feat: deprecate <webview>.getWebContents()

docs/api/breaking-changes.md

@@ -59,6 +59,19 @@ these kinds of objects will throw a 'could not be cloned' error.
 
 [SCA]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm
 
+### `<webview>.getWebContents()`
+
+This API is implemented using the `remote` module, which has both performance
+and security implications. Therefore its usage should be explicit.
+
+```js
+// Deprecated
+webview.getWebContents()
+// Replace with
+const { remote } = require('electron')
+remote.webContents.fromId(webview.getWebContentsId())
+```
+
 ## Planned Breaking API Changes (7.0)
 
 ### Node Headers URL

docs/api/web-contents.md

@@ -1393,11 +1393,13 @@ An example of showing devtools in a `<webview>` tag:
   <webview id="browser" src="https://github.com"></webview>
   <webview id="devtools"></webview>
   <script>
+    const { webContents } = require('electron').remote
     const browserView = document.getElementById('browser')
     const devtoolsView = document.getElementById('devtools')
     browserView.addEventListener('dom-ready', () => {
-      const browser = browserView.getWebContents()
-      browser.setDevToolsWebContents(devtoolsView.getWebContents())
+      const browser = webContents.fromId(browserView.getWebContentsId())
+      const devtools = webContents.fromId(devtoolsView.getWebContentsId())
+      browser.setDevToolsWebContents(devtools)
       browser.openDevTools()
     })
   </script>

docs/api/webview-tag.md

@@ -648,7 +648,7 @@ Sets the maximum and minimum layout-based (i.e. non-visual) zoom level.
 
 Shows pop-up dictionary that searches the selected word on the page.
 
-### `<webview>.getWebContents()`
+### `<webview>.getWebContents()` _Deprecated_
 
 Returns [`WebContents`](web-contents.md) - The web contents associated with
 this `webview`.

lib/renderer/web-view/web-view-impl.ts

@@ -238,6 +238,8 @@ export const setupMethods = (WebViewElement: typeof ElectronInternal.WebViewElem
     return remote.getGuestWebContents(internal.guestInstanceId!)
   }
 
+  electron.deprecate.moveAPI(WebViewElement.prototype.getWebContents, 'webview.getWebContents()', 'remote.webContents.fromId(webview.getWebContentsId())')
+
   // Focusing the webview should move page focus to the underlying iframe.
   WebViewElement.prototype.focus = function () {
     this.contentWindow.focus()