chore: cherry-pick 28 changes from angle, chromium, pdfium and v8 - #54898

Electron 44.7.1 and 44.7.2 carry upstream Chromium, V8, ANGLE and PDFium
security backports (electron/electron#54898) and roll Chromium to
152.0.7977.149. 44.7.2 is younger than the one-day minimumReleaseAge, so it
is exempted by exact version in minimumReleaseAgeExclude.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore(deps): update actions/setup-node action to v7.1.0

* chore(deps): update dependency third_party/emsdk to v6.0.12

* chore(deps): update dependency python to 3.15

* chore(deps): update pnpm to v12.12.1 (#333)

Renovate proposed v12.11.2; v12.12.1 is the newest release that already
satisfies the one-day minimumReleaseAge policy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore(deps): update js dependencies (#331, #332, #334, #336)

- electron 44.6.0 -> 44.7.0
- vite 8.3.3 -> 8.3.4 (postcss 8.5.30, source-map-js 1.2.2, rolldown 1.2.13)
- @types/node 24.19.1 -> 24.19.2
- prettier 3.9.9 -> 3.9.10

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs(changelog): record dependency updates in Unreleased

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore(deps): update electron to v44.7.2 (security)

Electron 44.7.1 and 44.7.2 carry upstream Chromium, V8, ANGLE and PDFium
security backports (electron/electron#54898) and roll Chromium to
152.0.7977.149. 44.7.2 is younger than the one-day minimumReleaseAge, so it
is exempted by exact version in minimumReleaseAgeExclude.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(deps): update vulnerable transitive dependencies (security)

pnpm audit reported 62 advisories in transitive dependencies that Renovate
does not refresh. Update them within their existing ranges:

- js-yaml 4.2.0 -> 4.3.2 (electron-updater, shipped in the GUI; also
  electron-builder): GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj,
  GHSA-2883-xcg3-v3hh
- tar 7.5.16 -> 7.5.22 (electron-builder): GHSA-23hp-3jrh-7fpw and others
- undici 6.27.0 -> 6.29.0, 7.29.0 -> 7.30.0 (@electron/get, node-gyp)
- @xmldom/xmldom 0.8.13 -> 0.8.15, fast-uri 3.1.2 -> 3.1.8,
  http-cache-semantics 4.2.0 -> 4.3.0,
  brace-expansion 1.1.21 / 2.1.7 / 5.0.12 (electron-builder)

All fixed versions are older than the minimumReleaseAge window.
sprintf-js (GHSA via @electron/get > global-agent > roarr) has no fixed
release yet and remains.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs(changelog): record Electron 44.7.2 and transitive security fixes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

##### [v44.9.0](https://github.com/electron/electron/releases/tag/v44.9.0)

### Release Notes for v44.9.0

#### Features

- Added app shims on macOS to show windows under another app's Dock icon. [#55073](electron/electron#55073) <sup>(Also in [45](https://github.com/electron/electron/pull/55072))</sup>

#### Fixes

- Fixed link-opened windows not using the opener's session and `webPreferences`. [#55048](electron/electron#55048) <sup>(Also in [42](electron/electron#55050), [43](electron/electron#55049), [45](https://github.com/electron/electron/pull/55051))</sup>
- Fixed `setCertificateVerifyProc` occasionally not being applied to a request issued concurrently with the first request to a host. [#55046](electron/electron#55046) <sup>(Also in [42](electron/electron#55054), [43](electron/electron#55047), [45](https://github.com/electron/electron/pull/55045))</sup>
##### [v44.8.0](https://github.com/electron/electron/releases/tag/v44.8.0)

### Release Notes for v44.8.0

#### Features

- Added support for `Notification` action buttons on Linux. [#54890](electron/electron#54890) <sup>(Also in [45](https://github.com/electron/electron/pull/54889))</sup>

#### Fixes

- Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. [#54987](electron/electron#54987)
- Fixed `net.fetch` and `session.fetch` failing permanently with `net::ERR_FAILED` after the Network Service process restarts. [#54909](electron/electron#54909) <sup>(Also in [42](electron/electron#54925), [43](electron/electron#54908), [45](https://github.com/electron/electron/pull/54910))</sup>
- Fixed `utilityProcess` dropping messages posted with `process.parentPort.postMessage()` right before the process exits. [#54960](electron/electron#54960) <sup>(Also in [42](electron/electron#55000), [43](electron/electron#54962), [45](https://github.com/electron/electron/pull/54956))</sup>
- Fixed `win.isFullScreen()` being stale in fullscreen events on Windows. [#55009](electron/electron#55009) <sup>(Also in [45](https://github.com/electron/electron/pull/55008))</sup>

#### Other Changes

- Backported fixes from upstream Chromium and V8. [#55034](electron/electron#55034)
- Updated Chromium to 152.0.7977.167. [#54928](electron/electron#54928)
- Updated Node.js to v24.22.0. [#55004](electron/electron#55004)
##### [v44.7.2](https://github.com/electron/electron/releases/tag/v44.7.2)

### Release Notes for v44.7.2

#### Fixes

- Fixed an issue where clicks posted to a background app were dropped on macOS. [#54819](electron/electron#54819) <sup>(Also in [45](https://github.com/electron/electron/pull/54818))</sup>
- Fixed interrupted macOS updates leaving a broken app behind. [#54844](electron/electron#54844) <sup>(Also in [45](https://github.com/electron/electron/pull/54843))</sup>

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, PDFium and V8. [#54898](electron/electron#54898)

#### Documentation

- Documentation changes: [#54880](electron/electron#54880)
##### [v44.7.1](https://github.com/electron/electron/releases/tag/v44.7.1)

### Release Notes for v44.7.1

#### Fixes

- Fixed a crash when starting without an available display server on Linux. [#54794](electron/electron#54794) <sup>(Also in [45](https://github.com/electron/electron/pull/54781))</sup>
- Fixed a Linux crash creating a window with a menu bar when GTK failed to load. [#54859](electron/electron#54859) <sup>(Also in [45](https://github.com/electron/electron/pull/54846))</sup>
- Fixed a `WebContentsView` that was removed with `removeChildView()` and re-added with `addChildView()` staying hidden behind its sibling views on Linux. [#54798](electron/electron#54798)
- Fixed asar archives in non-ASCII folders failing to load on Linux. [#54849](electron/electron#54849) <sup>(Also in [45](https://github.com/electron/electron/pull/54848))</sup>
- Fixed renderer crashes during garbage collection inside ShadowRealms. [#54865](electron/electron#54865) <sup>(Also in [45](https://github.com/electron/electron/pull/54864))</sup>

#### Other Changes

- Refactored mouse forwarding on Windows to fix `setIgnoreMouseEvents(true, { forward: true })` related issues. [#54802](electron/electron#54802) <sup>(Also in [45](https://github.com/electron/electron/pull/54803))</sup>
- Updated Chromium to 152.0.7977.149. [#54085](electron/electron#54085)
##### [v44.7.0](https://github.com/electron/electron/releases/tag/v44.7.0)

### Release Notes for v44.7.0

#### Features

- The macOS `autoUpdater` now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. [#54204](electron/electron#54204)

#### Fixes

- Fixed an uncatchable TypeError in `net.fetch` when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. [#54672](electron/electron#54672)

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. [#54666](electron/electron#54666)
- Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. [#54657](electron/electron#54657)
##### [v44.6.0](https://github.com/electron/electron/releases/tag/v44.6.0)

### Release Notes for v44.6.0

#### Features

- Added the experimental `protocol.registerSource()` to serve a custom scheme from directories on disk without a JavaScript handler. [#54522](electron/electron#54522) <sup>(Also in [45](https://github.com/electron/electron/pull/54521))</sup>

#### Fixes

- Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. [#54596](electron/electron#54596)
- Fixed a crash on `navigator.usb.requestDevice()` in in-memory sessions. [#54616](electron/electron#54616) <sup>(Also in [45](https://github.com/electron/electron/pull/54615))</sup>
- Fixed `webview.findInPage()` hanging when the host page also has an iframe. [#54586](electron/electron#54586) <sup>(Also in [43](electron/electron#54584), [45](https://github.com/electron/electron/pull/54585))</sup>
- Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. [#54623](electron/electron#54623)

#### Documentation

- Documentation changes: [#54589](electron/electron#54589)

##### [v44.9.0](https://github.com/electron/electron/releases/tag/v44.9.0)

### Release Notes for v44.9.0

#### Features

- Added app shims on macOS to show windows under another app's Dock icon. [#55073](electron/electron#55073) <sup>(Also in [45](https://github.com/electron/electron/pull/55072))</sup>

#### Fixes

- Fixed link-opened windows not using the opener's session and `webPreferences`. [#55048](electron/electron#55048) <sup>(Also in [42](electron/electron#55050), [43](electron/electron#55049), [45](https://github.com/electron/electron/pull/55051))</sup>
- Fixed `setCertificateVerifyProc` occasionally not being applied to a request issued concurrently with the first request to a host. [#55046](electron/electron#55046) <sup>(Also in [42](electron/electron#55054), [43](electron/electron#55047), [45](https://github.com/electron/electron/pull/55045))</sup>
##### [v44.8.0](https://github.com/electron/electron/releases/tag/v44.8.0)

### Release Notes for v44.8.0

#### Features

- Added support for `Notification` action buttons on Linux. [#54890](electron/electron#54890) <sup>(Also in [45](https://github.com/electron/electron/pull/54889))</sup>

#### Fixes

- Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. [#54987](electron/electron#54987)
- Fixed `net.fetch` and `session.fetch` failing permanently with `net::ERR_FAILED` after the Network Service process restarts. [#54909](electron/electron#54909) <sup>(Also in [42](electron/electron#54925), [43](electron/electron#54908), [45](https://github.com/electron/electron/pull/54910))</sup>
- Fixed `utilityProcess` dropping messages posted with `process.parentPort.postMessage()` right before the process exits. [#54960](electron/electron#54960) <sup>(Also in [42](electron/electron#55000), [43](electron/electron#54962), [45](https://github.com/electron/electron/pull/54956))</sup>
- Fixed `win.isFullScreen()` being stale in fullscreen events on Windows. [#55009](electron/electron#55009) <sup>(Also in [45](https://github.com/electron/electron/pull/55008))</sup>

#### Other Changes

- Backported fixes from upstream Chromium and V8. [#55034](electron/electron#55034)
- Updated Chromium to 152.0.7977.167. [#54928](electron/electron#54928)
- Updated Node.js to v24.22.0. [#55004](electron/electron#55004)
##### [v44.7.2](https://github.com/electron/electron/releases/tag/v44.7.2)

### Release Notes for v44.7.2

#### Fixes

- Fixed an issue where clicks posted to a background app were dropped on macOS. [#54819](electron/electron#54819) <sup>(Also in [45](https://github.com/electron/electron/pull/54818))</sup>
- Fixed interrupted macOS updates leaving a broken app behind. [#54844](electron/electron#54844) <sup>(Also in [45](https://github.com/electron/electron/pull/54843))</sup>

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, PDFium and V8. [#54898](electron/electron#54898)

#### Documentation

- Documentation changes: [#54880](electron/electron#54880)
##### [v44.7.1](https://github.com/electron/electron/releases/tag/v44.7.1)

### Release Notes for v44.7.1

#### Fixes

- Fixed a crash when starting without an available display server on Linux. [#54794](electron/electron#54794) <sup>(Also in [45](https://github.com/electron/electron/pull/54781))</sup>
- Fixed a Linux crash creating a window with a menu bar when GTK failed to load. [#54859](electron/electron#54859) <sup>(Also in [45](https://github.com/electron/electron/pull/54846))</sup>
- Fixed a `WebContentsView` that was removed with `removeChildView()` and re-added with `addChildView()` staying hidden behind its sibling views on Linux. [#54798](electron/electron#54798)
- Fixed asar archives in non-ASCII folders failing to load on Linux. [#54849](electron/electron#54849) <sup>(Also in [45](https://github.com/electron/electron/pull/54848))</sup>
- Fixed renderer crashes during garbage collection inside ShadowRealms. [#54865](electron/electron#54865) <sup>(Also in [45](https://github.com/electron/electron/pull/54864))</sup>

#### Other Changes

- Refactored mouse forwarding on Windows to fix `setIgnoreMouseEvents(true, { forward: true })` related issues. [#54802](electron/electron#54802) <sup>(Also in [45](https://github.com/electron/electron/pull/54803))</sup>
- Updated Chromium to 152.0.7977.149. [#54085](electron/electron#54085)
##### [v44.7.0](https://github.com/electron/electron/releases/tag/v44.7.0)

### Release Notes for v44.7.0

#### Features

- The macOS `autoUpdater` now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. [#54204](electron/electron#54204)

#### Fixes

- Fixed an uncatchable TypeError in `net.fetch` when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. [#54672](electron/electron#54672)

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. [#54666](electron/electron#54666)
- Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. [#54657](electron/electron#54657)
##### [v44.6.0](https://github.com/electron/electron/releases/tag/v44.6.0)

### Release Notes for v44.6.0

#### Features

- Added the experimental `protocol.registerSource()` to serve a custom scheme from directories on disk without a JavaScript handler. [#54522](electron/electron#54522) <sup>(Also in [45](https://github.com/electron/electron/pull/54521))</sup>

#### Fixes

- Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. [#54596](electron/electron#54596)
- Fixed a crash on `navigator.usb.requestDevice()` in in-memory sessions. [#54616](electron/electron#54616) <sup>(Also in [45](https://github.com/electron/electron/pull/54615))</sup>
- Fixed `webview.findInPage()` hanging when the host page also has an iframe. [#54586](electron/electron#54586) <sup>(Also in [43](electron/electron#54584), [45](https://github.com/electron/electron/pull/54585))</sup>
- Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. [#54623](electron/electron#54623)

#### Documentation

- Documentation changes: [#54589](electron/electron#54589)