You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
new Request(url, { headers: <Proxy over a record> }) silently drops the headers #10274
new Request(url, { headers: <Proxy over a record> }) silently produces empty headers; bun/node produce the header. A Headers built directly from the same proxy is correct (that path is fixed in the PR referenced below), so only the Request init path is affected.
bun 1.3.14: request ["x-a=1"] — perry: request [].
Silently dropping headers is worse than throwing: a request just goes out without its authorization or content-type header.
Notes
js_headers_init_from_value (perry-stdlib fetch/headers.rs) handles a proxied record correctly once the record path accepts proxies. The Request path does not end up there with the proxy value, so the conversion happens somewhere else (request_ctor.rs reads init.headers and calls that helper; codegen also has a compile-time build_headers_from_object for literal inits in lower_call/options/). Worth checking which of the two runs for a dynamic (non-literal) headers value.
The faulty route was Request codegen: a dynamic headers expression inside literal RequestInit went directly to js_request_new as a Headers handle. It now reaches js_headers_init_from_value; literal headers retain their existing lowering. The compiled issue reproduction matches bun, and the new test fails on pristine 1cd160f3d and passes with the fix, including trapped authorization headers, dynamic records, and pair arrays. The PR also fixes #10270, references #10107, and includes the audit, benchmarks, and the unrelated runtime-suite failure reproduced on main.
Activity
proggeramlug commentedon Sep 15, 2026
Ready-for-review fix: #10280
The faulty route was Request codegen: a dynamic headers expression inside literal RequestInit went directly to
js_request_newas a Headers handle. It now reachesjs_headers_init_from_value; literal headers retain their existing lowering. The compiled issue reproduction matches bun, and the new test fails on pristine1cd160f3dand passes with the fix, including trapped authorization headers, dynamic records, and pair arrays. The PR also fixes #10270, references #10107, and includes the audit, benchmarks, and the unrelated runtime-suite failure reproduced on main.