• This is a security release to mitigate some CVEs recently discovered in Node (https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). The recommended version is Node 24.22.1 and above

• This is a security release to mitigate some CVEs recently discovered in Node (https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). The recommended version is Node 24.22.1 and above

Astryx 0.7.4 — every published @astryxdesign/* package ships at this version.

OLD_VERSION=0.7.3  # replace with the Core version your project uses today
npm install @astryxdesign/core@0.7.4 @astryxdesign/cli@0.7.4  # plus every other published @astryxdesign/* package you use, at 0.7.4
npx @astryxdesign/cli upgrade --from "$OLD_VERSION" --apply --path .

• BottomSheetSwitcher now gives every step its own native <dialog> while preserving one scrim, focus containment, scroll locking, Escape handling, and focus return. The public props and defaults are unchanged. Its forwarded ref now follows the dialog that hosts the active step. (#7720)

• Busy controls now announce “Loading” once through the shared polite announcement channel instead of competing with a second live Spinner. This covers TextInput, TextArea, Selector, MultiSelector, CheckboxInput, CommandPalette, DateInput, DateRangeInput, DateTimeInput, TimeInput, FileInput, DropdownMenuSubMenu, Thumbnail, ChatMessageList, ComplexSelector, Typeahead, Tokenizer, and BaseTypeahead. Announcements made inside an open modal stay inside that modal. (#7920, #7930, #7939, #7942, #7948, #7950, #7954, #7956)

• ChatComposerInput announces a trigger menu’s visible loading state once, while cached results that arrive before the loading row appears stay silent. (#7900)

• When a focused Carousel arrow reaches the end and becomes unavailable, focus moves to the scroll area without undoing the scroll. (#7926)

• CommandPaletteItem exposes highlighted, selected, and disabled states on its theme target:

  .astryx-command-palette-item[data-highlighted] { /* … */ }
  .astryx-command-palette-item[data-selected] { /* … */ }
  .astryx-command-palette-item[data-disabled] { /* … */ }

  Rendering, semantics, and props are unchanged. (#7967)

• A busy DateInput keeps its ordinary appearance and shows its Spinner; only a disabled field is dimmed. (#7968)

• Selector, DropdownMenu, and ContextMenu options inside open, closed, or nested shadow roots now commit when clicked. (#7914)

• useTypeahead clears its pending type buffer when its component unmounts or becomes hidden, leaving no timer behind and restoring with an empty buffer. (#7938)

• BottomSheetSwitcher anatomy now describes the per-step dialog structure. (#7720)

Integrations can ship an icon set, projects can select one, agents can find icons by meaning, and copied templates can replace declared icons with the selected set. The feature is isolated under astryx experimental and does not change stable search results or template output unless a project opts in with experimental.iconSet. (#7759)

astryx experimental icon --list
astryx experimental icon "delete"
astryx experimental icon use <set>

• Docs, schema fields, and enum values can declare stability: 'experimental'. The CLI labels experimental commands, keeps experimental docs out of stable search, and tells integration authors when an older supported CLI would drop the descriptor. (#7759)
• Docs can render commands for each reader’s package manager with {@command …}, {@pm …}, and {@pm-only …} tokens. integration check --next can validate them before their findings become warnings in the next minor release. (#7868)
• An integration doc can replace or extend an existing guide by route and place a section before or after another section. Reads name the contributing package, and unresolved placement is reported as a non-failing note. (#7936)
• astryx doctor --built <path> checks a finished project, output folder, or HTML file for Astryx use and reports source-level purity issues when source is available. It reads files only and does not execute them. (#7886)
• astryx theme palette generate receipts now identify the generator and candidate format without changing existing receipt fields. (#7678)
• Integration validation reports what examples need to run wherever they are shown, including package availability, exported subpaths, props, browser-only dependencies, assets, and runnable code. These are notes today and become strict warnings in the next minor. (#7891)
• Project agent docs written by astryx init now tell agents to run astryx doctor --built before delivering a build when the installed CLI supports it. (#7944)

• astryx doctor --built no longer counts type-only imports as shipped Astryx use. (#7945)
• astryx discover results name their source package, and typo-tolerant lookup now matches astryx search. (#7147)
• astryx search finds family members by their spelled-out names, lists representative members for a family-name query, and orders tied results by fit instead of alphabetically. (#7927, #7955, #7959)
• astryx integration verify now reads the tarball filename npm 8 actually writes for scoped packages. (#7933)

• Four block templates now say what they show and when to use them. (#7963)
• BottomSheetSwitcher templates describe the new per-step native dialogs. (#7720)
• The CommandPaletteItem showcase describes its rendered command and shortcut rows. (#7967)
• Lab ListInput showcase blocks are discoverable as templates. (#7953)
• Six guide titles now use plainer, consistent sentence case without changing their routes. (#7934)

Butter, Gothic, Matcha, Stone, and Y2K move their maintained light and dark themes to reviewed named palette stops. Public compatibility palette objects and metadata stay available, and apps can preserve the previous appearance by overriding the affected color, syntax, shadow, and component tokens. The CLI templates ship the same mappings. (#7669, #7670, #7671, #7672, #7675)

Thanks to everyone who contributed to this release:

@cixzhang @ernestt @HelloOjasMutreja @imdreamrunner @josephfarina @rubyycheung @vjeux

Full Changelog: https://github.com/facebook/astryx/compare/v0.7.3...v0.7.4

• #4264 94e0985 Thanks @chrispezza! - Fixes a layout shift where the table of contents could be painted at the start of the content area and then jump to the end when a page's HTML arrived in several chunks

• #4285 6f22edd Thanks @tunetheweb! - Improves hero image loading by adding fetchpriority="high" hint for browsers

Note: This is an alpha release. Please file new issues for any bugs you find in it.

This release is published to npm under the alpha tag and can be installed via npm install electron@alpha, or npm install electron@46.0.0-alpha.1.

• Changed heap profiling in contentTracing recordings to now use a perfetto heap-profiling data source. #53349 ^{(Also in 45)}
• child.kill() on utilityProcess now sends SIGTERM on POSIX like child_process.kill() and no longer force-kills a child that handles the signal. #53992
• Removed the deprecated synchronous safeStorage.isEncryptionAvailable(), safeStorage.encryptString() and safeStorage.decryptString(); use isAsyncEncryptionAvailable(), encryptStringAsync() and decryptStringAsync() instead. #53662
• Removed the events, timers and url modules and the Buffer, setImmediate and clearImmediate globals from sandboxed preload scripts; use a polyfill. #53891
• webContents.capturePage(), the offscreen paint event and webContents.beginFrameSubscription() now return images with the page's device scale factor, so image.getSize() is in DIPs rather than pixels on HiDPI displays. Also fixed nativeImage.toJPEG() returning an empty buffer for images without a 1x representation. #53813

• Added a globalShortcut registration-resolved event on Linux that reports whether the Wayland GlobalShortcuts portal actually bound a registered accelerator. #52224
• Added a Windows Error Reporting helper (electron_wer.dll, renamed to <app>_wer.dll alongside the executable) so crashReporter captures __fastfail and other crashes that bypass the in-process handler on Windows. #53802 ^{(Also in 45)}
• Added app shims on macOS to show windows under another app's Dock icon. #54932 ^{(Also in 44, 45)}
• Added app.canDeElevate() and app.relaunch({ deElevate }) on Windows. #54383
• Added experimental Widevine CDM support with bundled CDM lookup. #50046
• Added filtering options to session.registerPreloadScript - matches, excludeMatches, includeGlobs, excludeGlobs, matchOriginAsFallback. #54903 ^{(Also in 44, 45)}
• Added initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin(), and a trailing frame argument to the will-download and preconnect session events. #53685 ^{(Also in 43, 44, 45)}
• Added launch-failure reporting with systemErrorCode to the app child-process-gone event. #53946 ^{(Also in 44, 45)}
• Added support for Notification action buttons on Linux. #54516 ^{(Also in 44, 45)}
• Added the ELECTRON_DEBUG_DRAGGABLE_REGIONS environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. #53598 ^{(Also in 43, 44, 45)}
• Added the experimental protocol.registerSource() to serve a custom scheme from directories on disk without a JavaScript handler. #53220 ^{(Also in 44, 45)}
• Added Wayland restore-token support to desktopCapturer.getSources(). #54550

• <webview> without allowpopups also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. #53683 ^{(Also in 42, 43, 44, 45)}
• Added validation to protocol.registerSchemesAsPrivileged() to reject protocol names that do not conform to RFC 3986 URI scheme grammar. #52519 ^{(Also in 44, 45)}
• Backported fix from upstream Chromium for File System Access WSL path checks. #54676
• Changed the default trash implementation on KDE Plasma 6 to kioclient. #54092 ^{(Also in 44, 45)}
• DevTools zoom in/out now uses the same zoom steps as Chromium. #54349 ^{(Also in 44, 45)}
• File System Access permission requests and the file-system-access-restricted event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. #53666 ^{(Also in 42, 43, 44, 45)}
• Fixed --xdg-portal-required-version having no effect and a spurious portal warning being logged for file dialogs on Linux. #54227 ^{(Also in 43, 44, 45)}
• Fixed <select> dropdowns not rendering in offscreen windows on macOS. #53638 ^{(Also in 45)}
• Fixed a bug where content-protected windows could temporarily appear in screen captures during picture-in-picture state changes. #51267 ^{(Also in 45)}
• Fixed a child WebContentsView losing focus when its window is reactivated. #54378 ^{(Also in 43, 44, 45)}
• Fixed a crash in ses.clearData() after a DownloadItem was garbage collected. #54961
• Fixed a crash on Linux when process.env was written while another thread was reading the environment, and a memory leak when a worker thread exits. #53491 ^{(Also in 42, 43, 44, 45)}
• Fixed a crash on navigator.usb.requestDevice() in in-memory sessions. #54608 ^{(Also in 44, 45)}
• Fixed a crash when a WebAuthn request used a security key that required its PIN. #54355 ^{(Also in 43, 44, 45)}
• Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported chrome.webstorePrivate API. #53752 ^{(Also in 44, 45)}
• Fixed a crash when calling node:wasi functions in optimized code. #53262 ^{(Also in 42, 43, 44, 45)}
• Fixed a crash when calling setIgnoreMenuShortcuts() on DevTools. #54014 ^{(Also in 43, 44, 45)}
• Fixed a crash when calling utilityProcess.postMessage() after the utility process had exited. #53293 ^{(Also in 43, 44, 45)}
• Fixed a crash when creating a framed window on Wayland in environments where GTK could not initialize. #54365 ^{(Also in 43, 44, 45)}
• Fixed a crash when sending a DevTools protocol command with a non-string value for an optional string parameter via webContents.debugger. #54418 ^{(Also in 43, 44, 45)}
• Fixed a File System Access blocklist bypass on macOS. #54679
• Fixed a grey border around frameless windows on Linux WMs without compositing. #54376 ^{(Also in 43, 44, 45)}
• Fixed a Linux crash creating a window with a menu bar when GTK failed to load. #54777 ^{(Also in 43, 44, 45)}
• Fixed a main process crash when onSendHeaders observed Blob uploads. #55085 ^{(Also in 44, 45)}
• Fixed a main-process crash when an app called loadURL() again right after a load failed because the renderer process exited before the page committed. #53924 ^{(Also in 43, 44, 45)}
• Fixed a memory leak on Windows when app.getPreferredSystemLanguages() was called. #53853 ^{(Also in 43, 44, 45)}
• Fixed a pending read on a net.request chunked upload stream inside a protocol handler never settling when the request failed or was aborted. #53341 ^{(Also in 43, 44, 45)}
• Fixed a possible crash during process exit when vm.Script or vm contexts created in the main process had been garbage collected shortly before quitting. #53560 ^{(Also in 43, 44, 45)}
• Fixed a possible crash on Windows on ARM when powerMonitor is torn down. #54352 ^{(Also in 44, 45)}
• Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. #53574 ^{(Also in 42, 43, 44, 45)}
• Fixed a possible hang when pressing Esc while a <webview> is fullscreen. #53637 ^{(Also in 45)}
• Fixed a potential crash during application shutdown. #54520 ^{(Also in 45)}
• Fixed a potential crash when cleaning up download items. #54513 ^{(Also in 45)}
• Fixed a potential crash when closing detached DevTools. #54524 ^{(Also in 45)}
• Fixed a potential UAF in app.getPreferredSystemLanguages() on Windows. #53854 ^{(Also in 43, 44, 45)}
• Fixed a potential UAF when a select-usb-device handler destroys the requesting webContents. #53940 ^{(Also in 43, 44, 45)}
• Fixed a renderer crash calling image.toPNG() from a sandboxed preload script. #54488 ^{(Also in 43, 44, 45)}
• Fixed a renderer crash that could occur when printing from an iframe. #53751 ^{(Also in 43, 44, 45)}
• Fixed a renderer crash when a nodeIntegrationInSubFrames preload removed its own iframe from a promise, process.nextTick() or other Node.js callback. #53838
• Fixed a renderer crash when a ResizeObserver loop-limit error handler modified layout. #54281 ^{(Also in 42, 43, 44, 45)}
• Fixed a renderer crash when an iframe was removed right after loading with nodeIntegrationInSubFrames enabled and sandbox disabled, e.g. on pages that embed Meta Pixel. #53833 ^{(Also in 42, 43, 44, 45)}
• Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's. #53535 ^{(Also in 42, 43, 44, 45)}
• Fixed a spurious node_init error being logged when creating a ShadowRealm with Node.js integration enabled. #53546 ^{(Also in 44, 45)}
• Fixed a stale nativeTheme.shouldUseDarkColors after resetting themeSource. #54595 ^{(Also in 45)}
• Fixed a window's draggable regions applying under child WebContentsViews. #54936
• Fixed accent-color-changed on Windows reporting a colour that differed from systemPreferences.getAccentColor(). #54353 ^{(Also in 44, 45)}
• Fixed alignment of the text label and popup menu in the macOS save dialog. #53950 ^{(Also in 44, 45)}
• Fixed an "Invalid guestInstanceId" error when removing a loaded <webview> from the DOM. #54089 ^{(Also in 42, 43, 44, 45)}
• Fixed an intermittent crash (access violation) on Windows when an ASAR integrity violation is detected, so the process now exits with code 1 as intended. #53433 ^{(Also in 43, 44, 45)}
• Fixed an intermittent crash at startup on Linux caused by a race between Pango and the main thread initializing fontconfig. #53314 ^{(Also in 43, 44, 45)}
• Fixed an issue where an exception thrown by a property getter on an object passed through contextBridge was swallowed instead of being thrown back to the caller. #53289 ^{(Also in 43, 44, 45)}
• Fixed an issue where crashReporter.setUploadToServer() had no effect after crashReporter.start() was called. #54506 ^{(Also in 44, 45)}
• Fixed an issue where notifications would sometimes not appear from certain long domains on Windows. #54225 ^{(Also in 45)}
• Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. #53669 ^{(Also in 43, 44, 45)}
• Fixed an uncatchable TypeError in net.fetch when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. #53550 ^{(Also in 44, 45)}
• Fixed app.getGPUInfo('complete') stalling the GPU process for several seconds on some Windows systems. #53640 ^{(Also in 44, 45)}
• Fixed app.getLoginItemSettings() not finding login items on Windows when the executable path contains spaces. #54364 ^{(Also in 44, 45)}
• Fixed app.getRecentDocuments() omitting documents with non-ASCII paths on Windows. #54351 ^{(Also in 44, 45)}
• Fixed application crash after a large number of IPC messages from renderers. #53398 ^{(Also in 42, 43, 44, 45)}
• Fixed asar archives in non-ASCII folders failing to load on Linux. #54655 ^{(Also in 44, 45)}
• Fixed BrowserWindow.setOpacity(NaN) on macOS returning NaN from getOpacity() instead of treating it as fully opaque. #53413
• Fixed chrome.tabs.query() returning tab url and title to extensions without the tabs permission or host access, aligning with tabs.get. #52597 ^{(Also in 42, 43, 44, 45)}
• Fixed clipboard.read(), readText() and has() resolving seconds late on Linux while the app was idle. #54296 ^{(Also in 42, 43, 44, 45)}
• Fixed crashes in setDisplayMediaRequestHandler when the granted frame had been destroyed or another tab was granted by id. #53665 ^{(Also in 42, 43, 44, 45)}
• Fixed crashes in sharedTexture, service-worker ipcRenderer and utilityProcess.fork() caused by object lifetime bugs. #53259 ^{(Also in 43, 44, 45)}
• Fixed crashes in the main process when a webRequest.onBeforeRequest listener redirected a CORS preflight request, and when calling net.fetch() with a webRequest-permission extension loaded. #53294 ^{(Also in 43, 44, 45)}
• Fixed crashes when a webContents or parent window is destroyed while other APIs still reference it. #53257 ^{(Also in 43, 44, 45)}
• Fixed crashes when certain app event handlers call back into Electron synchronously. #53258 ^{(Also in 43, 44, 45)}
• Fixed Ctrl+Y not yanking text killed with Ctrl+K in text fields on macOS. #53635 ^{(Also in 44, 45)}
• Fixed default protocol client APIs falsely returning true on Windows. #53937 ^{(Also in 43, 44, 45)}
• Fixed desktopCapturer.getSources() leaving non-resizable windows resizable on macOS. #54360 ^{(Also in 43, 44, 45)}
• Fixed fs.constants.O_DIRECTORY, O_NOFOLLOW and O_DIRECT holding x86 values on Linux arm64 and armv7l, which made opening a directory fail with EINVAL, and made require('trace_events') behave the same on cross-compiled builds as on native ones. #53316 ^{(Also in 42, 43, 44, 45)}
• Fixed fs.rmSync failing to remove read-only files on Windows. #54180 ^{(Also in 42, 43, 44, 45)}
• Fixed GDK_BACKEND leaking into processes spawned by Electron apps on Linux. #54379 ^{(Also in 43, 44, 45)}
• Fixed GPU shaders compiled by Skia not being cached between launches. #54113 ^{(Also in 44, 45)}
• Fixed handling of malformed asar archives whose size fields do not match the file length. #55171 ^{(Also in 43, 44, 45)}
• Fixed helper executables on macOS starting a second app instance when launched without a process type, for example through child_process.fork() with the runAsNode fuse disabled; fork() now throws in that configuration. #53831 ^{(Also in 44, 45)}
• Fixed hidden windows continuing to render at full frame rate after setBackgroundThrottling(false) followed by setBackgroundThrottling(true). #54311 ^{(Also in 44, 45)}
• Fixed inconsistent handling of asar archive paths between the main process and child processes. #55173 ^{(Also in 43, 44, 45)}
• Fixed interrupted macOS updates leaving a broken app behind. #54842 ^{(Also in 44, 45)}
• Fixed link-opened windows not using the opener's session and webPreferences. #55030 ^{(Also in 42, 43, 44, 45)}
• Fixed main process crashes when navigating to http://accessibility/ or http://devtools/, when using the LanguageModel API from a Worker with a local AI handler registered, when an extension background page used navigator.mediaDevices, and when calling SerialPort.forget() for a disconnected device. #53305 ^{(Also in 43, 44, 45)}
• Fixed MV3 extension events not arriving to background service workers. #55146 ^{(Also in 43, 44, 45)}
• Fixed native addons deriving from node::ObjectWrap aborting during garbage collection on Node.js 24.19.0 and later. #53390 ^{(Also in 42, 43, 44, 45)}
• Fixed net.fetch and session.fetch failing permanently with net::ERR_FAILED after the Network Service process restarts. #54902 ^{(Also in 42, 43, 44, 45)}
• Fixed net.fetch() / net.request() spending seconds of main-process time buffering large streamed request bodies. #53858 ^{(Also in 44, 45)}
• Fixed non-network Web Worker requests (such as file:// and custom schemes) bypassing protocol.handle() and webRequest handlers. #55119
• Fixed pointerLock permission requests from in-process iframes reporting the parent frame instead of the requesting frame. #54432 ^{(Also in 42, 43, 44, 45)}
• Fixed process.nextTick and promise callbacks queued in protocol/webRequest handlers running at the wrong time. #54292 ^{(Also in 45)}
• Fixed protocol.registerSource schemes not applying the same fetch rules as protocol.handle schemes. #55172 ^{(Also in 44, 45)}
• Fixed ready-to-show never firing for some hidden windows on Windows and Linux. #54090 ^{(Also in 43, 44, 45)}
• Fixed renderer crashes during garbage collection inside ShadowRealms. #54840 ^{(Also in 44, 45)}
• Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe. #53656 ^{(Also in 42, 43, 44, 45)}
• Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host. #55028 ^{(Also in 42, 43, 44, 45)}
• Fixed setContentProtection(true) having no effect in Windows remote sessions. #54492 ^{(Also in 44, 45)}
• Fixed setIgnoreMouseEvents() taking effect late on X11. #54487 ^{(Also in 43, 44, 45)}
• Fixed setIgnoreMouseEvents(true) being undone by the next resize on X11. #54375 ^{(Also in 43, 44, 45)}
  • Added setIgnoreMouseEvents support on Wayland.
• Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. #51806 ^{(Also in 43, 44, 45)}
• Fixed several object lifetime issues in Debugger, Menu, Tray, Notification, globalShortcut, utilityProcess, ServiceWorkerMain, WebFrameMain, webFrame, sharedTexture, systemPreferences, netLog, MessagePortMain, net.request and shell.openPath(). #53738 ^{(Also in 44, 45)}
• Fixed shell.showItemInFolder() on Linux for paths containing #, ? or % when the file manager is reached over D-Bus. #54350 ^{(Also in 44, 45)}
• Fixed the default action label on Linux notifications not being localized. #54366 ^{(Also in 43, 44, 45)}
• Fixed the GPU process crash-looping on Windows when the sandbox cannot read the install folder; the folder is now reported instead. #54382 ^{(Also in 43, 44, 45)}
• Fixed the PDF viewer failing to save an edited PDF with NotAllowedError: Third party iframes are not allowed to show a file picker. #53313 ^{(Also in 43, 44, 45)}
• Fixed the tray context menu not working for snap-confined apps because AppArmor blocked the /org/chromium/DbusMenu path. #54027 ^{(Also in 44, 45)}
• Fixed the zoom level resetting on file: and other host-less pages after a location.hash change. #54381 ^{(Also in 43, 44, 45)}
• Fixed Tray icons not appearing when running inside Flatpak or Snap sandboxes on Linux. #53641 ^{(Also in 44, 45)}
• Fixed typing not working after closing an alert() or confirm() on Windows. #54380 ^{(Also in 43, 44, 45)}
• Fixed utilityProcess dropping messages posted with process.parentPort.postMessage() right before the process exits. #54924 ^{(Also in 42, 43, 45)}
• Fixed utilityProcess dropping stdout/stderr output that the child wrote immediately before exiting. #54262 ^{(Also in 42, 43, 44, 45)}
• Fixed V8 code caching for https scripts loaded by file:// and custom-scheme pages. #53676 ^{(Also in 44, 45)}
• Fixed visual zoom limits resetting on navigation and not applying to webviews. #54373 ^{(Also in 43, 44, 45)}
• Fixed WebAssembly modules loaded from the code cache crashing or throwing RuntimeError: unreachable after updating between certain patch releases. #54234 ^{(Also in 42, 43, 44, 45)}
• Fixed webContents emitting unresponsive right after the system wakes from sleep on Windows, and emitting responsive when a hung window was hidden rather than when it recovered. #53529 ^{(Also in 44, 45)}
• Fixed webContents.capturePage() on offscreen windows returning an image resampled to the display's scale factor instead of rendered at the window's offscreen.deviceScaleFactor. #53810 ^{(Also in 43, 44, 45)}
• Fixed webContents.executeJavaScript() with userGesture set not granting browser-side user activation, which could make activation-gated APIs fail. #54923 ^{(Also in 45)}
• Fixed webContents.on(), removeListener() and removeAllListeners() throwing "Object has been destroyed" for console-message listeners after the WebContents was destroyed. #53493 ^{(Also in 42, 43, 44, 45)}
• Fixed webview.findInPage() hanging when the host page also has an iframe. #54508 ^{(Also in 43, 44, 45)}
• Fixed win.isFullScreen() being stale in fullscreen events on Windows. #54990 ^{(Also in 44, 45)}
• Fixed win.setEnabled(false) and modal child windows not blocking input on Wayland. #54427 ^{(Also in 43, 44, 45)}
• Fixed Window Controls Overlay CSS environment variables and navigator.windowControlsOverlay not being populated for WebContentsViews in a BaseWindow. #53639 ^{(Also in 44, 45)}
• Fixed window state not being persisted when a window entered or left fullscreen, or was maximized or unmaximized, without also being moved or resized. #53566 ^{(Also in 44, 45)}
• Fixed Windows tray icons that lost their tooltip when explorer restarted. #54624
• Fixed zoom in/out getting stuck after zooming past the 25%-500% range. #54374 ^{(Also in 43, 44, 45)}
  • Fixed setVisualZoomLevelLimits() shrinking pages when the minimum is under 1.
• getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents. #53687 ^{(Also in 42, 43, 44, 45)}
• Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame. #53684 ^{(Also in 42, 43, 44, 45)}
• nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes. #53686 ^{(Also in 42, 43, 44, 45)}
• openExternal permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. #53682 ^{(Also in 42, 43, 44, 45)}
• pointerLock and keyboardLock permission requests now report the requesting frame, and execCommand('paste') requires user activation in the frame that calls it. #53664 ^{(Also in 42, 43, 44, 45)}
• Window geometry APIs now reject non-finite and out-of-range values. #54216

• Fixed BaseWindow.setBounds() throwing when given a partial bounds object. #54333
  • Improved the performance of app.getName(), app.name, app.getVersion() and app.getAppPath().
• Fixed the app becoming unresponsive when a page has a very large number of app-region draggable elements. #53595 ^{(Also in 43, 44, 45)}
• Improved cold-launch time on macOS by prefetching Electron's framework files. #54515 ^{(Also in 45)}
• Improved the performance of APIs that return rectangles, sizes, points and display objects. #54207 ^{(Also in 44, 45)}
• Improved the performance of building and showing menus. #53876
• Improved the performance of fs operations and require() on files inside asar archives. #53852 ^{(Also in 44, 45)}
• Improved the performance of session.getUserAgent(). #54206 ^{(Also in 44, 45)}
• Improved throughput of responses that protocol.handle handlers return straight from net.fetch. #52953 ^{(Also in 44, 45)}
• Made sandboxed renderers without a preload script start faster. #53972
• Reduced sandboxed renderer startup work for preload scripts that do not use Buffer. #53855 ^{(Also in 45)}
• Reduced the cost of calling native methods and properties on BrowserWindow, BaseWindow, WebContents, WebFrameMain, Session and View from JavaScript. #54331 ^{(Also in 45)}

• Deprecated the synchronous safeStorage.isEncryptionAvailable(), safeStorage.encryptString() and safeStorage.decryptString() in favor of isAsyncEncryptionAvailable(), encryptStringAsync() and decryptStringAsync(). #53670 ^{(Also in 45)}
• Electron's internal JavaScript bundles are no longer listed in require('module').builtinModules or loadable through process.getBuiltinModule(). #53547 ^{(Also in 45)}
• Made sandboxed preload scripts start faster; Electron no longer evaluates a JavaScript bundle of its own in sandboxed renderers unless webviewTag is enabled. #53974
• Refactored mouse forwarding on Windows to fix setIgnoreMouseEvents(true, { forward: true }) related issues. #52633 ^{(Also in 44, 45)}
• Removed the no-op enableWebSQL web preference from the documentation and TypeScript definitions. #54229
• Updated Chromium to 158.0.8114.0. #55143
• Updated Node.js to v24.22.1. #55164

• Documentation changes: #54300, #54587, #54739

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

• v16.4.2
• [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
• [lts-active] test: Pin react-virtualized (#100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
• [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Huge thanks to @mischnic, @lukesandberg, @acdlite, @eps1lon, and @sokra for helping!

• 50c15e7: Fixed .breadcrumb link styles applying to the items of a dropdown placed inside it.
• 2bdbab3: Fixed dark mode contrast of .text-muted and other muted theme color utilities with a lighter --tblr-muted value.
• 1745d1f: Fixed the .flag size classes, which were stretched to one height inside flex containers because the height came from aspect-ratio.
• db649f4: Fixed .form-check-label stretching the clickable area of a checkbox or radio across the whole row.
• f076113: Fixed the arrow position and the room kept for it in .form-select-sm and .form-select-lg.
• 0d2e253: Fixed .modal-lg and .modal-xl falling back to the default width in viewports below the lg and xl breakpoints.
• 5d5186e: Fixed Modal and Offcanvas not returning focus to the element that opened them when closed.
• e069052: Fixed .page-text in pagination using the body font size instead of --tblr-pagination-font-size, including pagination-sm and pagination-lg.
• ac8eb82: Fixed ApexCharts demos and Dropzone previews to respect prefers-reduced-motion, with a shared prefersReducedMotion() helper.
• 8336b33: Added a focus ring to .card-body-scrollable and .table-responsive so a scrollable region that is focused with the keyboard is visible.
• cf3ceaa: Fixed the native clear button missing from .form-control search inputs in Chrome and Safari.
• 73392da: Fixed .sortable-drag tilting the dragged element itself in native drag mode, which broke the drag.
• c9e9b9b: Fixed the uneven .table-bordered grid in the dark theme by using the opaque border color.
• f1a49aa: Fixed .text-bg-* and .progress-bar hard-coding white text instead of reading the --tblr-*-fg tokens.
• 3eaeb74: Fixed the Tom Select focus ring leaving the wrapper border visible at the corners.
• 0df5946: Fixed the Tom Select focus ring flashing black before it fades in.
• 7ee278f: Fixed the square start corners of a Tom Select that opens an .input-group.
• 01f6a6c: Fixed the Tom Select dropdown text growing to the mobile font size on phones.
• fa4c175: Fixed the bright dividers before the remove button of Tom Select chips in the dark theme.

• 76b309f: Fixed the unnamed search input in the AdvancedTable demo by adding an aria-label.
• 74f6193: Fixed the heading order on the dashboard and other preview pages so no heading level is skipped.
• 041d4e9: Added an accessible name to the split dropdown toggle and the icon-only button demos.
• 1dfe93d: Fixed the missing accessible name on the invalid state input in the form elements demo by adding aria-label.
• 2225064: Fixed the select all checkbox in the Invoices table on the tables preview page.
• ae7cd30: Added aria-label to the row checkboxes in the invoices, tasks and advanced table demos and the input group checkbox and radio.
• ac6615c: Fixed the page header in DefaultLayout so it sits inside the <main> landmark.
• fcf5276: Added an ariaLabel prop to Pagination and gave each pagination on a page its own name.
• 276c904: Added an ariaLabel prop to Range and named the noUiSlider handles on the form elements pages.
• 6acc5c5: Fixed unlabeled <select> elements on the form demo pages and added an ariaLabel prop to the Select component.
• c15dac2: Added hidden text to empty <th> cells in the Table, AdvancedTable, TopDeals and Invoices demos and the tour page.
• 9beef3a: Updated the demo Toast to use role="status" and aria-live="polite" by default, with an urgent prop for alert.
• c3ae0ed: Fixed the height of the Traffic summary chart on the dashboard page.

• Reduce repeated scans when concatenating imported modules. (by @xiaoxiaojx in #22865)

• Avoid allocating CSS module sets for single-group chunks. (by @xiaoxiaojx in #22866)

• Return the value of every module type loaded with importModule(). (by @alexander-akait in #22869)

• Fix storage GC deleting nothing when one pending object is still referenced #12276 (PR: #12269)
• Fix objects GC stopping file deletion when one file still has a child row #12277 (PR: #12269)
• Fix file restore leaving its storage objects marked for deletion #12278 (PR: #12269)
• Fix backend workers staying parked forever when nested calls take the same concurrency limits #12279 (PR: #12269)
• Fix one profile's activity blocking the audit events of every other profile #12280 (PR: #12269)
• Fix storage garbage collection blocking database vacuum during long deletions #12396 (PR: #12397)
• Fix saving a version taking seconds and the version quota never counting saved versions #12404 (PR: #12405)
• Fix file_change accumulating revisions that the objects GC never collects #12418 (PR: #12419)

• Add a graceful instance drain through the /readyz endpoint #12281 (PR: #12269)
• Add an accumulated queue gauge to the CLIMIT metrics #12282 (PR: #12269)
• Expose the backend log events as a metric by logger and level #12312 (PR: #12313)