test(ws-proxy): renegotiate only after the "renegotiating" frame is written by robobun · Pull Request #46170 · oven-sh/bun

robobun · 2026-10-20T07:36:05Z

Problem

test/js/first_party/ws/ws-proxy.test.ts fails on Windows 2019 x64 (builds 128251, 128333, 128506) in "a message sent during a TLS renegotiation arrives after it". request.forwarded[0].types is [22, 23], not [23, 22], and the client closes with 1006.
The cause is the node origin of startRenegotiatingWssServer("behind a message") (test/js/web/websocket/proxy-test-utils.ts:445, added by WebSocket client: follow-up fixes to #45223 #45720). It ran send("renegotiating"); renegotiate(...). If the write of the 101 is not done, node queues the frame, and renegotiate() arms the request at once. The HelloRequest leaves first.

Fix

The origin calls renegotiate() from the callback of the frame's write, so the frame always leaves first.
Correct because the test needs this order: the client's listener for the frame must run during the renegotiation. No expectation changes.
Verified: bun bd test on ws-proxy.test.ts and websocket-proxy.test.ts. With a write in flight in the origin, the old helper fails 20 of 20 runs with the diff from CI, and the new helper passes 20 of 20.

Background

A TLS 1.2 server asks for a renegotiation with a HelloRequest (record type 22). Application data is type 23. The client's BoringSSL takes no application data during the new handshake, so [22, 23] ends the connection.
Node reports a socket write as done in the check phase of its loop, and socket.write() queues until then. On Windows, libuv can deliver a later read before that phase. On Linux and macOS it cannot.
Not run on Windows: that part is from the node and libuv sources.

Notes

Order on the wire, node v26.3.0 (the version CI pins). A node-only probe ran the origin script of the helper behind a TCP forwarder that logs the TLS record types. A zero-length socket.write("") in front of the frame stands in for the 101 whose callback is pending. It puts nothing on the wire.

helper	socket when the client's frame arrives	records that follow
before	idle	`[23] [22]`
before	write in flight	`[22] [23]`
after	idle	`[23] [22]`
after	write in flight	`[23] [22]`

The same stand-in in the real test, release build of main (ea6a2c7b7), case "a message sent during a TLS renegotiation arrives after it":

helper	socket	result
before	idle	20 of 20 pass
before	write in flight	0 of 20 pass. The diff is the one of build 128506: `- Expected - 15`, `+ Received + 3`
after	idle	40 of 40 pass
after	write in flight	20 of 20 pass

The global WebSocket cases in websocket-proxy.test.ts (http and https proxy) use the same origin. With the old helper and a write in flight, they fail in the same way. They pass with the new helper.

Why the write of the 101 can be in flight (node v26.3.0, libuv 1.52.1):

TLSWrap::EncOut reports a synchronous socket write as done through SetImmediate (src/crypto/crypto_tls.cc:725-734). Until that runs, the stream is in kWriting and write() buffers (lib/internal/streams/writable.js:553).
TLSSocket.prototype.renegotiate calls SSL_renegotiate() at once (lib/internal/tls/wrap.js:1016). The next SSL_write or SSL_read sends the HelloRequest. For a frame that is still queued, that is its own SSL_write, which puts the HelloRequest in front of the frame.
libuv on Windows: one loop iteration runs uv__process_reqs, uv__poll, and up to 8 more rounds of uv__process_reqs before uv__check_invoke (deps/uv/src/win/core.c:719-746). uv__tcp_queue_read puts a read that completes at once into the next round (deps/uv/src/win/tcp.c:549-604). So a frame that arrives after the 101 left, and before the check phase, is read first.
libuv on Unix reads a socket only in uv__io_poll, one time for each iteration, and uv__read stops after a short read (deps/uv/src/unix/stream.c:1154). The check phase always comes first.

Not proven. There was no run on Windows. That the Windows lane has this interleaving is an inference: the failures are on Windows only, and the emulated state gives the same diff.

Suites run with bun bd test: test/js/first_party/ws/ws-proxy.test.ts (106 pass) and test/js/web/websocket/websocket-proxy.test.ts (125 pass, 4 skipped for Docker). With the release build of main: the same two files, and the renegotiation cases of test/js/web/websocket/websocket-client.test.ts.

Cold start. With cold page caches in the test container, the case went over the 5 s default timeout with the old helper and with the new helper (2 of 2 runs each). The spawn of node takes that long there. A warm run takes about 0.2 s.

Other design. Add the listener for the client's frame from the callback of the 101's write. A frame that arrives before that callback then has no listener, and the origin drops it.

Sibling, not changed. pingPongRenegotiationServer in test/js/node/tls/renegotiation.test.ts also runs socket.write(); socket.renegotiate(). With a write in flight, its 9 "data in the same read: true" cases time out. That state cannot occur there: its proxies run on the loop of the origin, so the reply of the client needs two more polls of that loop, and the check phase comes after the first.

Not changed here. [22, 23] is legal in TLS 1.2. A server that sends application data between its HelloRequest and the new handshake ends a bun wss:// connection. vendor/boringssl/PORTING.md says: "Interleaving application data with the new handshake is forbidden."

no test proof · iteration 2 · no src or test change; test-proof not applicable

…ritten The node origin of startRenegotiatingWssServer("behind a message") wrote the "renegotiating" frame and called renegotiate() in the same turn. When the write of the 101 is still in flight, node queues the frame, and renegotiate() arms the request at once. The HelloRequest then leaves before the frame. BoringSSL takes no application data during the new handshake, so the client closes with 1006. On Windows, libuv can deliver the client's first frame before node reports the write of the 101 as done. ws-proxy.test.ts failed there with request.forwarded[0].types [22, 23] where [23, 22] is expected. The origin now calls renegotiate() from the callback of the frame's write.

robobun · 2026-10-20T07:36:38Z

Status: closed as superseded. The same change is on main through #46825 (8a0e49e), which carries both hunks of test/js/web/websocket/proxy-test-utils.ts unmodified.

Reproduction. The failure needs a write in flight in the node origin when the client's first frame arrives. On Linux, a zero-length socket.write("") in front of the "renegotiating" frame gives that state and puts nothing on the wire. With it, the old helper fails 20 of 20 runs of test/js/first_party/ws/ws-proxy.test.ts with the diff of build 128506 (request is [22, 23], close 1006). The new helper passes 20 of 20.

On main. test/js/first_party/ws/ws-proxy.test.ts passes on main at 11c3671 (106 pass, release build of that commit, Linux). The 60 most recent finished CI builds (134128 to 134284) have no failure of this file.

claude

Code review found no issues

No high-confidence issues detected in this change.

coderabbitai · 2026-10-20T07:42:08Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 1 minute.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: oven-sh/bun/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 4c406294-074e-4290-9915-a6debea9c30e

📥 Commits

Reviewing files that changed from the base of the PR and between 3e2b341 and 1441385.

📒 Files selected for processing: 1

test/js/web/websocket/proxy-test-utils.ts

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: oven-sh/bun/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 0590fe9e-a6d4-4279-9947-7bc33a0f42b3

📥 Commits

Reviewing files that changed from the base of the PR and between ea6a2c7 and 3e2b341.

📒 Files selected for processing: 1

test/js/web/websocket/proxy-test-utils.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

Walkthrough

The embedded renegotiation test server now starts renegotiation after the “renegotiating” WebSocket frame write completes.

Changes

WebSocket renegotiation

Layer / File(s)	Summary
Defer renegotiation until write completion `test/js/web/websocket/proxy-test-utils.ts`	The `send` helper accepts an optional write callback. In the “behind a message” path, renegotiation starts from the callback after the “renegotiating” frame is written.

Suggested reviewers: jarred-sumner

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 3e2b3

The focused test-helper change has no identified merge-blocking risk.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary change: delaying TLS renegotiation until the "renegotiating" frame is written.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description is complete and relevant. It explains the problem, the fix, the expected ordering, verification commands, test results, limitations, and supporting technical details. It does not use t…

Full details: Description check

Explanation

The description is complete and relevant. It explains the problem, the fix, the expected ordering, verification commands, test results, limitations, and supporting technical details. It does not use the exact template headings, but it provides the required information under equivalent sections.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

robobun · 2026-10-20T07:45:54Z

^{Updated 5:58 PM PT - Oct 21st, 2026}

✅ @robobun, your commit 144138573b63ca68700531f66b10e7a1d4f416f8 passed in Build #130280! 🎉

🧪 To try this PR locally:

bunx bun-pr 46170

That installs a local version of the PR into your bun-46170 executable, so you can run:

bun-46170 --bun

…roxy-renegotiate-after-write

…ritten Same change as #46170. On Windows 2019 x64 the node origin's HelloRequest can leave before the frame that is still queued behind the 101, and the client closes with 1006.

…ritten Same change as #46170. On Windows 2019 x64 the test "a message sent during a TLS renegotiation arrives after it" fails on many branches: the node origin queues the frame behind the 101 that is still being written, and `renegotiate()` sends its HelloRequest first. The origin now starts the renegotiation from the frame's write callback.

…ritten Same change as #46170. `ws-proxy.test.ts` fails on Windows 2019 x64 in "a message sent during a TLS renegotiation arrives after it" when the origin's HelloRequest leaves before the frame that is still queued. The origin now renegotiates from the callback of the frame's write.

…ter-free) (#46825) ### What does this PR do? Printing an Error could read a source-map file name that had just been freed, and put the stale bytes in the printed stack. This fixes that bug and makes the mistake behind it a compile error. **The bug.** For a stack frame whose URL is not an absolute path, `Lookup::display_source_url_if_needed` returned a string that borrowed the map's own `sources` entry. The printer reads the Error's own `cause` between remapping the frames and printing them. A `cause` getter that loads the same file again replaces the map, which frees its names. `require(URL.createObjectURL(Bun.file("rel.js")))` gives such a URL. - AddressSanitizer build: `heap-use-after-free` under `print_stack_trace`. - Release 1.4.4: the frame prints as `(\^@\^VnO�\^B\^@:1:1)` instead of `(orig.ts:1:1)`. - `Bun.inspect`, `console.log`, `console.error` and an uncaught throw are affected. **The root cause.** `bun_core::String` is the owned type, but `String::borrow_utf8`, `from_bytes` and `ascii` were safe functions that took a `&[u8]` and dropped its lifetime. `StringView<'a>` already existed for borrowing. - Those three constructors are removed. Borrowing goes through `StringView<'a>`, which derefs to `&String`. - `String::clone` copies the bytes a view borrows. It was a bitwise copy, so `view.clone()` and `thread_isolated_copy()` returned a dangling string. - `create_static_external*` take `&'static`. `create_external` is `unsafe`. Both lose `is_latin1`: `false` read past the end of the slice, and every caller passed `true`. - New: `StringOrView<'a>`, a `String` field that may hold borrowed `'a` bytes instead of a ref. It is what a C++ `BunString` slot really is. It derefs to `&String`, drops the ref if it has one, and has no `DerefMut`. - New: `String::from_static_bytes`, `StringView::ascii`, `StringView::as_strings`. **What the compiler then flagged** (112 call sites; most became a `StringView` with no other change): - `ZigException`, `ZigStackTrace`, `ZigStackFrame` and `Holder` get a lifetime, and their strings are `StringOrView<'a>`. C++ fills them with refs, the dev server fills them with slices of the request body, and `remap_zig_exception` fills the source lines with slices of the source text. The caller owns that text and passes `&'a mut Utf8Bytes`, so the compiler checks that it outlives the holder. `ZigStackTrace::from_frames` keeps its frame buffer borrowed. - `Route`, `JSS3Error` and the npmrc test object get a lifetime. - `ResolvedSource` and `SystemError` own their strings. C++ wraps a borrowed ASCII string it receives by value with `createWithoutCopying`, so those borrows could outlive the Rust frame. - `bun bake` production moves each server chunk's bytes into the string that JavaScriptCore loads. The chunk was aliased by a string that JavaScriptCore keeps for the module's life, but `PerThread`, which owned the bytes, drops before the VM. **Cost, read from the code.** A value that ends up as a JS string is still copied once: C++ shares an owned impl and copies a borrowed one, so `clone_utf8` + share replaces borrow + copy (`process.argv`, `os.homedir()`, UDP `rinfo.address`, the `fs` `SystemError`, the inspector's bundle-failed payload). What costs more than on `main`: - The relative arm of `display_source_url_if_needed` copies the name. That is the fix. - `AsyncModule` copies `source_url`. The alias it replaces dangled once the `AsyncModule` was freed. - `from_static_bytes` (the `bun:wrap` source, a compiled module's bytecode origin path) makes a `WTF::ExternalStringImpl`: one more small allocation than `createWithoutCopying`, once per module load, freed with the string. - `PerThread::init` boxes one more key per server chunk. - Cloning a view copies its bytes. It was free, and dangling. What costs less: a builtin's resolved path is `String::static_`. In the module loader (`transferToWTFString`) a repeated import finds the atom and allocates nothing, where `main` made a `createWithoutCopying` header each time. The JS resolve APIs (`into_js`) copy it once, as on `main`. **Not changed here.** - `String::create_uninitialized_latin1` / `_utf16` return a `&'static mut` slice that lives only as long as the string. Same kind of lie, 24 callers in hot paths, so it needs its own PR. - A relative `Bun.file()` path behind a `blob:` URL stays the module's source URL: #46842. **Also in the diff.** `test/js/web/websocket/proxy-test-utils.ts` carries the change from #46170 unmodified. It fixes a flaky `ws-proxy.test.ts` case on Windows 2019 x64 that turned this PR's CI red and also fails on other branches. ### How did you verify your code works? - **The bug no longer compiles.** Putting `String::borrow_utf8(display)` back gives E0599. `Some(StringView::borrow_utf8(display))` gives E0308, `expected String, found StringView<'_>`. Changing the return type to `StringView<'_>` gives a lifetime error. - **Neither do these.** Declaring the source text after the holder that borrows its lines: E0597. Freeing the request body before the dev server prints its frames: E0505. Clearing the frame `Vec` while the trace points at it: E0499. - **No leak.** C++ stores an owned ref in source line 0 for an error with `lineText`. 1200 inspects of an error with a fresh 1 MB `lineText` grow RSS by 8 MB (debug build, ASAN quarantine at 1 MB). - `a cause getter that loads the throwing file again` in `test/js/bun/util/inspect-error.test.js` covers the four printers and `error.stack`. It fails with `USE_SYSTEM_BUN=1 bun test` and passes with `bun bd test` (46 pass). The repro reports the use-after-free on a debug build of `main`. - `stringViewCloneOutlivesBytes` in `test/internal/bindgen.test.ts` frees the bytes before it returns the clone. `stringViewEcho` now goes through `String::clone` for Latin-1 and UTF-16 views (226 pass). - An A/B probe of the touched behaviour gives the same output on release 1.4.4 and on this branch: `process.argv`, `os.homedir()`, brace expansion, `Transpiler.scan`, `dns.getServers()`, UDP `rinfo`, timer warnings, JSON IPC, builtin resolution (all 182 alias keys through five resolve APIs), `bun:wrap`, the valkey URL, error printing with non-ASCII source lines, system errors, redirects, S3 errors, CLI errors. - 36 related test files on a debug + ASAN build, with no ASAN report. The failures are environmental: no `USER`, no IPv6, no DNS, 5 s timeouts that pass with a longer limit, and a leak fixture that only knows an ASAN build by the name `bun-asan`. `native-plugin.test.ts` did not run locally (its setup hook timed out on a download). - `cargo check --workspace --all-targets`, `bun run rust:clippy`, `cargo fmt --check`, the source lints, and `rust:check-all` for `x86_64-pc-windows-msvc` and `aarch64-apple-darwin`. `mordant` was not run locally. --- _Generated by [Claude Code](https://claude.ai/code)_ --------- Co-authored-by: Claude <noreply@anthropic.com>

…ritten (#46170)

@mikamikasuki

### What does this PR do? Consolidates the open pull requests on the CSS parser (`src/css`: parsing, minifying, lowering, printing, CSS modules) into one. 179 open pull requests were in scope. Each was judged by one rule: **the output must mean to a browser what the input meant.** Every claim was run through a build of `main`, a build with the change, lightningcss 1.33 and Chromium 156 (CSSOM, computed values, painted pixels for colors and gradients), and counted against 10,116 real stylesheets: the published CSS of about 190 popular npm packages, plus stylesheets from open source repositories. 107 land here, whole or in part, most of them cut down. The source diff is net negative. Of the 10,116, 9,509 are stylesheets that someone ships. The rest are test fixtures of other tools (521), Tailwind v4 source that needs its plugin (59) and SCSS, PostCSS or template source (27). | 9,509 shipped stylesheets | `main` | this branch | |---|---|---| | fail to build | 71 | 35 | | ... of those, valid CSS that Bun rejects | | 0 | | minified output reads differently in Chromium than the input | 552 | 2 | | CSS modules with a name that is referenced but not defined, or exported but not defined | 166 | 0 | | all 10,116 | `main` | this branch | |---|---|---| | fail to build | 192 | 141 | | minified output reads differently in Chromium than the input | 593 | 15 | | build on `main`, fail here | | 0 | | right on `main`, wrong here (minified, and at the default targets) | | 0 | | size of the minified output, no targets | 162.32 MB | 162.47 MB (+0.093%) | | size of the output at the default targets | 224.1 MB | 210.2 MB (-6.2%) | A syntax error is a build error, with one exception: the IE star hack `*zoom: 1` is skipped, because tachyons and handsontable ship it. The 35 shipped stylesheets that fail are invalid CSS: 28 have a selector that Chromium drops (semantic-ui-css, swiper, @ionic/core, Adobe Spectrum, xp.css), 2 an `@import` after other rules, and one each `@supports not X and Y`, a nested `@keyframes`, a stray comma, a selector list in `::slotted()`, `@media screen\0` (govuk-frontend). The 2 that read differently fold a `color-mix()` inside a gradient (see the known gaps). The growth of the minified output is rules and declarations that `main` deleted by mistake: 87 KB of rules, 45 KB of prefixed declarations that only browser targets can rule out. #### Popular CSS that `main` breaks today - normalize.css, modern-normalize, sanitize.css: `font-family: monospace, monospace` is collapsed to `monospace`, which changes the font size from 16px to 13px (#46662). - CKEditor 5, Tabler, Carbon, VitePress, Ionic, PatternFly, Excalidraw: a rule of custom properties is deleted as a "duplicate" of a later rule with the same selector and other custom properties. 37 stylesheets lose 1,681 custom properties (#33684). - Material Components, daisyUI, DocSearch, plyr: a `var()` size loses to its own fallback (#42101). - nextra, daisyUI, CKEditor: declarations written after a nested rule are moved above it (#45462). - antd 4, purecss, govuk-frontend: browser hacks in selector lists start to apply everywhere (#42100). - foundation-sites, flatpickr, 98.css, blueprintjs, scalar, react-datepicker: the build fails on valid CSS (#46756, #38552, #38534). tachyons, handsontable: it fails on the IE star hack (#46751). - nodejs.org, Mantine: a CSS module exports classes that no rule defines, because the `@apply` or `@mixin` in them is moved out of the rule (#46759). - hint.css and 42 more: `z-index: 1000001` and `1000000` become the same number (#46715). - Adobe Spectrum: `--version: 5.0.1` prints as `5.1`. - A quarter of all stylesheets: minified output has a stray space in `align-items: center` (#41993). #### Behavior changes to look at first 1. **`light-dark()` is kept as written at the default browser targets** (#42009). The lowered form `var(--buncss-light, a) var(--buncss-dark, b)` is invalid unless a compiled `color-scheme` covers the element: 184 of the 215 real stylesheets that get it never define the variable, so every browser drops the declaration. The docs section on the polyfill is removed. 2. **`border` is not built from longhands** (#42072): `border-width:0;border-style:solid;border-color:red` stays three declarations, because `border` also resets `border-image`. 305 real stylesheets grow by 30 KB in total; `bootstrap.min.css` by 113 bytes, 5 gzipped. No real stylesheet was found where the old merge shows, so this is the one to drop if size matters more. 14 existing expectations change. 3. **A CSS module no longer exports names that only occur inside `:global(...)`** (#45487). 73 real modules lose 202 export keys, all of them names that no rule has. `import { g }` or `composes: g` of such a name becomes a build error. 4. **Container names and `@counter-style` names stay global in a CSS module** (#45247 by @mikamikasuki). `main` hashes the `@container` name but not `container-name`, so a named query never matches. postcss-modules (Vite, css-loader, Next.js) keeps them global; lightningcss and esbuild hash both. Global keeps a container that is queried from another file or from JS working. 5. **Syntax errors are build errors, also two that `main` lets through**: a media query that stops short (`@media screen and {`, `@media not {`, `@import "a.css" screen and;`) and `@media (width <) foo {`. No stylesheet of the 10,116 has either. A condition that is valid by the grammar though no browser knows it, `( ... )` or `fn( ... )`, is kept as written (#46756): `(min-width:0\0)`, `(not(hover))`. 6. **Declarations after a nested rule stay where they were written**, as a nested declarations rule (#45462). Changes the output of 199 real stylesheets; in a fuzz of 2,850 nested programs compared by computed style, `main` was wrong in 1,056 and the pull request's code, before it was trimmed here, in none. 7. **`Bun.color`**: `color()` inputs are converted instead of returned as a string (`Bun.color("color(srgb 1 0 0)", "hex")` was `"color(srgb 1 0 0)"`); `currentColor`, system colors and `light-dark()` give `null` in the converting formats instead of the keyword as a string; a relative color or `color-mix()` outside sRGB is clipped, not gamut-mapped (`hsl(from oklch(100% .399 336.3) h s l)` is `#ff5bff`, was `#fff`). 8. The `:-moz-any()` and `:-webkit-any()` copies of rules with `:is()` are gone at the default targets (#45945, #42029). The `:-webkit-any()` copy outranked the original rule: `.title{color:blue} :is(h1,h2,h3){color:red}` painted red. 5.8% of all default-target output was the `:-moz-any()` copies. 9. `Property` grows from 216 to 224 bytes: `Url` stores its text as a slice so that two `url()` values can be compared (#46895). The pull request packed a pointer and a `u32` behind `unsafe` to avoid that. #### Not in this PR, needs a decision - **Raise the default browser targets (#40369) and add a `cssTarget` option (#40368).** Today: Chrome 80, Edge 80, Firefox 78, Safari 14, Opera 67, and no public way to change them. At Vite 8's floor the output of the 9,924 stylesheets is 15.3% smaller (3.9% gzipped). About a dozen fixes here only matter at today's floor, and code for older targets is unreachable without the option. - Vendor prefixes for `user-select`, `appearance`, `hyphens` and five more (#45814): 1,116 real stylesheets lack a prefix they need at the default targets. And for `backdrop-filter` (#44648): 173. - Clip instead of gamut-map in the sRGB fallback of a plain wide-gamut color: deletes about 90 lines, changes every pinned fallback hex. If the mapping stays, #44647 by @oddharsh makes it closer to what browsers paint (colors off by 2/255 or more: 168 to 110 of 3,170 real ones). #### Changes **Rules: duplicates, merging, nesting, fallbacks** - The `:-moz-any()` copy of every rule with `:is()` or `:not(a, b)` is gone: Firefox 78 has `:is()` (#45945). 1,164 real stylesheets - Keep declarations written after a nested rule in place with a nested declarations rule (#45462). 379 real stylesheets - With nesting compiled away, an unknown at-rule inside a style rule was moved out of it: `.wrapper{@apply flex}` printed a bare `@apply flex;` and the rule was gone, so a CSS module exported a class that no rule defines. It now stays in a block under the compiled selector. 72 real modules with Tailwind's `@apply`, 25 with Mantine's `@mixin` (#46759). 316 real stylesheets - Keep !important in the rules generated for logical properties and color-scheme (#38597). 311 real stylesheets - With browser targets, remove an earlier duplicate rule only when its declaration block is equal (#46861). 171 real stylesheets - Compare custom property names in `PropertyId` equality and importance in duplicate-rule detection (#33684). 40 real stylesheets - Keep same-condition @supports rules and empty named @layer blocks (#46733). 31 real stylesheets - Keep target-added vendor prefix passes on cloned and re-minified rules, and never print a bare `:full-screen` (#43339). 12 real stylesheets - Keep the selectors on rules added for color fallbacks and logical properties (#43240). 3 real stylesheets - A later declaration of a property drops the `@supports` color copies of the earlier one, which printed after the rule and won (#45560). 2 real stylesheets - Do not merge style rules in a stylesheet that holds `revert-rule` (#46953). 1 real stylesheets - `@import ... supports(-webkit-mask: none)` kept its prefix (#38589) **Properties and shorthands** - Print align-items:center without a stray space when no safe/unsafe keyword is given (#41993). 3,317 real stylesheets - Emit the physical longhands instead of the inset shorthand for targets without it (#38583). 1,452 real stylesheets - Keep the stops of an upward gradient as written, and drop a `50%` hint only at the midpoint (#46790). 104 real stylesheets - Emit unparsed border-block-* declarations when compiling logical borders (#38582). 89 real stylesheets - Keep repeated font families and dedupe only the inserted system-ui fallbacks (#46662). 88 real stylesheets - A `width` / `height` / `min-*` / `max-*` with `var()` or `env()` was printed before the plain fallback written above it, so the fallback won (#42101). 26 real stylesheets - Keep box-orient and box-direction when flex-direction or flex-flow follows (#45672). 16 real stylesheets - Write held prefixed background declarations at every flush (#46882). 6 real stylesheets - Derive equality for Size2D and BorderRadius, and keep every prefix in the border-radius handler (#45665). 2 real stylesheets - Print `none` instead of an empty border-image, mask-border or mask-box-image value (#45143). 2 real stylesheets - Keep font/transition sub-properties on the side of the shorthand they were written on (#41990). 2 real stylesheets - CSS-wide keywords are not names: `font:12px Arial;font-family:inherit` printed `font:12px inherit`, `color-scheme:inherit` and `color-scheme:auto` printed `normal`, `transition-property:unset` was folded into `transition` (#42022). 2 real stylesheets - Only fold font longhands into `font` when the rule declared a `font` (#45459) - Keep a font family name quoted when its identifiers do not read back as the same name (#46606) - Stop rewriting valid positions into ones browsers reject (#45197) - `border` is no longer built from longhands unless the rule also sets what `border` resets (`border-image`), and an author's `border-image` reset is no longer dropped. `transition` is likewise only written where the rule wrote one, because it resets `transition-behavior` (#42072) - `border; border-image: <gradient>; border-image-slice: 1` lost the gradient in every default build (#42018) - A prefixed `linear-gradient` keeps its direction, written or generated: the prefixed syntax names the starting side and measures angles differently (#46697) **At-rules** - Print @font-face format() keywords as strings (#37979). 439 real stylesheets - Print @supports `not` conditions without a leading space (#38559). 88 real stylesheets - Reset after the number token of a unicode-range (#45835). 33 real stylesheets - Keep `<general-enclosed>` media and container conditions as written (#46756). 24 real stylesheets - A strict range such as `(width < 768px)` lowered for old targets still matched at exactly 768px. The step is now `.02px`. The `not all and` form for other units is not taken (#46806). 18 real stylesheets - Keep scanning an @supports condition after a nested block (#38552). 9 real stylesheets - Every `@counter-style name` printed as `@counter-stylename`, which browsers drop (also #46692). In a CSS module the name now stays global, like the `list-style` that refers to it (#33679). 9 real stylesheets - Keep a keyframe whose block has an invalid item (#46288). 2 real stylesheets - Read an @Property initial-value on the stylesheet's parser, keep an unmatched value as written (#45806). 2 real stylesheets - `@media {}` is `all`. A media query that stops after `and`, `or` or `not` (`@media screen and {`) is a build error; `main` printed `not all` or dropped the condition, silently. The `@layer` and type selector parts are not taken (#46869). 2 real stylesheets - Accept a name-only `@container` and a `style()` feature with no value (#46689). 1 real stylesheets - Parse `<timeline-range-name> <percentage>` keyframe selectors (#45652) - Allow `or` inside parentheses after a media type (#45088) - Print the `=` comparison in media and container queries as `=` (#45071) - Parse the @font-palette-values font-family descriptor as a list of family names (#45484) **Selectors** - Never wrap a selector list in :is() (#46787). 414 real stylesheets - Stop emitting :-webkit-any() copies of :is() that outrank the original rule (#42029). 373 real stylesheets - With browser targets, a selector list with a vendor-prefixed member was split, which revives hacks that rely on other engines dropping the whole list: `.s *::-ms-backdrop,.s{flex:auto}` applied everywhere. Rewritten; the list is printed as written (#42100). 42 real stylesheets - Print the vendor prefix on downleveled :any-link, :read-only, :read-write, :placeholder-shown and :autofill (#42131). 12 real stylesheets - Fix nesting lowering of a `&` that does not lead its selector (#43047). 8 real stylesheets - `@scope`: `&` and implicit selectors compile to `:where(:scope)`, relative selectors and bare declarations parse (#43165). 7 real stylesheets - Only reject bare :global / :local pseudo-classes in CSS modules (#38534). 5 real stylesheets - Stop truncating `@scope to (...)` and stop replacing `&` in the scope-end selector (#43146). 2 real stylesheets - `[xl|href$=".pdf"]` lost its namespace prefix (#45159). 2 real stylesheets - Match An+B keywords exactly and take only `+` as the leading sign (#42953). 1 real stylesheets - Parse ::details-content and ::picker() like ::part() (#45504). 1 real stylesheets - Parse :window-inactive as an ordinary pseudo-class, and accept it after ::selection (#45815) - Print :nth-col(1) and :nth-last-col(1) in functional form (#41575) - `li::before::marker` failed the build (#45810) - `&` inside `:nth-child(... of S)` is resolved when nesting is compiled away. The second selector serializer (326 lines) is deleted (#43024) **Colors and `Bun.color`** - Keep light-dark() as written under the default browser targets (#42009). 227 real stylesheets - Number and percentage channels parse in `lab()`, `lch()`, `oklab()`, `oklch()`, `hsl()` and `hwb()`; the hue of `lch` / `oklch` is no longer scaled by alpha (#45084). 130 real stylesheets - `Bun.color` returns `null` for `currentColor`, system colors and `light-dark()` in the converting formats, instead of the CSS keyword as a string (#33047). 130 real stylesheets - Relative colors: channel keywords are on the scale of their function (`rgb(from #369 calc(r + 10) g b)`), the origin's alpha is kept, a relative color kept as written gets no `@supports` copies, and a result outside sRGB is not folded (#45362). 31 real stylesheets - Keep rotate: 0deg out of none, and keep the origin alpha in relative colors (#38486). 13 real stylesheets - Compute the D50 reference white in f32 so greys convert to lab(l 0 0) like lightningcss (#38535). 7 real stylesheets - Return a missing hue for a grey from conversions into lch, oklch, hsl and hwb (#45201). 5 real stylesheets - Fix color(a98-rgb), srgb-linear relative colors and color-mix(in xyz-d50) (#38487). 4 real stylesheets - Match named colors without regard to ASCII case (#45092). 3 real stylesheets - Fold min(), max() and clamp() over plain numbers (#39515) - `calc(l - .08)` in a percentage channel of a relative color became NaN and printed `#000` (also #45970) (#45971) - Bun.color: convert color() inputs instead of returning them as a CSS string (#38488) - A `color-mix(in srgb, ...)` result outside sRGB prints `color(srgb ...)` instead of a gamut-mapped hex (#39269) **`calc()` and numbers** - Rounding to 6 significant digits ate into the integer part: `z-index:2147483647` became `2147480000`, `max-width:9999999px` became `10000000px`, `--x:1234567.5` became `1234570`. It now only cuts a fraction short: a value kept as tokens prints its source text, a typed value prints every integer digit and at least one digit of the fraction (#46715). 43 real stylesheets - A number without a unit is no longer repaired into `px` (`height:1.5715` is dropped by a standards-mode browser, so it prints as written), `calc(-1 * 0)` is not a length, and on a property of the range [0,∞] (sizes, border radii, padding, border and outline widths, gap, `flex-basis`, `font-size`) a `calc()` that folds below zero prints `0` instead of an invalid negative literal, and a negative literal no longer replaces the valid declaration before it (`width:10px;width:-5px` printed `width:-5px`) (#42104). 24 real stylesheets - Print numbers from the f32's shortest digits, not its f64 expansion (#38565). 17 real stylesheets - Print negative numbers below 1 with a single minus sign (#38516) - Keep math functions over two different length units as written (#38489) - Fold rem() with a truncated quotient, so it keeps the sign of the dividend (#32286) - A one-argument `min()` / `max()` around a sum printed without any function (`width:100% - 20px`) (#46145) - `round()` breaks ties upward and handles a negative step as browsers do (#45249) **CSS modules** - A CSS module exports its `@keyframes` names (`styles.spin`). Hashing is unchanged (#46720). 145 real stylesheets - A name inside `:global(...)` prints plain but was exported as `name_<hash>`, a class no rule has (also #38573) (#45487). 90 real stylesheets - Keep container names global in CSS modules (#45247). 6 real stylesheets - Tag the keyframes name when an `animation` value falls back to raw tokens (#46034). 6 real stylesheets - In a plain stylesheet `composes: a from "./b.css"` was treated as an import: the file was inlined and an absolute path printed (#45961). 4 real stylesheets - Drop a rejected composes instead of failing the file at print time (#38538). 1 real stylesheets - Keep every rule's custom properties for the composes conflict check (#38523) - Keep composes working after a nested rule in the same block (#38520) - `IdentOrRef::hash` read 2 of 16 bytes, so in release builds every class of a module hashed alike (#30784) **Tokens, `url()`, diagnostics** - The block skip stack no longer allocates on every block exit (#39533) - Report the diagnostic's line without its line breaks in position.lineText (#38342). 192 real stylesheets - Compare `url()` values by their text (#46895). 26 real stylesheets - Values kept as tokens keep the blanks they were written with instead of having them re-invented at print time: `attr(x type(<number>))` printed `type(< number> )`, which browsers drop. Minified output still drops the blanks that cannot matter (#45577). 19 real stylesheets - The IE star hack (`*zoom:1`) failed the whole build. The declaration is skipped, as every browser does. It is the one syntax error that builds: tachyons, handsontable and jasmine ship it (#46751). 8 real stylesheets - The path of a copied asset spliced into `url()` is always quoted, so a file name with a space or a parenthesis cannot end the `url()` (#41557). 7 real stylesheets - Move the skip loop of parse_until_before out of the generic body (#39520) - Remove dead code from bun_css: the unused `impl Default for Property` (#45618) - Default the at-rule and qualified-rule parser traits, drop the url_to_css shim (#31999) **Speed** Four inputs that took quadratic or exponential time, or produced output out of proportion, are now linear, with no new limit and no extra pass (#31639, #42243, #38531, #43421). **Tests only** - `css-fuzz.test.ts` never ran in CI and timed out on debug builds; it is a deterministic table now (#38500) - `nth-anplusb-ident.test.ts` counts heaps in a child process (#46331) - `color.test.ts` checks the ansi-16 sweep with one `expect()` (#42824) - Not CSS, but it failed this PR's CI and fails on `main` too: `ws-proxy.test.ts` on Windows, "a message sent during a TLS renegotiation arrives after it". The helper server now renegotiates from the callback of the frame's write (#46170) **No pull request covered these** - `--v: 5.0.1` printed as `5.1`, `--w: 1.0.0` as `10`, `--x: 1+2` as `12`, `2n+1` as `2n1`: a number token that touches another keeps its source text. - `color-scheme: auto` printed as `normal`, and `color-scheme: dark light` as `light dark`. - A bare `:global` or `:local` in a CSS module sets the scope of the names after it, up to the end of the selector, as in css-loader. It was a build error. - The scrollbar states (`a:horizontal`, `::-webkit-scrollbar{&:horizontal{}}`) are valid in a plain compound, as in WebKit and Blink. - Without browser targets, `-webkit-box-align`, `-ms-flex-align` and the like were dropped next to their standard form (flatpickr, foundation-sites, materialize-css: 28 stylesheets), and `-webkit-fill-available` before `-moz-available` (beercss). - `(-o-min-device-pixel-ratio: 2/1)` printed as `2`. - `sin()`, `cos()` and `tan()` are exact at multiples of 90deg: `calc(100px * cos(90deg))` printed `-.00000437114px`. - A `display-p3` color at targets that have P3 but not the other `color()` spaces (Safari 10.1 to 14) got itself as a fallback. - `width: rem(-18px, 5px)` folds to a negative literal once `rem()` is right; it prints `0`. - Consecutive nested declarations rules, which arise when same-query `@media` blocks in one rule merge, are folded into one and count against the existing selector expansion limit as the `&{}` rules they replace did. #### Known and not fixed here - Four longhands are still folded into a `transition` the author did not write where the targets add a prefixed copy of a property (`mask-image` at Chrome 80): only the shorthand gives the copy its own times. - A later `background`, `box-shadow` or `border-*` declaration still loses to the `@supports` copy of an earlier `var()` value of the same property with a wide-gamut color. Same on `main`; #45560 is taken for the properties of the fallback handler and for unparsed values only. - A merged rule prints the unprefixed name in the passes of the rule it absorbed: `.d::-webkit-input-placeholder{}.d::-moz-placeholder{}` prints `::placeholder` for the second (#42106, not taken: it breaks the merge of prefix-equivalent rules). - The `border`, `outline` and `font` shorthands, `line-height`, `scroll-padding`, `background-size` and a few more still print a `calc()` that folds below zero as a negative literal. No real stylesheet has one. - `all` is not a property Bun knows, so `a{margin-top:1px;all:unset}` prints `all` first. Same on `main`. - A selector kept as raw tokens loses the blank before `*` when minified: `--sel: .dark *` prints `.dark*`. Same on `main`. - `width:calc(0% + 12px)` folds to `12px`, which lays out differently in a table cell. Same on `main`. - The `:dir()` / `:lang()` rules of a lowered logical property print before the nested rules of their rule, so a logical declaration written after a nested rule of equal specificity still loses to it. Same on `main`. - A fraction is still rounded to 6 significant digits (`12345.678` prints `12345.7`, `33.3333333333%` prints `33.3333%`). Keeping every digit would add up to 282 KB over the corpus. - `@keyframes "quoted"` is hashed in a module but not exported. - In a module, a keyframes name inside a `var()` fallback is not hashed: `animation: var(--enter, fade 1s)`. Same on `main`. - A `color-mix()` or relative color folded to a hex inside a gradient changes the interpolation from Oklab to sRGB (VS Code, clawhub). Printing `color(srgb ..)` instead needs a fallback for `mask-image`, `list-style-image` and custom properties at the default targets, which have none. - A comma list in `@container` still fails the build. - After a bare `:global`, names that are hashed at print time (`::view-transition-old(foo)`) are still hashed; inside `:global(...)` they are not. #### Pull requests in scope that do not land here - Duplicates of a pull request that lands here: #36961 (of #37979), #38478 (of #46662), #38480 (of #46733), #38482 (of #46715), #38491 (of #38500), #38508 (of #45201), #38513 (of #45362), #38573 (of #45487), #38640 (of #38500), #45525 (of #45247), #45589 (of #46756), #45970 (of #45971) - Already fixed on `main`: #38674 - Right, but for input nobody writes (0 of 10,116 stylesheets, and not new syntax): #31916, #38526, #38592, #39349, #41139, #41801, #42042, #42484, #43078, #45604, #45908, #46086, #46221, #46224, #46273, #46694, #46707, #46737, #46755, #46816, #46870, #46934 - Right or harmless, but not worth their code, their bigger output or the behavior they change: #30905, #31924, #33332, #34426, #36225, #38006, #38512, #38547, #38551, #38561, #38572, #38576, #38607, #38623, #38667, #38692, #42106, #42912, #42918, #43407, #43434, #44700, #45442, #45546, #45747, #45759, #45825, #45946, #46061, #46127, #46206 - Need a decision (see above), stay open: #40368, #40369, #44647, #44648, #45814 - Stays open: #45787 Out of scope: CSS linking and chunking in the bundler, the dev server, docs-only pull requests, and repository-wide sweeps that touch `src/css` in passing. Thanks to @mikamikasuki (#45247), @alii (#39520, #31999) and @oddharsh, whose measurements on #40369 and #41990 were used. Fixes #16727. Fixes #24770. Fixes #30772. Fixes #44704. Fixes #45089. Fixes #45237. Fixes #46872. ### How did you verify your code works? - The 35 CSS test files pass on a debug build, also with `FORCE_COLOR=1`. 600+ of the tests in this branch fail on a build of `main`. An earlier head of this branch passed all 179 CI jobs that ran. - The reproduction of each issue listed above was run on `main` (wrong) and on this branch (right). - Differential run over the 10,116 stylesheets, `main` against this branch, minified without targets and through `Bun.build` at the default targets: no stylesheet that builds on `main` fails; Chromium 156 compares the output with the input rule by rule (CSSOM, then computed values on a sized element in a standards-mode document, colors as painted pixels in sRGB and P3). The comparison has 195 control pairs that must read equal or different. For stylesheets that read differently on both builds, mostly because of lowering, the sets of differences were compared; the three new ones are two minifier fixtures that are wrong on both and one comparison artifact. - CSS modules are checked for consistency instead, since hashed names defeat the comparison: every reference points at a name the output defines, every export exists. - `Bun.color`: 59 inputs in 13 formats on both builds; every changed cell was read.

robobun · 2026-10-28T07:06:35Z

Closing: the change of this PR is on main. #46825 (8a0e49e) carries both hunks of test/js/web/websocket/proxy-test-utils.ts unmodified, and the reverse of this diff applies cleanly to main at 11c3671.

github-actions Bot added the claude label Oct 20, 2026

robobun mentioned this pull request Oct 20, 2026

WebSocket client: follow-up fixes to #45223 #45720

Merged

claude Bot reviewed Oct 20, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into robobun/194aeb21/ws-p…

1441385

…roxy-renegotiate-after-write

dylan-conway mentioned this pull request Oct 24, 2026

node:http: make writableFinished a flag and report the flush to end() callbacks #46675

Open

dylan-conway mentioned this pull request Oct 24, 2026

ci: run clippy for Windows and macOS too, and fix what it finds #46696

Open

robobun mentioned this pull request Oct 24, 2026

bake: build the server and SSR transpilers for bun #46702

Open

dylan-conway mentioned this pull request Oct 25, 2026

bun_core::String can no longer borrow (fixes a source-map name use-after-free) #46825

Merged

Jarred-Sumner added a commit that referenced this pull request Oct 27, 2026

test(ws-proxy): renegotiate only after the "renegotiating" frame is w…

20324cf

…ritten (#46170)

Jarred-Sumner mentioned this pull request Oct 27, 2026

css: consolidate the open CSS parser fixes #47025

Merged

robobun closed this Oct 28, 2026

Navigation Menu

Repository navigation

test(ws-proxy): renegotiate only after the "renegotiating" frame is written - #46170

test(ws-proxy): renegotiate only after the "renegotiating" frame is written#46170
robobun wants to merge 2 commits into
mainfrom
robobun/194aeb21/ws-proxy-renegotiate-after-write

robobun commented Oct 20, 2026 •

edited

Loading

Uh oh!

robobun commented Oct 20, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

Review limit reached

Uh oh!

robobun commented Oct 20, 2026 •

edited

Loading

Uh oh!

robobun commented Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

robobun commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Background

Uh oh!

robobun commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

robobun commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

robobun commented Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

robobun commented Oct 20, 2026 •

edited

Loading

robobun commented Oct 20, 2026 •

edited

Loading

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

robobun commented Oct 20, 2026 •

edited

Loading