docs: fix some string enum typings (#49932)

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: David Sanders <dsanders11@ucsbalum.com>

.devcontainer/docker-compose.yml

@@ -2,7 +2,7 @@ version: '3'
 
 services:
   buildtools:
-    image: ghcr.io/electron/devcontainer:933c7d6ff6802706875270bec2e3c891cf8add3f
+    image: ghcr.io/electron/devcontainer:a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb
 
     volumes:
       - ..:/workspaces/gclient/src/electron:cached

.github/actions/build-electron/action.yml

@@ -188,6 +188,7 @@ runs:
     - name: Publish Electron Dist ${{ inputs.step-suffix }}
       if: ${{ inputs.is-release == 'true' }}
       shell: bash
+      id: github-upload
       run: |
         rm -rf src/out/Default/obj
         cd src/electron
@@ -198,6 +199,11 @@ runs:
           echo 'Uploading Electron release distribution to GitHub releases'
           script/release/uploaders/upload.py --verbose
         fi
+    - name: Generate artifact attestation
+      if: ${{ inputs.is-release == 'true' }}
+      uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+      with:
+        subject-path: ${{ steps.github-upload.outputs.UPLOADED_PATHS }}
     - name: Generate siso report
       if: ${{ inputs.target-platform != 'win' && !cancelled() }}
       shell: bash

.github/actions/checkout/action.yml

@@ -143,11 +143,12 @@ runs:
           echo "No changes to patches detected"
         fi
       fi
-  - name: Remove patch conflict problem matcher
+  - name: Remove patch conflict problem matchers
     shell: bash
     run: |
       echo "::remove-matcher owner=merge-conflict::"
       echo "::remove-matcher owner=patch-conflict::"
+      echo "::remove-matcher owner=patch-needs-update::"
   - name: Upload patches stats
     if: ${{ inputs.target-platform == 'linux' && github.ref == 'refs/heads/main' }}
     shell: bash

.github/actions/free-space-macos/action.yml

@@ -64,15 +64,24 @@ runs:
         sudo rm -rf /Applications/Xcode_16.1.app
         sudo rm -rf /Applications/Xcode_16.2.app
         sudo rm -rf /Applications/Xcode_16.3.app
+        sudo rm -rf /Applications/Xcode_26*
         sudo rm -rf /Applications/Google Chrome.app
         sudo rm -rf /Applications/Google Chrome for Testing.app
-        sudo rm -rf	/Applications/Firefox.app
+        sudo rm -rf /Applications/Firefox.app
+        sudo rm -rf /Applications/Microsoft Edge.app
         sudo rm -rf ~/project/src/third_party/catapult/tracing/test_data
         sudo rm -rf ~/project/src/third_party/angle/third_party/VK-GL-CTS
         sudo rm -rf /Users/runner/Library/Android
         sudo rm -rf $JAVA_HOME_11_arm64
         sudo rm -rf $JAVA_HOME_17_arm64
         sudo rm -rf $JAVA_HOME_21_arm64
+        sudo rm -rf $JAVA_HOME_25_arm64
+        sudo rm -rf /Users/runner/.dotnet/
+        sudo rm -rf /Users/runner/.rustup
+
+        # remove homebrew packages we don't need
+        brew uninstall -f --zap aws-sam-cli session-manager-plugin gcc gcc@13 gcc@14 llvm@18 gradle maven ant azure-cli
+        brew autoremove
 
         # lipo off some huge binaries arm64 versions to save space
         strip_universal_deep $(xcode-select -p)/../SharedFrameworks

.github/actions/install-build-tools/action.yml

@@ -15,7 +15,7 @@ runs:
         git config --global core.preloadindex true
         git config --global core.longpaths true
       fi
-      export BUILD_TOOLS_SHA=a5d9f9052dcc36ee88bef5c8b13acbefd87b7d8d
+      export BUILD_TOOLS_SHA=a0cc95a1884a631559bcca0c948465b725d9295a
       npm i -g @electron/build-tools
       # Update depot_tools to ensure python
       e d update_depot_tools

.github/actions/install-dependencies/action.yml

@@ -21,4 +21,11 @@ runs:
       if [ "$TARGET_ARCH" = "x86" ]; then
         export npm_config_arch="ia32"
       fi
-      node script/yarn.js install --immutable
+      # if running on linux arm skip yarn Builds
+      ARCH=$(uname -m)
+      if [ "$ARCH" = "armv7l" ]; then
+        echo "Skipping yarn build on linux arm"
+        node script/yarn.js install --immutable --mode=skip-build
+      else
+        node script/yarn.js install --immutable
+      fi

.github/copilot-instructions.md

@@ -0,0 +1,122 @@
+# Copilot Instructions for Electron
+
+## Build System
+
+Electron uses `@electron/build-tools` (`e` CLI). Install with `npm i -g @electron/build-tools`.
+
+```bash
+e sync              # Fetch sources and apply patches
+e build             # Build Electron (GN + Ninja)
+e build -k 999      # Build, continuing through errors
+e start             # Run built Electron
+e start --version   # Verify Electron launches
+e test              # Run full test suite
+e debug             # Run in debugger (lldb on macOS, gdb on Linux)
+```
+
+### Linting
+
+```bash
+npm run lint              # Run all linters (JS, C++, Python, GN, docs)
+npm run lint:js           # JavaScript/TypeScript only
+npm run lint:clang-format # C++ formatting only
+npm run lint:cpp          # C++ linting only
+npm run lint:docs         # Documentation only
+```
+
+### Running a Single Test
+
+```bash
+npm run test -- -g "pattern"   # Run tests matching a regex pattern
+# Example: npm run test -- -g "ipc"
+```
+
+### Running a Single Node.js Test
+
+```bash
+node script/node-spec-runner.js parallel/test-crypto-keygen
+```
+
+## Architecture
+
+Electron embeds Chromium (rendering) and Node.js (backend) to enable desktop apps with web technologies. The parent directory (`../`) is the Chromium source tree.
+
+### Process Model
+
+Electron has two primary process types, mirroring Chromium:
+
+- **Main process** (`shell/browser/` + `lib/browser/`): Controls app lifecycle, creates windows, system APIs
+- **Renderer process** (`shell/renderer/` + `lib/renderer/`): Runs web content in BrowserWindows
+
+### Native ↔ JavaScript Bridge
+
+Each API is implemented as a C++/JS pair:
+
+- C++ side: `shell/browser/api/electron_api_{name}.cc/.h` — uses `gin::Wrappable` and `ObjectTemplateBuilder`
+- JS side: `lib/browser/api/{name}.ts` — exports the module, registered in `lib/browser/api/module-list.ts`
+- Binding: `NODE_LINKED_BINDING_CONTEXT_AWARE(electron_browser_{name}, Initialize)` in C++ and registered in `shell/common/node_bindings.cc`
+- Type declaration: `typings/internal-ambient.d.ts` maps `process._linkedBinding('electron_browser_{name}')`
+
+### Patches System
+
+Electron patches upstream dependencies (Chromium, Node.js, V8, etc.) rather than forking them. Patches live in `patches/` organized by target, with `patches/config.json` mapping directories to repos.
+
+```text
+patches/{target}/*.patch  →  [e sync]   →  target repo commits
+                          ←  [e patches] ←
+```
+
+Key rules:
+
+- Fix existing patches rather than creating new ones
+- Preserve original authorship in TODO comments — never change `TODO(name)` assignees
+- Each patch commit message must explain why the patch exists
+- After modifying patches, run `e patches {target}` to export
+
+When working on the `roller/chromium/main` branch for Chromium upgrades, use `e sync --3` for 3-way merge conflict resolution.
+
+## Conventions
+
+### File Naming
+
+- JS/TS files: kebab-case (`file-name.ts`)
+- C++ files: snake_case with `electron_api_` prefix (`electron_api_safe_storage.cc`)
+- Test files: `api-{module-name}-spec.ts` in `spec/`
+- Source file lists are maintained in `filenames.gni` (with platform-specific sections)
+
+### JavaScript/TypeScript
+
+- Semicolons required (`"semi": ["error", "always"]`)
+- `const` and `let` only (no `var`)
+- Arrow functions preferred
+- Import order enforced: `@electron/internal` → `@electron` → `electron` → external → builtin → relative
+- API naming: `PascalCase` for classes (`BrowserWindow`), `camelCase` for module APIs (`globalShortcut`)
+- Prefer getters/setters over jQuery-style `.text([text])` patterns
+
+### C++
+
+- Follows Chromium coding style, enforced by `clang-format` and `clang-tidy`
+- Uses Chromium abstractions (`base::`, `content::`, etc.)
+- Header guards: `#ifndef ELECTRON_SHELL_BROWSER_API_ELECTRON_API_{NAME}_H_`
+- Platform-specific files: `_mac.mm`, `_win.cc`, `_linux.cc`
+
+### Testing
+
+- Framework: Mocha + Chai + Sinon
+- Test helpers in `spec/lib/` (e.g., `spec-helpers.ts`, `window-helpers.ts`)
+- Use `defer()` from spec-helpers for cleanup, `closeAllWindows()` for window teardown
+- Tests import from `electron/main` or `electron/renderer`
+
+### Documentation
+
+- API docs in `docs/api/` as Markdown, parsed by `@electron/docs-parser` to generate `electron.d.ts`
+- API history tracked via YAML blocks in HTML comments within doc files
+- Docs must pass `npm run lint:docs`
+
+### Build Configuration
+
+- `BUILD.gn`: Main GN build config
+- `buildflags/buildflags.gni`: Feature flags (PDF viewer, extensions, spellchecker)
+- `build/args/`: Build argument profiles (`testing.gn`, `release.gn`, `all.gn`)
+- `DEPS`: Dependency versions and checkout paths
+- `chromium_src/`: Chromium source file overrides (compiled instead of originals)

.github/problem-matchers/markdownlint.json

@@ -0,0 +1,16 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "markdownlint",
+      "pattern": [
+        {
+          "regexp": "^(.+):(\\d+):(\\d+)\\s+(.*)$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4
+        }
+      ]
+    }
+  ]
+}

.github/problem-matchers/patch-conflict.json

@@ -19,6 +19,16 @@
           "line": 3
         }
       ]
+    },
+    {
+      "owner": "patch-needs-update",
+      "pattern": [
+        {
+          "regexp": "^((patches\/.*): needs update)$",
+          "message": 1,
+          "file": 2
+        }
+      ]
     }
   ]
 }

.github/workflows/apply-patches.yml

@@ -0,0 +1,73 @@
+name: Apply Patches
+
+on:
+  pull_request:
+
+permissions: {}
+
+concurrency:
+  group: apply-patches-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  setup:
+    if: github.repository == 'electron/electron'
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      has-patches: ${{ steps.filter.outputs.patches }}
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      with:
+        persist-credentials: false
+        ref: ${{ github.event.pull_request.head.sha }}
+    # Use dorny/paths-filter instead of the path filter under the on: pull_request: block
+    # so that the output can be used to conditionally run the apply-patches job, which lets
+    # the job be marked as a required status check (conditional skip counts as a success).
+    - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      id: filter
+      with:
+        filters: |
+          patches:
+            - DEPS
+            - 'patches/**'
+
+  apply-patches:
+    needs: setup
+    if: ${{ needs.setup.outputs.has-patches == 'true' }}
+    runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
+    container:
+      image: ghcr.io/electron/build:a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb
+      options: --user root
+      volumes:
+        - /mnt/cross-instance-cache:/mnt/cross-instance-cache
+        - /var/run/sas:/var/run/sas
+    env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      with:
+        path: src/electron
+        fetch-depth: 0
+        persist-credentials: false
+        ref: ${{ github.event.pull_request.base.ref }}
+    - name: Merge PR HEAD
+      working-directory: src/electron
+      env:
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+      run: |
+        git config user.email "electron@github.com"
+        git config user.name "Electron Bot"
+        git fetch origin refs/pull/${PR_NUMBER}/head
+        git merge --squash FETCH_HEAD
+        git commit -n -m "Squashed commits"
+    - name: Checkout & Sync & Save
+      uses: ./src/electron/.github/actions/checkout
+      with:
+        target-platform: linux

.github/workflows/build-git-cache.yml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: read
     container:
-      image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
+      image: ghcr.io/electron/build:a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb
       options: --user root
       volumes:
         - /mnt/cross-instance-cache:/mnt/cross-instance-cache
@@ -37,7 +37,7 @@ jobs:
     permissions:
       contents: read
     container:
-      image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
+      image: ghcr.io/electron/build:a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
       volumes:
         - /mnt/win-cache:/mnt/win-cache
@@ -63,7 +63,7 @@ jobs:
     # This job updates the same git cache as linux, so it needs to run after the linux one.
     needs: build-git-cache-linux
     container:
-      image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
+      image: ghcr.io/electron/build:a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb
       options: --user root
       volumes:
         - /mnt/cross-instance-cache:/mnt/cross-instance-cache

.github/workflows/build.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
+        default: 'a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb'
         required: true
       skip-macos:
         type: boolean
@@ -76,7 +76,7 @@ jobs:
       id: set-output
       run: |
         if [ -z "${{ inputs.build-image-sha }}" ]; then
-          echo "build-image-sha=933c7d6ff6802706875270bec2e3c891cf8add3f" >> "$GITHUB_OUTPUT"
+          echo "build-image-sha=a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb" >> "$GITHUB_OUTPUT"
         else
           echo "build-image-sha=${{ inputs.build-image-sha }}" >> "$GITHUB_OUTPUT"
         fi

.github/workflows/linux-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
+        default: 'a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb'
       upload-to-storage:
         description: 'Uploads to Azure storage'
         required: false
@@ -43,9 +43,12 @@ jobs:
       uses: ./src/electron/.github/actions/checkout
 
   publish-x64:
-    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    uses: ./.github/workflows/pipeline-segment-electron-publish.yml
     permissions:
+      artifact-metadata: write
+      attestations: write
       contents: read
+      id-token: write
     needs: checkout-linux
     with:
       environment: production-release
@@ -60,9 +63,12 @@ jobs:
     secrets: inherit
 
   publish-arm:
-    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    uses: ./.github/workflows/pipeline-segment-electron-publish.yml
     permissions:
+      artifact-metadata: write
+      attestations: write
       contents: read
+      id-token: write
     needs: checkout-linux
     with:
       environment: production-release
@@ -77,9 +83,12 @@ jobs:
     secrets: inherit
 
   publish-arm64:
-    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    uses: ./.github/workflows/pipeline-segment-electron-publish.yml
     permissions:
+      artifact-metadata: write
+      attestations: write
       contents: read
+      id-token: write
     needs: checkout-linux
     with:
       environment: production-release

.github/workflows/macos-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
+        default: 'a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb'
         required: true
       upload-to-storage:
         description: 'Uploads to Azure storage'
@@ -47,9 +47,12 @@ jobs:
         target-platform: macos
 
   publish-x64-darwin:
-    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    uses: ./.github/workflows/pipeline-segment-electron-publish.yml
     permissions:
+      artifact-metadata: write
+      attestations: write
       contents: read
+      id-token: write
     needs: checkout-macos
     with:
       environment: production-release
@@ -64,9 +67,12 @@ jobs:
     secrets: inherit
 
   publish-x64-mas:
-    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    uses: ./.github/workflows/pipeline-segment-electron-publish.yml
     permissions:
+      artifact-metadata: write
+      attestations: write
       contents: read
+      id-token: write
     needs: checkout-macos
     with:
       environment: production-release
@@ -81,9 +87,12 @@ jobs:
     secrets: inherit
 
   publish-arm64-darwin:
-    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    uses: ./.github/workflows/pipeline-segment-electron-publish.yml
     permissions:
+      artifact-metadata: write
+      attestations: write
       contents: read
+      id-token: write
     needs: checkout-macos
     with:
       environment: production-release
@@ -98,9 +107,12 @@ jobs:
     secrets: inherit
 
   publish-arm64-mas:
-    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    uses: ./.github/workflows/pipeline-segment-electron-publish.yml
     permissions:
+      artifact-metadata: write
+      attestations: write
       contents: read
+      id-token: write
     needs: checkout-macos
     with:
       environment: production-release

.github/workflows/non-maintainer-dependency-change.yml

@@ -7,6 +7,8 @@ on:
       - 'spec/yarn.lock'
       - '.github/workflows/**'
       - '.github/actions/**'
+      - '.yarn/**'
+      - '.yarnrc.yml'
 
 permissions: {}
 

.github/workflows/pipeline-electron-lint.yml

@@ -65,9 +65,11 @@ jobs:
         curl -sL "https://chromium.googlesource.com/chromium/src/+/${chromium_revision}/buildtools/DEPS?format=TEXT" | base64 -d > src/buildtools/DEPS
 
         gclient sync --spec="solutions=[{'name':'src/buildtools','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':True},'managed':False}]"
-    - name: Add ESLint problem matcher
+    - name: Add problem matchers
       shell: bash
-      run: echo "::add-matcher::src/electron/.github/problem-matchers/eslint-stylish.json"
+      run: |
+        echo "::add-matcher::src/electron/.github/problem-matchers/eslint-stylish.json"
+        echo "::add-matcher::src/electron/.github/problem-matchers/markdownlint.json"
     - name: Run Lint
       shell: bash
       run: |
@@ -85,4 +87,8 @@ jobs:
       run: |
         cd src/electron
         node script/yarn.js tsc -p tsconfig.script.json
-    
+    - name: Check GHA Workflows
+      shell: bash
+      run: |
+        cd src/electron
+        node script/copy-pipeline-segment-publish.js --check

.github/workflows/pipeline-segment-electron-publish.yml

@@ -0,0 +1,237 @@
+# AUTOGENERATED FILE - DO NOT EDIT MANUALLY
+# ONLY EDIT .github/workflows/pipeline-segment-electron-build.yml
+
+name: Pipeline Segment - Electron Build
+on:
+  workflow_call:
+    inputs:
+      environment:
+        description: using the production or testing environment
+        required: false
+        type: string
+      target-platform:
+        type: string
+        description: Platform to run on, can be macos, win or linux
+        required: true
+      target-arch:
+        type: string
+        description: Arch to build for, can be x64, arm64, ia32 or arm
+        required: true
+      target-variant:
+        type: string
+        description: Variant to build for, no effect on non-macOS target platforms. Can
+          be darwin, mas or all.
+        default: all
+      build-runs-on:
+        type: string
+        description: What host to run the build
+        required: true
+      build-container:
+        type: string
+        description: JSON container information for aks runs-on
+        required: false
+        default: '{"image":null}'
+      is-release:
+        description: Whether this build job is a release job
+        required: true
+        type: boolean
+        default: false
+      gn-build-type:
+        description: The gn build type - testing or release
+        required: true
+        type: string
+        default: testing
+      generate-symbols:
+        description: Whether or not to generate symbols
+        required: true
+        type: boolean
+        default: false
+      upload-to-storage:
+        description: Whether or not to upload build artifacts to external storage
+        required: true
+        type: string
+        default: "0"
+      is-asan:
+        description: Building the Address Sanitizer (ASan) Linux build
+        required: false
+        type: boolean
+        default: false
+      enable-ssh:
+        description: Enable SSH debugging
+        required: false
+        type: boolean
+        default: false
+permissions: {}
+concurrency:
+  group: electron-build-${{ inputs.target-platform }}-${{ inputs.target-arch
+    }}-${{ inputs.target-variant }}-${{ inputs.is-asan }}-${{
+    github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
+env:
+  CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+  CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
+  DD_API_KEY: ${{ secrets.DD_API_KEY }}
+  ELECTRON_ARTIFACTS_BLOB_STORAGE: ${{ secrets.ELECTRON_ARTIFACTS_BLOB_STORAGE }}
+  ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
+  SUDOWOODO_EXCHANGE_URL: ${{ secrets.SUDOWOODO_EXCHANGE_URL }}
+  SUDOWOODO_EXCHANGE_TOKEN: ${{ secrets.SUDOWOODO_EXCHANGE_TOKEN }}
+  GCLIENT_EXTRA_ARGS: ${{ inputs.target-platform == 'macos' &&
+    '--custom-var=checkout_mac=True --custom-var=host_os=mac' ||
+    inputs.target-platform == 'win' && '--custom-var=checkout_win=True' ||
+    '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True' }}
+  ELECTRON_OUT_DIR: Default
+  ACTIONS_STEP_DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }}
+jobs:
+  build:
+    defaults:
+      run:
+        shell: bash
+    runs-on: ${{ inputs.build-runs-on }}
+    permissions:
+      artifact-metadata: write
+      attestations: write
+      contents: read
+      id-token: write
+    container: ${{ fromJSON(inputs.build-container) }}
+    environment: ${{ inputs.environment }}
+    env:
+      TARGET_ARCH: ${{ inputs.target-arch }}
+      TARGET_PLATFORM: ${{ inputs.target-platform }}
+    steps:
+      - name: Create src dir
+        run: |
+          mkdir src
+      - name: Checkout Electron
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          path: src/electron
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Setup SSH Debugging
+        if: ${{ inputs.target-platform == 'macos' && (inputs.enable-ssh ||
+          env.ACTIONS_STEP_DEBUG == 'true') }}
+        uses: ./src/electron/.github/actions/ssh-debug
+        with:
+          tunnel: "true"
+        env:
+          CLOUDFLARE_TUNNEL_CERT: ${{ secrets.CLOUDFLARE_TUNNEL_CERT }}
+          CLOUDFLARE_TUNNEL_HOSTNAME: ${{ vars.CLOUDFLARE_TUNNEL_HOSTNAME }}
+          CLOUDFLARE_USER_CA_CERT: ${{ secrets.CLOUDFLARE_USER_CA_CERT }}
+          AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Free up space (macOS)
+        if: ${{ inputs.target-platform == 'macos' }}
+        uses: ./src/electron/.github/actions/free-space-macos
+      - name: Check disk space after freeing up space
+        if: ${{ inputs.target-platform == 'macos' }}
+        run: df -h
+      - name: Setup Node.js/npm
+        if: ${{ inputs.target-platform == 'macos' }}
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: 20.19.x
+          cache: yarn
+          cache-dependency-path: src/electron/yarn.lock
+      - name: Install Dependencies
+        uses: ./src/electron/.github/actions/install-dependencies
+      - name: Install AZCopy
+        if: ${{ inputs.target-platform == 'macos' }}
+        run: brew install azcopy
+      - name: Set GN_EXTRA_ARGS for Linux
+        if: ${{ inputs.target-platform == 'linux' }}
+        run: >
+          if [ "${{ inputs.target-arch  }}" = "arm" ]; then
+            if [ "${{ inputs.is-release  }}" = true ]; then
+              GN_EXTRA_ARGS='target_cpu="arm" build_tflite_with_xnnpack=false symbol_level=1'
+            else
+              GN_EXTRA_ARGS='target_cpu="arm" build_tflite_with_xnnpack=false'
+            fi
+          elif [ "${{ inputs.target-arch }}" = "arm64" ]; then
+            GN_EXTRA_ARGS='target_cpu="arm64" fatal_linker_warnings=false enable_linux_installer=false'
+          elif [ "${{ inputs.is-asan }}" = true ]; then
+            GN_EXTRA_ARGS='is_asan=true'
+          fi
+
+          echo "GN_EXTRA_ARGS=$GN_EXTRA_ARGS" >> $GITHUB_ENV
+      - name: Set Chromium Git Cookie
+        uses: ./src/electron/.github/actions/set-chromium-cookie
+      - name: Install Build Tools
+        uses: ./src/electron/.github/actions/install-build-tools
+      - name: Generate DEPS Hash
+        run: |
+          node src/electron/script/generate-deps-hash.js
+          DEPSHASH=v1-src-cache-$(cat src/electron/.depshash)
+          echo "DEPSHASH=$DEPSHASH" >> $GITHUB_ENV
+          echo "CACHE_PATH=$DEPSHASH.tar" >> $GITHUB_ENV
+      - name: Restore src cache via AZCopy
+        if: ${{ inputs.target-platform != 'linux' }}
+        uses: ./src/electron/.github/actions/restore-cache-azcopy
+        with:
+          target-platform: ${{ inputs.target-platform }}
+      - name: Restore src cache via AKS
+        if: ${{ inputs.target-platform == 'linux' }}
+        uses: ./src/electron/.github/actions/restore-cache-aks
+      - name: Checkout Electron
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          path: src/electron
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Fix Sync
+        if: ${{ inputs.target-platform != 'linux' }}
+        uses: ./src/electron/.github/actions/fix-sync
+        with:
+          target-platform: ${{ inputs.target-platform }}
+        env:
+          ELECTRON_DEPOT_TOOLS_DISABLE_LOG: true
+      - name: Init Build Tools
+        run: >
+          e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }}
+          --import ${{ inputs.gn-build-type }} --target-cpu ${{
+          inputs.target-arch }} --remote-build siso
+      - name: Run Electron Only Hooks
+        run: |
+          e d gclient runhooks --spec="solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False},'managed':False}]"
+      - name: Regenerate DEPS Hash
+        run: >
+          (cd src/electron && git checkout .) && node
+          src/electron/script/generate-deps-hash.js
+
+          echo "DEPSHASH=$(cat src/electron/.depshash)" >> $GITHUB_ENV
+      - name: Add CHROMIUM_BUILDTOOLS_PATH to env
+        run: echo "CHROMIUM_BUILDTOOLS_PATH=$(pwd)/src/buildtools" >> $GITHUB_ENV
+      - name: Free up space (macOS)
+        if: ${{ inputs.target-platform == 'macos' }}
+        uses: ./src/electron/.github/actions/free-space-macos
+      - name: Build Electron
+        if: ${{ inputs.target-platform != 'macos' || (inputs.target-variant == 'all' ||
+          inputs.target-variant == 'darwin') }}
+        uses: ./src/electron/.github/actions/build-electron
+        with:
+          target-arch: ${{ inputs.target-arch }}
+          target-platform: ${{ inputs.target-platform }}
+          artifact-platform: ${{ inputs.target-platform == 'macos' && 'darwin' ||
+            inputs.target-platform }}
+          is-release: ${{ inputs.is-release }}
+          generate-symbols: ${{ inputs.generate-symbols }}
+          upload-to-storage: ${{ inputs.upload-to-storage }}
+          is-asan: ${{ inputs.is-asan }}
+      - name: Set GN_EXTRA_ARGS for MAS Build
+        if: ${{ inputs.target-platform == 'macos' && (inputs.target-variant == 'all' ||
+          inputs.target-variant == 'mas') }}
+        run: |
+          echo "MAS_BUILD=true" >> $GITHUB_ENV
+          GN_EXTRA_ARGS='is_mas_build=true'
+          echo "GN_EXTRA_ARGS=$GN_EXTRA_ARGS" >> $GITHUB_ENV
+      - name: Build Electron (MAS)
+        if: ${{ inputs.target-platform == 'macos' && (inputs.target-variant == 'all' ||
+          inputs.target-variant == 'mas') }}
+        uses: ./src/electron/.github/actions/build-electron
+        with:
+          target-arch: ${{ inputs.target-arch }}
+          target-platform: ${{ inputs.target-platform }}
+          artifact-platform: mas
+          is-release: ${{ inputs.is-release }}
+          generate-symbols: ${{ inputs.generate-symbols }}
+          upload-to-storage: ${{ inputs.upload-to-storage }}
+          step-suffix: (mas)

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -138,10 +138,16 @@ jobs:
         unzip -:o dist.zip
     - name: Setup Linux for Headless Testing
       run: sh -e /etc/init.d/xvfb start
+    - name: Add Clang problem matcher
+      shell: bash
+      run: echo "::add-matcher::src/electron/.github/problem-matchers/clang.json"
     - name: Run Nan Tests
       run: |
         cd src
         node electron/script/nan-spec-runner.js
+    - name: Remove Clang problem matcher
+      shell: bash
+      run: echo "::remove-matcher owner=clang::"
     - name: Wait for active SSH sessions
       shell: bash
       if: always() && !cancelled()

.github/workflows/rerun-apply-patches.yml

@@ -0,0 +1,71 @@
+name: Rerun PR Apply Patches
+
+on:
+  push:
+    branches:
+      - main
+      - '[1-9][0-9]-x-y'
+    paths:
+      - 'DEPS'
+      - 'patches/**'
+
+permissions: {}
+
+jobs:
+  rerun-apply-patches:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      checks: read
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Find PRs and Rerun Apply Patches
+        env:
+          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          BRANCH="${GITHUB_REF#refs/heads/}"
+
+          # Find all open PRs targeting this branch
+          PRS=$(gh pr list --base "$BRANCH" --state open --limit 250 --json number)
+
+          echo "$PRS" | jq -c '.[]' | while read -r pr; do
+            PR_NUMBER=$(echo "$pr" | jq -r '.number')
+            echo "Processing PR #${PR_NUMBER}"
+
+            # Find the Apply Patches workflow check for this PR
+            CHECK=$(gh pr view "$PR_NUMBER" --json statusCheckRollup --jq '[.statusCheckRollup[] | select(.workflowName == "Apply Patches" and .name == "apply-patches")] | first')
+
+            if [ -z "$CHECK" ] || [ "$CHECK" = "null" ]; then
+              echo "  No Apply Patches workflow found for PR #${PR_NUMBER}"
+              continue
+            fi
+
+            CONCLUSION=$(echo "$CHECK" | jq -r '.conclusion')
+            if [ "$CONCLUSION" = "SKIPPED" ]; then
+              echo "  apply-patches job was skipped for PR #${PR_NUMBER} (no patches)"
+              continue
+            fi
+
+            LINK=$(echo "$CHECK" | jq -r '.detailsUrl')
+
+            # Extract the run ID from the link (format: .../runs/RUN_ID/job/JOB_ID)
+            RUN_ID=$(echo "$LINK" | grep -oE 'runs/[0-9]+' | cut -d'/' -f2)
+
+            if [ -z "$RUN_ID" ]; then
+              echo "  Could not extract run ID from link: ${LINK}"
+              continue
+            fi
+
+            # Check if the workflow is currently in progress
+            RUN_STATUS=$(gh run view "$RUN_ID" --json status --jq '.status')
+
+            if [ "$RUN_STATUS" = "in_progress" ] || [ "$RUN_STATUS" = "queued" ] || [ "$RUN_STATUS" = "waiting" ]; then
+              echo "  Workflow run ${RUN_ID} is ${RUN_STATUS}, cancelling..."
+              gh run cancel "$RUN_ID" --force
+              gh run watch "$RUN_ID"
+            fi
+
+            gh run rerun "$RUN_ID"
+          done

.github/workflows/windows-publish.yml

@@ -6,7 +6,7 @@ on:
       build-image-sha:
         type: string
         description: 'SHA for electron/build image'
-        default: '933c7d6ff6802706875270bec2e3c891cf8add3f'
+        default: 'a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb'
         required: true
       upload-to-storage:
         description: 'Uploads to Azure storage'
@@ -51,9 +51,12 @@ jobs:
         target-platform: win
 
   publish-x64-win:
-    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    uses: ./.github/workflows/pipeline-segment-electron-publish.yml
     permissions:
+      artifact-metadata: write
+      attestations: write
       contents: read
+      id-token: write
     needs: checkout-windows
     with:
       environment: production-release
@@ -67,9 +70,12 @@ jobs:
     secrets: inherit
 
   publish-arm64-win:
-    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    uses: ./.github/workflows/pipeline-segment-electron-publish.yml
     permissions:
+      artifact-metadata: write
+      attestations: write
       contents: read
+      id-token: write
     needs: checkout-windows
     with:
       environment: production-release
@@ -83,9 +89,12 @@ jobs:
     secrets: inherit
 
   publish-x86-win:
-    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    uses: ./.github/workflows/pipeline-segment-electron-publish.yml
     permissions:
+      artifact-metadata: write
+      attestations: write
       contents: read
+      id-token: write
     needs: checkout-windows
     with:
       environment: production-release

.yarnrc.yml

@@ -9,4 +9,4 @@ npmMinimalAgeGate: 10080
 npmPreapprovedPackages:
   - "@electron/*"
 
-yarnPath: .yarn/releases/yarn-4.11.0.cjs
+yarnPath: .yarn/releases/yarn-4.12.0.cjs

DEPS

@@ -2,9 +2,9 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '142.0.7444.177',
+    '142.0.7444.265',
   'node_version':
-    'v22.21.1',
+    'v22.22.0',
   'nan_version':
     'e14bdcd1f72d62bca1d541b66da43130384ec213',
   'squirrel.mac_version':
@@ -152,7 +152,7 @@ hooks = [
     'action': [
       'python3',
       '-c',
-      'import os, subprocess; os.chdir(os.path.join("src", "electron")); subprocess.check_call(["node", ".yarn/releases/yarn-4.11.0.cjs", "install", "--immutable"]);',
+      'import os, subprocess; os.chdir(os.path.join("src", "electron")); subprocess.check_call(["node", ".yarn/releases/yarn-4.12.0.cjs", "install", "--immutable"]);',
     ],
   },
   {

docs/api/app.md

@@ -250,7 +250,9 @@ Returns:
 
 Emitted when the user clicks the native macOS new tab button. The new
 tab button is only visible if the current `BrowserWindow` has a
-`tabbingIdentifier`
+`tabbingIdentifier`.
+
+You must create a window in this handler in order for macOS tabbing to work as expected.
 
 ### Event: 'browser-window-blur'
 
@@ -1315,7 +1317,7 @@ Returns `boolean` - Whether the current desktop environment is Unity launcher.
 ### `app.getLoginItemSettings([options])` _macOS_ _Windows_
 
 * `options` Object (optional)
-  * `type` string (optional) _macOS_ - Can be one of `mainAppService`, `agentService`, `daemonService`, or `loginItemService`. Defaults to `mainAppService`. Only available on macOS 13 and up. See [app.setLoginItemSettings](app.md#appsetloginitemsettingssettings-macos-windows) for more information about each type.
+  * `type` string (optional) _macOS_ - Can be `mainAppService`, `agentService`, `daemonService`, or `loginItemService`. Defaults to `mainAppService`. Only available on macOS 13 and up. See [app.setLoginItemSettings](app.md#appsetloginitemsettingssettings-macos-windows) for more information about each type.
   * `serviceName` string (optional) _macOS_ - The name of the service. Required if `type` is non-default. Only available on macOS 13 and up.
   * `path` string (optional) _Windows_ - The executable path to compare against. Defaults to `process.execPath`.
   * `args` string[] (optional) _Windows_ - The command-line arguments to compare against. Defaults to an empty array.
@@ -1330,13 +1332,13 @@ Returns `Object`:
 * `wasOpenedAtLogin` boolean _macOS_ - `true` if the app was opened at login automatically.
 * `wasOpenedAsHidden` boolean _macOS_ _Deprecated_ - `true` if the app was opened as a hidden login item. This indicates that the app should not open any windows at startup. This setting is not available on [MAS builds][mas-builds] or on macOS 13 and up.
 * `restoreState` boolean _macOS_ _Deprecated_ - `true` if the app was opened as a login item that should restore the state from the previous session. This indicates that the app should restore the windows that were open the last time the app was closed. This setting is not available on [MAS builds][mas-builds] or on macOS 13 and up.
-* `status` string _macOS_ - can be one of `not-registered`, `enabled`, `requires-approval`, or `not-found`.
+* `status` string _macOS_ - can be `not-registered`, `enabled`, `requires-approval`, or `not-found`.
 * `executableWillLaunchAtLogin` boolean _Windows_ - `true` if app is set to open at login and its run key is not deactivated. This differs from `openAtLogin` as it ignores the `args` option, this property will be true if the given executable would be launched at login with **any** arguments.
 * `launchItems` Object[] _Windows_
   * `name` string _Windows_ - name value of a registry entry.
   * `path` string _Windows_ - The executable to an app that corresponds to a registry entry.
   * `args` string[] _Windows_ - the command-line arguments to pass to the executable.
-  * `scope` string _Windows_ - one of `user` or `machine`. Indicates whether the registry entry is under `HKEY_CURRENT USER` or `HKEY_LOCAL_MACHINE`.
+  * `scope` string _Windows_ - can be `user` or `machine`. Indicates whether the registry entry is under `HKEY_CURRENT USER` or `HKEY_LOCAL_MACHINE`.
   * `enabled` boolean _Windows_ - `true` if the app registry key is startup approved and therefore shows as `enabled` in Task Manager and Windows settings.
 
 ### `app.setLoginItemSettings(settings)` _macOS_ _Windows_

docs/api/auto-updater.md

@@ -32,9 +32,19 @@ update process. Apps that need to disable ATS can add the
 
 ### Windows
 
-On Windows, you have to install your app into a user's machine before you can
-use the `autoUpdater`, so it is recommended that you use
-[electron-winstaller][installer-lib] or [Electron Forge's Squirrel.Windows maker][electron-forge-lib] to generate a Windows installer.
+On Windows, the `autoUpdater` module automatically selects the appropriate update mechanism
+based on how your app is packaged:
+
+* **MSIX packages**: If your app is running as an MSIX package (created with [electron-windows-msix][msix-lib] and detected via [`process.windowsStore`](process.md#processwindowsstore-readonly)),
+  the module uses the MSIX updater, which supports direct MSIX file links and JSON update feeds.
+* **Squirrel.Windows**: For apps installed via traditional installers (created with
+  [electron-winstaller][installer-lib] or [Electron Forge's Squirrel.Windows maker][electron-forge-lib]),
+  the module uses Squirrel.Windows for updates.
+
+You don't need to configure which updater to use; Electron automatically detects the packaging
+format and uses the appropriate one.
+
+#### Squirrel.Windows
 
 Apps built with Squirrel.Windows will trigger [custom launch events](https://github.com/Squirrel/Squirrel.Windows/blob/51f5e2cb01add79280a53d51e8d0cfa20f8c9f9f/docs/using/custom-squirrel-events-non-cs.md#application-startup-commands)
 that must be handled by your Electron application to ensure proper setup and teardown.
@@ -55,6 +65,14 @@ The installer generated with Squirrel.Windows will create a shortcut icon with a
 same ID for your app with `app.setAppUserModelId` API, otherwise Windows will
 not be able to pin your app properly in task bar.
 
+#### MSIX Packages
+
+When your app is packaged as an MSIX, the `autoUpdater` module provides additional
+functionality:
+
+* Use the `allowAnyVersion` option in `setFeedURL()` to allow updates to older versions (downgrades)
+* Support for direct MSIX file links or JSON update feeds (similar to Squirrel.Mac format)
+
 ## Events
 
 The `autoUpdater` object emits the following events:
@@ -92,7 +110,7 @@ Returns:
 
 Emitted when an update has been downloaded.
 
-On Windows only `releaseName` is available.
+With Squirrel.Windows only `releaseName` is available.
 
 > [!NOTE]
 > It is not strictly necessary to handle this event. A successfully
@@ -111,10 +129,12 @@ The `autoUpdater` object has the following methods:
 ### `autoUpdater.setFeedURL(options)`
 
 * `options` Object
-  * `url` string
+  * `url` string - The update server URL. For _Windows_ MSIX, this can be either a direct link to an MSIX file (e.g., `https://example.com/update.msix`) or a JSON endpoint that returns update information (see the [Squirrel.Mac][squirrel-mac] README for more information).
   * `headers` Record\<string, string\> (optional) _macOS_ - HTTP request headers.
   * `serverType` string (optional) _macOS_ - Can be `json` or `default`, see the [Squirrel.Mac][squirrel-mac]
     README for more information.
+  * `allowAnyVersion` boolean (optional) _Windows_ - If `true`, allows downgrades to older versions for MSIX packages.
+    Defaults to `false`.
 
 Sets the `url` and initialize the auto updater.
 
@@ -151,3 +171,4 @@ closed.
 [electron-forge-lib]: https://www.electronforge.io/config/makers/squirrel.windows
 [app-user-model-id]: https://learn.microsoft.com/en-us/windows/win32/shell/appids
 [event-emitter]: https://nodejs.org/api/events.html#events_class_eventemitter
+[msix-lib]:  https://github.com/electron-userland/electron-windows-msix

docs/api/base-window.md

@@ -351,7 +351,11 @@ Emitted when the window has closed a sheet.
 
 #### Event: 'new-window-for-tab' _macOS_
 
-Emitted when the native new tab button is clicked.
+Emitted when the user clicks the native macOS new tab button. The new
+tab button is only visible if the current `BrowserWindow` has a
+`tabbingIdentifier`.
+
+You must create a window in this handler in order for macOS tabbing to work as expected.
 
 #### Event: 'system-context-menu' _Windows_ _Linux_
 
@@ -756,6 +760,9 @@ Returns [`Rectangle`](structures/rectangle.md) - The `bounds` of the window as `
 > [!NOTE]
 > On macOS, the y-coordinate value returned will be at minimum the [Tray](tray.md) height. For example, calling `win.setBounds({ x: 25, y: 20, width: 800, height: 600 })` with a tray height of 38 means that `win.getBounds()` will return `{ x: 25, y: 38, width: 800, height: 600 }`.
 
+> [!NOTE]
+> On Wayland, this method will return `{ x: 0, y: 0, ... }` as introspecting or programmatically changing the global window coordinates is prohibited.
+
 #### `win.getBackgroundColor()`
 
 Returns `string` - Gets the background color of the window in Hex (`#RRGGBB`) format.
@@ -969,6 +976,9 @@ Moves window to `x` and `y`.
 
 Returns `Integer[]` - Contains the window's current position.
 
+> [!NOTE]
+> On Wayland, this method will return `[0, 0]` as introspecting or programmatically changing the global window coordinates is prohibited.
+
 #### `win.setTitle(title)`
 
 * `title` string

docs/api/browser-window.md

@@ -435,7 +435,11 @@ Emitted when the window has closed a sheet.
 
 #### Event: 'new-window-for-tab' _macOS_
 
-Emitted when the native new tab button is clicked.
+Emitted when the user clicks the native macOS new tab button. The new
+tab button is only visible if the current `BrowserWindow` has a
+`tabbingIdentifier`.
+
+You must create a window in this handler in order for macOS tabbing to work as expected.
 
 #### Event: 'system-context-menu' _Windows_ _Linux_
 
@@ -862,6 +866,9 @@ Returns [`Rectangle`](structures/rectangle.md) - The `bounds` of the window as `
 > [!NOTE]
 > On macOS, the y-coordinate value returned will be at minimum the [Tray](tray.md) height. For example, calling `win.setBounds({ x: 25, y: 20, width: 800, height: 600 })` with a tray height of 38 means that `win.getBounds()` will return `{ x: 25, y: 38, width: 800, height: 600 }`.
 
+> [!NOTE]
+> On Wayland, this method will return `{ x: 0, y: 0, ... }` as introspecting or programmatically changing the global window coordinates is prohibited.
+
 #### `win.getBackgroundColor()`
 
 Returns `string` - Gets the background color of the window in Hex (`#RRGGBB`) format.
@@ -1087,6 +1094,9 @@ Not supported on Wayland (Linux).
 
 Returns `Integer[]` - Contains the window's current position.
 
+> [!NOTE]
+> On Wayland, this method will return `[0, 0]` as introspecting or programmatically changing the global window coordinates is prohibited.
+
 #### `win.setTitle(title)`
 
 * `title` string

docs/api/command-line-switches.md

@@ -361,6 +361,13 @@ Keep in mind that standalone switches can sometimes be split into individual fea
 
 Finally, you'll need to ensure that the version of Chromium in Electron matches the version of the browser you're using to cross-reference the switches.
 
+### Chromium features relevant to Electron apps
+
+* `AlwaysLogLOAFURL`: enables script attribution for
+  [`long-animation-frame`](https://developer.mozilla.org/en-US/docs/Web/API/Performance_API/Long_animation_frame_timing)
+  `PerformanceObserver` events for non-http(s), non-data, non-blob URLs (such as `file:` or custom
+  protocol URLs).
+
 [app]: app.md
 [append-switch]: command-line.md#commandlineappendswitchswitch-value
 [debugging-main-process]: ../tutorial/debugging-main-process.md

docs/api/desktop-capturer.md

@@ -94,18 +94,45 @@ The `desktopCapturer` module has the following methods:
 Returns `Promise<DesktopCapturerSource[]>` - Resolves with an array of [`DesktopCapturerSource`](structures/desktop-capturer-source.md) objects, each `DesktopCapturerSource` represents a screen or an individual window that can be captured.
 
 > [!NOTE]
-> Capturing the screen contents requires user consent on macOS 10.15 Catalina or higher,
-> which can detected by [`systemPreferences.getMediaAccessStatus`][].
+
+> * Capturing audio requires `NSAudioCaptureUsageDescription` Info.plist key on macOS 14.2 Sonoma and higher - [read more](#macos-versions-142-or-higher).
+> * Capturing the screen contents requires user consent on macOS 10.15 Catalina or higher, which can detected by [`systemPreferences.getMediaAccessStatus`][].
 
 [`navigator.mediaDevices.getUserMedia`]: https://developer.mozilla.org/en/docs/Web/API/MediaDevices/getUserMedia
 [`systemPreferences.getMediaAccessStatus`]: system-preferences.md#systempreferencesgetmediaaccessstatusmediatype-windows-macos
 
 ## Caveats
 
+### Linux
+
 `desktopCapturer.getSources(options)` only returns a single source on Linux when using Pipewire.
 
 PipeWire supports a single capture for both screens and windows. If you request the window and screen type, the selected source will be returned as a window capture.
 
-`navigator.mediaDevices.getUserMedia` does not work on macOS for audio capture due to a fundamental limitation whereby apps that want to access the system's audio require a [signed kernel extension](https://developer.apple.com/library/archive/documentation/Security/Conceptual/System_Integrity_Protection_Guide/KernelExtensions/KernelExtensions.html). Chromium, and by extension Electron, does not provide this.
+---
 
-It is possible to circumvent this limitation by capturing system audio with another macOS app like Soundflower and passing it through a virtual audio input device. This virtual device can then be queried with `navigator.mediaDevices.getUserMedia`.
+### MacOS versions 14.2 or higher
+
+`NSAudioCaptureUsageDescription` Info.plist key must be added in-order for audio to be captured by `desktopCapturer`. If instead you are running electron from another program like a terminal or IDE then that parent program must contain the Info.plist key.
+
+This is in order to facillitate use of Apple's new [CoreAudio Tap API](https://developer.apple.com/documentation/CoreAudio/capturing-system-audio-with-core-audio-taps#Configure-the-sample-code-project) by Chromium.
+
+> [!WARNING]
+> Failure of `desktopCapturer` to start an audio stream due to `NSAudioCaptureUsageDescription` permission not present will still create a dead audio stream however no warnings or errors are displayed.
+
+As of electron `v39.0.0-beta.4` Chromium [made Apple's new `CoreAudio Tap API` the default](https://source.chromium.org/chromium/chromium/src/+/ad17e8f8b93d5f34891b06085d373a668918255e) for desktop audio capture. There is no fallback to the older `Screen & System Audio Recording` permissions system even if [CoreAudio Tap API](https://developer.apple.com/documentation/CoreAudio/capturing-system-audio-with-core-audio-taps) stream creation fails.
+
+If you need to continue using `Screen & System Audio Recording` permissions for `desktopCapturer` on macOS versions 14.2 and later, you can apply a chromium feature flag to force use of that older permissions system:
+
+```js
+// main.js (right beneath your require/import statments)
+app.commandLine.appendSwitch('disable-features', 'MacCatapLoopbackAudioForScreenShare')
+```
+
+---
+
+### MacOS versions 12.7.6 or lower
+
+`navigator.mediaDevices.getUserMedia` does not work on macOS versions 12.7.6 and prior for audio capture due to a fundamental limitation whereby apps that want to access the system's audio require a [signed kernel extension](https://developer.apple.com/library/archive/documentation/Security/Conceptual/System_Integrity_Protection_Guide/KernelExtensions/KernelExtensions.html). Chromium, and by extension Electron, does not provide this. Only in macOS 13 and onwards does Apple provide APIs to capture desktop audio without the need for a signed kernel extension.
+
+It is possible to circumvent this limitation by capturing system audio with another macOS app like [BlackHole](https://existential.audio/blackhole/) or [Soundflower](https://rogueamoeba.com/freebies/soundflower/) and passing it through a virtual audio input device. This virtual device can then be queried with `navigator.mediaDevices.getUserMedia`.

docs/api/environment-variables.md

@@ -159,6 +159,22 @@ Notification activated (com.github.Electron:notification:EAF7B87C-A113-43D7-8E76
 Notification replied to (com.github.Electron:notification:EAF7B87C-A113-43D7-8E76-F88EC9D73D44)
 ```
 
+### `ELECTRON_DEBUG_MSIX_UPDATER`
+
+Adds extra logs to MSIX updater operations on Windows to aid in debugging. Extra logging will be displayed when MSIX update operations are initiated, including package updates, package registration, and restart registration. This helps diagnose issues with MSIX package updates and deployments.
+
+Sample output:
+
+```sh
+UpdateMsix called with URI: https://example.com/app.msix
+DoUpdateMsix: Starting
+Calling AddPackageByUriAsync... URI: https://example.com/app.msix
+Update options - deferRegistration: true, developerMode: false, forceShutdown: false, forceTargetShutdown: false, forceUpdateFromAnyVersion: false
+Waiting for deployment...
+Deployment finished.
+MSIX Deployment completed.
+```
+
 ### `ELECTRON_LOG_ASAR_READS`
 
 When Electron reads from an ASAR file, log the read offset and file path to

docs/api/menu-item.md

@@ -107,7 +107,7 @@ A `string` (optional) indicating the item's role, if set. Can be `undo`, `redo`,
 
 #### `menuItem.accelerator`
 
-An `Accelerator` (optional) indicating the item's accelerator, if set.
+An `Accelerator | null` indicating the item's accelerator, if set.
 
 #### `menuItem.userAccelerator` _Readonly_ _macOS_
 

docs/api/process.md

@@ -71,7 +71,7 @@ will disable the support for `asar` archives in Node's built-in modules.
 
 ### `process.noDeprecation`
 
-A `boolean` that controls whether or not deprecation warnings are printed to `stderr`.
+A `boolean` (optional) that controls whether or not deprecation warnings are printed to `stderr`.
 Setting this to `true` will silence deprecation warnings. This property is used
 instead of the `--no-deprecation` command line flag.
 
@@ -128,8 +128,8 @@ A `string` representing Electron's version string.
 
 ### `process.windowsStore` _Readonly_
 
-A `boolean`. If the app is running as a Windows Store app (appx), this property is `true`,
-for otherwise it is `undefined`.
+A `boolean`. If the app is running as an MSIX package (including AppX for Windows Store),
+this property is `true`, otherwise it is `undefined`.
 
 ### `process.contextId` _Readonly_
 

docs/api/shell.md

@@ -58,6 +58,10 @@ Rejects if there was an error while deleting the requested item.
 This moves a path to the OS-specific trash location (Trash on macOS, Recycle
 Bin on Windows, and a desktop-environment-specific location on Linux).
 
+The path must use the default path separator for the platform (backslash on
+Windows). Use `path.resolve()` from the `node:path` module to ensure correct
+handling on all filesystems.
+
 ### `shell.beep()`
 
 Play the beep sound.

docs/api/structures/base-window-options.md

@@ -102,9 +102,9 @@
 * `trafficLightPosition` [Point](point.md) (optional) _macOS_ -
   Set a custom position for the traffic light buttons in frameless windows.
 * `roundedCorners` boolean (optional) _macOS_ _Windows_ - Whether frameless window
-  should have rounded corners. Default is `true`. Setting this property
-  to `false` will prevent the window from being fullscreenable on macOS.
-  On Windows versions older than Windows 11 Build 22000 this property has no effect, and frameless windows will not have rounded corners.
+  should have rounded corners. Default is `true`. On Windows versions older than
+  Windows 11 Build 22000 this property has no effect, and frameless windows will
+  not have rounded corners.
 * `thickFrame` boolean (optional) _Windows_ - Use `WS_THICKFRAME` style for
   frameless windows on Windows, which adds the standard window frame. Setting it
   to `false` will remove window shadow and window animations, and disable window

docs/api/utility-process.md

@@ -36,6 +36,12 @@ Process: [Main](../glossary.md#main-process)<br />
     `com.apple.security.cs.allow-unsigned-executable-memory` entitlements. This will allow the utility process
     to load unsigned libraries. Unless you specifically need this capability, it is best to leave this disabled.
     Default is `false`.
+  * `disclaim` boolean (optional) _macOS_ - With this flag, the utility process will disclaim
+    responsibility for the child process. This causes the operating system to consider the child
+    process as a separate entity for purposes of security policies like Transparency, Consent, and
+    Control (TCC). When responsibility is disclaimed, the parent process will not be attributed
+    for any TCC requests initiated by the child process. This is useful when launching processes
+    that run third-party or otherwise untrusted code. Default is `false`.
   * `respondToAuthRequestsFromMainProcess` boolean (optional) - With this flag, all HTTP 401 and 407 network
     requests created via the [net module](net.md) will allow responding to them via the
     [`app#login`](app.md#event-login) event in the main process instead of the default

docs/api/web-contents.md

@@ -2410,7 +2410,8 @@ A [`NavigationHistory`](navigation-history.md) used by this webContents.
 
 #### `contents.hostWebContents` _Readonly_
 
-A [`WebContents`](web-contents.md) instance that might own this `WebContents`.
+A `WebContents | null` property that represents a [`WebContents`](web-contents.md)
+instance that might own this `WebContents`.
 
 #### `contents.devToolsWebContents` _Readonly_
 

docs/breaking-changes.md

@@ -37,6 +37,22 @@ webContents.setWindowOpenHandler((details) => {
 })
 ```
 
+### Behavior Changed: `NSAudioCaptureUsageDescription` should be included in your app's Info.plist file to use `desktopCapturer` (🍏 macOS ≥14.2)
+
+Per [Chromium update](https://source.chromium.org/chromium/chromium/src/+/ad17e8f8b93d5f34891b06085d373a668918255e) which enables Apple's newer [CoreAudio Tap API](https://developer.apple.com/documentation/CoreAudio/capturing-system-audio-with-core-audio-taps#Configure-the-sample-code-project) by default, you now must have `NSAudioCaptureUsageDescription` defined in your `Info.plist` to use `desktopCapturer`.
+
+Electron's `desktopCapturer` will create a dead audio stream if the new permission is absent however no errors or warnings will occur. This is partially a side-effect of Chromium not falling back to the older `Screen & System Audio Recording` permissions system if the new system fails.
+
+To restore previous behavior:
+
+```js
+// main.js (right beneath your require/import statments)
+app.commandLine.appendSwitch(
+  'disable-features',
+  'MacCatapLoopbackAudioForScreenShare'
+)
+```
+
 ### Behavior Changed: shared texture OSR `paint` event data structure
 
 When using shared texture offscreen rendering feature, the `paint` event now emits a more structured object.

docs/tutorial/asar-archives.md

@@ -6,7 +6,7 @@ hide_title: false
 ---
 
 After creating an [application distribution](application-distribution.md), the
-app's source code are usually bundled into an [ASAR archive](https://github.com/electron/asar),
+app's source code is usually bundled into an [ASAR archive](https://github.com/electron/asar),
 which is a simple extensive archive format designed for Electron apps. By bundling the app
 we can mitigate issues around long path names on Windows, speed up `require` and conceal your source
 code from cursory inspection.
@@ -134,7 +134,7 @@ underlying system calls, Electron will extract the needed file into a
 temporary file and pass the path of the temporary file to the APIs to make them
 work. This adds a little overhead for those APIs.
 
-APIs that requires extra unpacking are:
+APIs that require extra unpacking are:
 
 * `child_process.execFile`
 * `child_process.execFileSync`

docs/tutorial/asar-integrity.md

@@ -24,7 +24,7 @@ All versions of `@electron/asar` support ASAR integrity.
 ## How it works
 
 Each ASAR archive contains a JSON string header. The header format includes an `integrity` object
-that contain a hex encoded hash of the entire archive as well as an array of hex encoded hashes for each
+that contains a hex encoded hash of the entire archive as well as an array of hex encoded hashes for each
 block of `blockSize` bytes.
 
 ```json

docs/tutorial/automated-testing.md

@@ -203,7 +203,7 @@ test('launch app', async () => {
 })
 ```
 
-After that, you will access to an instance of Playwright's `ElectronApp` class. This
+After that, you will have access to an instance of Playwright's `ElectronApp` class. This
 is a powerful class that has access to main process modules for example:
 
 ```js {5-10} @ts-nocheck
@@ -237,7 +237,7 @@ test('save screenshot', async () => {
 })
 ```
 
-Putting all this together using the Playwright test-runner, let's create a `example.spec.js`
+Putting all this together using the Playwright test-runner, let's create an `example.spec.js`
 test file with a single test and assertion:
 
 ```js title='example.spec.js' @ts-nocheck
@@ -377,7 +377,7 @@ class TestDriver {
 module.exports = { TestDriver }
 ```
 
-In your app code, can then write a simple handler to receive RPC calls:
+In your app code, you can then write a simple handler to receive RPC calls:
 
 ```js title='main.js'
 const METHODS = {

docs/tutorial/code-signing.md

@@ -17,7 +17,7 @@ run them, users need to go through multiple advanced and manual steps.
 
 If you are building an Electron app that you intend to package and distribute,
 it should be code signed. The Electron ecosystem tooling makes codesigning your
-apps straightforward - this documentation explains how sign your apps on both
+apps straightforward - this documentation explains how to sign your apps on both
 Windows and macOS.
 
 ## Signing & notarizing macOS builds
@@ -210,7 +210,7 @@ const msiCreator = new MSICreator({
 const supportBinaries = await msiCreator.create()
 
 // 🆕 Step 2a: optionally sign support binaries if you
-// sign you binaries as part of of your packaging script
+// sign your binaries as part of your packaging script
 for (const binary of supportBinaries) {
   // Binaries are the new stub executable and optionally
   // the Squirrel auto updater.

docs/tutorial/custom-title-bar.md

@@ -110,7 +110,7 @@ const win = new BrowserWindow({
 #### Show and hide the traffic lights programmatically _macOS_
 
 You can also show and hide the traffic lights programmatically from the main process.
-The `win.setWindowButtonVisibility` forces traffic lights to be show or hidden depending
+The `win.setWindowButtonVisibility` forces traffic lights to be shown or hidden depending
 on the value of its boolean parameter.
 
 ```js title='main.js'

docs/tutorial/custom-window-interactions.md

@@ -5,12 +5,12 @@
 By default, windows are dragged using the title bar provided by the OS chrome. Apps
 that remove the default title bar need to use the `app-region` CSS property to define
 specific areas that can be used to drag the window. Setting `app-region: drag` marks
-a rectagular area as draggable.
+a rectangular area as draggable.
 
 It is important to note that draggable areas ignore all pointer events. For example,
 a button element that overlaps a draggable region will not emit mouse clicks or mouse
 enter/exit events within that overlapping area. Setting `app-region: no-drag` reenables
-pointer events by excluding a rectagular area from a draggable region.
+pointer events by excluding a rectangular area from a draggable region.
 
 To make the whole window draggable, you can add `app-region: drag` as
 `body`'s style:

docs/tutorial/dark-mode.md

@@ -29,7 +29,7 @@ be updated accordingly.
 In macOS 10.14 Mojave, Apple introduced a new [system-wide dark mode][system-wide-dark-mode]
 for all macOS computers. If your Electron app has a dark mode, you can make it
 follow the system-wide dark mode setting using
-[the `nativeTheme` api](../api/native-theme.md).
+[the `nativeTheme` API](../api/native-theme.md).
 
 In macOS 10.15 Catalina, Apple introduced a new "automatic" dark mode option
 for all macOS computers. In order for the `nativeTheme.shouldUseDarkColors` and

docs/tutorial/ipc.md

@@ -171,7 +171,7 @@ sections.
 
 In the main process, we'll be creating a `handleFileOpen()` function that calls
 `dialog.showOpenDialog` and returns the value of the file path selected by the user. This function
-is used as a callback whenever an `ipcRender.invoke` message is sent through the `dialog:openFile`
+is used as a callback whenever an `ipcRenderer.invoke` message is sent through the `dialog:openFile`
 channel from the renderer process. The return value is then returned as a Promise to the original
 `invoke` call.
 
@@ -446,7 +446,7 @@ After loading the preload script, your renderer process should have access to th
 We don't directly expose the whole `ipcRenderer.on` API for [security reasons][]. Make sure to
 limit the renderer's access to Electron APIs as much as possible.
 Also don't just pass the callback to `ipcRenderer.on` as this will leak `ipcRenderer` via `event.sender`.
-Use a custom handler that invoke the `callback` only with the desired arguments.
+Use a custom handler that invokes the `callback` only with the desired arguments.
 :::
 
 :::info

docs/tutorial/keyboard-shortcuts.md

@@ -10,7 +10,7 @@ hide_title: false
 ## Accelerators
 
 Accelerators are strings that can be used to represent keyboard shortcuts throughout your Electron.
-These strings can contain multiple modifiers keys and a single key code joined by the `+` character.
+These strings can contain multiple modifier keys and a single key code joined by the `+` character.
 
 > [!NOTE]
 > Accelerators are **case-insensitive**.

docs/tutorial/launch-app-from-url-in-another-app.md

@@ -62,9 +62,9 @@ const createWindow = () => {
 }
 ```
 
-In this next step, we will create our  `BrowserWindow` and tell our application how to handle an event in which an external protocol is clicked.
+In this next step, we will create our `BrowserWindow` and tell our application how to handle an event in which an external protocol is clicked.
 
-This code will be different in Windows and Linux compared to MacOS. This is due to both platforms emitting the `second-instance` event rather than the `open-url` event and Windows requiring additional code in order to open the contents of the protocol link within the same Electron instance. Read more about this [here](../api/app.md#apprequestsingleinstancelockadditionaldata).
+This code will be different in Windows and Linux compared to macOS. This is due to both platforms emitting the `second-instance` event rather than the `open-url` event and Windows requiring additional code in order to open the contents of the protocol link within the same Electron instance. Read more about this [here](../api/app.md#apprequestsingleinstancelockadditionaldata).
 
 #### Windows and Linux code:
 
@@ -91,7 +91,7 @@ if (!gotTheLock) {
 }
 ```
 
-#### MacOS code:
+#### macOS code:
 
 ```js @ts-type={createWindow:()=>void}
 // This method will be called when Electron has finished

docs/tutorial/mac-app-store-submission-guide.md

@@ -65,7 +65,7 @@ The full list of certificate types can be found
 Apps signed with "Apple Development" and "Apple Distribution" certificates can
 only run under [App Sandbox][app-sandboxing], so they must use the MAS build of
 Electron. However, the "Developer ID Application" certificate does not have this
-restrictions, so apps signed with it can use either the normal build or the MAS
+restriction, so apps signed with it can use either the normal build or the MAS
 build of Electron.
 
 #### Legacy certificate names
@@ -208,7 +208,7 @@ signAsync({
 After signing the app with the "Apple Distribution" certificate, you can
 continue to submit it to Mac App Store.
 
-However, this guide do not ensure your app will be approved by Apple; you
+However, this guide does not ensure your app will be approved by Apple; you
 still need to read Apple's [Submitting Your App][submitting-your-app] guide on
 how to meet the Mac App Store requirements.
 

docs/tutorial/macos-dock.md

@@ -25,7 +25,7 @@ Electron application, and this property only exists on macOS.
 One of the main uses for your app's Dock icon is to expose additional app menus. The Dock menu is
 triggered by right-clicking or <kbd>Ctrl</kbd>-clicking the app icon. By default, the app's Dock menu
 will come with system-provided window management utilities, including the ability to show all windows,
-hide the app, and switch betweeen different open windows.
+hide the app, and switch between different open windows.
 
 To set an app-defined custom Dock menu, pass any [Menu](../api/menu.md) instance into the
 [`dock.setMenu`](../api/dock.md#docksetmenumenu-macos) API.

docs/tutorial/menus.md

@@ -200,7 +200,7 @@ macOS has a number of platform-specific menu roles available. Many of these map
 
 * `recentDocuments` - The submenu is an "Open Recent" menu.
 * `clearRecentDocuments` - Map to the [`clearRecentDocuments`](https://developer.apple.com/documentation/appkit/nsdocumentcontroller/clearrecentdocuments(_:)) action.
-* `shareMenu` - The submenu is [share menu][ShareMenu]. The `sharingItem` property must also be set to indicate the item to share.
+* `shareMenu` - The submenu is [share menu](../api/share-menu.md). The `sharingItem` property must also be set to indicate the item to share.
 
 > [!IMPORTANT]
 > When specifying a `role` on macOS, `label` and `accelerator` are the only

docs/tutorial/native-code-and-electron-cpp-linux.md

@@ -1339,7 +1339,7 @@ For developers wanting to learn more, you can refer to the [official N-API docum
 
 ### Putting `cpp_addon.cc` together
 
-We've now finished the bridge part our addon - that is, the code that's most concerned with being the bridge between your JavaScript and C++ code (and by contrast, less so actually interacting with the operating system or GTK). After adding all the sections above, your `src/cpp_addon.cc` should look like this:
+We've now finished the bridge part of our addon - that is, the code that's most concerned with being the bridge between your JavaScript and C++ code (and by contrast, less so actually interacting with the operating system or GTK). After adding all the sections above, your `src/cpp_addon.cc` should look like this:
 
 ```cpp title='src/cpp_addon.cc'
 #include <napi.h>

docs/tutorial/native-code-and-electron-cpp-win32.md

@@ -4,13 +4,13 @@ This tutorial builds on the [general introduction to Native Code and Electron](.
 
 Specifically, we'll be integrating with two commonly used native Windows libraries:
 
-* `comctl32.lib`, which contains common controls and user interface components. It provides various UI elements like buttons, scrollbars, toolbars, status bars, progress bars, and tree views. As far as GUI development on Windows goes, this library is very low-level and basic - more modern frameworks like WinUI or WPF are advanced and alternatives but require a lot more C++ and Windows version considerations than are useful for this tutorial. This way, we can avoid the many perils of building native interfaces for multiple Windows versions!
+* `comctl32.lib`, which contains common controls and user interface components. It provides various UI elements like buttons, scrollbars, toolbars, status bars, progress bars, and tree views. As far as GUI development on Windows goes, this library is very low-level and basic - more modern frameworks like WinUI or WPF are more advanced alternatives but require a lot more C++ and Windows version considerations than are useful for this tutorial. This way, we can avoid the many perils of building native interfaces for multiple Windows versions!
 * `shcore.lib`, a library that provides high-DPI awareness functionality and other Shell-related features around managing displays and UI elements.
 
 This tutorial will be most useful to those who already have some familiarity with native C++ GUI development on Windows. You should have experience with basic window classes and procedures, like `WNDCLASSEXW` and `WindowProc` functions. You should also be familiar with the Windows message loop, which is the heart of any native application - our code will be using `GetMessage`, `TranslateMessage`, and `DispatchMessage` to handle messages. Lastly, we'll be using (but not explaining) standard Win32 controls like `WC_EDITW` or `WC_BUTTONW`.
 
 > [!NOTE]
-> If you're not familiar with C++ GUI development on Windows, we recommend Microsoft's excellent documentation and guides, particular for beginners. "[Get Started with Win32 and C++](https://learn.microsoft.com/en-us/windows/win32/learnwin32/learn-to-program-for-windows)" is a great introduction.
+> If you're not familiar with C++ GUI development on Windows, we recommend Microsoft's excellent documentation and guides, particularly for beginners. "[Get Started with Win32 and C++](https://learn.microsoft.com/en-us/windows/win32/learnwin32/learn-to-program-for-windows)" is a great introduction.
 
 ## Requirements
 
@@ -1333,7 +1333,7 @@ npm run build
 
 ## Conclusion
 
-You've now built a complete native Node.js addon for Windows using C++ and the Win32 API. Some of things we've done here are:
+You've now built a complete native Node.js addon for Windows using C++ and the Win32 API. Some of the things we've done here are:
 
 1. Creating a native Windows GUI from C++
 2. Implementing a Todo list application with Add, Edit, and Delete functionality

docs/tutorial/native-code-and-electron-swift-macos.md

@@ -1167,7 +1167,7 @@ The approach demonstrated here allows you to:
 * Setting up bidirectional communication using callbacks and events
 * Configuring a custom build process to compile Swift code
 
-For more information on developing with Swift and Swift, refer to Apple's developer documentation:
+For more information on developing with Swift and SwiftUI, refer to Apple's developer documentation:
 
 * [Swift Programming Language](https://developer.apple.com/swift/)
 * [SwiftUI Framework](https://developer.apple.com/documentation/swiftui)

docs/tutorial/offscreen-rendering.md

@@ -36,7 +36,7 @@ setting.
     This is an advanced feature requiring a native node module to work with your own code.
     The frames are directly copied in GPU textures, thus this mode is very fast because
     there's no CPU-GPU memory copies overhead, and you can directly import the shared
-    texture to your own rendering program. You can read more details at
+    texture to your own rendering program. You can read more details
     [here](https://github.com/electron/electron/blob/main/shell/browser/osr/README.md).
 
 2. Use CPU shared memory bitmap

docs/tutorial/performance.md

@@ -294,7 +294,7 @@ particularly useful if users complain about your app sometimes "stuttering".
 
 Generally speaking, all advice for building performant web apps for modern
 browsers apply to Electron's renderers, too. The two primary tools at your
-disposal  are currently `requestIdleCallback()` for small operations and
+disposal are currently `requestIdleCallback()` for small operations and
 `Web Workers` for long-running operations.
 
 _`requestIdleCallback()`_ allows developers to queue up a function to be
@@ -360,7 +360,7 @@ turning into a desktop application. As web developers, we are used to loading
 resources from a variety of content delivery networks. Now that you are
 shipping a proper desktop application, attempt to "cut the cord" where possible
 and avoid letting your users wait for resources that never change and could
-easily be included  in your app.
+easily be included in your app.
 
 A typical example is Google Fonts. Many developers make use of Google's
 impressive collection of free fonts, which comes with a content delivery

docs/tutorial/process-model.md

@@ -113,7 +113,7 @@ For a full list of Electron's main process modules, check out our API documentat
 
 Each Electron app spawns a separate renderer process for each open `BrowserWindow`
 (and each web embed). As its name implies, a renderer is responsible for
-_rendering_ web content. For all intents and purposes, code ran in renderer processes
+_rendering_ web content. For all intents and purposes, code run in renderer processes
 should behave according to web standards (insofar as Chromium does, at least).
 
 Therefore, all user interfaces and app functionality within a single browser

docs/tutorial/security.md

@@ -767,7 +767,7 @@ ipcMain.handle('get-secrets', (e) => {
 })
 
 function validateSender (frame) {
-  // Value the host of the URL using an actual URL parser and an allowlist
+  // Validate the host of the URL using an actual URL parser and an allowlist
   if ((new URL(frame.url)).host === 'electronjs.org') return true
   return false
 }

docs/tutorial/testing-on-headless-ci.md

@@ -2,8 +2,8 @@
 
 Being based on Chromium, Electron requires a display driver to function.
 If Chromium can't find a display driver, Electron will fail to launch -
-and therefore not executing any of your tests, regardless of how you are running
-them. Testing Electron-based apps on Travis, CircleCI, Jenkins or similar Systems
+and therefore not execute any of your tests, regardless of how you are running
+them. Testing Electron-based apps on Travis, CircleCI, Jenkins or similar systems
 requires therefore a little bit of configuration. In essence, we need to use
 a virtual display driver.
 

docs/tutorial/updates.md

@@ -44,7 +44,7 @@ following JSON format:
       "updateTo": {
         "version": "1.2.1",
         "pub_date": "2023-09-18T12:29:53+01:00",
-        "notes": "Theses are some release notes innit",
+        "notes": "These are some release notes innit",
         "name": "1.2.1",
         "url": "https://mycompany.example.com/myapp/releases/myrelease"
       }
@@ -54,7 +54,7 @@ following JSON format:
       "updateTo": {
         "version": "1.2.3",
         "pub_date": "2024-09-18T12:29:53+01:00",
-        "notes": "Theses are some more release notes innit",
+        "notes": "These are some more release notes innit",
         "name": "1.2.3",
         "url": "https://mycompany.example.com/myapp/releases/myrelease3"
       }
@@ -307,7 +307,7 @@ app update. All other properties in the object are optional.
 {
     "url": "https://your-static.storage/your-app-1.2.3-darwin.zip",
     "name": "1.2.3",
-    "notes": "Theses are some release notes innit",
+    "notes": "These are some release notes innit",
     "pub_date": "2024-09-18T12:29:53+01:00"
 }
 ```

docs/tutorial/using-native-node-modules.md

@@ -149,7 +149,7 @@ for an example delay-load hook if you're implementing your own.
 native Node modules with prebuilt binaries for multiple versions of Node
 and Electron.
 
-If the `prebuild`-powered module provide binaries for the usage in Electron,
+If the `prebuild`-powered module provides binaries for the usage in Electron,
 make sure to omit `--build-from-source` and the `npm_config_build_from_source`
 environment variable in order to take full advantage of the prebuilt binaries.
 

docs/tutorial/windows-arm.md

@@ -38,7 +38,7 @@ To test your app, use a Windows on Arm device running Windows 10 (version 1903 o
 
 ### Node.js/node-gyp
 
-[Node.js v12.9.0 or later is recommended.](https://nodejs.org/en/) If updating to a new version of Node is  undesirable, you can instead [update npm's copy of node-gyp manually](https://github.com/nodejs/node-gyp/wiki/Updating-npm's-bundled-node-gyp) to version 5.0.2 or later, which contains the required changes to compile native modules for Arm.
+[Node.js v12.9.0 or later is recommended.](https://nodejs.org/en/) If updating to a new version of Node is undesirable, you can instead [update npm's copy of node-gyp manually](https://github.com/nodejs/node-gyp/wiki/Updating-npm's-bundled-node-gyp) to version 5.0.2 or later, which contains the required changes to compile native modules for Arm.
 
 ### Visual Studio 2017
 

docs/tutorial/windows-store-guide.md

@@ -134,7 +134,7 @@ system.
 
 Before running the CLI for the first time, you will have to setup the "Windows Desktop App
 Converter". This will take a few minutes, but don't worry - you only have to do
-this once. Download and Desktop App Converter from [here][app-converter].
+this once. Download the Desktop App Converter from [here][app-converter].
 You will receive two files: `DesktopAppConverter.zip` and `BaseImage-14316.wim`.
 
 1. Unzip `DesktopAppConverter.zip`. From an elevated PowerShell (opened with

filenames.auto.gni

@@ -222,8 +222,10 @@ auto_filenames = {
   browser_bundle_deps = [
     "lib/browser/api/app.ts",
     "lib/browser/api/auto-updater.ts",
+    "lib/browser/api/auto-updater/auto-updater-msix.ts",
     "lib/browser/api/auto-updater/auto-updater-native.ts",
     "lib/browser/api/auto-updater/auto-updater-win.ts",
+    "lib/browser/api/auto-updater/msix-update-win.ts",
     "lib/browser/api/auto-updater/squirrel-update-win.ts",
     "lib/browser/api/base-window.ts",
     "lib/browser/api/browser-view.ts",

filenames.gni

@@ -277,6 +277,8 @@ filenames = {
     "shell/browser/api/electron_api_in_app_purchase.h",
     "shell/browser/api/electron_api_menu.cc",
     "shell/browser/api/electron_api_menu.h",
+    "shell/browser/api/electron_api_msix_updater.cc",
+    "shell/browser/api/electron_api_msix_updater.h",
     "shell/browser/api/electron_api_native_theme.cc",
     "shell/browser/api/electron_api_native_theme.h",
     "shell/browser/api/electron_api_net_log.cc",
@@ -587,6 +589,7 @@ filenames = {
     "shell/common/electron_command_line.cc",
     "shell/common/electron_command_line.h",
     "shell/common/electron_constants.h",
+    "shell/common/electron_paths.cc",
     "shell/common/electron_paths.h",
     "shell/common/gin_converters/accelerator_converter.cc",
     "shell/common/gin_converters/accelerator_converter.h",

lib/browser/api/auto-updater.ts

@@ -1,5 +1,10 @@
 if (process.platform === 'win32') {
-  module.exports = require('./auto-updater/auto-updater-win');
+  // windowsStore indicates whether the app is running as a packaged app (MSIX), even outside of the store
+  if (process.windowsStore) {
+    module.exports = require('./auto-updater/auto-updater-msix');
+  } else {
+    module.exports = require('./auto-updater/auto-updater-win');
+  }
 } else {
   module.exports = require('./auto-updater/auto-updater-native');
 }

lib/browser/api/auto-updater/auto-updater-msix.ts

@@ -0,0 +1,449 @@
+import * as msixUpdate from '@electron/internal/browser/api/auto-updater/msix-update-win';
+
+import { app, net } from 'electron/main';
+
+import { EventEmitter } from 'events';
+
+interface UpdateInfo {
+  ok: boolean; // False if error encountered
+  available?: boolean; // True if the update is available, false if not
+  updateUrl?: string; // The URL of the update
+  releaseNotes?: string; // The release notes of the update
+  releaseName?: string; // The release name of the update
+  releaseDate?: Date; // The release date of the update
+}
+
+interface MSIXPackageInfo {
+  id: string;
+  familyName: string;
+  developmentMode: boolean;
+  version: string;
+  signatureKind: 'developer' | 'enterprise' | 'none' | 'store' | 'system';
+  appInstallerUri?: string;
+}
+
+/**
+ * Options for updating an MSIX package.
+ * Used with `updateMsix()` to control how the package update behaves.
+ *
+ * These options correspond to the Windows.Management.Deployment.AddPackageOptions class properties.
+ *
+ * @see https://learn.microsoft.com/en-us/uwp/api/windows.management.deployment.addpackageoptions?view=winrt-26100
+ */
+export interface UpdateMsixOptions {
+  /**
+   * Gets or sets a value that indicates whether to delay registration of the main package
+   * or dependency packages if the packages are currently in use.
+   *
+   * Corresponds to `AddPackageOptions.DeferRegistrationWhenPackagesAreInUse`
+   *
+   * @default false
+   */
+  deferRegistration?: boolean;
+
+  /**
+   * Gets or sets a value that indicates whether the app is installed in developer mode.
+   * When set, the app is installed in development mode which allows for a more rapid
+   * development cycle. The BlockMap.xml, [Content_Types].xml, and digital signature
+   * files are not required for app installation.
+   *
+   * Corresponds to `AddPackageOptions.DeveloperMode`
+   *
+   * @default false
+   */
+  developerMode?: boolean;
+
+  /**
+   * Gets or sets a value that indicates whether the processes associated with the package
+   * will be shut down forcibly so that registration can continue if the package, or any
+   * package that depends on the package, is currently in use.
+   *
+   * Corresponds to `AddPackageOptions.ForceAppShutdown`
+   *
+   * @default false
+   */
+  forceShutdown?: boolean;
+
+  /**
+   * Gets or sets a value that indicates whether the processes associated with the package
+   * will be shut down forcibly so that registration can continue if the package is
+   * currently in use.
+   *
+   * Corresponds to `AddPackageOptions.ForceTargetAppShutdown`
+   *
+   * @default false
+   */
+  forceTargetShutdown?: boolean;
+
+  /**
+   * Gets or sets a value that indicates whether to force a specific version of a package
+   * to be added, regardless of if a higher version is already added.
+   *
+   * Corresponds to `AddPackageOptions.ForceUpdateFromAnyVersion`
+   *
+   * @default false
+   */
+  forceUpdateFromAnyVersion?: boolean;
+}
+
+/**
+ * Options for registering an MSIX package.
+ * Used with `registerPackage()` to control how the package registration behaves.
+ *
+ * These options correspond to the Windows.Management.Deployment.DeploymentOptions enum.
+ *
+ * @see https://learn.microsoft.com/en-us/uwp/api/windows.management.deployment.deploymentoptions?view=winrt-26100
+ */
+interface RegisterPackageOptions {
+  /**
+   * Force shutdown of the application if it's currently running.
+   * If this package, or any package that depends on this package, is currently in use,
+   * the processes associated with the package are shut down forcibly so that registration can continue.
+   *
+   * Corresponds to `DeploymentOptions.ForceApplicationShutdown` (value: 1)
+   *
+   * @default false
+   */
+  forceShutdown?: boolean;
+
+  /**
+   * Force shutdown of the target application if it's currently running.
+   * If this package is currently in use, the processes associated with the package
+   * are shut down forcibly so that registration can continue.
+   *
+   * Corresponds to `DeploymentOptions.ForceTargetApplicationShutdown` (value: 64)
+   *
+   * @default false
+   */
+  forceTargetShutdown?: boolean;
+
+  /**
+   * Force a specific version of a package to be staged/registered, regardless of if
+   * a higher version is already staged/registered.
+   *
+   * Corresponds to `DeploymentOptions.ForceUpdateFromAnyVersion` (value: 262144)
+   *
+   * @default false
+   */
+  forceUpdateFromAnyVersion?: boolean;
+}
+
+class AutoUpdater extends EventEmitter implements Electron.AutoUpdater {
+  updateAvailable: boolean = false;
+  updateURL: string | null = null;
+  updateHeaders: Record<string, string> | null = null;
+  allowAnyVersion: boolean = false;
+
+  // Private: Validate that the URL points to an MSIX file (following redirects)
+  private async validateMsixUrl (url: string): Promise<void> {
+    try {
+      // Make a HEAD request to follow redirects and get the final URL
+      const response = await net.fetch(url, {
+        method: 'HEAD',
+        headers: this.updateHeaders ? new Headers(this.updateHeaders) : undefined,
+        redirect: 'follow' // Follow redirects to get the final URL
+      });
+
+      // Get the final URL after redirects (response.url contains the final URL)
+      const finalUrl = response.url || url;
+      const urlObj = new URL(finalUrl);
+      const pathname = urlObj.pathname.toLowerCase();
+
+      // Check if final URL ends with .msix or .msixbundle extension
+      const hasMsixExtension = pathname.endsWith('.msix') || pathname.endsWith('.msixbundle');
+
+      if (!hasMsixExtension) {
+        throw new Error(`Update URL does not point to an MSIX file. Expected .msix or .msixbundle extension, got final URL: ${finalUrl}`);
+      }
+    } catch (error) {
+      if (error instanceof TypeError) {
+        throw new Error(`Invalid MSIX URL: ${url}`);
+      }
+      throw error;
+    }
+  }
+
+  // Private: Check if URL is a direct MSIX file (following redirects)
+  private async isDirectMsixUrl (url: string, emitError: boolean = false): Promise<boolean> {
+    try {
+      await this.validateMsixUrl(url);
+      return true;
+    } catch (error) {
+      if (emitError) {
+        this.emitError(error as Error);
+      }
+      return false;
+    }
+  }
+
+  // Supports both  versioning (x.y.z) and Windows version format (x.y.z.a)
+  // Returns: 1 if v1 > v2, -1 if v1 < v2, 0 if v1 === v2
+  private compareVersions (v1: string, v2: string): number {
+    const parts1 = v1.split('.').map(part => {
+      const parsed = parseInt(part, 10);
+      return isNaN(parsed) ? 0 : parsed;
+    });
+    const parts2 = v2.split('.').map(part => {
+      const parsed = parseInt(part, 10);
+      return isNaN(parsed) ? 0 : parsed;
+    });
+
+    const maxLength = Math.max(parts1.length, parts2.length);
+
+    for (let i = 0; i < maxLength; i++) {
+      const part1 = parts1[i] ?? 0;
+      const part2 = parts2[i] ?? 0;
+
+      if (part1 > part2) return 1;
+      if (part1 < part2) return -1;
+    }
+
+    return 0;
+  }
+
+  // Private: Parse the static releases array format
+  // This is a static JSON file containing all releases
+  private parseStaticReleasFile (json: any, currentVersion: string): { ok: boolean; available: boolean; url?: string; name?: string; notes?: string; pub_date?: string } {
+    if (!Array.isArray(json.releases) || !json.currentRelease || typeof json.currentRelease !== 'string') {
+      this.emitError(new Error('Invalid releases format. Expected \'releases\' array and \'currentRelease\' string.'));
+      return { ok: false, available: false };
+    }
+
+    // Use currentRelease property to determine if update is available
+    const currentReleaseVersion = json.currentRelease;
+
+    // Compare current version with currentRelease
+    const versionComparison = this.compareVersions(currentReleaseVersion, currentVersion);
+
+    // If versions match, we're up to date
+    if (versionComparison === 0) {
+      return { ok: true, available: false };
+    }
+
+    // If currentRelease is older than current version, check allowAnyVersion
+    if (versionComparison < 0) {
+      // If allowAnyVersion is true, allow downgrades
+      if (this.allowAnyVersion) {
+        // Continue to find the release entry for downgrade
+      } else {
+        return { ok: true, available: false };
+      }
+    }
+
+    // currentRelease is newer, find the release entry
+    const releaseEntry = json.releases.find((r: any) => r.version === currentReleaseVersion);
+
+    if (!releaseEntry || !releaseEntry.updateTo) {
+      this.emitError(new Error(`Release entry for version '${currentReleaseVersion}' not found or missing 'updateTo' property.`));
+      return { ok: false, available: false };
+    }
+
+    const updateTo = releaseEntry.updateTo;
+
+    if (!updateTo.url) {
+      this.emitError(new Error(`Invalid release entry. 'updateTo.url' is missing for version ${currentReleaseVersion}.`));
+      return { ok: false, available: false };
+    }
+
+    return {
+      ok: true,
+      available: true,
+      url: updateTo.url,
+      name: updateTo.name,
+      notes: updateTo.notes,
+      pub_date: updateTo.pub_date
+    };
+  }
+
+  private parseDynamicReleasFile (json: any): { ok: boolean; available: boolean; url?: string; name?: string; notes?: string; pub_date?: string } {
+    if (!json.url) {
+      this.emitError(new Error('Invalid releases format. Expected \'url\' string property.'));
+      return { ok: false, available: false };
+    }
+    return { ok: true, available: true, url: json.url, name: json.name, notes: json.notes, pub_date: json.pub_date };
+  }
+
+  private async fetchSquirrelJson (url: string) {
+    const headers: Record<string, string> = {
+      ...this.updateHeaders,
+      Accept: 'application/json' // Always set Accept header, overriding any user-provided Accept
+    };
+    const response = await net.fetch(url, {
+      headers
+    });
+
+    if (response.status === 204) {
+      return { ok: true, available: false };
+    } else if (response.status === 200) {
+      const updateJson = await response.json();
+
+      // Check if this is the static releases array format
+      if (Array.isArray(updateJson.releases)) {
+        // Get current package version
+        const packageInfo = msixUpdate.getPackageInfo();
+        const currentVersion = packageInfo.version;
+
+        if (!currentVersion) {
+          this.emitError(new Error('Cannot determine current package version.'));
+          return { ok: false, available: false };
+        }
+
+        return this.parseStaticReleasFile(updateJson, currentVersion);
+      } else {
+        // Dynamic format: server returns JSON with update info for current version
+        return this.parseDynamicReleasFile(updateJson);
+      }
+    } else {
+      this.emitError(new Error(`Unexpected response status: ${response.status}`));
+      return { ok: false, available: false };
+    }
+  }
+
+  private async getUpdateInfo (url: string): Promise<UpdateInfo> {
+    if (url && await this.isDirectMsixUrl(url)) {
+      return { ok: true, available: true, updateUrl: url, releaseDate: new Date() };
+    } else {
+      const updateJson = await this.fetchSquirrelJson(url);
+      if (!updateJson.ok) {
+        return { ok: false };
+      } else if (updateJson.ok && !updateJson.available) {
+        return { ok: true, available: false };
+      } else {
+        // updateJson.ok && updateJson.available must be true here
+        // Parse the publication date if present (ISO 8601 format)
+        let releaseDate: Date | null = null;
+        if (updateJson.pub_date) {
+          releaseDate = new Date(updateJson.pub_date);
+        }
+
+        const updateUrl = updateJson.url ?? '';
+        const releaseNotes = updateJson.notes ?? '';
+        const releaseName = updateJson.name ?? '';
+        releaseDate = releaseDate ?? new Date();
+
+        if (!await this.isDirectMsixUrl(updateUrl, true)) {
+          return { ok: false };
+        } else {
+          return {
+            ok: true,
+            available: true,
+            updateUrl,
+            releaseNotes,
+            releaseName,
+            releaseDate
+          };
+        }
+      }
+    }
+  }
+
+  getFeedURL () {
+    return this.updateURL ?? '';
+  }
+
+  setFeedURL (options: { url: string; headers?: Record<string, string>; allowAnyVersion?: boolean } | string) {
+    let updateURL: string;
+    let headers: Record<string, string> | undefined;
+    let allowAnyVersion: boolean | undefined;
+    if (typeof options === 'object') {
+      if (typeof options.url === 'string') {
+        updateURL = options.url;
+        headers = options.headers;
+        allowAnyVersion = options.allowAnyVersion;
+      } else {
+        throw new TypeError('Expected options object to contain a \'url\' string property in setFeedUrl call');
+      }
+    } else if (typeof options === 'string') {
+      updateURL = options;
+    } else {
+      throw new TypeError('Expected an options object with a \'url\' property to be provided');
+    }
+    this.updateURL = updateURL;
+    this.updateHeaders = headers ?? null;
+    this.allowAnyVersion = allowAnyVersion ?? false;
+  }
+
+  getPackageInfo (): MSIXPackageInfo {
+    return msixUpdate.getPackageInfo() as MSIXPackageInfo;
+  }
+
+  async checkForUpdates () {
+    const url = this.updateURL;
+    if (!url) {
+      return this.emitError(new Error('Update URL is not set'));
+    }
+
+    // Check if running in MSIX package
+    const packageInfo = msixUpdate.getPackageInfo();
+    if (!packageInfo.familyName) {
+      return this.emitError(new Error('MSIX updates are not supported'));
+    }
+
+    // If appInstallerUri is set, Windows App Installer manages updates automatically
+    // Prevent updates here to avoid conflicts
+    if (packageInfo.appInstallerUri) {
+      return this.emitError(new Error('Auto-updates are managed by Windows App Installer. Updates are not allowed when installed via Application Manifest.'));
+    }
+
+    this.emit('checking-for-update');
+    try {
+      const msixUrlInfo = await this.getUpdateInfo(url);
+      if (!msixUrlInfo.ok) {
+        return this.emitError(new Error('Invalid update or MSIX URL. See previous errors.'));
+      }
+
+      if (!msixUrlInfo.available) {
+        this.emit('update-not-available');
+      } else {
+        this.updateAvailable = true;
+        this.emit('update-available');
+        await msixUpdate.updateMsix(msixUrlInfo.updateUrl, {
+          deferRegistration: true,
+          developerMode: false,
+          forceShutdown: false,
+          forceTargetShutdown: false,
+          forceUpdateFromAnyVersion: this.allowAnyVersion
+        } as UpdateMsixOptions);
+
+        this.emit('update-downloaded', {}, msixUrlInfo.releaseNotes, msixUrlInfo.releaseName, msixUrlInfo.releaseDate, msixUrlInfo.updateUrl, () => {
+          this.quitAndInstall();
+        });
+      }
+    } catch (error) {
+      this.emitError(error as Error);
+    }
+  }
+
+  async quitAndInstall () {
+    if (!this.updateAvailable) {
+      this.emitError(new Error('No update available, can\'t quit and install'));
+      app.quit();
+      return;
+    }
+
+    try {
+      // Get package info to get family name
+      const packageInfo = msixUpdate.getPackageInfo();
+      if (!packageInfo.familyName) {
+        return this.emitError(new Error('MSIX updates are not supported'));
+      }
+
+      msixUpdate.registerRestartOnUpdate('');
+      this.emit('before-quit-for-update');
+      // force shutdown of the application and register the package to be installed on restart
+      await msixUpdate.registerPackage(packageInfo.familyName, {
+        forceShutdown: true
+      } as RegisterPackageOptions);
+    } catch (error) {
+      this.emitError(error as Error);
+    }
+  }
+
+  // Private: Emit both error object and message, this is to keep compatibility
+  // with Old APIs.
+  emitError (error: Error) {
+    this.emit('error', error, error.message);
+  }
+}
+
+export default new AutoUpdater();

lib/browser/api/auto-updater/auto-updater-win.ts

@@ -20,6 +20,11 @@ class AutoUpdater extends EventEmitter implements Electron.AutoUpdater {
     return this.updateURL ?? '';
   }
 
+  getPackageInfo () {
+    // Squirrel-based Windows apps don't have MSIX package information
+    return undefined;
+  }
+
   setFeedURL (options: { url: string } | string) {
     let updateURL: string;
     if (typeof options === 'object') {

lib/browser/api/auto-updater/msix-update-win.ts

@@ -0,0 +1,4 @@
+const { updateMsix, registerPackage, registerRestartOnUpdate, getPackageInfo } =
+  process._linkedBinding('electron_browser_msix_updater');
+
+export { updateMsix, registerPackage, registerRestartOnUpdate, getPackageInfo };

lib/browser/api/menu-item-roles.ts

@@ -353,6 +353,7 @@ export function shouldOverrideCheckStatus (role: RoleId) {
 
 export function getDefaultAccelerator (role: RoleId) {
   if (hasRole(role)) return roleList[role].accelerator;
+  return undefined;
 }
 
 export function shouldRegisterAccelerator (role: RoleId) {

lib/browser/api/menu-item.ts

@@ -25,7 +25,7 @@ const MenuItem = function (this: any, options: any) {
 
   this.overrideReadOnlyProperty('type', roles.getDefaultType(this.role));
   this.overrideReadOnlyProperty('role');
-  this.overrideReadOnlyProperty('accelerator');
+  this.overrideReadOnlyProperty('accelerator', roles.getDefaultAccelerator(this.role));
   this.overrideReadOnlyProperty('icon');
   this.overrideReadOnlyProperty('submenu');
 

lib/renderer/inspector.ts

@@ -11,12 +11,14 @@ const { contextIsolationEnabled } = internalContextBridge;
 * 1) Use menu API to show context menu.
 */
 window.onload = function () {
-  if (contextIsolationEnabled) {
-    internalContextBridge.overrideGlobalValueFromIsolatedWorld([
-      'InspectorFrontendHost', 'showContextMenuAtPoint'
-    ], createMenu);
-  } else {
-    window.InspectorFrontendHost!.showContextMenuAtPoint = createMenu;
+  if (window.InspectorFrontendHost) {
+    if (contextIsolationEnabled) {
+      internalContextBridge.overrideGlobalValueFromIsolatedWorld([
+        'InspectorFrontendHost', 'showContextMenuAtPoint'
+      ], createMenu);
+    } else {
+      window.InspectorFrontendHost.showContextMenuAtPoint = createMenu;
+    }
   }
 };
 

package.json

@@ -1,5 +1,5 @@
 {
-  "name": "electron",
+  "name": "@electron-ci/dev-root",
   "version": "0.0.0-development",
   "repository": "https://github.com/electron/electron",
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
@@ -9,8 +9,8 @@
     "@electron/asar": "^3.2.13",
     "@electron/docs-parser": "^2.0.0",
     "@electron/fiddle-core": "^1.3.4",
-    "@electron/github-app-auth": "^2.2.1",
-    "@electron/lint-roller": "^3.1.2",
+    "@electron/github-app-auth": "^3.2.0",
+    "@electron/lint-roller": "^3.2.0",
     "@electron/typescript-definitions": "^9.1.2",
     "@octokit/rest": "^20.1.2",
     "@primer/octicons": "^10.0.0",
@@ -25,7 +25,6 @@
     "buffer": "^6.0.3",
     "chalk": "^4.1.0",
     "check-for-leaks": "^1.2.1",
-    "dugite": "^2.7.1",
     "eslint": "^8.57.1",
     "eslint-config-standard": "^17.1.0",
     "eslint-plugin-import": "^2.32.0",
@@ -58,7 +57,8 @@
     "url": "^0.11.4",
     "webpack": "^5.95.0",
     "webpack-cli": "^5.1.4",
-    "wrapper-webpack-plugin": "^2.2.0"
+    "wrapper-webpack-plugin": "^2.2.0",
+    "yaml": "^2.8.1"
   },
   "private": true,
   "scripts": {
@@ -133,6 +133,10 @@
     "DEPS": [
       "node script/gen-hunspell-filenames.js",
       "node script/gen-libc++-filenames.js"
+    ],
+    ".github/workflows/pipeline-segment-electron-build.yml": [
+      "node script/copy-pipeline-segment-publish.js",
+      "git add .github/workflows/pipeline-segment-electron-publish.yml"
     ]
   },
   "resolutions": {
@@ -140,7 +144,7 @@
     "abstract-socket": "github:deepak1556/node-abstractsocket#928cc591decd12aff7dad96449da8afc29832c19",
     "minimist@npm:~0.0.1": "0.2.4"
   },
-  "packageManager": "yarn@4.11.0",
+  "packageManager": "yarn@4.12.0",
   "workspaces": [
     "spec",
     "spec/fixtures/native-addon/*"
@@ -148,9 +152,6 @@
   "dependenciesMeta": {
     "abstract-socket": {
       "built": true
-    },
-    "dugite": {
-      "built": true
     }
   }
 }

patches/chromium/.patches

@@ -143,3 +143,11 @@ allow_electron_to_depend_on_components_os_crypt_sync.patch
 expose_referrerscriptinfo_hostdefinedoptionsindex.patch
 chore_disable_protocol_handler_dcheck.patch
 fix_release_mouse_buttons_on_focus_loss_on_wayland.patch
+viz_fix_visual_artifacts_due_to_resizing_root_render_pass_with_dcomp.patch
+viz_do_not_overallocate_surface_on_initial_render.patch
+viz_create_isbufferqueuesupportedandenabled.patch
+viz_fix_visual_artifacts_while_resizing_window_with_dcomp.patch
+graphite_handle_out_of_order_recording_errors.patch
+ozone_wayland_treat_dnd_drop_performed_with_none_action_as_a.patch
+cherry-pick-e045399a1ecb.patch
+loaf_add_feature_to_enable_sourceurl_for_all_protocols.patch

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -46,7 +46,7 @@ index 7280ef29b85c1b16b11dd9e4d628a9eb579bb4dd..ab56e29d402a400a8c91aa97b6e82ad7
        # than here in :chrome_dll.
        deps += [ "//chrome:packed_resources_integrity_header" ]
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 15cfa64348e80a3507fc83c3819e9abdb238bffb..4650080f45da4e321d4b0f0dabd98f2bf097c7c2 100644
+index d8978eb678048850cc0e629d0c978f23417b5be9..219c9ae3dde4f2239b5c1331b99c8f2e9a170628 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
 @@ -7571,9 +7571,12 @@ test("unit_tests") {

patches/chromium/cherry-pick-e045399a1ecb.patch

@@ -0,0 +1,132 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Dominik=20R=C3=B6ttsches?= <drott@chromium.org>
+Date: Thu, 12 Feb 2026 06:35:36 -0800
+Subject: Avoid stale iteration in CSSFontFeatureValuesMap
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+To avoid invalid iterator state, take a snapshot of the
+map when creating the iteration source. This addresses
+the immediate problem of iterating while modifying.
+
+Remaining work tracked in https://crbug.com/483936078
+
+Fixed: 483569511
+Change-Id: Ie29cfdf7ed94bbe189b44c842a5efce571bb2cee
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7566570
+Commit-Queue: Dominik Röttsches <drott@chromium.org>
+Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1583927}
+
+diff --git a/third_party/blink/renderer/core/css/css_font_feature_values_map.cc b/third_party/blink/renderer/core/css/css_font_feature_values_map.cc
+index 0c5990799fbfdff5f1d1e04a9038a471217ad0d2..2ea27901e3ba503e7e1acc5dacf90dc60d52ac1a 100644
+--- a/third_party/blink/renderer/core/css/css_font_feature_values_map.cc
++++ b/third_party/blink/renderer/core/css/css_font_feature_values_map.cc
+@@ -13,16 +13,15 @@ class FontFeatureValuesMapIterationSource final
+     : public PairSyncIterable<CSSFontFeatureValuesMap>::IterationSource {
+  public:
+   FontFeatureValuesMapIterationSource(const CSSFontFeatureValuesMap& map,
+-                                      const FontFeatureAliases* aliases)
+-      : map_(map), aliases_(aliases), iterator_(aliases->begin()) {}
++                                      const FontFeatureAliases aliases)
++      : map_(map),
++        aliases_(std::move(aliases)),
++        iterator_(aliases_.begin()) {}
+ 
+   bool FetchNextItem(ScriptState* script_state,
+                      String& map_key,
+                      Vector<uint32_t>& map_value) override {
+-    if (!aliases_) {
+-      return false;
+-    }
+-    if (iterator_ == aliases_->end()) {
++    if (iterator_ == aliases_.end()) {
+       return false;
+     }
+     map_key = iterator_->key;
+@@ -37,9 +36,13 @@ class FontFeatureValuesMapIterationSource final
+   }
+ 
+  private:
+-  // Needs to be kept alive while we're iterating over it.
+   const Member<const CSSFontFeatureValuesMap> map_;
+-  const FontFeatureAliases* aliases_;
++  // Create a copy to keep the iterator from becoming invalid if there are
++  // modifications to the aliases HashMap while iterating.
++  // TODO(https://crbug.com/483936078): Implement live/stable iteration over
++  // FontFeatureAliases by changing its storage type, avoiding taking a copy
++  // here.
++  const FontFeatureAliases aliases_;
+   FontFeatureAliases::const_iterator iterator_;
+ };
+ 
+@@ -49,8 +52,8 @@ uint32_t CSSFontFeatureValuesMap::size() const {
+ 
+ PairSyncIterable<CSSFontFeatureValuesMap>::IterationSource*
+ CSSFontFeatureValuesMap::CreateIterationSource(ScriptState*) {
+-  return MakeGarbageCollected<FontFeatureValuesMapIterationSource>(*this,
+-                                                                   aliases_);
++  return MakeGarbageCollected<FontFeatureValuesMapIterationSource>(
++      *this, aliases_ ? *aliases_ : FontFeatureAliases());
+ }
+ 
+ bool CSSFontFeatureValuesMap::GetMapEntry(ScriptState*,
+diff --git a/third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html b/third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html
+new file mode 100644
+index 0000000000000000000000000000000000000000..eac7198b0b4a58007cbcc77ad3e9357a1009117c
+--- /dev/null
++++ b/third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html
+@@ -0,0 +1,52 @@
++<!DOCTYPE html>
++<html>
++  <head>
++    <title>CSSFontFeatureValuesMap Iteration and Modification</title>
++    <link
++      rel="help"
++      href="https://drafts.csswg.org/css-fonts-4/#om-fontfeaturevalues"
++    />
++    <meta
++      name="assert"
++      content="Iteration while modifying CSSFontFeatureValuesMap does not crash."
++    />
++    <script type="text/javascript" src="/resources/testharness.js"></script>
++    <script
++      type="text/javascript"
++      src="/resources/testharnessreport.js"
++    ></script>
++  </head>
++  <body>
++    <style>
++      @font-feature-values TestFont {
++        @styleset {
++          a: 1;
++          b: 2;
++          c: 3;
++        }
++      }
++    </style>
++    <script>
++      test(() => {
++        const rule = document.styleSheets[0].cssRules[0];
++        const map = rule.styleset;
++        const iterator = map.entries();
++        let count = 0;
++
++        while (count < 10) {
++          const { value: entry, done } = iterator.next();
++          if (done) break;
++
++          const [key, value] = entry;
++
++          map.delete(key);
++          for (let i = 0; i < 100; i++) {
++            map.set(`newkey_${count}_${i}`, i);
++          }
++
++          count++;
++        }
++      }, "Iteration of the CSSFontFeatureValuesMap does not crash.");
++    </script>
++  </body>
++</html>

patches/chromium/feat_configure_launch_options_for_service_process.patch

@@ -9,6 +9,8 @@ Subject: feat: configure launch options for service process
   Allows configuring base::LaunchOptions::handles_to_inherit, base::LaunchOptions::stdout_handle,
   base::LaunchOptions::stderr_handle and base::LaunchOptions::feedback_cursor_off when launching
   the child process.
+- Mac:
+  Allows configuring base::LaunchOptions::disclaim_responsibility when launching the child process.
 - All:
   Allows configuring base::LauncOptions::current_directory, base::LaunchOptions::enviroment
   and base::LaunchOptions::clear_environment.
@@ -165,10 +167,10 @@ index 0791b5317fc6846389f65f93734ae5e816d04623..48948b409d6da58ade72c60ed848df49
                           FinishStartSandboxedProcessOnLauncherThread,
                       this));
 diff --git a/content/browser/service_host/service_process_host_impl.cc b/content/browser/service_host/service_process_host_impl.cc
-index d9c14f91747bde0e76056d7f2f2ada166e67f994..53be16879777a3b9bef58ead5f7e420c1bf6acbe 100644
+index d9c14f91747bde0e76056d7f2f2ada166e67f994..09335acac17f526fb8d8e42e4b2d993b11045786 100644
 --- a/content/browser/service_host/service_process_host_impl.cc
 +++ b/content/browser/service_host/service_process_host_impl.cc
-@@ -69,6 +69,17 @@ void LaunchServiceProcess(mojo::GenericPendingReceiver receiver,
+@@ -69,6 +69,21 @@ void LaunchServiceProcess(mojo::GenericPendingReceiver receiver,
      utility_options.WithGpuClientAllowed();
    }
  
@@ -179,6 +181,10 @@ index d9c14f91747bde0e76056d7f2f2ada166e67f994..53be16879777a3b9bef58ead5f7e420c
 +#elif BUILDFLAG(IS_POSIX)
 +  utility_options.WithAdditionalFds(std::move(service_options.fds_to_remap));
 +#endif
++#if BUILDFLAG(IS_MAC)
++  utility_options.WithDisclaimResponsibility(
++      service_options.disclaim_responsibility);
++#endif
 +  utility_options.WithCurrentDirectory(service_options.current_directory);
 +  utility_options.WithEnvironment(service_options.environment,
 +                                  service_options.clear_environment);
@@ -187,7 +193,7 @@ index d9c14f91747bde0e76056d7f2f2ada166e67f994..53be16879777a3b9bef58ead5f7e420c
  
    UtilityProcessHost::Start(std::move(utility_options),
 diff --git a/content/browser/service_host/utility_process_host.cc b/content/browser/service_host/utility_process_host.cc
-index ab48c8b88a7cf311205b221169308d96e95f239f..d714d2022f685052e1def3b0d242d2ea596d790b 100644
+index ab48c8b88a7cf311205b221169308d96e95f239f..54883f202c1769227c823d46454173b53692a7dd 100644
 --- a/content/browser/service_host/utility_process_host.cc
 +++ b/content/browser/service_host/utility_process_host.cc
 @@ -245,13 +245,13 @@ UtilityProcessHost::Options& UtilityProcessHost::Options::WithFileToPreload(
@@ -207,7 +213,7 @@ index ab48c8b88a7cf311205b221169308d96e95f239f..d714d2022f685052e1def3b0d242d2ea
  
  #if BUILDFLAG(USE_ZYGOTE)
  UtilityProcessHost::Options& UtilityProcessHost::Options::WithZygoteForTesting(
-@@ -261,6 +261,36 @@ UtilityProcessHost::Options& UtilityProcessHost::Options::WithZygoteForTesting(
+@@ -261,6 +261,45 @@ UtilityProcessHost::Options& UtilityProcessHost::Options::WithZygoteForTesting(
  }
  #endif  // BUILDFLAG(USE_ZYGOTE)
  
@@ -240,11 +246,20 @@ index ab48c8b88a7cf311205b221169308d96e95f239f..d714d2022f685052e1def3b0d242d2ea
 +  return *this;
 +}
 +#endif  // BUILDFLAG(IS_WIN)
++
++#if BUILDFLAG(IS_MAC)
++UtilityProcessHost::Options&
++UtilityProcessHost::Options::WithDisclaimResponsibility(
++    bool disclaim_responsibility) {
++  disclaim_responsibility_ = disclaim_responsibility;
++  return *this;
++}
++#endif  // BUILDFLAG(IS_MAC)
 +
  UtilityProcessHost::Options&
  UtilityProcessHost::Options::WithBoundReceiverOnChildProcessForTesting(
      mojo::GenericPendingReceiver receiver) {
-@@ -525,9 +555,26 @@ bool UtilityProcessHost::StartProcess() {
+@@ -525,9 +564,30 @@ bool UtilityProcessHost::StartProcess() {
    }
  #endif  // BUILDFLAG(ENABLE_GPU_CHANNEL_MEDIA_CAPTURE) && !BUILDFLAG(IS_WIN)
  
@@ -269,11 +284,15 @@ index ab48c8b88a7cf311205b221169308d96e95f239f..d714d2022f685052e1def3b0d242d2ea
 +#if BUILDFLAG(IS_WIN)
 +  delegate->SetFeedbackCursorOff(options_.feedback_cursor_off_);
 +#endif  // BUILDFLAG(IS_WIN)
++
++#if BUILDFLAG(IS_MAC)
++  delegate->SetDisclaimResponsibility(options_.disclaim_responsibility_);
++#endif  // BUILDFLAG(IS_MAC)
  
  #if BUILDFLAG(IS_WIN)
    if (!options_.preload_libraries_.empty()) {
 diff --git a/content/browser/service_host/utility_process_host.h b/content/browser/service_host/utility_process_host.h
-index 580fa663e729a43bef44a10de8983c4aecc312fb..f39af3df87786a472f987309ac0dea699b9f0d9f 100644
+index 580fa663e729a43bef44a10de8983c4aecc312fb..c339f2b8504beee6ed2e5746a8e6b961a7aa9746 100644
 --- a/content/browser/service_host/utility_process_host.h
 +++ b/content/browser/service_host/utility_process_host.h
 @@ -31,6 +31,7 @@
@@ -284,7 +303,7 @@ index 580fa663e729a43bef44a10de8983c4aecc312fb..f39af3df87786a472f987309ac0dea69
  #endif  // BUILDFLAG(IS_WIN)
  
  namespace base {
-@@ -134,14 +135,31 @@ class CONTENT_EXPORT UtilityProcessHost final
+@@ -134,14 +135,36 @@ class CONTENT_EXPORT UtilityProcessHost final
          std::variant<base::FilePath, base::ScopedFD> file);
  #endif
  
@@ -315,11 +334,16 @@ index 580fa663e729a43bef44a10de8983c4aecc312fb..f39af3df87786a472f987309ac0dea69
 +    // Specifies if the process should trigger mouse cursor feedback.
 +    Options& WithFeedbackCursorOff(bool feedback_cursor_off);
 +#endif  // BUILDFLAG(IS_WIN)
++
++#if BUILDFLAG(IS_MAC)
++    // Specifies if the process should disclaim TCC responsibility.
++    Options& WithDisclaimResponsibility(bool disclaim_responsibility);
++#endif  // BUILDFLAG(IS_MAC)
 +
      // Requests that the process bind a receiving pipe targeting the interface
      // named by `receiver`. Calls to this method generally end up in
      // `ChildThreadImpl::OnBindReceiver()` and the option is used for testing
-@@ -185,6 +203,27 @@ class CONTENT_EXPORT UtilityProcessHost final
+@@ -185,6 +208,32 @@ class CONTENT_EXPORT UtilityProcessHost final
      std::optional<raw_ptr<ZygoteCommunication>> zygote_for_testing_;
  #endif  // BUILDFLAG(USE_ZYGOTE)
  
@@ -343,12 +367,17 @@ index 580fa663e729a43bef44a10de8983c4aecc312fb..f39af3df87786a472f987309ac0dea69
 +    // Specifies if the process should trigger mouse cursor feedback.
 +    bool feedback_cursor_off_ = false;
 +#endif  // BUILDFLAG(IS_WIN)
++
++#if BUILDFLAG(IS_MAC)
++    // Specifies if the process should disclaim TCC responsibility.
++    bool disclaim_responsibility_ = false;
++#endif  // BUILDFLAG(IS_MAC)
 +
  #if BUILDFLAG(ENABLE_GPU_CHANNEL_MEDIA_CAPTURE)
      // Whether or not to bind viz::mojom::Gpu to the utility process.
      bool allowed_gpu_;
 diff --git a/content/browser/service_host/utility_sandbox_delegate.cc b/content/browser/service_host/utility_sandbox_delegate.cc
-index 8f89c28144e1ecf3d7dbf9a3b43031cbad12a8ea..faa49bb63bd2e9080da441286bdbf427f22cd26f 100644
+index 8f89c28144e1ecf3d7dbf9a3b43031cbad12a8ea..0c6e724f8ad0926076274f696b77b17b77f2aaa9 100644
 --- a/content/browser/service_host/utility_sandbox_delegate.cc
 +++ b/content/browser/service_host/utility_sandbox_delegate.cc
 @@ -43,17 +43,19 @@ UtilitySandboxedProcessLauncherDelegate::
@@ -406,8 +435,24 @@ index 8f89c28144e1ecf3d7dbf9a3b43031cbad12a8ea..faa49bb63bd2e9080da441286bdbf427
  
  #if BUILDFLAG(USE_ZYGOTE)
  ZygoteCommunication* UtilitySandboxedProcessLauncherDelegate::GetZygote() {
+@@ -203,6 +222,15 @@ UtilitySandboxedProcessLauncherDelegate::GetProcessRequirement() {
+ 
+   return std::nullopt;
+ }
++
++void UtilitySandboxedProcessLauncherDelegate::SetDisclaimResponsibility(
++    bool disclaim_responsibility) {
++  disclaim_responsibility_ = disclaim_responsibility;
++}
++
++bool UtilitySandboxedProcessLauncherDelegate::DisclaimResponsibility() {
++  return disclaim_responsibility_;
++}
+ #endif  // BUILDFLAG(IS_MAC)
+ 
+ }  // namespace content
 diff --git a/content/browser/service_host/utility_sandbox_delegate.h b/content/browser/service_host/utility_sandbox_delegate.h
-index f2e8c1d62c1cb1677f618b584ed401685b03034b..7c47ec471e4676365cf3e023808983cb3e7a18d0 100644
+index f2e8c1d62c1cb1677f618b584ed401685b03034b..00a20885092bd299e817685dd18c3971b25f721b 100644
 --- a/content/browser/service_host/utility_sandbox_delegate.h
 +++ b/content/browser/service_host/utility_sandbox_delegate.h
 @@ -36,7 +36,9 @@ class CONTENT_EXPORT UtilitySandboxedProcessLauncherDelegate
@@ -438,7 +483,12 @@ index f2e8c1d62c1cb1677f618b584ed401685b03034b..7c47ec471e4676365cf3e023808983cb
  
  #if BUILDFLAG(USE_ZYGOTE)
    void SetZygote(ZygoteCommunication* handle);
-@@ -77,9 +84,7 @@ class CONTENT_EXPORT UtilitySandboxedProcessLauncherDelegate
+@@ -74,12 +81,12 @@ class CONTENT_EXPORT UtilitySandboxedProcessLauncherDelegate
+ 
+ #if BUILDFLAG(IS_MAC)
+   std::optional<base::mac::ProcessRequirement> GetProcessRequirement() override;
++  void SetDisclaimResponsibility(bool disclaim_responsibility);
++  bool DisclaimResponsibility() override;
  #endif  // BUILDFLAG(IS_MAC)
  
   private:
@@ -448,7 +498,7 @@ index f2e8c1d62c1cb1677f618b584ed401685b03034b..7c47ec471e4676365cf3e023808983cb
  
  #if BUILDFLAG(IS_WIN)
    // Adds preload-libraries to the delegate blob for utility_main() to access
-@@ -95,12 +100,17 @@ class CONTENT_EXPORT UtilitySandboxedProcessLauncherDelegate
+@@ -95,12 +102,20 @@ class CONTENT_EXPORT UtilitySandboxedProcessLauncherDelegate
    std::optional<raw_ptr<ZygoteCommunication>> zygote_;
  #endif  // BUILDFLAG(USE_ZYGOTE)
  
@@ -463,6 +513,9 @@ index f2e8c1d62c1cb1677f618b584ed401685b03034b..7c47ec471e4676365cf3e023808983cb
 +#if BUILDFLAG(IS_WIN)
 +  bool feedback_cursor_off_ = false;
 +#endif  // BUILDFLAG(IS_WIN)
++#if BUILDFLAG(IS_MAC)
++  bool disclaim_responsibility_ = false;
++#endif  // BUILDFLAG(IS_MAC)
  };
  }  // namespace content
  
@@ -489,10 +542,10 @@ index 39c96d4423b24695eee86353057cfeed19318b57..31b343d97b7672294644041c9bb1a4cd
  }
  
 diff --git a/content/public/browser/service_process_host.cc b/content/public/browser/service_process_host.cc
-index d1bc550a891979e2d41d8d5b18a2f9287468e460..5fcac7a8493e5065f80303067a04f59e7c4509ef 100644
+index d1bc550a891979e2d41d8d5b18a2f9287468e460..5d255f628788bc8b40d8df0039b08c06ffec8730 100644
 --- a/content/public/browser/service_process_host.cc
 +++ b/content/public/browser/service_process_host.cc
-@@ -53,12 +53,53 @@ ServiceProcessHost::Options::WithExtraCommandLineSwitches(
+@@ -53,12 +53,62 @@ ServiceProcessHost::Options::WithExtraCommandLineSwitches(
    return *this;
  }
  
@@ -542,12 +595,21 @@ index d1bc550a891979e2d41d8d5b18a2f9287468e460..5fcac7a8493e5065f80303067a04f59e
 +  return *this;
 +}
 +#endif  // #if BUILDFLAG(IS_WIN)
++
++#if BUILDFLAG(IS_MAC)
++ServiceProcessHost::Options&
++ServiceProcessHost::Options::WithDisclaimResponsibility(
++    bool should_disclaim_responsibility) {
++  disclaim_responsibility = should_disclaim_responsibility;
++  return *this;
++}
++#endif  // BUILDFLAG(IS_MAC)
 +
  #if BUILDFLAG(IS_WIN)
  ServiceProcessHost::Options&
  ServiceProcessHost::Options::WithPreloadedLibraries(
 diff --git a/content/public/browser/service_process_host.h b/content/public/browser/service_process_host.h
-index 0062d2cb6634b8b29977a0312516b1b13936b40a..611a52e908f4cb70fbe5628e220a082e45320b70 100644
+index 0062d2cb6634b8b29977a0312516b1b13936b40a..888ff36d70c83010f1f45e9eeb2dd6b573158db5 100644
 --- a/content/public/browser/service_process_host.h
 +++ b/content/public/browser/service_process_host.h
 @@ -14,6 +14,7 @@
@@ -569,7 +631,7 @@ index 0062d2cb6634b8b29977a0312516b1b13936b40a..611a52e908f4cb70fbe5628e220a082e
  namespace base {
  class Process;
  }  // namespace base
-@@ -94,11 +99,35 @@ class CONTENT_EXPORT ServiceProcessHost {
+@@ -94,11 +99,40 @@ class CONTENT_EXPORT ServiceProcessHost {
      // Specifies extra command line switches to append before launch.
      Options& WithExtraCommandLineSwitches(std::vector<std::string> switches);
  
@@ -601,11 +663,16 @@ index 0062d2cb6634b8b29977a0312516b1b13936b40a..611a52e908f4cb70fbe5628e220a082e
 +    // Specifies if the process should trigger mouse cursor feedback.
 +    Options& WithFeedbackCursorOff(bool feedback_cursor_off);
 +#endif  // #if BUILDFLAG(IS_WIN)
++
++#if BUILDFLAG(IS_MAC)
++    // Specifies if the process should disclaim TCC responsibility.
++    Options& WithDisclaimResponsibility(bool disclaim_responsibility);
++#endif  // BUILDFLAG(IS_MAC)
 +
  #if BUILDFLAG(IS_WIN)
      // Specifies libraries to preload before the sandbox is locked down. Paths
      // should be absolute paths. Libraries will be preloaded before sandbox
-@@ -127,11 +156,23 @@ class CONTENT_EXPORT ServiceProcessHost {
+@@ -127,11 +161,26 @@ class CONTENT_EXPORT ServiceProcessHost {
      std::optional<GURL> site;
      std::optional<int> child_flags;
      std::vector<std::string> extra_switches;
@@ -626,6 +693,9 @@ index 0062d2cb6634b8b29977a0312516b1b13936b40a..611a52e908f4cb70fbe5628e220a082e
 +#if BUILDFLAG(IS_WIN)
 +    bool feedback_cursor_off = false;
 +#endif  // BUILDFLAG(IS_WIN)
++#if BUILDFLAG(IS_MAC)
++    bool disclaim_responsibility = false;
++#endif  // BUILDFLAG(IS_MAC)
    };
  
    // An interface which can be implemented and registered/unregistered with

patches/chromium/feat_corner_smoothing_css_rule_and_blink_painting.patch

@@ -312,7 +312,7 @@ index 7e3d46902fbf736b4240eb3fcb89975a7b222197..57fdc89fc265ad70cb0bff8443cc1026
  
    auto DrawAsSinglePath = [&]() {
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-index a25e99fac5f5a171becff833464cdb3dfe7522c2..123a7c1fc980b1b3bcbe0e3e00afa594632d720b 100644
+index 2e464ef7bbfd7e0d84df348d012e8020d4758726..b59eceacbd4143ef183bb67c39f9ccccc7582adb 100644
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 @@ -214,6 +214,10 @@

patches/chromium/feat_enable_passing_exit_code_on_service_process_crash.patch

@@ -84,10 +84,10 @@ index 2648adb1cf38ab557b66ffd0e3034b26b04d76d6..98eab587f343f6ca472efc3d4e7b31b2
   private:
    const std::string service_interface_name_;
 diff --git a/content/browser/service_host/utility_process_host.cc b/content/browser/service_host/utility_process_host.cc
-index d714d2022f685052e1def3b0d242d2ea596d790b..fb4cee1416836c4d0b807a862507a52347f24dd2 100644
+index 54883f202c1769227c823d46454173b53692a7dd..b2a2f64435f566c67531bac9d0782215739d8fe6 100644
 --- a/content/browser/service_host/utility_process_host.cc
 +++ b/content/browser/service_host/utility_process_host.cc
-@@ -629,7 +629,7 @@ void UtilityProcessHost::OnProcessCrashed(int exit_code) {
+@@ -642,7 +642,7 @@ void UtilityProcessHost::OnProcessCrashed(int exit_code) {
                 : Client::CrashType::kPreIpcInitialization;
    }
  #endif  // BUILDFLAG(IS_WIN)
@@ -97,7 +97,7 @@ index d714d2022f685052e1def3b0d242d2ea596d790b..fb4cee1416836c4d0b807a862507a523
  
  std::optional<std::string> UtilityProcessHost::GetServiceName() {
 diff --git a/content/browser/service_host/utility_process_host.h b/content/browser/service_host/utility_process_host.h
-index f39af3df87786a472f987309ac0dea699b9f0d9f..6f470d19fa5fa0bd4d2bdb1be4aa0cb3a70d3936 100644
+index c339f2b8504beee6ed2e5746a8e6b961a7aa9746..e75b67e08755c90670d44b1e06a685aa2b35539d 100644
 --- a/content/browser/service_host/utility_process_host.h
 +++ b/content/browser/service_host/utility_process_host.h
 @@ -88,7 +88,7 @@ class CONTENT_EXPORT UtilityProcessHost final

patches/chromium/graphite_handle_out_of_order_recording_errors.patch

@@ -0,0 +1,348 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Sunny Sachanandani <sunnyps@chromium.org>
+Date: Fri, 30 Jan 2026 12:51:05 -0800
+Subject: [graphite] Handle out of order recording errors
+
+Explicitly handle out of order recording errors to crash just like async
+shader compile failed errors. Also, emit the insert status to an UMA
+histogram at 1% subsampling and log all error statuses at runtime.
+
+Bug: 458722690
+Change-Id: Id94657be6ae870dcf8adba71aff216386a6a6964
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7533855
+Commit-Queue: Sunny Sachanandani <sunnyps@chromium.org>
+Auto-Submit: Sunny Sachanandani <sunnyps@chromium.org>
+Reviewed-by: Jonathan Ross <jonross@chromium.org>
+Reviewed-by: Michael Ludwig <michaelludwig@google.com>
+Cr-Commit-Position: refs/heads/main@{#1577487}
+
+diff --git a/gpu/command_buffer/service/graphite_shared_context.cc b/gpu/command_buffer/service/graphite_shared_context.cc
+index f9a47ac16bddc2352d81f43629d8ce8c2d2b3b99..9856d68f893e4329fda5d002835613161b346bc1 100644
+--- a/gpu/command_buffer/service/graphite_shared_context.cc
++++ b/gpu/command_buffer/service/graphite_shared_context.cc
+@@ -4,7 +4,10 @@
+ 
+ #include "gpu/command_buffer/service/graphite_shared_context.h"
+ 
++#include "base/logging.h"
+ #include "base/memory/ptr_util.h"
++#include "base/metrics/histogram_macros.h"
++#include "base/rand_util.h"
+ #include "base/task/single_thread_task_runner.h"
+ #include "gpu/command_buffer/common/shm_count.h"
+ #include "third_party/skia/include/core/SkColorSpace.h"
+@@ -14,6 +17,44 @@
+ namespace gpu {
+ 
+ namespace {
++// This is emitted to UMA - values should not be reordered, only appended!
++// LINT.IfChange(InsertRecordingStatusUma)
++enum class InsertRecordingStatusUma {
++  kSuccess,
++  kInvalidRecording,
++  kPromiseImageInstantiationFailed,
++  kAddCommandsFailed,
++  kAsyncShaderCompilesFailed,
++  kOutOfOrderRecording,
++  kMaxValue = kOutOfOrderRecording
++};
++// LINT.ThenChange(//tools/metrics/histograms/metadata/gpu/enums.xml:GraphiteInsertRecordingStatus)
++
++InsertRecordingStatusUma InsertRecordingStatusUma(
++    skgpu::graphite::InsertStatus insert_status) {
++  // InsertStatus almost behaves like an enum class, but not quite since it can
++  // convert to both bool and integer types and can't be used in a switch.
++  if (insert_status == skgpu::graphite::InsertStatus::kSuccess) {
++    return InsertRecordingStatusUma::kSuccess;
++  } else if (insert_status ==
++             skgpu::graphite::InsertStatus::kInvalidRecording) {
++    return InsertRecordingStatusUma::kInvalidRecording;
++  } else if (insert_status ==
++             skgpu::graphite::InsertStatus::kPromiseImageInstantiationFailed) {
++    return InsertRecordingStatusUma::kPromiseImageInstantiationFailed;
++  } else if (insert_status ==
++             skgpu::graphite::InsertStatus::kAddCommandsFailed) {
++    return InsertRecordingStatusUma::kAddCommandsFailed;
++  } else if (insert_status ==
++             skgpu::graphite::InsertStatus::kAsyncShaderCompilesFailed) {
++    return InsertRecordingStatusUma::kAsyncShaderCompilesFailed;
++  } else if (insert_status ==
++             skgpu::graphite::InsertStatus::kOutOfOrderRecording) {
++    return InsertRecordingStatusUma::kOutOfOrderRecording;
++  }
++  NOTREACHED();
++}
++
+ struct RecordingContext {
+   skgpu::graphite::GpuFinishedProc old_finished_proc;
+   skgpu::graphite::GpuFinishedContext old_context;
+@@ -216,20 +257,38 @@ bool GraphiteSharedContext::InsertRecordingImpl(
+ 
+   auto insert_status = graphite_context_->insertRecording(*info_ptr);
+ 
+-  // TODO(433845560): Check the kAddCommandsFailed failures.
+-  // Crash only if we're not simulating a failure for testing.
+   const bool simulating_insert_failure =
+       info_ptr->fSimulatedStatus != skgpu::graphite::InsertStatus::kSuccess;
+ 
+-  // InsertStatus::kAsyncShaderCompilesFailed is also an unrecoverable error for
+-  // which we should also clear the disk shader cache in case the error was due
+-  // to a corrupted cached shader blob.
++  // Crash, log, or emit UMA only if we're not simulating a failure for testing.
++  if (!simulating_insert_failure) {
++    if (base::ShouldRecordSubsampledMetric(0.01)) {
++      UMA_HISTOGRAM_ENUMERATION("GPU.Graphite.InsertRecordingStatus",
++                                InsertRecordingStatusUma(insert_status));
++    }
++    if (insert_status != skgpu::graphite::InsertStatus::kSuccess) {
++      // skgpu::graphite::InsertStatus almost behaves like an enum class, but
++      // not quite - it can't be static_cast to an int.
++      LOG(ERROR) << "Graphite insertRecording failed with status "
++                 << static_cast<int>(InsertRecordingStatusUma(insert_status));
++    }
++  }
++
++  // kAsyncShaderCompilesFailed and kOutOfOrderRecording are unrecoverable
++  // failures because they cause future recordings to be rendered incorrectly.
++  // TODO(433845560): Check the kAddCommandsFailed failures.
++  const bool is_unrecoverable_failure =
++      insert_status ==
++          skgpu::graphite::InsertStatus::kAsyncShaderCompilesFailed ||
++      insert_status == skgpu::graphite::InsertStatus::kOutOfOrderRecording;
++  // For kAsyncShaderCompilesFailed, we should also clear the disk shader
++  // cache in case the error was due to a corrupted cached shader blob.
++  std::optional<GpuProcessShmCount::ScopedIncrement> use_shader_cache;
+   if (insert_status ==
+       skgpu::graphite::InsertStatus::kAsyncShaderCompilesFailed) {
+-    GpuProcessShmCount::ScopedIncrement use_shader_cache(
+-        use_shader_cache_shm_count_);
+-    CHECK(simulating_insert_failure);
++    use_shader_cache.emplace(use_shader_cache_shm_count_);
+   }
++  CHECK(simulating_insert_failure || !is_unrecoverable_failure);
+ 
+   // All other failure modes are recoverable in the sense that future recordings
+   // will be rendered correctly, so merely return a boolean here so that callers
+diff --git a/gpu/command_buffer/service/graphite_shared_context_unittest.cc b/gpu/command_buffer/service/graphite_shared_context_unittest.cc
+index 0de107a9d86ff8217a4c537598f198f313ecf9df..852343ab6804efed962b707b748ddf1920c20ea7 100644
+--- a/gpu/command_buffer/service/graphite_shared_context_unittest.cc
++++ b/gpu/command_buffer/service/graphite_shared_context_unittest.cc
+@@ -6,6 +6,7 @@
+ 
+ #include "base/threading/thread.h"
+ #include "gpu/command_buffer/common/shm_count.h"
++#include "gpu/command_buffer/service/skia_utils.h"
+ #include "skia/buildflags.h"
+ #include "testing/gmock/include/gmock/gmock.h"
+ #include "testing/gtest/include/gtest/gtest.h"
+@@ -86,8 +87,7 @@ class GraphiteSharedContextTest : public testing::TestWithParam<bool> {
+ 
+     wgpu::DeviceDescriptor device_desc = {};
+ 
+-    wgpu::Device device =
+-        wgpu::Adapter(adapters[0].Get()).CreateDevice(&device_desc);
++    auto device = wgpu::Adapter(adapters[0].Get()).CreateDevice(&device_desc);
+     CHECK(device);
+ 
+     skgpu::graphite::DawnBackendContext backend_context = {};
+@@ -95,7 +95,11 @@ class GraphiteSharedContextTest : public testing::TestWithParam<bool> {
+     backend_context.fDevice = device;
+     backend_context.fQueue = device.GetQueue();
+ 
+-    skgpu::graphite::ContextOptions context_options = {};
++    // Use the default Graphite context options that Chromium uses e.g. disallow
++    // things like out of order recordings.
++    gpu::GpuDriverBugWorkarounds workarounds;
++    auto context_options = GetDefaultGraphiteContextOptions(workarounds);
++
+     graphite_shared_context_ = std::make_unique<GraphiteSharedContext>(
+         skgpu::graphite::ContextFactory::MakeDawn(backend_context,
+                                                   context_options),
+@@ -133,14 +137,12 @@ TEST_P(GraphiteSharedContextTest, ConcurrentAccess) {
+   auto run_graphite_functions =
+       [](GraphiteSharedContext* graphite_shared_context) {
+         // Call a method that acquires the lock
+-        std::unique_ptr<skgpu::graphite::Recorder> recorder =
+-            graphite_shared_context->makeRecorder();
++        auto recorder = graphite_shared_context->makeRecorder();
+         EXPECT_TRUE(recorder);
+ 
+         for (int i = 0; i < 2; ++i) {
+           for (int j = 0; j < 10; ++j) {
+-            std::unique_ptr<skgpu::graphite::Recording> recording =
+-                recorder->snap();
++            auto recording = recorder->snap();
+             skgpu::graphite::InsertRecordingInfo info = {};
+             info.fRecording = recording.get();
+             EXPECT_TRUE(recording);
+@@ -172,18 +174,17 @@ TEST_P(GraphiteSharedContextTest, ConcurrentAccess) {
+ }
+ 
+ TEST_P(GraphiteSharedContextTest, AsyncShaderCompilesFailed) {
+-  std::unique_ptr<skgpu::graphite::Recorder> recorder =
+-      graphite_shared_context_->makeRecorder();
++  auto recorder = graphite_shared_context_->makeRecorder();
+   EXPECT_TRUE(recorder);
+ 
+   auto ii = SkImageInfo::Make(64, 64, kN32_SkColorType, kPremul_SkAlphaType);
+-  sk_sp<SkSurface> surface1 = SkSurfaces::RenderTarget(recorder.get(), ii);
++  auto surface1 = SkSurfaces::RenderTarget(recorder.get(), ii);
+   surface1->getCanvas()->clear(SK_ColorRED);
+ 
+-  sk_sp<SkSurface> surface2 = SkSurfaces::RenderTarget(recorder.get(), ii);
++  auto surface2 = SkSurfaces::RenderTarget(recorder.get(), ii);
+   surface2->getCanvas()->drawImage(surface1->makeTemporaryImage(), 0, 0);
+ 
+-  std::unique_ptr<skgpu::graphite::Recording> recording = recorder->snap();
++  auto recording = recorder->snap();
+   EXPECT_TRUE(recording);
+ 
+   skgpu::graphite::InsertRecordingInfo info = {};
+@@ -197,19 +198,43 @@ TEST_P(GraphiteSharedContextTest, AsyncShaderCompilesFailed) {
+   EXPECT_FALSE(graphite_shared_context_->insertRecording(info));
+ }
+ 
++TEST_P(GraphiteSharedContextTest, OutOfOrderRecording) {
++  auto recorder = graphite_shared_context_->makeRecorder();
++  EXPECT_TRUE(recorder);
++
++  auto ii = SkImageInfo::Make(64, 64, kN32_SkColorType, kPremul_SkAlphaType);
++  auto surface1 = SkSurfaces::RenderTarget(recorder.get(), ii);
++  surface1->getCanvas()->clear(SK_ColorRED);
++  auto recording1 = recorder->snap();
++  EXPECT_TRUE(recording1);
++
++  auto surface2 = SkSurfaces::RenderTarget(recorder.get(), ii);
++  surface2->getCanvas()->drawImage(surface1->makeTemporaryImage(), 0, 0);
++  auto recording2 = recorder->snap();
++  EXPECT_TRUE(recording2);
++
++  skgpu::graphite::InsertRecordingInfo info = {};
++
++  info.fRecording = recording2.get();
++  graphite_shared_context_->insertRecording(info);
++
++  info.fRecording = recording1.get();
++  EXPECT_DEATH_IF_SUPPORTED(graphite_shared_context_->insertRecording(info),
++                            "");
++}
++
+ TEST_P(GraphiteSharedContextTest, AddCommandsFailed) {
+-  std::unique_ptr<skgpu::graphite::Recorder> recorder =
+-      graphite_shared_context_->makeRecorder();
++  auto recorder = graphite_shared_context_->makeRecorder();
+   EXPECT_TRUE(recorder);
+ 
+   auto ii = SkImageInfo::Make(64, 64, kN32_SkColorType, kPremul_SkAlphaType);
+-  sk_sp<SkSurface> surface1 = SkSurfaces::RenderTarget(recorder.get(), ii);
++  auto surface1 = SkSurfaces::RenderTarget(recorder.get(), ii);
+   surface1->getCanvas()->clear(SK_ColorRED);
+ 
+-  sk_sp<SkSurface> surface2 = SkSurfaces::RenderTarget(recorder.get(), ii);
++  auto surface2 = SkSurfaces::RenderTarget(recorder.get(), ii);
+   surface2->getCanvas()->drawImage(surface1->makeTemporaryImage(), 0, 0);
+ 
+-  std::unique_ptr<skgpu::graphite::Recording> recording = recorder->snap();
++  auto recording = recorder->snap();
+   EXPECT_TRUE(recording);
+ 
+   skgpu::graphite::InsertRecordingInfo info = {};
+@@ -223,39 +248,37 @@ TEST_P(GraphiteSharedContextTest, AddCommandsFailed) {
+ }
+ 
+ TEST_P(GraphiteSharedContextTest, LowPendingRecordings) {
+-  std::unique_ptr<skgpu::graphite::Recorder> recorder =
+-      graphite_shared_context_->makeRecorder();
++  auto recorder = graphite_shared_context_->makeRecorder();
+   EXPECT_TRUE(recorder);
+ 
+-  std::unique_ptr<skgpu::graphite::Recording> recording = recorder->snap();
+-  EXPECT_TRUE(recording);
+-
+-  skgpu::graphite::InsertRecordingInfo info = {};
+-  info.fRecording = recording.get();
+-
+   // No flush is expected if the number of pending recordings is low.
+   EXPECT_CALL(backend_flush_callback_, Flush()).Times(0);
+ 
+   for (size_t i = 0; i < kMaxPendingRecordings - 1; ++i) {
++    auto recording = recorder->snap();
++    EXPECT_TRUE(recording);
++
++    skgpu::graphite::InsertRecordingInfo info = {};
++    info.fRecording = recording.get();
++
+     EXPECT_TRUE(graphite_shared_context_->insertRecording(info));
+   }
+ }
+ 
+ TEST_P(GraphiteSharedContextTest, MaxPendingRecordings) {
+-  std::unique_ptr<skgpu::graphite::Recorder> recorder =
+-      graphite_shared_context_->makeRecorder();
++  auto recorder = graphite_shared_context_->makeRecorder();
+   EXPECT_TRUE(recorder);
+ 
+-  std::unique_ptr<skgpu::graphite::Recording> recording = recorder->snap();
+-  EXPECT_TRUE(recording);
+-
+-  skgpu::graphite::InsertRecordingInfo info = {};
+-  info.fRecording = recording.get();
+-
+   // Expect a flush when the number of pending recordings reaches the max.
+   EXPECT_CALL(backend_flush_callback_, Flush()).Times(1);
+ 
+   for (size_t i = 0; i < kMaxPendingRecordings; ++i) {
++    auto recording = recorder->snap();
++    EXPECT_TRUE(recording);
++
++    skgpu::graphite::InsertRecordingInfo info = {};
++    info.fRecording = recording.get();
++
+     EXPECT_TRUE(graphite_shared_context_->insertRecording(info));
+   }
+ }
+diff --git a/tools/metrics/histograms/metadata/gpu/enums.xml b/tools/metrics/histograms/metadata/gpu/enums.xml
+index 58471a1d69c65cdf559f98ec2e11550bc16520d2..b62d8b78d34bfec491bcd5e6c65ff63eaedf00dd 100644
+--- a/tools/metrics/histograms/metadata/gpu/enums.xml
++++ b/tools/metrics/histograms/metadata/gpu/enums.xml
+@@ -1104,6 +1104,19 @@ Called by update_gpu_driver_bug_workaround_entries.py.-->
+   <int value="10" label="NoKillForGpuProgressInCrashDump"/>
+ </enum>
+ 
++<!-- LINT.IfChange(GraphiteInsertRecordingStatus) -->
++
++<enum name="GraphiteInsertRecordingStatus">
++  <int value="0" label="Success"/>
++  <int value="1" label="InvalidRecording"/>
++  <int value="2" label="PromiseImageInstantiationFailed"/>
++  <int value="3" label="AddCommandsFailed"/>
++  <int value="4" label="AsyncShaderCompilesFailed"/>
++  <int value="5" label="OutOfOrderRecording"/>
++</enum>
++
++<!-- LINT.ThenChange(//gpu/command_buffer/service/graphite_shared_context.cc:InsertRecordingStatusUma) -->
++
+ <enum name="HasDiscreteGpu">
+   <int value="0" label="No"/>
+   <int value="1" label="Yes"/>
+diff --git a/tools/metrics/histograms/metadata/gpu/histograms.xml b/tools/metrics/histograms/metadata/gpu/histograms.xml
+index ea8b129a2f4aba4d8afd9c3338f21574a12185dd..80bf969cbf66eac7f970b7c096da83c69424c38a 100644
+--- a/tools/metrics/histograms/metadata/gpu/histograms.xml
++++ b/tools/metrics/histograms/metadata/gpu/histograms.xml
+@@ -1004,6 +1004,16 @@ chromium-metrics-reviews@google.com.
+   </summary>
+ </histogram>
+ 
++<histogram name="Gpu.Graphite.InsertRecordingStatus"
++    enum="GraphiteInsertRecordingStatus" expires_after="2026-04-30">
++  <owner>sunnyps@chromium.org</owner>
++  <owner>michaelludwig@google.com</owner>
++  <owner>chrome-gpu-metric-alerts@chromium.org</owner>
++  <summary>
++    The return value for each Graphite insertRecording call made by Chromium.
++  </summary>
++</histogram>
++
+ <histogram name="GPU.GraphValidation.Duration" units="ms"
+     expires_after="2025-11-15">
+   <owner>vasilyt@chromium.org</owner>

patches/chromium/loaf_add_feature_to_enable_sourceurl_for_all_protocols.patch

@@ -0,0 +1,52 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Niklas Wenzel <dev@nikwen.de>
+Date: Wed, 4 Feb 2026 06:02:40 -0800
+Subject: LoAF: Add feature to enable sourceURL for all protocols
+
+Backports https://crrev.com/c/7510894 (minus the test changes).
+
+Can be removed when that CL is included via a Chromium roll.
+
+Change-Id: Id5e58a151b13cc0ac054f4ec237b038255d683fd
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7510894
+Commit-Queue: Noam Rosenthal <nrosenthal@google.com>
+Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
+Reviewed-by: Noam Rosenthal <nrosenthal@google.com>
+Cr-Commit-Position: refs/heads/main@{#1579397}
+
+diff --git a/third_party/blink/renderer/core/frame/animation_frame_timing_monitor.cc b/third_party/blink/renderer/core/frame/animation_frame_timing_monitor.cc
+index 6e118aeed3b13e4d36064f2e114aba9edf4bb6dc..5e0304eda6548e7065527e03c0635bd1387138bd 100644
+--- a/third_party/blink/renderer/core/frame/animation_frame_timing_monitor.cc
++++ b/third_party/blink/renderer/core/frame/animation_frame_timing_monitor.cc
+@@ -519,8 +519,15 @@ void AnimationFrameTimingMonitor::Trace(Visitor* visitor) const {
+   visitor->Trace(frame_handling_input_);
+ }
+ 
++BASE_FEATURE(kAlwaysLogLOAFURL, base::FEATURE_DISABLED_BY_DEFAULT);
++
+ namespace {
++
+ bool ShouldAllowScriptURL(const String& url) {
++  if (base::FeatureList::IsEnabled(kAlwaysLogLOAFURL)) {
++    return true;
++  }
++
+   KURL kurl(url);
+   return kurl.ProtocolIsData() || kurl.ProtocolIsInHTTPFamily() ||
+          kurl.ProtocolIs("blob") || kurl.IsEmpty();
+diff --git a/third_party/blink/renderer/core/frame/animation_frame_timing_monitor.h b/third_party/blink/renderer/core/frame/animation_frame_timing_monitor.h
+index f2fe39be2db525d89fcd9787c2ae9285babab26d..c395cf39d404f6c4f6f6e23c9fb8dfe92151a7d2 100644
+--- a/third_party/blink/renderer/core/frame/animation_frame_timing_monitor.h
++++ b/third_party/blink/renderer/core/frame/animation_frame_timing_monitor.h
+@@ -22,6 +22,11 @@ class TimeTicks;
+ 
+ namespace blink {
+ 
++// When enabled, long-animation-frame events will always include the sourceURL,
++// regardless of protocol. This is useful during development when using `file:`
++// URLs or custom protocols defined by embedders.
++CORE_EXPORT BASE_DECLARE_FEATURE(kAlwaysLogLOAFURL);
++
+ class LocalFrame;
+ 
+ // Monitors long-animation-frame timing (LoAF).

patches/chromium/mas_avoid_private_macos_api_usage.patch.patch

@@ -81,7 +81,7 @@ index 4bf9a3c27e05c6635b2beb8e880b5b43dbed61b5..f328fbb49c45991f44a9c75325491d08
  
  }  // namespace base
 diff --git a/base/process/launch_mac.cc b/base/process/launch_mac.cc
-index b63d58da9837ba4d1e4aff8f24f2cd977c5ed02d..8387fd7d2bcf8951b6cc024829c16d970799190c 100644
+index b63d58da9837ba4d1e4aff8f24f2cd977c5ed02d..49b4c0b69731386ef5a4b7dfb782aa8f4ae09cdd 100644
 --- a/base/process/launch_mac.cc
 +++ b/base/process/launch_mac.cc
 @@ -84,6 +84,10 @@ int posix_spawnattr_set_csm_np(const posix_spawnattr_t*, uint32_t)
@@ -135,15 +135,26 @@ index b63d58da9837ba4d1e4aff8f24f2cd977c5ed02d..8387fd7d2bcf8951b6cc024829c16d97
  }
  #endif
  
-@@ -301,7 +321,7 @@ Process LaunchProcess(const std::vector<std::string>& argv,
+@@ -301,16 +321,16 @@ Process LaunchProcess(const std::vector<std::string>& argv,
      file_actions.Inherit(STDERR_FILENO);
    }
  
 -#if BUILDFLAG(IS_MAC)
-+#if 0
++#if !IS_MAS_BUILD()
    if (options.disclaim_responsibility) {
      DPSXCHECK(responsibility_spawnattrs_setdisclaim(attr.get(), 1));
    }
++#endif
+ 
+   EnvironmentMap new_environment_map = options.environment;
++#if !IS_MAS_BUILD()
+   MachPortRendezvousServerMac::AddFeatureStateToEnvironment(
+       new_environment_map);
+-#else
+-  const EnvironmentMap& new_environment_map = options.environment;
+ #endif
+ 
+   std::vector<char*> argv_cstr;
 diff --git a/base/process/process_info_mac.mm b/base/process/process_info_mac.mm
 index e12c1d078147d956a1d9b1bc498c1b1d6fe7b974..233362259dc4e728ed37435e650417647b45a6af 100644
 --- a/base/process/process_info_mac.mm
@@ -385,7 +396,7 @@ index 71158ca9a7101911bb76f0c1b5300b0ff0e326b3..1441b9d4f9560c8b26d4beffe31449ed
  // The NSWindow used by BridgedNativeWidget. Provides hooks into AppKit that
  // can only be accomplished by overriding methods.
 diff --git a/components/remote_cocoa/app_shim/native_widget_mac_nswindow.mm b/components/remote_cocoa/app_shim/native_widget_mac_nswindow.mm
-index 433f12928857e288b6b0d4f4dd3d1f29da08cf6c..bb95aabec2e0d5c7b3a5d315c9a3f8cb3a45c8d2 100644
+index 433f12928857e288b6b0d4f4dd3d1f29da08cf6c..98bd545ad806c0f3eece970560c769a4b119a486 100644
 --- a/components/remote_cocoa/app_shim/native_widget_mac_nswindow.mm
 +++ b/components/remote_cocoa/app_shim/native_widget_mac_nswindow.mm
 @@ -21,6 +21,7 @@
@@ -415,7 +426,29 @@ index 433f12928857e288b6b0d4f4dd3d1f29da08cf6c..bb95aabec2e0d5c7b3a5d315c9a3f8cb
  - (BOOL)hasKeyAppearance;
  - (long long)_resizeDirectionForMouseLocation:(CGPoint)location;
  - (BOOL)_isConsideredOpenForPersistentState;
-@@ -165,6 +170,8 @@ - (void)cr_mouseDownOnFrameView:(NSEvent*)event {
+@@ -158,13 +163,30 @@ - (void)cr_mouseDownOnFrameView:(NSEvent*)event;
+ @implementation NSView (CRFrameViewAdditions)
+ // If a mouseDown: falls through to the frame view, turn it into a window drag.
+ - (void)cr_mouseDownOnFrameView:(NSEvent*)event {
++#if !IS_MAS_BUILD()
+   if ([self.window _resizeDirectionForMouseLocation:event.locationInWindow] !=
+       -1)
+     return;
++#else
++  // For MAS builds, approximate the resize direction check.
++  if (self.window.styleMask & NSWindowStyleMaskResizable) {
++    constexpr CGFloat kResizeThreshold = 5.0;
++    NSPoint location = event.locationInWindow;
++    NSRect frame = self.window.frame;
++    CGFloat width = NSWidth(frame);
++    CGFloat height = NSHeight(frame);
++    if (location.x < kResizeThreshold || location.x > width - kResizeThreshold ||
++        location.y < kResizeThreshold || location.y > height - kResizeThreshold) {
++      return;
++    }
++  }
++#endif
+   [self.window performWindowDragWithEvent:event];
  }
  @end
  
@@ -424,7 +457,7 @@ index 433f12928857e288b6b0d4f4dd3d1f29da08cf6c..bb95aabec2e0d5c7b3a5d315c9a3f8cb
  @implementation NativeWidgetMacNSWindowTitledFrame
  - (void)mouseDown:(NSEvent*)event {
    if (self.window.isMovable)
-@@ -192,6 +199,8 @@ - (BOOL)usesCustomDrawing {
+@@ -192,6 +214,8 @@ - (BOOL)usesCustomDrawing {
  }
  @end
  
@@ -433,7 +466,7 @@ index 433f12928857e288b6b0d4f4dd3d1f29da08cf6c..bb95aabec2e0d5c7b3a5d315c9a3f8cb
  @implementation NativeWidgetMacNSWindow {
   @private
    CommandDispatcher* __strong _commandDispatcher;
-@@ -389,6 +398,8 @@ - (NSAccessibilityRole)accessibilityRole {
+@@ -389,6 +413,8 @@ - (NSAccessibilityRole)accessibilityRole {
  
  // NSWindow overrides.
  
@@ -442,7 +475,7 @@ index 433f12928857e288b6b0d4f4dd3d1f29da08cf6c..bb95aabec2e0d5c7b3a5d315c9a3f8cb
  + (Class)frameViewClassForStyleMask:(NSWindowStyleMask)windowStyle {
    if (windowStyle & NSWindowStyleMaskTitled) {
      if (Class customFrame = [NativeWidgetMacNSWindowTitledFrame class])
-@@ -400,6 +411,8 @@ + (Class)frameViewClassForStyleMask:(NSWindowStyleMask)windowStyle {
+@@ -400,6 +426,8 @@ + (Class)frameViewClassForStyleMask:(NSWindowStyleMask)windowStyle {
    return [super frameViewClassForStyleMask:windowStyle];
  }
  

patches/chromium/ozone_wayland_treat_dnd_drop_performed_with_none_action_as_a.patch

@@ -0,0 +1,114 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: AbdAlRahman Gad <agad@igalia.com>
+Date: Wed, 15 Oct 2025 09:34:12 -0700
+Subject: Ozone/Wayland: Treat DND drop performed with NONE action as a
+ cancellation
+
+According to the Wayland protocol, a "drop performed" event can be
+followed with a `cancelled` event. This is the behavior of compositors
+like KWin.
+
+We were always treating "drop performed" as a completed drop. This
+change corrects the logic to pass `DragResult::kCancelled` in this
+scenario.
+
+Bug: 447037092
+Change-Id: I0f3805365355bb364e15a9ab6d5a6954698cce1f
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7002773
+Reviewed-by: Nick Yamane <nickdiego@igalia.com>
+Reviewed-by: Max Ihlenfeldt <max@igalia.com>
+Commit-Queue: AbdAlRahman Gad <agad@igalia.com>
+Cr-Commit-Position: refs/heads/main@{#1530269}
+
+diff --git a/ui/ozone/platform/wayland/host/wayland_data_device.h b/ui/ozone/platform/wayland/host/wayland_data_device.h
+index 128baea3fe9a03f9d76afa234d6c21e9a4583cf7..d9824490e402308e64b5f54cbf9b46646f6021e8 100644
+--- a/ui/ozone/platform/wayland/host/wayland_data_device.h
++++ b/ui/ozone/platform/wayland/host/wayland_data_device.h
+@@ -90,6 +90,8 @@ class WaylandDataDevice : public WaylandDataDeviceBase {
+   FRIEND_TEST_ALL_PREFIXES(WaylandDataDragControllerTest, StartDrag);
+   FRIEND_TEST_ALL_PREFIXES(WaylandDataDragControllerTest, ReceiveDrag);
+   FRIEND_TEST_ALL_PREFIXES(WaylandDataDragControllerTest, CancelIncomingDrag);
++  FRIEND_TEST_ALL_PREFIXES(WaylandDataDragControllerTest,
++                           DndDropPerformedWithNoneActionThenCancelled);
+   FRIEND_TEST_ALL_PREFIXES(WaylandDataDragControllerTest,
+                            DestroyWindowWhileFetchingForeignData);
+   FRIEND_TEST_ALL_PREFIXES(WaylandDataDragControllerTest,
+diff --git a/ui/ozone/platform/wayland/host/wayland_data_drag_controller.cc b/ui/ozone/platform/wayland/host/wayland_data_drag_controller.cc
+index 893bf03a8f4aa473faf3a1232ea1902d226d8ca6..b557e4654dbe2a5d6f94bf31466c78bf83744c32 100644
+--- a/ui/ozone/platform/wayland/host/wayland_data_drag_controller.cc
++++ b/ui/ozone/platform/wayland/host/wayland_data_drag_controller.cc
+@@ -573,7 +573,13 @@ void WaylandDataDragController::OnDataSourceDropPerformed(
+           << " origin=" << !!origin_window_
+           << " nested_dispatcher=" << !!nested_dispatcher_;
+ 
+-  HandleDragEnd(DragResult::kCompleted, timestamp);
++  // Treat a "drop performed" event with a `dnd_action` of NONE (0) as a
++  // cancellation (passing `kCancelled`). Per the protocol, `cancelled` event
++  // can be sent after "drop performed", that is what `KWin` does, for example.
++  // See crbug.com/447037092.
++  HandleDragEnd(data_source_->dnd_action() ? DragResult::kCompleted
++                                           : DragResult::kCancelled,
++                timestamp);
+ }
+ 
+ void WaylandDataDragController::OnDataSourceSend(WaylandDataSource* source,
+diff --git a/ui/ozone/platform/wayland/host/wayland_data_drag_controller_unittest.cc b/ui/ozone/platform/wayland/host/wayland_data_drag_controller_unittest.cc
+index c70a03d082f518b48dda58be893fc9181507e1ab..baf42205a786d42a341a6dc9265c8d929c6a7454 100644
+--- a/ui/ozone/platform/wayland/host/wayland_data_drag_controller_unittest.cc
++++ b/ui/ozone/platform/wayland/host/wayland_data_drag_controller_unittest.cc
+@@ -497,6 +497,36 @@ MATCHER_P(PointFNear, n, "") {
+   return arg.IsWithinDistance(n, 0.01f);
+ }
+ 
++// Tests that if the compositor sends wl_data_source.dnd_drop_performed with
++// DND_ACTION_NONE, the drag controller treats it as a cancelled operation by
++// calling OnDragLeave, and can still handle a subsequent
++// wl_data_source.cancelled event gracefully. Regression test for
++// https://crbug.com/447037092.
++TEST_P(WaylandDataDragControllerTest,
++       DndDropPerformedWithNoneActionThenCancelled) {
++  FocusAndPressLeftPointerButton(window_.get(), &delegate_);
++
++  // Post test task to be performed asynchronously once the dnd-related protocol
++  // objects are ready.
++  ScheduleTestTask(base::BindLambdaForTesting([&]() {
++    // Now the server can read the data and give it to our callback.
++    ReadAndCheckData(kMimeTypeUtf8PlainText, kSampleTextForDragAndDrop);
++
++    EXPECT_CALL(*drop_handler_, OnDragLeave()).Times(1);
++    SendDndDropPerformed();
++
++    // Emulate server sending an wl_data_source::cancelled event so the drag
++    // loop is finished.
++    EXPECT_CALL(*drop_handler_, OnDragLeave()).Times(0);
++    SendDndCancelled();
++  }));
++
++  RunMouseDragWithSampleData(window_.get(), DragDropTypes::DRAG_NONE);
++
++  // Ensure drag delegate it properly reset when the drag loop quits.
++  EXPECT_FALSE(data_device()->drag_delegate_);
++}
++
+ TEST_P(WaylandDataDragControllerTest, ReceiveDrag) {
+   const uint32_t surface_id = window_->root_surface()->get_surface_id();
+ 
+diff --git a/ui/ozone/platform/wayland/host/wayland_data_source.cc b/ui/ozone/platform/wayland/host/wayland_data_source.cc
+index 761f6a456456e11ad0e8c4dbe408c360de50f02d..f1b74febf52ecadef0da6574d50dfe3709ee48d7 100644
+--- a/ui/ozone/platform/wayland/host/wayland_data_source.cc
++++ b/ui/ozone/platform/wayland/host/wayland_data_source.cc
+@@ -30,12 +30,12 @@ DataSource<T>::DataSource(T* data_source,
+   DCHECK(delegate_);
+ 
+   Initialize();
+-  VLOG(1) << "DataSoure created:" << this;
++  VLOG(1) << "DataSource created:" << this;
+ }
+ 
+ template <typename T>
+ DataSource<T>::~DataSource() {
+-  VLOG(1) << "DataSoure deleted:" << this;
++  VLOG(1) << "DataSource deleted:" << this;
+ }
+ 
+ template <typename T>

patches/chromium/viz_create_isbufferqueuesupportedandenabled.patch

@@ -0,0 +1,93 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Niklas Wenzel <dev@nikwen.de>
+Date: Wed, 3 Dec 2025 17:10:02 +0100
+Subject: viz: Create IsBufferQueueSupportedAndEnabled()
+
+Manual backport of crrev.com/c/7210913
+
+Bug: 457463689
+Change-Id: I31bbaa6b5d79697c6bb5e1fc6738f6ea5a937b4f
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7210913
+Reviewed-by: Michael Tang <tangm@microsoft.com>
+Commit-Queue: David Sanders <dsanders11@ucsbalum.com>
+Reviewed-by: Vasiliy Telezhnikov <vasilyt@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1553190}
+
+diff --git a/components/viz/service/display/output_surface.cc b/components/viz/service/display/output_surface.cc
+index ff795eb057ac64f40aa842fec8e053d12f57f538..71287614c627d39f8d019889498205ab3eff2a69 100644
+--- a/components/viz/service/display/output_surface.cc
++++ b/components/viz/service/display/output_surface.cc
+@@ -21,6 +21,16 @@
+ 
+ namespace viz {
+ 
++namespace {
++
++#if BUILDFLAG(IS_WIN)
++// Use BufferQueue for the primary plane instead of a DXGI swap chain or DComp
++// surface.
++BASE_FEATURE(kBufferQueue, base::FEATURE_DISABLED_BY_DEFAULT);
++#endif
++
++}  // namespace
++
+ OutputSurface::Capabilities::Capabilities() = default;
+ OutputSurface::Capabilities::~Capabilities() = default;
+ OutputSurface::Capabilities::Capabilities(const Capabilities& capabilities) =
+@@ -94,6 +104,12 @@ bool IsDelegatedCompositingSupportedAndEnabled(
+   // Ensure we check the feature flag iff the feature is supported.
+   return features::IsDelegatedCompositingEnabled();
+ }
++
++bool IsBufferQueueSupportedAndEnabled(
++    OutputSurface::DCSupportLevel support_level) {
++  return support_level >= OutputSurface::DCSupportLevel::kDCompDynamicTexture &&
++         base::FeatureList::IsEnabled(kBufferQueue);
++}
+ #endif
+ 
+ }  // namespace viz
+diff --git a/components/viz/service/display/output_surface.h b/components/viz/service/display/output_surface.h
+index 25306ab6e18a266efdc329e4ddd81f5303033f4c..589f4c10dad9c807c9e3ce7baba63795b629435b 100644
+--- a/components/viz/service/display/output_surface.h
++++ b/components/viz/service/display/output_surface.h
+@@ -307,6 +307,9 @@ class VIZ_SERVICE_EXPORT OutputSurface {
+ // `features::IsDelegatedCompositingEnabled()`.
+ bool IsDelegatedCompositingSupportedAndEnabled(
+     OutputSurface::DCSupportLevel support_level);
++
++bool IsBufferQueueSupportedAndEnabled(
++    OutputSurface::DCSupportLevel support_level);
+ #endif
+ 
+ }  // namespace viz
+diff --git a/components/viz/service/display/skia_renderer.cc b/components/viz/service/display/skia_renderer.cc
+index e34e15dda13a183568fc3e186d3b89da1e828ad4..9b9a4c02c975799fe42b04f0d5b680274d28b09e 100644
+--- a/components/viz/service/display/skia_renderer.cc
++++ b/components/viz/service/display/skia_renderer.cc
+@@ -121,12 +121,6 @@ namespace {
+ BASE_FEATURE(kDumpWithoutCrashingOnMissingRenderPassBacking,
+              base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+-#if BUILDFLAG(IS_WIN)
+-// Use BufferQueue for the primary plane instead of a DXGI swap chain or DComp
+-// surface.
+-BASE_FEATURE(kBufferQueue, base::FEATURE_DISABLED_BY_DEFAULT);
+-#endif
+-
+ // Smallest unit that impacts anti-aliasing output. We use this to determine
+ // when an exterior edge (with AA) has been clipped (no AA). The specific value
+ // was chosen to match that used by gl_renderer.
+@@ -992,10 +986,8 @@ SkiaRenderer::SkiaRenderer(const RendererSettings* settings,
+ 
+   // It's possible to use BufferQueue with DComp textures, so we can optionally
+   // enable it behind a feature flag.
+-  const bool want_buffer_queue =
+-      output_surface_->capabilities().dc_support_level >=
+-          OutputSurface::DCSupportLevel::kDCompDynamicTexture &&
+-      base::FeatureList::IsEnabled(kBufferQueue);
++  const bool want_buffer_queue = IsBufferQueueSupportedAndEnabled(
++      output_surface_->capabilities().dc_support_level);
+ #else
+   const bool want_buffer_queue = true;
+ #endif

patches/chromium/viz_do_not_overallocate_surface_on_initial_render.patch

@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Niklas Wenzel <dev@nikwen.de>
+Date: Wed, 3 Dec 2025 17:08:55 +0100
+Subject: viz: Do not overallocate surface on initial render
+
+Manual backport of crrev.com/c/7129658
+
+Change-Id: I0baa5865dbe66efc7b0f3f793c8e89cdc6aaa0b6
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7129658
+Commit-Queue: Vasiliy Telezhnikov <vasilyt@chromium.org>
+Reviewed-by: Vasiliy Telezhnikov <vasilyt@chromium.org>
+Reviewed-by: Michael Tang <tangm@microsoft.com>
+Cr-Commit-Position: refs/heads/main@{#1544293}
+
+diff --git a/components/viz/service/display/direct_renderer.cc b/components/viz/service/display/direct_renderer.cc
+index c03a4b3db61371021a94128f698126b5fef2f577..01abf5d36e2e117acf6f9cdc91307c9ac5616453 100644
+--- a/components/viz/service/display/direct_renderer.cc
++++ b/components/viz/service/display/direct_renderer.cc
+@@ -1081,10 +1081,13 @@ gfx::Size DirectRenderer::CalculateTextureSizeForRenderPass(
+ // buffer area and number of reallocations to quantify the trade-off.
+ gfx::Size DirectRenderer::CalculateSizeForOutputSurface(
+     const gfx::Size& requested_viewport_size) {
++  const gfx::Size surface_size = surface_size_for_swap_buffers();
++
+   // We're not able to clip back buffers if output surface does not support
+-  // clipping.
+-  if (requested_viewport_size == surface_size_for_swap_buffers() ||
++  // clipping. We don't round on the initial frame when a window is first shown.
++  if (requested_viewport_size == surface_size ||
+       !output_surface_->capabilities().supports_viewporter ||
++      surface_size.IsZero() ||
+       settings_->dont_round_texture_sizes_for_pixel_tests) {
+     device_viewport_size_ = requested_viewport_size;
+     return requested_viewport_size;
+@@ -1102,8 +1105,8 @@ gfx::Size DirectRenderer::CalculateSizeForOutputSurface(
+   // allows backings to be more easily reused during a resize operation.
+   const int request_width = requested_viewport_size.width();
+   const int request_height = requested_viewport_size.height();
+-  int surface_width = surface_size_for_swap_buffers().width();
+-  int surface_height = surface_size_for_swap_buffers().height();
++  int surface_width = surface_size.width();
++  int surface_height = surface_size.height();
+   constexpr int multiple = 256;
+ 
+   // If |request_width| or |request_height| is already a multiple of |multiple|,

patches/chromium/viz_fix_visual_artifacts_due_to_resizing_root_render_pass_with_dcomp.patch

@@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Niklas Wenzel <dev@nikwen.de>
+Date: Thu, 20 Nov 2025 11:51:44 -0800
+Subject: viz: Fix visual artifacts due to resizing root render pass with DComp
+
+Backport of crrev.com/c/7156576
+
+Refs https://github.com/electron/electron/issues/36280#issuecomment-3560964534
+
+Bug: 457463689
+Change-Id: I7e00eadb2a1c3b44d64939d1a870d89befee158b
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7156576
+Reviewed-by: Vasiliy Telezhnikov <vasilyt@chromium.org>
+Reviewed-by: Jonathan Ross <jonross@chromium.org>
+Commit-Queue: Jonathan Ross <jonross@chromium.org>
+Reviewed-by: Michael Tang <tangm@microsoft.com>
+Cr-Commit-Position: refs/heads/main@{#1547987}
+
+diff --git a/components/viz/service/display_embedder/skia_output_device_dcomp.cc b/components/viz/service/display_embedder/skia_output_device_dcomp.cc
+index 81649eb59eb71ac950779af0f521a1f2a02e3add..7ac9ea1cdc4416a7af8dc2a75404cbc15be6cfad 100644
+--- a/components/viz/service/display_embedder/skia_output_device_dcomp.cc
++++ b/components/viz/service/display_embedder/skia_output_device_dcomp.cc
+@@ -39,6 +39,11 @@
+ namespace viz {
+ 
+ namespace {
++// With DirectComposition, resize surface based on root render pass size to
++// avoid gutter which shows stale pixels.
++BASE_FEATURE(kDirectCompositionResizeBasedOnRootSurface,
++             base::FEATURE_ENABLED_BY_DEFAULT);
++
+ base::TimeTicks g_last_reshape_failure = base::TimeTicks();
+ 
+ NOINLINE void CheckForLoopFailures() {
+@@ -155,6 +160,8 @@ SkiaOutputDeviceDComp::SkiaOutputDeviceDComp(
+   capabilities_.renderer_allocates_images = true;
+   capabilities_.supports_viewporter = presenter_->SupportsViewporter();
+   capabilities_.supports_non_backed_solid_color_overlays = true;
++  capabilities_.resize_based_on_root_surface =
++      base::FeatureList::IsEnabled(kDirectCompositionResizeBasedOnRootSurface);
+ 
+   DCHECK(context_state_);
+   DCHECK(context_state_->gr_context() ||

patches/chromium/viz_fix_visual_artifacts_while_resizing_window_with_dcomp.patch

@@ -0,0 +1,122 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Niklas Wenzel <dev@nikwen.de>
+Date: Wed, 3 Dec 2025 17:42:58 +0100
+Subject: viz: Fix visual artifacts while resizing window with DComp
+
+Manual backport of crrev.com/c/7115438
+
+Bug: 457463689
+Change-Id: I9c684effe15e0b112ae533faa243e5a035e9c875
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7115438
+Commit-Queue: David Sanders <dsanders11@ucsbalum.com>
+Reviewed-by: Michael Tang <tangm@microsoft.com>
+Reviewed-by: Vasiliy Telezhnikov <vasilyt@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1553192}
+
+diff --git a/components/viz/service/display/direct_renderer.cc b/components/viz/service/display/direct_renderer.cc
+index 01abf5d36e2e117acf6f9cdc91307c9ac5616453..7e45d9ea46d0d4095169daf748e20c98db21969d 100644
+--- a/components/viz/service/display/direct_renderer.cc
++++ b/components/viz/service/display/direct_renderer.cc
+@@ -243,6 +243,31 @@ void DirectRenderer::DrawFrame(
+   current_frame()->device_viewport_size = device_viewport_size;
+   current_frame()->display_color_spaces = display_color_spaces;
+ 
++  gfx::Size surface_resource_size =
++      CalculateSizeForOutputSurface(device_viewport_size);
++
++#if BUILDFLAG(IS_WIN)
++  if (output_surface_->capabilities().clear_drawn_areas_outside_viewport &&
++      device_viewport_size != surface_resource_size) {
++    // On Windows with DirectComposition, we cannot synchronize the swap chain
++    // |Present| and the DComp |Commit| calls to take effect at the same time.
++    // (Both take effect asynchronously.) Hence, presenting a frame and changing
++    // the DComp layer clip rect can happen at different times. This can lead to
++    // ugly visual artifacts while resizing the window because it can reveal
++    // areas of the surface that are outside the viewport (crbug.com/457463689).
++    // To prevent those artifacts, we clear areas outside of the viewport with a
++    // transparent color. Transparency is expensive, so we use it only while
++    // resizing.
++    // This line gives us a transparent image format and triggers the background
++    // to be cleared in |SkiaRenderer::ClearFramebuffer|.
++    root_render_pass->has_transparent_background = true;
++    // Redraw and swap the whole surface.
++    root_render_pass->output_rect = gfx::Rect(surface_resource_size);
++    current_frame()->root_damage_rect = gfx::Rect(surface_resource_size);
++    current_frame()->device_viewport_size = surface_resource_size;
++  }
++#endif
++
+   output_surface_->SetNeedsMeasureNextDrawLatency();
+   BeginDrawingFrame();
+ 
+@@ -274,8 +299,6 @@ void DirectRenderer::DrawFrame(
+       current_frame()->display_color_spaces.GetOutputBufferFormat(
+           current_frame()->root_render_pass->content_color_usage,
+           frame_has_alpha));
+-  gfx::Size surface_resource_size =
+-      CalculateSizeForOutputSurface(device_viewport_size);
+   if (overlay_processor_) {
+     // Display transform and viewport size are needed for overlay validator on
+     // Android SurfaceControl, and viewport size is need on Windows. These need
+@@ -397,8 +420,10 @@ void DirectRenderer::DrawFrame(
+ 
+   // If we need to redraw the frame, the whole output should be considered
+   // damaged.
+-  if (needs_full_frame_redraw)
+-    current_frame()->root_damage_rect = gfx::Rect(device_viewport_size);
++  if (needs_full_frame_redraw) {
++    current_frame()->root_damage_rect =
++        gfx::Rect(current_frame()->device_viewport_size);
++  }
+ 
+   if (!skip_drawing_root_render_pass) {
+     DrawRenderPassAndExecuteCopyRequests(root_render_pass);
+diff --git a/components/viz/service/display/output_surface.h b/components/viz/service/display/output_surface.h
+index 589f4c10dad9c807c9e3ce7baba63795b629435b..641bbfc732c88141ddd929a4c334360462259ee4 100644
+--- a/components/viz/service/display/output_surface.h
++++ b/components/viz/service/display/output_surface.h
+@@ -106,6 +106,11 @@ class VIZ_SERVICE_EXPORT OutputSurface {
+ #if BUILDFLAG(IS_WIN)
+     // Whether this OutputSurface supports direct composition layers.
+     DCSupportLevel dc_support_level = DCSupportLevel::kNone;
++    // Whether to 1) clear all drawn areas outside the viewport with a
++    // transparent background color when drawing a frame and 2) swap them. This
++    // is necessary if the surface clip rect can get out of sync with the
++    // viewport size (e.g., due to a race condition).
++    bool clear_drawn_areas_outside_viewport = false;
+ #endif
+     // Whether this OutputSurface should skip DrawAndSwap(). This is true for
+     // the unified display on Chrome OS. All drawing is handled by the physical
+diff --git a/components/viz/service/display_embedder/skia_output_device_dcomp.cc b/components/viz/service/display_embedder/skia_output_device_dcomp.cc
+index 7ac9ea1cdc4416a7af8dc2a75404cbc15be6cfad..8e027d1382c5d639c1e114b8e25b6cea3af3445d 100644
+--- a/components/viz/service/display_embedder/skia_output_device_dcomp.cc
++++ b/components/viz/service/display_embedder/skia_output_device_dcomp.cc
+@@ -39,10 +39,8 @@
+ namespace viz {
+ 
+ namespace {
+-// With DirectComposition, resize surface based on root render pass size to
+-// avoid gutter which shows stale pixels.
+-BASE_FEATURE(kDirectCompositionResizeBasedOnRootSurface,
+-             base::FEATURE_ENABLED_BY_DEFAULT);
++// Apply fixes for crbug.com/457463689.
++BASE_FEATURE(kDirectCompositionResizeFixes, base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+ base::TimeTicks g_last_reshape_failure = base::TimeTicks();
+ 
+@@ -161,7 +159,14 @@ SkiaOutputDeviceDComp::SkiaOutputDeviceDComp(
+   capabilities_.supports_viewporter = presenter_->SupportsViewporter();
+   capabilities_.supports_non_backed_solid_color_overlays = true;
+   capabilities_.resize_based_on_root_surface =
+-      base::FeatureList::IsEnabled(kDirectCompositionResizeBasedOnRootSurface);
++      base::FeatureList::IsEnabled(kDirectCompositionResizeFixes);
++  // With delegated compositing or a buffer queue, |Present| and |Commit| are
++  // synchronized and the clear is not needed.
++  capabilities_.clear_drawn_areas_outside_viewport =
++      base::FeatureList::IsEnabled(kDirectCompositionResizeFixes) &&
++      !IsDelegatedCompositingSupportedAndEnabled(
++          capabilities_.dc_support_level) &&
++      !IsBufferQueueSupportedAndEnabled(capabilities_.dc_support_level);
+ 
+   DCHECK(context_state_);
+   DCHECK(context_state_->gr_context() ||

patches/config.json

@@ -12,5 +12,6 @@
   { "patch_dir": "src/electron/patches/ReactiveObjC", "repo": "src/third_party/squirrel.mac/vendor/ReactiveObjC" },
   { "patch_dir": "src/electron/patches/webrtc", "repo": "src/third_party/webrtc" },
   { "patch_dir": "src/electron/patches/reclient-configs", "repo": "src/third_party/engflow-reclient-configs" },
-  { "patch_dir": "src/electron/patches/sqlite", "repo": "src/third_party/sqlite/src" }
+  { "patch_dir": "src/electron/patches/sqlite", "repo": "src/third_party/sqlite/src" },
+  { "patch_dir": "src/electron/patches/skia", "repo": "src/third_party/skia" }
 ]

patches/devtools_frontend/.patches

@@ -1 +1,2 @@
 chore_expose_ui_to_allow_electron_to_set_dock_side.patch
+fix_element_tree_flickering_with_node_inspection.patch

patches/devtools_frontend/fix_element_tree_flickering_with_node_inspection.patch

@@ -0,0 +1,107 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alex Rudenko <alexrudenko@chromium.org>
+Date: Thu, 20 Nov 2025 11:18:30 +0100
+Subject: Fix element tree flickering with node inspection
+
+Regressed in https://crrev.com/c/6888910. The highlighting in the tree
+outline emits the INSPECT_MODE_WILL_BE_TOGGLED on the overlay model
+causing the tree to clear the highlight immediately. This CL
+recovers the logic missed in the https://crrev.com/c/6888910
+to prevent re-entrancy during highlighting.
+
+Fixed: 462120622
+Change-Id: I08af098f7a142085c2fb16511031855623e07c4b
+Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/7170551
+Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
+Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
+Auto-Submit: Alex Rudenko <alexrudenko@chromium.org>
+
+diff --git a/front_end/panels/elements/DOMTreeWidget.test.ts b/front_end/panels/elements/DOMTreeWidget.test.ts
+index 43ae133087a61c47c84349c7550485bd52b23847..d83fddd7afc1871b8064631d63c1b6b1e5357b70 100644
+--- a/front_end/panels/elements/DOMTreeWidget.test.ts
++++ b/front_end/panels/elements/DOMTreeWidget.test.ts
+@@ -24,6 +24,7 @@ describeWithMockConnection('DOMTreeWidget', () => {
+         elementsTreeOutline,
+         alreadyExpandedParentTreeElement: null,
+         highlightedTreeElement: null,
++        isUpdatingHighlights: false,
+       });
+       const domTree = new Elements.ElementsTreeOutline.DOMTreeWidget(undefined, view);
+       domTree.performUpdate();
+diff --git a/front_end/panels/elements/ElementsTreeOutline.ts b/front_end/panels/elements/ElementsTreeOutline.ts
+index bd8093e1c0961648e782234ed5826273d6ace6d9..c6c8d9d29a84f872126ca0b7c847dffe08c285ad 100644
+--- a/front_end/panels/elements/ElementsTreeOutline.ts
++++ b/front_end/panels/elements/ElementsTreeOutline.ts
+@@ -105,6 +105,7 @@ interface ViewInput {
+ interface ViewOutput {
+   elementsTreeOutline?: ElementsTreeOutline;
+   highlightedTreeElement: ElementsTreeElement|null;
++  isUpdatingHighlights: boolean;
+   alreadyExpandedParentTreeElement: ElementsTreeElement|null;
+ }
+ 
+@@ -136,6 +137,7 @@ export const DEFAULT_VIEW = (input: ViewInput, output: ViewOutput, target: HTMLE
+   // Node highlighting logic. FIXME: express as a lit template.
+   const previousHighlightedNode = output.highlightedTreeElement?.node() ?? null;
+   if (previousHighlightedNode !== input.currentHighlightedNode) {
++    output.isUpdatingHighlights = true;
+     let treeElement: ElementsTreeElement|null = null;
+ 
+     if (output.highlightedTreeElement) {
+@@ -173,6 +175,7 @@ export const DEFAULT_VIEW = (input: ViewInput, output: ViewOutput, target: HTMLE
+     output.highlightedTreeElement = treeElement;
+     output.elementsTreeOutline.setHoverEffect(treeElement);
+     treeElement?.reveal(true);
++    output.isUpdatingHighlights = false;
+   }
+ };
+ 
+@@ -225,6 +228,7 @@ export class DOMTreeWidget extends UI.Widget.Widget {
+   #viewOutput: ViewOutput = {
+     highlightedTreeElement: null,
+     alreadyExpandedParentTreeElement: null,
++    isUpdatingHighlights: false,
+   };
+   #highlightThrottler = new Common.Throttler.Throttler(100);
+ 
+@@ -239,8 +243,8 @@ export class DOMTreeWidget extends UI.Widget.Widget {
+           SDK.OverlayModel.OverlayModel, SDK.OverlayModel.Events.HIGHLIGHT_NODE_REQUESTED, this.#highlightNode, this,
+           {scoped: true});
+       SDK.TargetManager.TargetManager.instance().addModelListener(
+-          SDK.OverlayModel.OverlayModel, SDK.OverlayModel.Events.INSPECT_MODE_WILL_BE_TOGGLED, this.#clearState, this,
+-          {scoped: true});
++          SDK.OverlayModel.OverlayModel, SDK.OverlayModel.Events.INSPECT_MODE_WILL_BE_TOGGLED,
++          this.#clearHighlightedNode, this, {scoped: true});
+     }
+   }
+ 
+@@ -251,7 +255,13 @@ export class DOMTreeWidget extends UI.Widget.Widget {
+     });
+   }
+ 
+-  #clearState(): void {
++  #clearHighlightedNode(): void {
++    // Highlighting an element via tree outline will emit the
++    // INSPECT_MODE_WILL_BE_TOGGLED event, therefore, we skip it if the view
++    // informed us that it is updating the element.
++    if (this.#viewOutput.isUpdatingHighlights) {
++      return;
++    }
+     this.#currentHighlightedNode = null;
+     this.requestUpdate();
+   }
+@@ -305,11 +315,11 @@ export class DOMTreeWidget extends UI.Widget.Widget {
+           currentHighlightedNode: this.#currentHighlightedNode,
+           onElementsTreeUpdated: this.onElementsTreeUpdated.bind(this),
+           onSelectedNodeChanged: event => {
+-            this.#clearState();
++            this.#clearHighlightedNode();
+             this.onSelectedNodeChanged(event);
+           },
+-          onElementCollapsed: this.#clearState.bind(this),
+-          onElementExpanded: this.#clearState.bind(this),
++          onElementCollapsed: this.#clearHighlightedNode.bind(this),
++          onElementExpanded: this.#clearHighlightedNode.bind(this),
+         },
+         this.#viewOutput, this.contentElement);
+   }

patches/node/.patches

@@ -54,3 +54,6 @@ fix_redefined_macos_sdk_header_symbols.patch
 src_use_cp_utf8_for_wide_file_names_on_win32.patch
 fix_ensure_traverseparent_bails_on_resource_path_exit.patch
 src_handle_der_decoding_errors_from_system_certificates.patch
+remove_obsolete_noarraybufferzerofillscope.patch
+src_prepare_for_v8_sandboxing.patch
+test_correct_conditional_secure_heap_flags_test.patch

patches/node/api_remove_deprecated_getisolate.patch

@@ -6,10 +6,10 @@ Subject: Remove deprecated `GetIsolate`
 https://chromium-review.googlesource.com/c/v8/v8/+/6905244
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 8e227ddd1be50c046a8cf2895a31d607eb7d31de..82f53bba29613de212f64be440ca20d7c630fddf 100644
+index ceac508418f489a8077c1bc85a2feaf85bf60480..33827edce63c9fe08b52aea59571391a83853443 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -654,7 +654,7 @@ std::unique_ptr<MultiIsolatePlatform> MultiIsolatePlatform::Create(
+@@ -646,7 +646,7 @@ std::unique_ptr<MultiIsolatePlatform> MultiIsolatePlatform::Create(
  
  MaybeLocal<Object> GetPerContextExports(Local<Context> context,
                                          IsolateData* isolate_data) {
@@ -18,7 +18,7 @@ index 8e227ddd1be50c046a8cf2895a31d607eb7d31de..82f53bba29613de212f64be440ca20d7
    EscapableHandleScope handle_scope(isolate);
  
    Local<Object> global = context->Global();
-@@ -700,7 +700,7 @@ void ProtoThrower(const FunctionCallbackInfo<Value>& info) {
+@@ -692,7 +692,7 @@ void ProtoThrower(const FunctionCallbackInfo<Value>& info) {
  // This runs at runtime, regardless of whether the context
  // is created from a snapshot.
  Maybe<void> InitializeContextRuntime(Local<Context> context) {
@@ -27,7 +27,7 @@ index 8e227ddd1be50c046a8cf2895a31d607eb7d31de..82f53bba29613de212f64be440ca20d7
    HandleScope handle_scope(isolate);
  
    // When `IsCodeGenerationFromStringsAllowed` is true, V8 takes the fast path
-@@ -779,7 +779,7 @@ Maybe<void> InitializeContextRuntime(Local<Context> context) {
+@@ -771,7 +771,7 @@ Maybe<void> InitializeContextRuntime(Local<Context> context) {
  }
  
  Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
@@ -36,7 +36,7 @@ index 8e227ddd1be50c046a8cf2895a31d607eb7d31de..82f53bba29613de212f64be440ca20d7
    HandleScope handle_scope(isolate);
  
    // Delete `Intl.v8BreakIterator`
-@@ -804,7 +804,7 @@ Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
+@@ -796,7 +796,7 @@ Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
  }
  
  Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
@@ -45,7 +45,7 @@ index 8e227ddd1be50c046a8cf2895a31d607eb7d31de..82f53bba29613de212f64be440ca20d7
    HandleScope handle_scope(isolate);
  
    // Initialize the default values.
-@@ -822,7 +822,7 @@ Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
+@@ -814,7 +814,7 @@ Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
  MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
                                              IsolateData* isolate_data) {
    CHECK(isolate_data);
@@ -54,7 +54,7 @@ index 8e227ddd1be50c046a8cf2895a31d607eb7d31de..82f53bba29613de212f64be440ca20d7
    EscapableHandleScope scope(isolate);
    Context::Scope context_scope(context);
  
-@@ -846,7 +846,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
+@@ -838,7 +838,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
  MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
                                                 IsolateData* isolate_data) {
    CHECK(isolate_data);
@@ -63,7 +63,7 @@ index 8e227ddd1be50c046a8cf2895a31d607eb7d31de..82f53bba29613de212f64be440ca20d7
    EscapableHandleScope scope(isolate);
    Context::Scope context_scope(context);
  
-@@ -872,7 +872,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
+@@ -864,7 +864,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
  Maybe<void> InitializePrimordials(Local<Context> context,
                                    IsolateData* isolate_data) {
    // Run per-context JS files.
@@ -508,10 +508,10 @@ index 492d5f455f45a5c8a957ecdabed38709a633f640..48f9917113555c7ed87e37750c45d152
    Local<Array> keys;
    if (!entries->GetOwnPropertyNames(context).ToLocal(&keys))
 diff --git a/src/node_errors.cc b/src/node_errors.cc
-index 4386a1bc5678e351ce084cd2c47202561619b164..8d51201ad24999ed8f54e16c7878432d41841cf2 100644
+index 36a21b9523351fe2f225ffe7fca184d737640b62..c6e9e2c00064348c435ae10871a4013cb49376e6 100644
 --- a/src/node_errors.cc
 +++ b/src/node_errors.cc
-@@ -633,7 +633,7 @@ v8::ModifyCodeGenerationFromStringsResult ModifyCodeGenerationFromStrings(
+@@ -631,7 +631,7 @@ v8::ModifyCodeGenerationFromStringsResult ModifyCodeGenerationFromStrings(
      v8::Local<v8::Context> context,
      v8::Local<v8::Value> source,
      bool is_code_like) {
@@ -520,7 +520,7 @@ index 4386a1bc5678e351ce084cd2c47202561619b164..8d51201ad24999ed8f54e16c7878432d
  
    if (context->GetNumberOfEmbedderDataFields() <=
        ContextEmbedderIndex::kAllowCodeGenerationFromStrings) {
-@@ -1000,7 +1000,7 @@ const char* errno_string(int errorno) {
+@@ -1037,7 +1037,7 @@ const char* errno_string(int errorno) {
  }
  
  void PerIsolateMessageListener(Local<Message> message, Local<Value> error) {
@@ -529,7 +529,7 @@ index 4386a1bc5678e351ce084cd2c47202561619b164..8d51201ad24999ed8f54e16c7878432d
    switch (message->ErrorLevel()) {
      case Isolate::MessageErrorLevel::kMessageWarning: {
        Environment* env = Environment::GetCurrent(isolate);
-@@ -1161,7 +1161,7 @@ void Initialize(Local<Object> target,
+@@ -1198,7 +1198,7 @@ void Initialize(Local<Object> target,
    SetMethod(
        context, target, "getErrorSourcePositions", GetErrorSourcePositions);
  
@@ -640,7 +640,7 @@ index 66a8ee48fc68b22eaf6c9d9209cc5cb2439e55ff..b31e244f8af7d37c35319853a478776c
    env->AssignToContext(context, this, ContextInfo(""));
  }
 diff --git a/src/node_report.cc b/src/node_report.cc
-index 8ff711f12e19f73e50daac2b9c0fd26773d32758..6966710e8f0be542364850776ddf76f9223a02e7 100644
+index e1f4e30417d17f85d2294f3a01e6d90f0a443948..12a59307b452b0d67ebe909cae0458b8a0ca085b 100644
 --- a/src/node_report.cc
 +++ b/src/node_report.cc
 @@ -399,7 +399,7 @@ static void PrintJavaScriptErrorProperties(JSONWriter* writer,

patches/node/chore_allow_the_node_entrypoint_to_be_a_builtin_module.patch

@@ -8,10 +8,10 @@ they use themselves as the entry point. We should try to upstream some form
 of this.
 
 diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
-index d12d21905c4823f45cffeea4423e99e81b1008f5..4987cd3f6c9eefb440bca3f58113df6cd5b410ac 100644
+index 15443a710ccf53fae333da3b1fbb52a970c658d5..464b34829c1a566836bfca6bbc2b87fcf5e50016 100644
 --- a/lib/internal/process/pre_execution.js
 +++ b/lib/internal/process/pre_execution.js
-@@ -267,12 +267,14 @@ function patchProcessObject(expandArgv1) {
+@@ -265,12 +265,14 @@ function patchProcessObject(expandArgv1) {
    // the entry point.
    if (expandArgv1 && process.argv[1] && process.argv[1][0] !== '-') {
      // Expand process.argv[1] into a full path.

patches/node/fix_remove_deprecated_errno_constants.patch

@@ -86,10 +86,10 @@ index 0ca643aa74d13f278685d2330b791182b55c15b4..cbcecfba33070b820aca0e2814982160
    NODE_DEFINE_CONSTANT(target, ETIMEDOUT);
  #endif
 diff --git a/src/node_errors.cc b/src/node_errors.cc
-index ae8553ee2022d60fea4572976b14ba9cd253aa45..4386a1bc5678e351ce084cd2c47202561619b164 100644
+index 238942d45a136facec55ca5a2534e2dc407137e9..36a21b9523351fe2f225ffe7fca184d737640b62 100644
 --- a/src/node_errors.cc
 +++ b/src/node_errors.cc
-@@ -862,10 +862,6 @@ const char* errno_string(int errorno) {
+@@ -899,10 +899,6 @@ const char* errno_string(int errorno) {
      ERRNO_CASE(ENOBUFS);
  #endif
  
@@ -100,7 +100,7 @@ index ae8553ee2022d60fea4572976b14ba9cd253aa45..4386a1bc5678e351ce084cd2c4720256
  #ifdef ENODEV
      ERRNO_CASE(ENODEV);
  #endif
-@@ -904,14 +900,6 @@ const char* errno_string(int errorno) {
+@@ -941,14 +937,6 @@ const char* errno_string(int errorno) {
      ERRNO_CASE(ENOSPC);
  #endif
  
@@ -115,7 +115,7 @@ index ae8553ee2022d60fea4572976b14ba9cd253aa45..4386a1bc5678e351ce084cd2c4720256
  #ifdef ENOSYS
      ERRNO_CASE(ENOSYS);
  #endif
-@@ -994,10 +982,6 @@ const char* errno_string(int errorno) {
+@@ -1031,10 +1019,6 @@ const char* errno_string(int errorno) {
      ERRNO_CASE(ESTALE);
  #endif
  

patches/node/fix_remove_fastapitypedarray_usage.patch

@@ -48,7 +48,7 @@ index fe669d40c31a29334b047b9cfee3067f64ef0a7b..9e5de7bbe574add017cd12ee091304d0
  
  static CFunction fast_timing_safe_equal(CFunction::Make(FastTimingSafeEqual));
 diff --git a/src/node_buffer.cc b/src/node_buffer.cc
-index e39852c8e0392e0a9ae5d4ea58be115416e19233..c94b14741c827a81d69a6f036426a344e563ad72 100644
+index b9f0c97938203b4652780a7d707c5e83319330b0..8a5b6b57321c2843a965a7e51b2ebed991a1e424 100644
 --- a/src/node_buffer.cc
 +++ b/src/node_buffer.cc
 @@ -44,6 +44,14 @@
@@ -74,7 +74,7 @@ index e39852c8e0392e0a9ae5d4ea58be115416e19233..c94b14741c827a81d69a6f036426a344
  using v8::FunctionCallbackInfo;
  using v8::Global;
  using v8::HandleScope;
-@@ -584,19 +591,24 @@ void SlowCopy(const FunctionCallbackInfo<Value>& args) {
+@@ -583,19 +590,24 @@ void SlowCopy(const FunctionCallbackInfo<Value>& args) {
  
  // Assume caller has properly validated args.
  uint32_t FastCopy(Local<Value> receiver,
@@ -107,7 +107,7 @@ index e39852c8e0392e0a9ae5d4ea58be115416e19233..c94b14741c827a81d69a6f036426a344
    return to_copy;
  }
  
-@@ -865,19 +877,17 @@ void Compare(const FunctionCallbackInfo<Value> &args) {
+@@ -864,19 +876,17 @@ void Compare(const FunctionCallbackInfo<Value> &args) {
  }
  
  int32_t FastCompare(v8::Local<v8::Value>,
@@ -135,7 +135,7 @@ index e39852c8e0392e0a9ae5d4ea58be115416e19233..c94b14741c827a81d69a6f036426a344
  }
  
  static v8::CFunction fast_compare(v8::CFunction::Make(FastCompare));
-@@ -1149,14 +1159,13 @@ void SlowIndexOfNumber(const FunctionCallbackInfo<Value>& args) {
+@@ -1148,14 +1158,13 @@ void SlowIndexOfNumber(const FunctionCallbackInfo<Value>& args) {
  }
  
  int32_t FastIndexOfNumber(v8::Local<v8::Value>,
@@ -153,7 +153,7 @@ index e39852c8e0392e0a9ae5d4ea58be115416e19233..c94b14741c827a81d69a6f036426a344
  }
  
  static v8::CFunction fast_index_of_number(
-@@ -1496,21 +1505,31 @@ void SlowWriteString(const FunctionCallbackInfo<Value>& args) {
+@@ -1510,21 +1519,31 @@ void SlowWriteString(const FunctionCallbackInfo<Value>& args) {
  
  template <encoding encoding>
  uint32_t FastWriteString(Local<Value> receiver,

patches/node/fix_replace_deprecated_setprototype.patch

@@ -9,10 +9,10 @@ This is already applied in newer versions of Node so we can drop
 this patch once we upgrade to v23.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 0a358735c331767e8eb563a80e9aaccfb544c27b..d7d18d5fcbf008ac131db189a141315af4f6410b 100644
+index 79327877b0f34cbafb3efcc21617027d4011f806..8a12475857135bd3e904610b7eb887c397c8e73c 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -835,7 +835,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
+@@ -827,7 +827,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
  
    Local<Object> private_symbols_object;
    if (!private_symbols->NewInstance(context).ToLocal(&private_symbols_object) ||
@@ -21,7 +21,7 @@ index 0a358735c331767e8eb563a80e9aaccfb544c27b..d7d18d5fcbf008ac131db189a141315a
            .IsNothing()) {
      return MaybeLocal<Object>();
    }
-@@ -861,7 +861,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
+@@ -853,7 +853,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
    Local<Object> per_isolate_symbols_object;
    if (!per_isolate_symbols->NewInstance(context).ToLocal(
            &per_isolate_symbols_object) ||

patches/node/refactor_attach_cppgc_heap_on_v8_isolate_creation.patch

@@ -18,10 +18,10 @@ This can be removed when Node.js upgrades to a version of V8 containing CLs
 from the above issue.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index cb37fa080fc8e8d524cfa2758c4a8c2c5652324d..8e227ddd1be50c046a8cf2895a31d607eb7d31de 100644
+index fd71ceac65ccef1d2832b45b0b5612877cee22c1..ceac508418f489a8077c1bc85a2feaf85bf60480 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -316,6 +316,10 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
+@@ -308,6 +308,10 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
                      MultiIsolatePlatform* platform,
                      const SnapshotData* snapshot_data,
                      const IsolateSettings& settings) {
@@ -32,7 +32,7 @@ index cb37fa080fc8e8d524cfa2758c4a8c2c5652324d..8e227ddd1be50c046a8cf2895a31d607
    Isolate* isolate = Isolate::Allocate();
    if (isolate == nullptr) return nullptr;
  
-@@ -359,9 +363,12 @@ Isolate* NewIsolate(ArrayBufferAllocator* allocator,
+@@ -351,9 +355,12 @@ Isolate* NewIsolate(ArrayBufferAllocator* allocator,
                      uv_loop_t* event_loop,
                      MultiIsolatePlatform* platform,
                      const EmbedderSnapshotData* snapshot_data,

patches/node/remove_obsolete_noarraybufferzerofillscope.patch

@@ -0,0 +1,653 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Robo <hop2deep@gmail.com>
+Date: Wed, 21 Jan 2026 09:53:15 +0000
+Subject: remove obsolete NoArrayBufferZeroFillScope
+
+Replace the scope in favor of the V8 api added in
+https://chromium-review.googlesource.com/c/v8/v8/+/5679067
+
+Ports changes from
+1) https://github.com/nodejs/node/commit/869ea331f3a8215229290e2e6038956874c382a6
+2) https://github.com/nodejs/node/commit/ef9dc0857a73610f5de5dc9f37afd0a927c4c17f
+3) partially from https://github.com/nodejs/node/commit/e0a71517fef4ca83f2d40d2d1600022bc82a7f9f
+
+This is needed to remove dependency on the zero_fill_field_
+that is exposed to JS
+Refs https://github.com/nodejs/node/commit/3cdb1cd437f63dd256ae2ab3b7e9016257326cb4
+
+diff --git a/src/api/environment.cc b/src/api/environment.cc
+index 8a12475857135bd3e904610b7eb887c397c8e73c..3702672f4e2c3b1bff9f9f5c66ca251af447826a 100644
+--- a/src/api/environment.cc
++++ b/src/api/environment.cc
+@@ -107,11 +107,7 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,
+ }
+ 
+ void* NodeArrayBufferAllocator::Allocate(size_t size) {
+-  void* ret;
+-  if (zero_fill_field_ || per_process::cli_options->zero_fill_all_buffers)
+-    ret = allocator_->Allocate(size);
+-  else
+-    ret = allocator_->AllocateUninitialized(size);
++  void* ret = allocator_->Allocate(size);
+   if (ret != nullptr) [[likely]] {
+     total_mem_usage_.fetch_add(size, std::memory_order_relaxed);
+   }
+diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
+index c00d3616e08b00b1e0a3a29b2dbb5278e1e14fcc..8939c5e5085d00b098f66074b9ee033f5be55d08 100644
+--- a/src/crypto/crypto_cipher.cc
++++ b/src/crypto/crypto_cipher.cc
+@@ -20,6 +20,7 @@ using ncrypto::SSLPointer;
+ using v8::Array;
+ using v8::ArrayBuffer;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::Context;
+ using v8::FunctionCallbackInfo;
+ using v8::FunctionTemplate;
+@@ -774,10 +775,10 @@ CipherBase::UpdateResult CipherBase::Update(
+     return kErrorState;
+   }
+ 
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env()->isolate_data());
+-    *out = ArrayBuffer::NewBackingStore(env()->isolate(), buf_len);
+-  }
++  *out = ArrayBuffer::NewBackingStore(
++      env()->isolate(),
++      buf_len,
++      BackingStoreInitializationMode::kUninitialized);
+ 
+   buffer = {
+       .data = reinterpret_cast<const unsigned char*>(data),
+@@ -852,11 +853,10 @@ bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
+ 
+   const int mode = ctx_.getMode();
+ 
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env()->isolate_data());
+-    *out = ArrayBuffer::NewBackingStore(
+-        env()->isolate(), static_cast<size_t>(ctx_.getBlockSize()));
+-  }
++  *out = ArrayBuffer::NewBackingStore(
++      env()->isolate(),
++      static_cast<size_t>(ctx_.getBlockSize()),
++      BackingStoreInitializationMode::kUninitialized);
+ 
+   if (kind_ == kDecipher &&
+       Cipher::FromCtx(ctx_).isSupportedAuthenticatedMode()) {
+@@ -972,10 +972,10 @@ bool PublicKeyCipher::Cipher(
+     return false;
+   }
+ 
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    *out = ArrayBuffer::NewBackingStore(env->isolate(), out_len);
+-  }
++  *out = ArrayBuffer::NewBackingStore(
++      env->isolate(),
++      out_len,
++      BackingStoreInitializationMode::kUninitialized);
+ 
+   if (EVP_PKEY_cipher(
+           ctx.get(),
+diff --git a/src/crypto/crypto_common.cc b/src/crypto/crypto_common.cc
+index b81b9005365272217c77e2b9289bd9f877c0e77c..185b1d8fe657b5db64dc92497ca742d69f7a2764 100644
+--- a/src/crypto/crypto_common.cc
++++ b/src/crypto/crypto_common.cc
+@@ -37,6 +37,7 @@ using ncrypto::X509Pointer;
+ using ncrypto::X509View;
+ using v8::ArrayBuffer;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::Context;
+ using v8::EscapableHandleScope;
+ using v8::Integer;
+@@ -307,11 +308,10 @@ MaybeLocal<Object> ECPointToBuffer(Environment* env,
+     return MaybeLocal<Object>();
+   }
+ 
+-  std::unique_ptr<BackingStore> bs;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs = ArrayBuffer::NewBackingStore(env->isolate(), len);
+-  }
++  std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
++      env->isolate(),
++      len,
++      BackingStoreInitializationMode::kUninitialized);
+ 
+   len = EC_POINT_point2oct(group,
+                            point,
+diff --git a/src/crypto/crypto_ec.cc b/src/crypto/crypto_ec.cc
+index 2a3107dbbf5c0dfe70c2e105338d186e5620ddbf..f36c84a77313bd57d0a7a902d1a2529636ca1422 100644
+--- a/src/crypto/crypto_ec.cc
++++ b/src/crypto/crypto_ec.cc
+@@ -29,6 +29,7 @@ using ncrypto::MarkPopErrorOnReturn;
+ using v8::Array;
+ using v8::ArrayBuffer;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::Context;
+ using v8::FunctionCallbackInfo;
+ using v8::FunctionTemplate;
+@@ -201,14 +202,10 @@ void ECDH::ComputeSecret(const FunctionCallbackInfo<Value>& args) {
+     return;
+   }
+ 
+-  std::unique_ptr<BackingStore> bs;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    // NOTE: field_size is in bits
+-    int field_size = EC_GROUP_get_degree(ecdh->group_);
+-    size_t out_len = (field_size + 7) / 8;
+-    bs = ArrayBuffer::NewBackingStore(env->isolate(), out_len);
+-  }
++  int field_size = EC_GROUP_get_degree(ecdh->group_);
++  size_t out_len = (field_size + 7) / 8;
++  auto bs = ArrayBuffer::NewBackingStore(
++      env->isolate(), out_len, BackingStoreInitializationMode::kUninitialized);
+ 
+   if (!ECDH_compute_key(
+           bs->Data(), bs->ByteLength(), pub, ecdh->key_.get(), nullptr))
+@@ -257,12 +254,10 @@ void ECDH::GetPrivateKey(const FunctionCallbackInfo<Value>& args) {
+     return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+         "Failed to get ECDH private key");
+ 
+-  std::unique_ptr<BackingStore> bs;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs = ArrayBuffer::NewBackingStore(env->isolate(),
+-                                      BignumPointer::GetByteCount(b));
+-  }
++  auto bs = ArrayBuffer::NewBackingStore(
++      env->isolate(),
++      BignumPointer::GetByteCount(b),
++      BackingStoreInitializationMode::kUninitialized);
+   CHECK_EQ(bs->ByteLength(),
+            BignumPointer::EncodePaddedInto(
+                b, static_cast<unsigned char*>(bs->Data()), bs->ByteLength()));
+diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
+index 1f2fccce6ed8f14525557644e0bdd130eedf3337..1099a8f89bb53083f01942ee14fff453d8cdc0af 100644
+--- a/src/crypto/crypto_rsa.cc
++++ b/src/crypto/crypto_rsa.cc
+@@ -20,6 +20,7 @@ using ncrypto::EVPKeyPointer;
+ using ncrypto::RSAPointer;
+ using v8::ArrayBuffer;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::FunctionCallbackInfo;
+ using v8::Int32;
+ using v8::JustVoid;
+@@ -535,12 +536,10 @@ Maybe<void> GetRsaKeyDetail(Environment* env,
+     return Nothing<void>();
+   }
+ 
+-  std::unique_ptr<BackingStore> public_exponent;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    public_exponent = ArrayBuffer::NewBackingStore(
+-        env->isolate(), BignumPointer::GetByteCount(e));
+-  }
++  auto public_exponent = ArrayBuffer::NewBackingStore(
++      env->isolate(),
++      BignumPointer::GetByteCount(e),
++      BackingStoreInitializationMode::kUninitialized);
+   CHECK_EQ(BignumPointer::EncodePaddedInto(
+                e,
+                static_cast<unsigned char*>(public_exponent->Data()),
+diff --git a/src/crypto/crypto_sig.cc b/src/crypto/crypto_sig.cc
+index 2f6e683e3497d4315259773d09443e5215bff28f..c33e93c34ef32c18e6de6bc03698ed6b851b4aa3 100644
+--- a/src/crypto/crypto_sig.cc
++++ b/src/crypto/crypto_sig.cc
+@@ -21,6 +21,7 @@ using ncrypto::EVPKeyPointer;
+ using ncrypto::EVPMDCtxPointer;
+ using v8::ArrayBuffer;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::Boolean;
+ using v8::FunctionCallbackInfo;
+ using v8::FunctionTemplate;
+@@ -92,11 +93,8 @@ std::unique_ptr<BackingStore> Node_SignFinal(Environment* env,
+     return nullptr;
+ 
+   size_t sig_len = pkey.size();
+-  std::unique_ptr<BackingStore> sig;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    sig = ArrayBuffer::NewBackingStore(env->isolate(), sig_len);
+-  }
++  auto sig = ArrayBuffer::NewBackingStore(
++      env->isolate(), sig_len, BackingStoreInitializationMode::kUninitialized);
+   EVPKeyCtxPointer pkctx = pkey.newCtx();
+   if (pkctx && EVP_PKEY_sign_init(pkctx.get()) > 0 &&
+       ApplyRSAOptions(pkey, pkctx.get(), padding, pss_salt_len) &&
+@@ -168,11 +166,9 @@ std::unique_ptr<BackingStore> ConvertSignatureToP1363(
+   if (n == kNoDsaSignature)
+     return std::move(signature);
+ 
+-  std::unique_ptr<BackingStore> buf;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    buf = ArrayBuffer::NewBackingStore(env->isolate(), 2 * n);
+-  }
++  auto buf = ArrayBuffer::NewBackingStore(
++      env->isolate(), 2 * n, BackingStoreInitializationMode::kUninitialized);
++
+   if (!ExtractP1363(static_cast<unsigned char*>(signature->Data()),
+                     static_cast<unsigned char*>(buf->Data()),
+                     signature->ByteLength(), n))
+diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
+index a80685790bd29102d99929ff81f866e0aee370f1..24336b86f6f25533a7b668e9f9806a5635e3a398 100644
+--- a/src/crypto/crypto_tls.cc
++++ b/src/crypto/crypto_tls.cc
+@@ -46,6 +46,7 @@ using v8::Array;
+ using v8::ArrayBuffer;
+ using v8::ArrayBufferView;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::Boolean;
+ using v8::Context;
+ using v8::DontDelete;
+@@ -1087,10 +1088,10 @@ int TLSWrap::DoWrite(WriteWrap* w,
+   // and copying it when it could just be used.
+ 
+   if (nonempty_count != 1) {
+-    {
+-      NoArrayBufferZeroFillScope no_zero_fill_scope(env()->isolate_data());
+-      bs = ArrayBuffer::NewBackingStore(env()->isolate(), length);
+-    }
++    bs = ArrayBuffer::NewBackingStore(
++        env()->isolate(),
++        length,
++        BackingStoreInitializationMode::kUninitialized);
+     size_t offset = 0;
+     for (i = 0; i < count; i++) {
+       memcpy(static_cast<char*>(bs->Data()) + offset,
+@@ -1107,8 +1108,10 @@ int TLSWrap::DoWrite(WriteWrap* w,
+     written = SSL_write(ssl_.get(), buf->base, buf->len);
+ 
+     if (written == -1) {
+-      NoArrayBufferZeroFillScope no_zero_fill_scope(env()->isolate_data());
+-      bs = ArrayBuffer::NewBackingStore(env()->isolate(), length);
++      bs = ArrayBuffer::NewBackingStore(
++          env()->isolate(),
++          length,
++          BackingStoreInitializationMode::kUninitialized);
+       memcpy(bs->Data(), buf->base, buf->len);
+     }
+   }
+@@ -1746,11 +1749,8 @@ void TLSWrap::GetFinished(const FunctionCallbackInfo<Value>& args) {
+   if (len == 0)
+     return;
+ 
+-  std::unique_ptr<BackingStore> bs;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs = ArrayBuffer::NewBackingStore(env->isolate(), len);
+-  }
++  auto bs = ArrayBuffer::NewBackingStore(
++      env->isolate(), len, BackingStoreInitializationMode::kUninitialized);
+ 
+   CHECK_EQ(bs->ByteLength(),
+            SSL_get_finished(w->ssl_.get(), bs->Data(), bs->ByteLength()));
+@@ -1777,11 +1777,8 @@ void TLSWrap::GetPeerFinished(const FunctionCallbackInfo<Value>& args) {
+   if (len == 0)
+     return;
+ 
+-  std::unique_ptr<BackingStore> bs;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs = ArrayBuffer::NewBackingStore(env->isolate(), len);
+-  }
++  auto bs = ArrayBuffer::NewBackingStore(
++      env->isolate(), len, BackingStoreInitializationMode::kUninitialized);
+ 
+   CHECK_EQ(bs->ByteLength(),
+            SSL_get_peer_finished(w->ssl_.get(), bs->Data(), bs->ByteLength()));
+@@ -1806,11 +1803,8 @@ void TLSWrap::GetSession(const FunctionCallbackInfo<Value>& args) {
+   if (slen <= 0)
+     return;  // Invalid or malformed session.
+ 
+-  std::unique_ptr<BackingStore> bs;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs = ArrayBuffer::NewBackingStore(env->isolate(), slen);
+-  }
++  auto bs = ArrayBuffer::NewBackingStore(
++      env->isolate(), slen, BackingStoreInitializationMode::kUninitialized);
+ 
+   unsigned char* p = static_cast<unsigned char*>(bs->Data());
+   CHECK_LT(0, i2d_SSL_SESSION(sess, &p));
+@@ -1993,11 +1987,8 @@ void TLSWrap::ExportKeyingMaterial(const FunctionCallbackInfo<Value>& args) {
+   uint32_t olen = args[0].As<Uint32>()->Value();
+   Utf8Value label(env->isolate(), args[1]);
+ 
+-  std::unique_ptr<BackingStore> bs;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs = ArrayBuffer::NewBackingStore(env->isolate(), olen);
+-  }
++  auto bs = ArrayBuffer::NewBackingStore(
++      env->isolate(), olen, BackingStoreInitializationMode::kUninitialized);
+ 
+   ByteSource context;
+   bool use_context = !args[2]->IsUndefined();
+diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc
+index fd29d17de195017970856ce30d7a9c5785b0b8ee..7fe3d09851d4476fa3f77ea0a0b49e8af13fae4f 100644
+--- a/src/crypto/crypto_x509.cc
++++ b/src/crypto/crypto_x509.cc
+@@ -28,6 +28,7 @@ using v8::Array;
+ using v8::ArrayBuffer;
+ using v8::ArrayBufferView;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::Boolean;
+ using v8::Context;
+ using v8::Date;
+@@ -683,11 +684,8 @@ MaybeLocal<Object> GetPubKey(Environment* env, OSSL3_CONST RSA* rsa) {
+   int size = i2d_RSA_PUBKEY(rsa, nullptr);
+   CHECK_GE(size, 0);
+ 
+-  std::unique_ptr<BackingStore> bs;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs = ArrayBuffer::NewBackingStore(env->isolate(), size);
+-  }
++  auto bs = ArrayBuffer::NewBackingStore(
++      env->isolate(), size, BackingStoreInitializationMode::kUninitialized);
+ 
+   unsigned char* serialized = reinterpret_cast<unsigned char*>(bs->Data());
+   CHECK_GE(i2d_RSA_PUBKEY(rsa, &serialized), 0);
+diff --git a/src/encoding_binding.cc b/src/encoding_binding.cc
+index 5ace688bb7ffc86eedf5aff11ab0ab487ad9440e..31058543a164bb45ba989e8c433994e0857a98b9 100644
+--- a/src/encoding_binding.cc
++++ b/src/encoding_binding.cc
+@@ -15,6 +15,7 @@ namespace encoding_binding {
+ 
+ using v8::ArrayBuffer;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::Context;
+ using v8::FunctionCallbackInfo;
+ using v8::Isolate;
+@@ -123,9 +124,8 @@ void BindingData::EncodeUtf8String(const FunctionCallbackInfo<Value>& args) {
+ 
+   Local<ArrayBuffer> ab;
+   {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    std::unique_ptr<BackingStore> bs =
+-        ArrayBuffer::NewBackingStore(isolate, length);
++    std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
++        isolate, length, BackingStoreInitializationMode::kUninitialized);
+ 
+     CHECK(bs);
+ 
+diff --git a/src/env-inl.h b/src/env-inl.h
+index 98e1e1e75bae94038bba0049447ab48b0acfb8cc..fe395bf89f9c1e5bb2dabc8fceda7b9b2b877415 100644
+--- a/src/env-inl.h
++++ b/src/env-inl.h
+@@ -44,16 +44,6 @@
+ 
+ namespace node {
+ 
+-NoArrayBufferZeroFillScope::NoArrayBufferZeroFillScope(
+-    IsolateData* isolate_data)
+-    : node_allocator_(isolate_data->node_allocator()) {
+-  if (node_allocator_ != nullptr) node_allocator_->zero_fill_field()[0] = 0;
+-}
+-
+-NoArrayBufferZeroFillScope::~NoArrayBufferZeroFillScope() {
+-  if (node_allocator_ != nullptr) node_allocator_->zero_fill_field()[0] = 1;
+-}
+-
+ inline v8::Isolate* IsolateData::isolate() const {
+   return isolate_;
+ }
+diff --git a/src/env.cc b/src/env.cc
+index 161d577e0ea6a251c83ba1903b1ec9a582a5317c..52713421465c23c959afac1955168294b2048341 100644
+--- a/src/env.cc
++++ b/src/env.cc
+@@ -39,6 +39,9 @@ namespace node {
+ 
+ using errors::TryCatchScope;
+ using v8::Array;
++using v8::ArrayBuffer;
++using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::Boolean;
+ using v8::Context;
+ using v8::CppHeap;
+@@ -724,9 +727,10 @@ void Environment::add_refs(int64_t diff) {
+ }
+ 
+ uv_buf_t Environment::allocate_managed_buffer(const size_t suggested_size) {
+-  NoArrayBufferZeroFillScope no_zero_fill_scope(isolate_data());
+-  std::unique_ptr<v8::BackingStore> bs =
+-      v8::ArrayBuffer::NewBackingStore(isolate(), suggested_size);
++  std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
++      isolate(),
++      suggested_size,
++      BackingStoreInitializationMode::kUninitialized);
+   uv_buf_t buf = uv_buf_init(static_cast<char*>(bs->Data()), bs->ByteLength());
+   released_allocated_buffers_.emplace(buf.base, std::move(bs));
+   return buf;
+diff --git a/src/env.h b/src/env.h
+index c346e3a9c827993036438685d758a734f9ce8c05..28c8df87c8e2f06e2ed8c554260bfdedb860bb4a 100644
+--- a/src/env.h
++++ b/src/env.h
+@@ -114,19 +114,6 @@ class ModuleWrap;
+ class Environment;
+ class Realm;
+ 
+-// Disables zero-filling for ArrayBuffer allocations in this scope. This is
+-// similar to how we implement Buffer.allocUnsafe() in JS land.
+-class NoArrayBufferZeroFillScope {
+- public:
+-  inline explicit NoArrayBufferZeroFillScope(IsolateData* isolate_data);
+-  inline ~NoArrayBufferZeroFillScope();
+-
+- private:
+-  NodeArrayBufferAllocator* node_allocator_;
+-
+-  friend class Environment;
+-};
+-
+ struct IsolateDataSerializeInfo {
+   std::vector<SnapshotIndex> primitive_values;
+   std::vector<PropInfo> template_values;
+diff --git a/src/node_buffer.cc b/src/node_buffer.cc
+index e844fe6cb33acefd075516e675075421ad5c3cff..06c84eb6ec097e3cb39502116135a7802aed13ce 100644
+--- a/src/node_buffer.cc
++++ b/src/node_buffer.cc
+@@ -66,6 +66,7 @@ namespace Buffer {
+ using v8::ArrayBuffer;
+ using v8::ArrayBufferView;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::Context;
+ using v8::EscapableHandleScope;
+ using v8::FunctionCallbackInfo;
+@@ -376,9 +377,8 @@ MaybeLocal<Object> New(Environment* env, size_t length) {
+ 
+   Local<ArrayBuffer> ab;
+   {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    std::unique_ptr<BackingStore> bs =
+-        ArrayBuffer::NewBackingStore(isolate, length);
++    std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
++        isolate, length, BackingStoreInitializationMode::kUninitialized);
+ 
+     CHECK(bs);
+ 
+@@ -417,18 +417,14 @@ MaybeLocal<Object> Copy(Environment* env, const char* data, size_t length) {
+     return Local<Object>();
+   }
+ 
+-  Local<ArrayBuffer> ab;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    std::unique_ptr<BackingStore> bs =
+-        ArrayBuffer::NewBackingStore(isolate, length);
++  std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
++      isolate, length, BackingStoreInitializationMode::kUninitialized);
+ 
+-    CHECK(bs);
++  CHECK(bs);
+ 
+-    memcpy(bs->Data(), data, length);
++  memcpy(bs->Data(), data, length);
+ 
+-    ab = ArrayBuffer::New(isolate, std::move(bs));
+-  }
++  Local<ArrayBuffer> ab = ArrayBuffer::New(isolate, std::move(bs));
+ 
+   MaybeLocal<Object> obj =
+       New(env, ab, 0, ab->ByteLength())
+@@ -1440,14 +1436,16 @@ void CreateUnsafeArrayBuffer(const FunctionCallbackInfo<Value>& args) {
+ 
+   Local<ArrayBuffer> buf;
+ 
+-  NodeArrayBufferAllocator* allocator = env->isolate_data()->node_allocator();
+   // 0-length, or zero-fill flag is set, or building snapshot
+   if (size == 0 || per_process::cli_options->zero_fill_all_buffers ||
+-      allocator == nullptr) {
++      env->isolate_data()->is_building_snapshot()) {
+     buf = ArrayBuffer::New(isolate, size);
+   } else {
+-    std::unique_ptr<BackingStore> store =
+-        ArrayBuffer::NewBackingStore(isolate, size);
++    std::unique_ptr<BackingStore> store = ArrayBuffer::NewBackingStore(
++        isolate,
++        size,
++        BackingStoreInitializationMode::kUninitialized,
++        v8::BackingStoreOnFailureMode::kReturnNull);
+     if (!store) {
+       return env->ThrowRangeError("Array buffer allocation failed");
+     }
+diff --git a/src/node_http2.cc b/src/node_http2.cc
+index 8237c9b7d325dd925ae8798d7795fcd94eeb13d0..a22cf6c4e33e5cf2d3168ce03dc35af8a9584af7 100644
+--- a/src/node_http2.cc
++++ b/src/node_http2.cc
+@@ -27,6 +27,7 @@ using v8::Array;
+ using v8::ArrayBuffer;
+ using v8::ArrayBufferView;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::Boolean;
+ using v8::Context;
+ using v8::EscapableHandleScope;
+@@ -298,11 +299,10 @@ Local<Value> Http2Settings::Pack(
+     size_t count,
+     const nghttp2_settings_entry* entries) {
+   EscapableHandleScope scope(env->isolate());
+-  std::unique_ptr<BackingStore> bs;
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs = ArrayBuffer::NewBackingStore(env->isolate(), count * 6);
+-  }
++  std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
++      env->isolate(),
++      count * 6,
++      BackingStoreInitializationMode::kUninitialized);
+   if (nghttp2_pack_settings_payload(static_cast<uint8_t*>(bs->Data()),
+                                     bs->ByteLength(),
+                                     entries,
+@@ -468,13 +468,11 @@ Origins::Origins(
+     return;
+   }
+ 
+-  {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs_ = ArrayBuffer::NewBackingStore(env->isolate(),
+-                                       alignof(nghttp2_origin_entry) - 1 +
+-                                       count_ * sizeof(nghttp2_origin_entry) +
+-                                       origin_string_len);
+-  }
++  bs_ = ArrayBuffer::NewBackingStore(
++      env->isolate(),
++      alignof(nghttp2_origin_entry) - 1 +
++          count_ * sizeof(nghttp2_origin_entry) + origin_string_len,
++      BackingStoreInitializationMode::kUninitialized);
+ 
+   // Make sure the start address is aligned appropriately for an nghttp2_nv*.
+   char* start = nbytes::AlignUp(static_cast<char*>(bs_->Data()),
+@@ -2120,12 +2118,10 @@ void Http2Session::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
+     // happen, we concatenate the data we received with the already-stored
+     // pending input data, slicing off the already processed part.
+     size_t pending_len = stream_buf_.len - stream_buf_offset_;
+-    std::unique_ptr<BackingStore> new_bs;
+-    {
+-      NoArrayBufferZeroFillScope no_zero_fill_scope(env()->isolate_data());
+-      new_bs = ArrayBuffer::NewBackingStore(env()->isolate(),
+-                                            pending_len + nread);
+-    }
++    std::unique_ptr<BackingStore> new_bs = ArrayBuffer::NewBackingStore(
++        env()->isolate(),
++        pending_len + nread,
++        BackingStoreInitializationMode::kUninitialized);
+     memcpy(static_cast<char*>(new_bs->Data()),
+            stream_buf_.base + stream_buf_offset_,
+            pending_len);
+diff --git a/src/node_internals.h b/src/node_internals.h
+index 12ea72b61b0a5e194207bb369dfed4b8667107cb..18844e18a32d6b07e62481138fa2342765643484 100644
+--- a/src/node_internals.h
++++ b/src/node_internals.h
+@@ -121,8 +121,6 @@ v8::MaybeLocal<v8::Object> InitializePrivateSymbols(
+ 
+ class NodeArrayBufferAllocator : public ArrayBufferAllocator {
+  public:
+-  inline uint32_t* zero_fill_field() { return &zero_fill_field_; }
+-
+   void* Allocate(size_t size) override;  // Defined in src/node.cc
+   void* AllocateUninitialized(size_t size) override;
+   void Free(void* data, size_t size) override;
+@@ -139,7 +137,6 @@ class NodeArrayBufferAllocator : public ArrayBufferAllocator {
+   }
+ 
+  private:
+-  uint32_t zero_fill_field_ = 1;  // Boolean but exposed as uint32 to JS land.
+   std::atomic<size_t> total_mem_usage_ {0};
+ 
+   // Delegate to V8's allocator for compatibility with the V8 memory cage.
+diff --git a/src/stream_base.cc b/src/stream_base.cc
+index fc81108120f0066f2d5dabedc74e22cb6c84d8e4..0bf2642599ee91e2d2aa20d6d066c80b3026ecc5 100644
+--- a/src/stream_base.cc
++++ b/src/stream_base.cc
+@@ -19,6 +19,7 @@ namespace node {
+ using v8::Array;
+ using v8::ArrayBuffer;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
+ using v8::ConstructorBehavior;
+ using v8::Context;
+ using v8::DontDelete;
+@@ -243,8 +244,8 @@ int StreamBase::Writev(const FunctionCallbackInfo<Value>& args) {
+ 
+   std::unique_ptr<BackingStore> bs;
+   if (storage_size > 0) {
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs = ArrayBuffer::NewBackingStore(isolate, storage_size);
++    bs = ArrayBuffer::NewBackingStore(
++        isolate, storage_size, BackingStoreInitializationMode::kUninitialized);
+   }
+ 
+   offset = 0;
+@@ -398,14 +399,14 @@ int StreamBase::WriteString(const FunctionCallbackInfo<Value>& args) {
+ 
+   if (try_write) {
+     // Copy partial data
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs = ArrayBuffer::NewBackingStore(isolate, buf.len);
++    bs = ArrayBuffer::NewBackingStore(
++        isolate, buf.len, BackingStoreInitializationMode::kUninitialized);
+     memcpy(bs->Data(), buf.base, buf.len);
+     data_size = buf.len;
+   } else {
+     // Write it
+-    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
+-    bs = ArrayBuffer::NewBackingStore(isolate, storage_size);
++    bs = ArrayBuffer::NewBackingStore(
++        isolate, storage_size, BackingStoreInitializationMode::kUninitialized);
+     data_size = StringBytes::Write(isolate,
+                                    static_cast<char*>(bs->Data()),
+                                    storage_size,

patches/node/src_prepare_for_v8_sandboxing.patch

@@ -0,0 +1,276 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: James M Snell <jasnell@gmail.com>
+Date: Sun, 18 May 2025 10:46:30 -0700
+Subject: src: prepare for v8 sandboxing
+
+PR-URL: https://github.com/nodejs/node/pull/58376
+Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
+Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
+
+diff --git a/src/crypto/crypto_dh.cc b/src/crypto/crypto_dh.cc
+index f23cedf4f2449d8edc9a8de1b70332e75d693cdd..5ac2b1a83688fe99b13c37bf375ca6e22497dc18 100644
+--- a/src/crypto/crypto_dh.cc
++++ b/src/crypto/crypto_dh.cc
+@@ -22,6 +22,8 @@ using ncrypto::DHPointer;
+ using ncrypto::EVPKeyCtxPointer;
+ using ncrypto::EVPKeyPointer;
+ using v8::ArrayBuffer;
++using v8::BackingStoreInitializationMode;
++using v8::BackingStoreOnFailureMode;
+ using v8::ConstructorBehavior;
+ using v8::Context;
+ using v8::DontDelete;
+@@ -55,12 +57,27 @@ void DiffieHellman::MemoryInfo(MemoryTracker* tracker) const {
+ 
+ namespace {
+ MaybeLocal<Value> DataPointerToBuffer(Environment* env, DataPointer&& data) {
++#ifdef V8_ENABLE_SANDBOX
++  auto backing = ArrayBuffer::NewBackingStore(
++      env->isolate(),
++      data.size(),
++      BackingStoreInitializationMode::kUninitialized,
++      BackingStoreOnFailureMode::kReturnNull);
++  if (!backing) {
++    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
++    return MaybeLocal<Value>();
++  }
++  if (data.size() > 0) {
++    memcpy(backing->Data(), data.get(), data.size());
++  }
++#else
+   auto backing = ArrayBuffer::NewBackingStore(
+       data.get(),
+       data.size(),
+       [](void* data, size_t len, void* ptr) { DataPointer free_me(data, len); },
+       nullptr);
+   data.release();
++#endif  // V8_ENABLE_SANDBOX
+ 
+   auto ab = ArrayBuffer::New(env->isolate(), std::move(backing));
+   return Buffer::New(env, ab, 0, ab->ByteLength()).FromMaybe(Local<Value>());
+diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
+index eab18ab9888e2f7c0757fefab80505d8c99dc742..7ecf810ea0f4106c7c44593dae1b0a3cf0673380 100644
+--- a/src/crypto/crypto_util.cc
++++ b/src/crypto/crypto_util.cc
+@@ -37,6 +37,8 @@ using ncrypto::SSLCtxPointer;
+ using ncrypto::SSLPointer;
+ using v8::ArrayBuffer;
+ using v8::BackingStore;
++using v8::BackingStoreInitializationMode;
++using v8::BackingStoreOnFailureMode;
+ using v8::BigInt;
+ using v8::Context;
+ using v8::Exception;
+@@ -359,34 +361,29 @@ ByteSource& ByteSource::operator=(ByteSource&& other) noexcept {
+   return *this;
+ }
+ 
+-std::unique_ptr<BackingStore> ByteSource::ReleaseToBackingStore(Environment* env) {
++std::unique_ptr<BackingStore> ByteSource::ReleaseToBackingStore(
++    Environment* env) {
+   // It's ok for allocated_data_ to be nullptr but
+   // only if size_ is zero.
+   CHECK_IMPLIES(size_ > 0, allocated_data_ != nullptr);
+-#if defined(V8_ENABLE_SANDBOX)
+-  // When V8 sandboxed pointers are enabled, we have to copy into the memory
+-  // cage. We still want to ensure we erase the data on free though, so
+-  // provide a custom deleter that calls OPENSSL_cleanse.
+-  if (!size())
+-    return ArrayBuffer::NewBackingStore(env->isolate(), 0);
+-  std::unique_ptr<ArrayBuffer::Allocator> allocator(ArrayBuffer::Allocator::NewDefaultAllocator());
+-  void* v8_data = allocator->Allocate(size());
+-  CHECK(v8_data);
+-  memcpy(v8_data, allocated_data_, size());
+-  OPENSSL_clear_free(allocated_data_, size());
++#ifdef V8_ENABLE_SANDBOX
++  // If the v8 sandbox is enabled, then all array buffers must be allocated
++  // via the isolate. External buffers are not allowed. So, instead of wrapping
++  // the allocated data we'll copy it instead.
++
++  // TODO(@jasnell): It would be nice to use an abstracted utility to do this
++  // branch instead of duplicating the V8_ENABLE_SANDBOX check each time.
+   std::unique_ptr<BackingStore> ptr = ArrayBuffer::NewBackingStore(
+-      v8_data,
++      env->isolate(),
+       size(),
+-      [](void* data, size_t length, void*) {
+-        OPENSSL_cleanse(data, length);
+-        std::unique_ptr<ArrayBuffer::Allocator> allocator(ArrayBuffer::Allocator::NewDefaultAllocator());
+-        allocator->Free(data, length);
+-      }, nullptr);
+-  CHECK(ptr);
+-  allocated_data_ = nullptr;
+-  data_ = nullptr;
+-  size_ = 0;
+-  return ptr;
++      BackingStoreInitializationMode::kUninitialized,
++      BackingStoreOnFailureMode::kReturnNull);
++  if (!ptr) {
++    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
++    return nullptr;
++  }
++  memcpy(ptr->Data(), allocated_data_, size());
++  OPENSSL_clear_free(allocated_data_, size_);
+ #else
+   std::unique_ptr<BackingStore> ptr = ArrayBuffer::NewBackingStore(
+       allocated_data_,
+@@ -394,12 +391,12 @@ std::unique_ptr<BackingStore> ByteSource::ReleaseToBackingStore(Environment* env
+       [](void* data, size_t length, void* deleter_data) {
+         OPENSSL_clear_free(deleter_data, length);
+       }, allocated_data_);
++#endif  // V8_ENABLE_SANDBOX
+   CHECK(ptr);
+   allocated_data_ = nullptr;
+   data_ = nullptr;
+   size_ = 0;
+   return ptr;
+-#endif  // defined(V8_ENABLE_SANDBOX)
+ }
+ 
+ Local<ArrayBuffer> ByteSource::ToArrayBuffer(Environment* env) {
+@@ -711,8 +708,19 @@ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
+ }
+ #else
+ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
+-  CHECK(args[0]->IsUint32());
+   Environment* env = Environment::GetCurrent(args);
++#ifdef V8_ENABLE_SANDBOX
++  // The v8 sandbox is enabled, so we cannot use the secure heap because
++  // the sandbox requires that all array buffers be allocated via the isolate.
++  // That is fundamentally incompatible with the secure heap which allocates
++  // in openssl's secure heap area. Instead we'll just throw an error here.
++  //
++  // That said, we really shouldn't get here in the first place since the
++  // option to enable the secure heap is only available when the sandbox
++  // is disabled.
++  UNREACHABLE();
++#else
++  CHECK(args[0]->IsUint32());
+   uint32_t len = args[0].As<Uint32>()->Value();
+   void* data = OPENSSL_malloc(len);
+   if (data == nullptr) {
+@@ -730,6 +738,7 @@ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
+           data);
+   Local<ArrayBuffer> buffer = ArrayBuffer::New(env->isolate(), store);
+   args.GetReturnValue().Set(Uint8Array::New(buffer, 0, len));
++#endif  // V8_ENABLE_SANDBOX
+ }
+ #endif  // defined(V8_ENABLE_SANDBOX)
+ 
+diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc
+index 7fe3d09851d4476fa3f77ea0a0b49e8af13fae4f..b60ad6b1cdb0b923ba2de1b7205ed5ce07612b81 100644
+--- a/src/crypto/crypto_x509.cc
++++ b/src/crypto/crypto_x509.cc
+@@ -29,6 +29,7 @@ using v8::ArrayBuffer;
+ using v8::ArrayBufferView;
+ using v8::BackingStore;
+ using v8::BackingStoreInitializationMode;
++using v8::BackingStoreOnFailureMode;
+ using v8::Boolean;
+ using v8::Context;
+ using v8::Date;
+@@ -168,18 +169,20 @@ MaybeLocal<Value> ToV8Value(Local<Context> context, const BIOPointer& bio) {
+ MaybeLocal<Value> ToBuffer(Environment* env, BIOPointer* bio) {
+   if (bio == nullptr || !*bio) return {};
+   BUF_MEM* mem = *bio;
+-#if defined(V8_ENABLE_SANDBOX)
+-  std::unique_ptr<ArrayBuffer::Allocator> allocator(ArrayBuffer::Allocator::NewDefaultAllocator());
+-  void* v8_data = allocator->Allocate(mem->length);
+-  CHECK(v8_data);
+-  memcpy(v8_data, mem->data, mem->length);
+-  std::unique_ptr<v8::BackingStore> backing = ArrayBuffer::NewBackingStore(
+-      v8_data,
++#ifdef V8_ENABLE_SANDBOX
++  // If the v8 sandbox is enabled, then all array buffers must be allocated
++  // via the isolate. External buffers are not allowed. So, instead of wrapping
++  // the BIOPointer we'll copy it instead.
++  auto backing = ArrayBuffer::NewBackingStore(
++      env->isolate(),
+       mem->length,
+-      [](void* data, size_t length, void*) {
+-        std::unique_ptr<ArrayBuffer::Allocator> allocator(ArrayBuffer::Allocator::NewDefaultAllocator());
+-        allocator->Free(data, length);
+-      }, nullptr);
++      BackingStoreInitializationMode::kUninitialized,
++      BackingStoreOnFailureMode::kReturnNull);
++  if (!backing) {
++    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
++    return MaybeLocal<Value>();
++  }
++  memcpy(backing->Data(), mem->data, mem->length);
+ #else
+   auto backing = ArrayBuffer::NewBackingStore(
+       mem->data,
+@@ -188,8 +191,7 @@ MaybeLocal<Value> ToBuffer(Environment* env, BIOPointer* bio) {
+         BIOPointer free_me(static_cast<BIO*>(data));
+       },
+       bio->release());
+-#endif
+-
++#endif  // V8_ENABLE_SANDBOX
+   auto ab = ArrayBuffer::New(env->isolate(), std::move(backing));
+   Local<Value> ret;
+   if (!Buffer::New(env, ab, 0, ab->ByteLength()).ToLocal(&ret)) return {};
+diff --git a/src/js_native_api_v8.cc b/src/js_native_api_v8.cc
+index 413db3ed9b88d7b7fb2ac6dd1153dade9ff830fd..6da93b8569a34841e846c320ec0a6ca7f1ea0da6 100644
+--- a/src/js_native_api_v8.cc
++++ b/src/js_native_api_v8.cc
+@@ -114,7 +114,7 @@ napi_status NewExternalString(napi_env env,
+   CHECK_NEW_STRING_ARGS(env, str, length, result);
+ 
+   napi_status status;
+-#if defined(V8_ENABLE_SANDBOX)
++#ifdef V8_ENABLE_SANDBOX
+   status = create_api(env, str, length, result);
+   if (status == napi_ok) {
+     if (copied != nullptr) {
+diff --git a/src/node_api.cc b/src/node_api.cc
+index 2769997f0ede0e921fcb8826942609e497e5f9cb..d9b17780f6143f1c3f8488a20144376963e43fbc 100644
+--- a/src/node_api.cc
++++ b/src/node_api.cc
+@@ -1056,7 +1056,7 @@ napi_create_external_buffer(napi_env env,
+   NAPI_PREAMBLE(env);
+   CHECK_ARG(env, result);
+ 
+-#if defined(V8_ENABLE_SANDBOX)
++#ifdef V8_ENABLE_SANDBOX
+   return napi_set_last_error(env, napi_no_external_buffers_allowed);
+ #else
+   v8::Isolate* isolate = env->isolate;
+diff --git a/src/node_options.cc b/src/node_options.cc
+index e93e8684e518b30a2514768a269be6d32d1f5b94..547cda780376f578b0f78eb9158dc14a3faf874d 100644
+--- a/src/node_options.cc
++++ b/src/node_options.cc
+@@ -83,6 +83,8 @@ void PerProcessOptions::CheckOptions(std::vector<std::string>* errors,
+   }
+ 
+   // Any value less than 2 disables use of the secure heap.
++#ifndef V8_ENABLE_SANDBOX
++  // The secure heap is not supported when V8_ENABLE_SANDBOX is enabled.
+   if (secure_heap >= 2) {
+     if ((secure_heap & (secure_heap - 1)) != 0)
+       errors->push_back("--secure-heap must be a power of 2");
+@@ -95,6 +97,7 @@ void PerProcessOptions::CheckOptions(std::vector<std::string>* errors,
+     if ((secure_heap_min & (secure_heap_min - 1)) != 0)
+       errors->push_back("--secure-heap-min must be a power of 2");
+   }
++#endif  // V8_ENABLE_SANDBOX
+ #endif  // HAVE_OPENSSL
+ 
+   if (use_largepages != "off" &&
+@@ -1243,6 +1246,7 @@ PerProcessOptionsParser::PerProcessOptionsParser(
+             "force FIPS crypto (cannot be disabled)",
+             &PerProcessOptions::force_fips_crypto,
+             kAllowedInEnvvar);
++#ifndef V8_ENABLE_SANDBOX
+   AddOption("--secure-heap",
+             "total size of the OpenSSL secure heap",
+             &PerProcessOptions::secure_heap,
+@@ -1251,6 +1255,7 @@ PerProcessOptionsParser::PerProcessOptionsParser(
+             "minimum allocation size from the OpenSSL secure heap",
+             &PerProcessOptions::secure_heap_min,
+             kAllowedInEnvvar);
++#endif  // V8_ENABLE_SANDBOX
+ #endif  // HAVE_OPENSSL
+ #if OPENSSL_VERSION_MAJOR >= 3
+   AddOption("--openssl-legacy-provider",

patches/node/src_switch_from_get_setprototype_to_get_setprototypev2.patch

@@ -10,10 +10,10 @@ Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 Reviewed-By: James M Snell <jasnell@gmail.com>
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 82f53bba29613de212f64be440ca20d7c630fddf..0a358735c331767e8eb563a80e9aaccfb544c27b 100644
+index 33827edce63c9fe08b52aea59571391a83853443..79327877b0f34cbafb3efcc21617027d4011f806 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -886,7 +886,7 @@ Maybe<void> InitializePrimordials(Local<Context> context,
+@@ -878,7 +878,7 @@ Maybe<void> InitializePrimordials(Local<Context> context,
    CHECK(!exports->Has(context, primordials_string).FromJust());
  
    Local<Object> primordials = Object::New(isolate);
@@ -51,10 +51,10 @@ index 7b2efa49468c0bed2f5935552addd3ab37d0a50b..413db3ed9b88d7b7fb2ac6dd1153dade
    return GET_RETURN_STATUS(env);
  }
 diff --git a/src/node_buffer.cc b/src/node_buffer.cc
-index c94b14741c827a81d69a6f036426a344e563ad72..15129e4455fdc8792f21511a04d534ba3a4ebb5f 100644
+index 8a5b6b57321c2843a965a7e51b2ebed991a1e424..e844fe6cb33acefd075516e675075421ad5c3cff 100644
 --- a/src/node_buffer.cc
 +++ b/src/node_buffer.cc
-@@ -284,8 +284,9 @@ MaybeLocal<Uint8Array> New(Environment* env,
+@@ -283,8 +283,9 @@ MaybeLocal<Uint8Array> New(Environment* env,
                             size_t length) {
    CHECK(!env->buffer_prototype_object().IsEmpty());
    Local<Uint8Array> ui = Uint8Array::New(ab, byte_offset, length);

patches/node/support_v8_sandboxed_pointers.patch

@@ -6,63 +6,6 @@ Subject: support V8 sandboxed pointers
 This refactors several allocators to allocate within the V8 memory cage,
 allowing them to be compatible with the V8_SANDBOXED_POINTERS feature.
 
-diff --git a/src/api/environment.cc b/src/api/environment.cc
-index fd71ceac65ccef1d2832b45b0b5612877cee22c1..cb37fa080fc8e8d524cfa2758c4a8c2c5652324d 100644
---- a/src/api/environment.cc
-+++ b/src/api/environment.cc
-@@ -106,6 +106,14 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,
-   return result;
- }
- 
-+NodeArrayBufferAllocator::NodeArrayBufferAllocator() {
-+  zero_fill_field_ = static_cast<uint32_t*>(allocator_->Allocate(sizeof(*zero_fill_field_)));
-+}
-+
-+NodeArrayBufferAllocator::~NodeArrayBufferAllocator() {
-+  allocator_->Free(zero_fill_field_, sizeof(*zero_fill_field_));
-+}
-+
- void* NodeArrayBufferAllocator::Allocate(size_t size) {
-   void* ret;
-   if (zero_fill_field_ || per_process::cli_options->zero_fill_all_buffers)
-diff --git a/src/crypto/crypto_dh.cc b/src/crypto/crypto_dh.cc
-index f23cedf4f2449d8edc9a8de1b70332e75d693cdd..976653dd1e9363e046788fc3419a9b649ceb2ea4 100644
---- a/src/crypto/crypto_dh.cc
-+++ b/src/crypto/crypto_dh.cc
-@@ -55,13 +55,32 @@ void DiffieHellman::MemoryInfo(MemoryTracker* tracker) const {
- 
- namespace {
- MaybeLocal<Value> DataPointerToBuffer(Environment* env, DataPointer&& data) {
-+#if defined(V8_ENABLE_SANDBOX)
-+  std::unique_ptr<v8::BackingStore> backing;
-+  if (data.size() > 0) {
-+    std::unique_ptr<ArrayBuffer::Allocator> allocator(ArrayBuffer::Allocator::NewDefaultAllocator());
-+    void* v8_data = allocator->Allocate(data.size());
-+    CHECK(v8_data);
-+    memcpy(v8_data, data.get(), data.size());
-+    backing = ArrayBuffer::NewBackingStore(
-+        v8_data,
-+        data.size(),
-+        [](void* data, size_t length, void*) {
-+          std::unique_ptr<ArrayBuffer::Allocator> allocator(ArrayBuffer::Allocator::NewDefaultAllocator());
-+          allocator->Free(data, length);
-+        }, nullptr);
-+  } else {
-+    NoArrayBufferZeroFillScope no_zero_fill_scope(env->isolate_data());
-+    backing = v8::ArrayBuffer::NewBackingStore(env->isolate(), data.size());
-+  }
-+#else
-   auto backing = ArrayBuffer::NewBackingStore(
-       data.get(),
-       data.size(),
-       [](void* data, size_t len, void* ptr) { DataPointer free_me(data, len); },
-       nullptr);
-   data.release();
--
-+#endif
-   auto ab = ArrayBuffer::New(env->isolate(), std::move(backing));
-   return Buffer::New(env, ab, 0, ab->ByteLength()).FromMaybe(Local<Value>());
- }
 diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
 index 4505786745c54a529f904d5e7813a86204e0a78b..eab18ab9888e2f7c0757fefab80505d8c99dc742 100644
 --- a/src/crypto/crypto_util.cc
@@ -188,6 +131,28 @@ index f616223cfb0f6e10f7cf57ada9704316bde2797e..eb6dad44a49d997097c8fb5009eeb60a
    auto ab = ArrayBuffer::New(env->isolate(), std::move(backing));
    Local<Value> ret;
    if (!Buffer::New(env, ab, 0, ab->ByteLength()).ToLocal(&ret)) return {};
+diff --git a/src/node_buffer.cc b/src/node_buffer.cc
+index 357dc5f6d1c1c2d3756a94c1326b0502403e1eaf..b9f0c97938203b4652780a7d707c5e83319330b0 100644
+--- a/src/node_buffer.cc
++++ b/src/node_buffer.cc
+@@ -1412,7 +1412,7 @@ inline size_t CheckNumberToSize(Local<Value> number) {
+   CHECK(value >= 0 && value < maxSize);
+   size_t size = static_cast<size_t>(value);
+ #ifdef V8_ENABLE_SANDBOX
+-  CHECK_LE(size, kMaxSafeBufferSizeForSandbox);
++  CHECK_LE(size, v8::internal::kMaxSafeBufferSizeForSandbox);
+ #endif
+   return size;
+ }
+@@ -1437,7 +1437,7 @@ void CreateUnsafeArrayBuffer(const FunctionCallbackInfo<Value>& args) {
+     buf = ArrayBuffer::New(isolate, size);
+   } else {
+     std::unique_ptr<BackingStore> store =
+-        ArrayBuffer::NewBackingStoreForNodeLTS(isolate, size);
++        ArrayBuffer::NewBackingStore(isolate, size);
+     if (!store) {
+       return env->ThrowRangeError("Array buffer allocation failed");
+     }
 diff --git a/src/node_i18n.cc b/src/node_i18n.cc
 index 6be3920632b25db450025ebab6a2636e4811cdbe..b49916d2b5fc5e58cf3fb67329430fd3df8fb813 100644
 --- a/src/node_i18n.cc
@@ -228,30 +193,6 @@ index 6be3920632b25db450025ebab6a2636e4811cdbe..b49916d2b5fc5e58cf3fb67329430fd3
  }
  
  constexpr const char* EncodingName(const enum encoding encoding) {
-diff --git a/src/node_internals.h b/src/node_internals.h
-index 12ea72b61b0a5e194207bb369dfed4b8667107cb..64442215714a98f648971e517ddd9c77e38fe3f2 100644
---- a/src/node_internals.h
-+++ b/src/node_internals.h
-@@ -121,7 +121,9 @@ v8::MaybeLocal<v8::Object> InitializePrivateSymbols(
- 
- class NodeArrayBufferAllocator : public ArrayBufferAllocator {
-  public:
--  inline uint32_t* zero_fill_field() { return &zero_fill_field_; }
-+  NodeArrayBufferAllocator();
-+  ~NodeArrayBufferAllocator() override;
-+  inline uint32_t* zero_fill_field() { return zero_fill_field_; }
- 
-   void* Allocate(size_t size) override;  // Defined in src/node.cc
-   void* AllocateUninitialized(size_t size) override;
-@@ -139,7 +141,7 @@ class NodeArrayBufferAllocator : public ArrayBufferAllocator {
-   }
- 
-  private:
--  uint32_t zero_fill_field_ = 1;  // Boolean but exposed as uint32 to JS land.
-+  uint32_t* zero_fill_field_ = nullptr;  // Boolean but exposed as uint32 to JS land.
-   std::atomic<size_t> total_mem_usage_ {0};
- 
-   // Delegate to V8's allocator for compatibility with the V8 memory cage.
 diff --git a/src/node_serdes.cc b/src/node_serdes.cc
 index c55a2e28066147ae5ca5def10ec76ccc03c634b4..c54183c72944989219b6437c9e571a3f7f3f8dd5 100644
 --- a/src/node_serdes.cc