docs: explain how to create transparent window using BaseWindow (#49052)

docs: clarify how to create transparent BaseWindow

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: teoyuqi <83915879+teoyuqi@users.noreply.github.com>

.github/actions/build-electron/action.yml

@@ -188,7 +188,7 @@ runs:
       shell: bash
       run: |
         cd src/electron
-        node script/yarn create-typescript-definitions
+        node script/yarn.js create-typescript-definitions
     - name: Publish Electron Dist ${{ inputs.step-suffix }}
       if: ${{ inputs.is-release == 'true' }}
       shell: bash

.github/actions/checkout/action.yml

@@ -152,7 +152,7 @@ runs:
     if: ${{ inputs.target-platform == 'linux' && github.ref == 'refs/heads/main' }}
     shell: bash
     run: |
-      npx node src/electron/script/patches-stats.mjs --upload-stats || true
+      node src/electron/script/patches-stats.mjs --upload-stats || true
   # delete all .git directories under src/ except for
   # third_party/angle/ and third_party/dawn/ because of build time generation of files
   # gen/angle/commit.h depends on third_party/angle/.git/HEAD

.github/actions/generate-types/action.yml

@@ -13,12 +13,16 @@ runs:
   - name: Generating Types for SHA in ${{ inputs.sha-file }}
     shell: bash
     run: |
-      git checkout $(cat ${{ inputs.sha-file }})
-      rm -rf node_modules
-      yarn install --frozen-lockfile --ignore-scripts
+      export ELECTRON_DIR=$(pwd)
+      if [ "${{ inputs.sha-file }}" == ".dig-old" ]; then
+        cd /tmp
+        git clone https://github.com/electron/electron.git
+        cd electron
+      fi
+      git checkout $(cat $ELECTRON_DIR/${{ inputs.sha-file }})
+      node script/yarn.js install --immutable
       echo "#!/usr/bin/env node\nglobal.x=1" > node_modules/typescript/bin/tsc
       node node_modules/.bin/electron-docs-parser --dir=./ --outDir=./ --moduleVersion=0.0.0-development
       node node_modules/.bin/electron-typescript-definitions --api=electron-api.json --outDir=artifacts
-      mv artifacts/electron.d.ts artifacts/${{ inputs.filename }}
-      git checkout .
+      mv artifacts/electron.d.ts $ELECTRON_DIR/artifacts/${{ inputs.filename }}
     working-directory: ./electron

.github/actions/install-dependencies/action.yml

@@ -6,7 +6,7 @@ runs:
   - name: Get yarn cache directory path
     shell: bash
     id: yarn-cache-dir-path
-    run: echo "dir=$(node src/electron/script/yarn cache dir)" >> $GITHUB_OUTPUT
+    run: echo "dir=$(node src/electron/script/yarn.js config get cacheFolder)" >> $GITHUB_OUTPUT
   - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
     id: yarn-cache
     with:
@@ -18,4 +18,7 @@ runs:
     shell: bash
     run: |
       cd src/electron
-      node script/yarn install --frozen-lockfile --prefer-offline
+      if [ "$TARGET_ARCH" = "x86" ]; then
+        export npm_config_arch="ia32"
+      fi
+      node script/yarn.js install --immutable

.github/workflows/archaeologist-dig.yml

@@ -3,10 +3,14 @@ name: Archaeologist
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
    archaeologist-dig:
     name: Archaeologist Dig
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Electron
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8

.github/workflows/build-git-cache.yml

@@ -6,9 +6,13 @@ on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions: {}
+
 jobs:
   build-git-cache-linux:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root
@@ -30,6 +34,8 @@ jobs:
 
   build-git-cache-windows:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -52,6 +58,8 @@ jobs:
 
   build-git-cache-macos:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     # This job updates the same git cache as linux, so it needs to run after the linux one.
     needs: build-git-cache-linux
     container:

.github/workflows/build.yml

@@ -43,10 +43,13 @@ defaults:
   run:
     shell: bash
 
+permissions: {}
+
 jobs:
   setup:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: read
     outputs:
         docs: ${{ steps.filter.outputs.docs }}
@@ -84,6 +87,8 @@ jobs:
     needs: setup
     if: ${{ !inputs.skip-lint }}
     uses: ./.github/workflows/pipeline-electron-lint.yml
+    permissions:
+      contents: read
     with:
       container: '{"image":"ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}","options":"--user root"}'
     secrets: inherit
@@ -93,6 +98,8 @@ jobs:
     needs: [setup, checkout-linux]
     if: ${{ needs.setup.outputs.docs-only == 'true' }}
     uses: ./.github/workflows/pipeline-electron-docs-only.yml
+    permissions:
+      contents: read
     with:
       container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
     secrets: inherit
@@ -102,6 +109,8 @@ jobs:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-macos}}
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -130,6 +139,8 @@ jobs:
     needs: setup
     if: ${{ !inputs.skip-linux}}
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root
@@ -159,6 +170,8 @@ jobs:
     needs: setup
     if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -189,6 +202,8 @@ jobs:
   # GN Check Jobs
   macos-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       target-platform: macos
@@ -199,6 +214,8 @@ jobs:
 
   linux-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     if: ${{ needs.setup.outputs.src == 'true' }}
     with:
@@ -211,6 +228,8 @@ jobs:
 
   windows-gn-check:
     uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       target-platform: win
@@ -314,7 +333,7 @@ jobs:
       build-runs-on: electron-arc-centralus-linux-amd64-32core
       test-runs-on: electron-arc-centralus-linux-arm64-4core
       build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
-      test-container: '{"image":"ghcr.io/electron/test:arm32v7-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init","volumes":["/home/runner/externals:/mnt/runner-externals"]}'
+      test-container: '{"image":"ghcr.io/electron/test:arm32v7-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init --memory=12g","volumes":["/home/runner/externals:/mnt/runner-externals"]}'
       target-platform: linux
       target-arch: arm
       is-release: false
@@ -404,6 +423,8 @@ jobs:
   gha-done:
     name: GitHub Actions Completed
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     needs: [docs-only, macos-x64, macos-arm64, linux-x64, linux-x64-asan, linux-arm, linux-arm64, windows-x64, windows-x86, windows-arm64]
     if: always() && !contains(needs.*.result, 'failure')
     steps: 

.github/workflows/clean-src-cache.yml

@@ -1,16 +1,20 @@
 name: Clean Source Cache
 
-description: |
-  This workflow cleans up the source cache on the cross-instance cache volume
-  to free up space. It runs daily at midnight and clears files older than 15 days.
+# Description:
+# This workflow cleans up the source cache on the cross-instance cache volume
+# to free up space. It runs daily at midnight and clears files older than 15 days.
 
 on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions: {}
+
 jobs:
   clean-src-cache:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
       options: --user root

.github/workflows/issue-labeled.yml

@@ -4,14 +4,15 @@ on:
   issues:
     types: [labeled]
 
-permissions:  # added using https://github.com/step-security/secure-workflows
-  contents: read
+permissions: {}
 
 jobs:
   issue-labeled-with-status:
     name: status/{confirmed,reviewed} label added
     if: github.event.label.name == 'status/confirmed' || github.event.label.name == 'status/reviewed'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -31,6 +32,8 @@ jobs:
     name: blocked/* label added
     if: startsWith(github.event.label.name, 'blocked/')
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/issue-opened.yml

@@ -11,6 +11,7 @@ jobs:
   add-to-issue-triage:
     if: ${{ contains(github.event.issue.labels.*.name, 'bug :beetle:') }}
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -28,6 +29,7 @@ jobs:
   set-labels:
     if: ${{ contains(github.event.issue.labels.*.name, 'bug :beetle:') }}
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/issue-transferred.yml

@@ -10,6 +10,7 @@ jobs:
   issue-transferred:
     name: Issue Transferred
     runs-on: ubuntu-latest
+    permissions: {}
     if: ${{ !github.event.changes.new_repository.private }}
     steps:
       - name: Generate GitHub App token

.github/workflows/issue-unlabeled.yml

@@ -4,14 +4,15 @@ on:
   issues:
     types: [unlabeled]
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   issue-unlabeled-blocked:
     name: All blocked/* labels removed
     if: startsWith(github.event.label.name, 'blocked/') && github.event.issue.state == 'open'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check for any blocked labels
         id: check-for-blocked-labels

.github/workflows/linux-publish.yml

@@ -17,9 +17,13 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   checkout-linux:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root
@@ -40,6 +44,8 @@ jobs:
 
   publish-x64:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     with:
       environment: production-release
@@ -55,6 +61,8 @@ jobs:
 
   publish-arm:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     with:
       environment: production-release
@@ -70,6 +78,8 @@ jobs:
 
   publish-arm64:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-linux
     with:
       environment: production-release

.github/workflows/macos-publish.yml

@@ -18,9 +18,13 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   checkout-macos:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root
@@ -44,6 +48,8 @@ jobs:
 
   publish-x64-darwin:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -59,6 +65,8 @@ jobs:
 
   publish-x64-mas:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -74,6 +82,8 @@ jobs:
 
   publish-arm64-darwin:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release
@@ -89,6 +99,8 @@ jobs:
 
   publish-arm64-mas:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-macos
     with:
       environment: production-release

.github/workflows/pipeline-electron-build-and-test-and-nan.yml

@@ -55,6 +55,8 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 concurrency:
   group: electron-build-and-test-and-nan-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -62,6 +64,8 @@ concurrency:
 jobs:
   build:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     with:
       build-runs-on: ${{ inputs.build-runs-on }}
       build-container: ${{ inputs.build-container }}
@@ -74,6 +78,10 @@ jobs:
     secrets: inherit
   test:
     uses: ./.github/workflows/pipeline-segment-electron-test.yml
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}
@@ -83,6 +91,8 @@ jobs:
     secrets: inherit
   nn-test:
     uses: ./.github/workflows/pipeline-segment-node-nan-test.yml
+    permissions:
+      contents: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}

.github/workflows/pipeline-electron-build-and-test.yml

@@ -64,14 +64,13 @@ concurrency:
   group: electron-build-and-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
 
-permissions:
-  contents: read
-  issues: read
-  pull-requests: read  
+permissions: {}
 
 jobs:
   build:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     with:
       build-runs-on: ${{ inputs.build-runs-on }}
       build-container: ${{ inputs.build-container }}
@@ -86,6 +85,10 @@ jobs:
     secrets: inherit
   test:
     uses: ./.github/workflows/pipeline-segment-electron-test.yml
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     needs: build
     with:
       target-arch: ${{ inputs.target-arch }}

.github/workflows/pipeline-electron-docs-only.yml

@@ -8,6 +8,8 @@ on:
         description: 'Container to run the docs-only ts compile in'
         type: string
 
+permissions: {}
+
 concurrency:
   group: electron-docs-only-${{ github.ref }}
   cancel-in-progress: true
@@ -19,6 +21,8 @@ jobs:
   docs-only:
     name: Docs Only Compile
     runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:
@@ -50,12 +54,12 @@ jobs:
       shell: bash
       run: |
         cd src/electron
-        node script/yarn create-typescript-definitions
-        node script/yarn tsc -p tsconfig.default_app.json --noEmit
+        node script/yarn.js create-typescript-definitions
+        node script/yarn.js tsc -p tsconfig.default_app.json --noEmit
         for f in build/webpack/*.js
         do
             out="${f:29}"
             if [ "$out" != "base.js" ]; then
-            node script/yarn webpack --config $f --output-filename=$out --output-path=./.tmp --env mode=development
+            node script/yarn.js webpack --config $f --output-filename=$out --output-path=./.tmp --env mode=development
             fi
         done

.github/workflows/pipeline-electron-lint.yml

@@ -8,6 +8,8 @@ on:
         description: 'Container to run lint in'
         type: string
 
+permissions: {}
+
 concurrency:
   group: electron-lint-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -19,6 +21,8 @@ jobs:
   lint:
     name: Lint
     runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
     timeout-minutes: 20
     container: ${{ fromJSON(inputs.container) }}
     steps:
@@ -74,11 +78,11 @@ jobs:
         # but then we would lint its contents (at least gn format), and it doesn't pass it.
 
         cd src/electron
-        node script/yarn install --frozen-lockfile
-        node script/yarn lint
+        node script/yarn.js install --immutable
+        node script/yarn.js lint
     - name: Run Script Typechecker
       shell: bash
       run: |
         cd src/electron
-        node script/yarn tsc -p tsconfig.script.json
+        node script/yarn.js tsc -p tsconfig.script.json
     

.github/workflows/pipeline-segment-electron-build.yml

@@ -59,6 +59,8 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 concurrency:
   group: electron-build-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.target-variant }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -81,6 +83,8 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.build-runs-on }}
+    permissions:
+      contents: read
     container: ${{ fromJSON(inputs.build-container) }}
     environment: ${{ inputs.environment }}
     env:

.github/workflows/pipeline-segment-electron-gn-check.yml

@@ -26,6 +26,8 @@ on:
         type: string
         default: testing
 
+permissions: {}
+
 concurrency:
   group: electron-gn-check-${{ inputs.target-platform }}-${{ github.ref }}
   cancel-in-progress: true
@@ -41,6 +43,8 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.check-runs-on }}
+    permissions:
+      contents: read
     container: ${{ fromJSON(inputs.check-container) }}
     steps:
     - name: Checkout Electron

.github/workflows/pipeline-segment-electron-test.yml

@@ -35,10 +35,7 @@ concurrency:
   group: electron-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
 
-permissions:
-  contents: read
-  issues: read
-  pull-requests: read
+permissions: {}
 
 env:
   CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
@@ -53,6 +50,10 @@ jobs:
       run:
         shell: bash
     runs-on: ${{ inputs.test-runs-on }}
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     container: ${{ fromJSON(inputs.test-container) }}
     strategy:
       fail-fast: false
@@ -196,10 +197,7 @@ jobs:
     #    sudo security authorizationdb write com.apple.trust-settings.admin allow
     #    cd src/electron
     #    ./script/codesign/generate-identity.sh
-    - name: Install Datadog CLI
-      run: |
-        cd src/electron
-        node script/yarn global add @datadog/datadog-ci
+
     - name: Run Electron Tests
       shell: bash
       env:
@@ -225,7 +223,7 @@ jobs:
               export ELECTRON_FORCE_TEST_SUITE_EXIT="true"
             fi
           fi
-          node script/yarn test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
+          node script/yarn.js test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
         else
           chown :builduser .. && chmod g+w ..
           chown -R :builduser . && chmod -R g+w .
@@ -242,9 +240,14 @@ jobs:
             export MOCHA_TIMEOUT=180000
             echo "Piping output to ASAN_SYMBOLIZE ($ASAN_SYMBOLIZE)"
             cd electron
-            runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn test --runners=main --trace-uncaught --enable-logging --files $tests_files | $ASAN_SYMBOLIZE
+            runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --runners=main --trace-uncaught --enable-logging --files $tests_files | $ASAN_SYMBOLIZE
           else
-            runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn test --runners=main --trace-uncaught --enable-logging --files $tests_files
+            if [ "${{ inputs.target-arch }}" = "arm" ]; then
+              runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --skipYarnInstall --runners=main --trace-uncaught --enable-logging --files $tests_files
+            else 
+              runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --runners=main --trace-uncaught --enable-logging --files $tests_files
+            fi
+            
           fi
         fi
     - name: Upload Test results to Datadog
@@ -256,9 +259,10 @@ jobs:
         DD_TAGS: "os.architecture:${{ inputs.target-arch }},os.family:${{ inputs.target-platform }},os.platform:${{ inputs.target-platform }},asan:${{ inputs.is-asan }}"
       run: |
         if ! [ -z $DD_API_KEY ] && [ -f src/electron/junit/test-results-main.xml ]; then
-          export DATADOG_PATH=`node src/electron/script/yarn global bin`
-          $DATADOG_PATH/datadog-ci junit upload src/electron/junit/test-results-main.xml
-        fi          
+          cd src/electron
+          export DATADOG_PATH=`node script/yarn.js bin datadog-ci`
+          $DATADOG_PATH junit upload junit/test-results-main.xml
+        fi
       if: always() && !cancelled()
     - name: Upload Test Artifacts
       if: always() && !cancelled()

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -26,6 +26,8 @@ on:
         type: string
         default: testing
 
+permissions: {}
+
 concurrency:
   group: electron-node-nan-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
   cancel-in-progress: ${{ github.ref_protected != true }}
@@ -39,6 +41,8 @@ jobs:
   node-tests:
     name: Run Node.js Tests
     runs-on: electron-arc-centralus-linux-amd64-8core
+    permissions:
+      contents: read
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}
@@ -93,6 +97,8 @@ jobs:
   nan-tests:
     name: Run Nan Tests
     runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
     timeout-minutes: 30
     env: 
       TARGET_ARCH: ${{ inputs.target-arch }}

.github/workflows/pull-request-labeled.yml

@@ -11,6 +11,7 @@ jobs:
     name: backport/requested label added
     if: github.event.label.name == 'backport/requested 🗳'
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Trigger Slack workflow
         uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
@@ -28,6 +29,7 @@ jobs:
     name: deprecation-review/complete label added
     if: github.event.label.name == 'deprecation-review/complete ✅'
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/semantic.yml

@@ -7,8 +7,7 @@ on:
       - edited
       - synchronize
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   main:

.github/workflows/stable-prep-items.yml

@@ -11,6 +11,7 @@ jobs:
   check-stable-prep-items:
     name: Check Stable Prep Items
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1

.github/workflows/stale.yml

@@ -10,6 +10,7 @@ permissions: {}
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate GitHub App token
         uses: electron/github-app-auth-action@384fd19694fe7b6dcc9a684746c6976ad78228ae # v1.1.1
@@ -31,6 +32,7 @@ jobs:
           only-pr-labels: not-a-real-label
   pending-repro:
     runs-on: ubuntu-latest
+    permissions: {}
     if: ${{ always() }}
     needs: stale
     steps:

.github/workflows/windows-publish.yml

@@ -18,9 +18,13 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   checkout-windows:
     runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
     container:
       image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
       options: --user root --device /dev/fuse --cap-add SYS_ADMIN
@@ -48,6 +52,8 @@ jobs:
 
   publish-x64-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       environment: production-release
@@ -62,6 +68,8 @@ jobs:
 
   publish-arm64-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       environment: production-release
@@ -76,6 +84,8 @@ jobs:
 
   publish-x86-win:
     uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
     needs: checkout-windows
     with:
       environment: production-release

.gitignore

@@ -53,3 +53,5 @@ ts-gen
 patches/mtime-cache.json
 
 spec/fixtures/logo.png
+
+.yarn/install-state.gz

.yarnrc.yml

@@ -0,0 +1,12 @@
+enableScripts: false
+
+nmHoistingLimits: workspaces
+
+nodeLinker: node-modules
+
+npmMinimalAgeGate: 10080
+
+npmPreapprovedPackages:
+  - "@electron/*"
+
+yarnPath: .yarn/releases/yarn-4.11.0.cjs

DEPS

@@ -4,7 +4,7 @@ vars = {
   'chromium_version':
     '144.0.7526.0',
   'node_version':
-    'v24.11.0',
+    'v24.11.1',
   'nan_version':
     '675cefebca42410733da8a454c8d9391fcebfbc2',
   'squirrel.mac_version':
@@ -30,9 +30,6 @@ vars = {
   # The path of the sysroots.json file.
   'sysroots_json_path': 'electron/script/sysroots.json',
 
-  # KEEP IN SYNC WITH utils.js FILE
-  'yarn_version': '1.22.22',
-
   # To be able to build clean Chromium from sources.
   'apply_patches': True,
 
@@ -155,7 +152,7 @@ hooks = [
     'action': [
       'python3',
       '-c',
-      'import os, subprocess; os.chdir(os.path.join("src", "electron")); subprocess.check_call(["python3", "script/lib/npx.py", "yarn@' + (Var("yarn_version")) + '", "install", "--frozen-lockfile"]);',
+      'import os, subprocess; os.chdir(os.path.join("src", "electron")); subprocess.check_call(["node", ".yarn/releases/yarn-4.11.0.cjs", "install", "--immutable"]);',
     ],
   },
   {

docs/api/browser-window.md

@@ -1227,7 +1227,8 @@ Captures a snapshot of the page within `rect`. Omitting `rect` will capture the
 
 Returns `Promise<void>` - the promise will resolve when the page has finished loading
 (see [`did-finish-load`](web-contents.md#event-did-finish-load)), and rejects
-if the page fails to load (see [`did-fail-load`](web-contents.md#event-did-fail-load)).
+if the page fails to load (see
+[`did-fail-load`](web-contents.md#event-did-fail-load)). A noop rejection handler is already attached, which avoids unhandled rejection errors. If the existing page has a beforeUnload handler, [`did-fail-load`](web-contents.md#event-did-fail-load) will be called unless [`will-prevent-unload`](web-contents.md#event-did-fail-load) is handled.
 
 Same as [`webContents.loadURL(url[, options])`](web-contents.md#contentsloadurlurl-options).
 

docs/api/structures/base-window-options.md

@@ -72,6 +72,9 @@
   some GTK+3 desktop environments. Default is `false`.
 * `transparent` boolean (optional) - Makes the window [transparent](../../tutorial/custom-window-styles.md#transparent-windows).
   Default is `false`. On Windows, does not work unless the window is frameless.
+  When you add a [`View`](../view.md) to a `BaseWindow`, you'll need to call
+  [`view.setBackgroundColor`](../view.md#viewsetbackgroundcolorcolor) with a transparent
+  background color on that view to make its background transparent as well.
 * `type` string (optional) - The type of window, default is normal window. See more about
   this below.
 * `visualEffectState` string (optional) _macOS_ - Specify how the material

docs/api/web-contents.md

@@ -1079,7 +1079,7 @@ Emitted when the [mainFrame](web-contents.md#contentsmainframe-readonly), an `<i
 Returns `Promise<void>` - the promise will resolve when the page has finished loading
 (see [`did-finish-load`](web-contents.md#event-did-finish-load)), and rejects
 if the page fails to load (see
-[`did-fail-load`](web-contents.md#event-did-fail-load)). A noop rejection handler is already attached, which avoids unhandled rejection errors.
+[`did-fail-load`](web-contents.md#event-did-fail-load)). A noop rejection handler is already attached, which avoids unhandled rejection errors. If the existing page has a beforeUnload handler, [`did-fail-load`](web-contents.md#event-did-fail-load) will be called unless [`will-prevent-unload`](web-contents.md#event-did-fail-load) is handled.
 
 Loads the `url` in the window. The `url` must contain the protocol prefix,
 e.g. the `http://` or `file://`. If the load should bypass http cache then

package.json

@@ -5,6 +5,7 @@
   "description": "Build cross platform desktop apps with JavaScript, HTML, and CSS",
   "devDependencies": {
     "@azure/storage-blob": "^12.28.0",
+    "@datadog/datadog-ci": "^4.1.2",
     "@electron/asar": "^3.2.13",
     "@electron/docs-parser": "^2.0.0",
     "@electron/fiddle-core": "^1.3.4",
@@ -40,6 +41,7 @@
     "lint-staged": "^16.1.0",
     "markdownlint-cli2": "^0.18.0",
     "minimist": "^1.2.8",
+    "node-gyp": "^11.4.2",
     "null-loader": "^4.0.1",
     "pre-flight": "^2.0.0",
     "process": "^0.11.10",
@@ -133,7 +135,14 @@
       "node script/gen-libc++-filenames.js"
     ]
   },
-  "resolutions": {
-    "nan": "nodejs/nan#e14bdcd1f72d62bca1d541b66da43130384ec213"
+  "packageManager": "yarn@4.11.0",
+  "workspaces": [
+    "spec",
+    "spec/fixtures/native-addon/*"
+  ],
+  "dependenciesMeta": {
+    "dugite": {
+      "built": true
+    }
   }
 }

patches/devtools_frontend/.patches

@@ -1 +1,2 @@
 chore_expose_ui_to_allow_electron_to_set_dock_side.patch
+fix_element_tree_flickering_with_node_inspection.patch

patches/devtools_frontend/fix_element_tree_flickering_with_node_inspection.patch

@@ -0,0 +1,107 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alex Rudenko <alexrudenko@chromium.org>
+Date: Thu, 20 Nov 2025 11:18:30 +0100
+Subject: Fix element tree flickering with node inspection
+
+Regressed in https://crrev.com/c/6888910. The highlighting in the tree
+outline emits the INSPECT_MODE_WILL_BE_TOGGLED on the overlay model
+causing the tree to clear the highlight immediately. This CL
+recovers the logic missed in the https://crrev.com/c/6888910
+to prevent re-entrancy during highlighting.
+
+Fixed: 462120622
+Change-Id: I08af098f7a142085c2fb16511031855623e07c4b
+Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/7170551
+Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
+Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
+Auto-Submit: Alex Rudenko <alexrudenko@chromium.org>
+
+diff --git a/front_end/panels/elements/DOMTreeWidget.test.ts b/front_end/panels/elements/DOMTreeWidget.test.ts
+index 43ae133087a61c47c84349c7550485bd52b23847..d83fddd7afc1871b8064631d63c1b6b1e5357b70 100644
+--- a/front_end/panels/elements/DOMTreeWidget.test.ts
++++ b/front_end/panels/elements/DOMTreeWidget.test.ts
+@@ -24,6 +24,7 @@ describeWithMockConnection('DOMTreeWidget', () => {
+         elementsTreeOutline,
+         alreadyExpandedParentTreeElement: null,
+         highlightedTreeElement: null,
++        isUpdatingHighlights: false,
+       });
+       const domTree = new Elements.ElementsTreeOutline.DOMTreeWidget(undefined, view);
+       domTree.performUpdate();
+diff --git a/front_end/panels/elements/ElementsTreeOutline.ts b/front_end/panels/elements/ElementsTreeOutline.ts
+index 978d20872455d630f7f852e5f5269433295a8c6b..0cd5891377d402fceec26168efed94b4f7690365 100644
+--- a/front_end/panels/elements/ElementsTreeOutline.ts
++++ b/front_end/panels/elements/ElementsTreeOutline.ts
+@@ -104,6 +104,7 @@ interface ViewInput {
+ interface ViewOutput {
+   elementsTreeOutline?: ElementsTreeOutline;
+   highlightedTreeElement: ElementsTreeElement|null;
++  isUpdatingHighlights: boolean;
+   alreadyExpandedParentTreeElement: ElementsTreeElement|null;
+ }
+ 
+@@ -135,6 +136,7 @@ export const DEFAULT_VIEW = (input: ViewInput, output: ViewOutput, target: HTMLE
+   // Node highlighting logic. FIXME: express as a lit template.
+   const previousHighlightedNode = output.highlightedTreeElement?.node() ?? null;
+   if (previousHighlightedNode !== input.currentHighlightedNode) {
++    output.isUpdatingHighlights = true;
+     let treeElement: ElementsTreeElement|null = null;
+ 
+     if (output.highlightedTreeElement) {
+@@ -172,6 +174,7 @@ export const DEFAULT_VIEW = (input: ViewInput, output: ViewOutput, target: HTMLE
+     output.highlightedTreeElement = treeElement;
+     output.elementsTreeOutline.setHoverEffect(treeElement);
+     treeElement?.reveal(true);
++    output.isUpdatingHighlights = false;
+   }
+ };
+ 
+@@ -224,6 +227,7 @@ export class DOMTreeWidget extends UI.Widget.Widget {
+   #viewOutput: ViewOutput = {
+     highlightedTreeElement: null,
+     alreadyExpandedParentTreeElement: null,
++    isUpdatingHighlights: false,
+   };
+   #highlightThrottler = new Common.Throttler.Throttler(100);
+ 
+@@ -238,8 +242,8 @@ export class DOMTreeWidget extends UI.Widget.Widget {
+           SDK.OverlayModel.OverlayModel, SDK.OverlayModel.Events.HIGHLIGHT_NODE_REQUESTED, this.#highlightNode, this,
+           {scoped: true});
+       SDK.TargetManager.TargetManager.instance().addModelListener(
+-          SDK.OverlayModel.OverlayModel, SDK.OverlayModel.Events.INSPECT_MODE_WILL_BE_TOGGLED, this.#clearState, this,
+-          {scoped: true});
++          SDK.OverlayModel.OverlayModel, SDK.OverlayModel.Events.INSPECT_MODE_WILL_BE_TOGGLED,
++          this.#clearHighlightedNode, this, {scoped: true});
+     }
+   }
+ 
+@@ -250,7 +254,13 @@ export class DOMTreeWidget extends UI.Widget.Widget {
+     });
+   }
+ 
+-  #clearState(): void {
++  #clearHighlightedNode(): void {
++    // Highlighting an element via tree outline will emit the
++    // INSPECT_MODE_WILL_BE_TOGGLED event, therefore, we skip it if the view
++    // informed us that it is updating the element.
++    if (this.#viewOutput.isUpdatingHighlights) {
++      return;
++    }
+     this.#currentHighlightedNode = null;
+     this.requestUpdate();
+   }
+@@ -304,11 +314,11 @@ export class DOMTreeWidget extends UI.Widget.Widget {
+           currentHighlightedNode: this.#currentHighlightedNode,
+           onElementsTreeUpdated: this.onElementsTreeUpdated.bind(this),
+           onSelectedNodeChanged: event => {
+-            this.#clearState();
++            this.#clearHighlightedNode();
+             this.onSelectedNodeChanged(event);
+           },
+-          onElementCollapsed: this.#clearState.bind(this),
+-          onElementExpanded: this.#clearState.bind(this),
++          onElementCollapsed: this.#clearHighlightedNode.bind(this),
++          onElementExpanded: this.#clearHighlightedNode.bind(this),
+         },
+         this.#viewOutput, this.contentElement);
+   }

patches/nan/.patches

@@ -5,3 +5,4 @@ test_use_v8_version_check_instead_of_node_version_check.patch
 fix_remove_deprecated_propertycallbackinfo_holder.patch
 fix_deprecation_of_v8_context_and_v8_object_api_methods.patch
 remove_accesscontrol_enum_for_v8_14_4_59.patch
+chore_add_yarnrc_yml_and_yarn_lock_file_to_use_yarn_v4.patch

patches/node/.patches

@@ -37,9 +37,9 @@ fix_allow_disabling_fetch_in_renderer_and_worker_processes.patch
 feat_disable_js_source_phase_imports_by_default.patch
 fix_avoid_external_memory_leak_on_invalid_tls_protocol_versions.patch
 lib_check_sharedarraybuffer_existence_in_fast-utf8-stream.patch
-chore_handle_support_for_import_defer_as_ns_and_import_defer.patch
 api_delete_deprecated_fields_on_v8_isolate.patch
 api_promote_deprecation_of_v8_context_and_v8_object_api_methods.patch
 src_use_cp_utf8_for_wide_file_names_on_win32.patch
 fix_ensure_traverseparent_bails_on_resource_path_exit.patch
 reland_temporal_unflag_temporal.patch
+src_handle_der_decoding_errors_from_system_certificates.patch

patches/node/api_delete_deprecated_fields_on_v8_isolate.patch

@@ -6,10 +6,10 @@ Subject: Delete deprecated fields on v8::Isolate
 https://chromium-review.googlesource.com/c/v8/v8/+/7081397
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 14be033113bfb13c64e5f99446afaf0cb2aa16a9..3eccf4ce7fcd13091186086456e60334f95f643e 100644
+index ea3e9374c30be92ba5668e33773ffbb2aef55b30..44ba3c42c7a980eee19e1aadcbe7999eefeda989 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -225,8 +225,6 @@ void SetIsolateCreateParamsForNode(Isolate::CreateParams* params) {
+@@ -231,8 +231,6 @@ void SetIsolateCreateParamsForNode(Isolate::CreateParams* params) {
      // heap based on the actual physical memory.
      params->constraints.ConfigureDefaults(total_memory, 0);
    }

patches/node/api_remove_deprecated_getisolate.patch

@@ -6,10 +6,10 @@ Subject: Remove deprecated `GetIsolate`
 https://chromium-review.googlesource.com/c/v8/v8/+/6905244
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index 072deb1fa70313e33397f6ff994e3f3548e86092..14be033113bfb13c64e5f99446afaf0cb2aa16a9 100644
+index 451796ffc4ec93b6e317dd49d92070c61aca04e5..ea3e9374c30be92ba5668e33773ffbb2aef55b30 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -669,7 +669,7 @@ std::unique_ptr<MultiIsolatePlatform> MultiIsolatePlatform::Create(
+@@ -687,7 +687,7 @@ std::unique_ptr<MultiIsolatePlatform> MultiIsolatePlatform::Create(
  
  MaybeLocal<Object> GetPerContextExports(Local<Context> context,
                                          IsolateData* isolate_data) {
@@ -18,7 +18,7 @@ index 072deb1fa70313e33397f6ff994e3f3548e86092..14be033113bfb13c64e5f99446afaf0c
    EscapableHandleScope handle_scope(isolate);
  
    Local<Object> global = context->Global();
-@@ -715,7 +715,7 @@ void ProtoThrower(const FunctionCallbackInfo<Value>& info) {
+@@ -733,7 +733,7 @@ void ProtoThrower(const FunctionCallbackInfo<Value>& info) {
  // This runs at runtime, regardless of whether the context
  // is created from a snapshot.
  Maybe<void> InitializeContextRuntime(Local<Context> context) {
@@ -27,7 +27,7 @@ index 072deb1fa70313e33397f6ff994e3f3548e86092..14be033113bfb13c64e5f99446afaf0c
    HandleScope handle_scope(isolate);
  
    // When `IsCodeGenerationFromStringsAllowed` is true, V8 takes the fast path
-@@ -794,7 +794,7 @@ Maybe<void> InitializeContextRuntime(Local<Context> context) {
+@@ -812,7 +812,7 @@ Maybe<void> InitializeContextRuntime(Local<Context> context) {
  }
  
  Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
@@ -36,7 +36,7 @@ index 072deb1fa70313e33397f6ff994e3f3548e86092..14be033113bfb13c64e5f99446afaf0c
    HandleScope handle_scope(isolate);
  
    // Delete `Intl.v8BreakIterator`
-@@ -819,7 +819,7 @@ Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
+@@ -837,7 +837,7 @@ Maybe<void> InitializeBaseContextForSnapshot(Local<Context> context) {
  }
  
  Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
@@ -45,7 +45,7 @@ index 072deb1fa70313e33397f6ff994e3f3548e86092..14be033113bfb13c64e5f99446afaf0c
    HandleScope handle_scope(isolate);
  
    // Initialize the default values.
-@@ -837,7 +837,7 @@ Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
+@@ -855,7 +855,7 @@ Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
  MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
                                              IsolateData* isolate_data) {
    CHECK(isolate_data);
@@ -54,7 +54,7 @@ index 072deb1fa70313e33397f6ff994e3f3548e86092..14be033113bfb13c64e5f99446afaf0c
    EscapableHandleScope scope(isolate);
    Context::Scope context_scope(context);
  
-@@ -861,7 +861,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
+@@ -879,7 +879,7 @@ MaybeLocal<Object> InitializePrivateSymbols(Local<Context> context,
  MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
                                                 IsolateData* isolate_data) {
    CHECK(isolate_data);
@@ -63,7 +63,7 @@ index 072deb1fa70313e33397f6ff994e3f3548e86092..14be033113bfb13c64e5f99446afaf0c
    EscapableHandleScope scope(isolate);
    Context::Scope context_scope(context);
  
-@@ -887,7 +887,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
+@@ -905,7 +905,7 @@ MaybeLocal<Object> InitializePerIsolateSymbols(Local<Context> context,
  Maybe<void> InitializePrimordials(Local<Context> context,
                                    IsolateData* isolate_data) {
    // Run per-context JS files.
@@ -159,10 +159,10 @@ index a78817467518245c4a190e870e0eb30658eafcdb..13dcf0e9c2c86486d1e43763033f43ac
    } else {
      info.js_execution_async_resources = 0;
 diff --git a/src/inspector/network_agent.cc b/src/inspector/network_agent.cc
-index d136b72e598d07f3c2fcc9c2c8ba84f5ff1aaad7..649008aafc8d68cfecb02c28ad1e26a9b749f7bd 100644
+index aacd4e8cb83c88649537ab5d9e1ce752ea5b87a8..a47ea86adb9da081a125b6590bcd96f43053d44b 100644
 --- a/src/inspector/network_agent.cc
 +++ b/src/inspector/network_agent.cc
-@@ -29,31 +29,31 @@ using v8::Value;
+@@ -31,31 +31,31 @@ constexpr size_t kDefaultMaxTotalBufferSize = 100 * 1024 * 1024;  // 100MB
  Maybe<protocol::String> ObjectGetProtocolString(v8::Local<v8::Context> context,
                                                  Local<Object> object,
                                                  Local<v8::String> property) {
@@ -200,7 +200,7 @@ index d136b72e598d07f3c2fcc9c2c8ba84f5ff1aaad7..649008aafc8d68cfecb02c28ad1e26a9
             .ToLocal(&value) ||
        !value->IsNumber()) {
      return Nothing<double>();
-@@ -65,9 +65,9 @@ Maybe<double> ObjectGetDouble(v8::Local<v8::Context> context,
+@@ -67,9 +67,9 @@ Maybe<double> ObjectGetDouble(v8::Local<v8::Context> context,
  Maybe<int> ObjectGetInt(v8::Local<v8::Context> context,
                          Local<Object> object,
                          const char* property) {
@@ -212,7 +212,7 @@ index d136b72e598d07f3c2fcc9c2c8ba84f5ff1aaad7..649008aafc8d68cfecb02c28ad1e26a9
             .ToLocal(&value) ||
        !value->IsInt32()) {
      return Nothing<int>();
-@@ -79,9 +79,9 @@ Maybe<int> ObjectGetInt(v8::Local<v8::Context> context,
+@@ -81,9 +81,9 @@ Maybe<int> ObjectGetInt(v8::Local<v8::Context> context,
  Maybe<bool> ObjectGetBool(v8::Local<v8::Context> context,
                            Local<Object> object,
                            const char* property) {
@@ -224,7 +224,7 @@ index d136b72e598d07f3c2fcc9c2c8ba84f5ff1aaad7..649008aafc8d68cfecb02c28ad1e26a9
             .ToLocal(&value) ||
        !value->IsBoolean()) {
      return Nothing<bool>();
-@@ -93,9 +93,9 @@ Maybe<bool> ObjectGetBool(v8::Local<v8::Context> context,
+@@ -95,9 +95,9 @@ Maybe<bool> ObjectGetBool(v8::Local<v8::Context> context,
  MaybeLocal<v8::Object> ObjectGetObject(v8::Local<v8::Context> context,
                                         Local<Object> object,
                                         const char* property) {
@@ -236,7 +236,7 @@ index d136b72e598d07f3c2fcc9c2c8ba84f5ff1aaad7..649008aafc8d68cfecb02c28ad1e26a9
             .ToLocal(&value) ||
        !value->IsObject()) {
      return {};
-@@ -106,7 +106,7 @@ MaybeLocal<v8::Object> ObjectGetObject(v8::Local<v8::Context> context,
+@@ -108,7 +108,7 @@ MaybeLocal<v8::Object> ObjectGetObject(v8::Local<v8::Context> context,
  // Create a protocol::Network::Headers from the v8 object.
  std::unique_ptr<protocol::Network::Headers> createHeadersFromObject(
      v8::Local<v8::Context> context, Local<Object> headers_obj) {
@@ -245,7 +245,7 @@ index d136b72e598d07f3c2fcc9c2c8ba84f5ff1aaad7..649008aafc8d68cfecb02c28ad1e26a9
  
    std::unique_ptr<protocol::DictionaryValue> dict =
        protocol::DictionaryValue::create();
-@@ -127,7 +127,7 @@ std::unique_ptr<protocol::Network::Headers> createHeadersFromObject(
+@@ -129,7 +129,7 @@ std::unique_ptr<protocol::Network::Headers> createHeadersFromObject(
               .To(&property_value)) {
        return {};
      }
@@ -254,7 +254,7 @@ index d136b72e598d07f3c2fcc9c2c8ba84f5ff1aaad7..649008aafc8d68cfecb02c28ad1e26a9
                      property_value);
    }
  
-@@ -137,7 +137,7 @@ std::unique_ptr<protocol::Network::Headers> createHeadersFromObject(
+@@ -139,7 +139,7 @@ std::unique_ptr<protocol::Network::Headers> createHeadersFromObject(
  // Create a protocol::Network::Request from the v8 object.
  std::unique_ptr<protocol::Network::Request> createRequestFromObject(
      v8::Local<v8::Context> context, Local<Object> request) {
@@ -263,7 +263,7 @@ index d136b72e598d07f3c2fcc9c2c8ba84f5ff1aaad7..649008aafc8d68cfecb02c28ad1e26a9
    protocol::String url;
    if (!ObjectGetProtocolString(context, request, "url").To(&url)) {
      return {};
-@@ -169,7 +169,7 @@ std::unique_ptr<protocol::Network::Request> createRequestFromObject(
+@@ -171,7 +171,7 @@ std::unique_ptr<protocol::Network::Request> createRequestFromObject(
  // Create a protocol::Network::Response from the v8 object.
  std::unique_ptr<protocol::Network::Response> createResponseFromObject(
      v8::Local<v8::Context> context, Local<Object> response) {
@@ -272,7 +272,7 @@ index d136b72e598d07f3c2fcc9c2c8ba84f5ff1aaad7..649008aafc8d68cfecb02c28ad1e26a9
    protocol::String url;
    if (!ObjectGetProtocolString(context, response, "url").To(&url)) {
      return {};
-@@ -210,7 +210,7 @@ std::unique_ptr<protocol::Network::Response> createResponseFromObject(
+@@ -212,7 +212,7 @@ std::unique_ptr<protocol::Network::Response> createResponseFromObject(
  
  std::unique_ptr<protocol::Network::WebSocketResponse> createWebSocketResponse(
      v8::Local<v8::Context> context, Local<Object> response) {
@@ -295,7 +295,7 @@ index 27aeac589b19cd681923fb848ce5f36c66fc05e2..5f2900869763f40cac54e3cb3fe2e24e
          module_api_version(module_api_version) {
      napi_clear_last_error(this);
 diff --git a/src/module_wrap.cc b/src/module_wrap.cc
-index 8fed194cbae9ce75bd0805b4df30b4de64fbbefa..a584e3a80adb69d2028dc79450349823ab973a58 100644
+index fa2f28989be19e8ea8f53b990ae96be92ef3c3a3..c26d1301d7b81a6c281d5465bfb29a5786b09dc2 100644
 --- a/src/module_wrap.cc
 +++ b/src/module_wrap.cc
 @@ -99,7 +99,7 @@ ModuleCacheKey ModuleCacheKey::From(Local<Context> context,
@@ -307,7 +307,7 @@ index 8fed194cbae9ce75bd0805b4df30b4de64fbbefa..a584e3a80adb69d2028dc79450349823
    std::size_t h1 = specifier->GetIdentityHash();
    size_t num_attributes = import_attributes->Length() / elements_per_attribute;
    ImportAttributeVector attributes;
-@@ -1022,7 +1022,7 @@ MaybeLocal<Module> ModuleWrap::ResolveModuleCallback(
+@@ -1023,7 +1023,7 @@ MaybeLocal<Module> ModuleWrap::ResolveModuleCallback(
      return {};
    }
    DCHECK_NOT_NULL(resolved_module);
@@ -316,7 +316,7 @@ index 8fed194cbae9ce75bd0805b4df30b4de64fbbefa..a584e3a80adb69d2028dc79450349823
  }
  
  // static
-@@ -1046,7 +1046,7 @@ MaybeLocal<Object> ModuleWrap::ResolveSourceCallback(
+@@ -1047,7 +1047,7 @@ MaybeLocal<Object> ModuleWrap::ResolveSourceCallback(
      Local<String> url = resolved_module->object()
                              ->GetInternalField(ModuleWrap::kURLSlot)
                              .As<String>();
@@ -325,7 +325,7 @@ index 8fed194cbae9ce75bd0805b4df30b4de64fbbefa..a584e3a80adb69d2028dc79450349823
      return {};
    }
    CHECK(module_source_object->IsObject());
-@@ -1059,7 +1059,7 @@ Maybe<ModuleWrap*> ModuleWrap::ResolveModule(
+@@ -1060,7 +1060,7 @@ Maybe<ModuleWrap*> ModuleWrap::ResolveModule(
      Local<String> specifier,
      Local<FixedArray> import_attributes,
      Local<Module> referrer) {
@@ -334,7 +334,7 @@ index 8fed194cbae9ce75bd0805b4df30b4de64fbbefa..a584e3a80adb69d2028dc79450349823
    Environment* env = Environment::GetCurrent(context);
    if (env == nullptr) {
      THROW_ERR_EXECUTION_ENVIRONMENT_NOT_AVAILABLE(isolate);
-@@ -1104,7 +1104,7 @@ MaybeLocal<Promise> ImportModuleDynamicallyWithPhase(
+@@ -1105,7 +1105,7 @@ MaybeLocal<Promise> ImportModuleDynamicallyWithPhase(
      Local<String> specifier,
      ModuleImportPhase phase,
      Local<FixedArray> import_attributes) {
@@ -343,7 +343,7 @@ index 8fed194cbae9ce75bd0805b4df30b4de64fbbefa..a584e3a80adb69d2028dc79450349823
    Environment* env = Environment::GetCurrent(context);
    if (env == nullptr) {
      THROW_ERR_EXECUTION_ENVIRONMENT_NOT_AVAILABLE(isolate);
-@@ -1346,7 +1346,7 @@ MaybeLocal<Module> LinkRequireFacadeWithOriginal(
+@@ -1347,7 +1347,7 @@ MaybeLocal<Module> LinkRequireFacadeWithOriginal(
      Local<FixedArray> import_attributes,
      Local<Module> referrer) {
    Environment* env = Environment::GetCurrent(context);
@@ -353,7 +353,7 @@ index 8fed194cbae9ce75bd0805b4df30b4de64fbbefa..a584e3a80adb69d2028dc79450349823
    CHECK(!env->temporary_required_module_facade_original.IsEmpty());
    return env->temporary_required_module_facade_original.Get(isolate);
 diff --git a/src/node.h b/src/node.h
-index 7fae281a6e0f3c1a9f0eb97536883bb26c16d94d..fb37310f44c8d06d1ab2697ed64a0b539776a411 100644
+index 84c121f13caa1472cef67113fbc7b7213e7af7e1..6a6f6f057f89ae72c680d19f4d478d421dede613 100644
 --- a/src/node.h
 +++ b/src/node.h
 @@ -1064,7 +1064,7 @@ NODE_DEPRECATED("Use v8::Date::ValueOf() directly",
@@ -502,7 +502,7 @@ index 6aad252eb5681bb9ab9890812602b43c418e7a7f..5f7ef8cc58f589ba30a44abaaaaaf151
    Local<Array> keys;
    if (!entries->GetOwnPropertyNames(context).ToLocal(&keys))
 diff --git a/src/node_errors.cc b/src/node_errors.cc
-index 4386a1bc5678e351ce084cd2c47202561619b164..8d51201ad24999ed8f54e16c7878432d41841cf2 100644
+index 15d78e3eca9693dc518ccb28fc7c02fa1372f34b..9286d20c19a1e06001ca4b60981291d320858064 100644
 --- a/src/node_errors.cc
 +++ b/src/node_errors.cc
 @@ -633,7 +633,7 @@ v8::ModifyCodeGenerationFromStringsResult ModifyCodeGenerationFromStrings(
@@ -523,7 +523,7 @@ index 4386a1bc5678e351ce084cd2c47202561619b164..8d51201ad24999ed8f54e16c7878432d
    switch (message->ErrorLevel()) {
      case Isolate::MessageErrorLevel::kMessageWarning: {
        Environment* env = Environment::GetCurrent(isolate);
-@@ -1161,7 +1161,7 @@ void Initialize(Local<Object> target,
+@@ -1160,7 +1160,7 @@ void Initialize(Local<Object> target,
    SetMethod(
        context, target, "getErrorSourcePositions", GetErrorSourcePositions);
  
@@ -634,7 +634,7 @@ index 2a5fe9fe501d1fd9356eeb7d044a872fa5a55f38..39f6f142044c42904d234da20a266315
    env->AssignToContext(context, this, ContextInfo(""));
    // The environment can also purge empty wrappers in the check callback,
 diff --git a/src/node_report.cc b/src/node_report.cc
-index c82c6bcc083ba60137e83b3c291130636db3162f..0d06f61d7fb2472a3d7a66854040dc493406b79e 100644
+index 139e2ae3f2de1f1e28876bdc5332f68ea392484e..d479ada5bf0776fac52cd43c952a7f418ebc0679 100644
 --- a/src/node_report.cc
 +++ b/src/node_report.cc
 @@ -400,7 +400,7 @@ static void PrintJavaScriptErrorProperties(JSONWriter* writer,
@@ -660,10 +660,10 @@ index c2e24b4645e7903e08c80aead1c18c7bcff1bd89..e34d24d51d5c090b560d06f727043f20
    // Recreate the buffer in the constructor.
    InternalFieldInfo* casted_info = static_cast<InternalFieldInfo*>(info);
 diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
-index 7bb4d4108c8326d69da5236c7ea7f00ddb68cea9..cf9ce6686cffca7e700a0e20cb9f776a5f0f7c4a 100644
+index 8b0bd18e6d9434aba4dd1a02beb0d8a2347c851c..1cab6dde9df945eb82ae59908711cfb75bd8993f 100644
 --- a/src/node_sqlite.cc
 +++ b/src/node_sqlite.cc
-@@ -2020,7 +2020,7 @@ bool StatementSync::BindParams(const FunctionCallbackInfo<Value>& args) {
+@@ -2018,7 +2018,7 @@ bool StatementSync::BindParams(const FunctionCallbackInfo<Value>& args) {
  
    if (args[0]->IsObject() && !args[0]->IsArrayBufferView()) {
      Local<Object> obj = args[0].As<Object>();
@@ -699,7 +699,7 @@ index 9d1e8ec05161570db11f7b662395509774668d78..9b91f83d879ea02fd3d61913c8dfd35b
    BindingData* binding = realm->AddBindingData<BindingData>(holder);
    CHECK_NOT_NULL(binding);
 diff --git a/src/node_v8.cc b/src/node_v8.cc
-index 98e392f6d7118bee8a3d0bce4de1ded76a293001..152b030198c6b36efd2be6c06f5c6e8bbc7cfadb 100644
+index 5cf30e8094b0014e12fa26d95d19a2d0e6f0ff56..13a4cbb11ad59e761f686c67f7a550d002b8e45c 100644
 --- a/src/node_v8.cc
 +++ b/src/node_v8.cc
 @@ -158,7 +158,7 @@ void BindingData::Deserialize(Local<Context> context,
@@ -784,7 +784,7 @@ index da4206187f7c7d2becb8a101c1ff5346a10e13f4..03f0910926f3d403121e227cee32a546
    // Recreate the buffer in the constructor.
    BindingData* binding = realm->AddBindingData<BindingData>(holder);
 diff --git a/src/util-inl.h b/src/util-inl.h
-index 9d4db311024c5f526fc3c00764fff686af044026..da9268dcf2ff432ddeec7c0f61a147b73f3130e2 100644
+index 5699d76fdfee4b260aa23929f1fb678389ad99e7..d07bceb425f00882db116975a92f4835d7c2cf3b 100644
 --- a/src/util-inl.h
 +++ b/src/util-inl.h
 @@ -336,14 +336,14 @@ v8::Maybe<void> FromV8Array(v8::Local<v8::Context> context,
@@ -805,6 +805,15 @@ index 9d4db311024c5f526fc3c00764fff686af044026..da9268dcf2ff432ddeec7c0f61a147b7
      // V8 only has a TODO comment about adding an exception when the maximum
      // string size is exceeded.
 @@ -359,7 +359,7 @@ v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
+ v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
+                                     std::u16string_view str,
+                                     v8::Isolate* isolate) {
+-  if (isolate == nullptr) isolate = context->GetIsolate();
++  if (isolate == nullptr) isolate = v8::Isolate::GetCurrent();
+   if (str.length() >= static_cast<size_t>(v8::String::kMaxLength))
+       [[unlikely]] {
+     // V8 only has a TODO comment about adding an exception when the maximum
+@@ -379,7 +379,7 @@ v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
  v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
                                      v8_inspector::StringView str,
                                      v8::Isolate* isolate) {
@@ -813,7 +822,7 @@ index 9d4db311024c5f526fc3c00764fff686af044026..da9268dcf2ff432ddeec7c0f61a147b7
    if (str.length() >= static_cast<size_t>(v8::String::kMaxLength))
        [[unlikely]] {
      // V8 only has a TODO comment about adding an exception when the maximum
-@@ -386,7 +386,7 @@ template <typename T>
+@@ -406,7 +406,7 @@ template <typename T>
  v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
                                      const std::vector<T>& vec,
                                      v8::Isolate* isolate) {
@@ -822,7 +831,7 @@ index 9d4db311024c5f526fc3c00764fff686af044026..da9268dcf2ff432ddeec7c0f61a147b7
    v8::EscapableHandleScope handle_scope(isolate);
  
    MaybeStackBuffer<v8::Local<v8::Value>, 128> arr(vec.size());
-@@ -403,7 +403,7 @@ template <typename T>
+@@ -423,7 +423,7 @@ template <typename T>
  v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
                                      const std::set<T>& set,
                                      v8::Isolate* isolate) {
@@ -831,7 +840,7 @@ index 9d4db311024c5f526fc3c00764fff686af044026..da9268dcf2ff432ddeec7c0f61a147b7
    v8::Local<v8::Set> set_js = v8::Set::New(isolate);
    v8::HandleScope handle_scope(isolate);
  
-@@ -422,7 +422,7 @@ template <typename T, std::size_t U>
+@@ -442,7 +442,7 @@ template <typename T, std::size_t U>
  v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
                                      const std::ranges::elements_view<T, U>& vec,
                                      v8::Isolate* isolate) {
@@ -840,7 +849,7 @@ index 9d4db311024c5f526fc3c00764fff686af044026..da9268dcf2ff432ddeec7c0f61a147b7
    v8::EscapableHandleScope handle_scope(isolate);
  
    MaybeStackBuffer<v8::Local<v8::Value>, 128> arr(vec.size());
-@@ -441,7 +441,7 @@ template <typename T, typename U>
+@@ -461,7 +461,7 @@ template <typename T, typename U>
  v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
                                      const std::unordered_map<T, U>& map,
                                      v8::Isolate* isolate) {
@@ -849,7 +858,7 @@ index 9d4db311024c5f526fc3c00764fff686af044026..da9268dcf2ff432ddeec7c0f61a147b7
    v8::EscapableHandleScope handle_scope(isolate);
  
    v8::Local<v8::Map> ret = v8::Map::New(isolate);
-@@ -484,7 +484,7 @@ template <typename T, typename>
+@@ -504,7 +504,7 @@ template <typename T, typename>
  v8::MaybeLocal<v8::Value> ToV8Value(v8::Local<v8::Context> context,
                                      const T& number,
                                      v8::Isolate* isolate) {
@@ -858,7 +867,7 @@ index 9d4db311024c5f526fc3c00764fff686af044026..da9268dcf2ff432ddeec7c0f61a147b7
    return ConvertNumberToV8Value(isolate, number);
  }
  
-@@ -497,7 +497,7 @@ v8::Local<v8::Array> ToV8ValuePrimitiveArray(v8::Local<v8::Context> context,
+@@ -517,7 +517,7 @@ v8::Local<v8::Array> ToV8ValuePrimitiveArray(v8::Local<v8::Context> context,
            std::is_floating_point_v<T>,
        "Only primitive types (bool, integral, floating-point) are supported.");
  
@@ -867,7 +876,7 @@ index 9d4db311024c5f526fc3c00764fff686af044026..da9268dcf2ff432ddeec7c0f61a147b7
    v8::EscapableHandleScope handle_scope(isolate);
  
    v8::LocalVector<v8::Value> elements(isolate);
-@@ -731,7 +731,7 @@ inline v8::MaybeLocal<v8::Object> NewDictionaryInstanceNullProto(
+@@ -751,7 +751,7 @@ inline v8::MaybeLocal<v8::Object> NewDictionaryInstanceNullProto(
      if (value.IsEmpty()) return v8::MaybeLocal<v8::Object>();
    }
    v8::Local<v8::Object> obj = tmpl->NewInstance(context, property_values);
@@ -926,10 +935,10 @@ index 660cfff6b8a0c583be843e555e7a06cd09e0d279..c4b39450c5b7f91c46f7027db367c30d
        context, that, OneByteString(isolate, name), tmpl, flag);
  }
 diff --git a/src/util.h b/src/util.h
-index 2b351235cf7f32c9fad25367cc912d187466f1e0..6da57f95165bbdedb65dab6eaae8c39b815ee4e5 100644
+index 63479eb3f12685702a06c27db52183a585de0da9..1db426df35e4976427b578a2974041ec9e92cf4c 100644
 --- a/src/util.h
 +++ b/src/util.h
-@@ -739,7 +739,7 @@ inline v8::MaybeLocal<v8::Value> ToV8Value(
+@@ -751,7 +751,7 @@ inline v8::MaybeLocal<v8::Value> ToV8Value(
  // Variation on NODE_DEFINE_CONSTANT that sets a String value.
  #define NODE_DEFINE_STRING_CONSTANT(target, name, constant)                    \
    do {                                                                         \

patches/node/build_add_gn_build_files.patch

@@ -11,18 +11,18 @@ really in 20/21. We have to wait until 22 is released to be able to
 build with upstream GN files.
 
 diff --git a/configure.py b/configure.py
-index 7f73f084ef1a8336089e6a16423c2eb310c0b9f2..96eedd5d9ae05ee6704724290973251059d5dd78 100755
+index 750ddc8ace6cad894e738f6e1d983b5906acc10f..e063f9131d4d547d231811dafea03c8c52b611e6 100755
 --- a/configure.py
 +++ b/configure.py
-@@ -1730,7 +1730,7 @@ def configure_v8(o, configs):
+@@ -1736,7 +1736,7 @@ def configure_v8(o, configs):
    # Until we manage to get rid of all those, v8_enable_sandbox cannot be used.
    # Note that enabling pointer compression without enabling sandbox is unsupported by V8,
    # so this can be broken at any time.
 -  o['variables']['v8_enable_sandbox'] = 0
 +  o['variables']['v8_enable_sandbox'] = 1 if options.enable_pointer_compression else 0
-   o['variables']['v8_enable_pointer_compression_shared_cage'] = 1 if options.enable_pointer_compression else 0
-   o['variables']['v8_enable_external_code_space'] = 1 if options.enable_pointer_compression else 0
-   o['variables']['v8_enable_31bit_smis_on_64bit_arch'] = 1 if options.enable_pointer_compression else 0
+   # We set v8_enable_pointer_compression_shared_cage to 0 always, even when
+   # pointer compression is enabled so that we don't accidentally enable shared
+   # cage mode when pointer compression is on.
 diff --git a/node.gni b/node.gni
 index d4438f7fd61598afac2c1e3184721a759d22b10c..e2407027ab05e59b2f0f1c213b98ea469db7a91b 100644
 --- a/node.gni

patches/node/build_enable_perfetto.patch

@@ -64,7 +64,7 @@ index 9bf929f7f3360f13058d3f446c18a36cd15bea58..abf9a06d891488288bccd98c437746c1
  
  function ipToInt(ip) {
 diff --git a/node.gyp b/node.gyp
-index 420d57135f48df59b2cbd33497ef90b6148017e6..eefb1e0577b881da7a1570fd7ac465fe8b06747c 100644
+index a598de39f13e7069e75484463fb096b771fa45fb..975f3897dd1ce1074626925b9fbf22f15632a0b1 100644
 --- a/node.gyp
 +++ b/node.gyp
 @@ -176,7 +176,6 @@

patches/node/build_ensure_native_module_compilation_fails_if_not_using_a_new.patch

@@ -7,7 +7,7 @@ Subject: build: ensure native module compilation fails if not using a new
 This should not be upstreamed, it is a quality-of-life patch for downstream module builders.
 
 diff --git a/common.gypi b/common.gypi
-index 29a912f58e7b522ae21fddac510946cbcbaaa4cc..aea3a882c338eb757bef9e85fabab3fc7e7495f7 100644
+index 088e7ebbfe07d273691c86c7ab2dce00fcb475c8..a3f7415dba63828bec94ac8503420f14e3fea14c 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -89,6 +89,8 @@
@@ -42,10 +42,10 @@ index 29a912f58e7b522ae21fddac510946cbcbaaa4cc..aea3a882c338eb757bef9e85fabab3fc
        # list in v8/BUILD.gn.
        ['v8_enable_v8_checks == 1', {
 diff --git a/configure.py b/configure.py
-index 96eedd5d9ae05ee6704724290973251059d5dd78..52060f9c6dc1bcec67a0fd4710e01e73a6cf276c 100755
+index e063f9131d4d547d231811dafea03c8c52b611e6..a5c764d9e7fb0ffa219202015ec67ed6d3e14c04 100755
 --- a/configure.py
 +++ b/configure.py
-@@ -1711,6 +1711,7 @@ def configure_library(lib, output, pkgname=None):
+@@ -1717,6 +1717,7 @@ def configure_library(lib, output, pkgname=None):
  def configure_v8(o, configs):
    set_configuration_variable(configs, 'v8_enable_v8_checks', release=1, debug=0)
  
@@ -54,7 +54,7 @@ index 96eedd5d9ae05ee6704724290973251059d5dd78..52060f9c6dc1bcec67a0fd4710e01e73
    o['variables']['v8_enable_javascript_promise_hooks'] = 1
    o['variables']['v8_enable_lite_mode'] = 1 if options.v8_lite_mode else 0
 diff --git a/src/node.h b/src/node.h
-index c5ade4bd30456cde33379c6202b65709650d3ec0..f7b3f90b0c2cfbeacc5bc50112dd711df8d3c364 100644
+index 27f5bb1571920c963e05644a5fc5858aa4b88288..9c624e4ef26c1b06a6c4bca7def245935189ce07 100644
 --- a/src/node.h
 +++ b/src/node.h
 @@ -22,6 +22,12 @@

patches/node/build_restore_clang_as_default_compiler_on_macos.patch

@@ -11,7 +11,7 @@ node-gyp will use the result of `process.config` that reflects the environment
 in which the binary got built.
 
 diff --git a/common.gypi b/common.gypi
-index aea3a882c338eb757bef9e85fabab3fc7e7495f7..9303217fb05190c734e410a524a6921723d665d5 100644
+index a3f7415dba63828bec94ac8503420f14e3fea14c..c08f65b0448806c613b27eb91f9dd512adab938c 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -128,6 +128,7 @@

patches/node/chore_allow_the_node_entrypoint_to_be_a_builtin_module.patch

@@ -8,10 +8,10 @@ they use themselves as the entry point. We should try to upstream some form
 of this.
 
 diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
-index c7f86098bdb00b6be84d547a0ac41919fa1bbb0f..35b43990c8f24f0888f89173f5662050a11b26ed 100644
+index 6585c52e4bd997b20d5a297c536844dea1b8fdc8..fd0a81f5216d8bcf662c7e8bb972ed789eda8645 100644
 --- a/lib/internal/process/pre_execution.js
 +++ b/lib/internal/process/pre_execution.js
-@@ -243,12 +243,14 @@ function patchProcessObject(expandArgv1) {
+@@ -276,12 +276,14 @@ function patchProcessObject(expandArgv1) {
    // the entry point.
    if (expandArgv1 && process.argv[1] && process.argv[1][0] !== '-') {
      // Expand process.argv[1] into a full path.

patches/node/chore_disable_deprecation_ftbfs_in_simdjson_header.patch

@@ -8,13 +8,16 @@ Without this patch, building with simdjson fails with
 > error: identifier '_padded' preceded by whitespace in a literal operator
 > declaration is deprecated [-Werror,-Wdeprecated-literal-operator]
 
+and
+> error: declaration requires an exit-time destructor [-Werror,-Wexit-time-destructors]
+
 This patch can be removed once this is fixed upstream in simdjson.
 
 diff --git a/deps/simdjson/simdjson.h b/deps/simdjson/simdjson.h
-index 8f52a4331d59996786450eec982659da9244cac1..74729673d87b068dff5f24166bbb77d844f15f42 100644
+index a8bd86b28acc16cb04c193a1afbeb8171b314107..e200835e3ae6042f5af62f7ea3e082c677a9d0cf 100644
 --- a/deps/simdjson/simdjson.h
 +++ b/deps/simdjson/simdjson.h
-@@ -3899,12 +3899,17 @@ inline std::ostream& operator<<(std::ostream& out, simdjson_result<padded_string
+@@ -4160,12 +4160,17 @@ inline std::ostream& operator<<(std::ostream& out, simdjson_result<padded_string
  
  } // namespace simdjson
  
@@ -32,7 +35,7 @@ index 8f52a4331d59996786450eec982659da9244cac1..74729673d87b068dff5f24166bbb77d8
  namespace simdjson {
  namespace internal {
  
-@@ -4304,6 +4309,9 @@ inline simdjson_result<padded_string> padded_string::load(std::string_view filen
+@@ -4617,6 +4622,9 @@ inline simdjson_result<padded_string> padded_string::load(std::string_view filen
  
  } // namespace simdjson
  
@@ -42,7 +45,7 @@ index 8f52a4331d59996786450eec982659da9244cac1..74729673d87b068dff5f24166bbb77d8
  inline simdjson::padded_string operator ""_padded(const char *str, size_t len) {
    return simdjson::padded_string(str, len);
  }
-@@ -4312,6 +4320,8 @@ inline simdjson::padded_string operator ""_padded(const char8_t *str, size_t len
+@@ -4625,6 +4633,8 @@ inline simdjson::padded_string operator ""_padded(const char8_t *str, size_t len
    return simdjson::padded_string(reinterpret_cast<const char8_t *>(str), len);
  }
  #endif
@@ -51,3 +54,37 @@ index 8f52a4331d59996786450eec982659da9244cac1..74729673d87b068dff5f24166bbb77d8
  #endif // SIMDJSON_PADDED_STRING_INL_H
  /* end file simdjson/padded_string-inl.h */
  /* skipped duplicate #include "simdjson/padded_string_view.h" */
+@@ -43655,12 +43665,16 @@ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::
+   return parser_instance;
+ }
+ 
++#pragma clang diagnostic push
++#pragma clang diagnostic ignored "-Wexit-time-destructors"
++
+ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::get_threadlocal_parser_if_exists() {
+   // @the-moisrex points out that this could be implemented with std::optional (C++17).
+   thread_local std::unique_ptr<ondemand::parser> parser_instance = nullptr;
+   return parser_instance;
+ }
+ 
++#pragma clang diagnostic pop
+ 
+ } // namespace ondemand
+ } // namespace arm64
+@@ -56961,12 +56975,16 @@ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::
+   return parser_instance;
+ }
+ 
++#pragma clang diagnostic push
++#pragma clang diagnostic ignored "-Wexit-time-destructors"
++
+ simdjson_inline simdjson_warn_unused std::unique_ptr<ondemand::parser>& parser::get_threadlocal_parser_if_exists() {
+   // @the-moisrex points out that this could be implemented with std::optional (C++17).
+   thread_local std::unique_ptr<ondemand::parser> parser_instance = nullptr;
+   return parser_instance;
+ }
+ 
++#pragma clang diagnostic pop
+ 
+ } // namespace ondemand
+ } // namespace fallback

patches/node/chore_expose_importmoduledynamically_and.patch

@@ -11,7 +11,7 @@ its own blended handler between Node and Blink.
 Not upstreamable.
 
 diff --git a/lib/internal/modules/esm/utils.js b/lib/internal/modules/esm/utils.js
-index 4a4279459341e87784ee8efa832dc74371c4a708..88d84786e72cf8712e0b9bda16c418d4087fe549 100644
+index a9076a7ae941284d4585829292e2ece25c2b90e4..7335fe20f34fdd822276575686379dd954f1c8e1 100644
 --- a/lib/internal/modules/esm/utils.js
 +++ b/lib/internal/modules/esm/utils.js
 @@ -34,7 +34,7 @@ const {
@@ -21,14 +21,14 @@ index 4a4279459341e87784ee8efa832dc74371c4a708..88d84786e72cf8712e0b9bda16c418d4
 -const { getOptionValue } = require('internal/options');
 +const { getOptionValue, getEmbedderOptions } = require('internal/options');
  const {
-   loadPreloadModules,
-   initializeFrozenIntrinsics,
-@@ -291,12 +291,13 @@ let _forceDefaultLoader = false;
-  * @param {boolean} [forceDefaultLoader] - A boolean indicating disabling custom loaders.
+   emitExperimentalWarning,
+   kEmptyObject,
+@@ -285,12 +285,13 @@ let _shouldSpawnLoaderHookWorker = true;
+  *   should be spawned later.
   */
- function initializeESM(forceDefaultLoader = false) {
+ function initializeESM(shouldSpawnLoaderHookWorker = true) {
 +  const shouldSetOnIsolate = !getEmbedderOptions().shouldNotRegisterESMLoader;
-   _forceDefaultLoader = forceDefaultLoader;
+   _shouldSpawnLoaderHookWorker = shouldSpawnLoaderHookWorker;
    initializeDefaultConditions();
    // Setup per-realm callbacks that locate data or callbacks that we keep
    // track of for different ESM modules.
@@ -40,10 +40,10 @@ index 4a4279459341e87784ee8efa832dc74371c4a708..88d84786e72cf8712e0b9bda16c418d4
  
  /**
 diff --git a/src/module_wrap.cc b/src/module_wrap.cc
-index 5783728da2894270f902f47b210008df0e911bde..8fed194cbae9ce75bd0805b4df30b4de64fbbefa 100644
+index 26e6bcfa30be8b22b20e66ffe2f8d0b7d60fc6cc..fa2f28989be19e8ea8f53b990ae96be92ef3c3a3 100644
 --- a/src/module_wrap.cc
 +++ b/src/module_wrap.cc
-@@ -1097,7 +1097,7 @@ Maybe<ModuleWrap*> ModuleWrap::ResolveModule(
+@@ -1098,7 +1098,7 @@ Maybe<ModuleWrap*> ModuleWrap::ResolveModule(
    return Just(module_wrap);
  }
  
@@ -52,7 +52,7 @@ index 5783728da2894270f902f47b210008df0e911bde..8fed194cbae9ce75bd0805b4df30b4de
      Local<Context> context,
      Local<Data> host_defined_options,
      Local<Value> resource_name,
-@@ -1185,14 +1185,16 @@ void ModuleWrap::SetImportModuleDynamicallyCallback(
+@@ -1186,14 +1186,16 @@ void ModuleWrap::SetImportModuleDynamicallyCallback(
    Realm* realm = Realm::GetCurrent(args);
    HandleScope handle_scope(isolate);
  
@@ -72,7 +72,7 @@ index 5783728da2894270f902f47b210008df0e911bde..8fed194cbae9ce75bd0805b4df30b4de
  }
  
  void ModuleWrap::HostInitializeImportMetaObjectCallback(
-@@ -1234,13 +1236,14 @@ void ModuleWrap::SetInitializeImportMetaObjectCallback(
+@@ -1235,13 +1237,14 @@ void ModuleWrap::SetInitializeImportMetaObjectCallback(
    Realm* realm = Realm::GetCurrent(args);
    Isolate* isolate = realm->isolate();
  

patches/node/chore_handle_support_for_import_defer_as_ns_and_import_defer.patch

@@ -1,48 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Shelley Vohr <shelley.vohr@gmail.com>
-Date: Wed, 29 Oct 2025 11:45:23 +0000
-Subject: chore: handle support for `import defer * as ns` and `import.defer`
- syntax
-
-V8 added support for the above syntax https://chromium-review.googlesource.com/c/v8/v8/+/7017517
-by adding a new `ModuleImportPhase::kDefer` phase.
-
-This patch can be removed when Electron updates to a version of Node.js containing
-the above CL.
-
-diff --git a/src/module_wrap.cc b/src/module_wrap.cc
-index a584e3a80adb69d2028dc79450349823ab973a58..6f010fa2e014b2d13b1f89a691d09e2ffdf690b6 100644
---- a/src/module_wrap.cc
-+++ b/src/module_wrap.cc
-@@ -563,8 +563,10 @@ ModulePhase to_phase_constant(ModuleImportPhase phase) {
-       return kEvaluationPhase;
-     case ModuleImportPhase::kSource:
-       return kSourcePhase;
-+    case ModuleImportPhase::kDefer:
-+    default:
-+      UNREACHABLE();
-   }
--  UNREACHABLE();
- }
- 
- static Local<Object> createImportAttributesContainer(
-@@ -1471,6 +1473,7 @@ void ModuleWrap::CreatePerContextProperties(Local<Object> target,
- 
-   V(ModulePhase, kEvaluationPhase);
-   V(ModulePhase, kSourcePhase);
-+  V(ModulePhase, kDeferPhase);
- #undef V
- }
- 
-diff --git a/src/module_wrap.h b/src/module_wrap.h
-index 45264c2ad58e37a73fd62addac7fb671eed6d502..fb32fbc5c1cfa4aef4a7822dbc6195429299da3e 100644
---- a/src/module_wrap.h
-+++ b/src/module_wrap.h
-@@ -37,6 +37,7 @@ enum HostDefinedOptions : int {
- enum ModulePhase : int {
-   kSourcePhase = 1,
-   kEvaluationPhase = 2,
-+  kDeferPhase = 3,
- };
- 
- /**

patches/node/feat_disable_js_source_phase_imports_by_default.patch

@@ -18,15 +18,15 @@ Stage 3.
 Upstreamed in https://github.com/nodejs/node/pull/60364
 
 diff --git a/src/node.cc b/src/node.cc
-index 5713d49d859e1161e1d6703c0b6f3d717a5a9a34..829634c084cb91eb7f488dbdd48175a093dd6e12 100644
+index d77735f4f5686e914811c0576975b57e6c631398..d8e1c809df6e96ed561c73c0e8de0cf9736e4aaa 100644
 --- a/src/node.cc
 +++ b/src/node.cc
-@@ -780,7 +780,7 @@ static ExitCode ProcessGlobalArgsInternal(std::vector<std::string>* args,
-     env_opts->abort_on_uncaught_exception = true;
+@@ -782,7 +782,7 @@ static ExitCode ProcessGlobalArgsInternal(std::vector<std::string>* args,
+ 
+   if (std::ranges::find(v8_args, "--no-js-source-phase-imports") ==
+       v8_args.end()) {
+-    v8_args.emplace_back("--js-source-phase-imports");
++    // v8_args.emplace_back("--js-source-phase-imports");
    }
  
--  v8_args.emplace_back("--js-source-phase-imports");
-+  // v8_args.emplace_back("--js-source-phase-imports");
- 
  #ifdef __POSIX__
-   // Block SIGPROF signals when sleeping in epoll_wait/kevent/etc.  Avoids the

patches/node/fix_add_default_values_for_variables_in_common_gypi.patch

@@ -7,7 +7,7 @@ common.gypi is a file that's included in the node header bundle, despite
 the fact that we do not build node with gyp.
 
 diff --git a/common.gypi b/common.gypi
-index 7727dfc4c62100cbd873ee4b34c6089ab4b638b1..29a912f58e7b522ae21fddac510946cbcbaaa4cc 100644
+index 60585d136f7ee103ac49ce0271e24561a2685a0a..088e7ebbfe07d273691c86c7ab2dce00fcb475c8 100644
 --- a/common.gypi
 +++ b/common.gypi
 @@ -91,6 +91,23 @@

patches/node/fix_allow_disabling_fetch_in_renderer_and_worker_processes.patch

@@ -9,10 +9,10 @@ conflict with Blink's in renderer and worker processes.
 We should try to upstream some version of this.
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index cc990c01704484cbaa314320b3b3b72acffb6940..6b985c9fce6ec607df0e04f93b3cd5b84233d0b9 100644
+index 38c66ec426205c07925e4d634e877a8cbb47b255..9b9a5455b9d597bb4009074c922d2c7c5aa975f1 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -1767,6 +1767,14 @@ changes:
+@@ -1770,6 +1770,14 @@ changes:
  
  Disable using [syntax detection][] to determine module type.
  
@@ -27,7 +27,7 @@ index cc990c01704484cbaa314320b3b3b72acffb6940..6b985c9fce6ec607df0e04f93b3cd5b8
  ### `--no-experimental-global-navigator`
  
  <!-- YAML
-@@ -3436,6 +3444,7 @@ one is included in the list below.
+@@ -3439,6 +3447,7 @@ one is included in the list below.
  * `--no-addons`
  * `--no-async-context-frame`
  * `--no-deprecation`
@@ -36,7 +36,7 @@ index cc990c01704484cbaa314320b3b3b72acffb6940..6b985c9fce6ec607df0e04f93b3cd5b8
  * `--no-experimental-repl-await`
  * `--no-experimental-sqlite`
 diff --git a/doc/node.1 b/doc/node.1
-index 6210cbf42b26d4673f67aac43874ea28c8955fd5..565068cc3aca0eb03642e1160b814b48cb0c3c45 100644
+index dad692863f2cc6b6d4fad86915cd1700d52e8279..6d451ef912d1162a242b7952f94d2071d8238673 100644
 --- a/doc/node.1
 +++ b/doc/node.1
 @@ -198,6 +198,9 @@ Enable transformation of TypeScript-only syntax into JavaScript code.
@@ -50,10 +50,10 @@ index 6210cbf42b26d4673f67aac43874ea28c8955fd5..565068cc3aca0eb03642e1160b814b48
  Disable experimental support for the WebSocket API.
  .
 diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
-index 35b43990c8f24f0888f89173f5662050a11b26ed..2c0d12c0fa9c85ac7ffb41dabda83760ed1ae3ee 100644
+index fd0a81f5216d8bcf662c7e8bb972ed789eda8645..72944995cf3cc30d8bc33bfef8c6690c652cdcf9 100644
 --- a/lib/internal/process/pre_execution.js
 +++ b/lib/internal/process/pre_execution.js
-@@ -110,6 +110,7 @@ function prepareExecution(options) {
+@@ -117,6 +117,7 @@ function prepareExecution(options) {
    setupSQLite();
    setupQuic();
    setupWebStorage();
@@ -61,7 +61,7 @@ index 35b43990c8f24f0888f89173f5662050a11b26ed..2c0d12c0fa9c85ac7ffb41dabda83760
    setupWebsocket();
    setupEventsource();
    setupCodeCoverage();
-@@ -312,6 +313,16 @@ function setupWarningHandler() {
+@@ -345,6 +346,16 @@ function setupWarningHandler() {
    }
  }
  
@@ -79,10 +79,10 @@ index 35b43990c8f24f0888f89173f5662050a11b26ed..2c0d12c0fa9c85ac7ffb41dabda83760
  function setupWebsocket() {
    if (getOptionValue('--no-experimental-websocket')) {
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 2a3ab5e73cdb98bde9df1465d5fb5e40ad7799f7..9317191d22f51fd75157e849eb67678d1ee6a2a1 100644
+index 03c1dde6de237e44539dccea3295cf4339260b1e..c53c40b36ec311f433c8a0cbb1c06287576e1453 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
-@@ -537,7 +537,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
+@@ -545,7 +545,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
              &EnvironmentOptions::experimental_eventsource,
              kAllowedInEnvvar,
              false);

patches/node/fix_cppgc_initializing_twice.patch

@@ -12,10 +12,10 @@ This can be removed/refactored once Node.js upgrades to a version of V8
 containing the above CL.
 
 diff --git a/src/node.cc b/src/node.cc
-index c70bec82a28b166afa785d458d3f6c820d7b8565..5713d49d859e1161e1d6703c0b6f3d717a5a9a34 100644
+index 31439d0cc1199d0e0c94c9d616d957610279e01b..d77735f4f5686e914811c0576975b57e6c631398 100644
 --- a/src/node.cc
 +++ b/src/node.cc
-@@ -1245,7 +1245,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
+@@ -1248,7 +1248,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
      result->platform_ = per_process::v8_platform.Platform();
    }
  

patches/node/fix_crypto_tests_to_run_with_bssl.patch

@@ -10,319 +10,8 @@ This should be upstreamed in some form, though it may need to be tweaked
 before it's acceptable to upstream, as this patch comments out a couple
 of tests that upstream probably cares about.
 
-diff --git a/test/fixtures/crypto/ecdsa.js b/test/fixtures/crypto/ecdsa.js
-index b8827b24d41965b355c6e8bbf33ebc2c034a9035..c3545fb20ec7df3e6c3d8e7c3396030af85637c0 100644
---- a/test/fixtures/crypto/ecdsa.js
-+++ b/test/fixtures/crypto/ecdsa.js
-@@ -72,18 +72,20 @@ module.exports = function() {
-         'b6a0a14d7e4bc6dd2eda82c9234f174b670b60c8f7d101f68fdf5889e02373b025' +
-         'dcbc4c82f2929b8e06c68535da98e38fe399c53a814b097935581ef21535eb',
-         'hex'),
--      'SHA3-256': Buffer.from(
--        'f6a48eb5557f484ed0c3e4b5c78a3cf497cbd346db06a4165d429248aa2cc51a69' +
--        '747d09f57af145469a8b607a9b8b9709629d74e8f5ca337c6ddc581b6f6103',
--        'hex'),
--      'SHA3-384': Buffer.from(
--        '777785978eb59da32888554dc7fd62d1ba1a3033cddaa8c36b8f3dcea8f85e1c8e' +
--        '6db26f509747bd144dfa9436784bf4abbcaa6abcf1ecc09cea3b921d46738c',
--        'hex'),
--      'SHA3-512': Buffer.from(
--        '0f01c2083b5dd7fccb2784563f88cd9a815d570a1690695e426643ab725780760d' +
--        'e972e26e18d67f5557be89f17b4cd0065ce2937de299bdb2e972ebf7635084',
--        'hex')
-+      ...(!process.features.openssl_is_boringssl ? {
-+        'SHA3-256': Buffer.from(
-+          'f6a48eb5557f484ed0c3e4b5c78a3cf497cbd346db06a4165d429248aa2cc51a69' +
-+          '747d09f57af145469a8b607a9b8b9709629d74e8f5ca337c6ddc581b6f6103',
-+          'hex'),
-+        'SHA3-384': Buffer.from(
-+          '777785978eb59da32888554dc7fd62d1ba1a3033cddaa8c36b8f3dcea8f85e1c8e' +
-+          '6db26f509747bd144dfa9436784bf4abbcaa6abcf1ecc09cea3b921d46738c',
-+          'hex'),
-+        'SHA3-512': Buffer.from(
-+          '0f01c2083b5dd7fccb2784563f88cd9a815d570a1690695e426643ab725780760d' +
-+          'e972e26e18d67f5557be89f17b4cd0065ce2937de299bdb2e972ebf7635084',
-+          'hex')
-+      } : {})
-     },
-     'P-384': {
-       'SHA-1': Buffer.from(
-@@ -102,18 +104,20 @@ module.exports = function() {
-         '72fbdb369fd34c1c54264d07f4facd69b02e4206f8a8bb259b882a305c56fde2d3' +
-         '5107e493c53cd6b4af0b31306f4d03fd43cfc762a1030e17a3d775453a1212b142' +
-         '9f7b3d93066a5f42a10b138cd177dc09616e827d598822d78d4627b754e6', 'hex'),
--      'SHA3-256': Buffer.from(
--        '0b07c078be30fa5925a307d6fc559c5f398e63fb5d007d6b24a834847f2d3d18d5' +
--        'b5e840711c52a7bc6626c3ced93301e873c013a706f6b297c12cc6d47a71e0529e' +
--        '719f43957de9995621d3cb0217469adaa6fd3135470771d0aa9d05d7a9c6', 'hex'),
--      'SHA3-384': Buffer.from(
--        '2f36e8b04af46f68ef900c2720e3518b06f5440865d44072bbad5d62288c575042' +
--        'b183a372acd70328c738668dcecb9866801462d62df3c35450fdc6c95433103fcd' +
--        'c77999b640e3f92bd4e9be6e27ab129d1bc4f0b2a4c829388666920892d3', 'hex'),
--      'SHA3-512': Buffer.from(
--        '32a951e886c33ac57a008efe9643bc92aa3ece9521d115e0c7240caecf124d1f7c' +
--        'dcba7fabb9ad5202e04f7aa591ab01ed3f060f04f493e4f24430fe8159200612f0' +
--        '2849108b8be6edc8494c328097ad9265928efe5cb9d91be2f013ee17ee4e', 'hex')
-+      ...(!process.features.openssl_is_boringssl ? {
-+        'SHA3-256': Buffer.from(
-+          '0b07c078be30fa5925a307d6fc559c5f398e63fb5d007d6b24a834847f2d3d18d5' +
-+          'b5e840711c52a7bc6626c3ced93301e873c013a706f6b297c12cc6d47a71e0529e' +
-+          '719f43957de9995621d3cb0217469adaa6fd3135470771d0aa9d05d7a9c6', 'hex'),
-+        'SHA3-384': Buffer.from(
-+          '2f36e8b04af46f68ef900c2720e3518b06f5440865d44072bbad5d62288c575042' +
-+          'b183a372acd70328c738668dcecb9866801462d62df3c35450fdc6c95433103fcd' +
-+          'c77999b640e3f92bd4e9be6e27ab129d1bc4f0b2a4c829388666920892d3', 'hex'),
-+        'SHA3-512': Buffer.from(
-+          '32a951e886c33ac57a008efe9643bc92aa3ece9521d115e0c7240caecf124d1f7c' +
-+          'dcba7fabb9ad5202e04f7aa591ab01ed3f060f04f493e4f24430fe8159200612f0' +
-+          '2849108b8be6edc8494c328097ad9265928efe5cb9d91be2f013ee17ee4e', 'hex')
-+      } : {})
-     },
-     'P-521': {
-       'SHA-1': Buffer.from(
-@@ -140,29 +144,35 @@ module.exports = function() {
-         '01f0071e6a32867fa70f695cd39c4e87e142b9e4134d38740bd6fee354a575167e' +
-         '13524e94832637910fe11e53a85fb21b91adb81bb1779c4e2b8bc87c717dc35084',
-         'hex'),
--      'SHA3-256': Buffer.from(
--        '00463679f47a4c705e03447360dcf34d1743e0d4b2591cc66832a6bc80d92e538c' +
--        '169a1fd330f98e7235ca7fec7e16ac44fb13095b8edf2c76b75c4845177d59e425' +
--        '0127c4359f6a4c9ccb63e7a9ff8122c0b4a8b7408e28c96817ecc3baf8c559c413' +
--        'c3bb580447dec9f52139b2afde369cd51730f050bc94137556ae137f0509464219',
--        'hex'),
--      'SHA3-384': Buffer.from(
--        '01969a4db0888bc067a68a31fe5d0fc97e0b701f570565f7b25cb27707c6f020ff' +
--        '680f8553ec5c2d6885e9e91b39262ed1bde375525eb13fdf12089b7939c7689735' +
--        '0101c8b8d1129a217e8e956bef78cf7b9a0458523b04ac8e0b84ce73d54326f7a8' +
--        '704ee42fe183f3ef79d83e676f34dc5476e2342641a5b973d3d94e8503676fbbc5',
--        'hex'),
--      'SHA3-512': Buffer.from(
--        '000f362e914ee0136663cf57bf4085c25604af6dc198b4818751e1195ee7e41a16' +
--        '91be909dcbc2bae00b8917f6bb918eae3740ac1b76e0913137c2da1171d6400b55' +
--        '01ec6e1dc5987a27fe16fc2ce5c8e954088f898a9bbefb176eaa8bbd9ccc264c4c' +
--        'cc38c83ac8b5a168f90228daf8405a2b9bf7829c263a646b4e1098e2ace38deec7',
--        'hex')
-+      ...(!process.features.openssl_is_boringssl ? {
-+        'SHA3-256': Buffer.from(
-+          '00463679f47a4c705e03447360dcf34d1743e0d4b2591cc66832a6bc80d92e538c' +
-+          '169a1fd330f98e7235ca7fec7e16ac44fb13095b8edf2c76b75c4845177d59e425' +
-+          '0127c4359f6a4c9ccb63e7a9ff8122c0b4a8b7408e28c96817ecc3baf8c559c413' +
-+          'c3bb580447dec9f52139b2afde369cd51730f050bc94137556ae137f0509464219',
-+          'hex'),
-+        'SHA3-384': Buffer.from(
-+          '01969a4db0888bc067a68a31fe5d0fc97e0b701f570565f7b25cb27707c6f020ff' +
-+          '680f8553ec5c2d6885e9e91b39262ed1bde375525eb13fdf12089b7939c7689735' +
-+          '0101c8b8d1129a217e8e956bef78cf7b9a0458523b04ac8e0b84ce73d54326f7a8' +
-+          '704ee42fe183f3ef79d83e676f34dc5476e2342641a5b973d3d94e8503676fbbc5',
-+          'hex'),
-+        'SHA3-512': Buffer.from(
-+          '000f362e914ee0136663cf57bf4085c25604af6dc198b4818751e1195ee7e41a16' +
-+          '91be909dcbc2bae00b8917f6bb918eae3740ac1b76e0913137c2da1171d6400b55' +
-+          '01ec6e1dc5987a27fe16fc2ce5c8e954088f898a9bbefb176eaa8bbd9ccc264c4c' +
-+          'cc38c83ac8b5a168f90228daf8405a2b9bf7829c263a646b4e1098e2ace38deec7',
-+          'hex')
-+      } : {})
-     }
-   }
- 
-   const curves = ['P-256', 'P-384', 'P-521'];
--  const hashes = ['SHA-1', 'SHA-256', 'SHA-384', 'SHA-512', 'SHA3-256', 'SHA3-384', 'SHA3-512'];
-+  const hashes = ['SHA-1', 'SHA-256', 'SHA-384', 'SHA-512'];
-+
-+  if (!process.features.openssl_is_boringssl) {
-+    hashes.push('SHA3-256', 'SHA3-384', 'SHA3-512');
-+  }
- 
-   const vectors = [];
-   curves.forEach((namedCurve) => {
-diff --git a/test/fixtures/crypto/hmac.js b/test/fixtures/crypto/hmac.js
-index 6505c6e2ae55b55b2474f1b9c53f2da1e66c852e..acdf3229a4bc7cfc45c664718e7396f71025624a 100644
---- a/test/fixtures/crypto/hmac.js
-+++ b/test/fixtures/crypto/hmac.js
-@@ -22,16 +22,18 @@ module.exports = function () {
-       '5dcc359443aaf652fa1375d6b3e61fdcf29bb4a28bd5d3dcfa40f82f906bb280' +
-       '0455db03b5d31fb972a15a6d0103a24e56d156a119c0e5a1e92a44c3c5657cf9',
-       'hex'),
--    'SHA3-256': Buffer.from(
--      'e588ec0811463d767241df1074b47ae4071b51f2ce36537ba69ccdc3fdc2b7a8',
--      'hex'),
--    'SHA3-384': Buffer.from(
--      '6b1da28eab1f582ad9718effe05e23d5fd2c9877a2d9443f90bec093bece2ea7' +
--      'd2354cd0bdc5e147d2e9009373494488', 'hex'),
--    'SHA3-512': Buffer.from(
--      '5dcc359443aaf652fa1375d6b3e61fdcf29bb4a28bd5d3dcfa40f82f906bb280' +
--      '0455db03b5d31fb972a15a6d0103a24e56d156a119c0e5a1e92a44c3c5657cf9',
--      'hex')
-+    ...(!process.features.openssl_is_boringssl ? {
-+      'SHA3-256': Buffer.from(
-+        'e588ec0811463d767241df1074b47ae4071b51f2ce36537ba69ccdc3fdc2b7a8',
-+        'hex'),
-+      'SHA3-384': Buffer.from(
-+        '6b1da28eab1f582ad9718effe05e23d5fd2c9877a2d9443f90bec093bece2ea7' +
-+        'd2354cd0bdc5e147d2e9009373494488', 'hex'),
-+      'SHA3-512': Buffer.from(
-+        '5dcc359443aaf652fa1375d6b3e61fdcf29bb4a28bd5d3dcfa40f82f906bb280' +
-+        '0455db03b5d31fb972a15a6d0103a24e56d156a119c0e5a1e92a44c3c5657cf9',
-+        'hex')
-+    } : {})
-   }
- 
-   const signatures = {
-@@ -46,16 +48,18 @@ module.exports = function () {
-       '61fb278c3ffb0cce2bf1cf723ddfd8ef1f931c0c618c25907324605939e3f9a2' +
-       'c6f4af690bda3407dc2f5770f6a0a44b954d64a332e3ee0821abf82b7f3e99c1',
-       'hex'),
--    'SHA3-256': Buffer.from(
--      'c1ac5e11fcd50c48bf567f6e296632f5801c4eb07a8a47579b41dee971a3099b',
--      'hex'),
--    'SHA3-384': Buffer.from(
--      'ac8c97f6dd8d9e16101063077c16b23fe291a5e6d149653e9ac7002365159317' +
--      'adcfad511996578b0053a5c14b75f16c', 'hex'),
--    'SHA3-512': Buffer.from(
--      '2162c2a8907e6b2f68599a69e81a464d8f076b5eeb555d98b4d20330034df3c7' +
--      'cf35b1fa958a074ca12f0d242df39f0da3d4f1dbfb3629057798fe1f883974ee',
--      'hex')
-+    ...(!process.features.openssl_is_boringssl ? {
-+      'SHA3-256': Buffer.from(
-+        'c1ac5e11fcd50c48bf567f6e296632f5801c4eb07a8a47579b41dee971a3099b',
-+        'hex'),
-+      'SHA3-384': Buffer.from(
-+        'ac8c97f6dd8d9e16101063077c16b23fe291a5e6d149653e9ac7002365159317' +
-+        'adcfad511996578b0053a5c14b75f16c', 'hex'),
-+      'SHA3-512': Buffer.from(
-+        '2162c2a8907e6b2f68599a69e81a464d8f076b5eeb555d98b4d20330034df3c7' +
-+        'cf35b1fa958a074ca12f0d242df39f0da3d4f1dbfb3629057798fe1f883974ee',
-+        'hex')
-+    } : {})
-   }
- 
-   const vectors = [];
-diff --git a/test/fixtures/crypto/rsa_pkcs.js b/test/fixtures/crypto/rsa_pkcs.js
-index 4630e4af9135800ad0fc604f99ac578d36984ca2..d54c44b6d820d83f997cc5e1b94fe5b5f151c013 100644
---- a/test/fixtures/crypto/rsa_pkcs.js
-+++ b/test/fixtures/crypto/rsa_pkcs.js
-@@ -97,33 +97,35 @@ module.exports = function () {
-       '7a6335c70e193235dcda48add6858626bd96311e60f7e5ea4491b6c1e6248afe12b' +
-       'bbd54f8869b043a5b0444562813f0a98b300356f306e6b783a29f3bec97ca40ea20' +
-       '062cab8926ec5d96aa387cc84821a6d72b8ea126e7d', 'hex'),
--    'sha3-256': Buffer.from(
--      'be1b476c1911a01d71710fd8a2f3158d6f7839e91443b01bed30dfdd04336d80c6b' +
--      'f692c06fad254877901c10a73853e8fb202a29cddefdf16c3adcda1fc123625897d' +
--      '1b81b32a9dec38957e023be221d8f31e7470ad32e761edce9170eefa37ec19bd0c3' +
--      'e0b0ad2a244e98f54a08f873efb63c6fad14d7322b50eb05b6bae767305da92a90a' +
--      '53cdae52b0d81e158a00003ec626e50423b7377a34a7b28cc7483b55bfde05bd431' +
--      'cfa436c38c285531e0d476ee13f151c8ae832ffd51ba00f2ab06f1844e73c0fe0f6' +
--      'ce17d966b1e07727af4161368aa0a74a594a6fdb782b46a9ae6098799c366fc0d71' +
--      '1b2d965cf5eeeed9175b39b1d0bcefdd7df376e8ac9', 'hex'),
--    'sha3-384': Buffer.from(
--      '002eaf5837443f1a33dc03729a308c503888d7a8cc013be424a91bce18105f7334a' +
--      '499a5eddc5f4fab2fdf80f52988d53bf8bd5e78c3ce1a43abaf3b8146c260b6ce8b' +
--      'ffc9857f4b35c190cea85921c46d3ab573113744472d1afb637a0e9ab5021bcb355' +
--      '7f5b52faf89fa864a7d3bf5799096c54ee53fa139e1bc13842a2a5bf0f1d85f041d' +
--      'a4e0e87425b421f22f0240ad62ef77ba6f090e0d48e17c07fd1e477c7e16a3196f5' +
--      '0142d0f0c5e525a10325569e5a1f50cb4577e782a643972857cc918ae5409587d9e' +
--      '44e1c1e89540e87deed7dda5005ac63ba609f522fdd92c81d95c1ffa383558a10f3' +
--      '064f59ca0534bfad31acbf3e2807cb7d3147c59ee4d', 'hex'),
--    'sha3-512': Buffer.from(
--      '561585b621c916453762285c8bb6ede3f303074ad6f2826ca15b3900e49c4d94c07' +
--      'aab0b875eaa79049ba2ed97e9a87c44fff9bffe638a1bf8c4db69c627b6adbe8fca' +
--      '2b38cb8b4c2810a16286bef498327b9db4b53043ed5012c7c58f037edf669baf772' +
--      '9b58e413e133ebb90a5fcb6dc3936f4f87971c0e85f362189b4279bbb2d9293a427' +
--      '5653068c1bc8772cebc4733a5d1df0b454d4f628c645c22bb1c8cc601fbc92dc091' +
--      'db38fad4a36289ae9ed424c46643a8161a102ae511877d25f2eab7342dff6b92bf3' +
--      '65951e76ee84c2bd84a595f63d7cc04d00e1589870956491e518b3ba245efc37a28' +
--      'ec018d8788a92ab93a90bb314f9ab0788a0b5b50489', 'hex')
-+    ...(!process.features.openssl_is_boringssl ? {
-+      'sha3-256': Buffer.from(
-+        'be1b476c1911a01d71710fd8a2f3158d6f7839e91443b01bed30dfdd04336d80c6b' +
-+        'f692c06fad254877901c10a73853e8fb202a29cddefdf16c3adcda1fc123625897d' +
-+        '1b81b32a9dec38957e023be221d8f31e7470ad32e761edce9170eefa37ec19bd0c3' +
-+        'e0b0ad2a244e98f54a08f873efb63c6fad14d7322b50eb05b6bae767305da92a90a' +
-+        '53cdae52b0d81e158a00003ec626e50423b7377a34a7b28cc7483b55bfde05bd431' +
-+        'cfa436c38c285531e0d476ee13f151c8ae832ffd51ba00f2ab06f1844e73c0fe0f6' +
-+        'ce17d966b1e07727af4161368aa0a74a594a6fdb782b46a9ae6098799c366fc0d71' +
-+        '1b2d965cf5eeeed9175b39b1d0bcefdd7df376e8ac9', 'hex'),
-+      'sha3-384': Buffer.from(
-+        '002eaf5837443f1a33dc03729a308c503888d7a8cc013be424a91bce18105f7334a' +
-+        '499a5eddc5f4fab2fdf80f52988d53bf8bd5e78c3ce1a43abaf3b8146c260b6ce8b' +
-+        'ffc9857f4b35c190cea85921c46d3ab573113744472d1afb637a0e9ab5021bcb355' +
-+        '7f5b52faf89fa864a7d3bf5799096c54ee53fa139e1bc13842a2a5bf0f1d85f041d' +
-+        'a4e0e87425b421f22f0240ad62ef77ba6f090e0d48e17c07fd1e477c7e16a3196f5' +
-+        '0142d0f0c5e525a10325569e5a1f50cb4577e782a643972857cc918ae5409587d9e' +
-+        '44e1c1e89540e87deed7dda5005ac63ba609f522fdd92c81d95c1ffa383558a10f3' +
-+        '064f59ca0534bfad31acbf3e2807cb7d3147c59ee4d', 'hex'),
-+      'sha3-512': Buffer.from(
-+        '561585b621c916453762285c8bb6ede3f303074ad6f2826ca15b3900e49c4d94c07' +
-+        'aab0b875eaa79049ba2ed97e9a87c44fff9bffe638a1bf8c4db69c627b6adbe8fca' +
-+        '2b38cb8b4c2810a16286bef498327b9db4b53043ed5012c7c58f037edf669baf772' +
-+        '9b58e413e133ebb90a5fcb6dc3936f4f87971c0e85f362189b4279bbb2d9293a427' +
-+        '5653068c1bc8772cebc4733a5d1df0b454d4f628c645c22bb1c8cc601fbc92dc091' +
-+        'db38fad4a36289ae9ed424c46643a8161a102ae511877d25f2eab7342dff6b92bf3' +
-+        '65951e76ee84c2bd84a595f63d7cc04d00e1589870956491e518b3ba245efc37a28' +
-+        'ec018d8788a92ab93a90bb314f9ab0788a0b5b50489', 'hex')
-+    } : {})
-   }
- 
-   const vectors = [
-@@ -159,30 +161,32 @@ module.exports = function () {
-       plaintext,
-       signature: signatures['sha-512']
-     },
--    {
--      publicKeyBuffer: spki,
--      privateKeyBuffer: pkcs8,
--      algorithm: { name: 'RSASSA-PKCS1-v1_5' },
--      hash: 'SHA3-256',
--      plaintext,
--      signature: signatures['sha3-256']
--    },
--    {
--      publicKeyBuffer: spki,
--      privateKeyBuffer: pkcs8,
--      algorithm: { name: 'RSASSA-PKCS1-v1_5' },
--      hash: 'SHA3-384',
--      plaintext,
--      signature: signatures['sha3-384']
--    },
--    {
--      publicKeyBuffer: spki,
--      privateKeyBuffer: pkcs8,
--      algorithm: { name: 'RSASSA-PKCS1-v1_5' },
--      hash: 'SHA3-512',
--      plaintext,
--      signature: signatures['sha3-512']
--    },
-+    ...(!process.features.openssl_is_boringssl ? [
-+      {
-+        publicKeyBuffer: spki,
-+        privateKeyBuffer: pkcs8,
-+        algorithm: { name: 'RSASSA-PKCS1-v1_5' },
-+        hash: 'SHA3-256',
-+        plaintext,
-+        signature: signatures['sha3-256']
-+      },
-+      {
-+        publicKeyBuffer: spki,
-+        privateKeyBuffer: pkcs8,
-+        algorithm: { name: 'RSASSA-PKCS1-v1_5' },
-+        hash: 'SHA3-384',
-+        plaintext,
-+        signature: signatures['sha3-384']
-+      },
-+      {
-+        publicKeyBuffer: spki,
-+        privateKeyBuffer: pkcs8,
-+        algorithm: { name: 'RSASSA-PKCS1-v1_5' },
-+        hash: 'SHA3-512',
-+        plaintext,
-+        signature: signatures['sha3-512']
-+      },
-+    ] : []),
-   ];
- 
-   return vectors;
 diff --git a/test/fixtures/crypto/rsa_pss.js b/test/fixtures/crypto/rsa_pss.js
-index 101122b2ffe31c8dc903ff8852212d9f55c0badd..fa0bcceb5697486930a9530732f9a9ab6e1bb5b0 100644
+index 423f2c4d77bfc98bfbdab93c09aff8012c678cbd..fa0bcceb5697486930a9530732f9a9ab6e1bb5b0 100644
 --- a/test/fixtures/crypto/rsa_pss.js
 +++ b/test/fixtures/crypto/rsa_pss.js
 @@ -1,6 +1,6 @@
@@ -333,192 +22,6 @@ index 101122b2ffe31c8dc903ff8852212d9f55c0badd..fa0bcceb5697486930a9530732f9a9ab
    const pkcs8 = Buffer.from(
      '308204bf020100300d06092a864886f70d0101010500048204a9308204a5020100028' +
      '2010100d3576092e62957364544e7e4233b7bdb293db2085122c479328546f9f0f712' +
-@@ -150,42 +150,44 @@ module.exports = function() {
-       'b68c04bfe452c3adc6c10066a915231b7b404727eb6201b4921eb96d9407de2b963' +
-       '3879ceb71d759d9828d7b4d062f6ef100757d8328187caf57dfb859d1555345207c' +
-       '1cce7905c3564c08fec78867a53d5a2cf84810e1ffa', 'hex'),
--    'sha3-512, no salt': Buffer.from(
--      'd2430dc87abeaa7d13f7cec8510f1a296e1c608f44b1696829c59a99e8eefe9b2ee' +
--      '6ee8ad6fdc93c24fcba2f04d1da195924b6209717e1992c10ed9f4783478765fe34' +
--      '3e761203bff9d326bb6dc2061b0a7554c8ce0814b29249136c20c8e30054df0c6bc' +
--      '656509a82845149368896690e32ff5dd32ef01543686f01d6a69bb438b049e66a8b' +
--      'df485a13edcd7dc482da4cc57d0b740aca3e56f0da247794e600afd27b22b6da13b' +
--      'cc15dd2059b525f8cb6bcd07540aa843f0ae51d4b0eea27045485914b908bdd01d0' +
--      'a9d42379f9f7180f4ad162ff73df5fed0200eb02ad01473975d54a77c15a9c61a3c' +
--      'b5e27de5d1eecc363d45506f7123a5ddd115c5e4c9e', 'hex'),
--    'sha3-256, salted': Buffer.from(
--      '59cb9cce6ae838eb20d38d6af4acb9b866b0753bb7df9e441037d788512c03279e8' +
--      '3d9a9cf5c0921fe1c0b6e8e895a8c0ad24a18b123f809b34ef2a3a1f05974030320' +
--      '435692ef5d378cef4368c3658c098a25371dfaf1c0b6910f653a4ec15f2c08956c1' +
--      '405136c2aba7f25a808fa7dbf57a4cb2978bd91af710b27ee239d955c8cac7a76ae' +
--      '9085cefeda2a585a99cc948f064b5da66a9c4aa4f3f767ac905a9f314b47038e05c' +
--      '3608fbb7e67a278e4f009a62c3cd3fdf43692e759d9361be1217999a76a69d4d119' +
--      'f8791a90e207e46b3f6125721f56fd819292d06a3cdae2c62c9a1dc0d964a06036c' +
--      '8c18661cc6c873532a3536ab51e1ce210926db299e2', 'hex'),
--    'sha3-384, salted': Buffer.from(
--      '8d1f9297c8169f27f0c58827dba991d862de58c1155f612ad2995d2bf862d051c4a' +
--      '91b48571849b0412384382e5b77990de6a3c84010046b35c4a504f175a3479483d9' +
--      '5c58f86bb96d53a27e59d6f67fddaae295ce90610f5086acc711557c2c85aac32d3' +
--      '24199cff2367ae44e1d91307a98c8cbfb085a8bce6b1c20714711bc15b0eddb7881' +
--      '823227d4be477ffdad8093663a6a1fc62eb39c49c2c3a821c2b202cf7904b49ca92' +
--      '3c83819602bb13931577354a80f99309030044935b1cd41f0513160e661db1959fb' +
--      '1ec15f087f3d288e875d54cbf070ec860b0aeecc951ea65e97cd5460750d4b7de52' +
--      '22cb9e7466b1f506ecf6a81fc399dfd8334160f9084', 'hex'),
--    'sha3-512, salted': Buffer.from(
--      '7b6d7be418c5d37cc8070698b8b03d818ecd8b673d047d34921913f6d59c69cb496' +
--      '172d6118207d9ff92b8e1246acf0e03a845d935a70f8a82c3d5d6db6a1a0e337269' +
--      '4b904372413dcbaa7ac5486bc8ccaf70d7e9470be82b928a90017e272cf9761ed26' +
--      'c160fe874a2675a4fb2acad72c50fbfffdd70b5a6f2919553d7ea1829934670f8de' +
--      'f2a5c2816404b1aa153323c92c58400622f184b9b0463fa48d6b27091f68c287e3f' +
--      '6d9ab9eb451711a5d984c547f3d56f14a686a89ddf36c47ce25092b8c6530904de9' +
--      '5df7fc602fe9394315f1b1847aae304cb5ad71e2cb78acfbc997a87a9d62a6898bb' +
--      '6d84a81bb89b50186265f4be171a93d837a4bf777c8', 'hex')
-+    ...(!process.features.openssl_is_boringssl ? {
-+      'sha3-512, no salt': Buffer.from(
-+        'd2430dc87abeaa7d13f7cec8510f1a296e1c608f44b1696829c59a99e8eefe9b2ee' +
-+        '6ee8ad6fdc93c24fcba2f04d1da195924b6209717e1992c10ed9f4783478765fe34' +
-+        '3e761203bff9d326bb6dc2061b0a7554c8ce0814b29249136c20c8e30054df0c6bc' +
-+        '656509a82845149368896690e32ff5dd32ef01543686f01d6a69bb438b049e66a8b' +
-+        'df485a13edcd7dc482da4cc57d0b740aca3e56f0da247794e600afd27b22b6da13b' +
-+        'cc15dd2059b525f8cb6bcd07540aa843f0ae51d4b0eea27045485914b908bdd01d0' +
-+        'a9d42379f9f7180f4ad162ff73df5fed0200eb02ad01473975d54a77c15a9c61a3c' +
-+        'b5e27de5d1eecc363d45506f7123a5ddd115c5e4c9e', 'hex'),
-+      'sha3-256, salted': Buffer.from(
-+        '59cb9cce6ae838eb20d38d6af4acb9b866b0753bb7df9e441037d788512c03279e8' +
-+        '3d9a9cf5c0921fe1c0b6e8e895a8c0ad24a18b123f809b34ef2a3a1f05974030320' +
-+        '435692ef5d378cef4368c3658c098a25371dfaf1c0b6910f653a4ec15f2c08956c1' +
-+        '405136c2aba7f25a808fa7dbf57a4cb2978bd91af710b27ee239d955c8cac7a76ae' +
-+        '9085cefeda2a585a99cc948f064b5da66a9c4aa4f3f767ac905a9f314b47038e05c' +
-+        '3608fbb7e67a278e4f009a62c3cd3fdf43692e759d9361be1217999a76a69d4d119' +
-+        'f8791a90e207e46b3f6125721f56fd819292d06a3cdae2c62c9a1dc0d964a06036c' +
-+        '8c18661cc6c873532a3536ab51e1ce210926db299e2', 'hex'),
-+      'sha3-384, salted': Buffer.from(
-+        '8d1f9297c8169f27f0c58827dba991d862de58c1155f612ad2995d2bf862d051c4a' +
-+        '91b48571849b0412384382e5b77990de6a3c84010046b35c4a504f175a3479483d9' +
-+        '5c58f86bb96d53a27e59d6f67fddaae295ce90610f5086acc711557c2c85aac32d3' +
-+        '24199cff2367ae44e1d91307a98c8cbfb085a8bce6b1c20714711bc15b0eddb7881' +
-+        '823227d4be477ffdad8093663a6a1fc62eb39c49c2c3a821c2b202cf7904b49ca92' +
-+        '3c83819602bb13931577354a80f99309030044935b1cd41f0513160e661db1959fb' +
-+        '1ec15f087f3d288e875d54cbf070ec860b0aeecc951ea65e97cd5460750d4b7de52' +
-+        '22cb9e7466b1f506ecf6a81fc399dfd8334160f9084', 'hex'),
-+      'sha3-512, salted': Buffer.from(
-+        '7b6d7be418c5d37cc8070698b8b03d818ecd8b673d047d34921913f6d59c69cb496' +
-+        '172d6118207d9ff92b8e1246acf0e03a845d935a70f8a82c3d5d6db6a1a0e337269' +
-+        '4b904372413dcbaa7ac5486bc8ccaf70d7e9470be82b928a90017e272cf9761ed26' +
-+        'c160fe874a2675a4fb2acad72c50fbfffdd70b5a6f2919553d7ea1829934670f8de' +
-+        'f2a5c2816404b1aa153323c92c58400622f184b9b0463fa48d6b27091f68c287e3f' +
-+        '6d9ab9eb451711a5d984c547f3d56f14a686a89ddf36c47ce25092b8c6530904de9' +
-+        '5df7fc602fe9394315f1b1847aae304cb5ad71e2cb78acfbc997a87a9d62a6898bb' +
-+        '6d84a81bb89b50186265f4be171a93d837a4bf777c8', 'hex')
-+    } : {})
-   }
- 
-   const vectors = [
-@@ -253,54 +255,56 @@ module.exports = function() {
-       plaintext,
-       signature: signatures['sha-512, salted']
-     },
--    {
--      publicKeyBuffer: spki,
--      privateKeyBuffer: pkcs8,
--      algorithm: { name: 'RSA-PSS', saltLength: 0 },
--      hash: 'SHA3-256',
--      plaintext,
--      signature: signatures['sha3-256, no salt']
--    },
--    {
--      publicKeyBuffer: spki,
--      privateKeyBuffer: pkcs8,
--      algorithm: { name: 'RSA-PSS', saltLength: 0 },
--      hash: 'SHA3-384',
--      plaintext,
--      signature: signatures['sha3-384, no salt']
--    },
--    {
--      publicKeyBuffer: spki,
--      privateKeyBuffer: pkcs8,
--      algorithm: { name: 'RSA-PSS', saltLength: 0 },
--      hash: 'SHA3-512',
--      plaintext,
--      signature: signatures['sha3-512, no salt']
--    },
--    {
--      publicKeyBuffer: spki,
--      privateKeyBuffer: pkcs8,
--      algorithm: { name: 'RSA-PSS', saltLength: 32 },
--      hash: 'SHA3-256',
--      plaintext,
--      signature: signatures['sha3-256, salted']
--    },
--    {
--      publicKeyBuffer: spki,
--      privateKeyBuffer: pkcs8,
--      algorithm: { name: 'RSA-PSS', saltLength: 48 },
--      hash: 'SHA3-384',
--      plaintext,
--      signature: signatures['sha3-384, salted']
--    },
--    {
--      publicKeyBuffer: spki,
--      privateKeyBuffer: pkcs8,
--      algorithm: { name: 'RSA-PSS', saltLength: 64 },
--      hash: 'SHA3-512',
--      plaintext,
--      signature: signatures['sha3-512, salted']
--    }
-+    ...(!process.features.openssl_is_boringssl ? [
-+      {
-+        publicKeyBuffer: spki,
-+        privateKeyBuffer: pkcs8,
-+        algorithm: { name: 'RSA-PSS', saltLength: 0 },
-+        hash: 'SHA3-256',
-+        plaintext,
-+        signature: signatures['sha3-256, no salt']
-+      },
-+      {
-+        publicKeyBuffer: spki,
-+        privateKeyBuffer: pkcs8,
-+        algorithm: { name: 'RSA-PSS', saltLength: 0 },
-+        hash: 'SHA3-384',
-+        plaintext,
-+        signature: signatures['sha3-384, no salt']
-+      },
-+      {
-+        publicKeyBuffer: spki,
-+        privateKeyBuffer: pkcs8,
-+        algorithm: { name: 'RSA-PSS', saltLength: 0 },
-+        hash: 'SHA3-512',
-+        plaintext,
-+        signature: signatures['sha3-512, no salt']
-+      },
-+      {
-+        publicKeyBuffer: spki,
-+        privateKeyBuffer: pkcs8,
-+        algorithm: { name: 'RSA-PSS', saltLength: 32 },
-+        hash: 'SHA3-256',
-+        plaintext,
-+        signature: signatures['sha3-256, salted']
-+      },
-+      {
-+        publicKeyBuffer: spki,
-+        privateKeyBuffer: pkcs8,
-+        algorithm: { name: 'RSA-PSS', saltLength: 48 },
-+        hash: 'SHA3-384',
-+        plaintext,
-+        signature: signatures['sha3-384, salted']
-+      },
-+      {
-+        publicKeyBuffer: spki,
-+        privateKeyBuffer: pkcs8,
-+        algorithm: { name: 'RSA-PSS', saltLength: 64 },
-+        hash: 'SHA3-512',
-+        plaintext,
-+        signature: signatures['sha3-512, salted']
-+      }
-+    ] : []),
-   ];
- 
-   return vectors;
 diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
 index 337ed577b143062d41e378cc1f820945e76cea08..76d5e805cbc0e756aef0013373baec31bd320f44 100644
 --- a/test/fixtures/webcrypto/supports-modern-algorithms.mjs
@@ -1022,382 +525,6 @@ index 7bd42bbe721c4c9442410d524c5ca740078fc72c..de49dbdc2b75517f497af353a6b24b1b
        assert.strictEqual(err.function, 'ssl3_read_bytes');
      assert.match(err.reason, expectedErrorReason);
    }));
-diff --git a/test/parallel/test-webcrypto-derivebits-hkdf.js b/test/parallel/test-webcrypto-derivebits-hkdf.js
-index 0629f85b0fb538cabf77479132f8c3e4ea958b19..2759223e76a0609d0ff98da73f8f6e67b325d8f3 100644
---- a/test/parallel/test-webcrypto-derivebits-hkdf.js
-+++ b/test/parallel/test-webcrypto-derivebits-hkdf.js
-@@ -91,18 +91,20 @@ const kDerivations = {
-         empty: '9e4b719033742101e90f1ad61e2ff3b4' +
-                '256863667296d74389f1f02af2c4e6a6'
-       },
--      'SHA3-256': {
--        normal: '386b0693d7a58c4ddf01b49bfbbd2fa87c6f911991543995170ba20ed28df599',
--        empty: 'd029bc828b6c6c8bb16ce3d25f5058f19c7d2517745e11c5d65c6d242e82e47f',
--      },
--      'SHA3-384': {
--        normal: '8c3b72e659bad40bcd14bdc1f7c3836059d24253795ab046a272973fd0456508',
--        empty: '3211ff4c676f761494c1ca2683d2d4662fe1d770ae5c58ebf6af6acb181c7d71',
--      },
--      'SHA3-512': {
--        normal: '5588c5c70cb3dd2f95323da2e9d5f299ca99c301d920a499330c449d21c645cd',
--        empty: '2c944b916c2751a71a1b5e57fcb487939c624335683995770b9f7cc7cbbb21f0',
--      },
-+      ...(!process.features.openssl_is_boringssl ? {
-+        'SHA3-256': {
-+          normal: '386b0693d7a58c4ddf01b49bfbbd2fa87c6f911991543995170ba20ed28df599',
-+          empty: 'd029bc828b6c6c8bb16ce3d25f5058f19c7d2517745e11c5d65c6d242e82e47f',
-+        },
-+        'SHA3-384': {
-+          normal: '8c3b72e659bad40bcd14bdc1f7c3836059d24253795ab046a272973fd0456508',
-+          empty: '3211ff4c676f761494c1ca2683d2d4662fe1d770ae5c58ebf6af6acb181c7d71',
-+        },
-+        'SHA3-512': {
-+          normal: '5588c5c70cb3dd2f95323da2e9d5f299ca99c301d920a499330c449d21c645cd',
-+          empty: '2c944b916c2751a71a1b5e57fcb487939c624335683995770b9f7cc7cbbb21f0',
-+        },
-+      } : {}),
-     },
-     empty: {
-       'SHA-384': {
-@@ -129,18 +131,20 @@ const kDerivations = {
-         empty: 'c8e12774135305c9147f2cc4766e5ead' +
-                '25d8f457b9a1953d52677361ced558fb'
-       },
--      'SHA3-256': {
--        normal: '9befc557f5baf4075b5fb38c014b41b92ab7534150baf64201069e8807d0e83d',
--        empty: '54d1fa1aa7cad99dab0622b772170e775c103756183bac36a228fd817a98a3f6',
--      },
--      'SHA3-384': {
--        normal: '46b54c015e368677edf7ac16963bccd9d2ba8246eef0e8beb04d8d188774b91b',
--        empty: '46eb0b2649bb0f605d70e4818ffc8176ee1be9782396e69fb4d0fd7cfe902b55',
--      },
--      'SHA3-512': {
--        normal: 'aa4375c82b5d7a3cac88a0423250b3882f140c253e98e8e7a0f6055b0908e4c2',
--        empty: '6613003f98602ddb53ac35f5aa256c9f5279d50ee65bb08fdf2ecf65cc5df27f',
--      },
-+      ...(!process.features.openssl_is_boringssl ? {
-+        'SHA3-256': {
-+          normal: '9befc557f5baf4075b5fb38c014b41b92ab7534150baf64201069e8807d0e83d',
-+          empty: '54d1fa1aa7cad99dab0622b772170e775c103756183bac36a228fd817a98a3f6',
-+        },
-+        'SHA3-384': {
-+          normal: '46b54c015e368677edf7ac16963bccd9d2ba8246eef0e8beb04d8d188774b91b',
-+          empty: '46eb0b2649bb0f605d70e4818ffc8176ee1be9782396e69fb4d0fd7cfe902b55',
-+        },
-+        'SHA3-512': {
-+          normal: 'aa4375c82b5d7a3cac88a0423250b3882f140c253e98e8e7a0f6055b0908e4c2',
-+          empty: '6613003f98602ddb53ac35f5aa256c9f5279d50ee65bb08fdf2ecf65cc5df27f',
-+        },
-+      } : {}),
-     }
-   },
-   long: {
-@@ -169,18 +173,20 @@ const kDerivations = {
-         empty: 'e579d1f9e7f08e6f990ffcfcce1ed201' +
-                'c5e37e62cdf606f0ba4aca80427fbc44'
-       },
--      'SHA3-256': {
--        normal: '24f38fd1905554b7cbf8395cc3976292d11ce24a0b3131da0fd4b109832d27e3',
--        empty: '33d0a5151c0f52e4bb7fb67cf7a17063127624dc3e685903f49ebb07872084d1',
--      },
--      'SHA3-384': {
--        normal: '15777581a1ea81ad0baac8a97d954df4142f7260d9e8351aa7f6ef6de2d04632',
--        empty: 'ada4da4e28dc971633a8760b265b3019db57baf17e7bf7e13cf78b1a676f6d44',
--      },
--      'SHA3-512': {
--        normal: '621e4602b07fcba55ed6b976a8bef513b0f7c4ad0c546e0f852993051d887408',
--        empty: 'f1292af65b05c86cf7146b739bc65785c707450316f3207ee54a3f596a7d0f7b',
--      },
-+      ...(!process.features.openssl_is_boringssl ? {
-+        'SHA3-256': {
-+          normal: '24f38fd1905554b7cbf8395cc3976292d11ce24a0b3131da0fd4b109832d27e3',
-+          empty: '33d0a5151c0f52e4bb7fb67cf7a17063127624dc3e685903f49ebb07872084d1',
-+        },
-+        'SHA3-384': {
-+          normal: '15777581a1ea81ad0baac8a97d954df4142f7260d9e8351aa7f6ef6de2d04632',
-+          empty: 'ada4da4e28dc971633a8760b265b3019db57baf17e7bf7e13cf78b1a676f6d44',
-+        },
-+        'SHA3-512': {
-+          normal: '621e4602b07fcba55ed6b976a8bef513b0f7c4ad0c546e0f852993051d887408',
-+          empty: 'f1292af65b05c86cf7146b739bc65785c707450316f3207ee54a3f596a7d0f7b',
-+        },
-+      } : {}),
-     },
-     empty: {
-       'SHA-384': {
-@@ -207,18 +213,20 @@ const kDerivations = {
-         empty: 'b4f7e7557674d501cbfbc0148ad800c0' +
-                '750189fe295a2aca5e1bf4122c85edf9'
-       },
--      'SHA3-256': {
--        normal: 'fe32459f7339dd2e8df6c6fc874ed9e81e3b7aad669edad9b71196f53ed95b12',
--        empty: '04519be1eb94079c91306cc5b21946b3de6a78ad35ec83d4f4a37bafbda678d7',
--      },
--      'SHA3-384': {
--        normal: 'a474e8289cb4a0511e90b87eaf9ec29cadd74d4c1f2ee1fb8cb5f7d08f91a379',
--        empty: '726c8c4b39083a7d5755604d3a67e9aa6139db00c08028ac9e69f7fb1525bf1d',
--      },
--      'SHA3-512': {
--        normal: 'c7a7f5004d1d595c6896498c169642ac24b946e13296ff53e12b534962a88675',
--        empty: '7b543480b5696932551abb3100d72e05c18f57fbb63aa44fe020bef1eec3555c',
--      },
-+      ...(!process.features.openssl_is_boringssl ? {
-+        'SHA3-256': {
-+          normal: 'fe32459f7339dd2e8df6c6fc874ed9e81e3b7aad669edad9b71196f53ed95b12',
-+          empty: '04519be1eb94079c91306cc5b21946b3de6a78ad35ec83d4f4a37bafbda678d7',
-+        },
-+        'SHA3-384': {
-+          normal: 'a474e8289cb4a0511e90b87eaf9ec29cadd74d4c1f2ee1fb8cb5f7d08f91a379',
-+          empty: '726c8c4b39083a7d5755604d3a67e9aa6139db00c08028ac9e69f7fb1525bf1d',
-+        },
-+        'SHA3-512': {
-+          normal: 'c7a7f5004d1d595c6896498c169642ac24b946e13296ff53e12b534962a88675',
-+          empty: '7b543480b5696932551abb3100d72e05c18f57fbb63aa44fe020bef1eec3555c',
-+        },
-+      } : {}),
-     }
-   },
- };
-diff --git a/test/parallel/test-webcrypto-derivekey.js b/test/parallel/test-webcrypto-derivekey.js
-index 422384f4447bda80c3137ea8784c1bd70c3c285f..c7c6343194a29f14d80db44cf6574e4cd6f34786 100644
---- a/test/parallel/test-webcrypto-derivekey.js
-+++ b/test/parallel/test-webcrypto-derivekey.js
-@@ -135,14 +135,21 @@ const { KeyObject } = require('crypto');
-      '201509b012c9cd2fbe7ea938f0c509b36ecb140f38bf9130e96923f55f46756d'],
-     ['hello', 'there', 5, 'SHA-512',
-      '2e8d981741f98193e0af9c79870af0e985089341221edad9a130d297eae1984b'],
--    ['hello', 'there', 5, 'SHA3-256',
--     '0aed29b61b3ca3978aea34a9793276574ea997b69e8d03727438199f90571649'],
--    ['hello', 'there', 5, 'SHA3-384',
--     '7aa4a274aa19b4623c5d3091c4b06355de85ff6f25e53a83e3126cbb86ae68df'],
--    ['hello', 'there', 5, 'SHA3-512',
--     '4d909c47a81c625f866d1f9406248e6bc3c7ea89225fbccf1f08820254c9ef56'],
-   ];
- 
-+  if (!process.features.openssl_is_boringssl) {
-+    kTests.push(
-+      ['hello', 'there', 5, 'SHA3-256',
-+        '0aed29b61b3ca3978aea34a9793276574ea997b69e8d03727438199f90571649'],
-+      ['hello', 'there', 5, 'SHA3-384',
-+        '7aa4a274aa19b4623c5d3091c4b06355de85ff6f25e53a83e3126cbb86ae68df'],
-+      ['hello', 'there', 5, 'SHA3-512',
-+        '4d909c47a81c625f866d1f9406248e6bc3c7ea89225fbccf1f08820254c9ef56']
-+    );
-+  } else {
-+    common.printSkipMessage('Skipping unsupported SHA-3 test cases');
-+  }
-+
-   const tests = Promise.all(kTests.map((args) => test(...args)));
- 
-   tests.then(common.mustCall());
-@@ -158,16 +165,23 @@ const { KeyObject } = require('crypto');
-     // Not long enough secret generated by ECDH
-     [{ name: 'HMAC', hash: 'SHA-384' }, 'sign', 1024],
-     [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024],
--    [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
--    [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
--    [{ name: 'HMAC', hash: 'SHA3-512', length: 512 }, 'sign', 512],
--    // This interaction is not defined for now.
--    // https://github.com/WICG/webcrypto-modern-algos/issues/23
--    // [{ name: 'HMAC', hash: 'SHA3-256' }, 'sign', 256],
--    // [{ name: 'HMAC', hash: 'SHA3-384' }, 'sign', 384],
--    // [{ name: 'HMAC', hash: 'SHA3-512' }, 'sign', 512],
-   ];
- 
-+  if (!process.features.openssl_is_boringssl) {
-+    vectors.push(
-+      [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
-+      [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
-+      [{ name: 'HMAC', hash: 'SHA3-512', length: 512 }, 'sign', 512]
-+      // This interaction is not defined for now.
-+      // https://github.com/WICG/webcrypto-modern-algos/issues/23
-+      // [{ name: 'HMAC', hash: 'SHA3-256' }, 'sign', 256],
-+      // [{ name: 'HMAC', hash: 'SHA3-384' }, 'sign', 384],
-+      // [{ name: 'HMAC', hash: 'SHA3-512' }, 'sign', 512],
-+    );
-+  } else {
-+    common.printSkipMessage('Skipping unsupported SHA-3 test cases');
-+  }
-+
-   if (hasOpenSSL(3)) {
-     vectors.push(
-       ['KMAC128', 'sign', 128],
-@@ -211,16 +225,23 @@ const { KeyObject } = require('crypto');
-     [{ name: 'HMAC', hash: 'SHA-256' }, 'sign', 512],
-     [{ name: 'HMAC', hash: 'SHA-384' }, 'sign', 1024],
-     [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024],
--    [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
--    [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
--    [{ name: 'HMAC', hash: 'SHA3-512', length: 512 }, 'sign', 512],
--    // This interaction is not defined for now.
--    // https://github.com/WICG/webcrypto-modern-algos/issues/23
--    // [{ name: 'HMAC', hash: 'SHA3-256' }, 'sign', 256],
--    // [{ name: 'HMAC', hash: 'SHA3-384' }, 'sign', 384],
--    // [{ name: 'HMAC', hash: 'SHA3-512' }, 'sign', 512],
-   ];
- 
-+  if (!process.features.openssl_is_boringssl) {
-+    vectors.push(
-+      [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
-+      [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
-+      [{ name: 'HMAC', hash: 'SHA3-512', length: 512 }, 'sign', 512],
-+      // This interaction is not defined for now.
-+      // https://github.com/WICG/webcrypto-modern-algos/issues/23
-+      // [{ name: 'HMAC', hash: 'SHA3-256' }, 'sign', 256],
-+      // [{ name: 'HMAC', hash: 'SHA3-384' }, 'sign', 384],
-+      // [{ name: 'HMAC', hash: 'SHA3-512' }, 'sign', 512],
-+    );
-+  } else {
-+    common.printSkipMessage('Skipping unsupported SHA-3 test cases');
-+  }
-+
-   if (hasOpenSSL(3)) {
-     vectors.push(
-       ['KMAC128', 'sign', 128],
-diff --git a/test/parallel/test-webcrypto-digest.js b/test/parallel/test-webcrypto-digest.js
-index 04507d77b59142be9c9fe81c746f1c0003429262..e91214047dea431913c1a3d47ed55dd573888daf 100644
---- a/test/parallel/test-webcrypto-digest.js
-+++ b/test/parallel/test-webcrypto-digest.js
-@@ -148,65 +148,67 @@ const kDigestedData = {
-           '60b22aab8d36a4c2a3affdb71234f49276737c575ddf7' +
-           '4d14054cbd6fdb98fd0ddcbcb46f91ad76b6ee'
-   },
--  'cshake128': {
--    empty: '7f9c2ba4e88f827d616045507605853ed73b8093f6e' +
--           'fbc88eb1a6eacfa66ef26',
--    short: 'dea62d73e6b59cf725d0320d660089a4475cbbd3b85' +
--           '39e36691f150d47556794',
--    medium: 'b1acd53a03e76a221e52ea578e042f686a68c3d1c9' +
--            '832ab18285cf4f304ca32d',
--    long: '3a5bf5676955e5dec87d430e526925558971ca14c370' +
--          'ee5d7cf572b94c7c63d7'
--  },
--  'cshake256': {
--    empty: '46b9dd2b0ba88d13233b3feb743eeb243fcd52ea62b' +
--           '81b82b50c27646ed5762fd75dc4ddd8c0f200cb0501' +
--           '9d67b592f6fc821c49479ab48640292eacb3b7c4be',
--    short: '1738113f5abb3ee5320ee18aa266c3617a7475dbd8e' +
--           'd9a985994fddd6112ad999ec8e2ebdfeafb96e76f6b' +
--           'b3a3adba43da60f00cd12496df5af3e28ae6d3de42',
--    medium: '4146c13d86d9bc186b0b309ab6a124ee0c74ba26b8' +
--            'c60dcc7b3ed505969aa8d19028c6317999a085b1e6' +
--            'b6a785ce4ff632aeb27493227e44232fb7b3952141' +
--            '7b',
--    long: '0c42bfd1e282622fd8144aa29b072fd09fc2bae70885' +
--          'd5290933492f9d17411926a613dd0611668c2ac999e8' +
--          'c011aabaa9004323425fbad75b0f58ee6e777a94'
--  },
--  'sha3-256': {
--    empty: 'a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a',
--    short: '3059af7aa33b517084e8ad7bbc4fb208a44c28ef32b4698d103dd540e4f91aa1',
--    medium: '1fa7cd1da74cd8046417508c8314e74a9a4a9d38f9f18e6cb215b8c891a0a80e',
--    long: 'b2cfc61e0386cdaef5e10a2be189891f5ef52a7624bfcd8edc893acc64fec600'
--  },
--  'sha3-384': {
--    empty: '0c63a75b845e4f7d01107d852e4c2485c51a50aaaa9' +
--           '4fc61995e71bbee983a2ac3713831264adb47fb6bd1' +
--           'e058d5f004',
--    short: '54b8f0e4cf4974de740098f66b3024479b01631315a' +
--           '6773606c33eadc32556a6e778e08f0225ae79265aec' +
--           '666cb2390b',
--    medium: '437b7d8b68b250b5c1739ea4cc86db2033879dfb18' +
--            'de292c9c50d9c193a4c79a08a6cae3f4e483c2795e' +
--            'a5d1ef7e69d2',
--    long: '3b39c4c97ad87613305d0ccc987181713e2d5e84b1f9' +
--          '760011bcce0c297499005bdce8a3d2409b5ad0164f32' +
--          'bb8778d0'
--  },
--  'sha3-512': {
--    empty: 'a69f73cca23a9ac5c8b567dc185a756e97c982164fe' +
--           '25859e0d1dcc1475c80a615b2123af1f5f94c11e3e9' +
--           '402c3ac558f500199d95b6d3e301758586281dcd26',
--    short: '2dd2e07a62e6ad0498ba84f313c4d4024cb46001f78' +
--           'f75db336b0d4d8bd2a9ec152c4ad20878735d82ba08' +
--           '72ecf59608ef3ced2b2a8669427e7da31e362333d8',
--    medium: 'e640a21909536640369e9b0a48931c5cb2efcbc91f' +
--           'ecf247306bc96a0e4ca33307cb8e1b9af367946dd01' +
--           'c243f3907508d04f1692a3161df1f898de8ee25febe',
--    long: 'bd262cecf565c338032de5ba0138f0aacfe7dde83d27' +
--          '2d0d37d952829ed25de1a1342d98659ef7d2fa4aca7c' +
--          'e2b1aa0784d8fc1dcbf81bcec7a7431a3da36bf7'
--  }
-+  ...(!process.features.openssl_is_boringssl ? {
-+    'cshake128': {
-+      empty: '7f9c2ba4e88f827d616045507605853ed73b8093f6e' +
-+            'fbc88eb1a6eacfa66ef26',
-+      short: 'dea62d73e6b59cf725d0320d660089a4475cbbd3b85' +
-+            '39e36691f150d47556794',
-+      medium: 'b1acd53a03e76a221e52ea578e042f686a68c3d1c9' +
-+              '832ab18285cf4f304ca32d',
-+      long: '3a5bf5676955e5dec87d430e526925558971ca14c370' +
-+            'ee5d7cf572b94c7c63d7'
-+    },
-+    'cshake256': {
-+      empty: '46b9dd2b0ba88d13233b3feb743eeb243fcd52ea62b' +
-+            '81b82b50c27646ed5762fd75dc4ddd8c0f200cb0501' +
-+            '9d67b592f6fc821c49479ab48640292eacb3b7c4be',
-+      short: '1738113f5abb3ee5320ee18aa266c3617a7475dbd8e' +
-+            'd9a985994fddd6112ad999ec8e2ebdfeafb96e76f6b' +
-+            'b3a3adba43da60f00cd12496df5af3e28ae6d3de42',
-+      medium: '4146c13d86d9bc186b0b309ab6a124ee0c74ba26b8' +
-+              'c60dcc7b3ed505969aa8d19028c6317999a085b1e6' +
-+              'b6a785ce4ff632aeb27493227e44232fb7b3952141' +
-+              '7b',
-+      long: '0c42bfd1e282622fd8144aa29b072fd09fc2bae70885' +
-+            'd5290933492f9d17411926a613dd0611668c2ac999e8' +
-+            'c011aabaa9004323425fbad75b0f58ee6e777a94'
-+    },
-+    'sha3-256': {
-+      empty: 'a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a',
-+      short: '3059af7aa33b517084e8ad7bbc4fb208a44c28ef32b4698d103dd540e4f91aa1',
-+      medium: '1fa7cd1da74cd8046417508c8314e74a9a4a9d38f9f18e6cb215b8c891a0a80e',
-+      long: 'b2cfc61e0386cdaef5e10a2be189891f5ef52a7624bfcd8edc893acc64fec600'
-+    },
-+    'sha3-384': {
-+      empty: '0c63a75b845e4f7d01107d852e4c2485c51a50aaaa9' +
-+            '4fc61995e71bbee983a2ac3713831264adb47fb6bd1' +
-+            'e058d5f004',
-+      short: '54b8f0e4cf4974de740098f66b3024479b01631315a' +
-+            '6773606c33eadc32556a6e778e08f0225ae79265aec' +
-+            '666cb2390b',
-+      medium: '437b7d8b68b250b5c1739ea4cc86db2033879dfb18' +
-+              'de292c9c50d9c193a4c79a08a6cae3f4e483c2795e' +
-+              'a5d1ef7e69d2',
-+      long: '3b39c4c97ad87613305d0ccc987181713e2d5e84b1f9' +
-+            '760011bcce0c297499005bdce8a3d2409b5ad0164f32' +
-+            'bb8778d0'
-+    },
-+    'sha3-512': {
-+      empty: 'a69f73cca23a9ac5c8b567dc185a756e97c982164fe' +
-+            '25859e0d1dcc1475c80a615b2123af1f5f94c11e3e9' +
-+            '402c3ac558f500199d95b6d3e301758586281dcd26',
-+      short: '2dd2e07a62e6ad0498ba84f313c4d4024cb46001f78' +
-+            'f75db336b0d4d8bd2a9ec152c4ad20878735d82ba08' +
-+            '72ecf59608ef3ced2b2a8669427e7da31e362333d8',
-+      medium: 'e640a21909536640369e9b0a48931c5cb2efcbc91f' +
-+            'ecf247306bc96a0e4ca33307cb8e1b9af367946dd01' +
-+            'c243f3907508d04f1692a3161df1f898de8ee25febe',
-+      long: 'bd262cecf565c338032de5ba0138f0aacfe7dde83d27' +
-+            '2d0d37d952829ed25de1a1342d98659ef7d2fa4aca7c' +
-+            'e2b1aa0784d8fc1dcbf81bcec7a7431a3da36bf7'
-+    }
-+  } : {}),
- };
- 
- async function testDigest(size, alg) {
-diff --git a/test/parallel/test-webcrypto-sign-verify-rsa.js b/test/parallel/test-webcrypto-sign-verify-rsa.js
-index 7e90388cc4c270200ecfbda541828c5b237e0d69..ca99ad79fea59f583726f96a58271e86d5c7b5d7 100644
---- a/test/parallel/test-webcrypto-sign-verify-rsa.js
-+++ b/test/parallel/test-webcrypto-sign-verify-rsa.js
-@@ -245,7 +245,7 @@ async function testSaltLength(keyLength, hash, hLen) {
-       ['SHA3-384', 48],
-       ['SHA3-512', 64],
-     ]) {
--      if (hash.startsWith('SHA-3') && !process.features.openssl_is_boringssl) {
-+      if (hash.startsWith('SHA3') && !process.features.openssl_is_boringssl) {
-         variations.push(testSaltLength(keyLength, hash, hLen));
-       }
-     }
 diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js
 index bd788ec4ed88289d35798b8af8c9490a68e081a2..1a5477ba928bce93320f8056db02e1a7b8ddcdf3 100644
 --- a/test/parallel/test-webcrypto-wrap-unwrap.js

patches/node/fix_do_not_resolve_electron_entrypoints.patch

@@ -6,10 +6,10 @@ Subject: fix: do not resolve electron entrypoints
 This wastes fs cycles and can result in strange behavior if this path actually exists on disk
 
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 1f967df42128a05e49acfa6d409737c06a3372e3..c9b0dae3378f556c453f4fa31208eb6f57c433a9 100644
+index 96869be3c48b84106a5fe2cb752fe979a211d96a..64f8902b1a3d5c335a3b8889b2dc801e8f9ec79c 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -408,6 +408,10 @@ function cjsPreparseModuleExports(filename, source, format) {
+@@ -404,6 +404,10 @@ function cjsPreparseModuleExports(filename, source, format) {
      return { module, exportNames: module[kModuleExportNames] };
    }
  
@@ -21,7 +21,7 @@ index 1f967df42128a05e49acfa6d409737c06a3372e3..c9b0dae3378f556c453f4fa31208eb6f
      ({ source } = loadSourceForCJSWithHooks(module, filename, format));
    }
 diff --git a/lib/internal/modules/run_main.js b/lib/internal/modules/run_main.js
-index 2a9ef56d1568080d19d4b6e68a14c752e48c3822..fb45f3dc66a49a554df1c06431197392c0a199b7 100644
+index d337eeca801b9c187d1513519d7faf27310dbc41..34025f0c2c984b1b9993709cbd00be4158ea1db3 100644
 --- a/lib/internal/modules/run_main.js
 +++ b/lib/internal/modules/run_main.js
 @@ -2,6 +2,7 @@

patches/node/fix_expose_readfilesync_override_for_modules.patch

@@ -8,7 +8,7 @@ an API override to replace the native `ReadFileSync` in the `modules`
 binding.
 
 diff --git a/src/env_properties.h b/src/env_properties.h
-index 2884149d82d180e0d2ecfa7ac8fd92f201f1cb55..dded4bf3d7106d127efbad81087f0c375b2b2c95 100644
+index 39803ae466fc81a6b2ff6e12093cdf2082790a9f..29ce687a03ccc8e45881f70d34e009e028aa4074 100644
 --- a/src/env_properties.h
 +++ b/src/env_properties.h
 @@ -490,6 +490,7 @@

patches/node/fix_expose_the_built-in_electron_module_via_the_esm_loader.patch

@@ -18,7 +18,7 @@ index 01584983c16a2ab6eec2fbb01208504f2771148b..6afbbca6c95103f3ecad29485581c947
  
  /**
 diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
-index 8414d303c078d51a93c9127a1fd8d6f24961b104..e8a2326e158550786620439fa4039c2b449624cc 100644
+index c284163fba86ec820af1996571fbd3d092d41d34..5f1921d15bc1d3a68c35990f85e36a0e8a5b3ec4 100644
 --- a/lib/internal/modules/esm/load.js
 +++ b/lib/internal/modules/esm/load.js
 @@ -77,7 +77,7 @@ function defaultLoad(url, context = kEmptyObject) {
@@ -39,16 +39,16 @@ index 8414d303c078d51a93c9127a1fd8d6f24961b104..e8a2326e158550786620439fa4039c2b
          // For backward compatibility reasons, we need to discard the source in
          // order for the CJS loader to re-fetch it.
          source = null;
-@@ -141,7 +141,7 @@ function defaultLoadSync(url, context = kEmptyObject) {
- 
+@@ -142,7 +142,7 @@ function defaultLoadSync(url, context = kEmptyObject) {
    throwIfUnsupportedURLScheme(urlInstance, false);
  
+   let shouldBeReloadedByCJSLoader = false;
 -  if (urlInstance.protocol === 'node:') {
 +  if (urlInstance.protocol === 'node:' || format === 'electron') {
      source = null;
-   } else if (source == null) {
-     ({ responseURL, source } = getSourceSync(urlInstance, context));
-@@ -174,12 +174,13 @@ function throwIfUnsupportedURLScheme(parsed) {
+     format ??= 'builtin';
+   } else if (format === 'addon') {
+@@ -186,12 +186,13 @@ function throwIfUnsupportedURLScheme(parsed) {
      protocol !== 'file:' &&
      protocol !== 'data:' &&
      protocol !== 'node:' &&
@@ -64,16 +64,16 @@ index 8414d303c078d51a93c9127a1fd8d6f24961b104..e8a2326e158550786620439fa4039c2b
    }
  }
 diff --git a/lib/internal/modules/esm/loader.js b/lib/internal/modules/esm/loader.js
-index 300da51afe6185f5f9799a88fc75ba3b8f0cf5fb..4c7e2dc8c00c7a38a27169d1cc08e27f89e74fbb 100644
+index d536d8215c93abd4b9e1faa125257fe120242e92..20bc3b3b15a01251964e741e16500d5d1fb5994e 100644
 --- a/lib/internal/modules/esm/loader.js
 +++ b/lib/internal/modules/esm/loader.js
-@@ -522,7 +522,7 @@ class ModuleLoader {
+@@ -499,7 +499,7 @@ class ModuleLoader {
      }
  
      const cjsModule = wrap[imported_cjs_symbol];
 -    if (cjsModule) {
-+    if (cjsModule && finalFormat !== 'electron') {
-       assert(finalFormat === 'commonjs-sync');
++    if (cjsModule && translatorKey !== 'electron') {
+       assert(translatorKey === 'commonjs-sync');
        // Check if the ESM initiating import CJS is being required by the same CJS module.
        if (cjsModule?.[kIsExecuting]) {
 diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
@@ -103,11 +103,11 @@ index c27ee4c6612c6a7ea0b6355f03563e8724fd0e40..5f03cf14e948d449d303b22ab6710b55
  
    const packageConfig = packageJsonReader.read(packageJSONPath, { __proto__: null, specifier, base, isESM: true });
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 147d96bda8098fe16e5d0053e36eab05fb489c22..3c82913ca381eba30596f22a734b49dcba9b6f5b 100644
+index 446349113e13bce042734010fd98af053c8cf31e..52b8b5d9255f782af96aa859dec4ffa6ca82c9d0 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
-@@ -215,7 +215,9 @@ function createCJSModuleWrap(url, source, isMain, format, loadCJS = loadCJSModul
-   const { exportNames, module } = cjsPreparseModuleExports(filename, source, format);
+@@ -220,7 +220,9 @@ function createCJSModuleWrap(url, translateContext, parentURL, loadCJS = loadCJS
+   const { exportNames, module } = cjsPreparseModuleExports(filename, source, sourceFormat);
    cjsCache.set(url, module);
  
 -  const wrapperNames = [...exportNames];
@@ -117,17 +117,17 @@ index 147d96bda8098fe16e5d0053e36eab05fb489c22..3c82913ca381eba30596f22a734b49dc
    if (!exportNames.has('default')) {
      ArrayPrototypePush(wrapperNames, 'default');
    }
-@@ -319,6 +321,10 @@ translators.set('require-commonjs', (url, source, isMain) => {
-   return createCJSModuleWrap(url, source, isMain, 'commonjs');
+@@ -322,6 +324,10 @@ translators.set('require-commonjs', (url, translateContext, parentURL) => {
+   return createCJSModuleWrap(url, translateContext, parentURL);
  });
  
 +translators.set('electron', () => {
-+  return createCJSModuleWrap('electron', '');
++  return createCJSModuleWrap('electron', { source: '' });
 +});
 +
  // Handle CommonJS modules referenced by `require` calls.
  // This translator function must be sync, as `require` is sync.
- translators.set('require-commonjs-typescript', (url, source, isMain) => {
+ translators.set('require-commonjs-typescript', (url, translateContext, parentURL) => {
 diff --git a/lib/internal/url.js b/lib/internal/url.js
 index a1473fdac8aba3be541df3b6688a05c0dfbe403f..0a87d997856ea227f8f21393909ffc4634043f24 100644
 --- a/lib/internal/url.js

patches/node/fix_lazyload_fs_in_esm_loaders_to_apply_asar_patches.patch

@@ -6,7 +6,7 @@ Subject: fix: lazyload fs in esm loaders to apply asar patches
 Changes { foo } from fs to just "fs.foo" so that our patching of fs is applied to esm loaders
 
 diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
-index e8a2326e158550786620439fa4039c2b449624cc..c17867136a07022a740d6bf957fe7a8138a48c11 100644
+index 5f1921d15bc1d3a68c35990f85e36a0e8a5b3ec4..99c6ce57c04768d125dd0a1c6bd62bca7aae27bc 100644
 --- a/lib/internal/modules/esm/load.js
 +++ b/lib/internal/modules/esm/load.js
 @@ -9,7 +9,7 @@ const {
@@ -50,7 +50,7 @@ index 5f03cf14e948d449d303b22ab6710b5508fb83b2..72cc9444ca93ef7a1526e23314693aea
      });
      const { search, hash } = resolved;
 diff --git a/lib/internal/modules/esm/translators.js b/lib/internal/modules/esm/translators.js
-index 3c82913ca381eba30596f22a734b49dcba9b6f5b..1f967df42128a05e49acfa6d409737c06a3372e3 100644
+index 52b8b5d9255f782af96aa859dec4ffa6ca82c9d0..96869be3c48b84106a5fe2cb752fe979a211d96a 100644
 --- a/lib/internal/modules/esm/translators.js
 +++ b/lib/internal/modules/esm/translators.js
 @@ -24,7 +24,7 @@ const {
@@ -62,12 +62,12 @@ index 3c82913ca381eba30596f22a734b49dcba9b6f5b..1f967df42128a05e49acfa6d409737c0
  const { dirname, extname } = require('path');
  const {
    assertBufferSource,
-@@ -350,7 +350,7 @@ translators.set('commonjs', function commonjsStrategy(url, source, isMain) {
+@@ -362,7 +362,7 @@ translators.set('commonjs', function commonjsStrategy(url, translateContext, par
  
    try {
      // We still need to read the FS to detect the exports.
--    source ??= readFileSync(new URL(url), 'utf8');
-+    source ??= fs.readFileSync(new URL(url), 'utf8');
+-    translateContext.source ??= readFileSync(new URL(url), 'utf8');
++    translateContext.source ??= fs.readFileSync(new URL(url), 'utf8');
    } catch {
      // Continue regardless of error.
    }

patches/node/fix_remove_deprecated_errno_constants.patch

@@ -86,7 +86,7 @@ index fd28e0904d05e24e8eeb74fa36abd9727699a649..fea0426496978c0003fe1481afcf93fc
    NODE_DEFINE_CONSTANT(target, ETIMEDOUT);
  #endif
 diff --git a/src/node_errors.cc b/src/node_errors.cc
-index ae8553ee2022d60fea4572976b14ba9cd253aa45..4386a1bc5678e351ce084cd2c47202561619b164 100644
+index 552aa161636928fb646a97402988bc394ee987c1..15d78e3eca9693dc518ccb28fc7c02fa1372f34b 100644
 --- a/src/node_errors.cc
 +++ b/src/node_errors.cc
 @@ -862,10 +862,6 @@ const char* errno_string(int errorno) {

patches/node/pass_all_globals_through_require.patch

@@ -6,10 +6,10 @@ Subject: Pass all globals through "require"
 (cherry picked from commit 7d015419cb7a0ecfe6728431a4ed2056cd411d62)
 
 diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
-index 8a28cd0e497911550cb0fa889c4f2f780d86c24b..811a2961834b9648f5f6b51c3bda570541413818 100644
+index 02c9ba15853603ed69af7bdb9a3d3c7513e53ca1..1d43e75ae55a7dd37095a4379963e0e8278aafa1 100644
 --- a/lib/internal/modules/cjs/loader.js
 +++ b/lib/internal/modules/cjs/loader.js
-@@ -208,6 +208,13 @@ const {
+@@ -209,6 +209,13 @@ const {
    CHAR_FORWARD_SLASH,
  } = require('internal/constants');
  
@@ -23,7 +23,7 @@ index 8a28cd0e497911550cb0fa889c4f2f780d86c24b..811a2961834b9648f5f6b51c3bda5705
  const {
    isProxy,
  } = require('internal/util/types');
-@@ -1755,10 +1762,12 @@ Module.prototype._compile = function(content, filename, format) {
+@@ -1756,10 +1763,12 @@ Module.prototype._compile = function(content, filename, format) {
    if (this[kIsMainSymbol] && getOptionValue('--inspect-brk')) {
      const { callAndPauseOnStart } = internalBinding('inspector');
      result = callAndPauseOnStart(compiledWrapper, thisValue, exports,

patches/node/refactor_attach_cppgc_heap_on_v8_isolate_creation.patch

@@ -18,10 +18,10 @@ This can be removed when Node.js upgrades to a version of V8 containing CLs
 from the above issue.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index a869bc0a145009b57db3f37208e405d9356cc20f..072deb1fa70313e33397f6ff994e3f3548e86092 100644
+index 6e7c0dbe31d0fef23288787df44e58c44bd47c5d..451796ffc4ec93b6e317dd49d92070c61aca04e5 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -319,6 +319,10 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
+@@ -336,6 +336,10 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
                      MultiIsolatePlatform* platform,
                      const SnapshotData* snapshot_data,
                      const IsolateSettings& settings) {
@@ -29,10 +29,10 @@ index a869bc0a145009b57db3f37208e405d9356cc20f..072deb1fa70313e33397f6ff994e3f35
 +    params->cpp_heap =
 +        v8::CppHeap::Create(platform, v8::CppHeapCreateParams{{}}).release();
 +  }
-   Isolate* isolate = Isolate::Allocate();
+   IsolateGroup group = GetOrCreateIsolateGroup();
+   Isolate* isolate = Isolate::Allocate(group);
    if (isolate == nullptr) return nullptr;
- 
-@@ -374,9 +378,12 @@ Isolate* NewIsolate(ArrayBufferAllocator* allocator,
+@@ -392,9 +396,12 @@ Isolate* NewIsolate(ArrayBufferAllocator* allocator,
                      uv_loop_t* event_loop,
                      MultiIsolatePlatform* platform,
                      const EmbedderSnapshotData* snapshot_data,
@@ -102,7 +102,7 @@ index 53f0bf7fc1e5c85fa9a5a323e998f04310f4f75e..a78817467518245c4a190e870e0eb306
        isolate, object, wrappable);
  }
 diff --git a/src/node.h b/src/node.h
-index f7b3f90b0c2cfbeacc5bc50112dd711df8d3c364..7fae281a6e0f3c1a9f0eb97536883bb26c16d94d 100644
+index 9c624e4ef26c1b06a6c4bca7def245935189ce07..84c121f13caa1472cef67113fbc7b7213e7af7e1 100644
 --- a/src/node.h
 +++ b/src/node.h
 @@ -604,7 +604,8 @@ NODE_EXTERN v8::Isolate* NewIsolate(
@@ -115,7 +115,7 @@ index f7b3f90b0c2cfbeacc5bc50112dd711df8d3c364..7fae281a6e0f3c1a9f0eb97536883bb2
  NODE_EXTERN v8::Isolate* NewIsolate(
      std::shared_ptr<ArrayBufferAllocator> allocator,
      struct uv_loop_s* event_loop,
-@@ -1617,9 +1618,10 @@ void RegisterSignalHandler(int signal,
+@@ -1625,9 +1626,10 @@ void RegisterSignalHandler(int signal,
  // work with only Node.js versions with v8::Object::Wrap() should use that
  // instead.
  NODE_DEPRECATED("Use v8::Object::Wrap()",

patches/node/src_handle_der_decoding_errors_from_system_certificates.patch

@@ -0,0 +1,74 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Joyee Cheung <joyeec9h3@gmail.com>
+Date: Thu, 20 Nov 2025 13:50:28 +0900
+Subject: src: handle DER decoding errors from system certificates
+
+When decoding certificates from the system store, it's not actually
+guaranteed to succeed. In case the system returns a certificate
+that cannot be decoded (might be related to SSL implementation issues),
+skip them.
+
+diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
+index 96f6ea29525bc2c60297e7be5bc1d0b74cd568e1..9b83f8d6b2c7639044e739a7f055e457882370a2 100644
+--- a/src/crypto/crypto_context.cc
++++ b/src/crypto/crypto_context.cc
+@@ -507,7 +507,11 @@ void ReadMacOSKeychainCertificates(
+   CFRelease(search);
+ 
+   if (ortn) {
+-    fprintf(stderr, "ERROR: SecItemCopyMatching failed %d\n", ortn);
++    per_process::Debug(DebugCategory::CRYPTO,
++                       "Cannot read certificates from system because "
++                       "SecItemCopyMatching failed %d\n",
++                       ortn);
++    return;
+   }
+ 
+   CFIndex count = CFArrayGetCount(curr_anchors);
+@@ -518,7 +522,9 @@ void ReadMacOSKeychainCertificates(
+ 
+     CFDataRef der_data = SecCertificateCopyData(cert_ref);
+     if (!der_data) {
+-      fprintf(stderr, "ERROR: SecCertificateCopyData failed\n");
++      per_process::Debug(DebugCategory::CRYPTO,
++                         "Skipping read of a system certificate "
++                         "because SecCertificateCopyData failed\n");
+       continue;
+     }
+     auto data_buffer_pointer = CFDataGetBytePtr(der_data);
+@@ -526,9 +532,19 @@ void ReadMacOSKeychainCertificates(
+     X509* cert =
+         d2i_X509(nullptr, &data_buffer_pointer, CFDataGetLength(der_data));
+     CFRelease(der_data);
++
++    if (cert == nullptr) {
++      per_process::Debug(DebugCategory::CRYPTO,
++                         "Skipping read of a system certificate "
++                         "because decoding failed\n");
++      continue;
++    }
++
+     bool is_valid = IsCertificateTrustedForPolicy(cert, cert_ref);
+     if (is_valid) {
+       system_root_certificates_X509->emplace_back(cert);
++    } else {
++      X509_free(cert);
+     }
+   }
+   CFRelease(curr_anchors);
+@@ -638,7 +654,14 @@ void GatherCertsForLocation(std::vector<X509*>* vector,
+         reinterpret_cast<const unsigned char*>(cert_from_store->pbCertEncoded);
+     const size_t cert_size = cert_from_store->cbCertEncoded;
+ 
+-    vector->emplace_back(d2i_X509(nullptr, &cert_data, cert_size));
++    X509* x509 = d2i_X509(nullptr, &cert_data, cert_size);
++    if (x509 == nullptr) {
++      per_process::Debug(DebugCategory::CRYPTO,
++                         "Skipping read of a system certificate "
++                         "because decoding failed\n");
++    } else {
++      vector->emplace_back(x509);
++    }
+   }
+ }
+ 

patches/node/src_use_cp_utf8_for_wide_file_names_on_win32.patch

@@ -197,10 +197,10 @@ index 529b7cfc15536c3fe5e7798c0f82698121751f2a..cbc3283fc2d511cce2eae0048cc9bf0f
  
    if (package_json == nullptr) {
 diff --git a/src/util-inl.h b/src/util-inl.h
-index da9268dcf2ff432ddeec7c0f61a147b73f3130e2..82b2760f535345d126bc3dcf3890573d36dbb497 100644
+index d07bceb425f00882db116975a92f4835d7c2cf3b..6898e8ea794675e903e13e2b45524d572a3f68bb 100644
 --- a/src/util-inl.h
 +++ b/src/util-inl.h
-@@ -698,12 +698,11 @@ inline bool IsWindowsBatchFile(const char* filename) {
+@@ -718,12 +718,11 @@ inline bool IsWindowsBatchFile(const char* filename) {
    return !extension.empty() && (extension == "cmd" || extension == "bat");
  }
  
@@ -216,7 +216,7 @@ index da9268dcf2ff432ddeec7c0f61a147b73f3130e2..82b2760f535345d126bc3dcf3890573d
                        0,
                        &str[0],
                        static_cast<int>(str.size()),
-@@ -711,6 +710,59 @@ inline std::wstring ConvertToWideString(const std::string& str,
+@@ -731,6 +730,59 @@ inline std::wstring ConvertToWideString(const std::string& str,
                        size_needed);
    return wstrTo;
  }
@@ -277,7 +277,7 @@ index da9268dcf2ff432ddeec7c0f61a147b73f3130e2..82b2760f535345d126bc3dcf3890573d
  
  inline v8::MaybeLocal<v8::Object> NewDictionaryInstance(
 diff --git a/src/util.h b/src/util.h
-index 6da57f95165bbdedb65dab6eaae8c39b815ee4e5..e65d6dbf359f61d051efe4e129c9035ed90cc8f6 100644
+index 1db426df35e4976427b578a2974041ec9e92cf4c..52e6a149d6760640d93c56ce91a759ae9207a8c7 100644
 --- a/src/util.h
 +++ b/src/util.h
 @@ -507,6 +507,8 @@ class MaybeStackBuffer {
@@ -289,7 +289,7 @@ index 6da57f95165bbdedb65dab6eaae8c39b815ee4e5..e65d6dbf359f61d051efe4e129c9035e
  
   private:
    size_t length_;
-@@ -1026,9 +1028,15 @@ class JSONOutputStream final : public v8::OutputStream {
+@@ -1038,9 +1040,15 @@ class JSONOutputStream final : public v8::OutputStream {
  // Returns true if OS==Windows and filename ends in .bat or .cmd,
  // case insensitive.
  inline bool IsWindowsBatchFile(const char* filename);

patches/node/support_v8_sandboxed_pointers.patch

@@ -7,10 +7,10 @@ This refactors several allocators to allocate within the V8 memory cage,
 allowing them to be compatible with the V8_SANDBOXED_POINTERS feature.
 
 diff --git a/src/api/environment.cc b/src/api/environment.cc
-index d10f861c96931d06fb50dcdb66f2e79b0dee55a7..a869bc0a145009b57db3f37208e405d9356cc20f 100644
+index 31007e599f0b717d586aa97b26c610047f402f0f..6e7c0dbe31d0fef23288787df44e58c44bd47c5d 100644
 --- a/src/api/environment.cc
 +++ b/src/api/environment.cc
-@@ -109,6 +109,14 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,
+@@ -111,6 +111,14 @@ MaybeLocal<Value> PrepareStackTraceCallback(Local<Context> context,
    return result;
  }
  
@@ -24,8 +24,8 @@ index d10f861c96931d06fb50dcdb66f2e79b0dee55a7..a869bc0a145009b57db3f37208e405d9
 +
  void* NodeArrayBufferAllocator::Allocate(size_t size) {
    void* ret;
-   if (zero_fill_field_ || per_process::cli_options->zero_fill_all_buffers)
-@@ -324,6 +332,12 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
+   if (zero_fill_field_ || per_process::cli_options->zero_fill_all_buffers) {
+@@ -342,6 +350,12 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
      // but also otherwise just doesn't work, and the only real alternative
      // is disabling shared-readonly-heap mode altogether.
      static Isolate::CreateParams first_params = *params;
@@ -275,10 +275,10 @@ index 3c4f419aa29470b3280174b58680b9421b0340b5..3b24ad2a2316f89d98b067e2c13988f8
  
  constexpr const char* EncodingName(const enum encoding encoding) {
 diff --git a/src/node_internals.h b/src/node_internals.h
-index 12ea72b61b0a5e194207bb369dfed4b8667107cb..64442215714a98f648971e517ddd9c77e38fe3f2 100644
+index 95ce3cf882296bf8eed5a11fe189857c3c88fd15..6612751d07803a1e9b8bf8196b5b8067644064ad 100644
 --- a/src/node_internals.h
 +++ b/src/node_internals.h
-@@ -121,7 +121,9 @@ v8::MaybeLocal<v8::Object> InitializePrivateSymbols(
+@@ -124,7 +124,9 @@ v8::MaybeLocal<v8::Object> InitializePrivateSymbols(
  
  class NodeArrayBufferAllocator : public ArrayBufferAllocator {
   public:
@@ -289,7 +289,7 @@ index 12ea72b61b0a5e194207bb369dfed4b8667107cb..64442215714a98f648971e517ddd9c77
  
    void* Allocate(size_t size) override;  // Defined in src/node.cc
    void* AllocateUninitialized(size_t size) override;
-@@ -139,7 +141,7 @@ class NodeArrayBufferAllocator : public ArrayBufferAllocator {
+@@ -142,7 +144,7 @@ class NodeArrayBufferAllocator : public ArrayBufferAllocator {
    }
  
   private:

patches/node/test_formally_mark_some_tests_as_flaky.patch

@@ -7,7 +7,7 @@ Instead of disabling the tests, flag them as flaky so they still run
 but don't cause CI failures on flakes.
 
 diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
-index 0036beb318df2241d49201dc9d0679763e551e7b..5713f13de818f84b1c598b73024773c1bbf936c6 100644
+index bf040bf2ee9c727542e347f3467e04a29bfd1b63..9dcd28bc499aa2b1ba313ab9e921d6835140cc92 100644
 --- a/test/parallel/parallel.status
 +++ b/test/parallel/parallel.status
 @@ -5,6 +5,16 @@ prefix parallel
@@ -28,7 +28,7 @@ index 0036beb318df2241d49201dc9d0679763e551e7b..5713f13de818f84b1c598b73024773c1
  test-shadow-realm-gc: SKIP
  test-shadow-realm-gc-module: SKIP
 diff --git a/test/sequential/sequential.status b/test/sequential/sequential.status
-index c36eac6302d43a6b80ed0bc77db2c628bb66169c..627c4d576787e4363736615d08eebe481800909e 100644
+index 627e61911d15cad151bfdf5af83c6ada93e62ba8..01e820390ecc039c7ae104a94e88c36c209eed36 100644
 --- a/test/sequential/sequential.status
 +++ b/test/sequential/sequential.status
 @@ -7,6 +7,18 @@ prefix sequential

script/codesign/generate-identity.sh

@@ -40,6 +40,7 @@ DevToolsSecurity -enable
 # security import "$dir"/public.key -k $KEY_CHAIN
 
 # Generate Trust Settings
+# TODO: Remove NPX
 npm_config_yes=true npx ts-node "$(dirname $0)"/gen-trust.ts "$dir"/certificate.cer "$dir"/trust.xml
 
 # Import Trust Settings

script/lint.js

@@ -153,7 +153,7 @@ const LINTERS = [{
 }, {
   key: 'javascript',
   roots: ['build', 'default_app', 'lib', 'npm', 'script', 'spec'],
-  ignoreRoots: ['spec/node_modules'],
+  ignoreRoots: ['spec/node_modules', 'spec/fixtures/native-addon'],
   test: filename => filename.endsWith('.js') || filename.endsWith('.ts') || filename.endsWith('.mjs'),
   run: async (opts, filenames) => {
     const eslint = new ESLint({
@@ -282,7 +282,7 @@ const LINTERS = [{
 }, {
   key: 'md',
   roots: ['.'],
-  ignoreRoots: ['.git', 'node_modules', 'spec/node_modules'],
+  ignoreRoots: ['.git', 'node_modules', 'spec/node_modules', 'spec/fixtures/native-addon'],
   test: filename => filename.endsWith('.md'),
   run: async (opts, filenames) => {
     const { getCodeBlocks } = await import('@electron/lint-roller/dist/lib/markdown.js');

script/nan-spec-runner.js

@@ -9,7 +9,7 @@ const NAN_DIR = path.resolve(BASE, 'third_party', 'nan');
 const NPX_CMD = process.platform === 'win32' ? 'npx.cmd' : 'npx';
 
 const utils = require('./lib/utils');
-const { YARN_VERSION } = require('./yarn');
+const { YARN_SCRIPT_PATH } = require('./yarn');
 
 if (!require.main) {
   throw new Error('Must call the nan spec runner directly');
@@ -112,13 +112,12 @@ async function main () {
     stdio: 'inherit',
     shell: process.platform === 'win32'
   });
-
   if (buildStatus !== 0 || signal != null) {
     console.error('Failed to build nan test modules');
     return process.exit(buildStatus !== 0 ? buildStatus : signal);
   }
 
-  const { status: installStatus, signal: installSignal } = cp.spawnSync(NPX_CMD, [`yarn@${YARN_VERSION}`, 'install'], {
+  const { status: installStatus, signal: installSignal } = cp.spawnSync(process.execPath, [YARN_SCRIPT_PATH, 'install'], {
     env,
     cwd: NAN_DIR,
     stdio: 'inherit',

script/node-disabled-tests.json

@@ -46,8 +46,6 @@
   "parallel/test-process-get-builtin",
   "parallel/test-repl",
   "parallel/test-repl-underscore",
-  "parallel/test-single-executable-blob-config",
-  "parallel/test-single-executable-blob-config-errors",
   "parallel/test-shadow-realm-custom-loaders",
   "parallel/test-snapshot-api",
   "parallel/test-snapshot-argv1",
@@ -171,6 +169,8 @@
   "report/test-report-uv-handles",
   "report/test-report-worker",
   "report/test-report-writereport",
+  "sea/test-single-executable-blob-config",
+  "sea/test-single-executable-blob-config-errors",
   "sequential/test-single-executable-application",
   "sequential/test-single-executable-application-disable-experimental-sea-warning",
   "sequential/test-single-executable-application-empty",

script/release/bin/publish-to-npm.ts

@@ -211,6 +211,7 @@ new Promise<string>((resolve, reject) => {
     });
   })
   .then((tarballPath) => {
+    // TODO: Remove NPX
     const existingVersionJSON = childProcess.execSync(`npx npm@7 view ${rootPackageJson.name}@${currentElectronVersion} --json`).toString('utf-8');
     // It's possible this is a re-run and we already have published the package, if not we just publish like normal
     if (!existingVersionJSON) {

script/spec-runner.js

@@ -21,6 +21,7 @@ const fail = chalk.red('✗');
 const FAILURE_STATUS_KEY = 'Electron_Spec_Runner_Failures';
 
 const args = minimist(process.argv, {
+  boolean: ['skipYarnInstall'],
   string: ['runners', 'target', 'electronVersion'],
   number: ['enableRerun'],
   unknown: arg => unknownFlags.push(arg)
@@ -36,10 +37,9 @@ for (const flag of unknownFlags) {
 }
 
 const utils = require('./lib/utils');
-const { YARN_VERSION } = require('./yarn');
+const { YARN_SCRIPT_PATH } = require('./yarn');
 
 const BASE = path.resolve(__dirname, '../..');
-const NPX_CMD = process.platform === 'win32' ? 'npx.cmd' : 'npx';
 
 const runners = new Map([
   ['main', { description: 'Main process specs', run: runMainProcessElectronTests }]
@@ -96,7 +96,7 @@ async function main () {
   const somethingChanged = (currentSpecHash !== lastSpecHash) ||
       (lastSpecInstallHash !== currentSpecInstallHash);
 
-  if (somethingChanged) {
+  if (somethingChanged && !args.skipYarnInstall) {
     await installSpecModules(path.resolve(__dirname, '..', 'spec'));
     await getSpecHash().then(saveSpecHash);
   }
@@ -419,7 +419,8 @@ async function installSpecModules (dir) {
   if (fs.existsSync(path.resolve(dir, 'node_modules'))) {
     await fs.promises.rm(path.resolve(dir, 'node_modules'), { force: true, recursive: true });
   }
-  const { status } = childProcess.spawnSync(NPX_CMD, [`yarn@${YARN_VERSION}`, 'install', '--frozen-lockfile'], {
+  const yarnArgs = [YARN_SCRIPT_PATH, 'install', '--immutable'];
+  const { status } = childProcess.spawnSync(process.execPath, yarnArgs, {
     env,
     cwd: dir,
     stdio: 'inherit',
@@ -435,8 +436,8 @@ function getSpecHash () {
   return Promise.all([
     (async () => {
       const hasher = crypto.createHash('SHA256');
+      hasher.update(fs.readFileSync(path.resolve(__dirname, '../yarn.lock')));
       hasher.update(fs.readFileSync(path.resolve(__dirname, '../spec/package.json')));
-      hasher.update(fs.readFileSync(path.resolve(__dirname, '../spec/yarn.lock')));
       hasher.update(fs.readFileSync(path.resolve(__dirname, '../script/spec-runner.js')));
       return hasher.digest('hex');
     })(),

script/yarn.js

@@ -1,21 +1,7 @@
-const cp = require('node:child_process');
-const fs = require('node:fs');
 const path = require('node:path');
 
-const YARN_VERSION = /'yarn_version': '(.+?)'/.exec(fs.readFileSync(path.resolve(__dirname, '../DEPS'), 'utf8'))[1];
-const NPX_CMD = process.platform === 'win32' ? 'npx.cmd' : 'npx';
+exports.YARN_SCRIPT_PATH = path.resolve(__dirname, '..', '.yarn/releases/yarn-4.11.0.cjs');
 
 if (require.main === module) {
-  const child = cp.spawn(NPX_CMD, [`yarn@${YARN_VERSION}`, ...process.argv.slice(2)], {
-    stdio: 'inherit',
-    env: {
-      ...process.env,
-      npm_config_yes: 'true'
-    },
-    shell: process.platform === 'win32'
-  });
-
-  child.on('exit', code => process.exit(code));
+  require(exports.YARN_SCRIPT_PATH);
 }
-
-exports.YARN_VERSION = YARN_VERSION;

shell/browser/api/electron_api_web_contents.cc

@@ -2397,6 +2397,9 @@ void WebContents::LoadURL(const GURL& url,
     return;
   }
 
+  if (web_contents()->NeedToFireBeforeUnloadOrUnloadEvents())
+    pending_unload_url_ = url;
+
   // Discard non-committed entries to ensure we don't re-use a pending entry.
   web_contents()->GetController().DiscardNonCommittedEntries();
   web_contents()->GetController().LoadURLWithParams(params);
@@ -3901,8 +3904,15 @@ void WebContents::RunBeforeUnloadDialog(content::WebContents* web_contents,
                                         content::RenderFrameHost* rfh,
                                         bool is_reload,
                                         DialogClosedCallback callback) {
-  // TODO: asyncify?
   bool default_prevented = Emit("will-prevent-unload");
+
+  if (pending_unload_url_.has_value() && !default_prevented) {
+    Emit("did-fail-load", static_cast<int>(net::ERR_ABORTED),
+         net::ErrorToShortString(net::ERR_ABORTED),
+         pending_unload_url_.value().possibly_invalid_spec(), true);
+    pending_unload_url_.reset();
+  }
+
   std::move(callback).Run(default_prevented, std::u16string());
 }
 

shell/browser/api/electron_api_web_contents.h

@@ -845,6 +845,8 @@ class WebContents final : public ExclusiveAccessContext,
   // that field to ensure the dtor destroys them in the right order.
   raw_ptr<WebContentsZoomController> zoom_controller_ = nullptr;
 
+  std::optional<GURL> pending_unload_url_ = std::nullopt;
+
   // Maps url to file path, used by the file requests sent from devtools.
   typedef std::map<std::string, base::FilePath> PathsMap;
   PathsMap saved_files_;

shell/browser/electron_api_ipc_handler_impl.cc

@@ -49,6 +49,8 @@ void ElectronApiIPCHandlerImpl::Message(bool internal,
     v8::Isolate* isolate = electron::JavascriptEnvironment::GetIsolate();
     v8::HandleScope handle_scope(isolate);
     auto* event = MakeIPCEvent(isolate, session->Get(), internal);
+    if (!event)
+      return;
     v8::Local<v8::Object> event_object =
         event->GetWrapper(isolate).ToLocalChecked();
     session->Get()->Message(event_object, channel, std::move(arguments));
@@ -64,6 +66,8 @@ void ElectronApiIPCHandlerImpl::Invoke(bool internal,
     v8::HandleScope handle_scope(isolate);
     auto* event =
         MakeIPCEvent(isolate, session->Get(), internal, std::move(callback));
+    if (!event)
+      return;
     v8::Local<v8::Object> event_object =
         event->GetWrapper(isolate).ToLocalChecked();
     session->Get()->Invoke(event_object, channel, std::move(arguments));
@@ -78,6 +82,8 @@ void ElectronApiIPCHandlerImpl::ReceivePostMessage(
     v8::Isolate* isolate = electron::JavascriptEnvironment::GetIsolate();
     v8::HandleScope handle_scope(isolate);
     auto* event = MakeIPCEvent(isolate, session->Get(), false);
+    if (!event)
+      return;
     v8::Local<v8::Object> event_object =
         event->GetWrapper(isolate).ToLocalChecked();
     session->Get()->ReceivePostMessage(event_object, channel,
@@ -95,6 +101,8 @@ void ElectronApiIPCHandlerImpl::MessageSync(bool internal,
     v8::HandleScope handle_scope(isolate);
     auto* event =
         MakeIPCEvent(isolate, session->Get(), internal, std::move(callback));
+    if (!event)
+      return;
     v8::Local<v8::Object> event_object =
         event->GetWrapper(isolate).ToLocalChecked();
     session->Get()->MessageSync(event_object, channel, std::move(arguments));
@@ -108,6 +116,8 @@ void ElectronApiIPCHandlerImpl::MessageHost(const std::string& channel,
     v8::Isolate* isolate = electron::JavascriptEnvironment::GetIsolate();
     v8::HandleScope handle_scope(isolate);
     auto* event = MakeIPCEvent(isolate, session->Get(), false);
+    if (!event)
+      return;
     v8::Local<v8::Object> event_object =
         event->GetWrapper(isolate).ToLocalChecked();
     session->Get()->MessageHost(event_object, channel, std::move(arguments));

shell/browser/electron_api_sw_ipc_handler_impl.cc

@@ -76,6 +76,8 @@ void ElectronApiSWIPCHandlerImpl::Message(bool internal,
     v8::Isolate* isolate = electron::JavascriptEnvironment::GetIsolate();
     v8::HandleScope handle_scope(isolate);
     auto* event = MakeIPCEvent(isolate, session->Get(), internal);
+    if (!event)
+      return;
     v8::Local<v8::Object> event_object =
         event->GetWrapper(isolate).ToLocalChecked();
     session->Get()->Message(event_object, channel, std::move(arguments));
@@ -92,6 +94,8 @@ void ElectronApiSWIPCHandlerImpl::Invoke(bool internal,
     v8::HandleScope handle_scope(isolate);
     auto* event =
         MakeIPCEvent(isolate, session->Get(), internal, std::move(callback));
+    if (!event)
+      return;
     v8::Local<v8::Object> event_object =
         event->GetWrapper(isolate).ToLocalChecked();
     session->Get()->Invoke(event_object, channel, std::move(arguments));
@@ -106,6 +110,8 @@ void ElectronApiSWIPCHandlerImpl::ReceivePostMessage(
     v8::Isolate* isolate = electron::JavascriptEnvironment::GetIsolate();
     v8::HandleScope handle_scope(isolate);
     auto* event = MakeIPCEvent(isolate, session->Get(), false);
+    if (!event)
+      return;
     v8::Local<v8::Object> event_object =
         event->GetWrapper(isolate).ToLocalChecked();
     session->Get()->ReceivePostMessage(event_object, channel,
@@ -123,6 +129,8 @@ void ElectronApiSWIPCHandlerImpl::MessageSync(bool internal,
     v8::HandleScope handle_scope(isolate);
     auto* event =
         MakeIPCEvent(isolate, session->Get(), internal, std::move(callback));
+    if (!event)
+      return;
     v8::Local<v8::Object> event_object =
         event->GetWrapper(isolate).ToLocalChecked();
     session->Get()->MessageSync(event_object, channel, std::move(arguments));

shell/browser/electron_browser_main_parts.cc

@@ -62,7 +62,6 @@
 #include "shell/common/logging.h"
 #include "shell/common/node_bindings.h"
 #include "shell/common/node_includes.h"
-#include "shell/common/v8_util.h"
 #include "ui/base/idle/idle.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/ui_base_switches.h"
@@ -275,10 +274,6 @@ void ElectronBrowserMainParts::PostEarlyInitialization() {
   // Initialize field trials.
   InitializeFieldTrials();
 
-  if (base::FeatureList::IsEnabled(features::kWebAssemblyTrapHandler)) {
-    electron::SetUpWebAssemblyTrapHandler();
-  }
-
   // Reinitialize logging now that the app has had a chance to set the app name
   // and/or user data directory.
   logging::InitElectronLogging(*base::CommandLine::ForCurrentProcess(),

shell/browser/native_window_views.cc

@@ -553,7 +553,7 @@ bool NativeWindowViews::IsFocused() const {
 }
 
 void NativeWindowViews::Show() {
-  if (is_modal() && NativeWindow::parent())
+  if (is_modal() && NativeWindow::parent() && !widget()->IsVisible())
     static_cast<NativeWindowViews*>(parent())->IncrementChildModals();
 
   widget()->native_widget_private()->Show(GetRestoredState(), gfx::Rect());

shell/browser/ui/cocoa/electron_menu_controller.mm

@@ -563,16 +563,22 @@ NSArray* ConvertSharingItemToNS(const SharingItem& item) {
 }
 
 - (void)menuDidClose:(NSMenu*)menu {
-  if (isMenuOpen_) {
-    isMenuOpen_ = NO;
-    if (model_)
-      model_->MenuWillClose();
-    // Post async task so that itemSelected runs before the close callback
-    // deletes the controller from the map which deallocates it
-    if (!closeCallback.is_null()) {
-      content::GetUIThreadTaskRunner({})->PostTask(FROM_HERE,
-                                                   std::move(closeCallback));
-    }
+  // If the menu is already closed, do nothing.
+  if (!isMenuOpen_)
+    return;
+
+  // We should only respond to the top-level menu's close event.
+  if (menu != menu_)
+    return;
+
+  isMenuOpen_ = NO;
+  if (model_)
+    model_->MenuWillClose();
+  // Post async task so that itemSelected runs before the close callback
+  // deletes the controller from the map which deallocates it
+  if (!closeCallback.is_null()) {
+    content::GetUIThreadTaskRunner({})->PostTask(FROM_HERE,
+                                                 std::move(closeCallback));
   }
 }
 

shell/common/v8_util.cc

@@ -8,7 +8,6 @@
 #include <utility>
 #include <vector>
 
-#include "base/base_switches.h"
 #include "base/memory/raw_ptr.h"
 #include "gin/converter.h"
 #include "shell/common/api/electron_api_native_image.h"
@@ -18,15 +17,6 @@
 #include "ui/gfx/image/image_skia.h"
 #include "v8/include/v8.h"
 
-#if BUILDFLAG(IS_LINUX) && (defined(ARCH_CPU_X86_64) || defined(ARCH_CPU_ARM64))
-#define ENABLE_WEB_ASSEMBLY_TRAP_HANDLER_LINUX
-#include "base/command_line.h"
-#include "base/debug/stack_trace.h"
-#include "components/crash/core/app/crashpad.h"  // nogncheck
-#include "content/public/common/content_switches.h"
-#include "v8/include/v8-wasm-trap-handler-posix.h"
-#endif
-
 namespace electron {
 
 namespace {
@@ -250,51 +240,6 @@ v8::Local<v8::Value> DeserializeV8Value(v8::Isolate* isolate,
   return V8Deserializer(isolate, data).Deserialize();
 }
 
-void SetUpWebAssemblyTrapHandler() {
-#if BUILDFLAG(IS_WIN)
-  // On Windows we use the default trap handler provided by V8.
-  v8::V8::EnableWebAssemblyTrapHandler(true);
-#elif BUILDFLAG(IS_MAC)
-  // On macOS, Crashpad uses exception ports to handle signals in a
-  // different process. As we cannot just pass a callback to this other
-  // process, we ask V8 to install its own signal handler to deal with
-  // WebAssembly traps.
-  v8::V8::EnableWebAssemblyTrapHandler(true);
-#elif defined(ENABLE_WEB_ASSEMBLY_TRAP_HANDLER_LINUX)
-  const bool crash_reporter_enabled =
-      crash_reporter::GetHandlerSocket(nullptr, nullptr);
-
-  if (crash_reporter_enabled) {
-    // If either --enable-crash-reporter or --enable-crash-reporter-for-testing
-    // is enabled it should take care of signal handling for us, use the default
-    // implementation which doesn't register an additional handler.
-    v8::V8::EnableWebAssemblyTrapHandler(false);
-    return;
-  }
-
-  const bool use_v8_default_handler =
-      base::CommandLine::ForCurrentProcess()->HasSwitch(
-          ::switches::kDisableInProcessStackTraces);
-
-  if (use_v8_default_handler) {
-    // There is no signal handler yet, but it's okay if v8 registers one.
-    v8::V8::EnableWebAssemblyTrapHandler(/*use_v8_signal_handler=*/true);
-    return;
-  }
-
-  if (base::debug::SetStackDumpFirstChanceCallback(
-          v8::TryHandleWebAssemblyTrapPosix)) {
-    // Crashpad and Breakpad are disabled, but the in-process stack dump
-    // handlers are enabled, so set the callback on the stack dump handlers.
-    v8::V8::EnableWebAssemblyTrapHandler(/*use_v8_signal_handler=*/false);
-    return;
-  }
-
-  // As the registration of the callback failed, we don't enable trap
-  // handlers.
-#endif
-}
-
 namespace util {
 
 /**

shell/common/v8_util.h

@@ -30,8 +30,6 @@ v8::Local<v8::Value> DeserializeV8Value(v8::Isolate* isolate,
 v8::Local<v8::Value> DeserializeV8Value(v8::Isolate* isolate,
                                         base::span<const uint8_t> data);
 
-void SetUpWebAssemblyTrapHandler();
-
 namespace util {
 
 [[nodiscard]] base::span<uint8_t> as_byte_span(

shell/renderer/electron_renderer_client.cc

@@ -6,8 +6,10 @@
 
 #include <algorithm>
 
+#include "base/base_switches.h"
 #include "base/command_line.h"
 #include "base/containers/contains.h"
+#include "base/debug/stack_trace.h"
 #include "content/public/renderer/render_frame.h"
 #include "net/http/http_request_headers.h"
 #include "shell/common/api/electron_bindings.h"
@@ -17,7 +19,6 @@
 #include "shell/common/node_includes.h"
 #include "shell/common/node_util.h"
 #include "shell/common/options_switches.h"
-#include "shell/common/v8_util.h"
 #include "shell/renderer/electron_render_frame_observer.h"
 #include "shell/renderer/web_worker_observer.h"
 #include "third_party/blink/public/common/web_preferences/web_preferences.h"
@@ -26,6 +27,13 @@
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"  // nogncheck
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"  // nogncheck
 
+#if BUILDFLAG(IS_LINUX) && (defined(ARCH_CPU_X86_64) || defined(ARCH_CPU_ARM64))
+#define ENABLE_WEB_ASSEMBLY_TRAP_HANDLER_LINUX
+#include "components/crash/core/app/crashpad.h"  // nogncheck
+#include "content/public/common/content_switches.h"
+#include "v8/include/v8-wasm-trap-handler-posix.h"
+#endif
+
 namespace electron {
 
 ElectronRendererClient::ElectronRendererClient()
@@ -240,9 +248,45 @@ void ElectronRendererClient::WillDestroyWorkerContextOnWorkerThread(
 }
 
 void ElectronRendererClient::SetUpWebAssemblyTrapHandler() {
-  // content/renderer layer already takes care of the feature flag detection
-  // so no need to check for features::kWebAssemblyTrapHandler here.
-  electron::SetUpWebAssemblyTrapHandler();
+// See CL:5372409 - copied from ShellContentRendererClient.
+#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC)
+  // Mac and Windows use the default implementation (where the default v8 trap
+  // handler gets set up).
+  ContentRendererClient::SetUpWebAssemblyTrapHandler();
+  return;
+#elif defined(ENABLE_WEB_ASSEMBLY_TRAP_HANDLER_LINUX)
+  const bool crash_reporter_enabled =
+      crash_reporter::GetHandlerSocket(nullptr, nullptr);
+
+  if (crash_reporter_enabled) {
+    // If either --enable-crash-reporter or --enable-crash-reporter-for-testing
+    // is enabled it should take care of signal handling for us, use the default
+    // implementation which doesn't register an additional handler.
+    ContentRendererClient::SetUpWebAssemblyTrapHandler();
+    return;
+  }
+
+  const bool use_v8_default_handler =
+      base::CommandLine::ForCurrentProcess()->HasSwitch(
+          ::switches::kDisableInProcessStackTraces);
+
+  if (use_v8_default_handler) {
+    // There is no signal handler yet, but it's okay if v8 registers one.
+    v8::V8::EnableWebAssemblyTrapHandler(/*use_v8_signal_handler=*/true);
+    return;
+  }
+
+  if (base::debug::SetStackDumpFirstChanceCallback(
+          v8::TryHandleWebAssemblyTrapPosix)) {
+    // Crashpad and Breakpad are disabled, but the in-process stack dump
+    // handlers are enabled, so set the callback on the stack dump handlers.
+    v8::V8::EnableWebAssemblyTrapHandler(/*use_v8_signal_handler=*/false);
+    return;
+  }
+
+  // As the registration of the callback failed, we don't enable trap
+  // handlers.
+#endif  // defined(ENABLE_WEB_ASSEMBLY_TRAP_HANDLER_LINUX)
 }
 
 node::Environment* ElectronRendererClient::GetEnvironment(

shell/services/node/node_service.cc

@@ -11,7 +11,6 @@
 #include "base/no_destructor.h"
 #include "base/process/process.h"
 #include "base/strings/utf_string_conversions.h"
-#include "content/public/common/content_features.h"
 #include "electron/mas.h"
 #include "net/base/network_change_notifier.h"
 #include "services/network/public/cpp/wrapper_shared_url_loader_factory.h"
@@ -23,7 +22,6 @@
 #include "shell/common/gin_helper/dictionary.h"
 #include "shell/common/node_bindings.h"
 #include "shell/common/node_includes.h"
-#include "shell/common/v8_util.h"
 #include "shell/services/node/parent_port.h"
 
 #if !IS_MAS_BUILD()
@@ -132,11 +130,6 @@ void NodeService::Initialize(
   v8::Isolate* const isolate = js_env_->isolate();
   v8::HandleScope scope{isolate};
 
-  // Initialize after setting up the V8 isolate.
-  if (base::FeatureList::IsEnabled(features::kWebAssemblyTrapHandler)) {
-    electron::SetUpWebAssemblyTrapHandler();
-  }
-
   node_bindings_->Initialize(isolate, isolate->GetCurrentContext());
 
   network_change_notifier_ = net::NetworkChangeNotifier::CreateIfNeeded(

spec/ambient.d.ts

@@ -1,4 +1,2 @@
 declare let standardScheme: string;
 declare let serviceWorkerScheme: string;
-
-declare module 'dbus-native';

spec/api-notification-dbus-spec.ts

@@ -10,7 +10,7 @@ import { nativeImage } from 'electron/common';
 import { app } from 'electron/main';
 
 import { expect } from 'chai';
-import * as dbus from 'dbus-native';
+import * as dbus from 'dbus-ts';
 
 import * as path from 'node:path';
 import { promisify } from 'node:util';
@@ -40,10 +40,9 @@ ifdescribe(!skip)('Notification module (dbus)', () => {
     const path = '/org/freedesktop/Notifications';
     const iface = 'org.freedesktop.DBus.Mock';
     console.log(`session bus: ${process.env.DBUS_SESSION_BUS_ADDRESS}`);
-    const bus = dbus.sessionBus();
+    const bus = await dbus.sessionBus();
     const service = bus.getService(serviceName);
-    const getInterface = promisify(service.getInterface.bind(service));
-    mock = await getInterface(path, iface);
+    mock = await service.getInterface(path, iface);
     getCalls = promisify(mock.GetCalls.bind(mock));
     reset = promisify(mock.Reset.bind(mock));
   });

spec/api-power-monitor-spec.ts

@@ -7,7 +7,7 @@
 // See https://pypi.python.org/pypi/python-dbusmock for more information about
 // python-dbusmock.
 import { expect } from 'chai';
-import * as dbus from 'dbus-native';
+import * as dbus from 'dbus-ts';
 
 import { once } from 'node:events';
 import { setTimeout } from 'node:timers/promises';
@@ -20,10 +20,9 @@ describe('powerMonitor', () => {
 
   ifdescribe(process.platform === 'linux' && process.env.DBUS_SYSTEM_BUS_ADDRESS != null)('when powerMonitor module is loaded with dbus mock', () => {
     before(async () => {
-      const systemBus = dbus.systemBus();
+      const systemBus = await dbus.systemBus();
       const loginService = systemBus.getService('org.freedesktop.login1');
-      const getInterface = promisify(loginService.getInterface.bind(loginService));
-      logindMock = await getInterface('/org/freedesktop/login1', 'org.freedesktop.DBus.Mock');
+      logindMock = await loginService.getInterface('/org/freedesktop/login1', 'org.freedesktop.DBus.Mock');
       getCalls = promisify(logindMock.GetCalls.bind(logindMock));
       emitSignal = promisify(logindMock.EmitSignal.bind(logindMock));
       reset = promisify(logindMock.Reset.bind(logindMock));

spec/api-web-contents-spec.ts

@@ -109,6 +109,7 @@ describe('webContents module', () => {
       await closeAllWindows();
       await cleanupWebContents();
     });
+
     it('does not emit if beforeunload returns undefined in a BrowserWindow', async () => {
       const w = new BrowserWindow({ show: false });
       w.webContents.once('will-prevent-unload', () => {
@@ -162,6 +163,35 @@ describe('webContents module', () => {
       w.close();
       await wait;
     });
+
+    it('fails loading a subsequent page after beforeunload is not prevented', async () => {
+      const w = new BrowserWindow({ show: false });
+
+      const didFailLoad = once(w.webContents, 'did-fail-load');
+      await w.loadFile(path.join(__dirname, 'fixtures', 'api', 'beforeunload-false.html'));
+      await w.webContents.executeJavaScript('console.log(\'gesture\')', true);
+
+      w.loadFile(path.join(__dirname, 'fixtures', 'pages', 'a.html'));
+      const [, code, , validatedURL] = await didFailLoad;
+      expect(code).to.equal(-3); // ERR_ABORTED
+      const { href: expectedURL } = url.pathToFileURL(path.join(__dirname, 'fixtures', 'pages', 'a.html'));
+      expect(validatedURL).to.equal(expectedURL);
+    });
+
+    it('allows loading a subsequent page after beforeunload is prevented', async () => {
+      const w = new BrowserWindow({ show: false });
+      w.webContents.once('will-prevent-unload', event => event.preventDefault());
+
+      await w.loadFile(path.join(__dirname, 'fixtures', 'api', 'beforeunload-false.html'));
+      await w.webContents.executeJavaScript('console.log(\'gesture\')', true);
+      await w.loadFile(path.join(__dirname, 'fixtures', 'pages', 'a.html'));
+      const pageTitle = await w.webContents.executeJavaScript('document.title');
+      expect(pageTitle).to.equal('test');
+
+      const wait = once(w, 'closed');
+      w.close();
+      await wait;
+    });
   });
 
   describe('webContents.send(channel, args...)', () => {
@@ -2657,7 +2687,13 @@ describe('webContents module', () => {
         const errMsg = Buffer.concat(stderr).toString().trim();
         console.error(`Error parsing PDF file, exit code was ${code}; signal was ${signal}, error: ${errMsg}`);
       }
-      return JSON.parse(Buffer.concat(stdout).toString().trim());
+      try {
+        return JSON.parse(Buffer.concat(stdout).toString().trim());
+      } catch (err) {
+        console.error('Error parsing PDF file:', err);
+        console.error('Raw output:', Buffer.concat(stdout).toString().trim());
+        throw err;
+      }
     };
 
     let w: BrowserWindow;

spec/fixtures/native-addon/echo/package.json

@@ -1,5 +1,8 @@
 {
-  "main": "./lib/echo.js",
   "name": "@electron-ci/echo",
-  "version": "0.0.1"
+  "version": "0.0.1",
+  "main": "./lib/echo.js",
+  "scripts": {
+    "install": "node-gyp configure && node-gyp build"
+  }
 }

spec/fixtures/native-addon/external-ab/package.json

@@ -1,5 +1,8 @@
 {
-  "main": "./lib/test-array-buffer.js",
   "name": "@electron-ci/external-ab",
-  "version": "0.0.1"
+  "version": "0.0.1",
+  "main": "./lib/test-array-buffer.js",
+  "scripts": {
+    "install": "node-gyp configure && node-gyp build"
+  }
 }

spec/fixtures/native-addon/is-valid-window/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@electron-ci/is-valid-window",
+  "version": "0.0.5",
+  "main": "./lib/is-valid-window.js",
+  "private": true,
+  "licenses": "MIT",
+  "dependencies": {
+    "nan": "2.x"
+  },
+  "scripts": {
+    "install": "node-gyp configure && node-gyp build"
+  }
+}