electron_30-bin: mark as insecure because it's EOL,...

      # We also need enable_widevine_cdm_component to be false. Unfortunately it isn't exposed as gn

      # flag (declare_args) so we simply hardcode it to false.

      ./patches/widevine-disable-auto-download-allow-bundle.patch

    ] ++ lib.optionals (versionRange "125" "126") [

      # Fix building M125 with ninja 1.12. Not needed for M126+.

      # https://issues.chromium.org/issues/336911498

      # https://chromium-review.googlesource.com/c/chromium/src/+/5487538

      (githubPatch {

        commit = "a976cb05b4024b7a6452d1541378d718cdfe33e6";

        hash = "sha256-K2PSeJAvhGH2/Yp63/4mJ85NyqXqDDkMWY+ptrpgmOI=";

      })

    ] ++ lib.optionals (versionRange "127" "128") [

      # Fix missing chrome/browser/ui/webui_name_variants.h dependency

      # and ninja 1.12 compat in M127.

      # Chromium reads initial_preferences from its own executable directory

      # This patch modifies it to read /etc/chromium/initial_preferences

      ./patches/chromium-initial-prefs.patch

    ] ++ lib.optionals (versionRange "120" "126") [

      # Partial revert to build M120+ with LLVM 17:

      # https://github.com/chromium/chromium/commit/02b6456643700771597c00741937e22068b0f956

      # https://github.com/chromium/chromium/commit/69736ffe943ff996d4a88d15eb30103a8c854e29

      ./patches/chromium-120-llvm-17.patch

    ] ++ lib.optionals (chromiumVersionAtLeast "126") [

      # Rebased variant of patch right above to build M126+ with LLVM 17.

      # Rebased variant of patch to build M126+ with LLVM 17.

      # staging-next will bump LLVM to 18, so we will be able to drop this soon.

      ./patches/chromium-126-llvm-17.patch

    ] ++ lib.optionals (versionRange "121" "126") [

      # M121 is the first version to require the new rust toolchain.

    ] ++ lib.optionals (versionRange "126" "129") [

      # Partial revert of https://github.com/chromium/chromium/commit/3687976b0c6d36cf4157419a24a39f6770098d61

      # allowing us to use our rustc and our clang.

      ./patches/chromium-121-rust.patch

    ] ++ lib.optionals (versionRange "126" "129") [

      # Rebased variant of patch right above to build M126+ with our rust and our clang.

      ./patches/chromium-126-rust.patch

    ] ++ lib.optionals (chromiumVersionAtLeast "129") [

diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn

index de1cd6e..bb5700b 100644

--- a/build/config/compiler/BUILD.gn

+++ b/build/config/compiler/BUILD.gn

@@ -616,24 +616,6 @@ config("compiler") {

       }

     }

-    # TODO(crbug.com/1488374): This causes binary size growth and potentially

-    # other problems.

-    # TODO(crbug.com/1491036): This isn't supported by Cronet's mainline llvm version.

-    if (default_toolchain != "//build/toolchain/cros:target" &&

-        !llvm_android_mainline) {

-      cflags += [

-        "-mllvm",

-        "-split-threshold-for-reg-with-hint=0",

-      ]

-      if (use_thin_lto && is_a_target_toolchain) {

-        if (is_win) {

-          ldflags += [ "-mllvm:-split-threshold-for-reg-with-hint=0" ]

-        } else {

-          ldflags += [ "-Wl,-mllvm,-split-threshold-for-reg-with-hint=0" ]

-        }

-      }

-    }

-

     # TODO(crbug.com/1235145): Investigate why/if this should be needed.

     if (is_win) {

       cflags += [ "/clang:-ffp-contract=off" ]

--- a/build/config/compiler/BUILD.gn

+++ b/build/config/compiler/BUILD.gn

@@ -1629,16 +1629,6 @@

     configs += [ "//build/config/c++:runtime_library" ]

   }

-  # Rust and C++ both provide intrinsics for LLVM to call for math operations. We

-  # want to use the C++ intrinsics, not the ones in the Rust compiler_builtins

-  # library. The Rust symbols are marked as weak, so that they can be replaced by

-  # the C++ symbols. This config ensures the C++ symbols exist and are strong in

-  # order to cause that replacement to occur by explicitly linking in clang's

-  # compiler-rt library.

-  if (is_clang && toolchain_has_rust) {

-    configs += [ "//build/config/clang:compiler_builtins" ]

-  }

-

   # TODO(crbug.com/830987): Come up with a better name for is POSIX + Fuchsia

   # configuration.

   if (is_posix || is_fuchsia) {

      ++ optionals (versionOlder version "19.0.0") [ "i686-linux" ];

    sourceProvenance = with sourceTypes; [ binaryNativeCode ];

    # https://www.electronjs.org/docs/latest/tutorial/electron-timelines

    knownVulnerabilities = optional (versionOlder version "30.0.0") "Electron version ${version} is EOL";

    knownVulnerabilities = optional (versionOlder version "31.0.0") "Electron version ${version} is EOL";

  };

  fetcher = vers: tag: hash: fetchurl {

  src = null;

  patches = base.patches ++ lib.optional (lib.versionOlder info.version "30")

    (substituteAll {

      # disable a component that requires CIPD blobs

      name = "disable-screen-ai.patch";

      src = ./disable-screen-ai.patch;

      inherit (info) version;

    })

  ;

  patches = base.patches;

  unpackPhase = ''

    runHook preUnpack

    dawn_use_built_dxc = false;

    v8_enable_private_mapping_fork_optimization = true;

    v8_expose_public_symbols = true;

  } // lib.optionalAttrs (lib.versionOlder info.version "31") {

    use_perfetto_client_library = false;

  } // lib.optionalAttrs (lib.versionAtLeast info.version "31") {

    enable_dangling_raw_ptr_feature_flag = false;

    clang_unsafe_buffers_paths = "";

    enterprise_cloud_content_analysis = false;