fix: BrowserWindow.isFocused on Windows

* chore: bump node in DEPS to v22.17.1

* chore: update patches

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: patchup[bot] <73610968+patchup[bot]@users.noreply.github.com>

.devcontainer/docker-compose.yml

@@ -2,7 +2,7 @@ version: '3'
 
 services:
   buildtools:
-    image: ghcr.io/electron/devcontainer:933c7d6ff6802706875270bec2e3c891cf8add3f
+    image: ghcr.io/electron/devcontainer:424eedbf277ad9749ffa9219068aa72ed4a5e373
 
     volumes:
       - ..:/workspaces/gclient/src/electron:cached

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -58,6 +58,15 @@ body:
     label: Last Known Working Electron version
     description: What is the last version of Electron this worked in, if applicable?
     placeholder: 16.0.0
+- type: dropdown
+  attributes:
+    label: Does the issue also appear in Chromium / Google Chrome?
+    description: If it does, please report the issue in the [Chromium issue tracker](https://issues.chromium.org/issues), not against Electron. Electron will inherit the fix once Chromium resolves the issue.
+    options:
+      - "Yes"
+      - "No"
+  validations:
+    required: true
 - type: textarea
   attributes:
     label: Expected Behavior

.github/actions/build-electron/action.yml

@@ -17,6 +17,9 @@ inputs:
   is-release:
     description: 'Is release build'
     required: true
+  strip-binaries:
+    description: 'Strip binaries (Linux only)'
+    required: false
   generate-symbols:
     description: 'Generate symbols'
     required: true
@@ -35,12 +38,6 @@ runs:
       run: |
         GN_APPENDED_ARGS="$GN_EXTRA_ARGS target_cpu=\"x64\" v8_snapshot_toolchain=\"//build/toolchain/mac:clang_x64\""
         echo "GN_EXTRA_ARGS=$GN_APPENDED_ARGS" >> $GITHUB_ENV
-    - name: Set GN_EXTRA_ARGS for Windows
-      shell: bash
-      if: ${{inputs.target-arch != 'x64' && inputs.target-platform == 'win' }}
-      run: |
-        GN_APPENDED_ARGS="$GN_EXTRA_ARGS target_cpu=\"${{ inputs.target-arch }}\""
-        echo "GN_EXTRA_ARGS=$GN_APPENDED_ARGS" >> $GITHUB_ENV
     - name: Add Clang problem matcher
       shell: bash
       run: echo "::add-matcher::src/electron/.github/problem-matchers/clang.json"
@@ -60,24 +57,22 @@ runs:
           sudo launchctl limit maxfiles 65536 200000
         fi
 
-        if [ "${{ inputs.is-release }}" = "true" ]; then
-          NINJA_SUMMARIZE_BUILD=1 e build --target electron:release_build
-        else
-          NINJA_SUMMARIZE_BUILD=1 e build --target electron:testing_build
-        fi
+        NINJA_SUMMARIZE_BUILD=1 e build -j $NUMBER_OF_NINJA_PROCESSES
         cp out/Default/.ninja_log out/electron_ninja_log
         node electron/script/check-symlinks.js
-
-        # Upload build stats to Datadog
-        if ! [ -z $DD_API_KEY ]; then
-          npx node electron/script/build-stats.mjs out/Default/siso.INFO --upload-stats || true
-        else
-          echo "Skipping build-stats.mjs upload because DD_API_KEY is not set"
-        fi
-    - name: Verify dist.zip ${{ inputs.step-suffix }}
+    - name: Strip Electron Binaries ${{ inputs.step-suffix }}
+      shell: bash
+      if: ${{ inputs.strip-binaries == 'true' }}
+      run: |
+        cd src
+        electron/script/copy-debug-symbols.py --target-cpu="${{ inputs.target-arch }}" --out-dir=out/Default/debug --compress
+        electron/script/strip-binaries.py --target-cpu="${{ inputs.target-arch }}" --verbose
+        electron/script/add-debug-link.py --target-cpu="${{ inputs.target-arch }}" --debug-dir=out/Default/debug
+    - name: Build Electron dist.zip ${{ inputs.step-suffix }}
       shell: bash
       run: |
-        cd src        
+        cd src
+        e build --target electron:electron_dist_zip -j $NUMBER_OF_NINJA_PROCESSES -d explain
         if [ "${{ inputs.is-asan }}" != "true" ]; then
           target_os=${{ inputs.target-platform == 'macos' && 'mac' || inputs.target-platform }}
           if [ "${{ inputs.artifact-platform }}" = "mas" ]; then
@@ -85,10 +80,11 @@ runs:
           fi
           electron/script/zip_manifests/check-zip-manifest.py out/Default/dist.zip electron/script/zip_manifests/dist_zip.$target_os.${{ inputs.target-arch }}.manifest
         fi
-    - name: Fixup Mksnapshot ${{ inputs.step-suffix }}
+    - name: Build Mksnapshot ${{ inputs.step-suffix }}
       shell: bash
       run: |
         cd src
+        e build --target electron:electron_mksnapshot -j $NUMBER_OF_NINJA_PROCESSES
         ELECTRON_DEPOT_TOOLS_DISABLE_LOG=1 e d gn desc out/Default v8:run_mksnapshot_default args > out/Default/mksnapshot_args
         # Remove unused args from mksnapshot_args
         SEDOPTION="-i"
@@ -98,6 +94,20 @@ runs:
         sed $SEDOPTION '/.*builtins-pgo/d' out/Default/mksnapshot_args
         sed $SEDOPTION '/--turbo-profiling-input/d' out/Default/mksnapshot_args
 
+        if [ "${{ inputs.target-platform }}" = "linux" ]; then
+          if [ "${{ inputs.target-arch }}" = "arm" ]; then
+            electron/script/strip-binaries.py --file $PWD/out/Default/clang_x86_v8_arm/mksnapshot
+            electron/script/strip-binaries.py --file $PWD/out/Default/clang_x86_v8_arm/v8_context_snapshot_generator
+          elif [ "${{ inputs.target-arch }}" = "arm64" ]; then
+            electron/script/strip-binaries.py --file $PWD/out/Default/clang_x64_v8_arm64/mksnapshot
+            electron/script/strip-binaries.py --file $PWD/out/Default/clang_x64_v8_arm64/v8_context_snapshot_generator
+          else
+            electron/script/strip-binaries.py --file $PWD/out/Default/mksnapshot
+            electron/script/strip-binaries.py --file $PWD/out/Default/v8_context_snapshot_generator
+          fi
+        fi
+
+        e build --target electron:electron_mksnapshot_zip -j $NUMBER_OF_NINJA_PROCESSES
         if [ "${{ inputs.target-platform }}" = "win" ]; then
           cd out/Default
           powershell Compress-Archive -update mksnapshot_args mksnapshot.zip
@@ -131,7 +141,13 @@ runs:
       shell: bash
       run: |
         cd src
+        e build --target electron:electron_chromedriver -j $NUMBER_OF_NINJA_PROCESSES
         e build --target electron:electron_chromedriver_zip
+    - name: Build Node.js headers ${{ inputs.step-suffix }}
+      shell: bash
+      run: |
+        cd src
+        e build --target electron:node_headers
     - name: Create installed_software.json ${{ inputs.step-suffix }}
       shell: powershell
       if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'win' }}
@@ -151,11 +167,17 @@ runs:
         # Needed for msdia140.dll on 64-bit windows
         cd src
         export PATH="$PATH:$(pwd)/third_party/llvm-build/Release+Asserts/bin"
-    - name: Zip Symbols ${{ inputs.step-suffix }}
+    - name: Generate & Zip Symbols ${{ inputs.step-suffix }}
       shell: bash
       run: |
+        # Generate breakpad symbols on release builds
+        if [ "${{ inputs.generate-symbols }}" = "true" ]; then
+          e build --target electron:electron_symbols
+        fi
         cd src
         export BUILD_PATH="$(pwd)/out/Default"
+        e build --target electron:licenses
+        e build --target electron:electron_version_file
         if [ "${{ inputs.is-release }}" = "true" ]; then
           DELETE_DSYMS_AFTER_ZIP=1 electron/script/zip-symbols.py -b $BUILD_PATH
         else
@@ -166,8 +188,20 @@ runs:
       if: ${{ inputs.is-release == 'true' }}
       run: |
         cd src
-        gn gen out/ffmpeg --args="import(\"//electron/build/args/ffmpeg.gn\") use_remoteexec=true use_siso=true $GN_EXTRA_ARGS"
-        e build --target electron:electron_ffmpeg_zip -C ../../out/ffmpeg
+        gn gen out/ffmpeg --args="import(\"//electron/build/args/ffmpeg.gn\") use_remoteexec=true $GN_EXTRA_ARGS"
+        e build --target electron:electron_ffmpeg_zip -C ../../out/ffmpeg -j $NUMBER_OF_NINJA_PROCESSES
+    - name: Generate Hunspell Dictionaries ${{ inputs.step-suffix }}
+      shell: bash
+      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'linux' }}
+      run: |
+        e build --target electron:hunspell_dictionaries_zip -j $NUMBER_OF_NINJA_PROCESSES
+    - name: Generate Libcxx ${{ inputs.step-suffix }}
+      shell: bash
+      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'linux' }}
+      run: |
+        e build --target electron:libcxx_headers_zip -j $NUMBER_OF_NINJA_PROCESSES
+        e build --target electron:libcxxabi_headers_zip -j $NUMBER_OF_NINJA_PROCESSES
+        e build --target electron:libcxx_objects_zip -j $NUMBER_OF_NINJA_PROCESSES
     - name: Remove Clang problem matcher
       shell: bash
       run: echo "::remove-matcher owner=clang::"
@@ -190,29 +224,7 @@ runs:
           echo 'Uploading Electron release distribution to GitHub releases'
           script/release/uploaders/upload.py --verbose
         fi
-    - name: Generate siso report
-      if: ${{ inputs.target-platform != 'win' && !cancelled() }}
-      shell: bash
-      run: |
-        cd src
-        e d siso report -C out/Default > siso_report.txt
-        SISO_REPORT_PATH=$(grep -o '/.*siso-report-[^ ]*' siso_report.txt)
-        echo "SISO_REPORT_PATH=$SISO_REPORT_PATH" >> $GITHUB_ENV
-        cat siso_report.txt
-        echo "SISO REPORT AT $SISO_REPORT_PATH"
-    - name: Generate siso report (Windows)
-      if: ${{ inputs.target-platform == 'win' && !cancelled() }}
-      shell: powershell
-      run: |
-        cd src
-        e d siso report -C out\Default > siso_report.txt
-        $SISO_REPORT_PATH = Get-Content "siso_report.txt" | Select-String "report file:\s*(.+)" | ForEach-Object { 
-          $_.Matches.Groups[1].Value.Trim() 
-        }
-        echo "SISO_REPORT_PATH=$SISO_REPORT_PATH"
-        echo "SISO_REPORT_PATH=$SISO_REPORT_PATH" >> $env:GITHUB_ENV
     - name: Generate Artifact Key
-      if: always() && !cancelled()
       shell: bash
       run: |
         if [ "${{ inputs.is-asan }}" = "true" ]; then 
@@ -224,11 +236,9 @@ runs:
     # The current generated_artifacts_<< artifact.key >> name was taken from CircleCI
     # to ensure we don't break anything, but we may be able to improve that.
     - name: Move all Generated Artifacts to Upload Folder ${{ inputs.step-suffix }}
-      if: always() && !cancelled()
       shell: bash
       run: ./src/electron/script/actions/move-artifacts.sh
     - name: Upload Generated Artifacts ${{ inputs.step-suffix }}
-      if: always() && !cancelled()
       uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
       with:
         name: generated_artifacts_${{ env.ARTIFACT_KEY }}

.github/actions/checkout/action.yml

@@ -40,7 +40,7 @@ runs:
     if: ${{ inputs.generate-sas-token == 'true' }}
     shell: bash
     run: |
-      curl --unix-socket /var/run/sas/sas.sock --fail "http://foo/$CACHE_FILE?platform=${{ inputs.target-platform }}&getAccountName=true" > sas-token
+      curl --unix-socket /var/run/sas/sas.sock --fail "http://foo/$CACHE_FILE?platform=${{ inputs.target-platform }}" > sas-token
   - name: Save SAS Key
     if: ${{ inputs.generate-sas-token == 'true' }}
     uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3

.github/actions/cipd-install/action.yml

@@ -14,9 +14,6 @@ inputs:
     description: 'Target platform, should be linux, win, macos'
   package:
     description: 'Package to install'
-  dependency-version:
-    description: 'Version of the dependency to install'
-    default: ''
 runs:
   using: "composite"
   steps:
@@ -25,23 +22,15 @@ runs:
       run : |
         rm -rf ${{ inputs.cipd-root-prefix-path }}${{ inputs.installation-dir }}
     - name: Create ensure file for ${{ inputs.dependency }}
-      if: ${{ inputs.dependency-version == '' }}
       shell: bash
       run: |
         echo '${{ inputs.package }}' `e d gclient getdep --deps-file=${{ inputs.deps-file }} -r '${{ inputs.installation-dir }}:${{ inputs.package }}'` > ${{ inputs.dependency }}_ensure_file
         cat ${{ inputs.dependency }}_ensure_file
-
-    - name: Create ensure file for ${{ inputs.dependency }} from dependency-version
-      if: ${{ inputs.dependency-version != '' }}
-      shell: bash
-      run: |
-        echo '${{ inputs.package }} ${{ inputs.dependency-version }}'  > ${{ inputs.dependency }}_ensure_file
-        cat ${{ inputs.dependency }}_ensure_file
     - name: CIPD installation of ${{ inputs.dependency }} (macOS)
-      if: ${{ inputs.target-platform != 'win' }}
+      if: ${{ inputs.target-platform == 'macos' }}
       shell: bash
       run: |
-        echo "ensuring ${{ inputs.dependency }}"
+        echo "ensuring ${{ inputs.dependency }} on macOS"
         e d cipd ensure --root ${{ inputs.cipd-root-prefix-path }}${{ inputs.installation-dir }} -ensure-file ${{ inputs.dependency }}_ensure_file
     - name: CIPD installation of ${{ inputs.dependency }} (Windows)
       if: ${{ inputs.target-platform == 'win' }}

.github/actions/fix-sync/action.yml

@@ -19,16 +19,12 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Fix llvm toolchain
-      if: ${{ inputs.target-platform != 'linux' }}
+    - name: Fix clang
       shell: bash
       run : |
         rm -rf src/third_party/llvm-build
         python3 src/tools/clang/scripts/update.py
-        # Refs https://chromium-review.googlesource.com/c/chromium/src/+/6667681
-        python3 src/tools/clang/scripts/update.py --package objdump
     - name: Fix esbuild
-      if: ${{ inputs.target-platform != 'linux' }}
       uses: ./src/electron/.github/actions/cipd-install
       with:
         cipd-root-prefix-path: src/third_party/devtools-frontend/src/
@@ -38,7 +34,6 @@ runs:
         target-platform: ${{ inputs.target-platform }}
         package: infra/3pp/tools/esbuild/${platform}
     - name: Fix rustc
-      if: ${{ inputs.target-platform != 'linux' }}
       shell: bash
       run : |
         rm -rf src/third_party/rust-toolchain
@@ -62,7 +57,6 @@ runs:
         target-platform: ${{ inputs.target-platform }}
         package: gn/gn/windows-amd64
     - name: Fix reclient
-      if: ${{ inputs.target-platform != 'linux' }}
       uses: ./src/electron/.github/actions/cipd-install
       with:
         dependency: reclient
@@ -71,7 +65,6 @@ runs:
         target-platform: ${{ inputs.target-platform }}
         package: infra/rbe/client/${platform}
     - name: Configure reclient configs
-      if: ${{ inputs.target-platform != 'linux' }}
       shell: bash
       run : |
         python3 src/buildtools/reclient_cfgs/configure_reclient_cfgs.py --rbe_instance "projects/rbe-chrome-untrusted/instances/default_instance" --reproxy_cfg_template reproxy.cfg.template --rewrapper_cfg_project "" --skip_remoteexec_cfg_fetch
@@ -89,7 +82,6 @@ runs:
           python3 src/third_party/depot_tools/download_from_google_storage.py --no_resume --no_auth --bucket chromium-browser-clang -s $DSYM_SHA_FILE -o src/tools/clang/dsymutil/bin/dsymutil
         fi
     - name: Fix ninja
-      if: ${{ inputs.target-platform != 'linux' }}
       uses: ./src/electron/.github/actions/cipd-install
       with:
         dependency: ninja
@@ -98,20 +90,10 @@ runs:
         target-platform: ${{ inputs.target-platform }}
         package: infra/3pp/tools/ninja/${platform}
     - name: Set ninja in path
-      if: ${{ inputs.target-platform != 'linux' }}
       shell: bash
       run : |
         echo "$(pwd)/src/third_party/ninja" >> $GITHUB_PATH
-    - name: Fix siso
-      uses: ./src/electron/.github/actions/cipd-install
-      with:
-        dependency: siso
-        deps-file: src/DEPS
-        installation-dir: src/third_party/siso/cipd
-        target-platform: ${{ inputs.target-platform }}
-        package: build/siso/${platform}
     - name: Fixup angle git
-      if: ${{ inputs.target-platform != 'linux' }}
       shell: bash
       run : |
         cd src/third_party/angle

.github/actions/install-build-tools/action.yml

@@ -13,9 +13,8 @@ runs:
         git config --global core.fscache true
         git config --global core.longpaths true
         git config --global core.preloadindex true
-        git config --global core.longpaths true
       fi
-      export BUILD_TOOLS_SHA=706147b2376f55078f718576b28129a0457f1795
+      export BUILD_TOOLS_SHA=274cba0474f0d1e4e6adbb66c1da48556cb0add5
       npm i -g @electron/build-tools
       # Update depot_tools to ensure python
       e d update_depot_tools

.github/actions/restore-cache-azcopy/action.yml

@@ -36,19 +36,18 @@ runs:
           echo "SAS Token not found; exiting src cache download early..."
           exit 1
         else
-          sas_token=$(jq -r '.sasToken' sas-token)
-          account_name=$(jq -r '.accountName' sas-token)
           if [ "${{ inputs.target-platform }}" = "win" ]; then
             azcopy copy --log-level=ERROR \
-            "https://$account_name.file.core.windows.net/${{ env.AZURE_AKS_WIN_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
+            "https://${{ env.AZURE_AKS_CACHE_STORAGE_ACCOUNT }}.file.core.windows.net/${{ env.AZURE_AKS_WIN_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
           else
             azcopy copy --log-level=ERROR \
-            "https://$account_name.file.core.windows.net/${{ env.AZURE_AKS_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
+            "https://${{ env.AZURE_AKS_CACHE_STORAGE_ACCOUNT }}.file.core.windows.net/${{ env.AZURE_AKS_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
           fi            
         fi
     env:
-      AZURE_AKS_CACHE_SHARE_NAME: linux-cache
-      AZURE_AKS_WIN_CACHE_SHARE_NAME: windows-cache
+      AZURE_AKS_CACHE_STORAGE_ACCOUNT: f723719aa87a34622b5f7f3
+      AZURE_AKS_CACHE_SHARE_NAME: pvc-f6a4089f-b082-4bee-a3f9-c3e1c0c02d8f
+      AZURE_AKS_WIN_CACHE_SHARE_NAME: pvc-71dec4f2-0d44-4fd1-a2c3-add049d70bdf
   - name: Clean SAS Key
     shell: bash
     run: rm -f sas-token
@@ -97,7 +96,7 @@ runs:
 
       $TEMP_DIR=New-Item -ItemType Directory -Path temp-cache
       $TEMP_DIR_PATH = $TEMP_DIR.FullName
-      C:\ProgramData\Chocolatey\bin\7z.exe -y -snld20 x $src_cache -o"$TEMP_DIR_PATH"
+      C:\ProgramData\Chocolatey\bin\7z.exe -y -snld x $src_cache -o"$TEMP_DIR_PATH"
 
   - name: Move Src Cache (Windows)
     if: ${{ inputs.target-platform == 'win' }}

.github/actions/ssh-debug/action.yml

@@ -1,20 +0,0 @@
-name: Debug via SSH
-description: Setup a SSH server with a tunnel to access it to debug via SSH.
-inputs:
-  tunnel:
-    description: 'Enable SSH tunneling via cloudflared'
-    required: true
-    default: 'false'
-  timeout:
-    description: 'SSH session timeout in seconds'
-    required: false
-    type: number
-    default: 3600
-runs:
-  using: composite
-  steps:
-    - run: $GITHUB_ACTION_PATH/setup-ssh.sh
-      shell: bash
-      env:
-        TUNNEL: ${{ inputs.tunnel }}
-        TIMEOUT: ${{ inputs.timeout }}

.github/actions/ssh-debug/bashrc

@@ -1,4 +0,0 @@
-# If we're in an interactive SSH session and we're not already in tmux and there's no explicit SSH command, auto attach tmux
-if [ -n "$SSH_TTY" ] && [ -z "$TMUX" ] && [ -z "$SSH_ORIGINAL_COMMAND" ]; then
-    exec tmux attach || exec tmux
-fi

.github/actions/ssh-debug/setup-ssh.sh

@@ -1,146 +0,0 @@
-#!/bin/bash -e
-
-if [ "${TUNNEL}" != "true" ]; then
-    echo "SSH tunneling is disabled. Set enable-tunnel: true to enable remote access."
-    echo "Local SSH server would be available on localhost:2222 if this were a local environment."
-    exit 0
-fi
-
-echo ::group::Configuring Tunnel
-
-echo "SSH tunneling enabled. Setting up remote access..."
-
-EXTERNAL_DEPS="curl jq ssh-keygen"
-
-for dep in $EXTERNAL_DEPS; do
-    if ! command -v "${dep}" > /dev/null 2>&1; then
-       echo "Command ${dep} not installed on the system!" >&2
-       exit 1
-    fi
-done
-
-cd "$GITHUB_ACTION_PATH"
-
-bashrc_path=$(pwd)/bashrc
-
-# Source `bashrc` to auto start tmux on SSH login.
-if ! grep -q "${bashrc_path}" ~/.bash_profile; then
-    echo >> ~/.bash_profile # On macOS runner there's no newline at the end of the file
-    echo "source \"${bashrc_path}\"" >> ~/.bash_profile
-fi
-
-OS=$(uname -s | tr '[:upper:]' '[:lower:]')
-ARCH=$(uname -m)
-
-if [ "${ARCH}" = "x86_64" ]; then
-    ARCH="amd64"
-elif [ "${ARCH}" = "aarch64" ]; then
-    ARCH="arm64"
-fi
-
-if [ "${OS}" = "darwin" ] && ! command -v tmux > /dev/null 2>&1; then
-    echo "Installing tmux..."
-    brew install tmux
-fi
-
-if [ "$OS" = "darwin" ]; then
-    cloudflared_url="https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${OS}-${ARCH}.tgz"
-    echo "Downloading \`cloudflared\` from <$cloudflared_url>..."
-    curl --location --silent --output cloudflared.tgz "${cloudflared_url}"
-    tar xf cloudflared.tgz
-    rm cloudflared.tgz
-fi
-
-chmod +x cloudflared
-
-echo 'Creating SSH server key...'
-ssh-keygen -q -f ssh_host_rsa_key -N ''
-
-echo 'Creating SSH server config...'
-sed "s,\$PWD,${PWD},;s,\$USER,${USER}," sshd_config.template > sshd_config
-
-echo 'Starting SSH server...'
-sudo /usr/sbin/sshd -f sshd_config -D &
-sshd_pid=$!
-
-echo "SSH server started successfully (PID: ${sshd_pid})"
-
-echo 'Starting tmux session...'
-(cd "${GITHUB_WORKSPACE}" && tmux new-session -d -s debug)
-
-mkdir ~/.cloudflared
-CLEAN_TUNNEL_CERT=$(printf '%s\n' "${CLOUDFLARE_TUNNEL_CERT}" | tr -d '\r' | sed '/^[[:space:]]*$/d')
-
-echo "${CLEAN_TUNNEL_CERT}" > ~/.cloudflared/cert.pem
-
-CLEAN_USER_CA_CERT=$(printf '%s\n' "${CLOUDFLARE_USER_CA_CERT}" | tr -d '\r' | sed '/^[[:space:]]*$/d')
-
-echo "${CLEAN_USER_CA_CERT}" | sudo tee /etc/ssh/ca.pub > /dev/null
-sudo chmod 644 /etc/ssh/ca.pub
-
-random_suffix=$(openssl rand -hex 5 | cut -c1-10)
-tunnel_name="${GITHUB_SHA}-${GITHUB_RUN_ID}-${random_suffix}"
-tunnel_url="${tunnel_name}.${CLOUDFLARE_TUNNEL_HOSTNAME}"
-
-if ./cloudflared tunnel list | grep -q "${tunnel_name}"; then
-    echo "Deleting existing tunnel: ${tunnel_name}"
-    ./cloudflared tunnel delete ${tunnel_name}
-fi
-
-echo "Creating new cloudflare tunnel: ${tunnel_name}"
-./cloudflared tunnel create ${tunnel_name}
-
-credentials_file=$(find ~/.cloudflared -name "*.json" | head -n 1)
-if [ -z "${credentials_file}" ]; then
-    echo "Error: Could not find tunnel credentials file"
-    exit 1
-fi
-
-echo "Found credentials file: ${credentials_file}"
-
-echo 'Creating tunnel configuration...'
-cat > tunnel_config.yml << EOF
-tunnel: ${tunnel_name}
-credentials-file: ${credentials_file}
-
-ingress:
-  - hostname: ${tunnel_url}
-    service: ssh://localhost:2222
-  - service: http_status:404
-EOF
-
-echo 'Setting up DNS routing for tunnel...'
-./cloudflared tunnel route dns ${tunnel_name} ${tunnel_url}
-
-echo 'Running cloudflare tunnel...'
-./cloudflared tunnel --no-autoupdate --config tunnel_config.yml run 2>&1 | tee cloudflared.log | sed -u 's/^/cloudflared: /' &
-cloudflared_pid=$!
-
-echo ::endgroup::
-
-echo ::notice title=SSH Debug Session Ready::ssh ${tunnel_url}
-
-
-(
-    echo '    '
-    echo '    '
-    echo '🔗 SSH Debug Session Ready!'
-    echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
-    echo '    '
-    echo '📋 Infra WG can copy and run this command to connect:'
-    echo '    '
-    echo "ssh ${tunnel_url}"
-    echo '    '
-    echo "⏰ Session expires automatically in ${TIMEOUT} seconds"
-    echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
-    echo '    '
-    echo '    '
-) | cat
-
-echo ::group::Starting Background Session
-echo 'Starting SSH session in background...'
-./ssh-session.sh "${sshd_pid}" "${cloudflared_pid}" "${TIMEOUT}" "${tunnel_name}" &
-
-echo 'SSH session is running in background. GitHub Action will continue.'
-echo 'Session will auto-cleanup after timeout or when processes end.'
-echo ::endgroup::

.github/actions/ssh-debug/ssh-session.sh

@@ -1,52 +0,0 @@
-#!/bin/bash
-
-SSHD_PID=$1
-CLOUDFLARED_PID=$2
-SESSION_TIMEOUT=${3:-10000}
-TUNNEL_NAME=$4
-
-cleanup() {
-    # Kill processes.
-    for pid in "$SLEEP_PID" "$SSHD_PID" "$CLOUDFLARED_PID"; do
-        if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
-            kill "$pid" 2>/dev/null || true
-        fi
-    done
-
-    # Clean up tunnel.
-    if [ -n "$TUNNEL_NAME" ]; then
-        cd "$GITHUB_ACTION_PATH"
-        ./cloudflared tunnel delete "$TUNNEL_NAME" 2>/dev/null || {
-            echo "Failed to delete tunnel"
-        }
-    fi
-
-    echo "Session ended at $(date)"
-    exit 0
-}
-
-# Trap signals to ensure cleanup.
-trap cleanup SIGTERM SIGINT SIGQUIT SIGHUP EXIT
-
-# Wait for timeout or until processes die.
-sleep "$SESSION_TIMEOUT" &
-SLEEP_PID=$!
-
-# Monitor processes
-while kill -0 "$SLEEP_PID" 2>/dev/null; do
-    # Check SSH daemon.
-    if ! kill -0 "$SSHD_PID" 2>/dev/null; then
-        echo "SSH daemon died at $(date)"
-        break
-    fi
-
-    # Check cloudflared,
-    if ! kill -0 "$CLOUDFLARED_PID" 2>/dev/null; then
-        echo "Cloudflared died at $(date)"
-        break
-    fi
-
-    sleep 10
-done
-
-cleanup

.github/actions/ssh-debug/sshd_config.template

@@ -1,25 +0,0 @@
-Port 2222
-HostKey $PWD/ssh_host_rsa_key
-PidFile $PWD/sshd.pid
-
-# Connection settings
-ClientAliveInterval 30
-ClientAliveCountMax 10
-MaxStartups 10
-LoginGraceTime 120
-
-# Allow TCP forwarding for tunneling
-AllowTcpForwarding yes
-
-# Try to prevent timeouts
-TCPKeepAlive yes
-
-# Security
-TrustedUserCAKeys /etc/ssh/ca.pub
-PubkeyAuthentication yes
-PasswordAuthentication no
-
-AuthorizedPrincipalsCommand /bin/bash -c "echo '%t %k' | ssh-keygen -L -f - | grep -A1 Principals"
-AuthorizedPrincipalsCommandUser nobody
-
-PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com

.github/workflows/archaeologist-dig.yml

@@ -3,14 +3,10 @@ name: Archaeologist
 on:
   pull_request:
 
-permissions: {}
-
 jobs:
    archaeologist-dig:
     name: Archaeologist Dig
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
       - name: Checkout Electron
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.0.2

.github/workflows/audit-branch-ci.yml

@@ -15,7 +15,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - run: npm install @actions/cache @electron/fiddle-core
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.17.x
+      - run: npm install @actions/cache@4.0.3 @electron/fiddle-core@2.0.1
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         id: audit-errors
         with:
@@ -29,7 +33,7 @@ jobs:
             // Only want the most recent workflow run that wasn't skipped or cancelled
             const isValidWorkflowRun = (run) => !['skipped', 'cancelled'].includes(run.conclusion);
 
-            const versions = await ElectronVersions.create(undefined, { ignoreCache: true });
+            const versions = await ElectronVersions.create({ ignoreCache: true });
             const branches = versions.supportedMajors.map((branch) => `${branch}-x-y`);
 
             for (const branch of ["main", ...branches]) {
@@ -101,7 +105,6 @@ jobs:
             }
 
             if (runsWithErrors.length > 0) {
-              core.setOutput('errorsFound', true);
               core.summary.addHeading('⚠️ Runs with Errors');
               core.summary.addTable([
                 [
@@ -128,6 +131,7 @@ jobs:
 
               // Set this as failed so it's easy to scan runs to find failures
               if (runsWithErrors.find((run) => !run.isStale)) {
+                core.setOutput('errorsFound', true);
                 process.exitCode = 1;
               }
             } else {

.github/workflows/build-git-cache.yml

@@ -6,13 +6,9 @@ on:
   schedule:
     - cron: "0 0 * * *"
 
-permissions: {}
-
 jobs:
   build-git-cache-linux:
-    runs-on: electron-arc-centralus-linux-amd64-32core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root
@@ -33,9 +29,7 @@ jobs:
         target-platform: linux
 
   build-git-cache-windows:
-    runs-on: electron-arc-centralus-linux-amd64-32core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -57,9 +51,7 @@ jobs:
         target-platform: win
 
   build-git-cache-macos:
-    runs-on: electron-arc-centralus-linux-amd64-32core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-32core
     # This job updates the same git cache as linux, so it needs to run after the linux one.
     needs: build-git-cache-linux
     container:

.github/workflows/build.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
+        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
         required: true
       skip-macos:
         type: boolean
@@ -28,11 +28,6 @@ on:
         description: 'Skip lint check'
         default: false
         required: false
-      enable-ssh:
-        description: 'Enable SSH debugging'
-        required: false
-        type: boolean
-        default: false
   push:
     branches:
       - main
@@ -43,13 +38,10 @@ defaults:
   run:
     shell: bash
 
-permissions: {}
-
 jobs:
   setup:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
       pull-requests: read
     outputs:
         docs: ${{ steps.filter.outputs.docs }}
@@ -66,17 +58,13 @@ jobs:
         filters: |
           docs:
             - 'docs/**'
-            - README.md
-            - SECURITY.md
-            - CONTRIBUTING.md
-            - CODE_OF_CONDUCT.md
           src:
             - '!docs/**'
     - name: Set Outputs for Build Image SHA & Docs Only
       id: set-output
       run: |
         if [ -z "${{ inputs.build-image-sha }}" ]; then
-          echo "build-image-sha=933c7d6ff6802706875270bec2e3c891cf8add3f" >> "$GITHUB_OUTPUT"
+          echo "build-image-sha=424eedbf277ad9749ffa9219068aa72ed4a5e373" >> "$GITHUB_OUTPUT"
         else
           echo "build-image-sha=${{ inputs.build-image-sha }}" >> "$GITHUB_OUTPUT"
         fi
@@ -87,30 +75,24 @@ jobs:
     needs: setup
     if: ${{ !inputs.skip-lint }}
     uses: ./.github/workflows/pipeline-electron-lint.yml
-    permissions:
-      contents: read
     with:
       container: '{"image":"ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}","options":"--user root"}'
     secrets: inherit
 
   # Docs Only Jobs
   docs-only:
-    needs: [setup, checkout-linux]
+    needs: setup
     if: ${{ needs.setup.outputs.docs-only == 'true' }}
     uses: ./.github/workflows/pipeline-electron-docs-only.yml
-    permissions:
-      contents: read
     with:
-      container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+      container: '{"image":"ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}","options":"--user root"}'
     secrets: inherit
 
   # Checkout Jobs
   checkout-macos:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-macos}}
-    runs-on: electron-arc-centralus-linux-amd64-32core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -137,10 +119,8 @@ jobs:
 
   checkout-linux:
     needs: setup
-    if: ${{ !inputs.skip-linux}}
-    runs-on: electron-arc-centralus-linux-amd64-32core
-    permissions:
-      contents: read
+    if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-linux}}
+    runs-on: electron-arc-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -169,9 +149,7 @@ jobs:
   checkout-windows:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
-    runs-on: electron-arc-centralus-linux-amd64-32core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -202,8 +180,6 @@ jobs:
   # GN Check Jobs
   macos-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
-    permissions:
-      contents: read
     needs: checkout-macos
     with:
       target-platform: macos
@@ -214,27 +190,22 @@ jobs:
 
   linux-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
-    permissions:
-      contents: read
     needs: checkout-linux
-    if: ${{ needs.setup.outputs.src == 'true' }}
     with:
       target-platform: linux
       target-archs: x64 arm arm64
-      check-runs-on: electron-arc-centralus-linux-amd64-8core
+      check-runs-on: electron-arc-linux-amd64-8core
       check-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       gn-build-type: testing
     secrets: inherit
 
   windows-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
-    permissions:
-      contents: read
     needs: checkout-windows
     with:
       target-platform: win
       target-archs: x64 x86 arm64
-      check-runs-on: electron-arc-centralus-linux-amd64-8core
+      check-runs-on: electron-arc-linux-amd64-8core
       check-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-windows.outputs.build-image-sha }}","options":"--user root --device /dev/fuse --cap-add SYS_ADMIN","volumes":["/mnt/win-cache:/mnt/win-cache"]}'
       gn-build-type: testing
     secrets: inherit
@@ -249,14 +220,13 @@ jobs:
     needs: checkout-macos
     with:
       build-runs-on: macos-14-xlarge
-      test-runs-on: macos-14-large 
+      test-runs-on: macos-13
       target-platform: macos
       target-arch: x64
       is-release: false
       gn-build-type: testing
       generate-symbols: false
       upload-to-storage: '0'
-      enable-ssh: ${{ inputs.enable-ssh || false }}
     secrets: inherit
   
   macos-arm64:
@@ -275,7 +245,6 @@ jobs:
       gn-build-type: testing
       generate-symbols: false
       upload-to-storage: '0'
-      enable-ssh: ${{ inputs.enable-ssh || false }}
     secrets: inherit
 
   linux-x64:
@@ -285,10 +254,9 @@ jobs:
       pull-requests: read
     uses: ./.github/workflows/pipeline-electron-build-and-test-and-nan.yml
     needs: checkout-linux
-    if: ${{ needs.setup.outputs.src == 'true' }}
     with:
-      build-runs-on: electron-arc-centralus-linux-amd64-32core
-      test-runs-on: electron-arc-centralus-linux-amd64-4core
+      build-runs-on: electron-arc-linux-amd64-32core
+      test-runs-on: electron-arc-linux-amd64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
       target-platform: linux
@@ -306,10 +274,9 @@ jobs:
       pull-requests: read
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
-    if: ${{ needs.setup.outputs.src == 'true' }}
     with:
-      build-runs-on: electron-arc-centralus-linux-amd64-32core
-      test-runs-on: electron-arc-centralus-linux-amd64-4core
+      build-runs-on: electron-arc-linux-amd64-32core
+      test-runs-on: electron-arc-linux-amd64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
       target-platform: linux
@@ -328,10 +295,9 @@ jobs:
       pull-requests: read
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
-    if: ${{ needs.setup.outputs.src == 'true' }}
     with:
-      build-runs-on: electron-arc-centralus-linux-amd64-32core
-      test-runs-on: electron-arc-centralus-linux-arm64-4core
+      build-runs-on: electron-arc-linux-amd64-32core
+      test-runs-on: electron-arc-linux-arm64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/test:arm32v7-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init","volumes":["/home/runner/externals:/mnt/runner-externals"]}'
       target-platform: linux
@@ -349,10 +315,9 @@ jobs:
       pull-requests: read
     uses: ./.github/workflows/pipeline-electron-build-and-test.yml
     needs: checkout-linux
-    if: ${{ needs.setup.outputs.src == 'true' }}
     with:
-      build-runs-on: electron-arc-centralus-linux-amd64-32core
-      test-runs-on: ubuntu-22.04-arm
+      build-runs-on: electron-arc-linux-amd64-32core
+      test-runs-on: electron-arc-linux-arm64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       test-container: '{"image":"ghcr.io/electron/test:arm64v8-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
       target-platform: linux
@@ -372,7 +337,7 @@ jobs:
     needs: checkout-windows
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     with:
-      build-runs-on: electron-arc-centralus-windows-amd64-16core
+      build-runs-on: electron-arc-windows-amd64-16core
       test-runs-on: windows-latest
       target-platform: win
       target-arch: x64
@@ -391,7 +356,7 @@ jobs:
     needs: checkout-windows
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     with:
-      build-runs-on: electron-arc-centralus-windows-amd64-16core
+      build-runs-on: electron-arc-windows-amd64-16core
       test-runs-on: windows-latest
       target-platform: win
       target-arch: x86
@@ -410,8 +375,8 @@ jobs:
     needs: checkout-windows
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     with:
-      build-runs-on: electron-arc-centralus-windows-amd64-16core
-      test-runs-on: windows-11-arm
+      build-runs-on: electron-arc-windows-amd64-16core
+      test-runs-on: electron-hosted-windows-arm64-4core
       target-platform: win
       target-arch: arm64
       is-release: false
@@ -423,8 +388,6 @@ jobs:
   gha-done:
     name: GitHub Actions Completed
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     needs: [docs-only, macos-x64, macos-arm64, linux-x64, linux-x64-asan, linux-arm, linux-arm64, windows-x64, windows-x86, windows-arm64]
     if: always() && !contains(needs.*.result, 'failure')
     steps: 

.github/workflows/clean-src-cache.yml

@@ -1,20 +1,16 @@
 name: Clean Source Cache
 
-# Description:
-# This workflow cleans up the source cache on the cross-instance cache volume
-# to free up space. It runs daily at midnight and clears files older than 15 days.
+description: |
+  This workflow cleans up the source cache on the cross-instance cache volume
+  to free up space. It runs daily at midnight and clears files older than 15 days.
 
 on:
   schedule:
     - cron: "0 0 * * *"
 
-permissions: {}
-
 jobs:
   clean-src-cache:
-    runs-on: electron-arc-centralus-linux-amd64-32core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root

.github/workflows/issue-labeled.yml

@@ -4,15 +4,14 @@ on:
   issues:
     types: [labeled]
 
-permissions: {}
+permissions:  # added using https://github.com/step-security/secure-workflows
+  contents: read
 
 jobs:
   issue-labeled-with-status:
     name: status/{confirmed,reviewed} label added
     if: github.event.label.name == 'status/confirmed' || github.event.label.name == 'status/reviewed'
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -32,8 +31,6 @@ jobs:
     name: blocked/* label added
     if: startsWith(github.event.label.name, 'blocked/')
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/issue-opened.yml

@@ -11,7 +11,6 @@ jobs:
   add-to-issue-triage:
     if: ${{ contains(github.event.issue.labels.*.name, 'bug :beetle:') }}
     runs-on: ubuntu-latest
-    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -29,7 +28,6 @@ jobs:
   set-labels:
     if: ${{ contains(github.event.issue.labels.*.name, 'bug :beetle:') }}
     runs-on: ubuntu-latest
-    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/issue-transferred.yml

@@ -10,7 +10,6 @@ jobs:
   issue-transferred:
     name: Issue Transferred
     runs-on: ubuntu-latest
-    permissions: {}
     if: ${{ !github.event.changes.new_repository.private }}
     steps:
       - name: Generate GitHub App token

.github/workflows/issue-unlabeled.yml

@@ -4,15 +4,14 @@ on:
   issues:
     types: [unlabeled]
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   issue-unlabeled-blocked:
     name: All blocked/* labels removed
     if: startsWith(github.event.label.name, 'blocked/') && github.event.issue.state == 'open'
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
       - name: Check for any blocked labels
         id: check-for-blocked-labels

.github/workflows/linux-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
+        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
       upload-to-storage:
         description: 'Uploads to Azure storage'
         required: false
@@ -17,13 +17,9 @@ on:
         type: boolean
         default: false
 
-permissions: {}
-
 jobs:
   checkout-linux:
-    runs-on: electron-arc-centralus-linux-amd64-32core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root
@@ -44,51 +40,48 @@ jobs:
 
   publish-x64:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     needs: checkout-linux
     with:
       environment: production-release
-      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      build-runs-on: electron-arc-linux-amd64-32core
       build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       target-platform: linux
       target-arch: x64
       is-release: true
       gn-build-type: release
       generate-symbols: true
+      strip-binaries: true
       upload-to-storage: ${{ inputs.upload-to-storage }}
     secrets: inherit
 
   publish-arm:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     needs: checkout-linux
     with:
       environment: production-release
-      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      build-runs-on: electron-arc-linux-amd64-32core
       build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       target-platform: linux
       target-arch: arm
       is-release: true
       gn-build-type: release
       generate-symbols: true
+      strip-binaries: true
       upload-to-storage: ${{ inputs.upload-to-storage }}
     secrets: inherit
 
   publish-arm64:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     needs: checkout-linux
     with:
       environment: production-release
-      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      build-runs-on: electron-arc-linux-amd64-32core
       build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
       target-platform: linux
       target-arch: arm64
       is-release: true
       gn-build-type: release
       generate-symbols: true
+      strip-binaries: true
       upload-to-storage: ${{ inputs.upload-to-storage }}
     secrets: inherit

.github/workflows/macos-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
+        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
         required: true
       upload-to-storage:
         description: 'Uploads to Azure storage'
@@ -18,13 +18,9 @@ on:
         type: boolean
         default: false
 
-permissions: {}
-
 jobs:
   checkout-macos:
-    runs-on: electron-arc-centralus-linux-amd64-32core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root
@@ -48,8 +44,6 @@ jobs:
 
   publish-x64-darwin:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -65,8 +59,6 @@ jobs:
 
   publish-x64-mas:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -82,8 +74,6 @@ jobs:
 
   publish-arm64-darwin:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -99,8 +89,6 @@ jobs:
 
   publish-arm64-mas:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     needs: checkout-macos
     with:
       environment: production-release

.github/workflows/pipeline-electron-build-and-test-and-nan.yml

@@ -55,8 +55,6 @@ on:
         type: boolean
         default: false
 
-permissions: {}
-
 concurrency:
   group: electron-build-and-test-and-nan-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -64,8 +62,6 @@ concurrency:
 jobs:
   build:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     with:
       build-runs-on: ${{ inputs.build-runs-on }}
       build-container: ${{ inputs.build-container }}
@@ -78,10 +74,6 @@ jobs:
     secrets: inherit
   test:
     uses: ./.github/workflows/pipeline-segment-electron-test.yml
-    permissions:
-      contents: read
-      issues: read
-      pull-requests: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}
@@ -91,8 +83,6 @@ jobs:
     secrets: inherit
   nn-test:
     uses: ./.github/workflows/pipeline-segment-node-nan-test.yml
-    permissions:
-      contents: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}

.github/workflows/pipeline-electron-build-and-test.yml

@@ -54,23 +54,19 @@ on:
         required: false
         type: boolean
         default: false
-      enable-ssh:
-        description: 'Enable SSH debugging'
-        required: false
-        type: boolean
-        default: false
 
 concurrency:
   group: electron-build-and-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
 
-permissions: {}
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read  
 
 jobs:
   build:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     with:
       build-runs-on: ${{ inputs.build-runs-on }}
       build-container: ${{ inputs.build-container }}
@@ -80,21 +76,15 @@ jobs:
       gn-build-type: ${{ inputs.gn-build-type }}
       generate-symbols: ${{ inputs.generate-symbols }}
       upload-to-storage: ${{ inputs.upload-to-storage }}
-      is-asan: ${{ inputs.is-asan }}
-      enable-ssh: ${{ inputs.enable-ssh }}
+      is-asan: ${{ inputs.is-asan}}
     secrets: inherit
   test:
     uses: ./.github/workflows/pipeline-segment-electron-test.yml
-    permissions:
-      contents: read
-      issues: read
-      pull-requests: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}
       target-platform: ${{ inputs.target-platform }}
       test-runs-on: ${{ inputs.test-runs-on }}
       test-container: ${{ inputs.test-container }}
-      is-asan: ${{ inputs.is-asan }}
-      enable-ssh: ${{ inputs.enable-ssh }}
+      is-asan: ${{ inputs.is-asan}}
     secrets: inherit

.github/workflows/pipeline-electron-docs-only.yml

@@ -8,40 +8,17 @@ on:
         description: 'Container to run the docs-only ts compile in'
         type: string
 
-permissions: {}
-
 concurrency:
   group: electron-docs-only-${{ github.ref }}
   cancel-in-progress: true
 
-env:  
-  GCLIENT_EXTRA_ARGS: --custom-var=checkout_arm=True --custom-var=checkout_arm64=True
-
 jobs:
   docs-only:
     name: Docs Only Compile
-    runs-on: electron-arc-centralus-linux-amd64-4core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-4core
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:
-    - name: Checkout Electron
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      with:
-        path: src/electron
-        fetch-depth: 0
-        ref: ${{ github.event.pull_request.head.sha }}
-    - name: Generate DEPS Hash
-      run: |
-        node src/electron/script/generate-deps-hash.js
-        DEPSHASH=v1-src-cache-$(cat src/electron/.depshash)
-        echo "DEPSHASH=$DEPSHASH" >> $GITHUB_ENV
-        echo "CACHE_PATH=$DEPSHASH.tar" >> $GITHUB_ENV
-    - name: Restore src cache via AKS
-      uses: ./src/electron/.github/actions/restore-cache-aks
-      with:
-        target-platform: linux
     - name: Checkout Electron
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       with:

.github/workflows/pipeline-electron-lint.yml

@@ -8,8 +8,6 @@ on:
         description: 'Container to run lint in'
         type: string
 
-permissions: {}
-
 concurrency:
   group: electron-lint-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -20,9 +18,7 @@ env:
 jobs:
   lint:
     name: Lint
-    runs-on: electron-arc-centralus-linux-amd64-4core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-4core
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:

.github/workflows/pipeline-segment-electron-build.yml

@@ -48,18 +48,17 @@ on:
         required: true
         type: string
         default: '0'
+      strip-binaries: 
+        description: 'Strip the binaries before release (Linux only)'
+        required: false
+        type: boolean
+        default: false
       is-asan: 
         description: 'Building the Address Sanitizer (ASan) Linux build'
         required: false
         type: boolean
         default: false
-      enable-ssh:
-        description: 'Enable SSH debugging'
-        required: false
-        type: boolean
-        default: false
 
-permissions: {}
 
 concurrency:
   group: electron-build-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.target-variant }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
@@ -68,14 +67,12 @@ concurrency:
 env:
   CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
   CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   ELECTRON_ARTIFACTS_BLOB_STORAGE: ${{ secrets.ELECTRON_ARTIFACTS_BLOB_STORAGE }}
   ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
   SUDOWOODO_EXCHANGE_URL: ${{ secrets.SUDOWOODO_EXCHANGE_URL }}
   SUDOWOODO_EXCHANGE_TOKEN: ${{ secrets.SUDOWOODO_EXCHANGE_TOKEN }}
   GCLIENT_EXTRA_ARGS: ${{ inputs.target-platform == 'macos' && '--custom-var=checkout_mac=True --custom-var=host_os=mac' || inputs.target-platform == 'win' && '--custom-var=checkout_win=True' || '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True' }}
   ELECTRON_OUT_DIR: Default
-  ACTIONS_STEP_DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }}
 
 jobs:
   build:
@@ -83,13 +80,10 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.build-runs-on }}
-    permissions:
-      contents: read
     container: ${{ fromJSON(inputs.build-container) }}
     environment: ${{ inputs.environment }}
     env:
       TARGET_ARCH: ${{ inputs.target-arch }}
-      TARGET_PLATFORM: ${{ inputs.target-platform }}
     steps:
     - name: Create src dir
       run: |
@@ -100,17 +94,6 @@ jobs:
         path: src/electron
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
-    - name: Setup SSH Debugging
-      if: ${{ inputs.target-platform == 'macos' && (inputs.enable-ssh || env.ACTIONS_STEP_DEBUG == 'true') }}
-      uses: ./src/electron/.github/actions/ssh-debug
-      with:
-        tunnel: 'true'
-      env:
-        CLOUDFLARE_TUNNEL_CERT: ${{ secrets.CLOUDFLARE_TUNNEL_CERT }}
-        CLOUDFLARE_TUNNEL_HOSTNAME: ${{ vars.CLOUDFLARE_TUNNEL_HOSTNAME }}
-        CLOUDFLARE_USER_CA_CERT: ${{ secrets.CLOUDFLARE_USER_CA_CERT }}
-        AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Free up space (macOS)
       if: ${{ inputs.target-platform == 'macos' }}
       uses: ./src/electron/.github/actions/free-space-macos
@@ -177,7 +160,7 @@ jobs:
         ELECTRON_DEPOT_TOOLS_DISABLE_LOG: true
     - name: Init Build Tools
       run: |
-        e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu ${{ inputs.target-arch }} --remote-build siso
+        e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu ${{ inputs.target-arch }}
     - name: Run Electron Only Hooks
       run: |
         e d gclient runhooks --spec="solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False},'managed':False}]"
@@ -187,6 +170,9 @@ jobs:
         echo "DEPSHASH=$(cat src/electron/.depshash)" >> $GITHUB_ENV
     - name: Add CHROMIUM_BUILDTOOLS_PATH to env
       run: echo "CHROMIUM_BUILDTOOLS_PATH=$(pwd)/src/buildtools" >> $GITHUB_ENV
+    - name: Setup Number of Ninja Processes
+      run: |
+        echo "NUMBER_OF_NINJA_PROCESSES=${{ inputs.target-platform != 'macos' && '300' || '200' }}" >> $GITHUB_ENV
     - name: Free up space (macOS)
       if: ${{ inputs.target-platform == 'macos' }}
       uses: ./src/electron/.github/actions/free-space-macos
@@ -199,6 +185,7 @@ jobs:
         artifact-platform: ${{ inputs.target-platform == 'macos' && 'darwin' || inputs.target-platform }}
         is-release: '${{ inputs.is-release }}'
         generate-symbols: '${{ inputs.generate-symbols }}'
+        strip-binaries: '${{ inputs.strip-binaries }}'
         upload-to-storage: '${{ inputs.upload-to-storage }}'
         is-asan: '${{ inputs.is-asan }}'
     - name: Set GN_EXTRA_ARGS for MAS Build

.github/workflows/pipeline-segment-electron-gn-check.yml

@@ -26,8 +26,6 @@ on:
         type: string
         default: testing
 
-permissions: {}
-
 concurrency:
   group: electron-gn-check-${{ inputs.target-platform }}-${{ github.ref }}
   cancel-in-progress: true
@@ -43,8 +41,6 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.check-runs-on }}
-    permissions:
-      contents: read
     container: ${{ fromJSON(inputs.check-container) }}
     steps:
     - name: Checkout Electron

.github/workflows/pipeline-segment-electron-test.yml

@@ -25,24 +25,21 @@ on:
         required: false
         type: boolean
         default: false
-      enable-ssh:
-        description: 'Enable SSH debugging'
-        required: false
-        type: boolean
-        default: false
 
 concurrency:
   group: electron-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
 
-permissions: {}
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
 
 env:
   CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
   CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
   ELECTRON_OUT_DIR: Default
   ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
-  ACTIONS_STEP_DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }}
 
 jobs:
   test:
@@ -50,10 +47,6 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.test-runs-on }}
-    permissions:
-      contents: read
-      issues: read
-      pull-requests: read
     container: ${{ fromJSON(inputs.test-container) }}
     strategy:
       fail-fast: false
@@ -69,6 +62,21 @@ jobs:
       if: ${{ inputs.target-arch == 'arm' && inputs.target-platform == 'linux' }}
       run: |
         cp $(which node) /mnt/runner-externals/node20/bin/
+    - name: Install Git on Windows arm64 runners
+      if: ${{ inputs.target-arch == 'arm64' && inputs.target-platform == 'win' }}
+      shell: powershell
+      run: |
+        Set-ExecutionPolicy Bypass -Scope Process -Force
+        [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
+        iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
+        choco install -y --no-progress git.install --params "'/GitAndUnixToolsOnPath'"
+        choco install -y --no-progress git
+        choco install -y --no-progress python --version 3.11.9
+        choco install -y --no-progress visualstudio2022-workload-vctools --package-parameters "--add Microsoft.VisualStudio.Component.VC.Tools.ARM64"
+        echo "C:\Program Files\Git\cmd" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+        echo "C:\Program Files\Git\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+        echo "C:\Python311" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+        cp "C:\Python311\python.exe" "C:\Python311\python3.exe"
     - name: Setup Node.js/npm
       if: ${{ inputs.target-platform == 'win' }}
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
@@ -116,17 +124,6 @@ jobs:
         path: src/electron
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
-    - name: Setup SSH Debugging
-      if: ${{ inputs.target-platform == 'macos' && (inputs.enable-ssh || env.ACTIONS_STEP_DEBUG == 'true') }}
-      uses: ./src/electron/.github/actions/ssh-debug
-      with:
-        tunnel: 'true'
-      env:
-        CLOUDFLARE_TUNNEL_CERT: ${{ secrets.CLOUDFLARE_TUNNEL_CERT }}
-        CLOUDFLARE_TUNNEL_HOSTNAME: ${{ vars.CLOUDFLARE_TUNNEL_HOSTNAME }}
-        CLOUDFLARE_USER_CA_CERT: ${{ secrets.CLOUDFLARE_USER_CA_CERT }}
-        AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Install Dependencies
       uses: ./src/electron/.github/actions/install-dependencies
     - name: Set Chromium Git Cookie
@@ -140,7 +137,6 @@ jobs:
         git config --global core.fscache true
         git config --global core.longpaths true
         git config --global core.preloadindex true
-        git config --global core.longpaths true
         git clone --filter=tree:0 https://chromium.googlesource.com/chromium/tools/depot_tools.git
         # Ensure depot_tools does not update.
         test -d depot_tools && cd depot_tools
@@ -165,18 +161,22 @@ jobs:
         path: ./src_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
     - name: Restore Generated Artifacts
       run: ./src/electron/script/actions/restore-artifacts.sh
-    - name: Unzip Dist (win)
+    - name: Unzip Dist, Mksnapshot & Chromedriver (win)
       if: ${{ inputs.target-platform == 'win' }}
       shell: powershell
       run: |
         Set-ExecutionPolicy Bypass -Scope Process -Force
         cd src/out/Default
         Expand-Archive -Force dist.zip -DestinationPath ./
-    - name: Unzip Dist (unix)
+        Expand-Archive -Force chromedriver.zip -DestinationPath ./
+        Expand-Archive -Force mksnapshot.zip -DestinationPath ./
+    - name: Unzip Dist, Mksnapshot & Chromedriver (unix)
       if: ${{ inputs.target-platform != 'win' }}
       run: |
         cd src/out/Default
         unzip -:o dist.zip
+        unzip -:o chromedriver.zip
+        unzip -:o mksnapshot.zip
     - name: Import & Trust Self-Signed Codesigning Cert on MacOS
       if: ${{ inputs.target-platform == 'macos' && inputs.target-arch == 'x64' }}
       run: |
@@ -212,7 +212,7 @@ jobs:
               export ELECTRON_FORCE_TEST_SUITE_EXIT="true"
             fi
           fi
-          node script/yarn test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
+          node script/yarn test --runners=main --trace-uncaught --enable-logging --files $tests_files
         else
           chown :builduser .. && chmod g+w ..
           chown -R :builduser . && chmod -R g+w .

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -26,8 +26,6 @@ on:
         type: string
         default: testing
 
-permissions: {}
-
 concurrency:
   group: electron-node-nan-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -40,9 +38,7 @@ env:
 jobs:
   node-tests:
     name: Run Node.js Tests
-    runs-on: electron-arc-centralus-linux-amd64-8core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-8core
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}
@@ -96,9 +92,7 @@ jobs:
         done
   nan-tests:
     name: Run Nan Tests
-    runs-on: electron-arc-centralus-linux-amd64-4core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-4core
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}

.github/workflows/pull-request-labeled.yml

@@ -11,7 +11,6 @@ jobs:
     name: backport/requested label added
     if: github.event.label.name == 'backport/requested 🗳'
     runs-on: ubuntu-latest
-    permissions: {}
     steps:
       - name: Trigger Slack workflow
         uses: slackapi/slack-github-action@b0fa283ad8fea605de13dc3f449259339835fc52 # v2.1.0
@@ -20,16 +19,12 @@ jobs:
           webhook-type: webhook-trigger
           payload: |
             {
-              "base_ref": ${{ toJSON(github.event.pull_request.base.ref) }},
-              "title": ${{ toJSON(github.event.pull_request.title) }},
-              "url": ${{ toJSON(github.event.pull_request.html_url) }},
-              "user": ${{ toJSON(github.event.pull_request.user.login) }}
+              "url": "${{ github.event.pull_request.html_url }}"
             }
   pull-request-labeled-deprecation-review-complete:
     name: deprecation-review/complete label added
     if: github.event.label.name == 'deprecation-review/complete ✅'
     runs-on: ubuntu-latest
-    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/scorecards.yml

@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: results.sarif

.github/workflows/semantic.yml

@@ -7,7 +7,8 @@ on:
       - edited
       - synchronize
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   main:

.github/workflows/stable-prep-items.yml

@@ -11,7 +11,6 @@ jobs:
   check-stable-prep-items:
     name: Check Stable Prep Items
     runs-on: ubuntu-latest
-    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/stale.yml

@@ -10,7 +10,6 @@ permissions: {}
 jobs:
   stale:
     runs-on: ubuntu-latest
-    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -32,7 +31,6 @@ jobs:
           only-pr-labels: not-a-real-label
   pending-repro:
     runs-on: ubuntu-latest
-    permissions: {}
     if: ${{ always() }}
     needs: stale
     steps:

.github/workflows/windows-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
+        default: '424eedbf277ad9749ffa9219068aa72ed4a5e373'
         required: true
       upload-to-storage:
         description: 'Uploads to Azure storage'
@@ -18,13 +18,9 @@ on:
         type: boolean
         default: false
 
-permissions: {}
-
 jobs:
   checkout-windows:
-    runs-on: electron-arc-centralus-linux-amd64-32core
-    permissions:
-      contents: read
+    runs-on: electron-arc-linux-amd64-32core
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -52,12 +48,10 @@ jobs:
 
   publish-x64-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     needs: checkout-windows
     with:
       environment: production-release
-      build-runs-on: electron-arc-centralus-windows-amd64-16core
+      build-runs-on: electron-arc-windows-amd64-16core
       target-platform: win
       target-arch: x64
       is-release: true
@@ -68,12 +62,10 @@ jobs:
 
   publish-arm64-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     needs: checkout-windows
     with:
       environment: production-release
-      build-runs-on: electron-arc-centralus-windows-amd64-16core
+      build-runs-on: electron-arc-windows-amd64-16core
       target-platform: win
       target-arch: arm64
       is-release: true
@@ -84,12 +76,10 @@ jobs:
 
   publish-x86-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
-    permissions:
-      contents: read
     needs: checkout-windows
     with:
       environment: production-release
-      build-runs-on: electron-arc-centralus-windows-amd64-16core
+      build-runs-on: electron-arc-windows-amd64-16core
       target-platform: win
       target-arch: x86
       is-release: true

BUILD.gn

@@ -4,9 +4,9 @@ import("//build/config/win/manifest.gni")
 import("//components/os_crypt/sync/features.gni")
 import("//components/spellcheck/spellcheck_build_features.gni")
 import("//content/public/app/mac_helpers.gni")
-import("//content/public/common/features.gni")
 import("//extensions/buildflags/buildflags.gni")
 import("//pdf/features.gni")
+import("//ppapi/buildflags/buildflags.gni")
 import("//printing/buildflags/buildflags.gni")
 import("//testing/test.gni")
 import("//third_party/electron_node/node.gni")
@@ -44,7 +44,6 @@ if (is_mac) {
 
 if (is_linux) {
   import("//build/config/linux/pkg_config.gni")
-  import("//electron/build/linux/strip_binary.gni")
   import("//tools/generate_stubs/rules.gni")
 
   pkg_config("gio_unix") {
@@ -453,7 +452,7 @@ source_set("electron_lib") {
     "//components/certificate_transparency",
     "//components/compose:buildflags",
     "//components/embedder_support:user_agent",
-    "//components/input",
+    "//components/input:input",
     "//components/language/core/browser",
     "//components/net_log",
     "//components/network_hints/browser",
@@ -486,7 +485,7 @@ source_set("electron_lib") {
     "//net:extras",
     "//net:net_resources",
     "//printing/buildflags",
-    "//services/device/public/cpp/bluetooth",
+    "//services/device/public/cpp/bluetooth:bluetooth",
     "//services/device/public/cpp/geolocation",
     "//services/device/public/cpp/hid",
     "//services/device/public/mojom",
@@ -519,10 +518,6 @@ source_set("electron_lib") {
     "//v8:v8_libplatform",
   ]
 
-  if (v8_use_external_startup_data && use_v8_context_snapshot) {
-    deps += [ ":mksnapshot_checksum_gen" ]
-  }
-
   public_deps = [
     "//base",
     "//base:i18n",
@@ -655,7 +650,6 @@ source_set("electron_lib") {
       "//ui/events/devices/x11",
       "//ui/events/platform/x11",
       "//ui/gtk:gtk_config",
-      "//ui/linux:display_server_utils",
       "//ui/linux:linux_ui",
       "//ui/linux:linux_ui_factory",
       "//ui/wm",
@@ -688,7 +682,6 @@ source_set("electron_lib") {
     deps += [
       "//components/app_launch_prefetch",
       "//components/crash/core/app:crash_export_thunks",
-      "//third_party/libxml:xml_writer",
       "//ui/native_theme:native_theme_browser",
       "//ui/wm",
       "//ui/wm/public",
@@ -734,7 +727,7 @@ source_set("electron_lib") {
       "shell/common/extensions/api:extensions_features",
       "//chrome/browser/resources:component_extension_resources",
       "//components/guest_view/common:mojom",
-      "//components/update_client",
+      "//components/update_client:update_client",
       "//components/zoom",
       "//extensions/browser",
       "//extensions/browser/api:api_provider",
@@ -779,14 +772,6 @@ source_set("electron_lib") {
   }
 }
 
-action("mksnapshot_checksum_gen") {
-  script = "build/checksum_header.py"
-  outputs = [ "$target_gen_dir/snapshot_checksum.h" ]
-  inputs = [ "$root_out_dir/$v8_context_snapshot_filename" ]
-  args = rebase_path(inputs) + rebase_path(outputs)
-  deps = [ "//tools/v8_context_snapshot" ]
-}
-
 electron_paks("packed_resources") {
   if (is_mac) {
     output_dir = "$root_gen_dir/electron_repack"
@@ -830,7 +815,7 @@ if (is_mac) {
       sources = []
       public_deps = []
       sources += [ "$root_out_dir/libffmpeg.dylib" ]
-      public_deps += [ "//third_party/ffmpeg" ]
+      public_deps += [ "//third_party/ffmpeg:ffmpeg" ]
       outputs = [ "{{bundle_contents_dir}}/Libraries/{{source_file_part}}" ]
     }
   } else {
@@ -1245,7 +1230,7 @@ if (is_mac) {
     }
 
     if (use_v8_context_snapshot) {
-      public_deps = [ "//tools/v8_context_snapshot" ]
+      public_deps = [ "//tools/v8_context_snapshot:v8_context_snapshot" ]
     }
 
     if (is_linux) {
@@ -1424,18 +1409,6 @@ dist_zip("electron_dist_zip") {
     ":licenses",
   ]
   if (is_linux) {
-    if (is_official_build) {
-      data_deps += [
-        ":strip_chrome_crashpad_handler",
-        ":strip_chrome_sandbox",
-        ":strip_electron_binary",
-        ":strip_libEGL_shlib",
-        ":strip_libGLESv2_shlib",
-        ":strip_libffmpeg_shlib",
-        ":strip_libvk_swiftshader_shlib",
-      ]
-    }
-
     data_deps += [ "//sandbox/linux:chrome_sandbox" ]
   }
   deps = data_deps
@@ -1481,16 +1454,6 @@ group("electron_mksnapshot") {
 
 dist_zip("electron_mksnapshot_zip") {
   data_deps = mksnapshot_deps
-  if (is_linux && is_official_build) {
-    data_deps += [
-      ":strip_libEGL_shlib",
-      ":strip_libGLESv2_shlib",
-      ":strip_libffmpeg_shlib",
-      ":strip_libvk_swiftshader_shlib",
-      ":strip_mksnapshot_binary",
-      ":strip_v8_context_snapshot_generator_binary",
-    ]
-  }
   deps = data_deps
   outputs = [ "$root_build_dir/mksnapshot.zip" ]
 }
@@ -1615,101 +1578,3 @@ group("copy_node_headers") {
 group("node_headers") {
   public_deps = [ ":tar_node_headers" ]
 }
-
-group("testing_build") {
-  public_deps = [
-    ":electron_dist_zip",
-    ":electron_mksnapshot_zip",
-    ":node_headers",
-  ]
-}
-
-group("release_build") {
-  public_deps = [ ":testing_build" ]
-  if (is_official_build) {
-    public_deps += [ ":electron_symbols" ]
-  }
-  if (is_linux) {
-    public_deps += [
-      ":hunspell_dictionaries_zip",
-      ":libcxx_headers_zip",
-      ":libcxx_objects_zip",
-      ":libcxxabi_headers_zip",
-    ]
-  }
-}
-
-if (is_linux && is_official_build) {
-  strip_binary("strip_electron_binary") {
-    binary_input = "$root_out_dir/$electron_project_name"
-    symbol_output = "$root_out_dir/debug/$electron_project_name.debug"
-    compress_debug_sections = true
-    deps = [ ":electron_app" ]
-  }
-
-  strip_binary("strip_chrome_crashpad_handler") {
-    binary_input = "$root_out_dir/chrome_crashpad_handler"
-    symbol_output = "$root_out_dir/debug/chrome_crashpad_handler.debug"
-    compress_debug_sections = true
-    deps = [ "//components/crash/core/app:chrome_crashpad_handler" ]
-  }
-
-  strip_binary("strip_chrome_sandbox") {
-    binary_input = "$root_out_dir/chrome_sandbox"
-    symbol_output = "$root_out_dir/debug/chrome-sandbox.debug"
-    compress_debug_sections = true
-    deps = [ "//sandbox/linux:chrome_sandbox" ]
-  }
-
-  strip_binary("strip_libEGL_shlib") {
-    binary_input = "$root_out_dir/libEGL.so"
-    symbol_output = "$root_out_dir/debug/libEGL.so.debug"
-    compress_debug_sections = true
-    deps = [ "//third_party/angle:libEGL" ]
-  }
-
-  strip_binary("strip_libGLESv2_shlib") {
-    binary_input = "$root_out_dir/libGLESv2.so"
-    symbol_output = "$root_out_dir/debug/libGLESv2.so.debug"
-    compress_debug_sections = true
-    deps = [ "//third_party/angle:libGLESv2" ]
-  }
-
-  strip_binary("strip_libffmpeg_shlib") {
-    binary_input = "$root_out_dir/libffmpeg.so"
-    symbol_output = "$root_out_dir/debug/libffmpeg.so.debug"
-    compress_debug_sections = true
-    deps = [ "//third_party/ffmpeg" ]
-  }
-
-  strip_binary("strip_libvk_swiftshader_shlib") {
-    binary_input = "$root_out_dir/libvk_swiftshader.so"
-    symbol_output = "$root_out_dir/debug/libvk_swiftshader.so.debug"
-    compress_debug_sections = true
-    deps = [ "//third_party/swiftshader/src/Vulkan:swiftshader_libvulkan" ]
-  }
-
-  strip_binary("strip_mksnapshot_binary") {
-    _binary_path = rebase_path(
-            get_label_info(
-                    ":v8_context_snapshot_generator($v8_snapshot_toolchain)",
-                    "root_out_dir") + "/mksnapshot",
-            root_build_dir)
-    binary_input = "$root_out_dir/$_binary_path"
-    symbol_output = "$root_out_dir/debug/${_binary_path}.debug"
-    compress_debug_sections = true
-    deps = mksnapshot_deps
-  }
-
-  strip_binary("strip_v8_context_snapshot_generator_binary") {
-    _binary_path = rebase_path(
-            get_label_info(
-                    ":v8_context_snapshot_generator($v8_snapshot_toolchain)",
-                    "root_out_dir") + "/v8_context_snapshot_generator",
-            root_build_dir)
-    binary_input = "$root_out_dir/$_binary_path"
-    symbol_output = "$root_out_dir/debug/${_binary_path}.debug"
-    compress_debug_sections = true
-    deps = mksnapshot_deps
-  }
-}

DEPS

@@ -2,9 +2,9 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '140.0.7339.249',
+    '140.0.7281.0',
   'node_version':
-    'v22.21.1',
+    'v22.17.1',
   'nan_version':
     'e14bdcd1f72d62bca1d541b66da43130384ec213',
   'squirrel.mac_version':

README.md

@@ -39,7 +39,7 @@ Each Electron release provides binaries for macOS, Windows, and Linux.
 
 * macOS (Big Sur and up): Electron provides 64-bit Intel and Apple Silicon / ARM binaries for macOS.
 * Windows (Windows 10 and up): Electron provides `ia32` (`x86`), `x64` (`amd64`), and `arm64` binaries for Windows. Windows on ARM support was added in Electron 5.0.8. Support for Windows 7, 8 and 8.1 was [removed in Electron 23, in line with Chromium's Windows deprecation policy](https://www.electronjs.org/blog/windows-7-to-8-1-deprecation-notice).
-* Linux: The prebuilt binaries of Electron are built on Ubuntu 22.04. They have also been verified to work on:
+* Linux: The prebuilt binaries of Electron are built on Ubuntu 20.04. They have also been verified to work on:
   * Ubuntu 18.04 and newer
   * Fedora 32 and newer
   * Debian 10 and newer

build/args/all.gn

@@ -24,6 +24,10 @@ enable_printing = true
 angle_enable_vulkan_validation_layers = false
 dawn_enable_vulkan_validation_layers = false
 
+# Removes dxc dll's that are only used experimentally.
+# See https://bugs.chromium.org/p/chromium/issues/detail?id=1474897
+dawn_use_built_dxc = false
+
 # These are disabled because they cause the zip manifest to differ between
 # testing and release builds.
 # See https://chromium-review.googlesource.com/c/chromium/src/+/2774898.
@@ -66,8 +70,6 @@ v8_expose_public_symbols = true
 # sensitive content by enterprise users.
 enterprise_cloud_content_analysis = false
 
-# We don't use anything from here, and it causes target collisions
-enable_linux_installer = false
-
-# Disable "Save to Drive" feature in PDF viewer
-enable_pdf_save_to_drive = false
+# Disable siso until we are ready to use it.
+# https://chromium-review.googlesource.com/c/chromium/src/+/6638830
+use_siso = false

build/checksum_header.py

@@ -1,37 +0,0 @@
-#!/usr/bin/env python3
-
-import os
-import sys
-import hashlib
-
-dir_path = os.path.dirname(os.path.realpath(__file__))
-
-TEMPLATE_H = """
-#ifndef ELECTRON_SNAPSHOT_CHECKSUM_H_
-#define ELECTRON_SNAPSHOT_CHECKSUM_H_
-
-namespace electron::snapshot_checksum {
-
-const std::string kChecksum = "{checksum}";
-
-}  // namespace electron::snapshot_checksum
-
-#endif  // ELECTRON_SNAPSHOT_CHECKSUM_H_
-"""
-
-def calculate_sha256(filepath):
-    sha256_hash = hashlib.sha256()
-    with open(filepath, "rb") as f:
-        for byte_block in iter(lambda: f.read(4096), b""):
-            sha256_hash.update(byte_block)
-    return sha256_hash.hexdigest()
-
-input_file = sys.argv[1]
-output_file = sys.argv[2]
-
-checksum = calculate_sha256(input_file)
-
-checksum_h = TEMPLATE_H.replace("{checksum}", checksum)
-
-with open(output_file, 'w') as f:
-    f.write(checksum_h)

build/linux/strip_binary.gni

@@ -1,70 +0,0 @@
-# Copyright 2021 The Chromium Authors
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# This has been adapted from https://source.chromium.org/chromium/chromium/src/+/main:build/linux/strip_binary.gni;drc=c220a41e0422d45f1657c28146d32e99cc53640b
-# The notable difference is it has an option to compress the debug sections
-
-import("//build/config/clang/clang.gni")
-import("//build/toolchain/toolchain.gni")
-
-# Extracts symbols from a binary into a symbol file.
-#
-# Args:
-#   binary_input: Path to the binary containing symbols to extract, e.g.:
-#       "$root_out_dir/chrome"
-#   symbol_output: Desired output file for symbols, e.g.:
-#       "$root_out_dir/chrome.debug"
-#   stripped_binary_output: Desired output file for stripped file, e.g.:
-#       "$root_out_dir/chrome.stripped"
-#   compress_debug_sections: If true, compress the extracted debug sections
-template("strip_binary") {
-  forward_variables_from(invoker,
-                         [
-                           "deps",
-                           "testonly",
-                         ])
-  action("${target_name}") {
-    llvm_strip_binary = "${clang_base_path}/bin/llvm-strip"
-    llvm_objcopy_binary = "${clang_base_path}/bin/llvm-objcopy"
-    script = "//electron/build/linux/strip_binary.py"
-
-    if (defined(invoker.stripped_binary_output)) {
-      stripped_binary_output = invoker.stripped_binary_output
-    } else {
-      stripped_binary_output = invoker.binary_input + ".stripped"
-    }
-    if (defined(invoker.symbol_output)) {
-      symbol_output = invoker.symbol_output
-    } else {
-      symbol_output = invoker.binary_input + ".debug"
-    }
-
-    inputs = [
-      invoker.binary_input,
-      llvm_strip_binary,
-      llvm_objcopy_binary,
-    ]
-    outputs = [
-      symbol_output,
-      stripped_binary_output,
-    ]
-    args = [
-      "--llvm-strip-binary-path",
-      rebase_path(llvm_strip_binary, root_build_dir),
-      "--llvm-objcopy-binary-path",
-      rebase_path(llvm_objcopy_binary, root_build_dir),
-      "--symbol-output",
-      rebase_path(symbol_output, root_build_dir),
-      "--stripped-binary-output",
-      rebase_path(stripped_binary_output, root_build_dir),
-      "--binary-input",
-      rebase_path(invoker.binary_input, root_build_dir),
-    ]
-
-    if (defined(invoker.compress_debug_sections) &&
-        invoker.compress_debug_sections) {
-      args += [ "--compress-debug-sections" ]
-    }
-  }
-}

build/linux/strip_binary.py

@@ -1,63 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright 2021 The Chromium Authors
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# This has been adapted from https://source.chromium.org/chromium/chromium/src/+/main:build/linux/strip_binary.py;drc=c220a41e0422d45f1657c28146d32e99cc53640b
-# The notable difference is it has an option to compress the debug sections
-
-import argparse
-import subprocess
-import sys
-
-
-def main() -> int:
-  parser = argparse.ArgumentParser(description="Strip binary using LLVM tools.")
-  parser.add_argument("--llvm-strip-binary-path",
-                      help="Path to llvm-strip executable.")
-  parser.add_argument("--llvm-objcopy-binary-path",
-                      required=True,
-                      help="Path to llvm-objcopy executable.")
-  parser.add_argument("--binary-input", help="Input ELF binary.")
-  parser.add_argument("--symbol-output",
-                      help="File to write extracted debug info (.debug).")
-  parser.add_argument("--compress-debug-sections",
-                      action="store_true",
-                      help="Compress extracted debug info.")
-  parser.add_argument("--stripped-binary-output",
-                      help="File to write stripped binary.")
-  args = parser.parse_args()
-
-  # Replicate the behavior of:
-  # eu-strip <binary_input> -o <stripped_binary_output> -f <symbol_output>
-
-  objcopy_args = [
-      "--only-keep-debug",
-      args.binary_input,
-      args.symbol_output,
-  ]
-
-  if args.compress_debug_sections:
-    objcopy_args.insert(0, "--compress-debug-sections")
-
-  subprocess.check_output([args.llvm_objcopy_binary_path] + objcopy_args)
-  subprocess.check_output([
-      args.llvm_strip_binary_path,
-      "--strip-debug",
-      "--strip-unneeded",
-      "-o",
-      args.stripped_binary_output,
-      args.binary_input,
-  ])
-  subprocess.check_output([
-      args.llvm_objcopy_binary_path,
-      f"--add-gnu-debuglink={args.symbol_output}",
-      args.stripped_binary_output,
-  ])
-
-  return 0
-
-
-if __name__ == "__main__":
-  sys.exit(main())

build/rules.gni

@@ -67,10 +67,6 @@ template("mac_xib_bundle_data") {
     ibtool_flags = [
       "--minimum-deployment-target",
       mac_deployment_target,
-
-      # TODO(rsesek): Enable this once all the bots are on Xcode 7+.
-      # "--target-device",
-      # "mac",
     ]
   }
 

build/siso/backend.star

@@ -3,7 +3,7 @@
 load("@builtin//struct.star", "module")
 
 def __platform_properties(ctx):
-    container_image = "docker://gcr.io/chops-public-images-prod/rbe/siso-chromium/linux@sha256:d7cb1ab14a0f20aa669c23f22c15a9dead761dcac19f43985bf9dd5f41fbef3a"
+    container_image = "docker://gcr.io/chops-public-images-prod/rbe/siso-chromium/linux@sha256:ef35d347f4a4a2d32b76fd908e66e96f59bf8ba7379fd5626548244c45343b2b"
     return {
         "default": {
             "OSFamily": "Linux",

build/siso/main.star

@@ -1,66 +0,0 @@
-load("@builtin//encoding.star", "json")
-load("@builtin//path.star", "path")
-load("@builtin//runtime.star", "runtime")
-load("@builtin//struct.star", "module")
-load("@config//main.star", upstream_init = "init")
-load("@config//win_sdk.star", "win_sdk")
-load("@config//gn_logs.star", "gn_logs")
-
-def init(ctx):
-    mod = upstream_init(ctx)
-    step_config = json.decode(mod.step_config)
-
-    # Buildbarn doesn't support input_root_absolute_path so disable that
-    for rule in step_config["rules"]:    
-      input_root_absolute_path = rule.get("input_root_absolute_path", False)
-      if input_root_absolute_path:
-        rule.pop("input_root_absolute_path", None)
-
-    # Only wrap clang rules with a remote wrapper if not on Linux. These are currently only
-    # needed for X-Compile builds, which run on Windows and Mac.
-    if runtime.os != "linux":
-      for rule in step_config["rules"]:
-        if rule["name"].startswith("clang/") or rule["name"].startswith("clang-cl/"):
-          rule["remote_wrapper"] = "../../buildtools/reclient_cfgs/chromium-browser-clang/clang_remote_wrapper"
-          if "inputs" not in rule:
-            rule["inputs"] = []
-          rule["inputs"].append("buildtools/reclient_cfgs/chromium-browser-clang/clang_remote_wrapper")
-          rule["inputs"].append("third_party/llvm-build/Release+Asserts_linux/bin/clang")
-
-      if "executables" not in step_config:
-        step_config["executables"] = []
-      step_config["executables"].append("buildtools/reclient_cfgs/chromium-browser-clang/clang_remote_wrapper")
-      step_config["executables"].append("third_party/llvm-build/Release+Asserts_linux/bin/clang")
-
-    if runtime.os == "darwin":
-      # Update platforms to match our default siso config instead of reclient configs.
-      step_config["platforms"].update({
-          "clang": step_config["platforms"]["default"],
-          "clang_large": step_config["platforms"]["default"],          
-      })      
-
-    if runtime.os == "windows":
-      # Add additional Windows SDK headers needed by Electron      
-      win_toolchain_dir = win_sdk.toolchain_dir(ctx)
-      if win_toolchain_dir:
-        sdk_version = gn_logs.read(ctx).get("windows_sdk_version")
-        step_config["input_deps"][win_toolchain_dir + ":headers"].extend([
-          # third_party/electron_node/deps/uv/include/uv/win.h includes mswsock.h
-          path.join(win_toolchain_dir, "Windows Kits/10/Include", sdk_version, "um/mswsock.h"),
-          # third_party/electron_node/src/debug_utils.cc includes lm.h
-          path.join(win_toolchain_dir, "Windows Kits/10/Include", sdk_version, "um/Lm.h"),          
-        ])
-      
-      # Update platforms to match our default siso config instead of reclient configs.
-      step_config["platforms"].update({
-          "clang-cl": step_config["platforms"]["default"],
-          "clang-cl_large": step_config["platforms"]["default"],
-          "lld-link": step_config["platforms"]["default"],
-      })
-
-    return module(
-      "config",
-      step_config = json.encode(step_config),
-      filegroups = mod.filegroups,
-      handlers = mod.handlers,
-    )

build/webpack/webpack.config.base.js

@@ -121,7 +121,6 @@ if ((globalThis.process || binding.process).argv.includes("--profile-electron-in
           'electron/main$': electronAPIFile,
           'electron/renderer$': electronAPIFile,
           'electron/common$': electronAPIFile,
-          'electron/utility$': electronAPIFile,
           // Force timers to resolve to our dependency that doesn't use window.postMessage
           timers: path.resolve(electronRoot, 'node_modules', 'timers-browserify', 'main.js')
         },
@@ -144,9 +143,7 @@ if ((globalThis.process || binding.process).argv.includes("--profile-electron-in
             transpileOnly: onlyPrintingGraph,
             ignoreDiagnostics: [
               // File '{0}' is not under 'rootDir' '{1}'.
-              6059,
-              // Private field '{0}' must be declared in an enclosing class.
-              1111
+              6059
             ]
           }
         }]

build/zip.py

@@ -41,8 +41,6 @@ PATHS_TO_SKIP = [
   'resources/inspector',
   'gen/third_party/devtools-frontend/src',
   'gen/ui/webui',
-  # Skip because these get zipped separately in script/zip-symbols.py
-  'debug',
 ]
 
 def skip_path(dep, dist_zip, target_cpu):
@@ -82,11 +80,6 @@ def main(argv):
       dep = dep.strip()
       if not skip_path(dep, dist_zip, target_cpu):
         dist_files.add(dep)
-  # On Linux, filter out any files which have a .stripped companion
-  if sys.platform == 'linux':
-    dist_files = {
-      dep for dep in dist_files if f"{dep.removeprefix('./')}.stripped" not in dist_files
-    }
   if sys.platform == 'darwin' and not should_flatten:
     execute(['zip', '-r', '-y', dist_zip] + list(dist_files))
   else:
@@ -103,13 +96,10 @@ def main(argv):
           dirname = os.path.dirname(dep)
           arcname = (
             os.path.join(dirname, 'chrome-sandbox')
-            if basename.removesuffix('.stripped') == 'chrome_sandbox'
+            if basename == 'chrome_sandbox'
             else dep
           )
           name_to_write = arcname
-          # On Linux, strip the .stripped suffix from the name before zipping
-          if sys.platform == 'linux':
-            name_to_write = name_to_write.removesuffix('.stripped')
           if should_flatten:
             if flatten_relative_to:
               if name_to_write.startswith(flatten_relative_to):

chromium_src/BUILD.gn

@@ -76,8 +76,14 @@ static_library("chrome") {
     "//chrome/browser/picture_in_picture/scoped_picture_in_picture_occlusion_observation.h",
     "//chrome/browser/platform_util.cc",
     "//chrome/browser/platform_util.h",
+    "//chrome/browser/predictors/preconnect_manager.cc",
+    "//chrome/browser/predictors/preconnect_manager.h",
     "//chrome/browser/predictors/predictors_features.cc",
     "//chrome/browser/predictors/predictors_features.h",
+    "//chrome/browser/predictors/proxy_lookup_client_impl.cc",
+    "//chrome/browser/predictors/proxy_lookup_client_impl.h",
+    "//chrome/browser/predictors/resolve_host_client_impl.cc",
+    "//chrome/browser/predictors/resolve_host_client_impl.h",
     "//chrome/browser/process_singleton.h",
     "//chrome/browser/process_singleton_internal.cc",
     "//chrome/browser/process_singleton_internal.h",
@@ -124,12 +130,8 @@ static_library("chrome") {
     "//chrome/browser/ui/views/overlay/hang_up_button.h",
     "//chrome/browser/ui/views/overlay/minimize_button.cc",
     "//chrome/browser/ui/views/overlay/minimize_button.h",
-    "//chrome/browser/ui/views/overlay/overlay_controls_fade_animation.cc",
-    "//chrome/browser/ui/views/overlay/overlay_controls_fade_animation.h",
     "//chrome/browser/ui/views/overlay/overlay_window_image_button.cc",
     "//chrome/browser/ui/views/overlay/overlay_window_image_button.h",
-    "//chrome/browser/ui/views/overlay/overlay_window_live_caption_button.cc",
-    "//chrome/browser/ui/views/overlay/overlay_window_live_caption_button.h",
     "//chrome/browser/ui/views/overlay/playback_image_button.cc",
     "//chrome/browser/ui/views/overlay/playback_image_button.h",
     "//chrome/browser/ui/views/overlay/resize_handle_button.cc",
@@ -142,8 +144,6 @@ static_library("chrome") {
     "//chrome/browser/ui/views/overlay/toggle_camera_button.h",
     "//chrome/browser/ui/views/overlay/toggle_microphone_button.cc",
     "//chrome/browser/ui/views/overlay/toggle_microphone_button.h",
-    "//chrome/browser/ui/views/overlay/video_overlay_window_native_widget_mac.h",
-    "//chrome/browser/ui/views/overlay/video_overlay_window_native_widget_mac.mm",
     "//chrome/browser/ui/views/overlay/video_overlay_window_views.cc",
     "//chrome/browser/ui/views/overlay/video_overlay_window_views.h",
     "//chrome/browser/ui/views/picture_in_picture/picture_in_picture_bounds_change_animation.cc",
@@ -213,7 +213,7 @@ static_library("chrome") {
     "//components/enterprise/common/proto:connectors_proto",
     "//components/enterprise/obfuscation/core:enterprise_obfuscation",
     "//components/safe_browsing/core/browser/db:safebrowsing_proto",
-    "//components/vector_icons",
+    "//components/vector_icons:vector_icons",
     "//ui/base/accelerators/global_accelerator_listener",
     "//ui/snapshot",
     "//ui/views/controls/webview",
@@ -280,6 +280,8 @@ static_library("chrome") {
       "//chrome/browser/process_singleton_mac.mm",
       "//chrome/browser/ui/views/eye_dropper/eye_dropper_view_mac.h",
       "//chrome/browser/ui/views/eye_dropper/eye_dropper_view_mac.mm",
+      "//chrome/browser/ui/views/overlay/video_overlay_window_native_widget_mac.h",
+      "//chrome/browser/ui/views/overlay/video_overlay_window_native_widget_mac.mm",
     ]
     deps += [ ":system_media_capture_permissions_mac_conflict" ]
   }
@@ -502,15 +504,17 @@ source_set("chrome_spellchecker") {
   ]
 }
 
-# These sources create an object file conflict with one in |:chrome|, so they
-# must live in a separate target.
-# Conflicting sources:
-#   //chrome/browser/media/webrtc/system_media_capture_permissions_stats_mac.mm
-#   //chrome/browser/permissions/system/system_media_capture_permissions_mac.mm
-source_set("system_media_capture_permissions_mac_conflict") {
-  sources = [
-    "//chrome/browser/permissions/system/system_media_capture_permissions_mac.h",
-    "//chrome/browser/permissions/system/system_media_capture_permissions_mac.mm",
-  ]
-  deps = [ "//chrome/common" ]
+if (is_mac) {
+  # These sources create an object file conflict with one in |:chrome|, so they
+  # must live in a separate target.
+  # Conflicting sources:
+  #   //chrome/browser/media/webrtc/system_media_capture_permissions_stats_mac.mm
+  #   //chrome/browser/permissions/system/system_media_capture_permissions_mac.mm
+  source_set("system_media_capture_permissions_mac_conflict") {
+    sources = [
+      "//chrome/browser/permissions/system/system_media_capture_permissions_mac.h",
+      "//chrome/browser/permissions/system/system_media_capture_permissions_mac.mm",
+    ]
+    deps = [ "//chrome/common" ]
+  }
 }

docs/api/app.md

@@ -602,7 +602,6 @@ Returns `string` - The current application directory.
     * `%APPDATA%` on Windows
     * `$XDG_CONFIG_HOME` or `~/.config` on Linux
     * `~/Library/Application Support` on macOS
-  * `assets` The directory where app assets such as `resources.pak` are stored. By default this is the same as the folder containing the `exe` path. Available on Windows and Linux only.
   * `userData` The directory for storing your app's configuration files, which
     by default is the `appData` directory appended with your app's name. By
     convention files storing user data should be written to this directory, and
@@ -617,7 +616,7 @@ Returns `string` - The current application directory.
     directory.
   * `temp` Temporary directory.
   * `exe` The current executable file.
-  * `module` The location of the Chromium module. By default this is synonymous with `exe`.
+  * `module` The `libchromiumcontent` library.
   * `desktop` The current user's Desktop directory.
   * `documents` Directory for a user's "My Documents".
   * `downloads` Directory for a user's downloads.
@@ -777,22 +776,6 @@ bar, and on macOS, you can visit it from dock menu.
 
 Clears the recent documents list.
 
-### `app.getRecentDocuments()` _macOS_ _Windows_
-
-Returns `string[]` - An array containing documents in the most recent documents list.
-
-```js
-const { app } = require('electron')
-
-const path = require('node:path')
-
-const file = path.join(app.getPath('desktop'), 'foo.txt')
-app.addRecentDocument(file)
-
-const recents = app.getRecentDocuments()
-console.log(recents) // ['/path/to/desktop/foo.txt'}
-```
-
 ### `app.setAsDefaultProtocolClient(protocol[, path, args])`
 
 * `protocol` string - The name of your protocol, without `://`. For example,
@@ -1214,13 +1197,6 @@ Disables hardware acceleration for current app.
 
 This method can only be called before app is ready.
 
-### `app.isHardwareAccelerationEnabled()`
-
-Returns `boolean` - whether hardware acceleration is currently disabled.
-
- > [!NOTE]
- > This information is only usable after the `gpu-info-update` event is emitted.
-
 ### `app.disableDomainBlockingFor3DAPIs()`
 
 By default, Chromium disables 3D APIs (e.g. WebGL) until restart on a per
@@ -1404,75 +1380,7 @@ details. Disabled by default.
 This API must be called after the `ready` event is emitted.
 
 > [!NOTE]
-> Rendering accessibility tree can significantly affect the performance of your app. It should not be enabled by default. Calling this method will enable the following accessibility support features: `nativeAPIs`, `webContents`, `inlineTextBoxes`, and `extendedProperties`.
-
-### `app.getAccessibilitySupportFeatures()` _macOS_ _Windows_
-
-Returns `string[]` - Array of strings naming currently enabled accessibility support components. Possible values:
-
-* `nativeAPIs` - Native OS accessibility APIs integration enabled.
-* `webContents` - Web contents accessibility tree exposure enabled.
-* `inlineTextBoxes` - Inline text boxes (character bounding boxes) enabled.
-* `extendedProperties` - Extended accessibility properties enabled.
-* `screenReader` - Screen reader specific mode enabled.
-* `html` - HTML accessibility tree construction enabled.
-* `labelImages` - Accessibility support for automatic image annotations.
-* `pdfPrinting` - Accessibility support for PDF printing enabled.
-
-Notes:
-
-* The array may be empty if no accessibility modes are active.
-* Use `app.isAccessibilitySupportEnabled()` for the legacy boolean check;
-  prefer this method for granular diagnostics or telemetry.
-
-Example:
-
-```js
-const { app } = require('electron')
-
-app.whenReady().then(() => {
-  if (app.getAccessibilitySupportFeatures().includes('screenReader')) {
-    // Change some app UI to better work with Screen Readers.
-  }
-})
-```
-
-### `app.setAccessibilitySupportFeatures(features)` _macOS_ _Windows_
-
-* `features` string[] - An array of the accessibility features to enable.
-
-Possible values are:
-
-* `nativeAPIs` - Native OS accessibility APIs integration enabled.
-* `webContents` - Web contents accessibility tree exposure enabled.
-* `inlineTextBoxes` - Inline text boxes (character bounding boxes) enabled.
-* `extendedProperties` - Extended accessibility properties enabled.
-* `screenReader` - Screen reader specific mode enabled.
-* `html` - HTML accessibility tree construction enabled.
-* `labelImages` - Accessibility support for automatic image annotations.
-* `pdfPrinting` - Accessibility support for PDF printing enabled.
-
-To disable all supported features, pass an empty array `[]`.
-
-Example:
-
-```js
-const { app } = require('electron')
-
-app.whenReady().then(() => {
-  // Enable a subset of features:
-  app.setAccessibilitySupportFeatures([
-    'screenReader',
-    'pdfPrinting',
-    'webContents'
-  ])
-
-  // Other logic
-
-  // Some time later, disable all features:
-  app.setAccessibilitySupportFeatures([])
-})
-```
+> Rendering accessibility tree can significantly affect the performance of your app. It should not be enabled by default.
 
 ### `app.showAboutPanel()`
 

docs/api/base-window.md

@@ -1260,47 +1260,6 @@ Sets the properties for the window's taskbar button.
 > `relaunchCommand` and `relaunchDisplayName` must always be set
 > together. If one of those properties is not set, then neither will be used.
 
-#### `win.setAccentColor(accentColor)` _Windows_
-
-* `accentColor` boolean | string | null - The accent color for the window. By default, follows user preference in System Settings. To reset to system default, pass `null`.
-
-Sets the system accent color and highlighting of active window border.
-
-The `accentColor` parameter accepts the following values:
-
-* **Color string** - Like `true`, but sets a custom accent color using standard CSS color formats (Hex, RGB, RGBA, HSL, HSLA, or named colors). Alpha values in RGBA/HSLA formats are ignored and the color is treated as fully opaque.
-* **`true`** - Enable accent color highlighting for the window with the system accent color regardless of whether accent colors are enabled for windows in System `Settings.`
-* **`false`** - Disable accent color highlighting for the window regardless of whether accent colors are currently enabled for windows in System Settings.
-* **`null`** - Reset window accent color behavior to follow behavior set in System Settings.
-
-Examples:
-
-```js
-const win = new BrowserWindow({ frame: false })
-
-// Set red accent color.
-win.setAccentColor('#ff0000')
-
-// RGB format (alpha ignored if present).
-win.setAccentColor('rgba(255,0,0,0.5)')
-
-// Enable accent color, using the color specified in System Settings.
-win.setAccentColor(true)
-
-// Disable accent color.
-win.setAccentColor(false)
-
-// Reset window accent color behavior to follow behavior set in System Settings.
-win.setAccentColor(null)
-```
-
-#### `win.getAccentColor()` _Windows_
-
-Returns `string | boolean` - the system accent color and highlighting of active window border in Hex RGB format.
-
-If a color has been set for the window that differs from the system accent color, the window accent color will
-be returned. Otherwise, a boolean will be returned, with `true` indicating that the window uses the global system accent color, and `false` indicating that accent color highlighting is disabled for this window.
-
 #### `win.setIcon(icon)` _Windows_ _Linux_
 
 * `icon` [NativeImage](native-image.md) | string

docs/api/browser-window.md

@@ -1440,47 +1440,6 @@ Sets the properties for the window's taskbar button.
 > `relaunchCommand` and `relaunchDisplayName` must always be set
 > together. If one of those properties is not set, then neither will be used.
 
-#### `win.setAccentColor(accentColor)` _Windows_
-
-* `accentColor` boolean | string | null - The accent color for the window. By default, follows user preference in System Settings. To reset to system default, pass `null`.
-
-Sets the system accent color and highlighting of active window border.
-
-The `accentColor` parameter accepts the following values:
-
-* **Color string** - Like `true`, but sets a custom accent color using standard CSS color formats (Hex, RGB, RGBA, HSL, HSLA, or named colors). Alpha values in RGBA/HSLA formats are ignored and the color is treated as fully opaque.
-* **`true`** - Enable accent color highlighting for the window with the system accent color regardless of whether accent colors are enabled for windows in System `Settings.`
-* **`false`** - Disable accent color highlighting for the window regardless of whether accent colors are currently enabled for windows in System Settings.
-* **`null`** - Reset window accent color behavior to follow behavior set in System Settings.
-
-Examples:
-
-```js
-const win = new BrowserWindow({ frame: false })
-
-// Set red accent color.
-win.setAccentColor('#ff0000')
-
-// RGB format (alpha ignored if present).
-win.setAccentColor('rgba(255,0,0,0.5)')
-
-// Enable accent color, using the color specified in System Settings.
-win.setAccentColor(true)
-
-// Disable accent color.
-win.setAccentColor(false)
-
-// Reset window accent color behavior to follow behavior set in System Settings.
-win.setAccentColor(null)
-```
-
-#### `win.getAccentColor()` _Windows_
-
-Returns `string | boolean` - the system accent color and highlighting of active window border in Hex RGB format.
-
-If a color has been set for the window that differs from the system accent color, the window accent color will
-be returned. Otherwise, a boolean will be returned, with `true` indicating that the window uses the global system accent color, and `false` indicating that accent color highlighting is disabled for this window.
-
 #### `win.showDefinitionForSelection()` _macOS_
 
 Same as `webContents.showDefinitionForSelection()`.
@@ -1574,18 +1533,11 @@ events.
 
 Prevents the window contents from being captured by other apps.
 
-On Windows, it calls [`SetWindowDisplayAffinity`](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowdisplayaffinity) with `WDA_EXCLUDEFROMCAPTURE`.
+On macOS it sets the NSWindow's [`sharingType`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.property?language=objc) to [`NSWindowSharingNone`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.enum/none?language=objc).
+On Windows it calls [`SetWindowDisplayAffinity`](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowdisplayaffinity) with `WDA_EXCLUDEFROMCAPTURE`.
 For Windows 10 version 2004 and up the window will be removed from capture entirely,
 older Windows versions behave as if `WDA_MONITOR` is applied capturing a black window.
 
-On macOS, it sets the `NSWindow`'s
-[`sharingType`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.property?language=objc)
-to
-[`NSWindowSharingNone`](https://developer.apple.com/documentation/appkit/nswindow/sharingtype-swift.enum/none?language=objc).
-Unfortunately, due to an intentional change in macOS, newer Mac applications that use
-`ScreenCaptureKit` will capture your window despite `win.setContentProtection(true)`.
-See [here](https://github.com/electron/electron/issues/48258#issuecomment-3269893618).
-
 #### `win.isContentProtected()` _macOS_ _Windows_
 
 Returns `boolean` - whether or not content protection is currently enabled.

docs/api/client-request.md

@@ -25,11 +25,6 @@ following properties:
     with which the request is associated. Defaults to the empty string. The
     `session` option supersedes `partition`. Thus if a `session` is explicitly
     specified, `partition` is ignored.
-  * `bypassCustomProtocolHandlers` boolean (optional) - When set to `true`,
-    custom protocol handlers registered for the request's URL scheme will not be
-    called. This allows forwarding an intercepted request to the built-in
-    handler. [webRequest](web-request.md) handlers will still be triggered
-    when bypassing custom protocols. Defaults to `false`.
   * `credentials` string (optional) - Can be `include`, `omit` or
     `same-origin`. Whether to send
     [credentials](https://fetch.spec.whatwg.org/#credentials) with this

docs/api/clipboard.md

@@ -4,12 +4,6 @@
 
 Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process) (non-sandboxed only)
 
-> [!IMPORTANT]
-> If you want to call this API from a renderer process with context isolation enabled,
-> place the API call in your preload script and
-> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
-> [`contextBridge`](context-bridge.md) API.
-
 On Linux, there is also a `selection` clipboard. To manipulate it
 you need to pass `selection` to each method:
 

docs/api/command-line-switches.md

@@ -331,6 +331,22 @@ Affects the default output directory of [v8.setHeapSnapshotNearHeapLimit](https:
 
 Disable exposition of [Navigator API][] on the global scope from Node.js.
 
+## Chromium Flags
+
+There isn't a documented list of all Chromium switches, but there are a few ways to find them.
+
+The easiest way is through Chromium's flags page, which you can access at `about://flags`. These flags don't directly match switch names, but they show up in the process's command-line arguments.
+
+To see these arguments, enable a flag in `about://flags`, then go to `about://version` in Chromium. You'll find a list of command-line arguments, including `--flag-switches-begin --your --list --flag-switches-end`, which contains the list of your flag enabled switches.
+
+Most flags are included as part of `--enable-features=`, but some are standalone switches, like `--enable-experimental-web-platform-features`.
+
+A complete list of flags exists in [Chromium's flag metadata page](https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/flag-metadata.json), but this list includes platform, environment and GPU specific, expired and potentially non-functional flags, so many of them might not always work in every situation.
+
+Keep in mind that standalone switches can sometimes be split into individual features, so there's no fully complete list of switches.
+
+Finally, you'll need to ensure that the version of Chromium in Electron matches the version of the browser you're using to cross-reference the switches.
+
 [app]: app.md
 [append-switch]: command-line.md#commandlineappendswitchswitch-value
 [debugging-main-process]: ../tutorial/debugging-main-process.md

docs/api/crash-reporter.md

@@ -4,12 +4,6 @@
 
 Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process)
 
-> [!IMPORTANT]
-> If you want to call this API from a renderer process with context isolation enabled,
-> place the API call in your preload script and
-> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
-> [`contextBridge`](context-bridge.md) API.
-
 The following is an example of setting up Electron to automatically submit
 crash reports to a remote server:
 

docs/api/environment-variables.md

@@ -125,6 +125,16 @@ Options:
 * `kioclient5`
 * `kioclient`
 
+### `ELECTRON_OZONE_PLATFORM_HINT` _Linux_
+
+Selects the preferred platform backend used on Linux. The default one is `x11`. `auto` selects Wayland if possible, X11 otherwise.
+
+Options:
+
+* `auto`
+* `wayland`
+* `x11`
+
 ## Development Variables
 
 The following environment variables are intended primarily for development and
@@ -186,3 +196,14 @@ the one downloaded by `npm install`. Usage:
 ```sh
 export ELECTRON_OVERRIDE_DIST_PATH=/Users/username/projects/electron/out/Testing
 ```
+
+## Set By Electron
+
+Electron sets some variables in your environment at runtime.
+
+### `ORIGINAL_XDG_CURRENT_DESKTOP`
+
+This variable is set to the value of `XDG_CURRENT_DESKTOP` that your application
+originally launched with.  Electron sometimes modifies the value of `XDG_CURRENT_DESKTOP`
+to affect other logic within Chromium so if you want access to the _original_ value
+you should look up this environment variable instead.

docs/api/ipc-renderer.md

@@ -20,12 +20,6 @@ changes:
 
 Process: [Renderer](../glossary.md#renderer-process)
 
-> [!IMPORTANT]
-> If you want to call this API from a renderer process with context isolation enabled,
-> place the API call in your preload script and
-> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
-> [`contextBridge`](context-bridge.md) API.
-
 The `ipcRenderer` module is an  [EventEmitter][event-emitter]. It provides a few
 methods so you can send synchronous and asynchronous messages from the render
 process (web page) to the main process. You can also receive replies from the

docs/api/menu-item.md

@@ -1,5 +1,3 @@
-# MenuItem
-
 ## Class: MenuItem
 
 > Add items to native application menus and context menus.

docs/api/native-image.md

@@ -4,12 +4,6 @@
 
 Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process)
 
-> [!IMPORTANT]
-> If you want to call this API from a renderer process with context isolation enabled,
-> place the API call in your preload script and
-> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
-> [`contextBridge`](context-bridge.md) API.
-
 The `nativeImage` module provides a unified interface for manipulating
 system images. These can be handy if you want to provide multiple scaled
 versions of the same icon or take advantage of macOS [template images][template-image].

docs/api/process.md

@@ -211,10 +211,6 @@ Returns `Object`:
   system.
 * `free` Integer - The total amount of memory not being used by applications or disk
   cache.
-* `fileBacked` Integer _macOS_ - The amount of memory that currently has been paged out to storage.
-  Includes memory for file caches, network buffers, and other system services.
-* `purgeable` Integer _macOS_ - The amount of memory that is marked as "purgeable". The system can reclaim it
-  if memory pressure increases.
 * `swapTotal` Integer _Windows_ _Linux_ - The total amount of swap memory in Kilobytes available to the
   system.
 * `swapFree` Integer _Windows_ _Linux_ - The free amount of swap memory in Kilobytes available to the

docs/api/service-worker-main.md

@@ -1,7 +1,11 @@
-## Class: ServiceWorkerMain
+# ServiceWorkerMain
 
 > An instance of a Service Worker representing a version of a script for a given scope.
 
+Process: [Main](../glossary.md#main-process)
+
+## Class: ServiceWorkerMain
+
 Process: [Main](../glossary.md#main-process)<br />
 _This class is not exported from the `'electron'` module. It is only available as a return value of other methods in the Electron API._
 

docs/api/session.md

@@ -939,18 +939,14 @@ session.fromPartition('some-partition').setPermissionRequestHandler((webContents
     * `top-level-storage-access` -  Allow top-level sites to request third-party cookie access on behalf of embedded content originating from another site in the same related website set using the [Storage Access API](https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API).
     * `usb` - Expose non-standard Universal Serial Bus (USB) compatible devices services to the web with the [WebUSB API](https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API).
     * `deprecated-sync-clipboard-read` _Deprecated_ - Request access to run `document.execCommand("paste")`
-    * `fileSystem` - Access to read, write, and file management capabilities using the [File System API](https://developer.mozilla.org/en-US/docs/Web/API/File_System_API).
   * `requestingOrigin` string - The origin URL of the permission check
   * `details` Object - Some properties are only available on certain permission types.
     * `embeddingOrigin` string (optional) - The origin of the frame embedding the frame that made the permission check.  Only set for cross-origin sub frames making permission checks.
     * `securityOrigin` string (optional) - The security origin of the `media` check.
     * `mediaType` string (optional) - The type of media access being requested, can be `video`,
-      `audio` or `unknown`.
+      `audio` or `unknown`
     * `requestingUrl` string (optional) - The last URL the requesting frame loaded.  This is not provided for cross-origin sub frames making permission checks.
-    * `isMainFrame` boolean - Whether the frame making the request is the main frame.
-    * `filePath` string (optional) - The path of a `fileSystem` request.
-    * `isDirectory` boolean (optional) - Whether a `fileSystem` request is a directory.
-    * `fileAccessType` string (optional) - The access type of a `fileSystem` request. Can be `writable` or `readable`.
+    * `isMainFrame` boolean - Whether the frame making the request is the main frame
 
 Sets the handler which can be used to respond to permission checks for the `session`.
 Returning `true` will allow the permission and `false` will reject it.  Please note that
@@ -972,9 +968,6 @@ session.fromPartition('some-partition').setPermissionCheckHandler((webContents,
 })
 ```
 
-> [!NOTE]
-> `isMainFrame` will always be `false` for a `fileSystem` request as a result of Chromium limitations.
-
 #### `ses.setDisplayMediaRequestHandler(handler[, opts])`
 
 * `handler` Function | null

docs/api/structures/base-window-options.md

@@ -102,10 +102,9 @@
   should have rounded corners. Default is `true`. Setting this property
   to `false` will prevent the window from being fullscreenable on macOS.
   On Windows versions older than Windows 11 Build 22000 this property has no effect, and frameless windows will not have rounded corners.
-* `thickFrame` boolean (optional) _Windows_ - Use `WS_THICKFRAME` style for
-  frameless windows on Windows, which adds the standard window frame. Setting it
-  to `false` will remove window shadow and window animations, and disable window
-  resizing via dragging the window edges. Default is `true`.
+* `thickFrame` boolean (optional) - Use `WS_THICKFRAME` style for frameless windows on
+  Windows, which adds standard window frame. Setting it to `false` will remove
+  window shadow and window animations. Default is `true`.
 * `vibrancy` string (optional) _macOS_ - Add a type of vibrancy effect to
   the window, only on macOS. Can be `appearance-based`, `titlebar`, `selection`,
   `menu`, `popover`, `sidebar`, `header`, `sheet`, `window`, `hud`, `fullscreen-ui`,

docs/api/structures/color-space.md

@@ -0,0 +1,195 @@
+# ColorSpace Object
+
+* `primaries` string - The color primaries of the color space. Can be one of the following values:
+  * `bt709` - BT709 primaries (also used for sRGB)
+  * `bt470m` - BT470M primaries
+  * `bt470bg` - BT470BG primaries
+  * `smpte170m` - SMPTE170M primaries
+  * `smpte240m` - SMPTE240M primaries
+  * `film` - Film primaries
+  * `bt2020` - BT2020 primaries
+  * `smptest428-1` - SMPTEST428-1 primaries
+  * `smptest431-2` - SMPTEST431-2 primaries
+  * `p3` - P3 primaries
+  * `xyz-d50` - XYZ D50 primaries
+  * `adobe-rgb` - Adobe RGB primaries
+  * `apple-generic-rgb` - Apple Generic RGB primaries
+  * `wide-gamut-color-spin` - Wide Gamut Color Spin primaries
+  * `ebu-3213-e` - EBU 3213-E primaries
+  * `custom` - Custom primaries
+  * `invalid` - Invalid primaries
+
+* `transfer` string - The transfer function of the color space. Can be one of the following values:
+  * `bt709` - BT709 transfer function
+  * `bt709-apple` - BT709 Apple transfer function
+  * `gamma18` - Gamma 1.8 transfer function
+  * `gamma22` - Gamma 2.2 transfer function
+  * `gamma24` - Gamma 2.4 transfer function
+  * `gamma28` - Gamma 2.8 transfer function
+  * `smpte170m` - SMPTE170M transfer function
+  * `smpte240m` - SMPTE240M transfer function
+  * `linear` - Linear transfer function
+  * `log` - Log transfer function
+  * `log-sqrt` - Log Square Root transfer function
+  * `iec61966-2-4` - IEC61966-2-4 transfer function
+  * `bt1361-ecg` - BT1361 ECG transfer function
+  * `srgb` - sRGB transfer function
+  * `bt2020-10` - BT2020-10 transfer function
+  * `bt2020-12` - BT2020-12 transfer function
+  * `pq` - PQ (Perceptual Quantizer) transfer function
+  * `smptest428-1` - SMPTEST428-1 transfer function
+  * `hlg` - HLG (Hybrid Log-Gamma) transfer function
+  * `srgb-hdr` - sRGB HDR transfer function
+  * `linear-hdr` - Linear HDR transfer function
+  * `custom` - Custom transfer function
+  * `custom-hdr` - Custom HDR transfer function
+  * `scrgb-linear-80-nits` - scRGB Linear 80 nits transfer function
+  * `invalid` - Invalid transfer function
+
+* `matrix` string - The color matrix of the color space. Can be one of the following values:
+  * `rgb` - RGB matrix
+  * `bt709` - BT709 matrix
+  * `fcc` - FCC matrix
+  * `bt470bg` - BT470BG matrix
+  * `smpte170m` - SMPTE170M matrix
+  * `smpte240m` - SMPTE240M matrix
+  * `ycocg` - YCoCg matrix
+  * `bt2020-ncl` - BT2020 NCL matrix
+  * `ydzdx` - YDzDx matrix
+  * `gbr` - GBR matrix
+  * `invalid` - Invalid matrix
+
+* `range` string - The color range of the color space. Can be one of the following values:
+  * `limited` - Limited color range (RGB values ranging from 16 to 235)
+  * `full` - Full color range (RGB values from 0 to 255)
+  * `derived` - Range defined by the transfer function and matrix
+  * `invalid` - Invalid range
+
+## Common `ColorSpace` definitions
+
+### Standard Color Spaces
+
+**sRGB**:
+
+  ```js
+  const cs = {
+    primaries: 'bt709',
+    transfer: 'srgb',
+    matrix: 'rgb',
+    range: 'full'
+  }
+  ```
+
+**Display P3**:
+
+  ```js
+  const cs = {
+    primaries: 'p3',
+    transfer: 'srgb',
+    matrix: 'rgb',
+    range: 'full'
+  }
+  ```
+
+**XYZ D50**:
+
+  ```js
+  const cs = {
+    primaries: 'xyz-d50',
+    transfer: 'linear',
+    matrix: 'rgb',
+    range: 'full'
+  }
+  ```
+
+### HDR Color Spaces
+
+**Extended sRGB** (extends sRGB to all real values):
+
+  ```js
+  const cs = {
+    primaries: 'bt709',
+    transfer: 'srgb-hdr',
+    matrix: 'rgb',
+    range: 'full'
+  }
+  ```
+
+**scRGB Linear** (linear transfer function for all real values):
+
+  ```js
+  const cs = {
+    primaries: 'bt709',
+    transfer: 'linear-hdr',
+    matrix: 'rgb',
+    range: 'full'
+  }
+  ```
+
+**scRGB Linear 80 Nits** (with an SDR white level of 80 nits):
+
+  ```js
+  const cs = {
+    primaries: 'bt709',
+    transfer: 'scrgb-linear-80-nits',
+    matrix: 'rgb',
+    range: 'full'
+  }
+  ```
+
+**HDR10** (BT.2020 primaries with PQ transfer function):
+
+  ```js
+  const cs = {
+    primaries: 'bt2020',
+    transfer: 'pq',
+    matrix: 'rgb',
+    range: 'full'
+  }
+  ```
+
+**HLG** (BT.2020 primaries with HLG transfer function):
+
+  ```js
+  const cs = {
+    primaries: 'bt2020',
+    transfer: 'hlg',
+    matrix: 'rgb',
+    range: 'full'
+  }
+  ```
+
+### Video Color Spaces
+
+**Rec. 601** (SDTV):
+
+  ```js
+  const cs = {
+    primaries: 'smpte170m',
+    transfer: 'smpte170m',
+    matrix: 'smpte170m',
+    range: 'limited'
+  }
+  ```
+
+**Rec. 709** (HDTV):
+
+  ```js
+  const cs = {
+    primaries: 'bt709',
+    transfer: 'bt709',
+    matrix: 'bt709',
+    range: 'limited'
+  }
+  ```
+
+**JPEG** (typical color space for JPEG images):
+
+  ```js
+  const cs = {
+    primaries: 'bt709',
+    transfer: 'srgb',
+    matrix: 'smpte170m',
+    range: 'full'
+  }
+  ```

docs/api/structures/usb-device.md

@@ -1,17 +1,35 @@
 # USBDevice Object
 
+* `configuration` Object (optional) - A [USBConfiguration](https://developer.mozilla.org/en-US/docs/Web/API/USBConfiguration) object containing information about the currently selected configuration of a USB device.
+  * `configurationValue` Integer - the configuration value of this configuration.
+  * `configurationName` string - the name provided by the device to describe this configuration.
+  * `interfaces` Object[] - An array of [USBInterface](https://developer.mozilla.org/en-US/docs/Web/API/USBInterface) objects containing information about an interface provided by the USB device.
+    * `interfaceNumber` Integer - the interface number of this interface.
+    * `alternate` Object - the currently selected alternative configuration of this interface.
+      * `alternateSetting` Integer - the alternate setting number of this interface.
+      * `interfaceClass` Integer - the class of this interface. See [USB.org](https://www.usb.org/defined-class-codes) for class code descriptions.
+      * `interfaceSubclass` Integer - the subclass of this interface.
+      * `interfaceProtocol` Integer - the protocol supported by this interface.
+      * `interfaceName` string (optional) - the name of the interface, if one is provided by the device.
+      * `endpoints` Object[] - an array containing instances of the [USBEndpoint interface](https://developer.mozilla.org/en-US/docs/Web/API/USBEndpoint) describing each of the endpoints that are part of this interface.
+        * `endpointNumber` Integer - this endpoint's "endpoint number" which is a value from 1 to 15.
+        * `direction` string - the direction in which this endpoint transfers data - can be either 'in' or 'out'.
+        * `type` string - the type of this endpoint - can be either 'bulk', 'interrupt', or 'isochronous'.
+        * `packetSize` Integer - the size of the packets that data sent through this endpoint will be divided into.
+    * `alternates` Object[] - an array containing instances of the [USBAlternateInterface](https://developer.mozilla.org/en-US/docs/Web/API/USBAlternateInterface) interface describing each of the alternative configurations possible for this interface.
+* `configurations` Object[] - An array of [USBConfiguration](https://developer.mozilla.org/en-US/docs/Web/API/USBConfiguration) interfaces for controlling a paired USB device.
+* `deviceClass` Integer - The device class for the communication interface supported by the device.
 * `deviceId` string - Unique identifier for the device.
-* `vendorId` Integer - The USB vendor ID.
-* `productId` Integer - The USB product ID.
-* `productName` string (optional) - Name of the device.
-* `serialNumber` string (optional) - The USB device serial number.
-* `manufacturerName` string (optional) - The manufacturer name of the device.
-* `usbVersionMajor` Integer - The USB protocol major version supported by the device
-* `usbVersionMinor` Integer - The USB protocol minor version supported by the device
-* `usbVersionSubminor` Integer - The USB protocol subminor version supported by the device
-* `deviceClass` Integer - The device class for the communication interface supported by the device
-* `deviceSubclass` Integer - The device subclass for the communication interface supported by the device
-* `deviceProtocol` Integer - The device protocol for the communication interface supported by the device
+* `deviceProtocol` Integer - The device protocol for the communication interface supported by the device.
+* `deviceSubclass` Integer - The device subclass for the communication interface supported by the device.
 * `deviceVersionMajor` Integer - The major version number of the device as defined by the device manufacturer.
 * `deviceVersionMinor` Integer - The minor version number of the device as defined by the device manufacturer.
 * `deviceVersionSubminor` Integer - The subminor version number of the device as defined by the device manufacturer.
+* `manufacturerName` string (optional) - The manufacturer name of the device.
+* `productId` Integer - The USB product ID.
+* `productName` string (optional) - Name of the device.
+* `serialNumber` string (optional) - The USB device serial number.
+* `usbVersionMajor` Integer - The USB protocol major version supported by the device.
+* `usbVersionMinor` Integer - The USB protocol minor version supported by the device.
+* `usbVersionSubminor` Integer - The USB protocol subminor version supported by the device.
+* `vendorId` Integer - The USB vendor ID.

docs/api/structures/web-preferences.md

@@ -21,9 +21,7 @@
   associated with the window, making it compatible with the Chromium
   OS-level sandbox and disabling the Node.js engine. This is not the same as
   the `nodeIntegration` option and the APIs available to the preload script
-  are more limited. Default is `true` since Electron 20. The sandbox will
-  automatically be disabled when `nodeIntegration` is set to `true`.
-  Read more about the option [here](../../tutorial/sandbox.md).
+  are more limited. Read more about the option [here](../../tutorial/sandbox.md).
 * `session` [Session](../session.md#class-session) (optional) - Sets the session used by the
   page. Instead of passing the Session object directly, you can also choose to
   use the `partition` option instead, which accepts a partition string. When

docs/api/tray.md

@@ -79,15 +79,7 @@ app.whenReady().then(() => {
 ### `new Tray(image, [guid])`
 
 * `image` ([NativeImage](native-image.md) | string)
-* `guid` string (optional) _Windows_ _macOS_ - A unique string used to identify the tray icon. Must adhere to [UUID](https://en.wikipedia.org/wiki/Universally_unique_identifier) format.
-
-**Windows**
-
-On Windows, if the executable is signed and the signature contains an organization in the subject line then the GUID is permanently associated with that signature. OS level settings like the position of the tray icon in the system tray will persist even if the path to the executable changes. If the executable is not code-signed then the GUID is permanently associated with the path to the executable. Changing the path to the executable will break the creation of the tray icon and a new GUID must be used. However, it is highly recommended to use the GUID parameter only in conjunction with code-signed executable. If an App defines multiple tray icons then each icon must use a separate GUID.
-
-**MacOS**
-
-On macOS, the `guid` is a string used to uniquely identify the tray icon and allow it to retain its position between relaunches. Using the same string for a new tray item will create it in the same position as the previous tray item to use the string.
+* `guid` string (optional) _Windows_ - Assigns a GUID to the tray icon. If the executable is signed and the signature contains an organization in the subject line then the GUID is permanently associated with that signature. OS level settings like the position of the tray icon in the system tray will persist even if the path to the executable changes. If the executable is not code-signed then the GUID is permanently associated with the path to the executable. Changing the path to the executable will break the creation of the tray icon and a new GUID must be used. However, it is highly recommended to use the GUID parameter only in conjunction with code-signed executable. If an App defines multiple tray icons then each icon must use a separate GUID.
 
 Creates a new tray icon associated with the `image`.
 
@@ -335,10 +327,6 @@ Returns [`Rectangle`](structures/rectangle.md)
 
 The `bounds` of this tray icon as `Object`.
 
-#### `tray.getGUID()` _macOS_ _Windows_
-
-Returns `string | null` - The GUID used to uniquely identify the tray icon and allow it to retain its position between relaunches, or null if none is set.
-
 #### `tray.isDestroyed()`
 
 Returns `boolean` - Whether the tray icon is destroyed.

docs/api/web-frame-main.md

@@ -66,16 +66,6 @@ These methods can be accessed from the `webFrameMain` module:
 Returns `WebFrameMain | undefined` - A frame with the given process and routing IDs,
 or `undefined` if there is no WebFrameMain associated with the given IDs.
 
-### `webFrameMain.fromFrameToken(processId, frameToken)`
-
-* `processId` Integer - An `Integer` representing the internal ID of the process which owns the frame.
-* `frameToken` string - A `string` token identifying the unique frame. Can also
-  be retrieved in the renderer process via
-  [`webFrame.frameToken`](web-frame.md#webframeframetoken-readonly).
-
-Returns `WebFrameMain | null` - A frame with the given process and frame token,
-or `null` if there is no WebFrameMain associated with the given IDs.
-
 ## Class: WebFrameMain
 
 Process: [Main](../glossary.md#main-process)<br />

docs/api/web-frame.md

@@ -4,12 +4,6 @@
 
 Process: [Renderer](../glossary.md#renderer-process)
 
-> [!IMPORTANT]
-> If you want to call this API from a renderer process with context isolation enabled,
-> place the API call in your preload script and
-> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
-> [`contextBridge`](context-bridge.md) API.
-
 `webFrame` export of the Electron module is an instance of the `WebFrame`
 class representing the current frame. Sub-frames can be retrieved by
 certain properties and methods (e.g. `webFrame.firstChild`).
@@ -145,7 +139,7 @@ by its key, which is returned from `webFrame.insertCSS(css)`.
 
 Inserts `text` to the focused element.
 
-### `webFrame.executeJavaScript(code[, userGesture][, callback])`
+### `webFrame.executeJavaScript(code[, userGesture, callback])`
 
 * `code` string
 * `userGesture` boolean (optional) - Default is `false`.
@@ -166,7 +160,7 @@ In the browser window some HTML APIs like `requestFullScreen` can only be
 invoked by a gesture from the user. Setting `userGesture` to `true` will remove
 this limitation.
 
-### `webFrame.executeJavaScriptInIsolatedWorld(worldId, scripts[, userGesture][, callback])`
+### `webFrame.executeJavaScriptInIsolatedWorld(worldId, scripts[, userGesture, callback])`
 
 * `worldId` Integer - The ID of the world to run the javascript
             in, `0` is the default main world (where content runs), `999` is the
@@ -259,7 +253,7 @@ and intend to stay there).
 
 * `selector` string - CSS selector for a frame element.
 
-Returns `WebFrame | null` - The frame element in `webFrame's` document selected by
+Returns `WebFrame` - The frame element in `webFrame's` document selected by
 `selector`, `null` would be returned if `selector` does not select a frame or
 if the frame is not in the current renderer process.
 
@@ -267,7 +261,7 @@ if the frame is not in the current renderer process.
 
 * `name` string
 
-Returns `WebFrame | null` - A child of `webFrame` with the supplied `name`, `null`
+Returns `WebFrame` - A child of `webFrame` with the supplied `name`, `null`
 would be returned if there's no such frame or if the frame is not in the current
 renderer process.
 
@@ -278,9 +272,7 @@ renderer process.
    instances (`webFrame.routingId`) and are also passed by frame
    specific `WebContents` navigation events (e.g. `did-frame-navigate`)
 
-Returns `WebFrame | null` - that has the supplied `routingId`, `null` if not found.
-
-**Deprecated:** Use the new `webFrame.findFrameByToken` API.
+Returns `WebFrame` - that has the supplied `routingId`, `null` if not found.
 
 ### `webFrame.findFrameByToken(frameToken)`
 
@@ -289,7 +281,7 @@ Returns `WebFrame | null` - that has the supplied `routingId`, `null` if not fou
    instances (`webFrame.frameToken`) and can also be retrieved from
    `WebFrameMain` instances using `webFrameMain.frameToken`.
 
-Returns `WebFrame | null` - that has the supplied `frameToken`, `null` if not found.
+Returns `WebFrame` - that has the supplied `frameToken`, `null` if not found.
 
 ### `webFrame.isWordMisspelled(word)`
 
@@ -341,8 +333,6 @@ An `Integer` representing the unique frame id in the current renderer process.
 Distinct WebFrame instances that refer to the same underlying frame will have
 the same `routingId`.
 
-**Deprecated:** Use the new `webFrame.frameToken` API.
-
 ### `webFrame.frameToken` _Readonly_
 
 A `string` representing the unique frame token in the current renderer process.

docs/api/web-utils.md

@@ -4,12 +4,6 @@
 
 Process: [Renderer](../glossary.md#renderer-process)
 
-> [!IMPORTANT]
-> If you want to call this API from a renderer process with context isolation enabled,
-> place the API call in your preload script and
-> [expose](../tutorial/context-isolation.md#after-context-isolation-enabled) it using the
-> [`contextBridge`](context-bridge.md) API.
-
 ## Methods
 
 The `webUtils` module has the following methods:
@@ -23,27 +17,11 @@ Returns `string` - The file system path that this `File` object points to. In th
 This method superseded the previous augmentation to the `File` object with the `path` property.  An example is included below.
 
 ```js @ts-nocheck
-// Before (renderer)
-const oldPath = document.querySelector('input[type=file]').files[0].path
-```
+// Before
+const oldPath = document.querySelector('input').files[0].path
 
-```js @ts-nocheck
 // After
+const { webUtils } = require('electron')
 
-// Renderer:
-
-const file = document.querySelector('input[type=file]').files[0]
-electronApi.doSomethingWithFile(file)
-
-// Preload script:
-
-const { contextBridge, webUtils } = require('electron')
-
-contextBridge.exposeInMainWorld('electronApi', {
-  doSomethingWithFile (file) {
-    const path = webUtils.getPathForFile(file)
-    // Do something with the path, e.g., send it over IPC to the main process.
-    // It's best not to expose the full file path to the web content if possible.
-  }
-})
+const newPath = webUtils.getPathForFile(document.querySelector('input').files[0])
 ```

docs/api/window-open.md

@@ -39,8 +39,8 @@ consider using `webContents.setWindowOpenHandler` to customize the
 BrowserWindow creation.
 
 A subset of [`WebPreferences`](structures/web-preferences.md) can be set directly,
-unnested, from the features string: `zoomFactor`, `nodeIntegration`, `javascript`,
-`contextIsolation`, and `webviewTag`.
+unnested, from the features string: `zoomFactor`, `nodeIntegration`, `preload`,
+`javascript`, `contextIsolation`, and `webviewTag`.
 
 For example:
 

docs/breaking-changes.md

@@ -14,18 +14,6 @@ This document uses the following convention to categorize breaking changes:
 
 ## Planned Breaking API Changes (38.0)
 
-### Removed: `ELECTRON_OZONE_PLATFORM_HINT` environment variable
-
-The default value of the `--ozone-platform` flag [changed to `auto`](https://chromium-review.googlesource.com/c/chromium/src/+/6775426).
-
-Electron now defaults to running as a native Wayland app when launched in a Wayland session (when `XDG_SESSION_TYPE=wayland`).
-Users can force XWayland by passing `--ozone-platform=x11`.
-
-### Removed: `ORIGINAL_XDG_CURRENT_DESKTOP` environment variable
-
-Previously, Electron changed the value of `XDG_CURRENT_DESKTOP` internally to `Unity`, and stored the original name of the desktop session
-in a separate variable. `XDG_CURRENT_DESKTOP` is no longer overriden and now reflects the actual desktop environment.
-
 ### Removed: macOS 11 support
 
 macOS 11 (Big Sur) is no longer supported by [Chromium](https://chromium-review.googlesource.com/c/chromium/src/+/6594615).
@@ -49,6 +37,23 @@ The `webFrame.findFrameByRoutingId(routingId)` function will be removed.
 
 You should use `webFrame.findFrameByToken(frameToken)` instead.
 
+### Behavior Changed: window.open popups are always resizable
+
+Per current [WHATWG spec](https://html.spec.whatwg.org/multipage/nav-history-apis.html#dom-open-dev), the `window.open` API will now always create a resizable popup window.
+
+To restore previous behavior:
+
+```js
+webContents.setWindowOpenHandler((details) => {
+  return {
+    action: 'allow',
+    overrideBrowserWindowOptions: {
+      resizable: details.features.includes('resizable=yes')
+    }
+  }
+})
+```
+
 ## Planned Breaking API Changes (37.0)
 
 ### Utility Process unhandled rejection behavior change

docs/development/build-instructions-gn.md

@@ -191,6 +191,12 @@ $ ./out/Testing/electron
 
 ### Packaging
 
+On linux, first strip the debugging and symbol information:
+
+```sh
+$ electron/script/strip-binaries.py -d out/Release
+```
+
 To package the electron build as a distributable zip file:
 
 ```sh

docs/development/creating-api.md

@@ -117,7 +117,7 @@ void Initialize(v8::Local<v8::Object> exports,
                 v8::Local<v8::Value> unused,
                 v8::Local<v8::Context> context,
                 void* priv) {
-  v8::Isolate* const isolate = v8::Isolate::GetCurrent();
+  v8::Isolate* isolate = context->GetIsolate();
   gin_helper::Dictionary dict(isolate, exports);
   dict.Set("apiName", electron::api::ApiName::Create(isolate));
 }

docs/faq.md

@@ -12,28 +12,19 @@ network problems. The best resolution is to try switching networks, or
 wait a bit and try installing again.
 
 You can also attempt to download Electron directly from
-[GitHub Releases](https://github.com/electron/electron/releases)
+[electron/electron/releases](https://github.com/electron/electron/releases)
 if installing via `npm` is failing.
 
-If you need to install Electron through a custom mirror or proxy, see
-the [Advanced Installation](./tutorial/installation.md) documentation for more details.
+## When will Electron upgrade to latest Chrome?
 
-## How are Electron binaries downloaded?
+The Chrome version of Electron is usually bumped within one or two weeks after
+a new stable Chrome version gets released. This estimate is not guaranteed and
+depends on the amount of work involved with upgrading.
 
-When you run `npm install electron`, the Electron binary for the corresponding version is downloaded
-into your project's `node_modules` folder via npm's `postinstall` lifecycle script.
+Only the stable channel of Chrome is used. If an important fix is in beta or dev
+channel, we will back-port it.
 
-This logic is handled by the [`@electron/get`](https://github.com/electron/get) utility package
-under the hood.
-
-## When will Electron upgrade to latest Chromium?
-
-Every new major version of Electron releases with a Chromium major version upgrade. By releasing every
-8 weeks, Electron is able to pull in every other major Chromium release on the very same day that it
-releases upstream. Security fixes will be backported to stable release channels ahead of time.
-
-See the [Electron Releases](./tutorial/electron-timelines.md) documentation for more details or
-[releases.electronjs.org](https://releases.electronjs.org) to see our Release Status dashboard.
+For more information, please see the [security introduction](tutorial/security.md).
 
 ## When will Electron upgrade to latest Node.js?
 

docs/tutorial/asar-integrity.md

@@ -64,10 +64,13 @@ flipFuses(
 )
 ```
 
-> [!TIP]
-> With Electron Forge, you can configure your app's fuses with
-> [@electron-forge/plugin-fuses](https://www.electronforge.io/config/plugins/fuses)
-> in your Forge configuration file.
+:::tip Fuses in Electron Forge
+
+With Electron Forge, you can configure your app's fuses with
+[@electron-forge/plugin-fuses](https://www.electronforge.io/config/plugins/fuses)
+in your Forge configuration file.
+
+:::
 
 ## Providing the header hash
 
@@ -106,7 +109,7 @@ Valid `algorithm` values are currently `SHA256` only. The `hash` is a hash of th
 The `@electron/asar` package exposes a `getRawHeader` method whose result can then be hashed to generate this value
 (e.g. using the [`node:crypto`](https://nodejs.org/api/crypto.html) module).
 
-#### Windows
+### Windows
 
 When packaging for Windows, you must populate a valid [resource](https://learn.microsoft.com/en-us/windows/win32/menurc/resources)
 entry of type `Integrity` and name `ElectronAsar`. The value of this resource should be a JSON encoded dictionary
@@ -122,6 +125,9 @@ in the form included below:
 ]
 ```
 
-> [!NOTE]
-> For an implementation example, see [`src/resedit.ts`](https://github.com/electron/packager/blob/main/src/resedit.ts)
-> in the Electron Packager code.
+:::info
+
+For an implementation example, see [`src/resedit.ts`](https://github.com/electron/packager/blob/main/src/resedit.ts)
+in the Electron Packager code.
+
+:::

docs/tutorial/automated-testing.md

@@ -74,46 +74,22 @@ describe('keyboard input', () => {
 Furthermore, WebdriverIO allows you to access Electron APIs to get static information about your application:
 
 ```js @ts-nocheck
-import { browser, $, expect } from '@wdio/globals'
+import { browser } from '@wdio/globals'
 
-describe('when the make smaller button is clicked', () => {
-  it('should decrease the window height and width by 10 pixels', async () => {
-    const boundsBefore = await browser.electron.browserWindow('getBounds')
-    expect(boundsBefore.width).toEqual(210)
-    expect(boundsBefore.height).toEqual(310)
-
-    await $('.make-smaller').click()
-    const boundsAfter = await browser.electron.browserWindow('getBounds')
-    expect(boundsAfter.width).toEqual(200)
-    expect(boundsAfter.height).toEqual(300)
-  })
-})
-```
-
-or to retrieve other Electron process information:
-
-```js @ts-nocheck
-import fs from 'node:fs'
-import path from 'node:path'
-
-import { browser, expect } from '@wdio/globals'
-
-const packageJson = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), { encoding: 'utf-8' }))
-const { name, version } = packageJson
-
-describe('electron APIs', () => {
-  it('should retrieve app metadata through the electron API', async () => {
-    const appName = await browser.electron.app('getName')
-    expect(appName).toEqual(name)
-    const appVersion = await browser.electron.app('getVersion')
-    expect(appVersion).toEqual(version)
-  })
-
-  it('should pass args through to the launched application', async () => {
-    // custom args are set in the wdio.conf.js file as they need to be set before WDIO starts
-    const argv = await browser.electron.mainProcess('argv')
-    expect(argv).toContain('--foo')
-    expect(argv).toContain('--bar=baz')
+describe('trigger message modal', async () => {
+  it('message modal can be triggered from a test', async () => {
+    await browser.electron.execute(
+      (electron, param1, param2, param3) => {
+        const appWindow = electron.BrowserWindow.getFocusedWindow()
+        electron.dialog.showMessageBox(appWindow, {
+          message: 'Hello World!',
+          detail: `${param1} + ${param2} + ${param3} = ${param1 + param2 + param3}`
+        })
+      },
+      1,
+      2,
+      3
+    )
   })
 })
 ```
@@ -206,7 +182,7 @@ npm install --save-dev @playwright/test
 ```
 
 :::caution Dependencies
-This tutorial was written with `@playwright/test@1.41.1`. Check out
+This tutorial was written with `@playwright/test@1.52.0`. Check out
 [Playwright's releases][playwright-releases] page to learn about
 changes that might affect the code below.
 :::
@@ -218,10 +194,10 @@ To point this API to your Electron app, you can pass the path to your main proce
 entry point (here, it is `main.js`).
 
 ```js {5} @ts-nocheck
-const { test, _electron: electron } = require('@playwright/test')
+import { test, _electron as electron } from '@playwright/test'
 
 test('launch app', async () => {
-  const electronApp = await electron.launch({ args: ['main.js'] })
+  const electronApp = await electron.launch({ args: ['.'] })
   // close app
   await electronApp.close()
 })
@@ -231,10 +207,10 @@ After that, you will access to an instance of Playwright's `ElectronApp` class.
 is a powerful class that has access to main process modules for example:
 
 ```js {5-10} @ts-nocheck
-const { test, _electron: electron } = require('@playwright/test')
+import { test, _electron as electron } from '@playwright/test'
 
 test('get isPackaged', async () => {
-  const electronApp = await electron.launch({ args: ['main.js'] })
+  const electronApp = await electron.launch({ args: ['.'] })
   const isPackaged = await electronApp.evaluate(async ({ app }) => {
     // This runs in Electron's main process, parameter here is always
     // the result of the require('electron') in the main app script.
@@ -250,10 +226,10 @@ It can also create individual [Page][playwright-page] objects from Electron Brow
 For example, to grab the first BrowserWindow and save a screenshot:
 
 ```js {6-7} @ts-nocheck
-const { test, _electron: electron } = require('@playwright/test')
+import { test, _electron as electron } from '@playwright/test'
 
 test('save screenshot', async () => {
-  const electronApp = await electron.launch({ args: ['main.js'] })
+  const electronApp = await electron.launch({ args: ['.'] })
   const window = await electronApp.firstWindow()
   await window.screenshot({ path: 'intro.png' })
   // close app
@@ -265,7 +241,7 @@ Putting all this together using the Playwright test-runner, let's create a `exam
 test file with a single test and assertion:
 
 ```js title='example.spec.js' @ts-nocheck
-const { test, expect, _electron: electron } = require('@playwright/test')
+import { test, expect, _electron as electron } from '@playwright/test'
 
 test('example test', async () => {
   const electronApp = await electron.launch({ args: ['.'] })

docs/tutorial/code-signing.md

@@ -233,10 +233,10 @@ can find [its documentation here](https://www.electron.build/code-signing).
 [Azure Trusted Signing][] is Microsoft's modern cloud-based alternative to EV certificates.
 It is the cheapest option for code signing on Windows, and it gets rid of SmartScreen warnings.
 
-As of October 2025, Azure Trusted Signing is available to US and Canada-based organizations
-with 3+ years of verifiable business history and to individual developers in the US and Canada.
-Microsoft is looking to make the program more widely available. If you're reading this at a
-later point, it could make sense to check if the eligibility criteria have changed.
+As of May 2025, Azure Trusted Signing is [available][trusted-signing-availability] to US and
+Canada-based organizations with 3+ years of verifiable business history. Microsoft is looking
+to make the program more widely available. If you're reading this at a later point, it could
+make sense to check if the eligibility criteria have changed.
 
 #### Using Electron Forge
 
@@ -267,5 +267,6 @@ See the [Windows Store Guide][].
 [maker-squirrel]: https://www.electronforge.io/config/makers/squirrel.windows
 [maker-msi]: https://www.electronforge.io/config/makers/wix-msi
 [azure trusted signing]: https://azure.microsoft.com/en-us/products/trusted-signing
+[trusted-signing-availability]: https://techcommunity.microsoft.com/blog/microsoft-security-blog/trusted-signing-public-preview-update/4399713
 [forge-trusted-signing]: https://www.electronforge.io/guides/code-signing/code-signing-windows#using-azure-trusted-signing
 [builder-trusted-signing]: https://www.electron.build/code-signing-win#using-azure-trusted-signing-beta

docs/tutorial/electron-timelines.md

@@ -9,11 +9,10 @@ check out our [Electron Versioning](./electron-versioning.md) doc.
 
 | Electron | Alpha | Beta | Stable | EOL | Chrome | Node | Supported |
 | ------- | ----- | ------- | ------ | ------ | ---- | ---- | ---- |
-| 39.0.0 |  2025-Sep-04 | 2025-Oct-01 | 2025-Oct-28 | 2026-May-05 | M142 | TBD | ✅ |
-| 38.0.0 |  2025-Jun-26 | 2025-Aug-06 | 2025-Sep-02 | 2026-Mar-10 | M140 | v22.18 | ✅ |
+| 38.0.0 |  2025-Jun-26 | 2025-Aug-06 | 2025-Sep-02 | 2026-Mar-10 | M140 | TBD | ✅ |
 | 37.0.0 |  2025-May-01 | 2025-May-28 | 2025-Jun-24 | 2026-Jan-13 | M138 | v22.16 | ✅ |
 | 36.0.0 |  2025-Mar-06 | 2025-Apr-02 | 2025-Apr-29 | 2025-Oct-28 | M136 | v22.14 | ✅ |
-| 35.0.0 |  2025-Jan-16 | 2025-Feb-05 | 2025-Mar-04 | 2025-Sep-02 | M134 | v22.14 | 🚫 |
+| 35.0.0 |  2025-Jan-16 | 2025-Feb-05 | 2025-Mar-04 | 2025-Sep-02 | M134 | v22.14 | ✅ |
 | 34.0.0 |  2024-Oct-17 | 2024-Nov-13 | 2025-Jan-14 | 2025-Jun-24 | M132 | v20.18 | 🚫 |
 | 33.0.0 |  2024-Aug-22 | 2024-Sep-18 | 2024-Oct-15 | 2025-Apr-29 | M130 | v20.18 | 🚫 |
 | 32.0.0 |  2024-Jun-14 | 2024-Jul-24 | 2024-Aug-20 | 2025-Mar-04 | M128 | v20.16 | 🚫 |

docs/tutorial/esm.md

@@ -32,7 +32,7 @@ This table gives a general overview of where ESM is supported and which ESM load
 | Main                 | Node.js    | N/A                   | <ul><li> [You must use `await` generously before the app's `ready` event](#you-must-use-await-generously-before-the-apps-ready-event) </li></ul> |
 | Renderer (Sandboxed) | Chromium   | Unsupported           | <ul><li> [Sandboxed preload scripts can't use ESM imports](#sandboxed-preload-scripts-cant-use-esm-imports) </li></ul> |
 | Renderer (Unsandboxed & Context Isolated) | Chromium | Node.js | <ul><li> [Unsandboxed ESM preload scripts will run after page load on pages with no content](#unsandboxed-esm-preload-scripts-will-run-after-page-load-on-pages-with-no-content) </li> <li>[ESM Preload Scripts must have the `.mjs` extension](#esm-preload-scripts-must-have-the-mjs-extension)</li></ul> |
-| Renderer (Unsandboxed & Non Context Isolated) | Chromium | Node.js | <ul><li>[Unsandboxed ESM preload scripts will run after page load on pages with no content](#unsandboxed-esm-preload-scripts-will-run-after-page-load-on-pages-with-no-content)</li><li>[ESM Preload Scripts must have the `.mjs` extension](#esm-preload-scripts-must-have-the-mjs-extension)</li></ul> |
+| Renderer (Unsandboxed & Non Context Isolated) | Chromium | Node.js | <ul><li>[Unsandboxed ESM preload scripts will run after page load on pages with no content](#unsandboxed-esm-preload-scripts-will-run-after-page-load-on-pages-with-no-content)</li><li>[ESM Preload Scripts must have the `.mjs` extension](#esm-preload-scripts-must-have-the-mjs-extension)</li><li>[ESM preload scripts must be context isolated to use dynamic Node.js ESM imports](#esm-preload-scripts-must-be-context-isolated-to-use-dynamic-nodejs-esm-imports)</li></ul> |
 
 ## Main process
 

docs/tutorial/installation.md

@@ -26,12 +26,12 @@ any dependencies in your app will not be installed.
 
 ## Customization
 
-If you want to change the architecture that is downloaded (e.g., `x64` on an
-`arm64` machine), you can use the `--arch` flag with npm install or set the
+If you want to change the architecture that is downloaded (e.g., `ia32` on an
+`x64` machine), you can use the `--arch` flag with npm install or set the
 `npm_config_arch` environment variable:
 
 ```shell
-npm install --arch=x64 electron
+npm install --arch=ia32 electron
 ```
 
 In addition to changing the architecture, you can also specify the platform
@@ -60,7 +60,7 @@ where `$VERSION` is the exact version of Electron).
 If you are unable to access GitHub or you need to provide a custom build, you
 can do so by either providing a mirror or an existing cache directory.
 
-### Mirror
+#### Mirror
 
 You can use environment variables to override the base URL, the path at which to
 look for Electron binaries, and the binary filename. The URL used by `@electron/get`
@@ -95,7 +95,7 @@ Electron release you may have to set `electron_use_remote_checksums=1` directly,
 or configure it in a `.npmrc` file, to force Electron to use the remote `SHASUMS256.txt`
 file to verify the checksum instead of the embedded checksums.
 
-### Cache
+#### Cache
 
 Alternatively, you can override the local cache. `@electron/get` will cache
 downloaded binaries in a local directory to not stress your network. You can use
@@ -120,7 +120,7 @@ The cache contains the version's official zip file as well as a checksum, and is
 │   └── electron-v15.3.1-darwin-x64.zip
 ```
 
-## Postinstall script
+## Skip binary download
 
 Under the hood, Electron's JavaScript API binds to a binary that contains its
 implementations. Because this binary is crucial to the function of any Electron app,

docs/tutorial/online-offline-events.md

@@ -2,15 +2,15 @@
 
 ## Overview
 
-Online and offline event detection can be implemented in both the main and renderer processes:
-
-- **Renderer process**: Use the [`navigator.onLine`](http://html5index.org/Offline%20-%20NavigatorOnLine.html) attribute and [online/offline events](https://developer.mozilla.org/en-US/docs/Online_and_offline_events), part of standard HTML5 API.
-- **Main process**: Use the [`net.isOnline()`](../api/net.md#netisonline) method or the [`net.online`](../api/net.md#netonline-readonly) property.
+[Online and offline event](https://developer.mozilla.org/en-US/docs/Online_and_offline_events)
+detection can be implemented in the Renderer process using the
+[`navigator.onLine`](http://html5index.org/Offline%20-%20NavigatorOnLine.html)
+attribute, part of standard HTML5 API.
 
 The `navigator.onLine` attribute returns:
 
-- `false` if all network requests are guaranteed to fail (e.g. when disconnected from the network).
-- `true` in all other cases.
+* `false` if all network requests are guaranteed to fail (e.g. when disconnected from the network).
+* `true` in all other cases.
 
 Since many cases return `true`, you should treat with care situations of
 getting false positives, as we cannot always assume that `true` value means
@@ -19,27 +19,7 @@ is running a virtualization software that has virtual Ethernet adapters in "alwa
 connected" state. Therefore, if you want to determine the Internet access
 status of Electron, you should develop additional means for this check.
 
-## Main Process Detection
-
-In the main process, you can use the `net` module to detect online/offline status:
-
-```js
-const { net } = require('electron')
-
-// Method 1: Using net.isOnline()
-const isOnline = net.isOnline()
-console.log('Online status:', isOnline)
-
-// Method 2: Using net.online property
-console.log('Online status:', net.online)
-```
-
-Both `net.isOnline()` and `net.online` return the same boolean value with the same reliability characteristics as `navigator.onLine` - they provide a strong indicator when offline (`false`), but a `true` value doesn't guarantee successful internet connectivity.
-
-> [!NOTE]
-> The `net` module is only available after the app emits the `ready` event.
-
-## Renderer Process Example
+## Example
 
 Starting with an HTML file `index.html`, this example will demonstrate how the `navigator.onLine` API can be used to build a connection status indicator.
 
@@ -104,4 +84,4 @@ After launching the Electron application, you should see the notification:
 ![Connection status](../images/connection-status.png)
 
 > [!NOTE]
-> If you need to check the connection status in the main process, you can use [`net.isOnline()`](../api/net.md#netisonline) directly instead of communicating from the renderer process via [IPC](../api/ipc-renderer.md).
+> If you need to communicate the connection status to the main process, use the [IPC renderer](../api/ipc-renderer.md) API.

docs/tutorial/recent-documents.md

@@ -77,11 +77,6 @@ To clear the list of recent documents, use the
 In this guide, the list of documents is cleared once all windows have been
 closed.
 
-#### Accessing the list of recent documents
-
-To access the list of recent documents, use the
-[app.getRecentDocuments][getrecentdocuments] API.
-
 ## Additional information
 
 ### Windows Notes
@@ -143,6 +138,5 @@ of `app` module will be emitted for it.
 [dock-menu-image]: https://cloud.githubusercontent.com/assets/639601/5069610/2aa80758-6e97-11e4-8cfb-c1a414a10774.png
 [addrecentdocument]: ../api/app.md#appaddrecentdocumentpath-macos-windows
 [clearrecentdocuments]: ../api/app.md#appclearrecentdocuments-macos-windows
-[getrecentdocuments]: ../api/app.md#appgetrecentdocuments-macos-windows
 [app-registration]: https://learn.microsoft.com/en-us/windows/win32/shell/app-registration
 [menu-item-image]: https://user-images.githubusercontent.com/3168941/33003655-ea601c3a-cd70-11e7-97fa-7c062149cfb1.png

docs/tutorial/sandbox.md

@@ -13,13 +13,7 @@ the GPU service and the network service.
 See Chromium's [Sandbox design document][sandbox] for more information.
 
 Starting from Electron 20, the sandbox is enabled for renderer processes without any
-further configuration.
-
-Sandboxing is tied to Node.js integration. _Enabling Node.js integration_ for a
-renderer process by setting `nodeIntegration: true` _disables the sandbox_ for the
-process.
-
-If you want to disable the sandbox for a process, see the
+further configuration. If you want to disable the sandbox for a process, see the
 [Disabling the sandbox for a single process](#disabling-the-sandbox-for-a-single-process)
 section.
 
@@ -104,8 +98,7 @@ app.whenReady().then(() => {
 ```
 
 Sandboxing is also disabled whenever Node.js integration is enabled in the renderer.
-This can be done through the BrowserWindow constructor with the `nodeIntegration: true` flag
-or by providing the respective HTML boolean attribute for a `webview`.
+This can be done through the BrowserWindow constructor with the `nodeIntegration: true` flag.
 
 ```js title='main.js'
 app.whenReady().then(() => {
@@ -118,10 +111,6 @@ app.whenReady().then(() => {
 })
 ```
 
-```html title='index.html (Renderer Process)'
-<webview nodeIntegration src="page.html"></webview>
-```
-
 ### Enabling the sandbox globally
 
 If you want to force sandboxing for all renderers, you can also use the

docs/tutorial/security.md

@@ -244,10 +244,6 @@ to enable this behavior.
 Even when `nodeIntegration: false` is used, to truly enforce strong isolation
 and prevent the use of Node primitives `contextIsolation` **must** also be used.
 
-Beware that _disabling context isolation_ for a renderer process by setting
-`nodeIntegration: true` _also disables process sandboxing_ for that process.
-See section below.
-
 :::info
 For more information on what `contextIsolation` is and how to enable it please
 see our dedicated [Context Isolation](context-isolation.md) document.
@@ -255,16 +251,6 @@ see our dedicated [Context Isolation](context-isolation.md) document.
 
 ### 4. Enable process sandboxing
 
-:::info
-This recommendation is the default behavior in Electron since 20.0.0.
-
-Additionally, process sandboxing can be enforced for all renderer processes
-application wide: [Enabling the sandbox globally](sandbox.md#enabling-the-sandbox-globally)
-
-_Disabling context isolation_ (see above) _also disables process sandboxing_,
-regardless of the default, `sandbox: false` or globally enabled sandboxing!
-:::
-
 [Sandboxing](https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md)
 is a Chromium feature that uses the operating system to
 significantly limit what renderer processes have access to. You should enable

docs/tutorial/tutorial-2-first-app.md

@@ -55,27 +55,14 @@ There are a few rules to follow for the purposes of this tutorial:
 - _author_, _license_, and _description_ can be any value, but will be necessary for
   [packaging][packaging] later on.
 
-:::caution Install dependencies with a regular `node_modules` folder
-
-Electron's packaging toolchain requires the `node_modules` folder to be physically on disk in the
-way that npm installs Node dependencies. By default, [Yarn Berry](https://yarnpkg.com/) and
-[pnpm](http://pnpm.io/) both use alternative installation strategies.
-
-Therefore, you must set [`nodeLinker: node-modules`](https://yarnpkg.com/configuration/yarnrc#nodeLinker)
-in Yarn or [`nodeLinker: hoisted`](https://pnpm.io/settings#nodelinker) in pnpm if you are using
-those package managers.
-
-:::
-
 Then, install Electron into your app's **devDependencies**, which is the list of external
 development-only package dependencies not required in production.
 
-:::info Why is Electron a dev dependency?
+:::info Why is Electron a devDependency?
 
-This may seem counter-intuitive since your production code is running Electron APIs. Under the hood,
-Electron's JavaScript API binds to a binary that contains its implementations. The packaging step for
-Electron handles the bundling of this binary, eliminating the need to specify it as a production
-dependency.
+This may seem counter-intuitive since your production code is running Electron APIs.
+However, packaged apps will come bundled with the Electron binary, eliminating the need to specify
+it as a production dependency.
 
 :::
 
@@ -83,17 +70,6 @@ dependency.
 npm install electron --save-dev
 ```
 
-:::warning
-
-In order to correctly install Electron, you need to ensure that its `postinstall` lifecycle
-script is able to run. This means avoiding the `--ignore-scripts` flag on npm and allowlisting
-`electron` to run build scripts on other package managers.
-
-This is likely to change in a future version of Electron. See
-[electron/rfcs#22](https://github.com/electron/rfcs/pull/22) for more details.
-
-:::
-
 Your package.json file should look something like this after initializing your package
 and installing Electron. You should also now have a `node_modules` folder containing
 the Electron executable, as well as a `package-lock.json` lockfile that specifies

filenames.auto.gni

@@ -82,6 +82,7 @@ auto_filenames = {
     "docs/api/structures/browser-window-options.md",
     "docs/api/structures/certificate-principal.md",
     "docs/api/structures/certificate.md",
+    "docs/api/structures/color-space.md",
     "docs/api/structures/cookie.md",
     "docs/api/structures/cpu-usage.md",
     "docs/api/structures/crash-report.md",
@@ -167,7 +168,6 @@ auto_filenames = {
   sandbox_bundle_deps = [
     "lib/common/api/native-image.ts",
     "lib/common/define-properties.ts",
-    "lib/common/deprecate.ts",
     "lib/common/ipc-messages.ts",
     "lib/common/web-view-methods.ts",
     "lib/common/webpack-globals-provider.ts",
@@ -299,7 +299,6 @@ auto_filenames = {
     "lib/common/api/native-image.ts",
     "lib/common/api/shell.ts",
     "lib/common/define-properties.ts",
-    "lib/common/deprecate.ts",
     "lib/common/init.ts",
     "lib/common/ipc-messages.ts",
     "lib/common/web-view-methods.ts",
@@ -340,7 +339,6 @@ auto_filenames = {
     "lib/common/api/native-image.ts",
     "lib/common/api/shell.ts",
     "lib/common/define-properties.ts",
-    "lib/common/deprecate.ts",
     "lib/common/init.ts",
     "lib/common/ipc-messages.ts",
     "lib/common/webpack-provider.ts",

filenames.gni

@@ -23,6 +23,7 @@ filenames = {
 
   lib_sources_linux = [
     "shell/browser/browser_linux.cc",
+    "shell/browser/electron_browser_main_parts_linux.cc",
     "shell/browser/lib/power_observer_linux.cc",
     "shell/browser/lib/power_observer_linux.h",
     "shell/browser/linux/unity_service.cc",
@@ -379,8 +380,6 @@ filenames = {
     "shell/browser/electron_navigation_throttle.h",
     "shell/browser/electron_permission_manager.cc",
     "shell/browser/electron_permission_manager.h",
-    "shell/browser/electron_preconnect_manager_delegate.cc",
-    "shell/browser/electron_preconnect_manager_delegate.h",
     "shell/browser/electron_speech_recognition_manager_delegate.cc",
     "shell/browser/electron_speech_recognition_manager_delegate.h",
     "shell/browser/electron_web_contents_utility_handler_impl.cc",
@@ -652,7 +651,6 @@ filenames = {
     "shell/common/gin_helper/function_template.cc",
     "shell/common/gin_helper/function_template.h",
     "shell/common/gin_helper/function_template_extensions.h",
-    "shell/common/gin_helper/handle.h",
     "shell/common/gin_helper/locker.cc",
     "shell/common/gin_helper/locker.h",
     "shell/common/gin_helper/object_template_builder.cc",

filenames.libcxx.gni

@@ -821,7 +821,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__cxx03/__utility/unreachable.h",
   "//third_party/libc++/src/include/__cxx03/__variant/monostate.h",
   "//third_party/libc++/src/include/__cxx03/__verbose_abort",
-  "//third_party/libc++/src/include/__cxx03/__verbose_trap",
   "//third_party/libc++/src/include/__cxx03/algorithm",
   "//third_party/libc++/src/include/__cxx03/array",
   "//third_party/libc++/src/include/__cxx03/atomic",
@@ -968,7 +967,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__format/enable_insertable.h",
   "//third_party/libc++/src/include/__format/escaped_output_table.h",
   "//third_party/libc++/src/include/__format/extended_grapheme_cluster_table.h",
-  "//third_party/libc++/src/include/__format/fmt_pair_like.h",
   "//third_party/libc++/src/include/__format/format_arg.h",
   "//third_party/libc++/src/include/__format/format_arg_store.h",
   "//third_party/libc++/src/include/__format/format_args.h",
@@ -991,7 +989,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__format/indic_conjunct_break_table.h",
   "//third_party/libc++/src/include/__format/parser_std_format_spec.h",
   "//third_party/libc++/src/include/__format/range_default_formatter.h",
-  "//third_party/libc++/src/include/__format/range_format.h",
   "//third_party/libc++/src/include/__format/range_formatter.h",
   "//third_party/libc++/src/include/__format/unicode.h",
   "//third_party/libc++/src/include/__format/width_estimation_table.h",
@@ -1087,7 +1084,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__iterator/ostreambuf_iterator.h",
   "//third_party/libc++/src/include/__iterator/permutable.h",
   "//third_party/libc++/src/include/__iterator/prev.h",
-  "//third_party/libc++/src/include/__iterator/product_iterator.h",
   "//third_party/libc++/src/include/__iterator/projected.h",
   "//third_party/libc++/src/include/__iterator/ranges_iterator_traits.h",
   "//third_party/libc++/src/include/__iterator/readable_traits.h",
@@ -1100,18 +1096,13 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__iterator/unreachable_sentinel.h",
   "//third_party/libc++/src/include/__iterator/wrap_iter.h",
   "//third_party/libc++/src/include/__locale",
-  "//third_party/libc++/src/include/__locale_dir/check_grouping.h",
-  "//third_party/libc++/src/include/__locale_dir/get_c_locale.h",
+  "//third_party/libc++/src/include/__locale_dir/locale_base_api/android.h",
   "//third_party/libc++/src/include/__locale_dir/locale_base_api/bsd_locale_fallbacks.h",
   "//third_party/libc++/src/include/__locale_dir/locale_base_api/ibm.h",
   "//third_party/libc++/src/include/__locale_dir/locale_base_api/musl.h",
   "//third_party/libc++/src/include/__locale_dir/locale_base_api/openbsd.h",
   "//third_party/libc++/src/include/__locale_dir/locale_base_api.h",
-  "//third_party/libc++/src/include/__locale_dir/messages.h",
-  "//third_party/libc++/src/include/__locale_dir/money.h",
-  "//third_party/libc++/src/include/__locale_dir/num.h",
   "//third_party/libc++/src/include/__locale_dir/pad_and_output.h",
-  "//third_party/libc++/src/include/__locale_dir/scan_keyword.h",
   "//third_party/libc++/src/include/__locale_dir/support/apple.h",
   "//third_party/libc++/src/include/__locale_dir/support/bsd_like.h",
   "//third_party/libc++/src/include/__locale_dir/support/freebsd.h",
@@ -1120,10 +1111,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__locale_dir/support/no_locale/characters.h",
   "//third_party/libc++/src/include/__locale_dir/support/no_locale/strtonum.h",
   "//third_party/libc++/src/include/__locale_dir/support/windows.h",
-  "//third_party/libc++/src/include/__locale_dir/time.h",
-  "//third_party/libc++/src/include/__locale_dir/wbuffer_convert.h",
-  "//third_party/libc++/src/include/__locale_dir/wstring_convert.h",
-  "//third_party/libc++/src/include/__log_hardening_failure",
   "//third_party/libc++/src/include/__math/abs.h",
   "//third_party/libc++/src/include/__math/copysign.h",
   "//third_party/libc++/src/include/__math/error_functions.h",
@@ -1305,7 +1292,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__ranges/iota_view.h",
   "//third_party/libc++/src/include/__ranges/istream_view.h",
   "//third_party/libc++/src/include/__ranges/join_view.h",
-  "//third_party/libc++/src/include/__ranges/join_with_view.h",
   "//third_party/libc++/src/include/__ranges/lazy_split_view.h",
   "//third_party/libc++/src/include/__ranges/movable_box.h",
   "//third_party/libc++/src/include/__ranges/non_propagating_cache.h",
@@ -1326,7 +1312,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__ranges/transform_view.h",
   "//third_party/libc++/src/include/__ranges/view_interface.h",
   "//third_party/libc++/src/include/__ranges/views.h",
-  "//third_party/libc++/src/include/__ranges/zip_transform_view.h",
   "//third_party/libc++/src/include/__ranges/zip_view.h",
   "//third_party/libc++/src/include/__split_buffer",
   "//third_party/libc++/src/include/__std_mbstate_t.h",
@@ -1370,14 +1355,16 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__tuple/make_tuple_types.h",
   "//third_party/libc++/src/include/__tuple/sfinae_helpers.h",
   "//third_party/libc++/src/include/__tuple/tuple_element.h",
+  "//third_party/libc++/src/include/__tuple/tuple_indices.h",
   "//third_party/libc++/src/include/__tuple/tuple_like.h",
   "//third_party/libc++/src/include/__tuple/tuple_like_ext.h",
   "//third_party/libc++/src/include/__tuple/tuple_like_no_subrange.h",
   "//third_party/libc++/src/include/__tuple/tuple_size.h",
   "//third_party/libc++/src/include/__tuple/tuple_types.h",
   "//third_party/libc++/src/include/__type_traits/add_cv_quals.h",
+  "//third_party/libc++/src/include/__type_traits/add_lvalue_reference.h",
   "//third_party/libc++/src/include/__type_traits/add_pointer.h",
-  "//third_party/libc++/src/include/__type_traits/add_reference.h",
+  "//third_party/libc++/src/include/__type_traits/add_rvalue_reference.h",
   "//third_party/libc++/src/include/__type_traits/aligned_storage.h",
   "//third_party/libc++/src/include/__type_traits/aligned_union.h",
   "//third_party/libc++/src/include/__type_traits/alignment_of.h",
@@ -1399,7 +1386,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__type_traits/extent.h",
   "//third_party/libc++/src/include/__type_traits/has_unique_object_representation.h",
   "//third_party/libc++/src/include/__type_traits/has_virtual_destructor.h",
-  "//third_party/libc++/src/include/__type_traits/integer_traits.h",
   "//third_party/libc++/src/include/__type_traits/integral_constant.h",
   "//third_party/libc++/src/include/__type_traits/invoke.h",
   "//third_party/libc++/src/include/__type_traits/is_abstract.h",
@@ -1450,6 +1436,7 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__type_traits/is_same.h",
   "//third_party/libc++/src/include/__type_traits/is_scalar.h",
   "//third_party/libc++/src/include/__type_traits/is_signed.h",
+  "//third_party/libc++/src/include/__type_traits/is_signed_integer.h",
   "//third_party/libc++/src/include/__type_traits/is_specialization.h",
   "//third_party/libc++/src/include/__type_traits/is_standard_layout.h",
   "//third_party/libc++/src/include/__type_traits/is_swappable.h",
@@ -1463,6 +1450,7 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__type_traits/is_unbounded_array.h",
   "//third_party/libc++/src/include/__type_traits/is_union.h",
   "//third_party/libc++/src/include/__type_traits/is_unsigned.h",
+  "//third_party/libc++/src/include/__type_traits/is_unsigned_integer.h",
   "//third_party/libc++/src/include/__type_traits/is_valid_expansion.h",
   "//third_party/libc++/src/include/__type_traits/is_void.h",
   "//third_party/libc++/src/include/__type_traits/is_volatile.h",
@@ -1533,7 +1521,6 @@ libcxx_headers = [
   "//third_party/libc++/src/include/__vector/vector_bool.h",
   "//third_party/libc++/src/include/__vector/vector_bool_formatter.h",
   "//third_party/libc++/src/include/__verbose_abort",
-  "//third_party/libc++/src/include/__verbose_trap",
   "//third_party/libc++/src/include/algorithm",
   "//third_party/libc++/src/include/any",
   "//third_party/libc++/src/include/array",

lib/browser/api/browser-window.ts

@@ -199,14 +199,7 @@ BrowserWindow.prototype.setBackgroundThrottling = function (allowed: boolean) {
 };
 
 BrowserWindow.prototype.addBrowserView = function (browserView: BrowserView) {
-  if (this._browserViews.includes(browserView)) {
-    return;
-  }
-
-  const ownerWindow = browserView.ownerWindow;
-  if (ownerWindow && ownerWindow !== this) {
-    ownerWindow.removeBrowserView(browserView);
-  }
+  if (browserView.ownerWindow) { browserView.ownerWindow.removeBrowserView(browserView); }
   this.contentView.addChildView(browserView.webContentsView);
   browserView.ownerWindow = this;
   browserView.webContents._setOwnerWindow(this);

lib/browser/api/menu.ts

@@ -25,30 +25,11 @@ Menu.prototype._isCommandIdChecked = function (id) {
 };
 
 Menu.prototype._isCommandIdEnabled = function (id) {
-  const item = this.commandsMap[id];
-  if (!item) return false;
-
-  const focusedWindow = BaseWindow.getFocusedWindow();
-
-  if (item.role === 'minimize' && focusedWindow) {
-    return focusedWindow.isMinimizable();
-  }
-
-  if (item.role === 'togglefullscreen' && focusedWindow) {
-    return focusedWindow.isFullScreenable();
-  }
-
-  if (item.role === 'close' && focusedWindow) {
-    return focusedWindow.isClosable();
-  }
-
-  return item.enabled;
+  return this.commandsMap[id] ? this.commandsMap[id].enabled : false;
 };
-
 Menu.prototype._shouldCommandIdWorkWhenHidden = function (id) {
   return this.commandsMap[id] ? !!this.commandsMap[id].acceleratorWorksWhenHidden : false;
 };
-
 Menu.prototype._isCommandIdVisible = function (id) {
   return this.commandsMap[id] ? this.commandsMap[id].visible : false;
 };

lib/browser/api/web-frame-main.ts

@@ -1,7 +1,7 @@
 import { IpcMainImpl } from '@electron/internal/browser/ipc-main-impl';
 import { MessagePortMain } from '@electron/internal/browser/message-port-main';
 
-const { WebFrameMain, fromId, fromFrameToken } = process._linkedBinding('electron_browser_web_frame_main');
+const { WebFrameMain, fromId } = process._linkedBinding('electron_browser_web_frame_main');
 
 Object.defineProperty(WebFrameMain.prototype, 'ipc', {
   get () {
@@ -43,6 +43,5 @@ WebFrameMain.prototype.postMessage = function (...args) {
 };
 
 export default {
-  fromId,
-  fromFrameToken
+  fromId
 };

lib/browser/init.ts

@@ -162,6 +162,27 @@ require('@electron/internal/browser/api/web-contents-view');
 // Set main startup script of the app.
 const mainStartupScript = packageJson.main || 'index.js';
 
+const KNOWN_XDG_DESKTOP_VALUES = new Set(['Pantheon', 'Unity:Unity7', 'pop:GNOME']);
+
+function currentPlatformSupportsAppIndicator () {
+  if (process.platform !== 'linux') return false;
+  const currentDesktop = process.env.XDG_CURRENT_DESKTOP;
+
+  if (!currentDesktop) return false;
+  if (KNOWN_XDG_DESKTOP_VALUES.has(currentDesktop)) return true;
+  // ubuntu based or derived session (default ubuntu one, communitheme…) supports
+  // indicator too.
+  if (/ubuntu/ig.test(currentDesktop)) return true;
+
+  return false;
+}
+
+// Workaround for electron/electron#5050 and electron/electron#9046
+process.env.ORIGINAL_XDG_CURRENT_DESKTOP = process.env.XDG_CURRENT_DESKTOP;
+if (currentPlatformSupportsAppIndicator()) {
+  process.env.XDG_CURRENT_DESKTOP = 'Unity';
+}
+
 // Quit when all windows are closed and no other one is listening to this.
 app.on('window-all-closed', () => {
   if (app.listenerCount('window-all-closed') === 1) {
@@ -183,7 +204,7 @@ delete process.appCodeLoaded;
 if (packagePath) {
   // Finally load app's main.js and transfer control to C++.
   if ((packageJson.type === 'module' && !mainStartupScript.endsWith('.cjs')) || mainStartupScript.endsWith('.mjs')) {
-    const { runEntryPointWithESMLoader } = __non_webpack_require__('internal/modules/run_main') as typeof import('@node/lib/internal/modules/run_main');
+    const { runEntryPointWithESMLoader } = __non_webpack_require__('internal/modules/run_main');
     const main = (require('url') as typeof url).pathToFileURL(path.join(packagePath, mainStartupScript));
     runEntryPointWithESMLoader(async (cascadedLoader: any) => {
       try {

lib/browser/parse-features-string.ts

@@ -91,6 +91,12 @@ export function parseFeatures (features: string) {
     delete parsed[key];
   }
 
+  // Per spec - https://html.spec.whatwg.org/multipage/nav-history-apis.html#dom-open-dev
+  // windows are always resizable.
+  if (parsed.resizable !== undefined) {
+    delete parsed.resizable;
+  }
+
   if (parsed.left !== undefined) parsed.x = parsed.left;
   if (parsed.top !== undefined) parsed.y = parsed.top;
 

lib/browser/rpc-server.ts

@@ -3,7 +3,6 @@ import * as ipcMainUtils from '@electron/internal/browser/ipc-main-internal-util
 import { IPC_MESSAGES } from '@electron/internal/common/ipc-messages';
 
 import { clipboard } from 'electron/common';
-import { webFrameMain } from 'electron/main';
 
 import * as fs from 'fs';
 import * as path from 'path';
@@ -110,17 +109,3 @@ ipcMainInternal.on(IPC_MESSAGES.BROWSER_PRELOAD_ERROR, function (event, preloadP
   if (event.type !== 'frame') return;
   event.sender?.emit('preload-error', event, preloadPath, error);
 });
-
-ipcMainUtils.handleSync(IPC_MESSAGES.BROWSER_GET_FRAME_ROUTING_ID_SYNC, function (event, frameToken: string) {
-  if (event.type !== 'frame') return;
-  const senderFrame = event.senderFrame;
-  if (!senderFrame || senderFrame.isDestroyed()) return;
-  return webFrameMain.fromFrameToken(senderFrame.processId, frameToken)?.routingId;
-});
-
-ipcMainUtils.handleSync(IPC_MESSAGES.BROWSER_GET_FRAME_TOKEN_SYNC, function (event, routingId: number) {
-  if (event.type !== 'frame') return;
-  const senderFrame = event.senderFrame;
-  if (!senderFrame || senderFrame.isDestroyed()) return;
-  return webFrameMain.fromId(senderFrame.processId, routingId)?.frameToken;
-});

lib/common/api/net-client-request.ts

@@ -289,8 +289,7 @@ function parseOptions (optionsIn: ClientRequestConstructorOptions | string): Nod
     referrerPolicy: options.referrerPolicy,
     cache: options.cache,
     allowNonHttpProtocols: Object.hasOwn(options, kAllowNonHttpProtocols),
-    priority: options.priority,
-    bypassCustomProtocolHandlers: options.bypassCustomProtocolHandlers
+    priority: options.priority
   };
   if ('priorityIncremental' in options) {
     urlLoaderOptions.priorityIncremental = options.priorityIncremental;

lib/common/init.ts

@@ -93,23 +93,20 @@ makeElectronModule('electron');
 makeElectronModule('electron/common');
 if (process.type === 'browser') {
   makeElectronModule('electron/main');
-} else if (process.type === 'renderer') {
+}
+if (process.type === 'renderer') {
   makeElectronModule('electron/renderer');
-} else if (process.type === 'utility') {
-  makeElectronModule('electron/utility');
 }
 
 const originalResolveFilename = Module._resolveFilename;
 
-// 'electron/{common,main,renderer,utility}' are module aliases
+// 'electron/main', 'electron/renderer' and 'electron/common' are module aliases
 // of the 'electron' module for TypeScript purposes, i.e., the types for
 // 'electron/main' consist of only main process modules, etc. It is intentional
 // that these can be `require()`-ed from both the main process as well as the
 // renderer process regardless of the names, they're superficial for TypeScript
 // only.
-const electronModuleNames = new Set([
-  'electron', 'electron/main', 'electron/renderer', 'electron/common', 'electron/utility'
-]);
+const electronModuleNames = new Set(['electron', 'electron/main', 'electron/renderer', 'electron/common']);
 Module._resolveFilename = function (request, parent, isMain, options) {
   if (electronModuleNames.has(request)) {
     return 'electron';