⚠️ Security release Fix for GHSA-4mh8-r7rc-xpvc What's Changed [Backport 5.x] perf: reduce content-type parser overhead by @github-actions[bot] in #7019 [Backport 5.x] perf: avoid redundant request-part reads during validation by @github-actions[bot] in #7020 Full Changelog: v5.12.4...v5.12.5
Fixed the fastify.js version mismatch. Full Changelog: v5.12.2...v5.12.4
⚠️ Security release Fix for GHSA-9q9j-q6p8-xq58 Fix for GHSA-hwr6-493r-vm6h Fix for GHSA-p68q-wchp-6fh7 Fix for GHSA-667r-xxjv-c9mm What's Changed docs: fix broken links in Style-Guide.md by @Snehal-Pradhan in #6966 test(types): assert LogController.requestCompleted accepts an undefined error by @suzunn in #6875 fix: callNotFound should run not-found preHandler regardless of registration order by…
⚠️ Security release Fix for GHSA-9q9j-q6p8-xq58 Fix for GHSA-hwr6-493r-vm6h Fix for GHSA-p68q-wchp-6fh7 Fix for GHSA-667r-xxjv-c9mm What's Changed [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @github-actions[bot] in #6973 [Backport 5.x] chore: npm ignore remaining agent files by @github-actions[bot] in #7003 Full Changelog: v5.12.1...v5.12.2
⚠️ Security release Fix for GHSA-w2qp-rph6-63g4 Fix for GHSA-3m5p-2c4r-xxw2 What's Changed test: fix reply.mediaType by @climba03003 in #6949 ci: allow backport in pr title by @climba03003 in #6948 fix: run preClose hook exactly once per declaring instance by @contactjawad in #6940 docs: remove deprecated-API notices ahead of v6 cleanup by @Tony133 in #6951 fix: report canonical route url for hidd…
⚠️ Security release Fix for GHSA-w2qp-rph6-63g4 Fix for GHSA-3m5p-2c4r-xxw2 What's Changed [Backport 5.x] test: fix reply.mediaType by @github-actions[bot] in #6950 [Backport 5.x] ci: allow backport in pr title by @github-actions[bot] in #6952 [Backport 5.x] fix: run preClose hook exactly once per declaring instance by @github-actions[bot] in #6954 [Backport 5.x] fix: report canonical route url fo…
What's Changed fix: remove raw response headers by @Ram-blip in #6860 test: use process-warning spyWarning for testing by @climba03003 in #6887 feat: add Reply.prototype.mediaType by @LiviaMedeiros in #6932 fix(content-type): return undefined for invalid media types by @jean-michelet in #6942 Full Changelog: v6.0.0-alpha.0...v6.0.0-alpha.1
What's Changed chore(sponsor): add testmu ai by @Eomm in #6922 docs: add per-route logging for Google Cloud Functions by @slegarraga in #6907 test: remove @sinonjs/fake-timers by @climba03003 in #6934 [Backport 5.x] fix: remove raw response headers by @github-actions[bot] in #6939 [Backport 5.x] test: use process-warning spyWarning for testing by @github-actions[bot] in #6945 [Backport 5.x] feat:…
What's Changed refactor: revert misleading error "Fastify instance is already listening" by @jean-michelet in #6098 refactor(types)!: remove deprecated FastifyPlugin type by @Tony133 in #6897 ci!: increase minimum runtime version by @climba03003 in #6904 refactor(types)!: remove deprecated FastifyLoggerInstance in favor of FastifyBaseLogger by @Tony133 in #6906 refactor!: remove Promise.withResolv…
What's Changed fix fastify version in fastify.js Full Changelog: v5.11.1...v5.11.2
What's Changed fix: clear trailer state when removing all trailers by @Ram-blip in #6845 docs: document percent-decoded route params as untrusted input by @mcollina in #6903 docs(errors): document what the default error handler sends by @basteez in #6894 docs(readme): fix grammar and cjs capitalization by @minirang in #6899 fix: pass null instead of undefined to requestCompleted on success by @laz…
What's Changed fix: add http method override warning by @jean-michelet in #6879 fix(types): allow explicit http2: false in server options by @Tony133 in #6888 docs: clarify what attachValidation exposes on request.validationError by @basteez in #6891 fix: do not force close in-flight connections when forceCloseConnections is 'idle' by @aquie00t in #6889 New Contributors @basteez made their first c…
What's Changed chore: Bump markdownlint-cli2 from 0.22.1 to 0.23.0 by @dependabot[bot] in #6839 fix: normalize method in findRoute by @Ram-blip in #6838 docs: fix incorrect description for validateInput in Request.md by @thePranav-kpk in #6823 feat: rfc10008 http query method by @climba03003 in #6832 perf: reuse cached content types for response serialization by @gurgunday in #6854 chore(sponsor):…
What's Changed docs(type-providers): clarify as const usage by @smith558 in #6772 docs: fix broken and redirected links by @Eomm in #6817 docs: remove marko from @fastify/view engines (support dropped) by @EduardF1 in #6821 fix: clear socket._meta on reply.hijack() when onTimeout is registered by @nerkoux in #6810 docs: fix duplicate routeOptions entries in Request.md example by @thePranav-kpk in…
What's Changed feat: add request.mediaType by @climba03003 in #6653 docs: remove deprecated leveldb plugin and update ecosystem by @Tony133 in #6661 chore(sponsor): add bestforandroid by @Eomm in #6659 ci: drop Node.js 20 from yarn matrix in package-manager-ci.yml by @Tony133 in #6662 fix: prevent duplicate res.end in sendTrailer with sync callbacks by @climba03003 in #6676 fix: avoid duplicate cl…
⚠️ Security Release This fixes CVE CVE-2026-33806 GHSA-247c-9743-5963. What's Changed chore: Fix port parsing by @jsumners in #6603 chore: upgrade to typescript v6.0.2 by @Tony133 in #6605 fix: restore trustProxy function for number and string types, add null check for socketAddr by @mcollina in #6613 ci: reduce cron scheduled workflows from daily/weekly to monthly by @Fdawgs in #6623 chore: Bump…
Full Changelog: v5.8.3...v5.8.4
⚠️ Security Release This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf. What's Changed docs(readme): add @Tony133 to plugin team by @Tony133 in #6565 Updated Plugins-Guide.md; Changed "fastify" to "instance" during plugin registration to showcase that it's added as a child by @kyrylchenko in #6566 test: use fastify.test in test case by @climba03003 in #6568 docs: use fastify.example in documentation…
What's Changed docs(ecosystem): add @yeliex/fastify-problem-details by @yeliex in #6546 Revert "chore: upgrade borp to v1.0.0" by @climba03003 in #6564 docs: document body validation with custom content type parsers by @mcollina in #6556 docs(ecosystem): add fastify-file-router by @bhouston in #6441 docs: add fastify-svelte-view to Ecosystem list by @matths in #6453 fix: anchor keyValuePairsReg to…
⚠️ Security Release Fixes "Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation": GHSA-573f-x89g-hqp9. CVE-2026-3419 Full Changelog: v5.8.0...v5.8.1
What's Changed docs(request): add host security warning references by @mcollina in #6476 docs: fix note style by @Fdawgs in #6487 chore: rename deploy website ci by @Eomm in #6492 chore: support pino v9 and v10 by @mcollina in #6496 chore: update logger types and fix TODO comment by @Tony133 in #6470 refactor(test-types): migrate dummy-plugin to FastifyPluginAsync by @Tony133 in #6472 docs: fix ma…
Full Changelog: v5.7.3...v5.7.4
⚠️ Security Release Fix GHSA-mrq3-vjjr-p77c CVE-2026-25224. What's Changed docs: update Reply.send() documentation for string serialization by @mcollina in #6466 chore: ignore agents config files by @mcollina in #6474 docs: update vulnerability reporting to use GitHub Security by @mcollina in #6475 Full Changelog: v5.7.2...v5.7.3
⚠️ Notice ⚠️ Parsing of the content-type header has been improved to a strict parser in PR #6414. This means only header values in the form described in RFC 9110 are accepted. What's Changed chore: npm ignore AI related files by @climba03003 in #6447 chore: update sponsor url by @Eomm in #6450 docs: add fastify-http-exceptions to Ecosystem.md by @bhouston in #6442 docs: fix invalid shorten form sc…