ky

Disclaimer: I used Fable 5 to debug and fix this issue. The title and description is also written by Claude. As a developer, I can confirm that this is a real issue and verified the fix myself. I have experienced this issue in two of my browser extensions in Firefox. Summary ky is currently unusable inside Firefox WebExtension content scripts: every request throws synchronously during request construction, before is ever called — even with zero headers or options configured. Chrome extensions are unaffected. Regressions like this are easy to miss because the throw happens inside the caller (e.g. a TanStack Query ), which often swallows it — the visible symptom is just "no requests are made, no errors anywhere". ky: 2.0.2 Firefox Developer Edition: 153.0b13 (manifest v3 extension, content script declared via in the manifest) Bundler: esbuild (no transforms relevant here — the shipped code contains the same iteration) Root cause In Firefox, content scripts see page DOM objects through Xray vision. Xray wrappers expose string-keyed WebIDL methods (, , , …) but filter out symbol-keyed properties — which means the pair-iteration protocol (, and the iterator objects returned by ) does not work on , , or in a content script. A two-line content script demonstrates it with no ky involved: does exactly this on every request — it runs unconditionally in the constructor (), constructing a even when both sources are empty, then pair-iterating it: https://github.com/sindresorhus/ky/blob/v2.0.2/source/utils/merge.ts#L64-L77 Chrome is unaffected because its content-script isolated worlds get their own native copies of these classes rather than wrappers, so iteration works there. All affected sites (request path) Fixing alone just moves the crash to the next iteration site. These are all of them in v2.0.2: 1. — , (the crash above; hit by every request) 2. — , (hit when is a ) 3. — string branch, 4. — searchParams→URL merge, (hit by every request using ) 5. — , over Repro Full runnable repro: https://github.com/timche/ky-firefox-content-script-repro It's a prebuilt manifest v3 extension — no build step needed: 1. Firefox → → Load Temporary Add-on… → select . 2. Open https://example.com and its DevTools console. 3. Both parts throw: the two-line pair-iteration demonstration (no ky involved), and the ky request, which dies synchronously in before — nothing appears in the Network tab. Loading the same folder in Chrome (steps in the README) shows the contrast: iteration works and the ky request reaches the network. The essence, for reference, is just a content script doing: Suggested fix Replace pair iteration with at the five sites — is a string-keyed WebIDL method that works through Xray wrappers, is supported everywhere is, and the change is semantics-preserving (same visitation order): I've verified this fix end-to-end: patched this way in our extension (via ), and all requests work in a test that simulates the Xray condition (strip / from the native classes) across plain GETs, records, with repeated keys, and JSON POSTs — plus in the real extension in Firefox. Workaround for anyone hitting this Patch the five sites to with your package manager's patch mechanism ( / ), or use a different HTTP client in Firefox content scripts.

Problem accepts a number as shorthand for (per the docs: "If is a number, it will be used as and other defaults will remain in place."). However, when a numeric is set on a parent instance and then extended with an object, the numeric limit is silently dropped and falls back to the default (): The reverse direction (object on the parent, number on the child) and the all-object case both work correctly — only the number → object merge loses data. Cause In , is merged like any other nested object. When the parent value is the numeric shorthand () and the incoming value is an object, the recursion ends up as . A non-object source is skipped entirely by , so the is discarded and only survives — the limit is lost. Fix Expand the numeric shorthand to before the deep merge, so extending it with an object preserves the limit. This mirrors the documented shorthand semantics and leaves every other case (object → object, object → number replacement, ) unchanged. Test Added a test in that sets on a parent, extends it with , and asserts the request is attempted times. It fails on (3 attempts) and passes with the fix (4 attempts).