Update WPT

.opencode/skills/wpt-update/SKILL.md

@@ -42,6 +42,18 @@ its intent. If you add, remove, or rename a patch, update the patch list and
 regenerate `build/deps/gen/shared_deps.MODULE.bazel` with
 `./build/deps/update-deps.py wpt`, which keeps the pinned `freeze_version`.
 
+Bazel deletes the extracted repository when a patch fails, but the archive
+remains in the repository cache at
+`$(bazel info repository_cache)/content_addressable/sha256/<sha256>/file`,
+using the `sha256` values from the old and new dependency metadata. Extract the
+old and new archives into separate empty directories under `$TMPDIR` to rebase
+patches and to compare the mapped WPT directories with `diff -rq`.
+
+The `serve` patch keeps `tools/serve/commands.json` from requesting a
+virtualenv. `tools/wpt/wpt.py` asserts that any command declaring
+`requirements` or `conditional_requirements` uses a virtualenv, so the patch
+must also remove any such keys that upstream adds to the `serve` entry.
+
 Describe each patch change and the upstream commit that required it in the
 final report.
 
@@ -238,7 +250,10 @@ missing.
   coverage.
 
 Each property accepts `true` for a whole suite or an array of exact strings and
-regular expressions. Prefer exact subtest names. Use a regex only when it is
+regular expressions. Prefer exact subtest names. Copy non-ASCII names with
+`\u` escapes when they contain decomposed or otherwise non-NFC text, because
+copying them through a terminal or editor can normalize them into different
+strings. Use a regex only when it is
 narrow, anchored where practical, and checked against every intended name. Do
 not use broad regexes or whole-suite `true` merely to make a target pass.
 
@@ -271,6 +286,9 @@ python3 tools/cross/format.py --check git
 git diff --check
 ```
 
+Running `python3 tools/cross/format.py git` without `--check` applies the
+formatting to the reported files. Rerun the affected targets afterwards.
+
 ### Continuous improvement
 
 Re-read the SKILL.md file. If there are any details that weren't clear or that

build/deps/gen/shared_deps.MODULE.bazel

@@ -115,11 +115,11 @@ http.archive(
     build_file = "@workerd//:build/BUILD.wpt",
     patch_strip = 1,
     patches = [
-        "//:patches/wpt/0001-disable-virtualenv-for-serve-command.patch",
+        "@workerd//:patches/wpt/0001-disable-virtualenv-for-serve-command.patch",
     ],
-    sha256 = "cbb50ece231cb0f8bd92f45ad9949407f9a0c8c8a5c6fa6fdaebe8fa09c93825",
-    strip_prefix = "wpt-b875b21fd",
+    sha256 = "e45f3ab903c74784ce5e41fc61f72200a0adf429f06203fe3e16bf2abeaa9431",
+    strip_prefix = "wpt-2f17dec1f",
     type = "tgz",
-    url = "https://github.com/cloudflare/workerd-tools/releases/download/wpt-b875b21fd/wpt-b875b21fd.tar.gz",
+    url = "https://github.com/cloudflare/workerd-tools/releases/download/wpt-2f17dec1f/wpt-2f17dec1f.tar.gz",
 )
 use_repo(http, "wpt")

build/deps/shared_deps.jsonc

@@ -113,9 +113,9 @@
       "repo": "workerd-tools",
       "file_regex": "wpt-.*.tar.gz",
       "build_file": "@workerd//:build/BUILD.wpt",
-      "freeze_version": "wpt-b875b21fd",
+      "freeze_version": "wpt-2f17dec1f",
       "patches": [
-        "//:patches/wpt/0001-disable-virtualenv-for-serve-command.patch"
+        "@workerd//:patches/wpt/0001-disable-virtualenv-for-serve-command.patch"
       ]
     }
   ]

patches/wpt/0001-disable-virtualenv-for-serve-command.patch

@@ -1,10 +1,11 @@
 --- a/tools/serve/commands.json
 +++ b/tools/serve/commands.json
-@@ -4,17 +4,7 @@
+@@ -4,18 +4,7 @@
      "script": "run",
      "parser": "get_parser",
      "help": "Run wptserve server",
 -    "virtualenv": true,
+-    "requirements": ["requirements.txt"],
 -    "conditional_requirements": {
 -      "commandline_flag": {
 -        "webtransport_h3": [

src/wpt/WebCryptoAPI-test.ts

@@ -128,6 +128,16 @@ export default {
   'encrypt_decrypt/rsa_oaep.https.any.js': {},
   'encrypt_decrypt/rsa_vectors.js': {},
 
+  'export-key-error-order.https.any.js': {
+    comment:
+      'exportKey() and wrapKey() check extractable before export support, so HKDF and PBKDF2 keys throw InvalidAccessError instead of NotSupportedError',
+    expectedFailures: [
+      'exportKey() with a HKDF key throws NotSupportedError',
+      'wrapKey() with a HKDF key throws NotSupportedError',
+      'exportKey() with a PBKDF2 key throws NotSupportedError',
+      'wrapKey() with a PBKDF2 key throws NotSupportedError',
+    ],
+  },
   'generateKey/algorithm_registry.js': {},
   'generateKey/failures.js': {},
   'generateKey/failures_AES-CBC.https.any.js': {},
@@ -439,6 +449,16 @@ export default {
     expectedFailures: true,
   },
   'serialization/x448.tentative.https.any.js': unsupported('X448'),
+  'sharedarraybuffer.https.any.js': {
+    comment:
+      'SubtleCrypto BufferSource arguments accept views backed by a SharedArrayBuffer instead of throwing TypeError',
+    expectedFailures: [
+      'digest() data is a Uint8Array(SharedArrayBuffer)',
+      'encrypt() data is a Uint8Array(SharedArrayBuffer)',
+      'encrypt() AesGcmParams.iv is a Uint8Array(SharedArrayBuffer)',
+      'encrypt() AesGcmParams.additionalData is a Uint8Array(SharedArrayBuffer)',
+    ],
+  },
   'sign_verify/ecdsa.https.any.js': {},
   'sign_verify/ecdsa.js': supportFile,
   'sign_verify/ecdsa_vectors.js': supportFile,

src/wpt/fetch/api-test-ts.ts

@@ -176,6 +176,13 @@ export default {
     comment: 'Referrer is not implemented',
     omittedTests: true,
   },
+  'basic/request-upload-421.any.js': {
+    comment:
+      'fetch() does not retry a request on a 421 Misdirected Request response',
+    expectedFailures: [
+      'Fetch with POST with text body on 421 response should be retried once on new connection.',
+    ],
+  },
   'basic/request-upload.any.js': {
     comment: 'Appears to corrupt the state of workerd',
     disabledTests: true,

src/wpt/fetch/api-test.ts

@@ -173,6 +173,13 @@ export default {
     comment: 'Referrer is not implemented',
     omittedTests: true,
   },
+  'basic/request-upload-421.any.js': {
+    comment:
+      'fetch() does not retry a request on a 421 Misdirected Request response',
+    expectedFailures: [
+      'Fetch with POST with text body on 421 response should be retried once on new connection.',
+    ],
+  },
   'basic/request-upload.any.js': {
     comment: 'Appears to corrupt the state of workerd',
     disabledTests: true,

src/wpt/fs-test.ts

@@ -62,6 +62,10 @@ export default {
     comment: 'Frames are not implemented in workers',
     disabledTests: true,
   },
+  'FileSystemBaseHandle-postMessage-insecure-context.https.window.js': {
+    comment: 'window.open() and postMessage are not implemented in workers',
+    disabledTests: true,
+  },
   'FileSystemBaseHandle-postMessage-windows.https.window.js': {
     comment: 'postMessage is not implemented in workers',
     disabledTests: true,

src/wpt/url-test.ts

@@ -6,7 +6,19 @@ import { type TestRunnerConfig } from 'harness/harness';
 
 export default {
   'IdnaTestV2-removed.any.js': {},
-  'IdnaTestV2.any.js': {},
+  'IdnaTestV2.any.js': {
+    comment:
+      'ada-url uses IDNA 17.0.0 tables, which do not include code points assigned in Unicode 18.0.0',
+    expectedFailures: [
+      'ToASCII("\u2D0D\u{3F8CD}\uA868\u05AE.\u2D1E")',
+      'ToASCII("\u10AD\u{3F8CD}\uA868\u05AE.\u10BE")',
+      'ToASCII("\u10AD\u{3F8CD}\uA868\u05AE.\u2D1E")',
+      'ToASCII("\u{3E8AC}\u3002\u0729\u3002\uCBD95")',
+      'ToASCII("\u{3E8AC}\u3002\u0729\u3002\u110D\u1173\u11AC5")',
+      'ToASCII("\u{3E8AC}.\u0729.\uCBD95")',
+      'ToASCII("\u{3E8AC}.\u0729.\u110D\u1173\u11AC5")',
+    ],
+  },
   'historical.any.js': {},
   'idlharness.any.js': {
     comment: