RepoJournal
Node.js

@nodejs

The Node.js runtime — every backend team's CVE source of truth

Pick a date

  1. Thu 21 may
  2. Sat 23 may
  3. Sun 24 may
  4. Mon 25 may
  5. Tue 26 may
  6. Wed 27 may
  7. Thu 28 may
  8. Fri 29 may
  9. Sat 30 may
  10. Sun 31 may
  11. Mon 1 jun
  12. Mon 8 jun
  13. Tue 9 jun
  14. Wed 10 jun
  15. Thu 11 jun
  16. Fri 12 jun
  17. Sat 13 jun
  18. Sun 14 jun
  19. Mon 15 jun
  20. Tue 16 jun
  21. Wed 17 jun
  22. Thu 18 jun
  23. Fri 19 jun
  24. Sat 27 jun
  25. Sun 28 jun
  26. Mon 29 jun
  27. Tue 30 jun
  28. Wed 1 jul
  29. Thu 2 jul
  30. Today 3 jul

The Wire · Showcase

UNDICI FIXES RETRY HANG ON LARGE DOWNLOADS

By RepoJournal · Filed · About Node.js

Undici patched a critical bug where retried Range requests hung indefinitely under backpressure, reproducibly freezing downloads over 1GB from S3.

The RetryAgent was losing flow-control wiring when transparently resuming a connection mid-stream, leaving the socket live but the reader dead [1]. This is the kind of silent hang that kills production jobs without error logs. In parallel, esbuild 0.28.1 shipped a security fix blocking backslash characters in local dev server HTTP requests [2], a small but necessary hardening. Across the Node.js ecosystem, maintenance is steady: full-icu-npm completed its actions/checkout migration to v7 [3], fixing fork PR security checks, while corepack bumped to 6.0.3 [4]. Most of these are dependency hygiene. The undici retry fix is the one that matters for anyone streaming large files or resuming downloads.

Action items

References

  1. [1] fix(retry): keep flow-control wired to the active connection across resumes ↗ nodejs/undici
  2. [2] build(deps-dev): bump esbuild from 0.28.0 to 0.28.1 ↗ nodejs/undici
  3. [3] Bump actions/checkout from 6 to 7 ↗ nodejs/full-icu-npm
  4. [4] build(deps): bump actions/checkout from 6.0.2 to 6.0.3 ↗ nodejs/corepack

FAQ

What changed in Node.js on June 19, 2026?
Undici patched a critical bug where retried Range requests hung indefinitely under backpressure, reproducibly freezing downloads over 1GB from S3.
What should Node.js teams do about it?
Update undici to pick up the RetryAgent backpressure fix [ref:8] • Upgrade esbuild to 0.28.1 if you run a local dev server [ref:7] • Monitor retry patterns in production after undici upgrade for any edge cases
Which Node.js repositories shipped on June 19, 2026?
nodejs/undici, nodejs/full-icu-npm, nodejs/corepack

Related across the cluster

For your repos

The showcase is a teaser.
Your wire is the product.

Same engine. Different stack. Below: what changes when the wire is yours.

Showcase wire

  • •14 famous open source orgs
  • •One wire per day
  • •Public, generic
  • •Read on the web, when you remember

Your wire

  • →Up to 1,500 of your repos - orgs, deps, vendors
  • →Morning and evening briefs
  • →Action items routed to your team
  • →Slack delivery, email, breaking-news CVE alerts

Want a hands-on demo first? Ask a current user for an invite link.