Avoid Safari/WebKit stalls during chunked ROM uploads

[Copilot]

Chunked ROM uploads could stall after the first few PUT /api/roms/upload/{id} requests in Safari/WebKit, while the same flow completed normally in Chromium-based browsers. The issue was isolated to the frontend upload path rather than the server-side chunk assembly flow.

• Chunked upload behavior

  • Detect Safari/WebKit-style user agents during chunked ROM uploads.
  • Skip axios onUploadProgress for those browsers, which avoids the WebKit-specific upload stall point.
  • Keep the existing per-chunk request, retry, cancel, and complete flow unchanged.

• Progress reporting

  • Preserve progress updates for Chromium-based browsers using the existing upload progress callback.
  • For Safari/WebKit, update progress when each chunk finishes so uploads still show forward progress without relying on WebKit upload-progress events.

• Scope

  • Limit the change to frontend/src/services/api/rom.ts.
  • Leave manual uploads and backend upload endpoints untouched.

const trackChunkUploadProgress = shouldTrackChunkUploadProgress();

await api.put(`/roms/upload/${upload_id}`, chunk, {
  headers: {
    "Content-Type": "application/octet-stream",
    "X-Chunk-Index": i.toString(),
  },
  timeout: 120000,
  ...(trackChunkUploadProgress && {
    onUploadProgress: (progressEvent: AxiosProgressEvent) => {
      const chunkFraction = progressEvent.progress ?? 0;
      const overall = ((i + chunkFraction) / totalChunks) * 100;
      uploadStore.updateChunkProgress(file.name, overall, file.size, progressEvent.rate);
    },
  }),
});

uploadStore.updateChunkProgress(file.name, ((i + 1) / totalChunks) * 100, file.size);

[gantoine]

@copilot can you confirm webkit is the issue here?

[Copilot]

@copilot can you confirm webkit is the issue here?

Not definitively. What I can confirm is that the failing path is browser-engine-specific: same server/upload flow works in Chromium, fails in Safari/WebKit, and the only client-side behavior I changed is Safari’s onUploadProgress path for chunked uploads. There is upstream evidence that Safari has axios upload-progress issues (axios/axios#6500), so this is a targeted mitigation for that Safari/WebKit-specific path rather than proof that WebKit alone is the root cause.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• bugs.webkit.org
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)
• developer.mozilla.org
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Works around a Safari/WebKit-specific stall observed during chunked ROM uploads by skipping axios's onUploadProgress callback on WebKit browsers, while preserving forward progress updates by emitting a per-chunk completion update.

Changes:

• Add shouldTrackChunkUploadProgress() that returns false for WebKit user agents that are not Chromium-based.
• Conditionally attach onUploadProgress to the chunk PUT request based on the above check.
• Always emit a chunk-completion progress update after each successful PUT.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​unidecode@​1.3.8
	pypi/​passlib@​1.7.4
	pypi/​pillow@​12.2.0
	npm/​bowser@​2.14.1
	pypi/​sqlalchemy@​2.0.41
	pypi/​gunicorn@​23.0.0
	pypi/​opentelemetry-instrumentation-aiohttp-client@​0.57b0
	pypi/​pyyaml@​6.0.1
	pypi/​fastapi@​0.121.1
	pypi/​defusedxml@​0.7.1
	pypi/​opentelemetry-instrumentation-redis@​0.57b0
	pypi/​colorama@​0.4.6
	pypi/​opentelemetry-instrumentation-sqlalchemy@​0.57b0
	pypi/​opentelemetry-instrumentation-fastapi@​0.57b0
	pypi/​opentelemetry-instrumentation-httpx@​0.57b0
	pypi/​joserfc@​1.6.3
	pypi/​httpx@​0.28.1
	pypi/​fastapi-pagination@​0.15.0
	pypi/​itsdangerous@​2.2.0
	pypi/​opentelemetry-distro@​0.57b0
	pypi/​opentelemetry-exporter-otlp@​1.36.0

View full report

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• frontend/package-lock.json: Language not supported