# What changed in fetch-nodeshim

> 19 changes in fetch-nodeshim 0.4 from its official release notes, upgrade guides and advisories: 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/fetch-nodeshim/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## fetch-nodeshim 0.4

### Security

- Protects against an invalid Location URI. (0.4.3) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.3)

### New APIs and options

- Adds configurable connectTimeout to override the connection timeout. (0.4.9) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.9)

### Behavior and default changes

- The default connection timeout is now also 30s when the request Accept header contains text/html. (0.4.9) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.9)
- The socket is unrefed for a more limited state, refed while the body is being read, and unrefed again when reading stops. (0.4.4) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.4)
- Adds a sane default timeout to http.request. (0.4.1) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.1)
- Automatically creates and uses agents when HTTP_PROXY, HTTPS_PROXY, or NO_PROXY is set. (0.4.0) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.0)

### Fixes and other changes

- Header casing is preserved when headers are passed as a tuple list or dictionary rather than as a Headers object. (0.4.10) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.10)
- Fixes fetch(new Request(...), init) so that init takes precedence over the request. (0.4.8) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.8)
- Fixes Set-Cookie casing on older Node versions. (0.4.7) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.7)
- For string inputs, an already-set Content-Type is no longer overridden. (0.4.5) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.5)
- Sets `Content-Length: 0` when a PATCH response body is null. (0.4.3) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.3)
- Propagates errors for duplex request/response streams and ensures early errors reach the Response stream. (0.4.3) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.3)
- Requests that time out now issue an explicit `ETIMEDOUT`. (0.4.3) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.3)
- Protects against a missing `Symbol.toStringTag`. (0.4.3) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.3)
- Fixes a typo in NO_PROXY construction. (0.4.3) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.3)
- Resets `requestOptions.agent` on retry or redirect. (0.4.3) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.3)
- Fixes Set-Cookie list handling by capturing values with `Headers#append`. (0.4.3) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.3)
- The incoming socket is unreferenced when the timeout is disabled, preventing body streams that never start from keeping processes alive. (0.4.2) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.2)
- Prevents an outright error when the flag is set and Request, Response, FormData, and Headers are unavailable globally. (0.4.0) — [release notes](https://github.com/kitten/fetch-nodeshim/releases/tag/v0.4.0)