ci: use <sup> in release notes generator (#48698)

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Erick Zhao <erick@hotmail.ca>

.github/actions/build-electron/action.yml

@@ -44,14 +44,6 @@ runs:
     - name: Add Clang problem matcher
       shell: bash
       run: echo "::add-matcher::src/electron/.github/problem-matchers/clang.json"
-    - name: Setup Siso for fork pull requests
-      if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
-      shell: bash
-      run: |
-        # Use Local Execution, Remote Caching (LERC). Checks the remote cache for action
-        # matches and uses existing results if a match is found. If not, execution of the
-        # action is performed locally.
-        echo "RBE_exec_strategy=local" >> $GITHUB_ENV
     - name: Build Electron ${{ inputs.step-suffix }}
       shell: bash
       run: |
@@ -68,14 +60,24 @@ runs:
           sudo launchctl limit maxfiles 65536 200000
         fi
 
-        NINJA_SUMMARIZE_BUILD=1 e build
+        if [ "${{ inputs.is-release }}" = "true" ]; then
+          NINJA_SUMMARIZE_BUILD=1 e build --target electron:release_build
+        else
+          NINJA_SUMMARIZE_BUILD=1 e build --target electron:testing_build
+        fi
         cp out/Default/.ninja_log out/electron_ninja_log
         node electron/script/check-symlinks.js
-    - name: Build Electron dist.zip ${{ inputs.step-suffix }}
+
+        # Upload build stats to Datadog
+        if ! [ -z $DD_API_KEY ]; then
+          npx node electron/script/build-stats.mjs out/Default/siso.INFO --upload-stats || true
+        else
+          echo "Skipping build-stats.mjs upload because DD_API_KEY is not set"
+        fi
+    - name: Verify dist.zip ${{ inputs.step-suffix }}
       shell: bash
       run: |
-        cd src
-        e build --target electron:electron_dist_zip
+        cd src        
         if [ "${{ inputs.is-asan }}" != "true" ]; then
           target_os=${{ inputs.target-platform == 'macos' && 'mac' || inputs.target-platform }}
           if [ "${{ inputs.artifact-platform }}" = "mas" ]; then
@@ -83,11 +85,10 @@ runs:
           fi
           electron/script/zip_manifests/check-zip-manifest.py out/Default/dist.zip electron/script/zip_manifests/dist_zip.$target_os.${{ inputs.target-arch }}.manifest
         fi
-    - name: Build Mksnapshot ${{ inputs.step-suffix }}
+    - name: Fixup Mksnapshot ${{ inputs.step-suffix }}
       shell: bash
       run: |
         cd src
-        e build --target electron:electron_mksnapshot
         ELECTRON_DEPOT_TOOLS_DISABLE_LOG=1 e d gn desc out/Default v8:run_mksnapshot_default args > out/Default/mksnapshot_args
         # Remove unused args from mksnapshot_args
         SEDOPTION="-i"
@@ -97,7 +98,6 @@ runs:
         sed $SEDOPTION '/.*builtins-pgo/d' out/Default/mksnapshot_args
         sed $SEDOPTION '/--turbo-profiling-input/d' out/Default/mksnapshot_args
 
-        e build --target electron:electron_mksnapshot_zip
         if [ "${{ inputs.target-platform }}" = "win" ]; then
           cd out/Default
           powershell Compress-Archive -update mksnapshot_args mksnapshot.zip
@@ -131,13 +131,7 @@ runs:
       shell: bash
       run: |
         cd src
-        e build --target electron:electron_chromedriver
         e build --target electron:electron_chromedriver_zip
-    - name: Build Node.js headers ${{ inputs.step-suffix }}
-      shell: bash
-      run: |
-        cd src
-        e build --target electron:node_headers
     - name: Create installed_software.json ${{ inputs.step-suffix }}
       shell: powershell
       if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'win' }}
@@ -157,17 +151,11 @@ runs:
         # Needed for msdia140.dll on 64-bit windows
         cd src
         export PATH="$PATH:$(pwd)/third_party/llvm-build/Release+Asserts/bin"
-    - name: Generate & Zip Symbols ${{ inputs.step-suffix }}
+    - name: Zip Symbols ${{ inputs.step-suffix }}
       shell: bash
       run: |
-        # Generate breakpad symbols on release builds
-        if [ "${{ inputs.generate-symbols }}" = "true" ]; then
-          e build --target electron:electron_symbols
-        fi
         cd src
         export BUILD_PATH="$(pwd)/out/Default"
-        e build --target electron:licenses
-        e build --target electron:electron_version_file
         if [ "${{ inputs.is-release }}" = "true" ]; then
           DELETE_DSYMS_AFTER_ZIP=1 electron/script/zip-symbols.py -b $BUILD_PATH
         else
@@ -180,18 +168,6 @@ runs:
         cd src
         gn gen out/ffmpeg --args="import(\"//electron/build/args/ffmpeg.gn\") use_remoteexec=true use_siso=true $GN_EXTRA_ARGS"
         e build --target electron:electron_ffmpeg_zip -C ../../out/ffmpeg
-    - name: Generate Hunspell Dictionaries ${{ inputs.step-suffix }}
-      shell: bash
-      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'linux' }}
-      run: |
-        e build --target electron:hunspell_dictionaries_zip
-    - name: Generate Libcxx ${{ inputs.step-suffix }}
-      shell: bash
-      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'linux' }}
-      run: |
-        e build --target electron:libcxx_headers_zip
-        e build --target electron:libcxxabi_headers_zip
-        e build --target electron:libcxx_objects_zip
     - name: Remove Clang problem matcher
       shell: bash
       run: echo "::remove-matcher owner=clang::"

.github/actions/fix-sync/action.yml

@@ -109,7 +109,7 @@ runs:
         deps-file: src/DEPS
         installation-dir: src/third_party/siso/cipd
         target-platform: ${{ inputs.target-platform }}
-        package: infra/build/siso/${platform}
+        package: build/siso/${platform}
     - name: Fixup angle git
       if: ${{ inputs.target-platform != 'linux' }}
       shell: bash

.github/actions/install-build-tools/action.yml

@@ -15,7 +15,7 @@ runs:
         git config --global core.preloadindex true
         git config --global core.longpaths true
       fi
-      export BUILD_TOOLS_SHA=8559e5d325d61f195a255f41077ffc9e5b70b0e5
+      export BUILD_TOOLS_SHA=706147b2376f55078f718576b28129a0457f1795
       npm i -g @electron/build-tools
       # Update depot_tools to ensure python
       e d update_depot_tools

.github/workflows/pipeline-segment-electron-build.yml

@@ -66,6 +66,7 @@ concurrency:
 env:
   CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
   CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
+  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   ELECTRON_ARTIFACTS_BLOB_STORAGE: ${{ secrets.ELECTRON_ARTIFACTS_BLOB_STORAGE }}
   ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
   SUDOWOODO_EXCHANGE_URL: ${{ secrets.SUDOWOODO_EXCHANGE_URL }}
@@ -84,6 +85,7 @@ jobs:
     environment: ${{ inputs.environment }}
     env:
       TARGET_ARCH: ${{ inputs.target-arch }}
+      TARGET_PLATFORM: ${{ inputs.target-platform }}
     steps:
     - name: Create src dir
       run: |

.github/workflows/pipeline-segment-electron-test.yml

@@ -164,22 +164,18 @@ jobs:
         path: ./src_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
     - name: Restore Generated Artifacts
       run: ./src/electron/script/actions/restore-artifacts.sh
-    - name: Unzip Dist, Mksnapshot & Chromedriver (win)
+    - name: Unzip Dist (win)
       if: ${{ inputs.target-platform == 'win' }}
       shell: powershell
       run: |
         Set-ExecutionPolicy Bypass -Scope Process -Force
         cd src/out/Default
         Expand-Archive -Force dist.zip -DestinationPath ./
-        Expand-Archive -Force chromedriver.zip -DestinationPath ./
-        Expand-Archive -Force mksnapshot.zip -DestinationPath ./
-    - name: Unzip Dist, Mksnapshot & Chromedriver (unix)
+    - name: Unzip Dist (unix)
       if: ${{ inputs.target-platform != 'win' }}
       run: |
         cd src/out/Default
         unzip -:o dist.zip
-        unzip -:o chromedriver.zip
-        unzip -:o mksnapshot.zip
     - name: Import & Trust Self-Signed Codesigning Cert on MacOS
       if: ${{ inputs.target-platform == 'macos' && inputs.target-arch == 'x64' }}
       run: |
@@ -215,7 +211,7 @@ jobs:
               export ELECTRON_FORCE_TEST_SUITE_EXIT="true"
             fi
           fi
-          node script/yarn test --runners=main --trace-uncaught --enable-logging --files $tests_files
+          node script/yarn test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
         else
           chown :builduser .. && chmod g+w ..
           chown -R :builduser . && chmod -R g+w .

.github/workflows/pull-request-labeled.yml

@@ -19,7 +19,10 @@ jobs:
           webhook-type: webhook-trigger
           payload: |
             {
-              "url": "${{ github.event.pull_request.html_url }}"
+              "base_ref": ${{ toJSON(github.event.pull_request.base.ref) }},
+              "title": ${{ toJSON(github.event.pull_request.title) }},
+              "url": ${{ toJSON(github.event.pull_request.html_url) }},
+              "user": ${{ toJSON(github.event.pull_request.user.login) }}
             }
   pull-request-labeled-deprecation-review-complete:
     name: deprecation-review/complete label added

BUILD.gn

@@ -655,6 +655,7 @@ source_set("electron_lib") {
       "//ui/events/devices/x11",
       "//ui/events/platform/x11",
       "//ui/gtk:gtk_config",
+      "//ui/linux:display_server_utils",
       "//ui/linux:linux_ui",
       "//ui/linux:linux_ui_factory",
       "//ui/wm",
@@ -1615,6 +1616,29 @@ group("node_headers") {
   public_deps = [ ":tar_node_headers" ]
 }
 
+group("testing_build") {
+  public_deps = [
+    ":electron_dist_zip",
+    ":electron_mksnapshot_zip",
+    ":node_headers",
+  ]
+}
+
+group("release_build") {
+  public_deps = [ ":testing_build" ]
+  if (is_official_build) {
+    public_deps += [ ":electron_symbols" ]
+  }
+  if (is_linux) {
+    public_deps += [
+      ":hunspell_dictionaries_zip",
+      ":libcxx_headers_zip",
+      ":libcxx_objects_zip",
+      ":libcxxabi_headers_zip",
+    ]
+  }
+}
+
 if (is_linux && is_official_build) {
   strip_binary("strip_electron_binary") {
     binary_input = "$root_out_dir/$electron_project_name"

DEPS

@@ -2,9 +2,9 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '140.0.7339.133',
+    '140.0.7339.249',
   'node_version':
-    'v22.19.0',
+    'v22.20.0',
   'nan_version':
     'e14bdcd1f72d62bca1d541b66da43130384ec213',
   'squirrel.mac_version':

README.md

@@ -39,7 +39,7 @@ Each Electron release provides binaries for macOS, Windows, and Linux.
 
 * macOS (Big Sur and up): Electron provides 64-bit Intel and Apple Silicon / ARM binaries for macOS.
 * Windows (Windows 10 and up): Electron provides `ia32` (`x86`), `x64` (`amd64`), and `arm64` binaries for Windows. Windows on ARM support was added in Electron 5.0.8. Support for Windows 7, 8 and 8.1 was [removed in Electron 23, in line with Chromium's Windows deprecation policy](https://www.electronjs.org/blog/windows-7-to-8-1-deprecation-notice).
-* Linux: The prebuilt binaries of Electron are built on Ubuntu 20.04. They have also been verified to work on:
+* Linux: The prebuilt binaries of Electron are built on Ubuntu 22.04. They have also been verified to work on:
   * Ubuntu 18.04 and newer
   * Fedora 32 and newer
   * Debian 10 and newer

build/args/all.gn

@@ -24,10 +24,6 @@ enable_printing = true
 angle_enable_vulkan_validation_layers = false
 dawn_enable_vulkan_validation_layers = false
 
-# Removes dxc dll's that are only used experimentally.
-# See https://bugs.chromium.org/p/chromium/issues/detail?id=1474897
-dawn_use_built_dxc = false
-
 # These are disabled because they cause the zip manifest to differ between
 # testing and release builds.
 # See https://chromium-review.googlesource.com/c/chromium/src/+/2774898.
@@ -72,3 +68,6 @@ enterprise_cloud_content_analysis = false
 
 # We don't use anything from here, and it causes target collisions
 enable_linux_installer = false
+
+# Disable "Save to Drive" feature in PDF viewer
+enable_pdf_save_to_drive = false

docs/api/app.md

@@ -1397,7 +1397,75 @@ details. Disabled by default.
 This API must be called after the `ready` event is emitted.
 
 > [!NOTE]
-> Rendering accessibility tree can significantly affect the performance of your app. It should not be enabled by default.
+> Rendering accessibility tree can significantly affect the performance of your app. It should not be enabled by default. Calling this method will enable the following accessibility support features: `nativeAPIs`, `webContents`, `inlineTextBoxes`, and `extendedProperties`.
+
+### `app.getAccessibilitySupportFeatures()` _macOS_ _Windows_
+
+Returns `string[]` - Array of strings naming currently enabled accessibility support components. Possible values:
+
+* `nativeAPIs` - Native OS accessibility APIs integration enabled.
+* `webContents` - Web contents accessibility tree exposure enabled.
+* `inlineTextBoxes` - Inline text boxes (character bounding boxes) enabled.
+* `extendedProperties` - Extended accessibility properties enabled.
+* `screenReader` - Screen reader specific mode enabled.
+* `html` - HTML accessibility tree construction enabled.
+* `labelImages` - Accessibility support for automatic image annotations.
+* `pdfPrinting` - Accessibility support for PDF printing enabled.
+
+Notes:
+
+* The array may be empty if no accessibility modes are active.
+* Use `app.isAccessibilitySupportEnabled()` for the legacy boolean check;
+  prefer this method for granular diagnostics or telemetry.
+
+Example:
+
+```js
+const { app } = require('electron')
+
+app.whenReady().then(() => {
+  if (app.getAccessibilitySupportFeatures().includes('screenReader')) {
+    // Change some app UI to better work with Screen Readers.
+  }
+})
+```
+
+### `app.setAccessibilitySupportFeatures(features)` _macOS_ _Windows_
+
+* `features` string[] - An array of the accessibility features to enable.
+
+Possible values are:
+
+* `nativeAPIs` - Native OS accessibility APIs integration enabled.
+* `webContents` - Web contents accessibility tree exposure enabled.
+* `inlineTextBoxes` - Inline text boxes (character bounding boxes) enabled.
+* `extendedProperties` - Extended accessibility properties enabled.
+* `screenReader` - Screen reader specific mode enabled.
+* `html` - HTML accessibility tree construction enabled.
+* `labelImages` - Accessibility support for automatic image annotations.
+* `pdfPrinting` - Accessibility support for PDF printing enabled.
+
+To disable all supported features, pass an empty array `[]`.
+
+Example:
+
+```js
+const { app } = require('electron')
+
+app.whenReady().then(() => {
+  // Enable a subset of features:
+  app.setAccessibilitySupportFeatures([
+    'screenReader',
+    'pdfPrinting',
+    'webContents'
+  ])
+
+  // Other logic
+
+  // Some time later, disable all features:
+  app.setAccessibilitySupportFeatures([])
+})
+```
 
 ### `app.showAboutPanel()`
 

docs/api/browser-window.md

@@ -1570,11 +1570,18 @@ events.
 
 Prevents the window contents from being captured by other apps.
 
-On macOS it sets the NSWindow's [`sharingType`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.property?language=objc) to [`NSWindowSharingNone`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.enum/none?language=objc).
-On Windows it calls [`SetWindowDisplayAffinity`](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowdisplayaffinity) with `WDA_EXCLUDEFROMCAPTURE`.
+On Windows, it calls [`SetWindowDisplayAffinity`](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowdisplayaffinity) with `WDA_EXCLUDEFROMCAPTURE`.
 For Windows 10 version 2004 and up the window will be removed from capture entirely,
 older Windows versions behave as if `WDA_MONITOR` is applied capturing a black window.
 
+On macOS, it sets the `NSWindow`'s
+[`sharingType`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.property?language=objc)
+to
+[`NSWindowSharingNone`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.enum/none?language=objc).
+Unfortunately, due to an intentional change in macOS, newer Mac applications that use
+`ScreenCaptureKit` will capture your window despite `win.setContentProtection(true)`.
+See [here](https://github.com/electron/electron/issues/48258#issuecomment-3269893618).
+
 #### `win.isContentProtected()` _macOS_ _Windows_
 
 Returns `boolean` - whether or not content protection is currently enabled.

docs/api/clipboard.md

@@ -4,6 +4,12 @@
 
 Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process) (non-sandboxed only)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 On Linux, there is also a `selection` clipboard. To manipulate it
 you need to pass `selection` to each method:
 

docs/api/crash-reporter.md

@@ -4,6 +4,12 @@
 
 Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 The following is an example of setting up Electron to automatically submit
 crash reports to a remote server:
 

docs/api/environment-variables.md

@@ -186,14 +186,3 @@ the one downloaded by `npm install`. Usage:
 ```sh
 export ELECTRON_OVERRIDE_DIST_PATH=/Users/username/projects/electron/out/Testing
 ```
-
-## Set By Electron
-
-Electron sets some variables in your environment at runtime.
-
-### `ORIGINAL_XDG_CURRENT_DESKTOP`
-
-This variable is set to the value of `XDG_CURRENT_DESKTOP` that your application
-originally launched with.  Electron sometimes modifies the value of `XDG_CURRENT_DESKTOP`
-to affect other logic within Chromium so if you want access to the _original_ value
-you should look up this environment variable instead.

docs/api/ipc-renderer.md

@@ -20,6 +20,12 @@ changes:
 
 Process: [Renderer](../glossary.md#renderer-process)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 The `ipcRenderer` module is an  [EventEmitter][event-emitter]. It provides a few
 methods so you can send synchronous and asynchronous messages from the render
 process (web page) to the main process. You can also receive replies from the

docs/api/native-image.md

@@ -4,6 +4,12 @@
 
 Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 The `nativeImage` module provides a unified interface for manipulating
 system images. These can be handy if you want to provide multiple scaled
 versions of the same icon or take advantage of macOS [template images][template-image].

docs/api/session.md

@@ -939,14 +939,18 @@ session.fromPartition('some-partition').setPermissionRequestHandler((webContents
     * `top-level-storage-access` -  Allow top-level sites to request third-party cookie access on behalf of embedded content originating from another site in the same related website set using the [Storage Access API](https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API).
     * `usb` - Expose non-standard Universal Serial Bus (USB) compatible devices services to the web with the [WebUSB API](https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API).
     * `deprecated-sync-clipboard-read` _Deprecated_ - Request access to run `document.execCommand("paste")`
+    * `fileSystem` - Access to read, write, and file management capabilities using the [File System API](https://developer.mozilla.org/en-US/docs/Web/API/File_System_API).
   * `requestingOrigin` string - The origin URL of the permission check
   * `details` Object - Some properties are only available on certain permission types.
     * `embeddingOrigin` string (optional) - The origin of the frame embedding the frame that made the permission check.  Only set for cross-origin sub frames making permission checks.
     * `securityOrigin` string (optional) - The security origin of the `media` check.
     * `mediaType` string (optional) - The type of media access being requested, can be `video`,
-      `audio` or `unknown`
+      `audio` or `unknown`.
     * `requestingUrl` string (optional) - The last URL the requesting frame loaded.  This is not provided for cross-origin sub frames making permission checks.
-    * `isMainFrame` boolean - Whether the frame making the request is the main frame
+    * `isMainFrame` boolean - Whether the frame making the request is the main frame.
+    * `filePath` string (optional) - The path of a `fileSystem` request.
+    * `isDirectory` boolean (optional) - Whether a `fileSystem` request is a directory.
+    * `fileAccessType` string (optional) - The access type of a `fileSystem` request. Can be `writable` or `readable`.
 
 Sets the handler which can be used to respond to permission checks for the `session`.
 Returning `true` will allow the permission and `false` will reject it.  Please note that
@@ -968,6 +972,9 @@ session.fromPartition('some-partition').setPermissionCheckHandler((webContents,
 })
 ```
 
+> [!NOTE]
+> `isMainFrame` will always be `false` for a `fileSystem` request as a result of Chromium limitations.
+
 #### `ses.setDisplayMediaRequestHandler(handler[, opts])`
 
 * `handler` Function | null

docs/api/structures/base-window-options.md

@@ -102,9 +102,10 @@
   should have rounded corners. Default is `true`. Setting this property
   to `false` will prevent the window from being fullscreenable on macOS.
   On Windows versions older than Windows 11 Build 22000 this property has no effect, and frameless windows will not have rounded corners.
-* `thickFrame` boolean (optional) - Use `WS_THICKFRAME` style for frameless windows on
-  Windows, which adds standard window frame. Setting it to `false` will remove
-  window shadow and window animations. Default is `true`.
+* `thickFrame` boolean (optional) _Windows_ - Use `WS_THICKFRAME` style for
+  frameless windows on Windows, which adds the standard window frame. Setting it
+  to `false` will remove window shadow and window animations, and disable window
+  resizing via dragging the window edges. Default is `true`.
 * `vibrancy` string (optional) _macOS_ - Add a type of vibrancy effect to
   the window, only on macOS. Can be `appearance-based`, `titlebar`, `selection`,
   `menu`, `popover`, `sidebar`, `header`, `sheet`, `window`, `hud`, `fullscreen-ui`,

docs/api/structures/web-preferences.md

@@ -21,7 +21,9 @@
   associated with the window, making it compatible with the Chromium
   OS-level sandbox and disabling the Node.js engine. This is not the same as
   the `nodeIntegration` option and the APIs available to the preload script
-  are more limited. Read more about the option [here](../../tutorial/sandbox.md).
+  are more limited. Default is `true` since Electron 20. The sandbox will
+  automatically be disabled when `nodeIntegration` is set to `true`.
+  Read more about the option [here](../../tutorial/sandbox.md).
 * `session` [Session](../session.md#class-session) (optional) - Sets the session used by the
   page. Instead of passing the Session object directly, you can also choose to
   use the `partition` option instead, which accepts a partition string. When

docs/api/web-frame.md

@@ -4,6 +4,12 @@
 
 Process: [Renderer](../glossary.md#renderer-process)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 `webFrame` export of the Electron module is an instance of the `WebFrame`
 class representing the current frame. Sub-frames can be retrieved by
 certain properties and methods (e.g. `webFrame.firstChild`).
@@ -139,7 +145,7 @@ by its key, which is returned from `webFrame.insertCSS(css)`.
 
 Inserts `text` to the focused element.
 
-### `webFrame.executeJavaScript(code[, userGesture, callback])`
+### `webFrame.executeJavaScript(code[, userGesture][, callback])`
 
 * `code` string
 * `userGesture` boolean (optional) - Default is `false`.
@@ -160,7 +166,7 @@ In the browser window some HTML APIs like `requestFullScreen` can only be
 invoked by a gesture from the user. Setting `userGesture` to `true` will remove
 this limitation.
 
-### `webFrame.executeJavaScriptInIsolatedWorld(worldId, scripts[, userGesture, callback])`
+### `webFrame.executeJavaScriptInIsolatedWorld(worldId, scripts[, userGesture][, callback])`
 
 * `worldId` Integer - The ID of the world to run the javascript
             in, `0` is the default main world (where content runs), `999` is the

docs/api/web-utils.md

@@ -4,6 +4,12 @@
 
 Process: [Renderer](../glossary.md#renderer-process)
 
+> [!IMPORTANT]
+> If you want to call this API from a renderer process with context isolation enabled,
+> place the API call in your preload script and
+> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
+> [`contextBridge`](context-bridge.md) API.
+
 ## Methods
 
 The `webUtils` module has the following methods:
@@ -17,11 +23,27 @@ Returns `string` - The file system path that this `File` object points to. In th
 This method superseded the previous augmentation to the `File` object with the `path` property.  An example is included below.
 
 ```js @ts-nocheck
-// Before
-const oldPath = document.querySelector('input').files[0].path
-
-// After
-const { webUtils } = require('electron')
-
-const newPath = webUtils.getPathForFile(document.querySelector('input').files[0])
+// Before (renderer)
+const oldPath = document.querySelector('input[type=file]').files[0].path
+```
+
+```js @ts-nocheck
+// After
+
+// Renderer:
+
+const file = document.querySelector('input[type=file]').files[0]
+electronApi.doSomethingWithFile(file)
+
+// Preload script:
+
+const { contextBridge, webUtils } = require('electron')
+
+contextBridge.exposeInMainWorld('electronApi', {
+  doSomethingWithFile (file) {
+    const path = webUtils.getPathForFile(file)
+    // Do something with the path, e.g., send it over IPC to the main process.
+    // It's best not to expose the full file path to the web content if possible.
+  }
+})
 ```

docs/api/window-open.md

@@ -39,8 +39,8 @@ consider using `webContents.setWindowOpenHandler` to customize the
 BrowserWindow creation.
 
 A subset of [`WebPreferences`](structures/web-preferences.md) can be set directly,
-unnested, from the features string: `zoomFactor`, `nodeIntegration`, `preload`,
-`javascript`, `contextIsolation`, and `webviewTag`.
+unnested, from the features string: `zoomFactor`, `nodeIntegration`, `javascript`,
+`contextIsolation`, and `webviewTag`.
 
 For example:
 

docs/breaking-changes.md

@@ -16,9 +16,15 @@ This document uses the following convention to categorize breaking changes:
 
 ### Removed: `ELECTRON_OZONE_PLATFORM_HINT` environment variable
 
-The default value of the `--ozone-plaftform` flag [changed to `auto`](https://chromium-review.googlesource.com/c/chromium/src/+/6775426).
+The default value of the `--ozone-platform` flag [changed to `auto`](https://chromium-review.googlesource.com/c/chromium/src/+/6775426).
 
-You should use the `XDG_SESSION_TYPE=wayland` environment variable instead to use Wayland.
+Electron now defaults to running as a native Wayland app when launched in a Wayland session (when `XDG_SESSION_TYPE=wayland`).
+Users can force XWayland by passing `--ozone-platform=x11`.
+
+### Removed: `ORIGINAL_XDG_CURRENT_DESKTOP` environment variable
+
+Previously, Electron changed the value of `XDG_CURRENT_DESKTOP` internally to `Unity`, and stored the original name of the desktop session
+in a separate variable. `XDG_CURRENT_DESKTOP` is no longer overriden and now reflects the actual desktop environment.
 
 ### Removed: macOS 11 support
 

docs/faq.md

@@ -12,19 +12,28 @@ network problems. The best resolution is to try switching networks, or
 wait a bit and try installing again.
 
 You can also attempt to download Electron directly from
-[electron/electron/releases](https://github.com/electron/electron/releases)
+[GitHub Releases](https://github.com/electron/electron/releases)
 if installing via `npm` is failing.
 
-## When will Electron upgrade to latest Chrome?
+If you need to install Electron through a custom mirror or proxy, see
+the [Advanced Installation](./tutorial/installation.md) documentation for more details.
 
-The Chrome version of Electron is usually bumped within one or two weeks after
-a new stable Chrome version gets released. This estimate is not guaranteed and
-depends on the amount of work involved with upgrading.
+## How are Electron binaries downloaded?
 
-Only the stable channel of Chrome is used. If an important fix is in beta or dev
-channel, we will back-port it.
+When you run `npm install electron`, the Electron binary for the corresponding version is downloaded
+into your project's `node_modules` folder via npm's `postinstall` lifecycle script.
 
-For more information, please see the [security introduction](tutorial/security.md).
+This logic is handled by the [`@electron/get`](https://github.com/electron/get) utility package
+under the hood.
+
+## When will Electron upgrade to latest Chromium?
+
+Every new major version of Electron releases with a Chromium major version upgrade. By releasing every
+8 weeks, Electron is able to pull in every other major Chromium release on the very same day that it
+releases upstream. Security fixes will be backported to stable release channels ahead of time.
+
+See the [Electron Releases](./tutorial/electron-timelines.md) documentation for more details or
+[releases.electronjs.org](https://releases.electronjs.org) to see our Release Status dashboard.
 
 ## When will Electron upgrade to latest Node.js?
 

docs/tutorial/asar-integrity.md

@@ -64,13 +64,10 @@ flipFuses(
 )
 ```
 
-:::tip Fuses in Electron Forge
-
-With Electron Forge, you can configure your app's fuses with
-[@electron-forge/plugin-fuses](https://www.electronforge.io/config/plugins/fuses)
-in your Forge configuration file.
-
-:::
+> [!TIP]
+> With Electron Forge, you can configure your app's fuses with
+> [@electron-forge/plugin-fuses](https://www.electronforge.io/config/plugins/fuses)
+> in your Forge configuration file.
 
 ## Providing the header hash
 
@@ -109,7 +106,7 @@ Valid `algorithm` values are currently `SHA256` only. The `hash` is a hash of th
 The `@electron/asar` package exposes a `getRawHeader` method whose result can then be hashed to generate this value
 (e.g. using the [`node:crypto`](https://nodejs.org/api/crypto.html) module).
 
-### Windows
+#### Windows
 
 When packaging for Windows, you must populate a valid [resource](https://learn.microsoft.com/en-us/windows/win32/menurc/resources)
 entry of type `Integrity` and name `ElectronAsar`. The value of this resource should be a JSON encoded dictionary
@@ -125,9 +122,6 @@ in the form included below:
 ]
 ```
 
-:::info
-
-For an implementation example, see [`src/resedit.ts`](https://github.com/electron/packager/blob/main/src/resedit.ts)
-in the Electron Packager code.
-
-:::
+> [!NOTE]
+> For an implementation example, see [`src/resedit.ts`](https://github.com/electron/packager/blob/main/src/resedit.ts)
+> in the Electron Packager code.

docs/tutorial/code-signing.md

@@ -233,10 +233,10 @@ can find [its documentation here](https://www.electron.build/code-signing).
 [Azure Trusted Signing][] is Microsoft's modern cloud-based alternative to EV certificates.
 It is the cheapest option for code signing on Windows, and it gets rid of SmartScreen warnings.
 
-As of May 2025, Azure Trusted Signing is [available][trusted-signing-availability] to US and
-Canada-based organizations with 3+ years of verifiable business history. Microsoft is looking
-to make the program more widely available. If you're reading this at a later point, it could
-make sense to check if the eligibility criteria have changed.
+As of October 2025, Azure Trusted Signing is available to US and Canada-based organizations
+with 3+ years of verifiable business history and to individual developers in the US and Canada.
+Microsoft is looking to make the program more widely available. If you're reading this at a
+later point, it could make sense to check if the eligibility criteria have changed.
 
 #### Using Electron Forge
 
@@ -267,6 +267,5 @@ See the [Windows Store Guide][].
 [maker-squirrel]: https://www.electronforge.io/config/makers/squirrel.windows
 [maker-msi]: https://www.electronforge.io/config/makers/wix-msi
 [azure trusted signing]: https://azure.microsoft.com/en-us/products/trusted-signing
-[trusted-signing-availability]: https://techcommunity.microsoft.com/blog/microsoft-security-blog/trusted-signing-public-preview-update/4399713
 [forge-trusted-signing]: https://www.electronforge.io/guides/code-signing/code-signing-windows#using-azure-trusted-signing
 [builder-trusted-signing]: https://www.electron.build/code-signing-win#using-azure-trusted-signing-beta

docs/tutorial/esm.md

@@ -32,7 +32,7 @@ This table gives a general overview of where ESM is supported and which ESM load
 | Main                 | Node.js    | N/A                   | <ul><li> [You must use `await` generously before the app's `ready` event](#you-must-use-await-generously-before-the-apps-ready-event) </li></ul> |
 | Renderer (Sandboxed) | Chromium   | Unsupported           | <ul><li> [Sandboxed preload scripts can't use ESM imports](#sandboxed-preload-scripts-cant-use-esm-imports) </li></ul> |
 | Renderer (Unsandboxed & Context Isolated) | Chromium | Node.js | <ul><li> [Unsandboxed ESM preload scripts will run after page load on pages with no content](#unsandboxed-esm-preload-scripts-will-run-after-page-load-on-pages-with-no-content) </li> <li>[ESM Preload Scripts must have the `.mjs` extension](#esm-preload-scripts-must-have-the-mjs-extension)</li></ul> |
-| Renderer (Unsandboxed & Non Context Isolated) | Chromium | Node.js | <ul><li>[Unsandboxed ESM preload scripts will run after page load on pages with no content](#unsandboxed-esm-preload-scripts-will-run-after-page-load-on-pages-with-no-content)</li><li>[ESM Preload Scripts must have the `.mjs` extension](#esm-preload-scripts-must-have-the-mjs-extension)</li><li>[ESM preload scripts must be context isolated to use dynamic Node.js ESM imports](#esm-preload-scripts-must-be-context-isolated-to-use-dynamic-nodejs-esm-imports)</li></ul> |
+| Renderer (Unsandboxed & Non Context Isolated) | Chromium | Node.js | <ul><li>[Unsandboxed ESM preload scripts will run after page load on pages with no content](#unsandboxed-esm-preload-scripts-will-run-after-page-load-on-pages-with-no-content)</li><li>[ESM Preload Scripts must have the `.mjs` extension](#esm-preload-scripts-must-have-the-mjs-extension)</li></ul> |
 
 ## Main process
 

docs/tutorial/installation.md

@@ -26,12 +26,12 @@ any dependencies in your app will not be installed.
 
 ## Customization
 
-If you want to change the architecture that is downloaded (e.g., `ia32` on an
-`x64` machine), you can use the `--arch` flag with npm install or set the
+If you want to change the architecture that is downloaded (e.g., `x64` on an
+`arm64` machine), you can use the `--arch` flag with npm install or set the
 `npm_config_arch` environment variable:
 
 ```shell
-npm install --arch=ia32 electron
+npm install --arch=x64 electron
 ```
 
 In addition to changing the architecture, you can also specify the platform
@@ -60,7 +60,7 @@ where `$VERSION` is the exact version of Electron).
 If you are unable to access GitHub or you need to provide a custom build, you
 can do so by either providing a mirror or an existing cache directory.
 
-#### Mirror
+### Mirror
 
 You can use environment variables to override the base URL, the path at which to
 look for Electron binaries, and the binary filename. The URL used by `@electron/get`
@@ -95,7 +95,7 @@ Electron release you may have to set `electron_use_remote_checksums=1` directly,
 or configure it in a `.npmrc` file, to force Electron to use the remote `SHASUMS256.txt`
 file to verify the checksum instead of the embedded checksums.
 
-#### Cache
+### Cache
 
 Alternatively, you can override the local cache. `@electron/get` will cache
 downloaded binaries in a local directory to not stress your network. You can use
@@ -120,7 +120,7 @@ The cache contains the version's official zip file as well as a checksum, and is
 │   └── electron-v15.3.1-darwin-x64.zip
 ```
 
-## Skip binary download
+## Postinstall script
 
 Under the hood, Electron's JavaScript API binds to a binary that contains its
 implementations. Because this binary is crucial to the function of any Electron app,

docs/tutorial/online-offline-events.md

@@ -2,15 +2,15 @@
 
 ## Overview
 
-[Online and offline event](https://developer.mozilla.org/en-US/docs/Online_and_offline_events)
-detection can be implemented in the Renderer process using the
-[`navigator.onLine`](http://html5index.org/Offline%20-%20NavigatorOnLine.html)
-attribute, part of standard HTML5 API.
+Online and offline event detection can be implemented in both the main and renderer processes:
+
+- **Renderer process**: Use the [`navigator.onLine`](http://html5index.org/Offline%20-%20NavigatorOnLine.html) attribute and [online/offline events](https://developer.mozilla.org/en-US/docs/Online_and_offline_events), part of standard HTML5 API.
+- **Main process**: Use the [`net.isOnline()`](../api/net.md#netisonline) method or the [`net.online`](../api/net.md#netonline-readonly) property.
 
 The `navigator.onLine` attribute returns:
 
-* `false` if all network requests are guaranteed to fail (e.g. when disconnected from the network).
-* `true` in all other cases.
+- `false` if all network requests are guaranteed to fail (e.g. when disconnected from the network).
+- `true` in all other cases.
 
 Since many cases return `true`, you should treat with care situations of
 getting false positives, as we cannot always assume that `true` value means
@@ -19,7 +19,27 @@ is running a virtualization software that has virtual Ethernet adapters in "alwa
 connected" state. Therefore, if you want to determine the Internet access
 status of Electron, you should develop additional means for this check.
 
-## Example
+## Main Process Detection
+
+In the main process, you can use the `net` module to detect online/offline status:
+
+```js
+const { net } = require('electron')
+
+// Method 1: Using net.isOnline()
+const isOnline = net.isOnline()
+console.log('Online status:', isOnline)
+
+// Method 2: Using net.online property
+console.log('Online status:', net.online)
+```
+
+Both `net.isOnline()` and `net.online` return the same boolean value with the same reliability characteristics as `navigator.onLine` - they provide a strong indicator when offline (`false`), but a `true` value doesn't guarantee successful internet connectivity.
+
+> [!NOTE]
+> The `net` module is only available after the app emits the `ready` event.
+
+## Renderer Process Example
 
 Starting with an HTML file `index.html`, this example will demonstrate how the `navigator.onLine` API can be used to build a connection status indicator.
 
@@ -84,4 +104,4 @@ After launching the Electron application, you should see the notification:
 ![Connection status](../images/connection-status.png)
 
 > [!NOTE]
-> If you need to communicate the connection status to the main process, use the [IPC renderer](../api/ipc-renderer.md) API.
+> If you need to check the connection status in the main process, you can use [`net.isOnline()`](../api/net.md#netisonline) directly instead of communicating from the renderer process via [IPC](../api/ipc-renderer.md).

docs/tutorial/sandbox.md

@@ -13,7 +13,13 @@ the GPU service and the network service.
 See Chromium's [Sandbox design document][sandbox] for more information.
 
 Starting from Electron 20, the sandbox is enabled for renderer processes without any
-further configuration. If you want to disable the sandbox for a process, see the
+further configuration.
+
+Sandboxing is tied to Node.js integration. _Enabling Node.js integration_ for a
+renderer process by setting `nodeIntegration: true` _disables the sandbox_ for the
+process.
+
+If you want to disable the sandbox for a process, see the
 [Disabling the sandbox for a single process](#disabling-the-sandbox-for-a-single-process)
 section.
 
@@ -98,7 +104,8 @@ app.whenReady().then(() => {
 ```
 
 Sandboxing is also disabled whenever Node.js integration is enabled in the renderer.
-This can be done through the BrowserWindow constructor with the `nodeIntegration: true` flag.
+This can be done through the BrowserWindow constructor with the `nodeIntegration: true` flag
+or by providing the respective HTML boolean attribute for a `webview`.
 
 ```js title='main.js'
 app.whenReady().then(() => {
@@ -111,6 +118,10 @@ app.whenReady().then(() => {
 })
 ```
 
+```html title='index.html (Renderer Process)'
+<webview nodeIntegration src="page.html"></webview>
+```
+
 ### Enabling the sandbox globally
 
 If you want to force sandboxing for all renderers, you can also use the

docs/tutorial/security.md

@@ -244,6 +244,10 @@ to enable this behavior.
 Even when `nodeIntegration: false` is used, to truly enforce strong isolation
 and prevent the use of Node primitives `contextIsolation` **must** also be used.
 
+Beware that _disabling context isolation_ for a renderer process by setting
+`nodeIntegration: true` _also disables process sandboxing_ for that process.
+See section below.
+
 :::info
 For more information on what `contextIsolation` is and how to enable it please
 see our dedicated [Context Isolation](context-isolation.md) document.
@@ -251,6 +255,16 @@ see our dedicated [Context Isolation](context-isolation.md) document.
 
 ### 4. Enable process sandboxing
 
+:::info
+This recommendation is the default behavior in Electron since 20.0.0.
+
+Additionally, process sandboxing can be enforced for all renderer processes
+application wide: [Enabling the sandbox globally](sandbox.md#enabling-the-sandbox-globally)
+
+_Disabling context isolation_ (see above) _also disables process sandboxing_,
+regardless of the default, `sandbox: false` or globally enabled sandboxing!
+:::
+
 [Sandboxing](https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md)
 is a Chromium feature that uses the operating system to
 significantly limit what renderer processes have access to. You should enable

docs/tutorial/tutorial-2-first-app.md

@@ -55,14 +55,27 @@ There are a few rules to follow for the purposes of this tutorial:
 - _author_, _license_, and _description_ can be any value, but will be necessary for
   [packaging][packaging] later on.
 
+:::caution Install dependencies with a regular `node_modules` folder
+
+Electron's packaging toolchain requires the `node_modules` folder to be physically on disk in the
+way that npm installs Node dependencies. By default, [Yarn Berry](https://yarnpkg.com/) and
+[pnpm](http://pnpm.io/) both use alternative installation strategies.
+
+Therefore, you must set [`nodeLinker: node-modules`](https://yarnpkg.com/configuration/yarnrc#nodeLinker)
+in Yarn or [`nodeLinker: hoisted`](https://pnpm.io/settings#nodelinker) in pnpm if you are using
+those package managers.
+
+:::
+
 Then, install Electron into your app's **devDependencies**, which is the list of external
 development-only package dependencies not required in production.
 
-:::info Why is Electron a devDependency?
+:::info Why is Electron a dev dependency?
 
-This may seem counter-intuitive since your production code is running Electron APIs.
-However, packaged apps will come bundled with the Electron binary, eliminating the need to specify
-it as a production dependency.
+This may seem counter-intuitive since your production code is running Electron APIs. Under the hood,
+Electron's JavaScript API binds to a binary that contains its implementations. The packaging step for
+Electron handles the bundling of this binary, eliminating the need to specify it as a production
+dependency.
 
 :::
 
@@ -70,6 +83,17 @@ it as a production dependency.
 npm install electron --save-dev
 ```
 
+:::warning
+
+In order to correctly install Electron, you need to ensure that its `postinstall` lifecycle
+script is able to run. This means avoiding the `--ignore-scripts` flag on npm and allowlisting
+`electron` to run build scripts on other package managers.
+
+This is likely to change in a future version of Electron. See
+[electron/rfcs#22](https://github.com/electron/rfcs/pull/22) for more details.
+
+:::
+
 Your package.json file should look something like this after initializing your package
 and installing Electron. You should also now have a `node_modules` folder containing
 the Electron executable, as well as a `package-lock.json` lockfile that specifies

lib/browser/init.ts

@@ -162,27 +162,6 @@ require('@electron/internal/browser/api/web-contents-view');
 // Set main startup script of the app.
 const mainStartupScript = packageJson.main || 'index.js';
 
-const KNOWN_XDG_DESKTOP_VALUES = new Set(['Pantheon', 'Unity:Unity7', 'pop:GNOME']);
-
-function currentPlatformSupportsAppIndicator () {
-  if (process.platform !== 'linux') return false;
-  const currentDesktop = process.env.XDG_CURRENT_DESKTOP;
-
-  if (!currentDesktop) return false;
-  if (KNOWN_XDG_DESKTOP_VALUES.has(currentDesktop)) return true;
-  // ubuntu based or derived session (default ubuntu one, communitheme…) supports
-  // indicator too.
-  if (/ubuntu/ig.test(currentDesktop)) return true;
-
-  return false;
-}
-
-// Workaround for electron/electron#5050 and electron/electron#9046
-process.env.ORIGINAL_XDG_CURRENT_DESKTOP = process.env.XDG_CURRENT_DESKTOP;
-if (currentPlatformSupportsAppIndicator()) {
-  process.env.XDG_CURRENT_DESKTOP = 'Unity';
-}
-
 // Quit when all windows are closed and no other one is listening to this.
 app.on('window-all-closed', () => {
   if (app.listenerCount('window-all-closed') === 1) {

npm/install.js

@@ -44,7 +44,7 @@ downloadArtifact({
   artifactName: 'electron',
   force: process.env.force_no_cache === 'true',
   cacheRoot: process.env.electron_config_cache,
-  checksums: process.env.electron_use_remote_checksums ?? process.env.npm_config_electron_use_remote_checksums ? undefined : require('./checksums.json'),
+  checksums: (process.env.electron_use_remote_checksums || process.env.npm_config_electron_use_remote_checksums) ? undefined : require('./checksums.json'),
   platform,
   arch
 }).then(extractFile).catch(err => {

package.json

@@ -20,6 +20,7 @@
     "@types/temp": "^0.9.4",
     "@typescript-eslint/eslint-plugin": "^8.32.1",
     "@typescript-eslint/parser": "^8.7.0",
+    "@xmldom/xmldom": "^0.8.11",
     "buffer": "^6.0.3",
     "chalk": "^4.1.0",
     "check-for-leaks": "^1.2.1",

patches/angle/.patches

@@ -0,0 +1 @@
+cherry-pick-2f564f1ca07b.patch

patches/angle/cherry-pick-2f564f1ca07b.patch

@@ -0,0 +1,125 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mark Mentovai <mark@chromium.org>
+Date: Tue, 16 Sep 2025 16:46:36 -0400
+Subject: mac: handle Metal toolchain being unbundled from Xcode 26
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The Metal toolchain was formerly part of Xcode, but in Xcode 26, it has
+been unbundled and is now a separate install. Attempting to use the
+Metal toolchain without installing it results in a build error, such as:
+
+error: error: cannot execute tool 'metal' due to missing Metal
+Toolchain; use: xcodebuild -downloadComponent MetalToolchain
+
+By running the suggested command, the Metal toolchain can be installed,
+but the existing angle build does not know how to find it correctly.
+
+For system Xcode installations, tools from the Metal toolchain (`metal`
+and `metallib`) can be run via `xcrun`. This construct should work
+equally well for older Xcode versions, for situations where it’s still
+in use.
+
+For the hermetic toolchain, we’ll continue splicing the Metal toolchain
+into the location it had previously been avialable (see
+https://chromium-review.googlesource.com/c/6950738), although this is
+subject to change in the future.
+
+Bug: chromium:423933062, chromium:445400016
+Change-Id: I139eca51938f7cecfec9b90fd488947160ef4ec9
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/6955000
+Auto-Submit: Mark Mentovai <mark@chromium.org>
+Commit-Queue: Mark Mentovai <mark@chromium.org>
+Reviewed-by: Geoff Lang <geofflang@chromium.org>
+
+diff --git a/src/libANGLE/renderer/metal/BUILD.gn b/src/libANGLE/renderer/metal/BUILD.gn
+index 96e9ee8420810f6a3ca9a0c290d4a654200eb7b9..50ac42a5b9a0f7c8b3b161af40c598cb34ff132a 100644
+--- a/src/libANGLE/renderer/metal/BUILD.gn
++++ b/src/libANGLE/renderer/metal/BUILD.gn
+@@ -24,20 +24,56 @@ config("angle_metal_backend_config") {
+ }
+ 
+ if (metal_internal_shader_compilation_supported) {
++  template("run_metal_tool") {
++    action(target_name) {
++      forward_variables_from(invoker,
++                             [
++                               "deps",
++                               "sources",
++                               "outputs",
++                               "metal_tool",
++                             ])
++      script = "shaders/metal_wrapper.py"
++      if (use_system_xcode) {
++        # System Xcode: run metal and metallib via xcrun. Since Xcode 26.0, the
++        # Metal toolchain has been unbundled from Xcode, and must be installed
++        # separately by running `xcodebuild -downloadComponent MetalToolchain`.
++        # There is a vestigial metal executable in mac_bin_path, but it’s
++        # incapable of running successfuly without the
++        # rest of the Metal toolchain surrounding it. `xcrun` is able to find
++        # and run the correct Metal toolchain when properly installed.
++        #
++        # If you’re using system Xcode and your build fails with this message:
++        #   error: error: cannot execute tool 'metal' due to missing Metal Toolchain; use: xcodebuild -downloadComponent MetalToolchain
++        # then do what the error message suggests, and then retry your build.
++        args = [
++          "xcrun",
++          metal_tool,
++        ]
++      } else {
++        # Hermetic Xcode: at least for now, the Metal toolchain is
++        # “spliced” into the location in the hermetic toolchain where it lived
++        # before Xcode 26.0, so it can be run directly from there.
++        args = [ mac_bin_path + metal_tool ]
++      }
++
++      args += invoker.args
++    }
++  }
++
+   _metal_internal_shaders_air_file =
+       "$root_gen_dir/angle/mtl_internal_shaders_autogen.air"
+ 
+-  action("angle_metal_internal_shaders_to_air") {
+-    script = "shaders/metal_wrapper.py"
+-
+-    outputs = [ _metal_internal_shaders_air_file ]
+-
++  run_metal_tool("angle_metal_internal_shaders_to_air") {
+     _metal_internal_shaders_metal_source =
+         "shaders/mtl_internal_shaders_autogen.metal"
+     sources = [ _metal_internal_shaders_metal_source ]
+ 
++    outputs = [ _metal_internal_shaders_air_file ]
++
++    metal_tool = "metal"
++
+     args = [
+-      mac_bin_path + "metal",
+       "-c",
+       rebase_path(_metal_internal_shaders_metal_source, root_build_dir),
+       "-o",
+@@ -60,17 +96,16 @@ if (metal_internal_shader_compilation_supported) {
+   _metal_internal_shaders_metallib_file =
+       "$root_gen_dir/angle/mtl_internal_shaders_autogen.metallib"
+ 
+-  action("angle_metal_internal_shaders_to_mtllib") {
+-    script = "shaders/metal_wrapper.py"
+-
+-    outputs = [ _metal_internal_shaders_metallib_file ]
++  run_metal_tool("angle_metal_internal_shaders_to_mtllib") {
++    deps = [ ":angle_metal_internal_shaders_to_air" ]
+ 
+     sources = [ _metal_internal_shaders_air_file ]
+ 
+-    deps = [ ":angle_metal_internal_shaders_to_air" ]
++    outputs = [ _metal_internal_shaders_metallib_file ]
++
++    metal_tool = "metallib"
+ 
+     args = [
+-      mac_bin_path + "metallib",
+       rebase_path(_metal_internal_shaders_air_file, root_build_dir),
+       "-o",
+       rebase_path(_metal_internal_shaders_metallib_file, root_build_dir),

patches/chromium/.patches

@@ -137,3 +137,5 @@ fix_add_macos_memory_query_fallback_to_avoid_crash.patch
 fix_resolve_dynamic_background_material_update_issue_on_windows_11.patch
 feat_add_support_for_embedder_snapshot_validation.patch
 band-aid_over_an_issue_with_using_deprecated_nsopenpanel_api.patch
+inspectorpageagent_provisional_frame_speculative_fix.patch
+expose_referrerscriptinfo_hostdefinedoptionsindex.patch

patches/chromium/command-ismediakey.patch

@@ -39,10 +39,10 @@ index e87c180342b967756efeb701c73207fcee8754f1..42e37564e585987d367921568f0f1d2b
            NOTREACHED();
        }
 diff --git a/ui/base/accelerators/global_accelerator_listener/global_accelerator_listener_ozone.cc b/ui/base/accelerators/global_accelerator_listener/global_accelerator_listener_ozone.cc
-index b6985bd63a34c55154fcfae601add6ce6c451704..fb44cc65b1a15c8b69410a2a2cb925a0326bb438 100644
+index c8ebf2a2f2dde80a53fbeac7a86657999709840a..8ad1bc55f633a6cef38ddd37ab465fa85ad14c34 100644
 --- a/ui/base/accelerators/global_accelerator_listener/global_accelerator_listener_ozone.cc
 +++ b/ui/base/accelerators/global_accelerator_listener/global_accelerator_listener_ozone.cc
-@@ -147,7 +147,8 @@ bool GlobalAcceleratorListenerOzone::StartListeningForAccelerator(
+@@ -155,7 +155,8 @@ bool GlobalAcceleratorListenerOzone::StartListeningForAccelerator(
    const bool registered =
        platform_global_shortcut_listener_->RegisterAccelerator(
            accelerator.key_code(), accelerator.IsAltDown(),
@@ -52,7 +52,7 @@ index b6985bd63a34c55154fcfae601add6ce6c451704..fb44cc65b1a15c8b69410a2a2cb925a0
    if (registered) {
      registered_hot_keys_.insert(accelerator);
    }
-@@ -162,14 +163,15 @@ void GlobalAcceleratorListenerOzone::StopListeningForAccelerator(
+@@ -170,14 +171,15 @@ void GlobalAcceleratorListenerOzone::StopListeningForAccelerator(
  
    platform_global_shortcut_listener_->UnregisterAccelerator(
        accelerator.key_code(), accelerator.IsAltDown(), accelerator.IsCtrlDown(),
@@ -70,7 +70,7 @@ index b6985bd63a34c55154fcfae601add6ce6c451704..fb44cc65b1a15c8b69410a2a2cb925a0
    int modifiers = 0;
    if (is_alt_down) {
      modifiers |= ui::EF_ALT_DOWN;
-@@ -180,6 +182,9 @@ void GlobalAcceleratorListenerOzone::OnKeyPressed(ui::KeyboardCode key_code,
+@@ -188,6 +190,9 @@ void GlobalAcceleratorListenerOzone::OnKeyPressed(ui::KeyboardCode key_code,
    if (is_shift_down) {
      modifiers |= ui::EF_SHIFT_DOWN;
    }

patches/chromium/expose_referrerscriptinfo_hostdefinedoptionsindex.patch

@@ -0,0 +1,53 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fedor Indutny <indutny@signal.org>
+Date: Wed, 24 Sep 2025 10:08:48 -0700
+Subject: Expose ReferrerScriptInfo::HostDefinedOptionsIndex
+
+In `shell/common/node_bindings.cc`'s
+`HostImportModuleWithPhaseDynamically` we route dynamic imports to
+either Node.js's or Blink's resolver based on presence of Node.js
+environment, process type, etc. Exporting `HostDefinedOptionsIndex`
+allows us to route based on the size of `v8_host_defined_options` data
+which enables us to support dynamic imports in non-context-isolated
+preload scripts.
+
+diff --git a/third_party/blink/renderer/bindings/core/v8/referrer_script_info.cc b/third_party/blink/renderer/bindings/core/v8/referrer_script_info.cc
+index 1b797783987255622735047bd78ca0e8bb635d5e..b209c736bb80c186ed51999af1dac0a1d50fc232 100644
+--- a/third_party/blink/renderer/bindings/core/v8/referrer_script_info.cc
++++ b/third_party/blink/renderer/bindings/core/v8/referrer_script_info.cc
+@@ -12,15 +12,6 @@ namespace blink {
+ 
+ namespace {
+ 
+-enum HostDefinedOptionsIndex : size_t {
+-  kBaseURL,
+-  kCredentialsMode,
+-  kNonce,
+-  kParserState,
+-  kReferrerPolicy,
+-  kLength
+-};
+-
+ // Omit storing base URL if it is same as ScriptOrigin::ResourceName().
+ // Note: This improves chance of getting into a fast path in
+ //       ReferrerScriptInfo::ToV8HostDefinedOptions.
+diff --git a/third_party/blink/renderer/bindings/core/v8/referrer_script_info.h b/third_party/blink/renderer/bindings/core/v8/referrer_script_info.h
+index 0119624a028bec3e53e4e402938a98fe6def1483..743865839448748fe00e3e7d5027587cb65393c9 100644
+--- a/third_party/blink/renderer/bindings/core/v8/referrer_script_info.h
++++ b/third_party/blink/renderer/bindings/core/v8/referrer_script_info.h
+@@ -23,6 +23,15 @@ class CORE_EXPORT ReferrerScriptInfo {
+   STACK_ALLOCATED();
+ 
+  public:
++  enum HostDefinedOptionsIndex : size_t {
++    kBaseURL,
++    kCredentialsMode,
++    kNonce,
++    kParserState,
++    kReferrerPolicy,
++    kLength
++  };
++
+   ReferrerScriptInfo() {}
+   ReferrerScriptInfo(const KURL& base_url,
+                      network::mojom::CredentialsMode credentials_mode,

patches/chromium/feat_corner_smoothing_css_rule_and_blink_painting.patch

@@ -312,7 +312,7 @@ index 7e3d46902fbf736b4240eb3fcb89975a7b222197..57fdc89fc265ad70cb0bff8443cc1026
  
    auto DrawAsSinglePath = [&]() {
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-index 485025e439a90fef0c333c75477011670f4cd6ae..db4ff90eaae7ac0e22d56536fb45f18aca98e7cf 100644
+index 4573b97c88c9553d880b8f61b29ff43bf16e1beb..de9168878c536e44e7656d7b23f05c1c1a452367 100644
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 @@ -214,6 +214,10 @@

patches/chromium/inspectorpageagent_provisional_frame_speculative_fix.patch

@@ -0,0 +1,116 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Joey Arhar <jarhar@chromium.org>
+Date: Wed, 1 Oct 2025 02:03:37 -0700
+Subject: InspectorPageAgent provisional frame speculative fix
+
+According to crash reports, addScriptToEvaluateOnNewDocument is running
+on provisional frames.
+
+Fixed: 390710982
+Change-Id: I5cecf63c9517d0b28fff40361c607b0aa54e68cf
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6216479
+Reviewed-by: Alex Rudenko <alexrudenko@chromium.org>
+Commit-Queue: Alex Rudenko <alexrudenko@chromium.org>
+Auto-Submit: Joey Arhar <jarhar@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1523418}
+
+diff --git a/third_party/blink/renderer/core/inspector/inspector_page_agent.cc b/third_party/blink/renderer/core/inspector/inspector_page_agent.cc
+index fe17063fa8f572368096b88e1e3cc35b469e816a..07c1b9dd216518f70257a6637e3b50d87f098e8b 100644
+--- a/third_party/blink/renderer/core/inspector/inspector_page_agent.cc
++++ b/third_party/blink/renderer/core/inspector/inspector_page_agent.cc
+@@ -603,7 +603,11 @@ protocol::Response InspectorPageAgent::addScriptToEvaluateOnNewDocument(
+     // Runtime.enable that forces main context creation. In this case, we would
+     // not normally evaluate the script, but we should.
+     for (LocalFrame* frame : *inspected_frames_) {
+-      EvaluateScriptOnNewDocument(*frame, *identifier);
++      // Don't evaluate scripts on provisional frames:
++      // https://crbug.com/390710982
++      if (!frame->IsProvisional()) {
++        EvaluateScriptOnNewDocument(*frame, *identifier);
++      }
+     }
+   }
+ 
+diff --git a/third_party/blink/web_tests/FlagExpectations/disable-site-isolation-trials b/third_party/blink/web_tests/FlagExpectations/disable-site-isolation-trials
+index f462af59547e93378034b7e9301053a43f636ea4..3b829d94fa447e58a1acc57b7c7bdbd4564c9507 100644
+--- a/third_party/blink/web_tests/FlagExpectations/disable-site-isolation-trials
++++ b/third_party/blink/web_tests/FlagExpectations/disable-site-isolation-trials
+@@ -63,6 +63,7 @@ http/tests/inspector-protocol/target/target-filter.js [ Skip ]
+ virtual/fenced-frame-mparch/http/tests/inspector-protocol/fenced-frame/fenced-frame-in-oopif-auto-attach.js [ Skip ]
+ http/tests/inspector-protocol/target/target-info-changed-auto-attach.js [ Skip ]
+ http/tests/inspector-protocol/page/frame-detached-oopif.js [ Skip ]
++http/tests/inspector-protocol/page/addScriptToEvaluateOnNewDocument-reload.js [ Skip ]
+ 
+ # Rely on OOPIF for an iframe to be a separate devtools target
+ http/tests/inspector-protocol/timeline/auction-worklet-frame.js [ Skip ]
+diff --git a/third_party/blink/web_tests/http/tests/inspector-protocol/page/addScriptToEvaluateOnNewDocument-reload-expected.txt b/third_party/blink/web_tests/http/tests/inspector-protocol/page/addScriptToEvaluateOnNewDocument-reload-expected.txt
+new file mode 100644
+index 0000000000000000000000000000000000000000..0131df6c227e1803741e654d42b15f589275061a
+--- /dev/null
++++ b/third_party/blink/web_tests/http/tests/inspector-protocol/page/addScriptToEvaluateOnNewDocument-reload-expected.txt
+@@ -0,0 +1,28 @@
++Tests that Page.addScriptToEvaluateOnNewDocument on auto-attach with runImmediately=true.
++Regression test for crbug.com/390710982.
++console called: {
++    method : Runtime.consoleAPICalled
++    params : {
++        args : [
++            [0] : {
++                type : string
++                value : evaluated
++            }
++        ]
++        executionContextId : <number>
++        stackTrace : {
++            callFrames : [
++                [0] : {
++                    columnNumber : 8
++                    functionName :
++                    lineNumber : 0
++                    scriptId : <string>
++                    url :
++                }
++            ]
++        }
++        timestamp : <number>
++        type : log
++    }
++    sessionId : <string>
++}
+diff --git a/third_party/blink/web_tests/http/tests/inspector-protocol/page/addScriptToEvaluateOnNewDocument-reload.js b/third_party/blink/web_tests/http/tests/inspector-protocol/page/addScriptToEvaluateOnNewDocument-reload.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..52ebe845c323c6d692147052f3458777dcd7f966
+--- /dev/null
++++ b/third_party/blink/web_tests/http/tests/inspector-protocol/page/addScriptToEvaluateOnNewDocument-reload.js
+@@ -0,0 +1,31 @@
++(async function(/** @type {import('test_runner').TestRunner} */ testRunner) {
++  const { session, dp } = await testRunner.startBlank(
++    `Tests that Page.addScriptToEvaluateOnNewDocument on auto-attach with runImmediately=true.
++Regression test for crbug.com/390710982.`);
++
++  await dp.Page.enable();
++  await dp.Target.enable();
++  await dp.Target.setAutoAttach({ flatten: true, autoAttach: true, waitForDebuggerOnStart: true });
++
++  dp.Target.onAttachedToTarget(async event => {
++    const dp2 = session.createChild(event.params.sessionId).protocol;
++    dp2.Page.enable();
++    dp2.Runtime.enable();
++    dp2.Runtime.onConsoleAPICalled(event => {
++      testRunner.log(event, 'console called: ');
++    });
++    dp2.Page.addScriptToEvaluateOnNewDocument({
++      source: 'console.log("evaluated")',
++      runImmediately: true,
++    });
++    await dp2.Runtime.runIfWaitingForDebugger();
++  });
++
++  const loaded = dp.Page.onceLoadEventFired();
++  await dp.Page.navigate({
++    url: testRunner.url('resources/iframe-src.html')
++  });
++  await loaded;
++
++  testRunner.completeTest();
++});

patches/chromium/mas_avoid_private_macos_api_usage.patch.patch

@@ -904,7 +904,7 @@ index f300e8d331057e894b43b74944e5052c39206844..4ff5277d550485cd79c5b5316d89c730
  
  base::WeakPtr<BluetoothLowEnergyAdapterApple>
 diff --git a/gpu/ipc/service/BUILD.gn b/gpu/ipc/service/BUILD.gn
-index 1e35afb74f7a149fb01ec2a2c62547a8aa6f1de1..05f4628930e74ea668a85968f74c678e57a6429d 100644
+index a09f0dcaf6a3e1f384d34c12d03094ae2767ee3f..33421164b54fc5991dc1636a741f1f0361608cd7 100644
 --- a/gpu/ipc/service/BUILD.gn
 +++ b/gpu/ipc/service/BUILD.gn
 @@ -128,6 +128,7 @@ component("service") {

patches/config.json

@@ -12,5 +12,6 @@
   { "patch_dir": "src/electron/patches/ReactiveObjC", "repo": "src/third_party/squirrel.mac/vendor/ReactiveObjC" },
   { "patch_dir": "src/electron/patches/webrtc", "repo": "src/third_party/webrtc" },
   { "patch_dir": "src/electron/patches/reclient-configs", "repo": "src/third_party/engflow-reclient-configs" },
-  { "patch_dir": "src/electron/patches/sqlite", "repo": "src/third_party/sqlite/src" }
+  { "patch_dir": "src/electron/patches/sqlite", "repo": "src/third_party/sqlite/src" },
+  { "patch_dir": "src/electron/patches/angle", "repo": "src/third_party/angle" }
 ]

patches/node/add_v8_taskpirority_to_foreground_task_runner_signature.patch

@@ -8,10 +8,10 @@ naturally upstream, and we will be able to remove this patch in a future
 Node.js upgrade.
 
 diff --git a/src/node_platform.cc b/src/node_platform.cc
-index b438b3774d0aa7680fdbc6c6bf39a87893d221b2..ec355061825fb861c17fa2e6cc967b4c7b8d4586 100644
+index b24e170cb247261d4a16d77ad40df4dfd33709d9..5e31f984b5655ae2d1d7559b1bd550ba6dc90fb4 100644
 --- a/src/node_platform.cc
 +++ b/src/node_platform.cc
-@@ -687,8 +687,8 @@ bool NodePlatform::IdleTasksEnabled(Isolate* isolate) {
+@@ -688,8 +688,8 @@ bool NodePlatform::IdleTasksEnabled(Isolate* isolate) {
    return ForIsolate(isolate)->IdleTasksEnabled();
  }
  

patches/node/build_add_gn_build_files.patch

@@ -11,10 +11,10 @@ really in 20/21. We have to wait until 22 is released to be able to
 build with upstream GN files.
 
 diff --git a/configure.py b/configure.py
-index 2415940835036226799a7ea14c6687cc0d56c523..0feb07afbccad97a92cee00954443407eb20ac67 100755
+index 91283ca577f580dbf1e0c4e2dbf851a9ceaa38ed..e8eaff30ec947677db2d45425f9180759d0c55de 100755
 --- a/configure.py
 +++ b/configure.py
-@@ -1722,7 +1722,7 @@ def configure_v8(o, configs):
+@@ -1728,7 +1728,7 @@ def configure_v8(o, configs):
    # Until we manage to get rid of all those, v8_enable_sandbox cannot be used.
    # Note that enabling pointer compression without enabling sandbox is unsupported by V8,
    # so this can be broken at any time.
@@ -68,7 +68,7 @@ index d4438f7fd61598afac2c1e3184721a759d22b10c..e2407027ab05e59b2f0f1c213b98ea46
  
  assert(!node_enable_inspector || node_use_openssl,
 diff --git a/src/node_builtins.cc b/src/node_builtins.cc
-index b4acc40618e372b09d0cb5e3755034f08711a282..efeaaef7e4dc64a0adb5e6bdbbe18945890de62c 100644
+index b83aa87c969fb4e71cb202816713af869bb76283..c54df6fee333ddfe59b9df7e0ddd2935b4dcb33f 100644
 --- a/src/node_builtins.cc
 +++ b/src/node_builtins.cc
 @@ -789,6 +789,7 @@ void BuiltinLoader::RegisterExternalReferences(

patches/node/build_compile_with_c_20_support.patch

@@ -10,7 +10,7 @@ V8 requires C++20 support as of https://chromium-review.googlesource.com/c/v8/v8
 This can be removed when Electron upgrades to a version of Node.js containing the required V8 version.
 
 diff --git a/common.gypi b/common.gypi
-index 3a1d2fc9d147a8c89f7b5231d63d37f29979965d..6425ee9e8dba993f3e899362ce9bd7b097f08883 100644
+index c28d6f5fe2c922f0b1e3f7e56289c78e7b91c294..95c56305926fc3e0e46e4cf99ec86d3d1b5576a7 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -539,7 +539,7 @@
@@ -22,7 +22,7 @@ index 3a1d2fc9d147a8c89f7b5231d63d37f29979965d..6425ee9e8dba993f3e899362ce9bd7b0
          ],
          'defines': [ '__STDC_FORMAT_MACROS' ],
          'ldflags': [ '-rdynamic' ],
-@@ -709,7 +709,7 @@
+@@ -719,7 +719,7 @@
            ['clang==1', {
              'xcode_settings': {
                'GCC_VERSION': 'com.apple.compilers.llvm.clang.1_0',

patches/node/build_enable_perfetto.patch

@@ -64,10 +64,10 @@ index 251f51ec454f9cba4023b8b6729241ee753aac13..1de8cac6e3953ce9cab9db03530da327
  
  module.exports = {
 diff --git a/node.gyp b/node.gyp
-index d604e0ddd973174aa7be6f2d250af7b9c2b0fcfd..8e97aa3f44087213425927113fe72bca9ddef45b 100644
+index 0e0071b508f605bb9b7722f8304814dc176d907e..bcb9f371c4e4d8c665058115dc39eaa65125d679 100644
 --- a/node.gyp
 +++ b/node.gyp
-@@ -176,7 +176,6 @@
+@@ -174,7 +174,6 @@
        'src/timers.cc',
        'src/timer_wrap.cc',
        'src/tracing/agent.cc',
@@ -75,7 +75,7 @@ index d604e0ddd973174aa7be6f2d250af7b9c2b0fcfd..8e97aa3f44087213425927113fe72bca
        'src/tracing/node_trace_writer.cc',
        'src/tracing/trace_event.cc',
        'src/tracing/traced_value.cc',
-@@ -304,7 +303,6 @@
+@@ -302,7 +301,6 @@
        'src/tcp_wrap.h',
        'src/timers.h',
        'src/tracing/agent.h',
@@ -105,7 +105,7 @@ index 40c8aea35c931c46fc62b717c978eab0659645fd..348cdfb0b42aa18f352c220cea0b896c
      if (!json_writer_)
        return;
 diff --git a/src/tracing/agent.cc b/src/tracing/agent.cc
-index 7ce59674356f9743438350949be42fa7ead2afbe..30bff4272ed8eb5146e3b73a4849c187177fc3bd 100644
+index eddcf6c3bf91b730d6ca72960e3048ceed7e7844..184e8647b2148bc597d9d3eb63f86ae99917c642 100644
 --- a/src/tracing/agent.cc
 +++ b/src/tracing/agent.cc
 @@ -2,7 +2,9 @@
@@ -144,7 +144,7 @@ index 7ce59674356f9743438350949be42fa7ead2afbe..30bff4272ed8eb5146e3b73a4849c187
  
    // This thread should be created *after* async handles are created
    // (within NodeTraceWriter and NodeTraceBuffer constructors).
-@@ -143,8 +151,10 @@ void Agent::StopTracing() {
+@@ -148,8 +156,10 @@ void Agent::StopTracing() {
      return;
    // Perform final Flush on TraceBuffer. We don't want the tracing controller
    // to flush the buffer again on destruction of the V8::Platform.
@@ -156,7 +156,7 @@ index 7ce59674356f9743438350949be42fa7ead2afbe..30bff4272ed8eb5146e3b73a4849c187
    started_ = false;
  
    // Thread should finish when the tracing loop is stopped.
-@@ -202,6 +212,7 @@ std::string Agent::GetEnabledCategories() const {
+@@ -207,6 +217,7 @@ std::string Agent::GetEnabledCategories() const {
    return categories;
  }
  
@@ -164,7 +164,7 @@ index 7ce59674356f9743438350949be42fa7ead2afbe..30bff4272ed8eb5146e3b73a4849c187
  void Agent::AppendTraceEvent(TraceObject* trace_event) {
    for (const auto& id_writer : writers_)
      id_writer.second->AppendTraceEvent(trace_event);
-@@ -211,18 +222,21 @@ void Agent::AddMetadataEvent(std::unique_ptr<TraceObject> event) {
+@@ -216,18 +227,21 @@ void Agent::AddMetadataEvent(std::unique_ptr<TraceObject> event) {
    Mutex::ScopedLock lock(metadata_events_mutex_);
    metadata_events_.push_back(std::move(event));
  }
@@ -187,7 +187,7 @@ index 7ce59674356f9743438350949be42fa7ead2afbe..30bff4272ed8eb5146e3b73a4849c187
  void TracingController::AddMetadataEvent(
      const unsigned char* category_group_enabled,
      const char* name,
-@@ -246,6 +260,6 @@ void TracingController::AddMetadataEvent(
+@@ -251,6 +265,6 @@ void TracingController::AddMetadataEvent(
    if (node_agent != nullptr)
      node_agent->AddMetadataEvent(std::move(trace_event));
  }

patches/node/build_ensure_native_module_compilation_fails_if_not_using_a_new.patch

@@ -7,7 +7,7 @@ Subject: build: ensure native module compilation fails if not using a new
 This should not be upstreamed, it is a quality-of-life patch for downstream module builders.
 
 diff --git a/common.gypi b/common.gypi
-index e56ba31ed068b81f5c6fbd432cd82bb6916e9a85..3a1d2fc9d147a8c89f7b5231d63d37f29979965d 100644
+index 6b79de07be3f839af5b0644f19bfef9c33de590e..c28d6f5fe2c922f0b1e3f7e56289c78e7b91c294 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -89,6 +89,8 @@
@@ -42,10 +42,10 @@ index e56ba31ed068b81f5c6fbd432cd82bb6916e9a85..3a1d2fc9d147a8c89f7b5231d63d37f2
        # list in v8/BUILD.gn.
        ['v8_enable_v8_checks == 1', {
 diff --git a/configure.py b/configure.py
-index 0feb07afbccad97a92cee00954443407eb20ac67..5eccced7cf0212f229db68c76cc824a37e4a29bc 100755
+index e8eaff30ec947677db2d45425f9180759d0c55de..dc2d9d80059e845b33444f8bdc29e82d0fe0e26b 100755
 --- a/configure.py
 +++ b/configure.py
-@@ -1704,6 +1704,7 @@ def configure_library(lib, output, pkgname=None):
+@@ -1710,6 +1710,7 @@ def configure_library(lib, output, pkgname=None):
  def configure_v8(o, configs):
    set_configuration_variable(configs, 'v8_enable_v8_checks', release=1, debug=0)
  
@@ -54,7 +54,7 @@ index 0feb07afbccad97a92cee00954443407eb20ac67..5eccced7cf0212f229db68c76cc824a3
    o['variables']['v8_enable_javascript_promise_hooks'] = 1
    o['variables']['v8_enable_lite_mode'] = 1 if options.v8_lite_mode else 0
 diff --git a/src/node.h b/src/node.h
-index 835c78145956de3d8c52b6cc0581bcfef600f90b..174fd4d1af4c8cd75aec09f4548a674fd5539fb2 100644
+index a336f44dc1e785ea237865077216d41ab032c0af..96c599aa6448e2aa8e57e84f811564a5281c139a 100644
 --- a/src/node.h
 +++ b/src/node.h
 @@ -22,6 +22,12 @@

patches/node/build_modify_js2c_py_to_allow_injection_of_original-fs_and_custom_embedder_js.patch

@@ -34,7 +34,7 @@ index 0244a214b187e67e0cb89f26cd019855963ec93a..b65a3be6bcb0e28f7f43367d0fa9da53
  let kResistStopPropagation;
  
 diff --git a/src/node_builtins.cc b/src/node_builtins.cc
-index efeaaef7e4dc64a0adb5e6bdbbe18945890de62c..557972987abeaa56918362638a17a9b6e0763238 100644
+index c54df6fee333ddfe59b9df7e0ddd2935b4dcb33f..4b288e0f89e0156cb5b0555c0259b2c1150770db 100644
 --- a/src/node_builtins.cc
 +++ b/src/node_builtins.cc
 @@ -35,6 +35,7 @@ using v8::Value;

patches/node/build_restore_clang_as_default_compiler_on_macos.patch

@@ -11,7 +11,7 @@ node-gyp will use the result of `process.config` that reflects the environment
 in which the binary got built.
 
 diff --git a/common.gypi b/common.gypi
-index 6425ee9e8dba993f3e899362ce9bd7b097f08883..95d66f75b582b3fd3b833109dfe110ae5b196f83 100644
+index 95c56305926fc3e0e46e4cf99ec86d3d1b5576a7..45bb2c4ff94ceac377c9117da4497cdc5ac41171 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -128,6 +128,7 @@

patches/node/chore_expose_importmoduledynamically_and.patch

@@ -40,10 +40,10 @@ index 9b41db8b0714b7408f79cbd5b4c460d9bc08f239..35ecfb9bbaf2c8e7351e1c69da84c82a
  
  /**
 diff --git a/src/module_wrap.cc b/src/module_wrap.cc
-index e317a84e55714af0a93719336d02ac26410ad724..e3880111172363feafb53b51deb08c93596cd4f4 100644
+index c52e20d742942667f43ea3e151fc6702260b176b..cbb3e7f4df72f83cb8a1afc25a7429218792e964 100644
 --- a/src/module_wrap.cc
 +++ b/src/module_wrap.cc
-@@ -895,7 +895,7 @@ MaybeLocal<Module> ModuleWrap::ResolveModuleCallback(
+@@ -901,7 +901,7 @@ MaybeLocal<Module> ModuleWrap::ResolveModuleCallback(
    return module->module_.Get(isolate);
  }
  
@@ -52,7 +52,7 @@ index e317a84e55714af0a93719336d02ac26410ad724..e3880111172363feafb53b51deb08c93
      Local<Context> context,
      Local<Data> host_defined_options,
      Local<Value> resource_name,
-@@ -967,12 +967,13 @@ void ModuleWrap::SetImportModuleDynamicallyCallback(
+@@ -973,12 +973,13 @@ void ModuleWrap::SetImportModuleDynamicallyCallback(
    Realm* realm = Realm::GetCurrent(args);
    HandleScope handle_scope(isolate);
  
@@ -68,7 +68,7 @@ index e317a84e55714af0a93719336d02ac26410ad724..e3880111172363feafb53b51deb08c93
  }
  
  void ModuleWrap::HostInitializeImportMetaObjectCallback(
-@@ -1014,13 +1015,14 @@ void ModuleWrap::SetInitializeImportMetaObjectCallback(
+@@ -1020,13 +1021,14 @@ void ModuleWrap::SetInitializeImportMetaObjectCallback(
    Realm* realm = Realm::GetCurrent(args);
    Isolate* isolate = realm->isolate();
  

patches/node/cli_move_--trace-atomics-wait_to_eol.patch

@@ -15,10 +15,10 @@ Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index 8cabb58e621a9951acd5551afb85c192f2b1c690..b69bacebef3e5e5e5b191c61aa5fe0f71c1edfb3 100644
+index 9a0e83b95a72486ab9751b3b8818f4beeb527041..1da7126b9d51238e9b89ee6bed602df3f5598a9e 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -2712,39 +2712,6 @@ added: v12.0.0
+@@ -2727,39 +2727,6 @@ added: v12.0.0
  Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.3'. Use to disable support
  for TLSv1.2, which is not as secure as TLSv1.3.
  
@@ -58,7 +58,7 @@ index 8cabb58e621a9951acd5551afb85c192f2b1c690..b69bacebef3e5e5e5b191c61aa5fe0f7
  ### `--trace-deprecation`
  
  <!-- YAML
-@@ -3429,7 +3396,6 @@ one is included in the list below.
+@@ -3445,7 +3412,6 @@ one is included in the list below.
  * `--tls-min-v1.1`
  * `--tls-min-v1.2`
  * `--tls-min-v1.3`
@@ -67,10 +67,10 @@ index 8cabb58e621a9951acd5551afb85c192f2b1c690..b69bacebef3e5e5e5b191c61aa5fe0f7
  * `--trace-env-js-stack`
  * `--trace-env-native-stack`
 diff --git a/doc/node.1 b/doc/node.1
-index 6913992a5476d2317a34fb69d3c6af63b686f9a6..1faef5ba1d4206a5cc4c71cb71f7a08f613fbf17 100644
+index e3b2c45af01b2e9b9522964da2572988edd2b9e9..64e975546285a1042dda6fdb54fdd502f338a929 100644
 --- a/doc/node.1
 +++ b/doc/node.1
-@@ -539,11 +539,6 @@ but the option is supported for compatibility with older Node.js versions.
+@@ -542,11 +542,6 @@ but the option is supported for compatibility with older Node.js versions.
  Set default minVersion to 'TLSv1.3'. Use to disable support for TLSv1.2 in
  favour of TLSv1.3, which is more secure.
  .
@@ -83,7 +83,7 @@ index 6913992a5476d2317a34fb69d3c6af63b686f9a6..1faef5ba1d4206a5cc4c71cb71f7a08f
  Print stack traces for deprecations.
  .
 diff --git a/src/node.cc b/src/node.cc
-index 0d383dcdb80fe30e3c2d6880b44f626f065bb1f3..9d9992dacbc595c987827f55eb12ea8af0480df6 100644
+index f0c0b6229048a2e9bc05684fab44ab09bc34e1f6..9027df9a321f7db76edd1218c194df519017dfaf 100644
 --- a/src/node.cc
 +++ b/src/node.cc
 @@ -232,44 +232,6 @@ void Environment::WaitForInspectorFrontendByOptions() {
@@ -150,7 +150,7 @@ index 0d383dcdb80fe30e3c2d6880b44f626f065bb1f3..9d9992dacbc595c987827f55eb12ea8a
      isolate_->SetPromiseHook(TracePromises);
    }
 diff --git a/src/node_options.cc b/src/node_options.cc
-index cfb95f65ccb0c6d150be8a4039caf26faf7cd06d..cb0ecd81b33abd7743e66e225a6cb96b4094f935 100644
+index e8424d7539db191a55edebb7d33a3c1dc37e2403..556776b79282d953fdc371d1901f21ca301bec1a 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -773,10 +773,6 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
@@ -165,10 +165,10 @@ index cfb95f65ccb0c6d150be8a4039caf26faf7cd06d..cb0ecd81b33abd7743e66e225a6cb96b
              "show stack traces on deprecations",
              &EnvironmentOptions::trace_deprecation,
 diff --git a/src/node_options.h b/src/node_options.h
-index 3ff1f4b4baa64b8ee2a4587e150ea14cb2fdfdf4..26ac54c4b18dd00b2c1f915dc1ba0e90ca70b48f 100644
+index 418dee360f867c363f1576012b32213a51c4fdd0..7078d2493ed696bc5bd92df9c629b714c1a8fbfb 100644
 --- a/src/node_options.h
 +++ b/src/node_options.h
-@@ -204,7 +204,6 @@ class EnvironmentOptions : public Options {
+@@ -205,7 +205,6 @@ class EnvironmentOptions : public Options {
    std::vector<std::string> coverage_include_pattern;
    std::vector<std::string> coverage_exclude_pattern;
    bool throw_deprecation = false;

patches/node/cli_remove_deprecated_v8_flag.patch

@@ -18,10 +18,10 @@ Reviewed-By: Michaël Zasso <targos@protonmail.com>
 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index 1a1e0ec1d89a4d0ecf1c9ae37c23b8f660c051d6..8cabb58e621a9951acd5551afb85c192f2b1c690 100644
+index b8f9fb49fcb45602828e79bd79902233b5987dda..9a0e83b95a72486ab9751b3b8818f4beeb527041 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -3467,7 +3467,6 @@ V8 options that are allowed are:
+@@ -3483,7 +3483,6 @@ V8 options that are allowed are:
  * `--disallow-code-generation-from-strings`
  * `--enable-etw-stack-walking`
  * `--expose-gc`
@@ -30,7 +30,7 @@ index 1a1e0ec1d89a4d0ecf1c9ae37c23b8f660c051d6..8cabb58e621a9951acd5551afb85c192
  * `--jitless`
  * `--max-old-space-size`
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 415d4e34f29bc303674dccbfdc231b251401961b..cfb95f65ccb0c6d150be8a4039caf26faf7cd06d 100644
+index 8afded658c3f569de7b329ea9dddc11010748cf9..e8424d7539db191a55edebb7d33a3c1dc37e2403 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -1001,11 +1001,6 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(

patches/node/enable_crashpad_linux_node_processes.patch

@@ -8,7 +8,7 @@ to child processes spawned with `ELECTRON_RUN_AS_NODE` which is used
 by the crashpad client to connect with the handler process.
 
 diff --git a/lib/child_process.js b/lib/child_process.js
-index 655349b6fa17217a9202616224032a36fd01e284..bf62c5adf0e0d75cb50636f365f71db82c29ba29 100644
+index 960ecd25ebb5b2aba0b92b869a2332a3a69011e1..ced0a5d792c63662c577a41c88b52cae076e7d08 100644
 --- a/lib/child_process.js
 +++ b/lib/child_process.js
 @@ -62,6 +62,7 @@ let debug = require('internal/util/debuglog').debuglog(
@@ -49,8 +49,8 @@ index 655349b6fa17217a9202616224032a36fd01e284..bf62c5adf0e0d75cb50636f365f71db8
 +
    if (options.shell) {
      validateArgumentNullCheck(options.shell, 'options.shell');
-     const command = ArrayPrototypeJoin([file, ...args], ' ');
-@@ -670,8 +686,6 @@ function normalizeSpawnArguments(file, args, options) {
+ 
+@@ -671,8 +687,6 @@ function normalizeSpawnArguments(file, args, options) {
      ArrayPrototypeUnshift(args, file);
    }
  

patches/node/fix_add_default_values_for_variables_in_common_gypi.patch

@@ -7,7 +7,7 @@ common.gypi is a file that's included in the node header bundle, despite
 the fact that we do not build node with gyp.
 
 diff --git a/common.gypi b/common.gypi
-index 7780ae106b479ca620a4065f08d6e4acc200628c..e56ba31ed068b81f5c6fbd432cd82bb6916e9a85 100644
+index ae31b372b96358a156761ec7e9c39c9530d1abd1..6b79de07be3f839af5b0644f19bfef9c33de590e 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -91,6 +91,23 @@

patches/node/fix_add_source_location_for_v8_task_runner.patch

@@ -15,10 +15,10 @@ corresponding change.
 CL: https://chromium-review.googlesource.com/c/v8/v8/+/5300826
 
 diff --git a/src/node_platform.cc b/src/node_platform.cc
-index 9c4c1e1db5fa7c0ca791e01d9be331e0957e9699..b438b3774d0aa7680fdbc6c6bf39a87893d221b2 100644
+index 0ffebd1dcb693dcddbedff5d259cf65c115f1dc2..b24e170cb247261d4a16d77ad40df4dfd33709d9 100644
 --- a/src/node_platform.cc
 +++ b/src/node_platform.cc
-@@ -307,11 +307,13 @@ void PerIsolatePlatformData::FlushTasks(uv_async_t* handle) {
+@@ -308,11 +308,13 @@ void PerIsolatePlatformData::FlushTasks(uv_async_t* handle) {
    platform_data->FlushForegroundTasksInternal();
  }
  
@@ -34,7 +34,7 @@ index 9c4c1e1db5fa7c0ca791e01d9be331e0957e9699..b438b3774d0aa7680fdbc6c6bf39a878
    // The task can be posted from any V8 background worker thread, even when
    // the foreground task runner is being cleaned up by Shutdown(). In that
    // case, make sure we wait until the shutdown is completed (which leads
-@@ -330,8 +332,10 @@ void PerIsolatePlatformData::PostTask(std::unique_ptr<Task> task) {
+@@ -331,8 +333,10 @@ void PerIsolatePlatformData::PostTask(std::unique_ptr<Task> task) {
    uv_async_send(flush_tasks_);
  }
  
@@ -47,7 +47,7 @@ index 9c4c1e1db5fa7c0ca791e01d9be331e0957e9699..b438b3774d0aa7680fdbc6c6bf39a878
    if (debug_log_level_ != PlatformDebugLogLevel::kNone) {
      fprintf(stderr,
              "\nPerIsolatePlatformData::PostDelayedTaskImpl %p %f",
-@@ -353,13 +357,15 @@ void PerIsolatePlatformData::PostDelayedTask(
+@@ -354,13 +358,15 @@ void PerIsolatePlatformData::PostDelayedTask(
    uv_async_send(flush_tasks_);
  }
  

patches/node/fix_allow_passing_fileexists_fn_to_legacymainresolve.patch

@@ -53,10 +53,10 @@ index e3afd30ba1f591d0298793bc42fd7166a4219bce..408dc96307d7f52f92db41004b358051
    const maybeMain = resolvedOption <= legacyMainResolveExtensionsIndexes.kResolvedByMainIndexNode ?
      packageConfig.main || './' : '';
 diff --git a/src/node_file.cc b/src/node_file.cc
-index c8e7e341b1d9f5a1142afdc265704455c252a0c3..7221708a2296ff44c19ed01dc52d78653ecc4e58 100644
+index e78326ed0de805a8bf4f621cad9158635eb44aa2..d7009937b31729f33d9c45cbda7f5440fbdac2aa 100644
 --- a/src/node_file.cc
 +++ b/src/node_file.cc
-@@ -3504,13 +3504,25 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
+@@ -3502,13 +3502,25 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
  }
  
  BindingData::FilePathIsFileReturnType BindingData::FilePathIsFile(
@@ -83,7 +83,7 @@ index c8e7e341b1d9f5a1142afdc265704455c252a0c3..7221708a2296ff44c19ed01dc52d7865
    uv_fs_t req;
  
    int rc = uv_fs_stat(env->event_loop(), &req, file_path.c_str(), nullptr);
-@@ -3568,6 +3580,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3566,6 +3578,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
    std::optional<std::string> initial_file_path;
    std::string file_path;
  
@@ -95,7 +95,7 @@ index c8e7e341b1d9f5a1142afdc265704455c252a0c3..7221708a2296ff44c19ed01dc52d7865
    if (args.Length() >= 2 && args[1]->IsString()) {
      auto package_config_main = Utf8Value(isolate, args[1]).ToString();
  
-@@ -3588,7 +3605,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3586,7 +3603,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
        BufferValue buff_file_path(isolate, local_file_path);
        ToNamespacedPath(env, &buff_file_path);
  
@@ -104,7 +104,7 @@ index c8e7e341b1d9f5a1142afdc265704455c252a0c3..7221708a2296ff44c19ed01dc52d7865
          case BindingData::FilePathIsFileReturnType::kIsFile:
            return args.GetReturnValue().Set(i);
          case BindingData::FilePathIsFileReturnType::kIsNotFile:
-@@ -3625,7 +3642,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
+@@ -3623,7 +3640,7 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
      BufferValue buff_file_path(isolate, local_file_path);
      ToNamespacedPath(env, &buff_file_path);
  

patches/node/fix_assert_module_in_the_renderer_process.patch

@@ -44,7 +44,7 @@ index 13e41d67c635c27bd5e69eb4960eace34beaef0d..9a99c9ca93907630f9f3ba7ba24577a1
    let filename = call.getFileName();
    const line = call.getLineNumber() - 1;
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 653112fbaea59fe8b446236085dcae8be671c6e5..415d4e34f29bc303674dccbfdc231b251401961b 100644
+index e3509abbc3bf84ac0edcd495eb3dde6219dbfc2d..8afded658c3f569de7b329ea9dddc11010748cf9 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -1566,14 +1566,16 @@ void GetEmbedderOptions(const FunctionCallbackInfo<Value>& args) {

patches/node/fix_cppgc_initializing_twice.patch

@@ -12,10 +12,10 @@ This can be removed/refactored once Node.js upgrades to a version of V8
 containing the above CL.
 
 diff --git a/src/node.cc b/src/node.cc
-index 9d9992dacbc595c987827f55eb12ea8af0480df6..d43a88b8780f04d186485a2dc58ad07083e699ac 100644
+index 9027df9a321f7db76edd1218c194df519017dfaf..cc1c35da5601fffc3c53985c5d95cc466662649d 100644
 --- a/src/node.cc
 +++ b/src/node.cc
-@@ -1222,7 +1222,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
+@@ -1246,7 +1246,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
      result->platform_ = per_process::v8_platform.Platform();
    }
  

patches/node/fix_do_not_resolve_electron_entrypoints.patch

@@ -6,19 +6,20 @@ Subject: fix: do not resolve electron entrypoints
 This wastes fs cycles and can result in strange behavior if this path actually exists on disk
 
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 8e099e0961b624c6143f5a60f050855b3366f177..dfed827fd3fc794f52bad39ccf7b5c14b1caebc3 100644
+index 2c33fd44b9a251682de78a8bcdad9ee5a0d3e5e8..ae3ef0e853ae19fca649704854d4bda84a5bd287 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -293,6 +293,9 @@ function cjsPreparseModuleExports(filename, source, isMain, format) {
-   if (module && module[kModuleExportNames] !== undefined) {
+@@ -355,6 +355,10 @@ function cjsPreparseModuleExports(filename, source, format) {
      return { module, exportNames: module[kModuleExportNames] };
    }
+ 
 +  if (filename === 'electron') {
 +    return { module, exportNames: new SafeSet(['default', ...Object.keys(module.exports)]) };
 +  }
-   const loaded = Boolean(module);
-   if (!loaded) {
-     module = new CJSModule(filename);
++
+   if (source === undefined) {
+     ({ source } = loadSourceForCJSWithHooks(module, filename, format));
+   }
 diff --git a/lib/internal/modules/run_main.js b/lib/internal/modules/run_main.js
 index 02ba43adc2c8e92a78942bbb04023a16f5870ee9..bbf1ab69b884a9325bebdd07b2c4fd354eee946b 100644
 --- a/lib/internal/modules/run_main.js

patches/node/fix_expose_readfilesync_override_for_modules.patch

@@ -8,10 +8,10 @@ an API override to replace the native `ReadFileSync` in the `modules`
 binding.
 
 diff --git a/src/env_properties.h b/src/env_properties.h
-index 5cb8dd86fe712755fe09556d227702aec905fbc9..f1768da6ef82fa85700fecbdf9321653345e92c5 100644
+index 82225b0a53dd828750991a4e15a060b736b6ea2b..4b0d31356a2496a7fc67876a22da2453efc54f53 100644
 --- a/src/env_properties.h
 +++ b/src/env_properties.h
-@@ -506,6 +506,7 @@
+@@ -508,6 +508,7 @@
    V(maybe_cache_generated_source_map, v8::Function)                            \
    V(messaging_deserialize_create_object, v8::Function)                         \
    V(message_port, v8::Object)                                                  \

patches/node/fix_expose_the_built-in_electron_module_via_the_esm_loader.patch

@@ -18,7 +18,7 @@ index 9519f947b8dfdc69808839948c9cb8434a0acf0e..23ce72d479f638c33edffcea7c35f5da
  
  /**
 diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
-index e718d7b3e7c11addc78cf7af33c93f63a9cb247b..3334818153068468967baa5adc1ed2382592ec76 100644
+index 307c35980551470b65128bebf5efe94df4e56892..3676a9852bcd42de0a3a380de117de58035f757b 100644
 --- a/lib/internal/modules/esm/load.js
 +++ b/lib/internal/modules/esm/load.js
 @@ -81,7 +81,7 @@ function defaultLoad(url, context = kEmptyObject) {
@@ -29,8 +29,8 @@ index e718d7b3e7c11addc78cf7af33c93f63a9cb247b..3334818153068468967baa5adc1ed238
 +  if (urlInstance.protocol === 'node:' || format === 'electron') {
      source = null;
      format ??= 'builtin';
-   } else if (format !== 'commonjs' || defaultType === 'module') {
-@@ -94,7 +94,7 @@ function defaultLoad(url, context = kEmptyObject) {
+   } else if (format === 'addon') {
+@@ -97,7 +97,7 @@ function defaultLoad(url, context = kEmptyObject) {
        // Now that we have the source for the module, run `defaultGetFormat` to detect its format.
        format = defaultGetFormat(urlInstance, context);
  
@@ -39,7 +39,7 @@ index e718d7b3e7c11addc78cf7af33c93f63a9cb247b..3334818153068468967baa5adc1ed238
          // For backward compatibility reasons, we need to discard the source in
          // order for the CJS loader to re-fetch it.
          source = null;
-@@ -142,7 +142,7 @@ function defaultLoadSync(url, context = kEmptyObject) {
+@@ -145,7 +145,7 @@ function defaultLoadSync(url, context = kEmptyObject) {
  
    throwIfUnsupportedURLScheme(urlInstance, false);
  
@@ -48,7 +48,7 @@ index e718d7b3e7c11addc78cf7af33c93f63a9cb247b..3334818153068468967baa5adc1ed238
      source = null;
    } else if (source == null) {
      ({ responseURL, source } = getSourceSync(urlInstance, context));
-@@ -175,12 +175,13 @@ function throwIfUnsupportedURLScheme(parsed) {
+@@ -178,12 +178,13 @@ function throwIfUnsupportedURLScheme(parsed) {
      protocol !== 'file:' &&
      protocol !== 'data:' &&
      protocol !== 'node:' &&
@@ -64,10 +64,10 @@ index e718d7b3e7c11addc78cf7af33c93f63a9cb247b..3334818153068468967baa5adc1ed238
    }
  }
 diff --git a/lib/internal/modules/esm/loader.js b/lib/internal/modules/esm/loader.js
-index 87c14d1f84def72c1326e09154b38c417840634e..4491499e6da1724a7fd66b028a78ba145d6114aa 100644
+index 78985575beb3df7722ba90968e8f085574b5afdf..e032c016efe227c26364e81804ad183cd2c0d17f 100644
 --- a/lib/internal/modules/esm/loader.js
 +++ b/lib/internal/modules/esm/loader.js
-@@ -498,7 +498,7 @@ class ModuleLoader {
+@@ -504,7 +504,7 @@ class ModuleLoader {
      }
  
      const cjsModule = wrap[imported_cjs_symbol];
@@ -103,12 +103,12 @@ index 859b6bfedac4bbee2df054f9ebca7cbaaed45f18..5aa946f66c71beff0b7a43c30638ab28
  
    const packageConfig = packageJsonReader.read(packageJSONPath, { __proto__: null, specifier, base, isESM: true });
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index d595ccbab8ce3042e83054e875eef612914115d8..7ea645b92a015b04cc121ff62aa1fc64b2961241 100644
+index 757f093becd112002f3422302f4c29bb464f1a6c..c8cea2117080930105b33e4e50586a2c88ef7352 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
 @@ -188,7 +188,7 @@ function createCJSModuleWrap(url, source, isMain, format, loadCJS = loadCJSModul
  
-   const { exportNames, module } = cjsPreparseModuleExports(filename, source, isMain, format);
+   const { exportNames, module } = cjsPreparseModuleExports(filename, source, format);
    cjsCache.set(url, module);
 -  const namesWithDefault = exportNames.has('default') ?
 +  const namesWithDefault = filename === 'electron' ? ['default', ...Object.keys(module.exports)] : exportNames.has('default') ?
@@ -126,7 +126,7 @@ index d595ccbab8ce3042e83054e875eef612914115d8..7ea645b92a015b04cc121ff62aa1fc64
          continue;
        }
        // We might trigger a getter -> dont fail.
-@@ -245,6 +245,10 @@ translators.set('require-commonjs', (url, source, isMain) => {
+@@ -286,6 +286,10 @@ translators.set('require-commonjs', (url, source, isMain) => {
    return createCJSModuleWrap(url, source, isMain, 'commonjs');
  });
  
@@ -138,10 +138,10 @@ index d595ccbab8ce3042e83054e875eef612914115d8..7ea645b92a015b04cc121ff62aa1fc64
  // This translator function must be sync, as `require` is sync.
  translators.set('require-commonjs-typescript', (url, source, isMain) => {
 diff --git a/lib/internal/url.js b/lib/internal/url.js
-index b6057ae6656e03d98ea40c018369419749409c6d..9bd9abd49523406fd9ac77f2b5efe311da1fa9aa 100644
+index d0c04be7c6ebc352d5958a987f3a4ba538e0d23a..00f9f3b73ed84c04ae712f6057b68737bd416333 100644
 --- a/lib/internal/url.js
 +++ b/lib/internal/url.js
-@@ -1604,6 +1604,8 @@ function fileURLToPath(path, options = kEmptyObject) {
+@@ -1605,6 +1605,8 @@ function fileURLToPath(path, options = kEmptyObject) {
      path = new URL(path);
    else if (!isURL(path))
      throw new ERR_INVALID_ARG_TYPE('path', ['string', 'URL'], path);

patches/node/fix_handle_boringssl_and_openssl_incompatibilities.patch

@@ -228,7 +228,7 @@ index d94f6e1c82c4a62547b3b395f375c86ce4deb5de..b81b9005365272217c77e2b9289bd9f8
        X509View ca(sk_X509_value(peer_certs.get(), i));
        if (!cert->view().isIssuedBy(ca)) continue;
 diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index 5e368e3fd93b560c629aef720acd576f118cb1d6..ea5179ad5155cb599891d7421cd61df719ac4cae 100644
+index c08dab17fa229d1d67d3ad5174c97192989b2bd0..a3d309d832c73ddc79564b9644d825bec7459e7f 100644
 --- a/src/crypto/crypto_context.cc
 +++ b/src/crypto/crypto_context.cc
 @@ -141,7 +141,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
@@ -240,7 +240,7 @@ index 5e368e3fd93b560c629aef720acd576f118cb1d6..ea5179ad5155cb599891d7421cd61df7
        X509* ca = sk_X509_value(extra_certs, i);
  
        // NOTE: Increments reference count on `ca`
-@@ -1752,11 +1752,12 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
+@@ -1773,11 +1773,12 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
    // If the user specified "auto" for dhparams, the JavaScript layer will pass
    // true to this function instead of the original string. Any other string
    // value will be interpreted as custom DH parameters below.
@@ -254,7 +254,7 @@ index 5e368e3fd93b560c629aef720acd576f118cb1d6..ea5179ad5155cb599891d7421cd61df7
    DHPointer dh;
    {
      BIOPointer bio(LoadBIO(env, args[0]));
-@@ -1982,7 +1983,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
+@@ -2003,7 +2004,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
    }
  
    // Add CA certs too
@@ -372,7 +372,7 @@ index c26a88b395abfc645da56231635b36fb23c8fa09..f23cedf4f2449d8edc9a8de1b70332e7
      UNREACHABLE();
    }
 diff --git a/src/crypto/crypto_dsa.cc b/src/crypto/crypto_dsa.cc
-index 471fee77531139ce988292470dff443fdfb05b07..931f7c2ae3d7e12afce471545d610d22f63412d7 100644
+index ca5edc8ebdf2550bb62b7969a5650733a2647f4f..198e18b58f31e361a9d2865cbe81e067e5f0b543 100644
 --- a/src/crypto/crypto_dsa.cc
 +++ b/src/crypto/crypto_dsa.cc
 @@ -43,7 +43,7 @@ namespace crypto {
@@ -520,11 +520,11 @@ index 7c548d32b40365343f0e208c3aa856a1c847f4c3..6346f8f7199cf7b7d3736c59571606ff
  }  // namespace
  
 diff --git a/src/env.h b/src/env.h
-index c42493ad958508f650917bf5ca92088714a5056c..07accfbcca491966c6c8ad9c20e146dbd22347f0 100644
+index 874e5f4d15a75307e45cf70c06fc104fed843a6a..35e16159a94bb97f19d17767e3ad4bb798660f44 100644
 --- a/src/env.h
 +++ b/src/env.h
-@@ -50,7 +50,7 @@
- #include "uv.h"
+@@ -51,7 +51,7 @@
+ #include "v8-profiler.h"
  #include "v8.h"
  
 -#if HAVE_OPENSSL
@@ -532,7 +532,7 @@ index c42493ad958508f650917bf5ca92088714a5056c..07accfbcca491966c6c8ad9c20e146db
  #include <openssl/evp.h>
  #endif
  
-@@ -1076,7 +1076,7 @@ class Environment final : public MemoryRetainer {
+@@ -1077,7 +1077,7 @@ class Environment final : public MemoryRetainer {
      kExitInfoFieldCount
    };
  
@@ -542,11 +542,11 @@ index c42493ad958508f650917bf5ca92088714a5056c..07accfbcca491966c6c8ad9c20e146db
    // We declare another alias here to avoid having to include crypto_util.h
    using EVPMDPointer = DeleteFnPtr<EVP_MD, EVP_MD_free>;
 diff --git a/src/node_metadata.h b/src/node_metadata.h
-index 7b2072ad39c3f1a7c73101b25b69beb781141e26..d23536d88d21255d348175425a59e2424332cd19 100644
+index d9c533f100d25aeab1fe8589932a8ddead431258..2acab8786a8a752b17961445edeb872c2b08fdeb 100644
 --- a/src/node_metadata.h
 +++ b/src/node_metadata.h
-@@ -6,7 +6,7 @@
- #include <string>
+@@ -8,7 +8,7 @@
+ #include <utility>
  #include "node_version.h"
  
 -#if HAVE_OPENSSL
@@ -555,7 +555,7 @@ index 7b2072ad39c3f1a7c73101b25b69beb781141e26..d23536d88d21255d348175425a59e242
  #if NODE_OPENSSL_HAS_QUIC
  #include <openssl/quic.h>
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 249361e351946c16452124029c60fca52782adf9..653112fbaea59fe8b446236085dcae8be671c6e5 100644
+index ed85bf11f6f325823b59b3b0275908f9210c1b24..e3509abbc3bf84ac0edcd495eb3dde6219dbfc2d 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -7,7 +7,7 @@
@@ -568,7 +568,7 @@ index 249361e351946c16452124029c60fca52782adf9..653112fbaea59fe8b446236085dcae8b
  #endif
  
 diff --git a/src/node_options.h b/src/node_options.h
-index 2a1a6aaf9f2d358ffffb0a8171df470686b9450e..3ff1f4b4baa64b8ee2a4587e150ea14cb2fdfdf4 100644
+index cdbd9ca39e907ab22515293eac2c5512223f4ca2..418dee360f867c363f1576012b32213a51c4fdd0 100644
 --- a/src/node_options.h
 +++ b/src/node_options.h
 @@ -11,7 +11,7 @@

patches/node/fix_lazyload_fs_in_esm_loaders_to_apply_asar_patches.patch

@@ -6,7 +6,7 @@ Subject: fix: lazyload fs in esm loaders to apply asar patches
 Changes { foo } from fs to just "fs.foo" so that our patching of fs is applied to esm loaders
 
 diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
-index 3334818153068468967baa5adc1ed2382592ec76..ab4c8a4d00f1813e72f1ea8349850b40f55a393e 100644
+index 3676a9852bcd42de0a3a380de117de58035f757b..eaecfcfd8b922908957c3fefea65fb9deb445249 100644
 --- a/lib/internal/modules/esm/load.js
 +++ b/lib/internal/modules/esm/load.js
 @@ -10,7 +10,7 @@ const {
@@ -50,10 +50,10 @@ index 5aa946f66c71beff0b7a43c30638ab28a1a5dfc0..e3afd30ba1f591d0298793bc42fd7166
      });
      const { search, hash } = resolved;
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 7ea645b92a015b04cc121ff62aa1fc64b2961241..8e099e0961b624c6143f5a60f050855b3366f177 100644
+index c8cea2117080930105b33e4e50586a2c88ef7352..2c33fd44b9a251682de78a8bcdad9ee5a0d3e5e8 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -25,7 +25,7 @@ const {
+@@ -24,7 +24,7 @@ const {
  
  const { BuiltinModule } = require('internal/bootstrap/realm');
  const assert = require('internal/assert');
@@ -62,7 +62,7 @@ index 7ea645b92a015b04cc121ff62aa1fc64b2961241..8e099e0961b624c6143f5a60f050855b
  const { dirname, extname } = require('path');
  const {
    assertBufferSource,
-@@ -274,7 +274,7 @@ translators.set('commonjs', function commonjsStrategy(url, source, isMain) {
+@@ -315,7 +315,7 @@ translators.set('commonjs', function commonjsStrategy(url, source, isMain) {
  
    try {
      // We still need to read the FS to detect the exports.

patches/node/fix_remove_deprecated_errno_constants.patch

@@ -45,7 +45,7 @@ index ac00778cfc59fb55e361b24fc81a965a5e8f97e7..f0c4d6dfc9f03bee59e656b2da9ac325
  # define UV__EUNATCH UV__ERR(EUNATCH)
  #else
 diff --git a/src/node_constants.cc b/src/node_constants.cc
-index 8c44e32381a44675792ca0922e47df1adda48e41..d193725ea9a3270ed9affea12d11467fb14efdf8 100644
+index 0ca643aa74d13f278685d2330b791182b55c15b4..cbcecfba33070b820aca0e2814982160a97a6378 100644
 --- a/src/node_constants.cc
 +++ b/src/node_constants.cc
 @@ -241,10 +241,6 @@ void DefineErrnoConstants(Local<Object> target) {

patches/node/fix_remove_fastapitypedarray_usage.patch

@@ -194,10 +194,10 @@ index e39852c8e0392e0a9ae5d4ea58be115416e19233..c94b14741c827a81d69a6f036426a344
  
  static const v8::CFunction fast_write_string_ascii(
 diff --git a/src/util.h b/src/util.h
-index dbec66247852df91c57c2a4e9664d2fea7d3dcef..efeb12d837db7b88093e4a6a2e20df562180ca1e 100644
+index dcd6548d41be786c42ce8328d89e532a8e9d43a2..7c98de621ca4d53cbaaa5bd4488aab20c7b033a7 100644
 --- a/src/util.h
 +++ b/src/util.h
-@@ -60,6 +60,7 @@
+@@ -62,6 +62,7 @@
  namespace node {
  
  constexpr char kPathSeparator = std::filesystem::path::preferred_separator;
@@ -205,7 +205,7 @@ index dbec66247852df91c57c2a4e9664d2fea7d3dcef..efeb12d837db7b88093e4a6a2e20df56
  
  #ifdef _WIN32
  /* MAX_PATH is in characters, not bytes. Make sure we have enough headroom. */
-@@ -585,6 +586,16 @@ class BufferValue : public MaybeStackBuffer<char> {
+@@ -589,6 +590,16 @@ class BufferValue : public MaybeStackBuffer<char> {
        static_cast<char*>(name->Buffer()->Data()) + name##_offset;              \
    if (name##_length > 0) CHECK_NE(name##_data, nullptr);
  

patches/node/fix_remove_outdated_v8_flags_from_node_cc.patch

@@ -13,7 +13,7 @@ This patch can be removed when we upgrade to a V8 version that
 contains the above CLs.
 
 diff --git a/src/node.cc b/src/node.cc
-index 1b5e989e5456a9bf77475e06250702029568c08d..61d65094aebd7f3016d51a8e7c9c761fc69cecba 100644
+index 07684482f855363e26c3d7299a585a8a5654015e..627337efae49319e2a77b4686176ce92a8493024 100644
 --- a/src/node.cc
 +++ b/src/node.cc
 @@ -816,7 +816,7 @@ static ExitCode ProcessGlobalArgsInternal(std::vector<std::string>* args,

patches/node/refactor_attach_cppgc_heap_on_v8_isolate_creation.patch

@@ -18,10 +18,10 @@ This can be removed when Node.js upgrades to a version of V8 containing CLs
 from the above issue.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 9e1b8d147a99fda962d75c343d0687ffea3c9c69..244d747f010c51366e44dec705ae304423038a85 100644
+index cb37fa080fc8e8d524cfa2758c4a8c2c5652324d..8e227ddd1be50c046a8cf2895a31d607eb7d31de 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -313,6 +313,10 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
+@@ -316,6 +316,10 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
                      MultiIsolatePlatform* platform,
                      const SnapshotData* snapshot_data,
                      const IsolateSettings& settings) {
@@ -32,7 +32,7 @@ index 9e1b8d147a99fda962d75c343d0687ffea3c9c69..244d747f010c51366e44dec705ae3044
    Isolate* isolate = Isolate::Allocate();
    if (isolate == nullptr) return nullptr;
  
-@@ -356,9 +360,12 @@ Isolate* NewIsolate(ArrayBufferAllocator* allocator,
+@@ -359,9 +363,12 @@ Isolate* NewIsolate(ArrayBufferAllocator* allocator,
                      uv_loop_t* event_loop,
                      MultiIsolatePlatform* platform,
                      const EmbedderSnapshotData* snapshot_data,
@@ -47,10 +47,10 @@ index 9e1b8d147a99fda962d75c343d0687ffea3c9c69..244d747f010c51366e44dec705ae3044
                      event_loop,
                      platform,
 diff --git a/src/env.cc b/src/env.cc
-index b6ad3ca99c8b0c656ce726fbc3455ba554bc3bd1..0922f7fb9c120482b6ee825f5f1ad10dea11fe30 100644
+index 20aad98e7af155d18fcfde167b1f465392298a6f..5fa667382bc957aee800d612f78b18c37a58c67f 100644
 --- a/src/env.cc
 +++ b/src/env.cc
-@@ -577,14 +577,6 @@ IsolateData::IsolateData(Isolate* isolate,
+@@ -578,14 +578,6 @@ IsolateData::IsolateData(Isolate* isolate,
    // We do not care about overflow since we just want this to be different
    // from the cppgc id.
    uint16_t non_cppgc_id = cppgc_id + 1;
@@ -65,7 +65,7 @@ index b6ad3ca99c8b0c656ce726fbc3455ba554bc3bd1..0922f7fb9c120482b6ee825f5f1ad10d
    {
      // GC could still be run after the IsolateData is destroyed, so we store
      // the ids in a static map to ensure pointers to them are still valid
-@@ -607,15 +599,6 @@ IsolateData::IsolateData(Isolate* isolate,
+@@ -608,15 +600,6 @@ IsolateData::IsolateData(Isolate* isolate,
    }
  }
  
@@ -82,10 +82,10 @@ index b6ad3ca99c8b0c656ce726fbc3455ba554bc3bd1..0922f7fb9c120482b6ee825f5f1ad10d
  void SetCppgcReference(Isolate* isolate,
                         Local<Object> object,
 diff --git a/src/env.h b/src/env.h
-index 1079e3beb02e5f5d71a15fd2db65cb93ebd175d6..a7be609c3ab9093cec5145367b95ae6859936a24 100644
+index 2d5fa8dbd75851bca30453548f6cbe0159509f26..c346e3a9c827993036438685d758a734f9ce8c05 100644
 --- a/src/env.h
 +++ b/src/env.h
-@@ -155,7 +155,6 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
+@@ -157,7 +157,6 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
        ArrayBufferAllocator* node_allocator = nullptr,
        const EmbedderSnapshotData* embedder_snapshot_data = nullptr,
        std::shared_ptr<PerIsolateOptions> options = nullptr);
@@ -93,7 +93,7 @@ index 1079e3beb02e5f5d71a15fd2db65cb93ebd175d6..a7be609c3ab9093cec5145367b95ae68
  
    SET_MEMORY_INFO_NAME(IsolateData)
    SET_SELF_SIZE(IsolateData)
-@@ -258,7 +257,6 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
+@@ -260,7 +259,6 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
    const SnapshotData* snapshot_data_;
    std::optional<SnapshotConfig> snapshot_config_;
  
@@ -102,10 +102,10 @@ index 1079e3beb02e5f5d71a15fd2db65cb93ebd175d6..a7be609c3ab9093cec5145367b95ae68
    worker::Worker* worker_context_ = nullptr;
    PerIsolateWrapperData* wrapper_data_;
 diff --git a/src/node.cc b/src/node.cc
-index 61d65094aebd7f3016d51a8e7c9c761fc69cecba..0d383dcdb80fe30e3c2d6880b44f626f065bb1f3 100644
+index 627337efae49319e2a77b4686176ce92a8493024..f0c0b6229048a2e9bc05684fab44ab09bc34e1f6 100644
 --- a/src/node.cc
 +++ b/src/node.cc
-@@ -1271,6 +1271,14 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
+@@ -1295,6 +1295,14 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
      result->platform_ = per_process::v8_platform.Platform();
    }
  
@@ -120,7 +120,7 @@ index 61d65094aebd7f3016d51a8e7c9c761fc69cecba..0d383dcdb80fe30e3c2d6880b44f626f
    if (!(flags & ProcessInitializationFlags::kNoInitializeV8)) {
      V8::Initialize();
  
-@@ -1280,14 +1288,6 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
+@@ -1304,14 +1312,6 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
      absl::SetMutexDeadlockDetectionMode(absl::OnDeadlockCycle::kIgnore);
    }
  
@@ -136,7 +136,7 @@ index 61d65094aebd7f3016d51a8e7c9c761fc69cecba..0d383dcdb80fe30e3c2d6880b44f626f
    bool use_wasm_trap_handler =
        !per_process::cli_options->disable_wasm_trap_handler;
 diff --git a/src/node.h b/src/node.h
-index 42d55d24bd0770795ae0c0e19241d25a6350ae08..4335c7cf53b7e08c95dcee3461384ac12c8ebe41 100644
+index d3a965661d068db359bb1bb4b14e59c28bb615f9..16a0c71aef949b0ddd27def9dc843298f9a6b75f 100644
 --- a/src/node.h
 +++ b/src/node.h
 @@ -590,7 +590,8 @@ NODE_EXTERN v8::Isolate* NewIsolate(
@@ -174,10 +174,10 @@ index 4119ac1b002681d39711eac810ca2fcc2702ffc7..790347056cde949ffe6cf8498a7eca0c
  
  ExitCode NodeMainInstance::Run() {
 diff --git a/src/node_worker.cc b/src/node_worker.cc
-index e2dbdd39b06c4f2f85eba46cbf1383af144456c6..6c43928ba5a9752c78544d1c77198278eb11ccd7 100644
+index 29c4b1de42b3127a98871d200c80197bf974b31f..8555ab556b5b74a1cf9cf30747f1f417bfe4e4d9 100644
 --- a/src/node_worker.cc
 +++ b/src/node_worker.cc
-@@ -163,6 +163,9 @@ class WorkerThreadData {
+@@ -177,6 +177,9 @@ class WorkerThreadData {
      SetIsolateCreateParamsForNode(&params);
      w->UpdateResourceConstraints(&params.constraints);
      params.array_buffer_allocator_shared = allocator;
@@ -187,7 +187,7 @@ index e2dbdd39b06c4f2f85eba46cbf1383af144456c6..6c43928ba5a9752c78544d1c77198278
      Isolate* isolate =
          NewIsolate(&params, &loop_, w->platform_, w->snapshot_data());
      if (isolate == nullptr) {
-@@ -231,13 +234,8 @@ class WorkerThreadData {
+@@ -245,13 +248,8 @@ class WorkerThreadData {
          *static_cast<bool*>(data) = true;
        }, &platform_finished);
  

patches/node/src_do_not_use_soon-to-be-deprecated_v8_api.patch

@@ -33,7 +33,7 @@ Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 Reviewed-By: James M Snell <jasnell@gmail.com>
 
 diff --git a/src/node_process_object.cc b/src/node_process_object.cc
-index 7dd24545fee674b25503b0fcff9b9af0d5c6a26a..5de8be7f8ed97e6b110e397fc4cacb9a246892b6 100644
+index 2e0d180d249c6925c761cb673a4a396905cc971c..5bf854723040859f841608f40ac43ea3d4a44b1e 100644
 --- a/src/node_process_object.cc
 +++ b/src/node_process_object.cc
 @@ -13,7 +13,6 @@
@@ -44,7 +44,7 @@ index 7dd24545fee674b25503b0fcff9b9af0d5c6a26a..5de8be7f8ed97e6b110e397fc4cacb9a
  using v8::EscapableHandleScope;
  using v8::Function;
  using v8::FunctionCallbackInfo;
-@@ -186,13 +185,12 @@ void PatchProcessObject(const FunctionCallbackInfo<Value>& args) {
+@@ -168,13 +167,12 @@ void PatchProcessObject(const FunctionCallbackInfo<Value>& args) {
  
    // process.title
    CHECK(process
@@ -59,7 +59,7 @@ index 7dd24545fee674b25503b0fcff9b9af0d5c6a26a..5de8be7f8ed97e6b110e397fc4cacb9a
                  None,
                  SideEffectType::kHasNoSideEffect)
              .FromJust());
-@@ -211,9 +209,15 @@ void PatchProcessObject(const FunctionCallbackInfo<Value>& args) {
+@@ -193,9 +191,15 @@ void PatchProcessObject(const FunctionCallbackInfo<Value>& args) {
    READONLY_PROPERTY(process, "pid",
                      Integer::New(isolate, uv_os_getpid()));
  
@@ -78,7 +78,7 @@ index 7dd24545fee674b25503b0fcff9b9af0d5c6a26a..5de8be7f8ed97e6b110e397fc4cacb9a
  
    // --security-revert flags
  #define V(code, _, __)                                                        \
-@@ -238,12 +242,15 @@ void PatchProcessObject(const FunctionCallbackInfo<Value>& args) {
+@@ -220,12 +224,15 @@ void PatchProcessObject(const FunctionCallbackInfo<Value>& args) {
  
    // process.debugPort
    CHECK(process

patches/node/src_remove_dependency_on_wrapper-descriptor-based_cppheap.patch

@@ -16,7 +16,7 @@ patch:
 (cherry picked from commit 30329d06235a9f9733b1d4da479b403462d1b326)
 
 diff --git a/src/env-inl.h b/src/env-inl.h
-index 0d32d9f5a55da257a5e5a895a2ff002b780f96fe..9567d9499c62ea44cca651e87ab912ad55e2d90b 100644
+index 67b4cc2037b8e02f6382cd12a7abb157d0dbac65..4906c6c4c0ab5260d6e6387d0ed8e0687f982a38 100644
 --- a/src/env-inl.h
 +++ b/src/env-inl.h
 @@ -62,31 +62,6 @@ inline uv_loop_t* IsolateData::event_loop() const {
@@ -52,7 +52,7 @@ index 0d32d9f5a55da257a5e5a895a2ff002b780f96fe..9567d9499c62ea44cca651e87ab912ad
    return &(wrapper_data_->cppgc_id);
  }
 diff --git a/src/env.cc b/src/env.cc
-index 63fdeeb26ba89284e74ca37050dfd170e7963331..b6ad3ca99c8b0c656ce726fbc3455ba554bc3bd1 100644
+index 926645dc647fe7ca01165462f08eac1ade71ac4e..20aad98e7af155d18fcfde167b1f465392298a6f 100644
 --- a/src/env.cc
 +++ b/src/env.cc
 @@ -23,6 +23,7 @@
@@ -71,7 +71,7 @@ index 63fdeeb26ba89284e74ca37050dfd170e7963331..b6ad3ca99c8b0c656ce726fbc3455ba5
  using worker::Worker;
  
  int const ContextEmbedderTag::kNodeContextTag = 0x6e6f64;
-@@ -529,6 +529,14 @@ void IsolateData::CreateProperties() {
+@@ -530,6 +530,14 @@ void IsolateData::CreateProperties() {
    CreateEnvProxyTemplate(this);
  }
  
@@ -86,7 +86,7 @@ index 63fdeeb26ba89284e74ca37050dfd170e7963331..b6ad3ca99c8b0c656ce726fbc3455ba5
  constexpr uint16_t kDefaultCppGCEmbedderID = 0x90de;
  Mutex IsolateData::isolate_data_mutex_;
  std::unordered_map<uint16_t, std::unique_ptr<PerIsolateWrapperData>>
-@@ -566,36 +574,16 @@ IsolateData::IsolateData(Isolate* isolate,
+@@ -567,36 +575,16 @@ IsolateData::IsolateData(Isolate* isolate,
    v8::CppHeap* cpp_heap = isolate->GetCppHeap();
  
    uint16_t cppgc_id = kDefaultCppGCEmbedderID;
@@ -130,7 +130,7 @@ index 63fdeeb26ba89284e74ca37050dfd170e7963331..b6ad3ca99c8b0c656ce726fbc3455ba5
  
    {
      // GC could still be run after the IsolateData is destroyed, so we store
-@@ -628,11 +616,12 @@ IsolateData::~IsolateData() {
+@@ -629,11 +617,12 @@ IsolateData::~IsolateData() {
    }
  }
  
@@ -146,10 +146,10 @@ index 63fdeeb26ba89284e74ca37050dfd170e7963331..b6ad3ca99c8b0c656ce726fbc3455ba5
  
  void IsolateData::MemoryInfo(MemoryTracker* tracker) const {
 diff --git a/src/env.h b/src/env.h
-index 07accfbcca491966c6c8ad9c20e146dbd22347f0..1079e3beb02e5f5d71a15fd2db65cb93ebd175d6 100644
+index 35e16159a94bb97f19d17767e3ad4bb798660f44..2d5fa8dbd75851bca30453548f6cbe0159509f26 100644
 --- a/src/env.h
 +++ b/src/env.h
-@@ -175,10 +175,6 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
+@@ -177,10 +177,6 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
    uint16_t* embedder_id_for_cppgc() const;
    uint16_t* embedder_id_for_non_cppgc() const;
  
@@ -161,10 +161,10 @@ index 07accfbcca491966c6c8ad9c20e146dbd22347f0..1079e3beb02e5f5d71a15fd2db65cb93
    inline MultiIsolatePlatform* platform() const;
    inline const SnapshotData* snapshot_data() const;
 diff --git a/src/node.h b/src/node.h
-index 174fd4d1af4c8cd75aec09f4548a674fd5539fb2..42d55d24bd0770795ae0c0e19241d25a6350ae08 100644
+index 96c599aa6448e2aa8e57e84f811564a5281c139a..d3a965661d068db359bb1bb4b14e59c28bb615f9 100644
 --- a/src/node.h
 +++ b/src/node.h
-@@ -1560,24 +1560,14 @@ void RegisterSignalHandler(int signal,
+@@ -1576,24 +1576,14 @@ void RegisterSignalHandler(int signal,
                             bool reset_handler = false);
  #endif  // _WIN32
  

patches/node/support_v8_sandboxed_pointers.patch

@@ -7,10 +7,10 @@ This refactors several allocators to allocate within the V8 memory cage,
 allowing them to be compatible with the V8_SANDBOXED_POINTERS feature.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 50accbf4052da11d47a5200997f1098ed9d85354..9e1b8d147a99fda962d75c343d0687ffea3c9c69 100644
+index fd71ceac65ccef1d2832b45b0b5612877cee22c1..cb37fa080fc8e8d524cfa2758c4a8c2c5652324d 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -103,6 +103,14 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,
+@@ -106,6 +106,14 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,
    return result;
  }
  
@@ -143,10 +143,10 @@ index 6346f8f7199cf7b7d3736c59571606fff102fbb6..7eea2eaefcad5780663a6b87985925ae
  void SecureHeapUsed(const FunctionCallbackInfo<Value>& args) {
  #ifndef OPENSSL_IS_BORINGSSL
 diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
-index 1592134716da2de40de4ba028ee937b765423e37..8f3ba65f1fef2c066d6df6087a08ba71100d1090 100644
+index ebc7fddeccf04a92c610849b626b33f900d63493..ed7d202d1b041f8a6cd43ae767d696fb29ab9cd9 100644
 --- a/src/crypto/crypto_util.h
 +++ b/src/crypto/crypto_util.h
-@@ -242,7 +242,7 @@ class ByteSource {
+@@ -243,7 +243,7 @@ class ByteSource {
    // Creates a v8::BackingStore that takes over responsibility for
    // any allocated data. The ByteSource will be reset with size = 0
    // after being called.
@@ -229,10 +229,10 @@ index 61b6ecd240c9500f21f683065a2f920af3afb502..ad2b1c76325cb5c8f18a618c5a85ae87
  
  constexpr const char* EncodingName(const enum encoding encoding) {
 diff --git a/src/node_internals.h b/src/node_internals.h
-index 275534285ec28f02b46639142ab4195b24267476..5f9d123f9d4b9feb7bc0b627b1e6309fdbd6e30d 100644
+index 12ea72b61b0a5e194207bb369dfed4b8667107cb..64442215714a98f648971e517ddd9c77e38fe3f2 100644
 --- a/src/node_internals.h
 +++ b/src/node_internals.h
-@@ -120,7 +120,9 @@ v8::MaybeLocal<v8::Object> InitializePrivateSymbols(
+@@ -121,7 +121,9 @@ v8::MaybeLocal<v8::Object> InitializePrivateSymbols(
  
  class NodeArrayBufferAllocator : public ArrayBufferAllocator {
   public:
@@ -243,7 +243,7 @@ index 275534285ec28f02b46639142ab4195b24267476..5f9d123f9d4b9feb7bc0b627b1e6309f
  
    void* Allocate(size_t size) override;  // Defined in src/node.cc
    void* AllocateUninitialized(size_t size) override;
-@@ -138,7 +140,7 @@ class NodeArrayBufferAllocator : public ArrayBufferAllocator {
+@@ -139,7 +141,7 @@ class NodeArrayBufferAllocator : public ArrayBufferAllocator {
    }
  
   private:

patches/node/test_formally_mark_some_tests_as_flaky.patch

@@ -7,7 +7,7 @@ Instead of disabling the tests, flag them as flaky so they still run
 but don't cause CI failures on flakes.
 
 diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
-index 0546a81ef11ec7ac8d6e214e4090b0e7b94bf70f..25b08be32c7a0aa501b64102f10c9bffc8c57970 100644
+index 67c0c04d2365e59db111258d008f8c73173e3e96..a4204e7580e7823399f6057d57c09cba56b5ff78 100644
 --- a/test/parallel/parallel.status
 +++ b/test/parallel/parallel.status
 @@ -5,6 +5,16 @@ prefix parallel
@@ -28,7 +28,7 @@ index 0546a81ef11ec7ac8d6e214e4090b0e7b94bf70f..25b08be32c7a0aa501b64102f10c9bff
  test-net-write-fully-async-hex-string: PASS, FLAKY
  # https://github.com/nodejs/node/issues/52273
 diff --git a/test/sequential/sequential.status b/test/sequential/sequential.status
-index 6893abfe6e1c03d455099099f0d7e6b6930372a6..24aab3bad500ce4b9d43bf693c5efa6d563fe858 100644
+index 4ae3b6c5fd2eb633ae78bed1824046d862d7579b..d291954d4451b63aeb2bf46232e8705150eb9e79 100644
 --- a/test/sequential/sequential.status
 +++ b/test/sequential/sequential.status
 @@ -7,6 +7,18 @@ prefix sequential

script/build-stats.mjs

@@ -0,0 +1,96 @@
+import * as fs from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { parseArgs } from 'node:util';
+
+async function main () {
+  const { positionals: [filename], values: { 'upload-stats': uploadStats } } = parseArgs({
+    allowPositionals: true,
+    options: {
+      'upload-stats': {
+        type: 'boolean',
+        default: false
+      }
+    }
+  });
+
+  if (!filename) {
+    throw new Error('filename is required (should be a siso.INFO file)');
+  }
+
+  const log = await fs.readFile(filename, 'utf-8');
+
+  // We expect to find a line which looks like stats=build.Stats{..., CacheHit:39008, Local:4778, Remote:0, LocalFallback:0, ...}
+  const match = log.match(/stats=build\.Stats{(.*)}/);
+
+  if (!match) {
+    throw new Error('could not find stats=build.Stats in log');
+  }
+
+  const stats = Object.fromEntries(match[1].split(',').map(part => {
+    const [key, value] = part.trim().split(':');
+    return [key, parseInt(value)];
+  }));
+  const hitRate = stats.CacheHit / (stats.Remote + stats.CacheHit + stats.LocalFallback);
+
+  console.log(`Effective cache hit rate: ${(hitRate * 100).toFixed(2)}%`);
+
+  if (uploadStats) {
+    if (!process.env.DD_API_KEY) {
+      throw new Error('DD_API_KEY is not set');
+    }
+
+    const timestamp = Math.round(new Date().getTime() / 1000);
+
+    const tags = [];
+
+    if (process.env.TARGET_ARCH) tags.push(`target-arch:${process.env.TARGET_ARCH}`);
+    if (process.env.TARGET_PLATFORM) tags.push(`target-platform:${process.env.TARGET_PLATFORM}`);
+    if (process.env.GITHUB_HEAD_REF) {
+      // Will be set in pull requests
+      tags.push(`branch:${process.env.GITHUB_HEAD_REF}`);
+    } else if (process.env.GITHUB_REF_NAME) {
+      // Will be set for release branches
+      tags.push(`branch:${process.env.GITHUB_REF_NAME}`);
+    }
+
+    const series = [
+      {
+        metric: 'electron.build.effective-cache-hit-rate',
+        points: [{ timestamp, value: (hitRate * 100).toFixed(2) }],
+        type: 3, // GAUGE
+        unit: 'percent',
+        tags
+      }
+    ];
+
+    // Add all raw stats as individual metrics
+    for (const [key, value] of Object.entries(stats)) {
+      series.push({
+        metric: `electron.build.stats.${key.toLowerCase()}`,
+        points: [{ timestamp, value }],
+        type: 1, // COUNT
+        tags
+      });
+    }
+
+    await fetch('https://api.datadoghq.com/api/v2/series', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'DD-API-KEY': process.env.DD_API_KEY
+      },
+      body: JSON.stringify({ series })
+    });
+  }
+}
+
+if ((await fs.realpath(process.argv[1])) === fileURLToPath(import.meta.url)) {
+  main()
+    .then(() => {
+      process.exit(0);
+    })
+    .catch((err) => {
+      console.error(`ERROR: ${err.message}`);
+      process.exit(1);
+    });
+}

script/gn-check.js

@@ -33,7 +33,9 @@ const gnCheckDirs = [
   '//electron:electron_lib',
   '//electron:electron_app',
   '//electron/shell/common:mojo',
-  '//electron/shell/common:plugin'
+  '//electron/shell/common:plugin',
+  '//electron:testing_build',
+  '//electron:release_build'
 ];
 
 for (const dir of gnCheckDirs) {

script/release/notes/notes.ts

@@ -684,7 +684,7 @@ function renderTrops (commit: Commit, excludeBranch: string) {
     .map(([branch, key]) => renderTrop(branch, key))
     .join(', ');
   return body
-    ? `<span style="font-size:small;">(Also in ${body})</span>`
+    ? `<sup>(Also in ${body})</sup>`
     : body;
 }
 

script/release/release.ts

@@ -210,8 +210,10 @@ function assetsForVersion (version: string, validatingRelease: boolean) {
 const cloudStoreFilePaths = (version: string) => [
   `iojs-${version}-headers.tar.gz`,
   `iojs-${version}.tar.gz`,
+  `node-${version}-headers.tar.gz`,
   `node-${version}.tar.gz`,
   'node.lib',
+  'arm64/node.lib',
   'x64/node.lib',
   'win-x64/iojs.lib',
   'win-x86/iojs.lib',
@@ -219,7 +221,6 @@ const cloudStoreFilePaths = (version: string) => [
   'win-x64/node.lib',
   'win-x86/node.lib',
   'win-arm64/node.lib',
-  'arm64/node.lib',
   'SHASUMS.txt',
   'SHASUMS256.txt'
 ];

script/release/uploaders/upload-to-github.ts

@@ -48,7 +48,7 @@ const targetRepo = getRepo();
 const uploadUrl = `https://uploads.github.com/repos/electron/${targetRepo}/releases/${releaseId}/assets{?name,label}`;
 let retry = 0;
 
-const octokit = new Octokit({
+let octokit = new Octokit({
   authStrategy: createGitHubTokenStrategy(targetRepo),
   log: console
 });
@@ -73,6 +73,12 @@ function uploadToGitHub () {
       console.log(`Error uploading ${fileName} to GitHub, will retry.  Error was:`, err);
       retry++;
 
+      // Reset octokit in case it cached an auth error somehow
+      octokit = new Octokit({
+        authStrategy: createGitHubTokenStrategy(targetRepo),
+        log: console
+      });
+
       octokit.repos.listReleaseAssets({
         owner: ELECTRON_ORG,
         repo: targetRepo,
@@ -98,6 +104,7 @@ function uploadToGitHub () {
         }
       }).catch((getReleaseErr) => {
         console.log('Fatal: Unable to get current release assets via getRelease!  Error was:', getReleaseErr);
+        process.exitCode = 1;
       });
     } else {
       console.log(`Error retrying uploading ${fileName} to GitHub:`, err);

script/spec-runner.js

@@ -2,6 +2,7 @@
 
 const { ElectronVersions, Installer } = require('@electron/fiddle-core');
 
+const { DOMParser } = require('@xmldom/xmldom');
 const chalk = require('chalk');
 const { hashElement } = require('folder-hash');
 const minimist = require('minimist');
@@ -21,6 +22,7 @@ const FAILURE_STATUS_KEY = 'Electron_Spec_Runner_Failures';
 
 const args = minimist(process.argv, {
   string: ['runners', 'target', 'electronVersion'],
+  number: ['enableRerun'],
   unknown: arg => unknownFlags.push(arg)
 });
 
@@ -191,7 +193,160 @@ async function asyncSpawn (exe, runnerArgs) {
   });
 }
 
-async function runTestUsingElectron (specDir, testName) {
+function parseJUnitXML (specDir) {
+  if (!fs.existsSync(process.env.MOCHA_FILE)) {
+    console.error('JUnit XML file not found:', process.env.MOCHA_FILE);
+    return [];
+  }
+
+  const xmlContent = fs.readFileSync(process.env.MOCHA_FILE, 'utf8');
+  const parser = new DOMParser();
+  const xmlDoc = parser.parseFromString(xmlContent, 'text/xml');
+
+  const failedTests = [];
+  // find failed tests by looking for all testsuite nodes with failure > 0
+  const testSuites = xmlDoc.getElementsByTagName('testsuite');
+  for (let i = 0; i < testSuites.length; i++) {
+    const testSuite = testSuites[i];
+    const failures = testSuite.getAttribute('failures');
+    if (failures > 0) {
+      const testcases = testSuite.getElementsByTagName('testcase');
+
+      for (let i = 0; i < testcases.length; i++) {
+        const testcase = testcases[i];
+        const failures = testcase.getElementsByTagName('failure');
+        const errors = testcase.getElementsByTagName('error');
+
+        if (failures.length > 0 || errors.length > 0) {
+          const testName = testcase.getAttribute('name');
+          const filePath = testSuite.getAttribute('file');
+          const fileName = filePath ? path.relative(specDir, filePath) : 'unknown file';
+          const failureInfo = {
+            name: testName,
+            file: fileName,
+            filePath
+          };
+          if (failures.length > 0) {
+            failureInfo.failure = failures[0].textContent || failures[0].nodeValue || 'No failure message';
+          }
+
+          if (errors.length > 0) {
+            failureInfo.error = errors[0].textContent || errors[0].nodeValue || 'No error message';
+          }
+
+          failedTests.push(failureInfo);
+        }
+      }
+    }
+  }
+
+  return failedTests;
+}
+
+async function rerunFailedTest (specDir, testName, testInfo) {
+  console.log('\n========================================');
+  console.log(`Rerunning failed test: ${testInfo.name} (${testInfo.file})`);
+  console.log('========================================');
+
+  let grepPattern = testInfo.name;
+
+  // Escape special regex characters in test name
+  grepPattern = grepPattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+  const args = [];
+  if (testInfo.filePath) {
+    args.push('--files', testInfo.filePath);
+  }
+  args.push('-g', grepPattern);
+
+  const success = await runTestUsingElectron(specDir, testName, false, args);
+
+  if (success) {
+    console.log(`✅ Test passed: ${testInfo.name}`);
+    return true;
+  } else {
+    console.log(`❌ Test failed again: ${testInfo.name}`);
+    return false;
+  }
+}
+
+async function rerunFailedTests (specDir, testName) {
+  console.log('\n📋 Parsing JUnit XML for failed tests...');
+  const failedTests = parseJUnitXML(specDir);
+
+  if (failedTests.length === 0) {
+    console.log('No failed tests could be found.');
+    process.exit(1);
+    return;
+  }
+
+  // Save off the original junit xml file
+  if (fs.existsSync(process.env.MOCHA_FILE)) {
+    fs.copyFileSync(process.env.MOCHA_FILE, `${process.env.MOCHA_FILE}.save`);
+  }
+
+  console.log(`\n📊 Found ${failedTests.length} failed test(s):`);
+  failedTests.forEach((test, index) => {
+    console.log(`  ${index + 1}. ${test.name} (${test.file})`);
+  });
+
+  // Step 3: Rerun each failed test individually
+  console.log('\n🔄 Rerunning failed tests individually...\n');
+
+  const results = {
+    total: failedTests.length,
+    passed: 0,
+    failed: 0
+  };
+
+  let index = 0;
+  for (const testInfo of failedTests) {
+    let runCount = 0;
+    let success = false;
+    let retryTest = false;
+    while (!success && (runCount < args.enableRerun)) {
+      success = await rerunFailedTest(specDir, testName, testInfo);
+      if (success) {
+        results.passed++;
+      } else {
+        if (runCount === args.enableRerun - 1) {
+          results.failed++;
+        } else {
+          retryTest = true;
+          console.log(`Retrying test (${runCount + 1}/${args.enableRerun})...`);
+        }
+      }
+
+      // Add a small delay between tests
+      if (retryTest || index < failedTests.length - 1) {
+        console.log('\nWaiting 2 seconds before next test...');
+        await new Promise(resolve => setTimeout(resolve, 2000));
+      }
+      runCount++;
+    }
+    index++;
+  };
+
+  // Step 4: Summary
+  console.log('\n📈 Summary:');
+  console.log(`Total failed tests: ${results.total}`);
+  console.log(`Passed on rerun: ${results.passed}`);
+  console.log(`Still failing: ${results.failed}`);
+
+  // Restore the original junit xml file
+  if (fs.existsSync(`${process.env.MOCHA_FILE}.save`)) {
+    fs.renameSync(`${process.env.MOCHA_FILE}.save`, process.env.MOCHA_FILE);
+  }
+
+  if (results.failed === 0) {
+    console.log('🎉 All previously failed tests now pass!');
+  } else {
+    console.log(`⚠️  ${results.failed} test(s) are still failing`);
+    process.exit(1);
+  }
+}
+
+async function runTestUsingElectron (specDir, testName, shouldRerun, additionalArgs = []) {
   let exe;
   if (args.electronVersion) {
     const installer = new Installer();
@@ -199,11 +354,16 @@ async function runTestUsingElectron (specDir, testName) {
   } else {
     exe = path.resolve(BASE, utils.getElectronExec());
   }
-  const runnerArgs = [`electron/${specDir}`, ...unknownArgs.slice(2)];
+  let argsToPass = unknownArgs.slice(2);
+  if (additionalArgs.includes('--files')) {
+    argsToPass = argsToPass.filter(arg => (arg.toString().indexOf('--files') === -1 && arg.toString().indexOf('spec/') === -1));
+  }
+  const runnerArgs = [`electron/${specDir}`, ...argsToPass, ...additionalArgs];
   if (process.platform === 'linux') {
     runnerArgs.unshift(path.resolve(__dirname, 'dbus_mock.py'), exe);
     exe = 'python3';
   }
+  console.log(`Running: ${exe} ${runnerArgs.join(' ')}`);
   const { status, signal } = await asyncSpawn(exe, runnerArgs);
   if (status !== 0) {
     if (status) {
@@ -212,13 +372,22 @@ async function runTestUsingElectron (specDir, testName) {
     } else {
       console.log(`${fail} Electron tests failed with kill signal ${signal}.`);
     }
-    process.exit(1);
+    if (shouldRerun) {
+      await rerunFailedTests(specDir, testName);
+    } else {
+      return false;
+    }
   }
   console.log(`${pass} Electron ${testName} process tests passed.`);
+  return true;
 }
 
 async function runMainProcessElectronTests () {
-  await runTestUsingElectron('spec', 'main');
+  let shouldRerun = false;
+  if (args.enableRerun && args.enableRerun > 0) {
+    shouldRerun = true;
+  }
+  await runTestUsingElectron('spec', 'main', shouldRerun);
 }
 
 async function installSpecModules (dir) {

script/zip_manifests/dist_zip.win.arm64.manifest

@@ -8,6 +8,8 @@ ffmpeg.dll
 icudtl.dat
 libEGL.dll
 libGLESv2.dll
+dxil.dll
+dxcompiler.dll
 locales/af.pak
 locales/am.pak
 locales/ar.pak

script/zip_manifests/dist_zip.win.x64.manifest

@@ -8,6 +8,8 @@ ffmpeg.dll
 icudtl.dat
 libEGL.dll
 libGLESv2.dll
+dxil.dll
+dxcompiler.dll
 locales/af.pak
 locales/am.pak
 locales/ar.pak

shell/browser/api/electron_api_app.cc

@@ -1163,6 +1163,86 @@ bool App::IsAccessibilitySupportEnabled() {
   return mode.has_mode(ui::kAXModeComplete.flags());
 }
 
+v8::Local<v8::Value> App::GetAccessibilitySupportFeatures() {
+  v8::Isolate* isolate = JavascriptEnvironment::GetIsolate();
+  v8::EscapableHandleScope handle_scope(isolate);
+  auto* ax_state = content::BrowserAccessibilityState::GetInstance();
+  ui::AXMode mode = ax_state->GetAccessibilityMode();
+
+  std::vector<v8::Local<v8::Value>> features;
+  auto push = [&](const char* name) {
+    features.push_back(v8::String::NewFromUtf8(isolate, name).ToLocalChecked());
+  };
+
+  if (mode.has_mode(ui::AXMode::kNativeAPIs))
+    push("nativeAPIs");
+  if (mode.has_mode(ui::AXMode::kWebContents))
+    push("webContents");
+  if (mode.has_mode(ui::AXMode::kInlineTextBoxes))
+    push("inlineTextBoxes");
+  if (mode.has_mode(ui::AXMode::kExtendedProperties))
+    push("extendedProperties");
+  if (mode.has_mode(ui::AXMode::kHTML))
+    push("html");
+  if (mode.has_mode(ui::AXMode::kLabelImages))
+    push("labelImages");
+  if (mode.has_mode(ui::AXMode::kPDFPrinting))
+    push("pdfPrinting");
+  if (mode.has_mode(ui::AXMode::kScreenReader))
+    push("screenReader");
+
+  v8::Local<v8::Array> arr = v8::Array::New(isolate, features.size());
+  for (uint32_t i = 0; i < features.size(); ++i) {
+    arr->Set(isolate->GetCurrentContext(), i, features[i]).Check();
+  }
+  return handle_scope.Escape(arr);
+}
+
+void App::SetAccessibilitySupportFeatures(
+    gin_helper::ErrorThrower thrower,
+    const std::vector<std::string>& features) {
+  if (!Browser::Get()->is_ready()) {
+    thrower.ThrowError(
+        "app.setAccessibilitySupportFeatures() can only be called after app "
+        "is ready");
+    return;
+  }
+
+  ui::AXMode mode;
+  for (const auto& f : features) {
+    if (f == "nativeAPIs") {
+      mode.set_mode(ui::AXMode::kNativeAPIs, true);
+    } else if (f == "webContents") {
+      mode.set_mode(ui::AXMode::kWebContents, true);
+    } else if (f == "inlineTextBoxes") {
+      mode.set_mode(ui::AXMode::kInlineTextBoxes, true);
+    } else if (f == "extendedProperties") {
+      mode.set_mode(ui::AXMode::kExtendedProperties, true);
+    } else if (f == "screenReader") {
+      mode.set_mode(ui::AXMode::kScreenReader, true);
+    } else if (f == "html") {
+      mode.set_mode(ui::AXMode::kHTML, true);
+    } else if (f == "labelImages") {
+      mode.set_mode(ui::AXMode::kLabelImages, true);
+    } else if (f == "pdfPrinting") {
+      mode.set_mode(ui::AXMode::kPDFPrinting, true);
+    } else {
+      thrower.ThrowError("Unknown accessibility feature: " + f);
+      return;
+    }
+  }
+
+  if (mode.is_mode_off()) {
+    scoped_accessibility_mode_.reset();
+  } else {
+    scoped_accessibility_mode_ =
+        content::BrowserAccessibilityState::GetInstance()
+            ->CreateScopedModeForProcess(mode);
+  }
+
+  Browser::Get()->OnAccessibilitySupportChanged();
+}
+
 void App::SetAccessibilitySupportEnabled(gin_helper::ErrorThrower thrower,
                                          bool enabled) {
   if (!Browser::Get()->is_ready()) {
@@ -1821,6 +1901,10 @@ gin::ObjectTemplateBuilder App::GetObjectTemplateBuilder(v8::Isolate* isolate) {
       .SetMethod("relaunch", &App::Relaunch)
       .SetMethod("isAccessibilitySupportEnabled",
                  &App::IsAccessibilitySupportEnabled)
+      .SetMethod("getAccessibilitySupportFeatures",
+                 &App::GetAccessibilitySupportFeatures)
+      .SetMethod("setAccessibilitySupportFeatures",
+                 &App::SetAccessibilitySupportFeatures)
       .SetMethod("setAccessibilitySupportEnabled",
                  &App::SetAccessibilitySupportEnabled)
       .SetMethod("disableHardwareAcceleration",

shell/browser/api/electron_api_app.h

@@ -209,6 +209,10 @@ class App final : public ElectronBrowserClient::Delegate,
   void DisableHardwareAcceleration(gin_helper::ErrorThrower thrower);
   void DisableDomainBlockingFor3DAPIs(gin_helper::ErrorThrower thrower);
   bool IsAccessibilitySupportEnabled();
+  v8::Local<v8::Value> GetAccessibilitySupportFeatures();
+  void SetAccessibilitySupportFeatures(
+      gin_helper::ErrorThrower thrower,
+      const std::vector<std::string>& features);
   void SetAccessibilitySupportEnabled(gin_helper::ErrorThrower thrower,
                                       bool enabled);
   v8::Local<v8::Value> GetLoginItemSettings(gin::Arguments* args);

shell/browser/api/electron_api_base_window.h

@@ -104,8 +104,8 @@ class BaseWindow : public gin_helper::TrackableObject<BaseWindow>,
   virtual void Focus();
   virtual void Blur();
   bool IsFocused() const;
-  void Show();
-  void ShowInactive();
+  virtual void Show();
+  virtual void ShowInactive();
   void Hide();
   bool IsVisible() const;
   bool IsEnabled() const;

shell/browser/api/electron_api_browser_window.cc

@@ -280,7 +280,6 @@ v8::Local<v8::Value> BrowserWindow::GetWebContents(v8::Isolate* isolate) {
 }
 
 void BrowserWindow::OnWindowShow() {
-  web_contents()->WasShown();
   BaseWindow::OnWindowShow();
 }
 
@@ -289,6 +288,19 @@ void BrowserWindow::OnWindowHide() {
   BaseWindow::OnWindowHide();
 }
 
+void BrowserWindow::Show() {
+  web_contents()->WasShown();
+  BaseWindow::Show();
+}
+
+void BrowserWindow::ShowInactive() {
+  // This method doesn't make sense for modal window.
+  if (IsModal())
+    return;
+  web_contents()->WasShown();
+  BaseWindow::ShowInactive();
+}
+
 // static
 gin_helper::WrappableBase* BrowserWindow::New(gin_helper::ErrorThrower thrower,
                                               gin::Arguments* args) {

shell/browser/api/electron_api_browser_window.h

@@ -67,6 +67,8 @@ class BrowserWindow : public BaseWindow,
   void SetBackgroundMaterial(const std::string& material) override;
   void OnWindowShow() override;
   void OnWindowHide() override;
+  void Show() override;
+  void ShowInactive() override;
 
   // BrowserWindow APIs.
   void FocusOnWebView();

shell/browser/electron_browser_main_parts.cc

@@ -68,6 +68,7 @@
 #include "ui/base/ui_base_switches.h"
 #include "ui/color/color_provider_manager.h"
 #include "ui/display/screen.h"
+#include "ui/linux/display_server_utils.h"
 #include "ui/views/layout/layout_provider.h"
 #include "url/url_util.h"
 
@@ -209,9 +210,14 @@ int ElectronBrowserMainParts::PreEarlyInitialization() {
 #if BUILDFLAG(IS_POSIX)
   HandleSIGCHLD();
 #endif
+#if BUILDFLAG(IS_OZONE)
+  // Initialize Ozone platform and add required feature flags as per platform's
+  // properties.
 #if BUILDFLAG(IS_LINUX)
-  ui::OzonePlatform::PreEarlyInitialization();
+  ui::SetOzonePlatformForLinuxIfNeeded(*base::CommandLine::ForCurrentProcess());
 #endif
+  ui::OzonePlatform::PreEarlyInitialization();
+#endif  // BUILDFLAG(IS_OZONE)
 #if BUILDFLAG(IS_MAC)
   screen_ = std::make_unique<display::ScopedNativeScreen>();
 #endif

shell/browser/electron_permission_manager.cc

@@ -142,6 +142,14 @@ void ElectronPermissionManager::SetBluetoothPairingHandler(
   bluetooth_pairing_handler_ = handler;
 }
 
+bool ElectronPermissionManager::HasPermissionRequestHandler() const {
+  return !request_handler_.is_null();
+}
+
+bool ElectronPermissionManager::HasPermissionCheckHandler() const {
+  return !check_handler_.is_null();
+}
+
 void ElectronPermissionManager::RequestPermissionWithDetails(
     blink::mojom::PermissionDescriptorPtr permission,
     content::RenderFrameHost* render_frame_host,

shell/browser/electron_permission_manager.h

@@ -82,6 +82,9 @@ class ElectronPermissionManager : public content::PermissionControllerDelegate {
   void SetProtectedUSBHandler(const ProtectedUSBHandler& handler);
   void SetBluetoothPairingHandler(const BluetoothPairingHandler& handler);
 
+  bool HasPermissionRequestHandler() const;
+  bool HasPermissionCheckHandler() const;
+
   void CheckBluetoothDevicePair(gin_helper::Dictionary details,
                                 PairCallback pair_callback) const;
 

shell/browser/extensions/api/pdf_viewer_private/pdf_viewer_private_api.cc

@@ -16,6 +16,7 @@
 #include "components/pdf/common/constants.h"
 #include "components/prefs/pref_service.h"
 #include "extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.h"
+#include "pdf/buildflags.h"
 #include "url/url_constants.h"
 
 namespace extensions {
@@ -25,6 +26,8 @@ namespace {
 namespace IsAllowedLocalFileAccess =
     api::pdf_viewer_private::IsAllowedLocalFileAccess;
 
+namespace SaveToDrive = api::pdf_viewer_private::SaveToDrive;
+
 namespace SetPdfPluginAttributes =
     api::pdf_viewer_private::SetPdfPluginAttributes;
 
@@ -107,6 +110,24 @@ PdfViewerPrivateIsAllowedLocalFileAccessFunction::Run() {
       IsUrlAllowedToEmbedLocalFiles(GURL(params->url), base::Value::List())));
 }
 
+PdfViewerPrivateSaveToDriveFunction::PdfViewerPrivateSaveToDriveFunction() =
+    default;
+
+PdfViewerPrivateSaveToDriveFunction::~PdfViewerPrivateSaveToDriveFunction() =
+    default;
+
+ExtensionFunction::ResponseAction PdfViewerPrivateSaveToDriveFunction::Run() {
+#if BUILDFLAG(ENABLE_PDF_SAVE_TO_DRIVE)
+  std::optional<SaveToDrive::Params> params =
+      SaveToDrive::Params::Create(args());
+  EXTENSION_FUNCTION_VALIDATE(params);
+  // TODO(crbug.com/424208776): Start the save to drive flow.
+  return RespondNow(NoArguments());
+#else
+  return RespondNow(Error("Not supported"));
+#endif  // BUILDFLAG(ENABLE_PDF_SAVE_TO_DRIVE)
+}
+
 PdfViewerPrivateSetPdfDocumentTitleFunction::
     PdfViewerPrivateSetPdfDocumentTitleFunction() = default;
 

shell/browser/extensions/api/pdf_viewer_private/pdf_viewer_private_api.h

@@ -46,6 +46,24 @@ class PdfViewerPrivateIsAllowedLocalFileAccessFunction
   ResponseAction Run() override;
 };
 
+class PdfViewerPrivateSaveToDriveFunction : public ExtensionFunction {
+ public:
+  DECLARE_EXTENSION_FUNCTION("pdfViewerPrivate.saveToDrive",
+                             PDFVIEWERPRIVATE_SAVETODRIVE)
+
+  PdfViewerPrivateSaveToDriveFunction();
+  PdfViewerPrivateSaveToDriveFunction(
+      const PdfViewerPrivateSaveToDriveFunction&) = delete;
+  PdfViewerPrivateSaveToDriveFunction& operator=(
+      const PdfViewerPrivateSaveToDriveFunction&) = delete;
+
+ protected:
+  ~PdfViewerPrivateSaveToDriveFunction() override;
+
+  // Override from ExtensionFunction:
+  ResponseAction Run() override;
+};
+
 class PdfViewerPrivateSetPdfDocumentTitleFunction : public ExtensionFunction {
  public:
   DECLARE_EXTENSION_FUNCTION("pdfViewerPrivate.setPdfDocumentTitle",

shell/browser/file_system_access/file_system_access_permission_context.cc

@@ -257,6 +257,28 @@ class FileSystemAccessPermissionContext::PermissionGrantImpl
   // FileSystemAccessPermissionGrant:
   PermissionStatus GetStatus() override {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+
+    auto* permission_manager =
+        static_cast<electron::ElectronPermissionManager*>(
+            context_->browser_context()->GetPermissionControllerDelegate());
+    if (permission_manager && permission_manager->HasPermissionCheckHandler()) {
+      base::Value::Dict details;
+      details.Set("filePath", base::FilePathToValue(path_info_.path));
+      details.Set("isDirectory", handle_type_ == HandleType::kDirectory);
+      details.Set("fileAccessType",
+                  type_ == GrantType::kWrite ? "writable" : "readable");
+
+      bool granted = permission_manager->CheckPermissionWithDetails(
+          blink::PermissionType::FILE_SYSTEM, nullptr, origin_.GetURL(),
+          std::move(details));
+      return granted ? PermissionStatus::GRANTED : PermissionStatus::DENIED;
+    }
+
+    return status_;
+  }
+
+  PermissionStatus GetActivePermissionStatus() {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
     return status_;
   }
 
@@ -279,8 +301,8 @@ class FileSystemAccessPermissionContext::PermissionGrantImpl
     // Check if a permission request has already been processed previously. This
     // check is done first because we don't want to reset the status of a
     // permission if it has already been granted.
-    if (GetStatus() != PermissionStatus::ASK || !context_) {
-      if (GetStatus() == PermissionStatus::GRANTED) {
+    if (GetActivePermissionStatus() != PermissionStatus::ASK || !context_) {
+      if (GetActivePermissionStatus() == PermissionStatus::GRANTED) {
         SetStatus(PermissionStatus::GRANTED);
       }
       std::move(callback).Run(PermissionRequestOutcome::kRequestAborted);
@@ -294,7 +316,7 @@ class FileSystemAccessPermissionContext::PermissionGrantImpl
       return;
     }
 
-    // Don't request permission  for an inactive RenderFrameHost as the
+    // Don't request permission for an inactive RenderFrameHost as the
     // page might not distinguish properly between user denying the permission
     // and automatic rejection.
     if (rfh->IsInactiveAndDisallowActivation(
@@ -347,7 +369,7 @@ class FileSystemAccessPermissionContext::PermissionGrantImpl
     permission_manager->RequestPermissionWithDetails(
         content::PermissionDescriptorUtil::
             CreatePermissionDescriptorForPermissionType(type),
-        rfh, origin, false, std::move(details),
+        rfh, origin, rfh->HasTransientUserActivation(), std::move(details),
         base::BindOnce(&PermissionGrantImpl::OnPermissionRequestResult, this,
                        std::move(callback)));
   }
@@ -394,7 +416,8 @@ class FileSystemAccessPermissionContext::PermissionGrantImpl
       return;
     }
 
-    DCHECK_EQ(entry_it->second->GetStatus(), PermissionStatus::GRANTED);
+    DCHECK_EQ(entry_it->second->GetActivePermissionStatus(),
+              PermissionStatus::GRANTED);
 
     auto* const grant_impl = entry_it->second;
     grant_impl->SetPath(new_path);
@@ -963,7 +986,8 @@ bool FileSystemAccessPermissionContext::OriginHasReadAccess(
   auto it = active_permissions_map_.find(origin);
   if (it != active_permissions_map_.end()) {
     return std::ranges::any_of(it->second.read_grants, [&](const auto& grant) {
-      return grant.second->GetStatus() == PermissionStatus::GRANTED;
+      return grant.second->GetActivePermissionStatus() ==
+             PermissionStatus::GRANTED;
     });
   }
 
@@ -977,7 +1001,8 @@ bool FileSystemAccessPermissionContext::OriginHasWriteAccess(
   auto it = active_permissions_map_.find(origin);
   if (it != active_permissions_map_.end()) {
     return std::ranges::any_of(it->second.write_grants, [&](const auto& grant) {
-      return grant.second->GetStatus() == PermissionStatus::GRANTED;
+      return grant.second->GetActivePermissionStatus() ==
+             PermissionStatus::GRANTED;
     });
   }
 
@@ -1031,7 +1056,7 @@ bool FileSystemAccessPermissionContext::AncestorHasActivePermission(
        parent = parent.DirName()) {
     auto i = relevant_grants.find(parent);
     if (i != relevant_grants.end() && i->second &&
-        i->second->GetStatus() == PermissionStatus::GRANTED) {
+        i->second->GetActivePermissionStatus() == PermissionStatus::GRANTED) {
       return true;
     }
   }
@@ -1054,7 +1079,7 @@ void FileSystemAccessPermissionContext::PermissionGrantDestroyed(
   // be granted but won't be visible in any UI because the permission context
   // isn't tracking them anymore.
   if (grant_it == grants.end()) {
-    DCHECK_EQ(PermissionStatus::DENIED, grant->GetStatus());
+    DCHECK_EQ(PermissionStatus::DENIED, grant->GetActivePermissionStatus());
     return;
   }
 

shell/browser/native_window_mac.mm

@@ -1347,7 +1347,6 @@ void NativeWindowMac::UpdateVibrancyRadii(bool fullscreen) {
       [maskImage setCapInsets:NSEdgeInsetsMake(radius, radius, radius, radius)];
       [maskImage setResizingMode:NSImageResizingModeStretch];
       [vibrantView setMaskImage:maskImage];
-      [window_ setCornerMask:maskImage];
     }
   }
 }

shell/browser/native_window_views.cc

@@ -268,7 +268,7 @@ NativeWindowViews::NativeWindowViews(const gin_helper::Dictionary& options,
   params.remove_standard_frame = !has_frame() || has_client_frame();
 
   // If a client frame, we need to draw our own shadows.
-  if (IsTranslucent() || has_client_frame())
+  if (transparent() || has_client_frame())
     params.opacity = InitParams::WindowOpacity::kTranslucent;
 
   // The given window is most likely not rectangular since it is translucent and
@@ -302,7 +302,7 @@ NativeWindowViews::NativeWindowViews(const gin_helper::Dictionary& options,
 
   widget()->Init(std::move(params));
   widget()->SetNativeWindowProperty(kNativeWindowKey.c_str(), this);
-  SetCanResize(resizable_);
+  widget()->OnSizeConstraintsChanged();
 
   const bool fullscreen = options.ValueOrDefault(options::kFullscreen, false);
 
@@ -356,11 +356,11 @@ NativeWindowViews::NativeWindowViews(const gin_helper::Dictionary& options,
     // frameless.
 
     DWORD frame_style = WS_CAPTION | WS_OVERLAPPED;
-    if (resizable_)
+    if (CanResize())
       frame_style |= WS_THICKFRAME;
     if (minimizable_)
       frame_style |= WS_MINIMIZEBOX;
-    if (maximizable_)
+    if (maximizable_ && CanResize())
       frame_style |= WS_MAXIMIZEBOX;
 
     // We should not show a frame for transparent window.
@@ -868,7 +868,7 @@ void NativeWindowViews::SetBounds(const gfx::Rect& bounds, bool animate) {
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX)
   // On Linux and Windows the minimum and maximum size should be updated with
   // window size when window is not resizable.
-  if (!resizable_) {
+  if (!CanResize()) {
     SetMaximumSize(bounds.size());
     SetMinimumSize(bounds.size());
   }
@@ -949,26 +949,21 @@ extensions::SizeConstraints NativeWindowViews::GetContentSizeConstraints()
 
 void NativeWindowViews::SetResizable(bool resizable) {
   if (resizable != resizable_) {
+    resizable_ = resizable;
     // On Linux there is no "resizable" property of a window, we have to set
     // both the minimum and maximum size to the window size to achieve it.
     if (resizable) {
       SetContentSizeConstraints(old_size_constraints_);
-      SetMaximizable(maximizable_);
     } else {
       old_size_constraints_ = GetContentSizeConstraints();
-      resizable_ = false;
       gfx::Size content_size = GetContentSize();
       SetContentSizeConstraints(
           extensions::SizeConstraints(content_size, content_size));
     }
-  }
-
-  resizable_ = resizable;
-  SetCanResize(resizable_);
-
 #if BUILDFLAG(IS_WIN)
-  UpdateThickFrame();
+    UpdateThickFrame();
 #endif
+  }
 }
 
 bool NativeWindowViews::MoveAbove(const std::string& sourceId) {
@@ -1013,12 +1008,20 @@ void NativeWindowViews::MoveTop() {
 #endif
 }
 
+bool NativeWindowViews::CanResize() const {
+#if BUILDFLAG(IS_WIN)
+  return resizable_ && thick_frame_;
+#else
+  return resizable_;
+#endif
+}
+
 bool NativeWindowViews::IsResizable() const {
 #if BUILDFLAG(IS_WIN)
   if (has_frame())
     return ::GetWindowLong(GetAcceleratedWidget(), GWL_STYLE) & WS_THICKFRAME;
 #endif
-  return resizable_;
+  return CanResize();
 }
 
 void NativeWindowViews::SetAspectRatio(double aspect_ratio,
@@ -1819,7 +1822,7 @@ views::View* NativeWindowViews::GetInitiallyFocusedView() {
 }
 
 bool NativeWindowViews::CanMaximize() const {
-  return resizable_ && maximizable_;
+  return CanResize() && maximizable_;
 }
 
 bool NativeWindowViews::CanMinimize() const {

shell/browser/native_window_views.h

@@ -88,6 +88,7 @@ class NativeWindowViews : public NativeWindow,
   bool IsResizable() const override;
   void SetAspectRatio(double aspect_ratio,
                       const gfx::Size& extra_size) override;
+  bool CanResize() const override;
   void SetMovable(bool movable) override;
   bool IsMovable() const override;
   void SetMinimizable(bool minimizable) override;

shell/browser/native_window_views_win.cc

@@ -31,15 +31,15 @@ namespace electron {
 
 namespace {
 
-void SetWindowBorderAndCaptionColor(HWND hwnd, COLORREF color) {
-  if (base::win::GetVersion() < base::win::Version::WIN11)
-    return;
+void SetWindowBorderAndCaptionColor(HWND hwnd, COLORREF color, bool has_frame) {
+  HRESULT result;
+  if (has_frame) {
+    result =
+        DwmSetWindowAttribute(hwnd, DWMWA_CAPTION_COLOR, &color, sizeof(color));
 
-  HRESULT result =
-      DwmSetWindowAttribute(hwnd, DWMWA_CAPTION_COLOR, &color, sizeof(color));
-
-  if (FAILED(result))
-    LOG(WARNING) << "Failed to set caption color";
+    if (FAILED(result))
+      LOG(WARNING) << "Failed to set caption color";
+  }
 
   result =
       DwmSetWindowAttribute(hwnd, DWMWA_BORDER_COLOR, &color, sizeof(color));
@@ -509,7 +509,7 @@ void NativeWindowViews::HandleSizeEvent(WPARAM w_param, LPARAM l_param) {
       WINDOWPLACEMENT wp;
       wp.length = sizeof(WINDOWPLACEMENT);
 
-      if (GetWindowPlacement(GetAcceleratedWidget(), &wp)) {
+      if (GetWindowPlacement(GetAcceleratedWidget(), &wp) && !was_snapped_) {
         last_normal_placement_bounds_ = gfx::Rect(wp.rcNormalPosition);
       }
 
@@ -518,11 +518,9 @@ void NativeWindowViews::HandleSizeEvent(WPARAM w_param, LPARAM l_param) {
       if (w_param == SIZE_MAXIMIZED &&
           last_window_state_ != ui::mojom::WindowShowState::kMaximized) {
         if (last_window_state_ == ui::mojom::WindowShowState::kMinimized) {
-          if (was_snapped_) {
-            SetRoundedCorners(false);
-            was_snapped_ = false;
-          }
           NotifyWindowRestore();
+          if (was_snapped_)
+            was_snapped_ = false;
         }
         last_window_state_ = ui::mojom::WindowShowState::kMaximized;
         NotifyWindowMaximize();
@@ -545,12 +543,10 @@ void NativeWindowViews::HandleSizeEvent(WPARAM w_param, LPARAM l_param) {
             last_window_state_ = ui::mojom::WindowShowState::kFullscreen;
             NotifyWindowEnterFullScreen();
           } else {
-            if (was_snapped_) {
-              SetRoundedCorners(false);
-              was_snapped_ = false;
-            }
             last_window_state_ = ui::mojom::WindowShowState::kNormal;
             NotifyWindowRestore();
+            if (was_snapped_)
+              was_snapped_ = false;
           }
           break;
         default:
@@ -595,7 +591,8 @@ void NativeWindowViews::UpdateWindowAccentColor(bool active) {
   }
 
   COLORREF final_color = border_color.value_or(DWMWA_COLOR_DEFAULT);
-  SetWindowBorderAndCaptionColor(GetAcceleratedWidget(), final_color);
+  SetWindowBorderAndCaptionColor(GetAcceleratedWidget(), final_color,
+                                 has_frame());
 }
 
 void NativeWindowViews::SetAccentColor(

shell/browser/net/proxying_websocket.cc

@@ -401,7 +401,7 @@ void ProxyingWebSocket::OnHeadersReceivedCompleteForAuth(
 
   auto continuation = base::BindRepeating(
       &ProxyingWebSocket::OnAuthRequiredComplete, weak_factory_.GetWeakPtr());
-  auto auth_rv = AuthRequiredResponse::kIoPending;
+  auto auth_rv = AuthRequiredResponse::kCancelAuth;
   PauseIncomingMethodCallProcessing();
 
   OnAuthRequiredComplete(auth_rv);

shell/browser/notifications/win/notification_presenter_win.cc

@@ -30,9 +30,8 @@ namespace {
 bool SaveIconToPath(const SkBitmap& bitmap, const base::FilePath& path) {
   std::optional<std::vector<uint8_t>> png_data =
       gfx::PNGCodec::EncodeBGRASkBitmap(bitmap, false);
-  if (!png_data.has_value())
+  if (!png_data.has_value() || !png_data.value().size())
     return false;
-
   return base::WriteFile(path, png_data.value());
 }
 
@@ -64,8 +63,10 @@ bool NotificationPresenterWin::Init() {
 std::wstring NotificationPresenterWin::SaveIconToFilesystem(
     const SkBitmap& icon,
     const GURL& origin) {
-  std::string filename;
+  if (icon.drawsNothing())
+    return L"";
 
+  std::string filename;
   if (origin.is_valid()) {
     filename = base::MD5String(origin.spec()) + ".png";
   } else {
@@ -75,11 +76,11 @@ std::wstring NotificationPresenterWin::SaveIconToFilesystem(
 
   ScopedAllowBlockingForElectron allow_blocking;
   base::FilePath path = temp_dir_.GetPath().Append(base::UTF8ToWide(filename));
-  if (base::PathExists(path))
-    return path.value();
-  if (SaveIconToPath(icon, path))
-    return path.value();
-  return base::UTF8ToWide(origin.spec());
+
+  if (!SaveIconToPath(icon, path))
+    return L"";
+
+  return path.value();
 }
 
 Notification* NotificationPresenterWin::CreateNotificationObject(

shell/browser/notifications/win/windows_toast_notification.cc

@@ -302,6 +302,7 @@ std::u16string WindowsToastNotification::GetToastXml(
   // Optional icon as app logo override (small icon).
   if (!icon_path.empty()) {
     xml_writer.StartElement(kImage);
+    xml_writer.AddAttribute(kID, "1");
     xml_writer.AddAttribute(kPlacement, kAppLogoOverride);
     xml_writer.AddAttribute(kHintCrop, kHintCropNone);
     xml_writer.AddAttribute(kSrc, base::WideToUTF8(icon_path));