129 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-11
stories 5

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Undici unrefs keep h2 WebSockets alive, adds private-field brand checks

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

Undici fixed an HTTP/2 WebSocket bug where the session was unref'd while a stream was still open, causing programs to exit with status 0 right after open, and moved brand checks to private fields.

Undici's HTTP/2 path no longer unrefs a session that still has open streams [1]. Once the h2 WebSocket handshake completed, `onUpgradeResponse()` completed the request and resumed the client; because the queue was empty (`client[kSize] === 0`), `resumeH2()` unref'd the session even though the WebSocket was still using that stream (`session[kOpenStreams]` was still 1). A program with nothing else holding the event loop therefore exited with status 0 right after `open`. The fix adds `session[kOpenStreams] === 0` to the unref condition [2].

The same PR body states the precondition plainly: "Once the h2 WebSocket handshake completes, `onUpgradeResponse()` completes the request and resumes the client" [1]. That is the moment the queue drains and the old unref logic fired.

Separately, KhafraDev moved undici's brand checks to private fields [3], inspired by nodejs/node#65846, with the change landing as commit 3c3db8d [4]. Brand checks now rely on private fields rather than the previous mechanism.

On the reliability desk, the Node.js GitHub Bot added the report for 2026-09-11 [5], a routine scheduled entry.

Quick answers

What shipped in Node.js on September 11, 2026?
Undici fixed an HTTP/2 WebSocket bug where the session was unref'd while a stream was still open, causing programs to exit with status 0 right after open, and moved brand checks to private fields. In total, 3 commits and 2 pull requests landed.
Who contributed to Node.js on September 11, 2026?
3 developers shipped this update, including Node.js GitHub Bot, KhafraDev, and kjsik11.
What were the notable Node.js updates?
fix(h2): do not unref a session with open streams, fix(h2): do not unref a session with open streams (#5782), and use private fields for brand checks.