fetch in bun 1.3.4 may contains break changes

[morlay]

What version of Bun is running?

1.3.4+5eb2145b3

What platform is your computer?

Darwin 25.1.0 arm64 arm

What steps can reproduce the bug?

bunx --bun taze -w -r latest
ERROR

chalk unknown error
FetchError: request to https://registry.npmjs.org/chalk failed, reason: fetch() proxy object requires a 'url' property
es-toolkit unknown error
FetchError: request to https://registry.npmjs.org/es-toolkit failed, reason: fetch() proxy object requires a 'url' property
globby unknown error
FetchError: request to https://registry.npmjs.org/globby failed, reason: fetch() proxy object requires a 'url' property
js-yaml unknown error
FetchError: request to https://registry.npmjs.org/js-yaml failed, reason: fetch() proxy object requires a 'url' property

What is the expected behavior?

No response

What do you see instead?

No response

Additional information

error throw in
https://github.com/npm/minipass-fetch
minipass-fetch/lib/index.js:130:18

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and agent prompts for this issue.

• Create Plan

Examples

• Example 1
• Example 2

🔗 Related PRs

#22523 - Fix tarball URL corruption in package manager [merged] | src/install/PackageManager/PackageManagerEnqueue.zig:
"""

AI-generated summary of changes

• Removed an empty line after var name = dependency.realname(); in enqueueDependencyWithMainAndSuccessFn. No behavioral, control-flow, or error-handling changes; only formatting.

Alterations to the declarations of exported or public entities

• None
  """

---

src/install/extract_tarball.zig:
"""

AI-generated summary of changes

• Added URL-aware basename extraction in ExtractTarball.extract(). If the computed name (tmp) starts with http:// or https://, derive tmp using std.fs.path.basename(tmp) and strip a trailing .tgz or .tar.gz extension (4 or 7 characters removed). This replaces the previous behavior which used the first '/' in the URL to derive the basename, which could yield an invalid path component. For non-URL names, the prior logic remains: if tmp starts with '@', trim the scope by dropping up to and including the first '/'. The rest of the extraction workflow remains unchanged.

• Introduced a clarifying comment and preserved existing Windows path handling and subsequent flow.

• No public API or function signatures were changed.

Alterations to the declarations of exported or public entities

• None

Estimated code review effort: Medium
"""

---

test/cli/install/bun-add.test.ts:
"""

AI-generated summary of changes

• Adds two identical integration tests named "should install tarball with tarball dependencies" to test/cli/install/bun-add.test.ts. The tests create a child tarball and a parent tarball, start a local Bun.serve server to host both tarballs, have the parent tarball depend on the child via the server URL, and then bun add the parent tarball URL. They verify both tarball packages are installed under node_modules and that the operation completes without errors. The patch contains two identical additions of the same test block.

Alterations to the declarations of exported or public entities

• No changes to exported/public entity signatures.

Estimated code review effort: High
"""
#24053 - ci: update bun version to 1.3.1 [merged] | scripts/bootstrap.ps1:
"""

AI-generated summary of changes

• Updated the Bun version used by Install-Bun from 1.2.17 to 1.3.1. No other functional changes or control-flow alterations are present.

Alterations to the declarations of exported or public entities

• None

Estimated code review effort: Medium
"""

---

scripts/bootstrap.sh:
"""

AI-generated summary of changes

• Updated the Bun version used by the bootstrap script from 1.2.17 to 1.3.1 in bun_version_exact. All other logic remains unchanged.

Alterations to the declarations of exported or public entities

• No changes to declarations of exported or public entities detected.

Estimated code review effort: Medium
"""

👤 Suggested Assignees

• robobun
• nektro

---

🧪 Issue enrichment is currently in early access.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

[Jarred-Sumner]

very strange.

okay we will investigate.

[morlay]

seems cause by the new feature https://bun.com/blog/bun-v1.3.4#custom-proxy-headers-in-fetch.

in minifetch. options of http/https.request() like:

{
  auth: "",
  host: "registry.npmjs.org",
  hostname: "registry.npmjs.org",
  path: "/%40morlay%2Fbunpublish",
  port: "",
  protocol: "https:",
  method: "GET",
  headers: [Object: null prototype] {
    "user-agent": [ "npm-registry-fetch@17.0.1/node@v24.3.0+arm64 (darwin)" ],
    Accept: [ "*/*" ],
    "Accept-Encoding": [ "gzip,deflate" ],
  },
  agent: Agent {
    _events: [Object: null prototype] {
      free: [
        [Function]
      ],
      newListener: [
        [Function: maybeEnableKeylog]
      ],
    },
    _eventsCount: 2,
    _maxListeners: undefined,
    [Symbol(kCapture)]: false,
    options: [Object: null prototype] {
      keepAliveMsecs: 1000,
      maxSockets: 12,
      maxTotalSockets: Infinity,
      maxFreeSockets: 256,
      scheduling: "fifo",
      algorithms: undefined,
      body: undefined,
      cache: "default",
      cachePath: undefined,
      ca: undefined,
      cert: undefined,
      headers: [Object ...],
      integrity: undefined,
      key: undefined,
      localAddress: undefined,
      memoize: undefined,
      method: "GET",
      retry: [Object ...],
      rejectUnauthorized: true,
      dns: [Object ...],
      cacheAdditionalHeaders: [],
      family: 0,
      keepAlive: true,
      hints: 1024,
      lookup: [Function: lookup],
      noDelay: true,
      path: null,
    },
    requests: [Object: null prototype] {},
    sockets: [Object: null prototype] {},
    freeSockets: [Object: null prototype] {},
    keepAliveMsecs: 1000,
    keepAlive: true,
    maxSockets: 12,
    maxFreeSockets: 256,
    scheduling: "fifo",
    maxTotalSockets: Infinity,
    totalSocketCount: 0,
    agentKeepAliveTimeoutBuffer: 1000,
    [Symbol(AgentBaseInternalState)]: {},
    proxy: [Getter],
    connect: [AsyncFunction: connect],
    addRequest: [Function: addRequest],
    isSecureEndpoint: [Function: isSecureEndpoint],
    incrementSockets: [Function: incrementSockets],
    decrementSockets: [Function: decrementSockets],
    getName: [Function: getName],
    createSocket: [Function: createSocket],
    createConnection: [Function: createConnection],
    defaultPort: [Getter/Setter],
    protocol: [Getter/Setter],
    removeSocket: [Function: removeSocket],
    keepSocketAlive: [Function: keepSocketAlive],
    reuseSocket: [Function: reuseSocket],
    destroy: [Function: destroy],
    setMaxListeners: [Function: setMaxListeners],
    getMaxListeners: [Function: getMaxListeners],
    emit: [Function: emit],
    addListener: [Function: addListener],
    on: [Function: addListener],
    prependListener: [Function: prependListener],
    once: [Function: once],
    prependOnceListener: [Function: prependOnceListener],
    removeListener: [Function: removeListener],
    off: [Function: removeListener],
    removeAllListeners: [Function: removeAllListeners],
    listeners: [Function: listeners],
    rawListeners: [Function: rawListeners],
    listenerCount: [Function: listenerCount],
    eventNames: [Function: eventNames],
  },
  ca: undefined,
  cert: undefined,
  ciphers: undefined,
  clientCertEngine: undefined,
  crl: undefined,
  dhparam: undefined,
  ecdhCurve: undefined,
  family: undefined,
  honorCipherOrder: undefined,
  key: undefined,
  passphrase: undefined,
  pfx: undefined,
  rejectUnauthorized: true,
  secureOptions: undefined,
  secureProtocol: undefined,
  servername: undefined,
  sessionIdContext: undefined,
  timeout: 300000,
}

no strange option found.
may issue in http/https of bun

[SpeedySH]

+1 1.3.4 broke all my npm publish pipes

[Araxeus]

I can confirm this started happening for me too

https://github.com/Araxeus/vendorfiles/actions/runs/20031992251/job/57443274962?pr=117

ERROR: FetchError: request to https://api.github.com/repos/junegunn/fzf/contents/LICENSE?Authorization=bearer%20***&ref=0.38.0 failed, reason: fetch() proxy object requires a 'url' property:

this should have been caught by a test, so when its fixed a test should probably be added :)