fix: improve asar archive path handling - #55185

Electron 43.8.4 updates its embedded Node.js to the v24.22.1 security
release (electron/electron#55161). The app and Setup's portable runtime now
run the same Node.

Electron 43.8.4 also fixes:
- a macOS File System Access blocklist bypass (electron/electron#54677);
- further blocklist gaps (electron/electron#55331);
- asar handling (electron/electron#55179, electron/electron#55185);
- tzdata, updated to 2026e (electron/electron#55336).

OpenSSL 3.5.9 reaches only Setup's runtime, because Electron's Node uses
BoringSSL.

- Every Electron pin moves from 43.8.3 to 43.8.4: package.json, the
  lockfile, the three release input profiles, the Windows pin constant, the
  linux-inputs hash in the AppImage and DEB contracts, tests and docs. ABI
  stays 148.
- The package's checksums.json matches the official SHASUMS256.txt (75/75),
  and #363 enforces it at build time. The binary, releases.json and
  Electron's DEPS all report Node 24.22.1 with ABI 148. src/api/hooks.cc is
  unchanged since Node 24.22.0, so the #135 fix still comes from upstream
  Node.
- Electron 43.8.4's Linux zips store most files as 0666 or 0777, and so do
  44.10.0's and 45.1.0's; the packager keeps stored modes. The Linux thin-app
  builder now clears group and other write on Electron's extracted files,
  never through a symlink. This restores 43.8.3's modes exactly.
- The AppImage's final verifier now refuses any regular file other than the
  sandbox that isn't 0644 or 0755. The DEB's verifier already did.

Follow-up: #378 (mode gates in the thin-folder verifiers).

Closes #371

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 9e7ec7a7-8690-49e5-9d55-492fedc3027a

##### [v44.10.1](https://github.com/electron/electron/releases/tag/v44.10.1)

### Release Notes for v44.10.1

#### Fixes

- Fixed DevTools "Save" prompting for a location every time instead of reusing the previously chosen file. [#55484](electron/electron#55484)
  - Fixed DevTools "Save As" using the old file and Linux cancels treated as saved.
- Fixed `webContents.adjustSelection()` ignoring the `end` option. [#55461](electron/electron#55461) <sup>(Also in [45](electron/electron#55462), [46](https://github.com/electron/electron/pull/55463))</sup>

#### Performance Improvements

- Improved performance of `net.fetch()` requests without a body. [#55445](electron/electron#55445) <sup>(Also in [43](electron/electron#55447), [45](electron/electron#55446), [46](https://github.com/electron/electron/pull/55444))</sup>
- Improved performance of repeated `net.fetch()` calls for `file:` URLs. [#55458](electron/electron#55458) <sup>(Also in [45](electron/electron#55459), [46](https://github.com/electron/electron/pull/55457))</sup>

#### Other Changes

- Backported fixes from upstream Chromium, Dawn, Skia and V8. [#55492](electron/electron#55492)
##### [v44.10.0](https://github.com/electron/electron/releases/tag/v44.10.0)

### Release Notes for v44.10.0

#### Features

- Added filtering options to `session.registerPreloadScript` - `matches`, `excludeMatches`, `includeGlobs`, `excludeGlobs`, `matchOriginAsFallback`. [#55182](electron/electron#55182) <sup>(Also in [45](https://github.com/electron/electron/pull/55181))</sup>

#### Fixes

- Fixed a crash on Linux when a D-Bus method call was made on a disconnected bus. [#55290](electron/electron#55290) <sup>(Also in [45](electron/electron#55292), [46](https://github.com/electron/electron/pull/55289))</sup>
- Fixed a main process crash when `onSendHeaders` observed Blob uploads. [#55168](electron/electron#55168) <sup>(Also in [45](https://github.com/electron/electron/pull/55169))</sup>
- Fixed `app.getLoginItemSettings()` not finding login items on Windows when the executable path contains spaces. [#55207](electron/electron#55207) <sup>(Also in [45](https://github.com/electron/electron/pull/54419))</sup>
- Fixed Europe/London and Europe/Dublin time zone names showing as "GMT+00:00" in winter by updating ICU to tzdata 2026e. [#55335](electron/electron#55335)
- Fixed File System Access blocklist gaps for `.git/hooks` writes and hypervisor UNC shares. [#55330](electron/electron#55330)
- Fixed handling of malformed asar archives whose size fields do not match the file length. [#55176](electron/electron#55176) <sup>(Also in [43](electron/electron#55179), [45](https://github.com/electron/electron/pull/55175))</sup>
- Fixed inconsistent handling of asar archive paths between the main process and child processes. [#55183](electron/electron#55183) <sup>(Also in [43](electron/electron#55185), [45](https://github.com/electron/electron/pull/55184))</sup>
- Fixed `Menu.popup()` on macOS sometimes not showing a menu after another closed. [#55325](electron/electron#55325) <sup>(Also in [45](electron/electron#55326), [46](https://github.com/electron/electron/pull/55324))</sup>
- Fixed MV3 extension events not arriving to background service workers. [#55152](electron/electron#55152) <sup>(Also in [43](electron/electron#55153), [45](https://github.com/electron/electron/pull/55154))</sup>
- Fixed paste hanging indefinitely on Linux X11 until the app was restarted. [#55327](electron/electron#55327)
- Fixed `protocol.registerSource` schemes not applying the same fetch rules as `protocol.handle` schemes. [#55177](electron/electron#55177) <sup>(Also in [45](https://github.com/electron/electron/pull/55178))</sup>
- Fixed `utilityProcess` not emitting an `exit` event when the app quit while the process was still launching. [#55273](electron/electron#55273) <sup>(Also in [43](electron/electron#55272), [45](electron/electron#55274), [46](https://github.com/electron/electron/pull/55264))</sup>

#### Other Changes

- Updated Chromium to 152.0.7977.169. [#55033](electron/electron#55033)
- Updated Node.js to v24.22.1. [#55162](electron/electron#55162)
##### [v44.9.3](https://github.com/electron/electron/releases/tag/v44.9.3)

### Release Notes for v44.9.3

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, PDFium, Skia and V8. [#55149](electron/electron#55149)
##### [v44.9.2](https://github.com/electron/electron/releases/tag/v44.9.2)

### Release Notes for v44.9.2
##### [v44.9.1](https://github.com/electron/electron/releases/tag/v44.9.1)

### Release Notes for v44.9.1

> \[!NOTE]
> This release contains the fix for <GHSA-jr5w-w6x2-84p9>, the mitigation for compromised eMudhra intermediate certificates
##### [v44.9.0](https://github.com/electron/electron/releases/tag/v44.9.0)

### Release Notes for v44.9.0

#### Features

- Added app shims on macOS to show windows under another app's Dock icon. [#55073](electron/electron#55073) <sup>(Also in [45](https://github.com/electron/electron/pull/55072))</sup>

#### Fixes

- Fixed link-opened windows not using the opener's session and `webPreferences`. [#55048](electron/electron#55048) <sup>(Also in [42](electron/electron#55050), [43](electron/electron#55049), [45](https://github.com/electron/electron/pull/55051))</sup>
- Fixed `setCertificateVerifyProc` occasionally not being applied to a request issued concurrently with the first request to a host. [#55046](electron/electron#55046) <sup>(Also in [42](electron/electron#55054), [43](electron/electron#55047), [45](https://github.com/electron/electron/pull/55045))</sup>
##### [v44.8.0](https://github.com/electron/electron/releases/tag/v44.8.0)

### Release Notes for v44.8.0

#### Features

- Added support for `Notification` action buttons on Linux. [#54890](electron/electron#54890) <sup>(Also in [45](https://github.com/electron/electron/pull/54889))</sup>

#### Fixes

- Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. [#54987](electron/electron#54987)
- Fixed `net.fetch` and `session.fetch` failing permanently with `net::ERR_FAILED` after the Network Service process restarts. [#54909](electron/electron#54909) <sup>(Also in [42](electron/electron#54925), [43](electron/electron#54908), [45](https://github.com/electron/electron/pull/54910))</sup>
- Fixed `utilityProcess` dropping messages posted with `process.parentPort.postMessage()` right before the process exits. [#54960](electron/electron#54960) <sup>(Also in [42](electron/electron#55000), [43](electron/electron#54962), [45](https://github.com/electron/electron/pull/54956))</sup>
- Fixed `win.isFullScreen()` being stale in fullscreen events on Windows. [#55009](electron/electron#55009) <sup>(Also in [45](https://github.com/electron/electron/pull/55008))</sup>

#### Other Changes

- Backported fixes from upstream Chromium and V8. [#55034](electron/electron#55034)
- Updated Chromium to 152.0.7977.167. [#54928](electron/electron#54928)
- Updated Node.js to v24.22.0. [#55004](electron/electron#55004)
##### [v44.7.2](https://github.com/electron/electron/releases/tag/v44.7.2)

### Release Notes for v44.7.2

#### Fixes

- Fixed an issue where clicks posted to a background app were dropped on macOS. [#54819](electron/electron#54819) <sup>(Also in [45](https://github.com/electron/electron/pull/54818))</sup>
- Fixed interrupted macOS updates leaving a broken app behind. [#54844](electron/electron#54844) <sup>(Also in [45](https://github.com/electron/electron/pull/54843))</sup>

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, PDFium and V8. [#54898](electron/electron#54898)

#### Documentation

- Documentation changes: [#54880](electron/electron#54880)
##### [v44.7.1](https://github.com/electron/electron/releases/tag/v44.7.1)

### Release Notes for v44.7.1

#### Fixes

- Fixed a crash when starting without an available display server on Linux. [#54794](electron/electron#54794) <sup>(Also in [45](https://github.com/electron/electron/pull/54781))</sup>
- Fixed a Linux crash creating a window with a menu bar when GTK failed to load. [#54859](electron/electron#54859) <sup>(Also in [45](https://github.com/electron/electron/pull/54846))</sup>
- Fixed a `WebContentsView` that was removed with `removeChildView()` and re-added with `addChildView()` staying hidden behind its sibling views on Linux. [#54798](electron/electron#54798)
- Fixed asar archives in non-ASCII folders failing to load on Linux. [#54849](electron/electron#54849) <sup>(Also in [45](https://github.com/electron/electron/pull/54848))</sup>
- Fixed renderer crashes during garbage collection inside ShadowRealms. [#54865](electron/electron#54865) <sup>(Also in [45](https://github.com/electron/electron/pull/54864))</sup>

#### Other Changes

- Refactored mouse forwarding on Windows to fix `setIgnoreMouseEvents(true, { forward: true })` related issues. [#54802](electron/electron#54802) <sup>(Also in [45](https://github.com/electron/electron/pull/54803))</sup>
- Updated Chromium to 152.0.7977.149. [#54085](electron/electron#54085)
##### [v44.7.0](https://github.com/electron/electron/releases/tag/v44.7.0)

### Release Notes for v44.7.0

#### Features

- The macOS `autoUpdater` now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. [#54204](electron/electron#54204)

#### Fixes

- Fixed an uncatchable TypeError in `net.fetch` when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. [#54672](electron/electron#54672)

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. [#54666](electron/electron#54666)
- Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. [#54657](electron/electron#54657)
##### [v44.6.0](https://github.com/electron/electron/releases/tag/v44.6.0)

### Release Notes for v44.6.0

#### Features

- Added the experimental `protocol.registerSource()` to serve a custom scheme from directories on disk without a JavaScript handler. [#54522](electron/electron#54522) <sup>(Also in [45](https://github.com/electron/electron/pull/54521))</sup>

#### Fixes

- Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. [#54596](electron/electron#54596)
- Fixed a crash on `navigator.usb.requestDevice()` in in-memory sessions. [#54616](electron/electron#54616) <sup>(Also in [45](https://github.com/electron/electron/pull/54615))</sup>
- Fixed `webview.findInPage()` hanging when the host page also has an iframe. [#54586](electron/electron#54586) <sup>(Also in [43](electron/electron#54584), [45](https://github.com/electron/electron/pull/54585))</sup>
- Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. [#54623](electron/electron#54623)

#### Documentation

- Documentation changes: [#54589](electron/electron#54589)