroundColor(color);
 }
 
@@ -850,8 +850,8 @@ void BaseWindow::SetVibrancy(v8::Isolate* isolate,
   window_->SetVibrancy(type, animation_duration_ms);
 }
 
-void BaseWindow::SetBackgroundMaterial(const std::string& material_type) {
-  window_->SetBackgroundMaterial(material_type);
+void BaseWindow::SetBackgroundMaterial(const std::string& material) {
+  window_->SetBackgroundMaterial(material);
 }
 
 #if BUILDFLAG(IS_MAC)
@@ -1089,6 +1089,33 @@ void BaseWindow::SetAppDetails(const gin_helper::Dictionary& options) {
 bool BaseWindow::IsSnapped() const {
   return window_->IsSnapped();
 }
+
+void BaseWindow::SetAccentColor(gin_helper::Arguments* args) {
+  bool accent_color = false;
+  std::string accent_color_string;
+  if (args->GetNext(&accent_color_string)) {
+    std::optional<SkColor> maybe_color = ParseCSSColor(accent_color_string);
+    if (maybe_color.has_value()) {
+      window_->SetAccentColor(maybe_color.value());
+      window_->UpdateWindowAccentColor(window_->IsActive());
+    }
+  } else if (args->GetNext(&accent_color)) {
+    window_->SetAccentColor(accent_color);
+    window_->UpdateWindowAccentColor(window_->IsActive());
+  } else {
+    args->ThrowError(
+        "Invalid accent color value - must be a string or boolean");
+  }
+}
+
+v8::Local<v8::Value> BaseWindow::GetAccentColor() const {
+  v8::Isolate* isolate = v8::Isolate::GetCurrent();
+  auto accent_color = window_->GetAccentColor();
+
+  if (std::holds_alternative<bool>(accent_color))
+    return v8::Boolean::New(isolate, std::get<bool>(accent_color));
+  return gin::StringToV8(isolate, std::get<std::string>(accent_color));
+}
 #endif
 
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX)
@@ -1333,6 +1360,8 @@ void BaseWindow::BuildPrototype(v8::Isolate* isolate,
 #if BUILDFLAG(IS_WIN)
       .SetMethod("isSnapped", &BaseWindow::IsSnapped)
       .SetProperty("snapped", &BaseWindow::IsSnapped)
+      .SetMethod("setAccentColor", &BaseWindow::SetAccentColor)
+      .SetMethod("getAccentColor", &BaseWindow::GetAccentColor)
       .SetMethod("hookWindowMessage", &BaseWindow::HookWindowMessage)
       .SetMethod("isWindowMessageHooked", &BaseWindow::IsWindowMessageHooked)
       .SetMethod("unhookWindowMessage", &BaseWindow::UnhookWindowMessage)

shell/browser/api/electron_api_base_window.h

@@ -196,7 +196,7 @@ class BaseWindow : public gin_helper::TrackableObject<BaseWindow>,
   virtual void SetVibrancy(v8::Isolate* isolate,
                            v8::Local<v8::Value> value,
                            gin_helper::Arguments* args);
-  void SetBackgroundMaterial(const std::string& vibrancy);
+  virtual void SetBackgroundMaterial(const std::string& material);
 
 #if BUILDFLAG(IS_MAC)
   std::string GetAlwaysOnTopLevel() const;
@@ -255,6 +255,8 @@ class BaseWindow : public gin_helper::TrackableObject<BaseWindow>,
   bool SetThumbnailToolTip(const std::string& tooltip);
   void SetAppDetails(const gin_helper::Dictionary& options);
   bool IsSnapped() const;
+  void SetAccentColor(gin_helper::Arguments* args);
+  v8::Local<v8::Value> GetAccentColor() const;
 #endif
 
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX)

shell/browser/api/electron_api_browser_window.cc

@@ -4,6 +4,7 @@
 
 #include "shell/browser/api/electron_api_browser_window.h"
 
+#include "base/containers/fixed_flat_set.h"
 #include "content/browser/renderer_host/render_widget_host_owner_delegate.h"  // nogncheck
 #include "content/browser/web_contents/web_contents_impl.h"  // nogncheck
 #include "content/public/browser/render_process_host.h"
@@ -234,7 +235,7 @@ void BrowserWindow::Blur() {
 
 void BrowserWindow::SetBackgroundColor(const std::string& color_name) {
   BaseWindow::SetBackgroundColor(color_name);
-  SkColor color = ParseCSSColor(color_name);
+  SkColor color = ParseCSSColor(color_name).value_or(SK_ColorWHITE);
   if (api_web_contents_) {
     api_web_contents_->SetBackgroundColor(color);
     // Also update the web preferences object otherwise the view will be reset
@@ -242,11 +243,23 @@ void BrowserWindow::SetBackgroundColor(const std::string& color_name) {
     auto* web_preferences =
         WebContentsPreferences::From(api_web_contents_->web_contents());
     if (web_preferences) {
-      web_preferences->SetBackgroundColor(ParseCSSColor(color_name));
+      web_preferences->SetBackgroundColor(color);
     }
   }
 }
 
+void BrowserWindow::SetBackgroundMaterial(const std::string& material) {
+  BaseWindow::SetBackgroundMaterial(material);
+  static constexpr auto materialTypes =
+      base::MakeFixedFlatSet<std::string_view>({"tabbed", "mica", "acrylic"});
+
+  if (materialTypes.contains(material)) {
+    SetBackgroundColor(ToRGBAHex(SK_ColorTRANSPARENT));
+  } else if (material == "none") {
+    SetBackgroundColor(ToRGBAHex(SK_ColorWHITE));
+  }
+}
+
 void BrowserWindow::FocusOnWebView() {
   web_contents()->GetRenderViewHost()->GetWidget()->Focus();
 }

shell/browser/api/electron_api_browser_window.h

@@ -64,6 +64,7 @@ class BrowserWindow : public BaseWindow,
   void Focus() override;
   void Blur() override;
   void SetBackgroundColor(const std::string& color_name) override;
+  void SetBackgroundMaterial(const std::string& material) override;
   void OnWindowShow() override;
   void OnWindowHide() override;
 

shell/browser/api/electron_api_desktop_capturer.cc

@@ -233,7 +233,8 @@ DesktopCapturer::DesktopListListener::~DesktopListListener() = default;
 
 void DesktopCapturer::DesktopListListener::OnDelegatedSourceListSelection() {
   if (have_thumbnail_) {
-    std::move(update_callback_).Run();
+    content::GetUIThreadTaskRunner({})->PostTask(FROM_HERE,
+                                                 std::move(update_callback_));
   } else {
     have_selection_ = true;
   }
@@ -246,7 +247,8 @@ void DesktopCapturer::DesktopListListener::OnSourceThumbnailChanged(int index) {
     have_selection_ = false;
 
     // PipeWire returns a single source, so index is not relevant.
-    std::move(update_callback_).Run();
+    content::GetUIThreadTaskRunner({})->PostTask(FROM_HERE,
+                                                 std::move(update_callback_));
   } else {
     have_thumbnail_ = true;
   }

shell/browser/api/electron_api_system_preferences.h

@@ -56,7 +56,7 @@ class SystemPreferences final
   const char* GetTypeName() override;
 
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC)
-  std::string GetAccentColor();
+  static std::string GetAccentColor();
   std::string GetColor(gin_helper::ErrorThrower thrower,
                        const std::string& color);
   std::string GetMediaAccessStatus(gin_helper::ErrorThrower thrower,

shell/browser/api/electron_api_system_preferences_win.cc

@@ -5,7 +5,6 @@
 #include <iomanip>
 #include <string_view>
 
-#include <dwmapi.h>
 #include <windows.devices.enumeration.h>
 #include <wrl/client.h>
 
@@ -84,14 +83,12 @@ std::string hexColorDWORDToRGBA(DWORD color) {
 }
 
 std::string SystemPreferences::GetAccentColor() {
-  DWORD color = 0;
-  BOOL opaque = FALSE;
+  std::optional<DWORD> color = GetSystemAccentColor();
 
-  if (FAILED(DwmGetColorizationColor(&color, &opaque))) {
+  if (!color.has_value())
     return "";
-  }
 
-  return hexColorDWORDToRGBA(color);
+  return hexColorDWORDToRGBA(color.value());
 }
 
 std::string SystemPreferences::GetColor(gin_helper::ErrorThrower thrower,

shell/browser/api/electron_api_web_contents.cc

@@ -242,7 +242,7 @@ template <>
 struct Converter<WindowOpenDisposition> {
   static v8::Local<v8::Value> ToV8(v8::Isolate* isolate,
                                    WindowOpenDisposition val) {
-    std::string disposition = "other";
+    std::string_view disposition = "other";
     switch (val) {
       case WindowOpenDisposition::CURRENT_TAB:
         disposition = "default";
@@ -303,7 +303,7 @@ struct Converter<electron::api::WebContents::Type> {
   static v8::Local<v8::Value> ToV8(v8::Isolate* isolate,
                                    electron::api::WebContents::Type val) {
     using Type = electron::api::WebContents::Type;
-    std::string type;
+    std::string_view type;
     switch (val) {
       case Type::kBackgroundPage:
         type = "backgroundPage";
@@ -864,9 +864,10 @@ WebContents::WebContents(v8::Isolate* isolate,
     // webPreferences does not have a transparent option, so if the window needs
     // to be transparent, that will be set at electron_api_browser_window.cc#L57
     // and we then need to pull it back out and check it here.
-    std::string background_color;
-    options.GetHidden(options::kBackgroundColor, &background_color);
-    bool transparent = ParseCSSColor(background_color) == SK_ColorTRANSPARENT;
+    std::string background_color_str;
+    options.GetHidden(options::kBackgroundColor, &background_color_str);
+    SkColor bc = ParseCSSColor(background_color_str).value_or(SK_ColorWHITE);
+    bool transparent = bc == SK_ColorTRANSPARENT;
 
     content::WebContents::CreateParams params(session->browser_context());
     auto* view = new OffScreenWebContentsView(
@@ -2001,26 +2002,26 @@ SkRegion* WebContents::draggable_region() {
 
 void WebContents::DidStartNavigation(
     content::NavigationHandle* navigation_handle) {
+  base::AutoReset<bool> resetter(&is_safe_to_delete_, false);
   EmitNavigationEvent("did-start-navigation", navigation_handle);
 }
 
 void WebContents::DidRedirectNavigation(
     content::NavigationHandle* navigation_handle) {
+  base::AutoReset<bool> resetter(&is_safe_to_delete_, false);
   EmitNavigationEvent("did-redirect-navigation", navigation_handle);
 }
 
 void WebContents::ReadyToCommitNavigation(
     content::NavigationHandle* navigation_handle) {
+  base::AutoReset<bool> resetter(&is_safe_to_delete_, false);
+  EmitNavigationEvent("-ready-to-commit-navigation", navigation_handle);
+
   // Don't focus content in an inactive window.
   if (!owner_window())
     return;
-#if BUILDFLAG(IS_MAC)
   if (!owner_window()->IsActive())
     return;
-#else
-  if (!owner_window()->widget()->IsActive())
-    return;
-#endif
   // Don't focus content after subframe navigations.
   if (!navigation_handle->IsInMainFrame())
     return;
@@ -2358,7 +2359,7 @@ void WebContents::LoadURL(const GURL& url,
   // http://crbug.com/347742.
   auto& ctrl_impl = static_cast<content::NavigationControllerImpl&>(
       web_contents()->GetController());
-  if (ctrl_impl.in_navigate_to_pending_entry()) {
+  if (!is_safe_to_delete_ || ctrl_impl.in_navigate_to_pending_entry()) {
     Emit("did-fail-load", static_cast<int>(net::ERR_FAILED),
          net::ErrorToShortString(net::ERR_FAILED), url.possibly_invalid_spec(),
          true);
@@ -2410,6 +2411,13 @@ void WebContents::DownloadURL(const GURL& url, gin::Arguments* args) {
       content::DownloadRequestUtils::CreateDownloadForWebContentsMainFrame(
           web_contents(), url, MISSING_TRAFFIC_ANNOTATION));
   for (const auto& [name, value] : headers) {
+    if (base::ToLowerASCII(name) ==
+        base::ToLowerASCII(net::HttpRequestHeaders::kReferer)) {
+      // Setting a Referer header with HTTPS scheme while the download URL's
+      // scheme is HTTP might lead to download failure.
+      download_params->set_referrer(GURL(value));
+      continue;
+    }
     download_params->add_request_header(name, value);
   }
 
@@ -2752,15 +2760,17 @@ void WebContents::CloseDevTools() {
   if (type_ == Type::kRemote)
     return;
 
-  DCHECK(inspectable_web_contents_);
-  inspectable_web_contents_->CloseDevTools();
+  if (inspectable_web_contents_)
+    inspectable_web_contents_->CloseDevTools();
 }
 
 bool WebContents::IsDevToolsOpened() {
   if (type_ == Type::kRemote)
     return false;
 
-  DCHECK(inspectable_web_contents_);
+  if (!inspectable_web_contents_)
+    return false;
+
   return inspectable_web_contents_->IsDevToolsViewShowing();
 }
 
@@ -2768,19 +2778,24 @@ std::u16string WebContents::GetDevToolsTitle() {
   if (type_ == Type::kRemote)
     return {};
 
-  DCHECK(inspectable_web_contents_);
+  if (!inspectable_web_contents_)
+    return {};
+
   return inspectable_web_contents_->GetDevToolsTitle();
 }
 
 void WebContents::SetDevToolsTitle(const std::u16string& title) {
-  inspectable_web_contents_->SetDevToolsTitle(title);
+  if (inspectable_web_contents_)
+    inspectable_web_contents_->SetDevToolsTitle(title);
 }
 
 bool WebContents::IsDevToolsFocused() {
   if (type_ == Type::kRemote)
     return false;
 
-  DCHECK(inspectable_web_contents_);
+  if (!inspectable_web_contents_)
+    return false;
+
   return inspectable_web_contents_->GetView()->IsDevToolsViewFocused();
 }
 
@@ -2828,10 +2843,9 @@ void WebContents::InspectElement(int x, int y) {
   if (type_ == Type::kRemote)
     return;
 
-  if (!enable_devtools_)
+  if (!enable_devtools_ || !inspectable_web_contents_)
     return;
 
-  DCHECK(inspectable_web_contents_);
   if (!inspectable_web_contents_->GetDevToolsWebContents())
     OpenDevTools(nullptr);
   inspectable_web_contents_->InspectElement(x, y);

shell/browser/api/electron_api_web_contents.h

@@ -856,6 +856,9 @@ class WebContents final : public ExclusiveAccessContext,
   const scoped_refptr<base::TaskRunner> print_task_runner_;
 #endif
 
+  // Track navigation state in order to avoid potential re-entrancy crashes.
+  bool is_safe_to_delete_ = true;
+
   // Stores the frame that's currently in fullscreen, nullptr if there is none.
   raw_ptr<content::RenderFrameHost> fullscreen_frame_ = nullptr;