@fastify/static 9.1.3 → 9.3.0

package/.gitattributes

@@ -1,5 +1,2 @@
-# Set the default behavior, in case people don't have core.autocrlf set
-* text=auto
-
-# Require Unix line endings
-* text eol=lf
+# Set default behavior to automatically convert line endings
+* text=auto eol=lf

package/.github/dependabot.yml

@@ -2,12 +2,52 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
     open-pull-requests-limit: 10
 
   - package-ecosystem: "npm"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    versioning-strategy: "increase-if-necessary"
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+    ignore:
+      # TODO: remove ignore until neostandard support ESLint 10
+      - dependency-name: "eslint"
+      - dependency-name: "neostandard"
+      - dependency-name: "@stylistic/*"
     open-pull-requests-limit: 10
+    groups:
+      # Production dependencies with breaking changes
+      dependencies:
+        dependency-type: "production"
+      # ESLint related dependencies
+      dev-dependencies-eslint:
+        patterns:
+          - "eslint"
+          - "neostandard"
+          - "@stylistic/*"
+      # TypeScript related dependencies
+      dev-dependencies-typescript:
+        patterns:
+          - "@types/*"
+          - "tstyche"
+          - "typescript"

package/README.md

@@ -114,7 +114,7 @@ fastify.get('/path/without/cache/control', function (req, reply) {
 ### Managing cache-control headers
 
 Production sites should use a reverse-proxy to manage caching headers.
-However, here is an example of using fastify-static to host a Single Page Application (for example a [vite.js](https://vite.dev/) build) with sane caching.
+However, here is an example of using fastify-static to host a Single Page Application (for example a [vite.js](https://vite.dev) build) with sane caching.
 
 ```js
 fastify.register(require('@fastify/static'), {
@@ -253,6 +253,8 @@ Default: `(pathName, root, request) => true`
 This function filters served files. Using the request object, complex path authentication is possible.
 Returning `true` serves the file; returning `false` calls Fastify's 404 handler.
 
+When using `preCompressed: true`, `allowedPath` receives the requested path before `.br` or `.gz` variants are selected; see the `preCompressed` note below before using extension-based access rules.
+
 #### `index`
 
 Default: `undefined`
@@ -470,6 +472,8 @@ Default: `false`
 
 First, try to send the brotli encoded asset (if supported by `Accept-Encoding` headers), then gzip, and finally the original `pathname`. Skip compression for smaller files that do not benefit from it.
 
+> ⚠ Warning: `allowedPath` is evaluated against the requested path before pre-compressed variants are selected. A request for `/file.txt` can serve `/file.txt.gz` or `/file.txt.br` when the client accepts that encoding, even if direct requests to `.gz` or `.br` files are denied by `allowedPath`. Treat pre-compressed files as public alternate encodings of the same asset: keep restricted compressed files outside the served root, disable `preCompressed`, or deny the base path too.
+
 Assume this structure with the compressed asset as a sibling of the uncompressed counterpart:
 
 ```

package/index.js

@@ -76,7 +76,7 @@ async function fastifyStatic (fastify, opts) {
         return
       }
 
-      fastify.errorHandler(error, request, reply)
+      return fastify.errorHandler(error, request, reply)
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/static",
-  "version": "9.1.3",
+  "version": "9.3.0",
   "description": "Plugin for serving static files as fast as possible.",
   "main": "index.js",
   "type": "commonjs",
@@ -10,7 +10,7 @@
     "lint": "eslint",
     "lint:fix": "eslint --fix",
     "test": "npm run test:unit && npm run test:typescript",
-    "test:typescript": "tsd",
+    "test:typescript": "tstyche",
     "test:unit": "borp -C --check-coverage --lines 100",
     "example": "node example/server.js",
     "example:benchmark": "node example/server-benchmark.js"
@@ -62,13 +62,13 @@
     "@fastify/accept-negotiator": "^2.0.0",
     "@fastify/send": "^4.0.0",
     "content-disposition": "^1.0.1",
-    "fastify-plugin": "^5.0.0",
+    "fastify-plugin": "^6.0.0",
     "fastq": "^1.17.1",
     "glob": "^13.0.0"
   },
   "devDependencies": {
-    "@fastify/compress": "^8.0.0",
-    "@types/node": "^25.0.3",
+    "@fastify/compress": "^9.0.0",
+    "@types/node": "^26.0.0",
     "autocannon": "^8.0.0",
     "borp": "^1.0.0",
     "c8": "^11.0.0",
@@ -78,10 +78,7 @@
     "neostandard": "^0.12.0",
     "pino": "^10.0.0",
     "proxyquire": "^2.1.3",
-    "tsd": "^0.33.0"
-  },
-  "tsd": {
-    "directory": "test/types"
+    "tstyche": "^7.0.0"
   },
   "publishConfig": {
     "access": "public"

package/test/static.test.js

@@ -2637,6 +2637,43 @@ test('routes should fallback to default errorHandler', async t => {
   })
 })
 
+test('routes should propagate return value from async custom errorHandler', async t => {
+  t.plan(3)
+
+  const pluginOptions = {
+    root: path.join(__dirname, '/static'),
+    prefix: '/static/'
+  }
+
+  const fastify = Fastify()
+
+  // An async error handler that returns its payload (without an explicit
+  // reply.send) relies on Fastify awaiting the returned promise. If
+  // @fastify/static does not propagate the return value of
+  // fastify.errorHandler(), the promise is dropped and the reply never
+  // resolves with the customized body.
+  fastify.setErrorHandler(async function (_error, _request, reply) {
+    reply.code(418).type('text/plain')
+    return 'handled by return value'
+  })
+
+  fastify.addHook('onRoute', function (routeOptions) {
+    routeOptions.preHandler = (_request, _reply, done) => {
+      const fakeError = new Error()
+      fakeError.code = 'SOMETHING_ELSE'
+      done(fakeError)
+    }
+  })
+
+  fastify.register(fastifyStatic, pluginOptions)
+  t.after(() => fastify.close())
+
+  const response = await fastify.inject({ method: 'GET', url: '/static/index.html' })
+  t.assert.deepStrictEqual(response.statusCode, 418)
+  t.assert.ok(response.headers['content-type'].startsWith('text/plain'))
+  t.assert.deepStrictEqual(response.body, 'handled by return value')
+})
+
 test('percent encoded URLs in glob mode', async (t) => {
   t.plan(3)
 

package/types/index.d.ts

@@ -82,18 +82,19 @@ declare namespace fastifyStatic {
 
   type Root = string | string[] | URL | URL[]
 
-  type RootOptions = {
-    serve: true;
-    root: Root;
-  } | {
-    serve?: false;
-    root?: Root;
-  }
+  type RootOptions =
+    | {
+      serve: true;
+      root: Root;
+    }
+    | {
+      serve?: false;
+      root?: Root;
+    }
 
-  export type FastifyStaticOptions =
-    SendOptions
-    & RootOptions
-    & {
+  export type FastifyStaticOptions = SendOptions &
+    RootOptions &
+    Omit<import('fastify').RegisterOptions, 'logLevel'> & {
       // Added by this plugin
       prefix?: string;
       prefixAvoidTrailingSlash?: boolean;
@@ -104,7 +105,11 @@ declare namespace fastifyStatic {
       wildcard?: boolean;
       globIgnore?: string[];
       list?: boolean | ListOptionsJsonFormat | ListOptionsHtmlFormat;
-      allowedPath?: (pathName: string, root: string, request: FastifyRequest) => boolean;
+      allowedPath?: (
+        pathName: string,
+        root: string,
+        request: FastifyRequest
+      ) => boolean;
       /**
        * @description
        * Opt-in to looking for pre-compressed files
@@ -123,7 +128,7 @@ declare namespace fastifyStatic {
       lastModified?: boolean;
       maxAge?: string | number;
       constraints?: RouteOptions['constraints'];
-      logLevel?: RouteOptions['logLevel'];
+      logLevel?: NonNullable<RouteOptions['logLevel']>;
     }
 
   export const fastifyStatic: FastifyStaticPlugin

package/types/{index.test-d.ts → index.tst.ts}

@@ -1,10 +1,10 @@
-import fastify, { FastifyInstance, FastifyPluginAsync, FastifyRequest, FastifyReply } from 'fastify'
-import { Server } from 'node:http'
-import { Stats } from 'node:fs'
-import { expectAssignable, expectError, expectType } from 'tsd'
+import fastify, { type FastifyInstance, type FastifyPluginAsync, type FastifyRequest, type FastifyReply } from 'fastify'
+import { type Server } from 'node:http'
+import { type Stats } from 'node:fs'
+import { expect } from 'tstyche'
 import * as fastifyStaticStar from '..'
 import fastifyStatic, {
-  FastifyStaticOptions,
+  type FastifyStaticOptions,
   fastifyStatic as fastifyStaticNamed
 } from '..'
 
@@ -21,15 +21,13 @@ app.register(fastifyStaticCjsImport.fastifyStatic, { root: __dirname })
 app.register(fastifyStaticStar.default, { root: __dirname })
 app.register(fastifyStaticStar.fastifyStatic, { root: __dirname })
 
-expectType<FastifyPluginAsync<FastifyStaticOptions, Server>>(fastifyStatic)
-expectType<FastifyPluginAsync<FastifyStaticOptions, Server>>(fastifyStaticNamed)
-expectType<FastifyPluginAsync<FastifyStaticOptions, Server>>(fastifyStaticCjsImport.default)
-expectType<FastifyPluginAsync<FastifyStaticOptions, Server>>(fastifyStaticCjsImport.fastifyStatic)
-expectType<FastifyPluginAsync<FastifyStaticOptions, Server>>(fastifyStaticStar.default)
-expectType<FastifyPluginAsync<FastifyStaticOptions, Server>>(
-  fastifyStaticStar.fastifyStatic
-)
-expectType<any>(fastifyStaticCjs)
+expect(fastifyStatic).type.toBe<FastifyPluginAsync<FastifyStaticOptions, Server>>()
+expect(fastifyStaticNamed).type.toBe<FastifyPluginAsync<FastifyStaticOptions, Server>>()
+expect(fastifyStaticCjsImport.default).type.toBe<FastifyPluginAsync<FastifyStaticOptions, Server>>()
+expect(fastifyStaticCjsImport.fastifyStatic).type.toBe<FastifyPluginAsync<FastifyStaticOptions, Server>>()
+expect(fastifyStaticStar.default).type.toBe<FastifyPluginAsync<FastifyStaticOptions, Server>>()
+expect(fastifyStaticStar.fastifyStatic).type.toBe<FastifyPluginAsync<FastifyStaticOptions, Server>>()
+expect(fastifyStaticCjs).type.toBe<any>()
 
 const appWithImplicitHttp = fastify()
 const options: FastifyStaticOptions = {
@@ -53,14 +51,14 @@ const options: FastifyStaticOptions = {
   globIgnore: ['**/*.private'],
   list: false,
   setHeaders: (res, path, stat) => {
-    expectType<string>(res.filename)
-    expectType<number>(res.statusCode)
-    expectType<ReturnType<FastifyReply['getHeader']>>(res.getHeader('X-Test'))
+    expect(res.filename).type.toBe<string>()
+    expect(res.statusCode).type.toBe<number>()
+    expect(res.getHeader('X-Test')).type.toBe<ReturnType<FastifyReply['getHeader']>>()
     res.setHeader('X-Test', 'string')
 
-    expectType<string>(path)
+    expect(path).type.toBe<string>()
 
-    expectType<Stats>(stat)
+    expect(stat).type.toBe<Stats>()
   },
   preCompressed: false,
   allowedPath: (_pathName: string, _root: string, _request: FastifyRequest) => {
@@ -73,64 +71,53 @@ const options: FastifyStaticOptions = {
   logLevel: 'warn'
 }
 
-expectError<FastifyStaticOptions>({
-  root: '',
-  wildcard: '**/**'
-})
-
-expectAssignable<FastifyStaticOptions>({
-  root: '',
-  list: {
-    format: 'json'
-  }
-})
-
-expectAssignable<FastifyStaticOptions>({
-  root: '',
-  list: {
-    format: 'json',
-    render: () => ''
-  }
-})
-
-expectAssignable<FastifyStaticOptions>({
-  root: '',
-  list: {
-    format: 'html',
-    render: () => ''
-  }
-})
+expect<FastifyStaticOptions>()
+  .type.toBeAssignableFrom({
+    root: '',
+    list: {
+      format: 'json' as const
+    }
+  })
 
-expectError<FastifyStaticOptions>({
-  root: '',
-  list: {
-    format: 'html'
-  }
-})
+expect<FastifyStaticOptions>()
+  .type.toBeAssignableFrom({
+    root: '',
+    list: {
+      format: 'json' as const,
+      render: () => ''
+    }
+  })
 
-expectAssignable<FastifyStaticOptions>({
-  root: ['']
-})
+expect<FastifyStaticOptions>()
+  .type.toBeAssignableFrom({
+    root: '',
+    list: {
+      format: 'html' as const,
+      render: () => ''
+    }
+  })
 
-expectAssignable<FastifyStaticOptions>({
-  root: new URL('')
-})
+expect<FastifyStaticOptions>()
+  .type.toBeAssignableFrom({
+    root: ['']
+  })
 
-expectAssignable<FastifyStaticOptions>({
-  root: [new URL('')]
-})
+expect<FastifyStaticOptions>()
+  .type.toBeAssignableFrom({
+    root: new URL('file://')
+  })
 
-expectError<FastifyStaticOptions>({
-  serve: true
-})
+expect<FastifyStaticOptions>()
+  .type.toBeAssignableFrom({ root: [new URL('file://')] })
 
-expectAssignable<FastifyStaticOptions>({
-  serve: true,
-  root: ''
-})
+expect<FastifyStaticOptions>()
+  .type.toBeAssignableFrom({
+    serve: true as const,
+    root: ''
+  })
 
-expectAssignable<FastifyStaticOptions>({
-  serve: false
+expect<FastifyStaticOptions>().type.not.toBeAssignableFrom({
+  serve: true as const,
 })
 
 appWithImplicitHttp
@@ -218,7 +205,7 @@ noIndexApp
     })
   })
 
-options.root = new URL('')
+options.root = new URL('file://')
 
 const URLRootApp = fastify()
 URLRootApp.register(fastifyStatic, options)
@@ -229,7 +216,7 @@ URLRootApp.register(fastifyStatic, options)
   })
 
 const defaultIndexApp = fastify()
-options.index = 'index.html'
+options.index = 'index.html' as const
 
 defaultIndexApp
   .register(fastifyStatic, options)