npm / fetch-nodeshim
fetch-nodeshim
What changed in fetch-nodeshim 0.4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
1 security1 new APIs and options4 behavior and defaults13 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initfetch-nodeshim 0.419 changes
Security 1
Protects against an invalid Location URI.
New APIs and options 1
Adds configurable connectTimeout to override the connection timeout.
Behavior and default changes 4
The default connection timeout is now also 30s when the request Accept header contains text/html.
The socket is unrefed for a more limited state, refed while the body is being read, and unrefed again when reading stops.
Adds a sane default timeout to http.request.
Automatically creates and uses agents when HTTP_PROXY, HTTPS_PROXY, or NO_PROXY is set.
Fixes and other changes 13
Header casing is preserved when headers are passed as a tuple list or dictionary rather than as a Headers object.
Fixes fetch(new Request(...), init) so that init takes precedence over the request.
Fixes Set-Cookie casing on older Node versions.
For string inputs, an already-set Content-Type is no longer overridden.
Sets
Content-Length: 0when a PATCH response body is null.Propagates errors for duplex request/response streams and ensures early errors reach the Response stream.
Requests that time out now issue an explicit
ETIMEDOUT.Protects against a missing
Symbol.toStringTag.Fixes a typo in NO_PROXY construction.
Resets
requestOptions.agenton retry or redirect.Fixes Set-Cookie list handling by capturing values with
Headers#append.The incoming socket is unreferenced when the timeout is disabled, preventing body streams that never start from keeping processes alive.
Prevents an outright error when the flag is set and Request, Response, FormData, and Headers are unavailable globally.