Update WPT

[workers-devprod]

This is an automated pull request for updating WPT in workerd.
The WPT update was triaged by an agent using the wpt-update skill (run).

WPT update: wpt-b875b21fd → wpt-2f17dec1f

• Old tag: wpt-b875b21fd (upstream b875b21fd9e6b688e37c10d1b6366cab7418f91e)
• New tag: wpt-2f17dec1f (upstream 2f17dec1f36194d1c236120fd38b3556be466072)
• Upstream comparison: https://github.com/web-platform-tests/wpt/compare/b875b21fd9e6b688e37c10d1b6366cab7418f91e...2f17dec1f36194d1c236120fd38b3556be466072.diff

Final verification: bazel test //src/wpt/... --test_size_filters= --nocache_test_results reports Build completed successfully and Executed 59 out of 59 tests: 59 tests pass. That covers the default and all-autogates variants plus the ESLint and TypeScript checks. tools/cross/format.py --check git and git diff --check are clean.

WPT patch changes

• patches/wpt/0001-disable-virtualenv-for-serve-command.patch was rebased. Upstream 9ee707c ("Install cryptography for commands that serve tests", #63036) added "requirements": ["requirements.txt"] to the serve entry of tools/serve/commands.json. After that change the patch no longer applied (CONTENT_DOES_NOT_MATCH_TARGET), and every WPT target failed during analysis.
  • tools/wpt/wpt.py asserts that a command with requirements or conditional_requirements uses a virtualenv. The rebased patch therefore removes the new key along with conditional_requirements and still sets "virtualenv": false.
  • The new requirement (cryptography) is only imported by fedcm/support/delegation-issuance.py, which no workerd WPT suite uses.
• No patches were added, removed or renamed. shared_deps.jsonc and the generated MODULE file are unchanged beyond the bump commit.

Suites

Added (4):

Suite	Classification	Reason
WebCryptoAPI/export-key-error-order.https.any.js	expectedFailures (4 subtests)	exportKey() and wrapKey() check extractable before checking export support. HKDF and PBKDF2 keys therefore throw InvalidAccessError (code 15) instead of NotSupportedError (code 9).
WebCryptoAPI/sharedarraybuffer.https.any.js	expectedFailures (4 subtests)	SubtleCrypto BufferSource arguments accept a Uint8Array backed by a SharedArrayBuffer instead of throwing TypeError. Raw SharedArrayBuffer arguments are already rejected, and those subtests pass.
fetch/api/basic/request-upload-421.any.js	expectedFailures (1 subtest), in both fetch/api and fetch/api-ts	The 421 retry subtest was moved out of request-upload.any.js, which stays fully disabled. fetch() does not retry a request after a 421 Misdirected Request response: the server reports "Request was sent 1 times. 1 connections were created." The test fails on an assertion and does not affect later tests.
fs/FileSystemBaseHandle-postMessage-insecure-context.https.window.js	disabledTests: true	Needs window.open(), postMessage and promise_setup. This matches the existing disabled FileSystemBaseHandle-postMessage-*.window.js siblings.

Removed / renamed: none in the mapped directories. The new interfaces/usb.idl, hid.idl and bluetooth*.idl replace webusb.idl, webhid.idl and web-bluetooth*.idl; nothing in workerd references either set. New .html files under dom/events, streams/transferable, encoding/streams/crashtests and fs/resources are not discovered as suites.

Expectations changed in existing suites

• url/IdnaTestV2.any.js: 7 new expectedFailures. Upstream 13748c3 ("Update IDNA Test JSON to Unicode 18.0.0") changed cases containing U+3E8AC and U+3F8CD from V7 (invalid) to valid ToASCII outputs. ada-url 4.0.0 ships IDNA 17.0.0 tables (external/ada-url+/ada.cpp) and still throws Invalid URL string. The names are written with \u escapes because two pairs differ only by precomposed versus conjoining Hangul jamo.
• Other changed upstream suites pass unchanged under their existing config:
  • digest/digest.https.any.js and digest.js dropped the transferBeforeCall vectors.
  • encoding/iso-2022-jp-decoder.any.js added decoder reset tests.
  • fetch/api/basic/gc.any.js added FormData GC tests.
  • url/url-setters-stripping.any.js added searchParams tests.
  • websockets/Create-blocked-port.any.js gained timeout=long.
  • streams/writable-streams/crashtests/garbage-collection.any.js added an abort-pending GC test.
• Default and all-autogates results were identical for every new entry.
• Disabled and omitted selectors were audited: no array-form disabled or omitted entries exist for any changed upstream suite, and request-upload.any.js stays whole-suite disabled.

Relevant source locations

• src/workerd/api/crypto/crypto.c++: SubtleCrypto::exportKey and wrapKey (JSG_REQUIRE(key.getExtractable(), DOMInvalidAccessError, ...) runs before key.impl->exportKey).
• src/workerd/jsg/jsvalue.c++: JsBufferSource (accepts views onto shared buffers); src/workerd/api/crypto/crypto.h (digest/encrypt take jsg::JsBufferSource).
• external/ada-url+/ada.cpp: IDNA 17.0.0 tables.

Proposed follow-ups (out of scope)

• WebCrypto export order: in exportKey() and wrapKey(), throw NotSupportedError for algorithms that cannot be exported (HKDF, PBKDF2) before the extractable check. This changes which error type is observable, so it may need a compatibility flag.
• WebCrypto shared buffers: reject SharedArrayBuffer-backed views in SubtleCrypto BufferSource arguments and dictionary members (they are not [AllowShared]). This is likely compat-flag gated.
• fetch 421 retry: retry once on a new connection when a request with a body gets a 421 response, per the Fetch HTTP-network-or-cache fetch algorithm.
• IDNA: update ada-url once it ships Unicode/IDNA 18 tables, then remove the IdnaTestV2.any.js expectations.

Skill update

.opencode/skills/wpt-update/SKILL.md now covers:

• where to find the old and new WPT archives in Bazel's repository cache after a patch failure;
• the wpt.py virtualenv/requirements assertion that constrains the serve patch;
• writing non-NFC subtest names with escapes;
• how to apply formatting fixes.

🤖 Generated with Claude Code

[clanky-the-clanker]

✅ Approved — No issues found. The rebased WPT patch, the dependency bump and the new expectation entries are consistent with each other.

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

✅ All checks passed

📋 Code Quality: ✅ LGTM

No issues found.

• Rebased patch: In patches/wpt/0001-disable-virtualenv-for-serve-command.patch, the hunk header (-4,18 +4,7) matches the hunk body. The patch removes requirements along with conditional_requirements and still sets "virtualenv": false. That is what wpt.py's virtualenv/requirements assertion requires.
• Dependency bump: freeze_version, sha256, strip_prefix and url match between build/deps/shared_deps.jsonc and the generated build/deps/gen/shared_deps.MODULE.bazel. The patch label changed from //:patches/... to @workerd//:patches/.... The root module is named workerd, so both labels resolve to the same file.
• WPT expectations: The new expectedFailures and disabledTests entries each have an explanatory comment. The request-upload-421 entry appears in both fetch/api-test.ts and fetch/api-test-ts.ts. The \u escapes in url-test.ts keep subtest names that are not in NFC exactly as upstream writes them.
• Not checked: These checks are static. The Bazel test results come from the pull request description and were not re-run here.

---

📝 Documentation: ✅ LGTM

The additions to .opencode/skills/wpt-update/SKILL.md are clear. They cover finding the WPT archives in Bazel's repository cache, the constraint the wpt.py assertion puts on the serve patch, escaping subtest names that are not in NFC, and applying formatting fixes. No issues found.

---

_{Reviewed commit: 20dc9dbb}

[ask-bonk]

Since last review: 1 resolved, 0 still open, 0 new.
LGTM!

---

_{Reviewed commit: 20dc9dbb · github run}