Who contributed to Node.js on June 19, 2026?

2 developers shipped this update, including bogomya and dependabot[bot].

What were the notable Node.js updates?

fix(retry): keep flow-control wired to the active connection across resumes, build(deps-dev): bump esbuild from 0.28.0 to 0.28.1, and Bump actions/checkout from 6 to 7.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

UNDICI FIXES RETRY HANG ON LARGE DOWNLOADS

By RepoJournal · Filed 06:01 UTC on June 19, 2026 · About Node.js

2 people shipped this

dependabot[bot] @dependabot[bot] 3 cited

bogomya @bogomya 1 cited

Undici patched a critical bug where retried Range requests hung indefinitely under backpressure, reproducibly freezing downloads over 1GB from S3.

The RetryAgent was losing flow-control wiring when transparently resuming a connection mid-stream, leaving the socket live but the reader dead [1]. This is the kind of silent hang that kills production jobs without error logs. In parallel, esbuild 0.28.1 shipped a security fix blocking backslash characters in local dev server HTTP requests [2], a small but necessary hardening. Across the Node.js ecosystem, maintenance is steady: full-icu-npm completed its actions/checkout migration to v7 [3], fixing fork PR security checks, while corepack bumped to 6.0.3 [4]. Most of these are dependency hygiene. The undici retry fix is the one that matters for anyone streaming large files or resuming downloads.

Action items

→ Update undici to pick up the RetryAgent backpressure fix [ref:8] nodejs/undici [immediate]
→ Upgrade esbuild to 0.28.1 if you run a local dev server [ref:7] evanw/esbuild [plan]
→ Monitor retry patterns in production after undici upgrade for any edge cases nodejs/undici [monitor]

References

[1] fix(retry): keep flow-control wired to the active connection across resumes ↗ nodejs/undici
[2] build(deps-dev): bump esbuild from 0.28.0 to 0.28.1 ↗ nodejs/undici
[3] Bump actions/checkout from 6 to 7 ↗ nodejs/full-icu-npm
[4] build(deps): bump actions/checkout from 6.0.2 to 6.0.3 ↗ nodejs/corepack

Quick answers

What shipped in Node.js on June 19, 2026?: Undici patched a critical bug where retried Range requests hung indefinitely under backpressure, reproducibly freezing downloads over 1GB from S3. In total, 6 commits and 7 pull requests landed.
Who contributed to Node.js on June 19, 2026?: 2 developers shipped this update, including bogomya and dependabot[bot].
What were the notable Node.js updates?: fix(retry): keep flow-control wired to the active connection across resumes, build(deps-dev): bump esbuild from 0.28.0 to 0.28.1, and Bump actions/checkout from 6 to 7.

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.