From 571df20281a64524bcdbe30a7bd695abfb9f983a Mon Sep 17 00:00:00 2001 From: Workers DevProd Date: Fri, 16 Oct 2026 20:53:13 +0000 Subject: [PATCH 1/6] update WPT to latest version --- build/deps/gen/shared_deps.MODULE.bazel | 6 +++--- build/deps/shared_deps.jsonc | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/build/deps/gen/shared_deps.MODULE.bazel b/build/deps/gen/shared_deps.MODULE.bazel index d5b1dbc0017..42e4e2218af 100644 --- a/build/deps/gen/shared_deps.MODULE.bazel +++ b/build/deps/gen/shared_deps.MODULE.bazel @@ -117,9 +117,9 @@ http.archive( patches = [ "//:patches/wpt/0001-disable-virtualenv-for-serve-command.patch", ], - sha256 = "cbb50ece231cb0f8bd92f45ad9949407f9a0c8c8a5c6fa6fdaebe8fa09c93825", - strip_prefix = "wpt-b875b21fd", + sha256 = "e45f3ab903c74784ce5e41fc61f72200a0adf429f06203fe3e16bf2abeaa9431", + strip_prefix = "wpt-2f17dec1f", type = "tgz", - url = "https://github.com/cloudflare/workerd-tools/releases/download/wpt-b875b21fd/wpt-b875b21fd.tar.gz", + url = "https://github.com/cloudflare/workerd-tools/releases/download/wpt-2f17dec1f/wpt-2f17dec1f.tar.gz", ) use_repo(http, "wpt") diff --git a/build/deps/shared_deps.jsonc b/build/deps/shared_deps.jsonc index a1c5347a0e6..419888ee6f2 100644 --- a/build/deps/shared_deps.jsonc +++ b/build/deps/shared_deps.jsonc @@ -113,7 +113,7 @@ "repo": "workerd-tools", "file_regex": "wpt-.*.tar.gz", "build_file": "@workerd//:build/BUILD.wpt", - "freeze_version": "wpt-b875b21fd", + "freeze_version": "wpt-2f17dec1f", "patches": [ "//:patches/wpt/0001-disable-virtualenv-for-serve-command.patch" ] From 65e2d705a9b800ba5cd98c98daac81ddce39d6bb Mon Sep 17 00:00:00 2001 From: Workers DevProd Date: Fri, 16 Oct 2026 20:51:27 +0000 Subject: [PATCH 2/6] Rebase WPT serve virtualenv patch Upstream WPT commit 9ee707c850996c8d124809570c3ff855d67301b9 ("Install cryptography for commands that serve tests", #63036) added a "requirements" key to the serve entry in tools/serve/commands.json. The patch no longer applied, so every WPT target failed during analysis with CONTENT_DOES_NOT_MATCH_TARGET. tools/wpt/wpt.py asserts that a command declaring requirements uses a virtualenv, so the rebased patch removes the new key together with conditional_requirements. The new requirement (cryptography) is only used by fedcm handlers, which no workerd WPT suite exercises. Co-Authored-By: Claude Opus 5.5 --- patches/wpt/0001-disable-virtualenv-for-serve-command.patch | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/patches/wpt/0001-disable-virtualenv-for-serve-command.patch b/patches/wpt/0001-disable-virtualenv-for-serve-command.patch index 57a051aca15..201a07b902d 100644 --- a/patches/wpt/0001-disable-virtualenv-for-serve-command.patch +++ b/patches/wpt/0001-disable-virtualenv-for-serve-command.patch @@ -1,10 +1,11 @@ --- a/tools/serve/commands.json +++ b/tools/serve/commands.json -@@ -4,17 +4,7 @@ +@@ -4,18 +4,7 @@ "script": "run", "parser": "get_parser", "help": "Run wptserve server", - "virtualenv": true, +- "requirements": ["requirements.txt"], - "conditional_requirements": { - "commandline_flag": { - "webtransport_h3": [ From eaeb02e49f26ec58c310fa98c0f47792dcde0495 Mon Sep 17 00:00:00 2001 From: Workers DevProd Date: Fri, 16 Oct 2026 20:51:27 +0000 Subject: [PATCH 3/6] Configure WPT suites added upstream New suites from the WPT update: - WebCryptoAPI/export-key-error-order.https.any.js: exportKey() and wrapKey() check extractability before export support, so HKDF and PBKDF2 keys throw InvalidAccessError instead of NotSupportedError (src/workerd/api/crypto/crypto.c++). Marked as expected failures. - WebCryptoAPI/sharedarraybuffer.https.any.js: raw SharedArrayBuffer arguments are rejected, but views onto one are accepted instead of throwing TypeError. Marked as expected failures. - fetch/api/basic/request-upload-421.any.js: the 421 retry subtest moved out of request-upload.any.js, which stays disabled. fetch() does not retry on 421 Misdirected Request; expected failure in both fetch/api and fetch/api-ts configs. - fs/FileSystemBaseHandle-postMessage-insecure-context.https.window.js requires window.open() and postMessage, like its disabled siblings. Default and all-autogates variants behave identically. Co-Authored-By: Claude Opus 5.5 --- src/wpt/WebCryptoAPI-test.ts | 20 ++++++++++++++++++++ src/wpt/fetch/api-test-ts.ts | 7 +++++++ src/wpt/fetch/api-test.ts | 7 +++++++ src/wpt/fs-test.ts | 4 ++++ 4 files changed, 38 insertions(+) diff --git a/src/wpt/WebCryptoAPI-test.ts b/src/wpt/WebCryptoAPI-test.ts index 5c73cb9bf5f..b31c5c19a42 100644 --- a/src/wpt/WebCryptoAPI-test.ts +++ b/src/wpt/WebCryptoAPI-test.ts @@ -128,6 +128,16 @@ export default { 'encrypt_decrypt/rsa_oaep.https.any.js': {}, 'encrypt_decrypt/rsa_vectors.js': {}, + 'export-key-error-order.https.any.js': { + comment: + 'exportKey() and wrapKey() check extractable before export support, so HKDF and PBKDF2 keys throw InvalidAccessError instead of NotSupportedError', + expectedFailures: [ + 'exportKey() with a HKDF key throws NotSupportedError', + 'wrapKey() with a HKDF key throws NotSupportedError', + 'exportKey() with a PBKDF2 key throws NotSupportedError', + 'wrapKey() with a PBKDF2 key throws NotSupportedError', + ], + }, 'generateKey/algorithm_registry.js': {}, 'generateKey/failures.js': {}, 'generateKey/failures_AES-CBC.https.any.js': {}, @@ -439,6 +449,16 @@ export default { expectedFailures: true, }, 'serialization/x448.tentative.https.any.js': unsupported('X448'), + 'sharedarraybuffer.https.any.js': { + comment: + 'SubtleCrypto BufferSource arguments accept views backed by a SharedArrayBuffer instead of throwing TypeError', + expectedFailures: [ + 'digest() data is a Uint8Array(SharedArrayBuffer)', + 'encrypt() data is a Uint8Array(SharedArrayBuffer)', + 'encrypt() AesGcmParams.iv is a Uint8Array(SharedArrayBuffer)', + 'encrypt() AesGcmParams.additionalData is a Uint8Array(SharedArrayBuffer)', + ], + }, 'sign_verify/ecdsa.https.any.js': {}, 'sign_verify/ecdsa.js': supportFile, 'sign_verify/ecdsa_vectors.js': supportFile, diff --git a/src/wpt/fetch/api-test-ts.ts b/src/wpt/fetch/api-test-ts.ts index 506defe229a..444f81b5017 100644 --- a/src/wpt/fetch/api-test-ts.ts +++ b/src/wpt/fetch/api-test-ts.ts @@ -176,6 +176,13 @@ export default { comment: 'Referrer is not implemented', omittedTests: true, }, + 'basic/request-upload-421.any.js': { + comment: + 'fetch() does not retry a request on a 421 Misdirected Request response', + expectedFailures: [ + 'Fetch with POST with text body on 421 response should be retried once on new connection.', + ], + }, 'basic/request-upload.any.js': { comment: 'Appears to corrupt the state of workerd', disabledTests: true, diff --git a/src/wpt/fetch/api-test.ts b/src/wpt/fetch/api-test.ts index b1468a78f67..8893888ae70 100644 --- a/src/wpt/fetch/api-test.ts +++ b/src/wpt/fetch/api-test.ts @@ -173,6 +173,13 @@ export default { comment: 'Referrer is not implemented', omittedTests: true, }, + 'basic/request-upload-421.any.js': { + comment: + 'fetch() does not retry a request on a 421 Misdirected Request response', + expectedFailures: [ + 'Fetch with POST with text body on 421 response should be retried once on new connection.', + ], + }, 'basic/request-upload.any.js': { comment: 'Appears to corrupt the state of workerd', disabledTests: true, diff --git a/src/wpt/fs-test.ts b/src/wpt/fs-test.ts index 61a54599cc8..514efe4f85d 100644 --- a/src/wpt/fs-test.ts +++ b/src/wpt/fs-test.ts @@ -62,6 +62,10 @@ export default { comment: 'Frames are not implemented in workers', disabledTests: true, }, + 'FileSystemBaseHandle-postMessage-insecure-context.https.window.js': { + comment: 'window.open() and postMessage are not implemented in workers', + disabledTests: true, + }, 'FileSystemBaseHandle-postMessage-windows.https.window.js': { comment: 'postMessage is not implemented in workers', disabledTests: true, From 753336e3c692f69cf0a430feaf688722d78672f0 Mon Sep 17 00:00:00 2001 From: Workers DevProd Date: Fri, 16 Oct 2026 20:51:28 +0000 Subject: [PATCH 4/6] Expect IdnaTestV2 failures for Unicode 18 code points Upstream WPT commit 13748c36fdf9dd77cd0b34dd6b244256b365ea60 updated url/resources/IdnaTestV2.json to Unicode 18.0.0. Seven ToASCII cases contain U+3E8AC or U+3F8CD, which were previously unassigned (V7) and now map to valid labels. ada-url 4.0.0 ships IDNA 17.0.0 tables and still rejects them, so mark them as expected failures until ada-url updates its tables. The names are written with escapes because two cases differ only by precomposed versus conjoining Hangul jamo. Co-Authored-By: Claude Opus 5.5 --- src/wpt/url-test.ts | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/src/wpt/url-test.ts b/src/wpt/url-test.ts index 153ffa885f6..d1a7170ee29 100644 --- a/src/wpt/url-test.ts +++ b/src/wpt/url-test.ts @@ -6,7 +6,19 @@ import { type TestRunnerConfig } from 'harness/harness'; export default { 'IdnaTestV2-removed.any.js': {}, - 'IdnaTestV2.any.js': {}, + 'IdnaTestV2.any.js': { + comment: + 'ada-url uses IDNA 17.0.0 tables, which do not include code points assigned in Unicode 18.0.0', + expectedFailures: [ + 'ToASCII("\u2D0D\u{3F8CD}\uA868\u05AE.\u2D1E")', + 'ToASCII("\u10AD\u{3F8CD}\uA868\u05AE.\u10BE")', + 'ToASCII("\u10AD\u{3F8CD}\uA868\u05AE.\u2D1E")', + 'ToASCII("\u{3E8AC}\u3002\u0729\u3002\uCBD95")', + 'ToASCII("\u{3E8AC}\u3002\u0729\u3002\u110D\u1173\u11AC5")', + 'ToASCII("\u{3E8AC}.\u0729.\uCBD95")', + 'ToASCII("\u{3E8AC}.\u0729.\u110D\u1173\u11AC5")', + ], + }, 'historical.any.js': {}, 'idlharness.any.js': { comment: From e93fac12d638730c1e7e5fd2c725de786b3cd964 Mon Sep 17 00:00:00 2001 From: Workers DevProd Date: Fri, 16 Oct 2026 20:51:28 +0000 Subject: [PATCH 5/6] Document WPT archive inspection in the wpt-update skill Describe where Bazel keeps the WPT archives after a failed patch, the wpt.py virtualenv assertion that constrains the serve patch, how to keep non-NFC subtest names exact, and how to apply formatting fixes. Co-Authored-By: Claude Opus 5.5 --- .opencode/skills/wpt-update/SKILL.md | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/.opencode/skills/wpt-update/SKILL.md b/.opencode/skills/wpt-update/SKILL.md index 8c6ad3509cd..e2d1b3edab2 100644 --- a/.opencode/skills/wpt-update/SKILL.md +++ b/.opencode/skills/wpt-update/SKILL.md @@ -42,6 +42,18 @@ its intent. If you add, remove, or rename a patch, update the patch list and regenerate `build/deps/gen/shared_deps.MODULE.bazel` with `./build/deps/update-deps.py wpt`, which keeps the pinned `freeze_version`. +Bazel deletes the extracted repository when a patch fails, but the archive +remains in the repository cache at +`$(bazel info repository_cache)/content_addressable/sha256//file`, +using the `sha256` values from the old and new dependency metadata. Extract the +old and new archives into separate empty directories under `$TMPDIR` to rebase +patches and to compare the mapped WPT directories with `diff -rq`. + +The `serve` patch keeps `tools/serve/commands.json` from requesting a +virtualenv. `tools/wpt/wpt.py` asserts that any command declaring +`requirements` or `conditional_requirements` uses a virtualenv, so the patch +must also remove any such keys that upstream adds to the `serve` entry. + Describe each patch change and the upstream commit that required it in the final report. @@ -238,7 +250,10 @@ missing. coverage. Each property accepts `true` for a whole suite or an array of exact strings and -regular expressions. Prefer exact subtest names. Use a regex only when it is +regular expressions. Prefer exact subtest names. Copy non-ASCII names with +`\u` escapes when they contain decomposed or otherwise non-NFC text, because +copying them through a terminal or editor can normalize them into different +strings. Use a regex only when it is narrow, anchored where practical, and checked against every intended name. Do not use broad regexes or whole-suite `true` merely to make a target pass. @@ -271,6 +286,9 @@ python3 tools/cross/format.py --check git git diff --check ``` +Running `python3 tools/cross/format.py git` without `--check` applies the +formatting to the reported files. Rerun the affected targets afterwards. + ### Continuous improvement Re-read the SKILL.md file. If there are any details that weren't clear or that From 20dc9dbb95b3ed9adf65586a153928a9f7effed7 Mon Sep 17 00:00:00 2001 From: Nicholas Paun Date: Fri, 16 Oct 2026 14:21:27 -0700 Subject: [PATCH 6/6] Resolve the WPT patch label from the workerd repository The wpt archive's patch was labelled //:patches/wpt/..., which resolves against the main repository. edgeworker includes shared_deps.MODULE.bazel, so its builds applied edgeworker's own copy of the patch, which went stale when the patch was rebased and failed with CONTENT_DOES_NOT_MATCH_TARGET. Use @workerd//, as build_file already does, so both builds apply the same patch. Co-Authored-By: Claude Opus 5.5 (1M context) --- build/deps/gen/shared_deps.MODULE.bazel | 2 +- build/deps/shared_deps.jsonc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build/deps/gen/shared_deps.MODULE.bazel b/build/deps/gen/shared_deps.MODULE.bazel index 42e4e2218af..7259bc12b34 100644 --- a/build/deps/gen/shared_deps.MODULE.bazel +++ b/build/deps/gen/shared_deps.MODULE.bazel @@ -115,7 +115,7 @@ http.archive( build_file = "@workerd//:build/BUILD.wpt", patch_strip = 1, patches = [ - "//:patches/wpt/0001-disable-virtualenv-for-serve-command.patch", + "@workerd//:patches/wpt/0001-disable-virtualenv-for-serve-command.patch", ], sha256 = "e45f3ab903c74784ce5e41fc61f72200a0adf429f06203fe3e16bf2abeaa9431", strip_prefix = "wpt-2f17dec1f", diff --git a/build/deps/shared_deps.jsonc b/build/deps/shared_deps.jsonc index 419888ee6f2..f902f0a955e 100644 --- a/build/deps/shared_deps.jsonc +++ b/build/deps/shared_deps.jsonc @@ -115,7 +115,7 @@ "build_file": "@workerd//:build/BUILD.wpt", "freeze_version": "wpt-2f17dec1f", "patches": [ - "//:patches/wpt/0001-disable-virtualenv-for-serve-command.patch" + "@workerd//:patches/wpt/0001-disable-virtualenv-for-serve-command.patch" ] } ]