fastify 5.11.0 → 5.11.2

package/.pi/bash-confirm-whitelist.json

@@ -0,0 +1,180 @@
+{
+  "entries": [
+    {
+      "type": "exact",
+      "value": "git fetch --all --prune --quiet && echo FETCH_OK || echo FETCH_FAILED",
+      "addedAt": "2026-02-07T10:03:03.909Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "npm install --ignore-scripts",
+      "addedAt": "2026-02-07T10:21:13.104Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "npm run coverage:ci-check-coverage",
+      "addedAt": "2026-02-07T15:10:08.412Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "node --test test/web-api.test.js",
+      "addedAt": "2026-02-07T15:24:46.872Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "gpg --list-secret-keys --keyid-format=long || true && git config --get user.signingkey && git config --get commit.gpgsign",
+      "addedAt": "2026-02-11T04:42:44.716Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && npm run test:typescript",
+      "addedAt": "2026-02-19T20:22:59.298Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && git checkout -- types/route.d.ts",
+      "addedAt": "2026-02-19T20:23:45.912Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && git status --short && git diff -- types/route.d.ts test/types/route.test-d.ts | sed -n '1,220p'",
+      "addedAt": "2026-02-19T20:25:10.175Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && git checkout -- types/route.d.ts test/types/route.test-d.ts && npm run test:typescript",
+      "addedAt": "2026-02-19T20:25:56.421Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && npm run lint:eslint -- types/route.d.ts test/types/route.test-d.ts",
+      "addedAt": "2026-02-19T20:27:12.547Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && git checkout -b fix/6513-route-hook-meta-return",
+      "addedAt": "2026-02-19T20:27:31.569Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && git add types/route.d.ts test/types/route.test-d.ts && git commit -m \"fix(types): allow async route hooks in shorthand options\"",
+      "addedAt": "2026-02-19T20:27:35.261Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && npx tsc /tmp/ctx-test2.ts --noEmit --strict",
+      "addedAt": "2026-02-19T20:44:45.451Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && npx tsd --files test/types/hooks.test-d.ts",
+      "addedAt": "2026-02-19T20:47:16.815Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && npx tsd --files test/types/route.test-d.ts",
+      "addedAt": "2026-02-19T20:47:37.607Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && npx tsd",
+      "addedAt": "2026-02-19T20:48:17.812Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "cd /home/matteo/repositories/fastify && npm run lint:eslint -- types/route.d.ts && npx tsd --files test/types/hooks.test-d.ts && npx tsd --files test/types/route.test-d.ts",
+      "addedAt": "2026-02-19T20:51:05.173Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "which gh && gh --version && gh auth status",
+      "addedAt": "2026-02-20T07:03:43.023Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "gh api repos/fastify/fastify/rulesets",
+      "addedAt": "2026-02-22T22:29:22.020Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "node --test test/fastify-instance.test.js",
+      "addedAt": "2026-02-23T07:23:34.147Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "exact",
+      "value": "nl -ba scripts/validate-ecosystem-links.js | sed -n '1,220p'",
+      "addedAt": "2026-02-23T07:23:55.927Z",
+      "note": "Always accept",
+      "source": "user"
+    },
+    {
+      "type": "pattern",
+      "value": "^npx\\s+eslint\\s+[\\w./~-]+\\s+[\\w./~-]+\\s+[\\w./~-]+\\s+[\\w./~-]+$",
+      "addedAt": "2026-03-09T12:41:11.065Z",
+      "note": "Always accept generic",
+      "source": "ai"
+    },
+    {
+      "type": "pattern",
+      "value": "^node\\s+--test\\s+[\\w./~-]+\\s+[\\w./~-]+$",
+      "addedAt": "2026-03-09T12:41:58.425Z",
+      "note": "Always accept generic",
+      "source": "ai"
+    },
+    {
+      "type": "pattern",
+      "value": "^npm\\s+run\\s+test:typescript$",
+      "addedAt": "2026-03-09T12:42:48.283Z",
+      "note": "Always accept generic",
+      "source": "ai"
+    },
+    {
+      "type": "exact",
+      "value": "gh search code \"request.host org:fastify\" --limit 20 --json repository,path,url",
+      "addedAt": "2026-03-09T21:03:22.953Z",
+      "note": "Always accept exact",
+      "source": "user"
+    }
+  ],
+  "version": 2
+}

package/docs/Reference/Server.md

@@ -1707,6 +1707,13 @@ Fastify supports the `GET`, `HEAD`, `TRACE`, `DELETE`, `OPTIONS`,
 The `addHttpMethod` method allows to add any non standard HTTP
 methods to the server that are [supported by Node.js](https://nodejs.org/api/http.html#httpmethods).
 
+The method accepts an optional configuration object:
+
+| Property | Type | Default | Description |
+| -------- | ---- | ------- | ----------- |
+| `hasBody` | `boolean` | `false` | Whether the method accepts a request body. |
+| `overrideExisting` | `boolean` | `false` | Whether to explicitly override an existing method. |
+
 ```js
 // Add a new HTTP method called 'MKCOL' that supports a request body
 fastify.addHttpMethod('MKCOL', { hasBody: true,  })
@@ -1725,8 +1732,17 @@ fastify.mkcol('/', (req, reply) => {
 })
 ```
 
-> ⚠ Warning:
-> `addHttpMethod` overrides existing methods.
+Calling `addHttpMethod` for an existing method overrides its body behavior.
+
+```js
+fastify.addHttpMethod('GET', {
+  hasBody: true,
+  overrideExisting: true
+})
+```
+
+In Fastify v5, omitting `overrideExisting: true` emits `FSTDEP025`; in Fastify
+v6, it will throw an error.
 
 #### addSchema
 <a id="add-schema"></a>

package/docs/Reference/Validation-and-Serialization.md

@@ -876,14 +876,25 @@ with the following payload:
 
 To handle errors inside the route, specify the `attachValidation` option. If
 there is a validation error, the `validationError` property of the request will
-contain the `Error` object with the raw validation result as shown below:
+contain the same `Error` object Fastify would have sent on its own, so no
+message has to be rebuilt from the raw validation result:
+
+- `message` is the formatted message, identical to the one in the response
+  payload above (for example `body must have required property 'name'`). It is
+  produced by [`schemaErrorFormatter`](#schemaerrorformatter), so a custom
+  formatter is reflected here too.
+- `validation` is the raw validation result, as returned by the validator.
+- `validationContext` is the part of the request that failed validation
+  (`body`, `params`, `querystring` or `headers`).
+- `code` is `FST_ERR_VALIDATION` and `statusCode` is `400`.
 
 ```js
 const fastify = Fastify()
 
 fastify.post('/', { schema, attachValidation: true }, function (req, reply) {
   if (req.validationError) {
-    // `req.validationError.validation` contains the raw validation error
+    // `req.validationError.message` is the formatted message
+    // `req.validationError.validation` contains the raw validation result
     reply.code(400).send(req.validationError)
   }
 })

package/docs/Reference/Warnings.md

@@ -12,6 +12,7 @@
     - [FSTDEP022](#FSTDEP022)
     - [FSTDEP023](#FSTDEP023)
     - [FSTDEP024](#FSTDEP024)
+    - [FSTDEP025](#FSTDEP025)
 
 ## Warnings
 
@@ -46,8 +47,6 @@ Disabling warnings is not recommended and may cause unexpected behavior.
 | <a id="FSTWRN001">FSTWRN001</a> | The specified schema for a route is missing. This may indicate the schema is not well specified. | Check the schema for the route. | [#4647](https://github.com/fastify/fastify/pull/4647) |
 | <a id="FSTWRN003">FSTWRN003</a> | The `%s` plugin mixes async and callback styles, which may lead to unhandled rejections. | Do not mix async and callback style. | [#6011](https://github.com/fastify/fastify/pull/6011) |
 | <a id="FSTWRN004">FSTWRN004</a> | An `errorHandler` is being overridden in the same scope, which can lead to subtle bugs. | Avoid calling `setErrorHandler` more than once in the same scope. For more information, see [Server documentation](https://fastify.dev/docs/latest/Reference/Server/#allowerrorhandleroverride). | [#6104](https://github.com/fastify/fastify/pull/6104) |
-
-
 ### Fastify Deprecation Codes
 
 Deprecation codes are supported by the Node.js CLI options:
@@ -62,3 +61,4 @@ Deprecation codes are supported by the Node.js CLI options:
 | <a id="FSTDEP022">FSTDEP022</a> | You are trying to access the deprecated router options on top option properties. | Use `options.routerOptions`. | [#5985](https://github.com/fastify/fastify/pull/5985)
 | <a id="FSTDEP023">FSTDEP023</a> | `disableRequestLogging` top-level option is deprecated. | Pass a `LogController` instance via the `logController` option with `disableRequestLogging` in its constructor instead. |
 | <a id="FSTDEP024">FSTDEP024</a> | `requestIdLogLabel` top-level option is deprecated. | Pass a `LogController` instance via the `logController` option with `requestIdLogLabel` in its constructor instead. |
+| <a id="FSTDEP025">FSTDEP025</a> | Calling `addHttpMethod` for an existing HTTP method without `{ overrideExisting: true }` is deprecated. | Pass `{ overrideExisting: true }` to make the override explicit. | [#6879](https://github.com/fastify/fastify/pull/6879) |

package/fastify.d.ts

@@ -69,6 +69,7 @@ declare namespace fastify {
     Logger extends FastifyBaseLogger = FastifyBaseLogger
   > = FastifyServerOptions<Server, Logger> & {
     https: https.ServerOptions | null
+    http2?: false
   }
 
   export type FastifyHttpOptions<
@@ -76,6 +77,7 @@ declare namespace fastify {
     Logger extends FastifyBaseLogger = FastifyBaseLogger
   > = FastifyServerOptions<Server, Logger> & {
     http?: http.ServerOptions | null
+    http2?: false
   }
 
   type FindMyWayVersion<RawServer extends RawServerBase> = RawServer extends http.Server

package/fastify.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const VERSION = '5.11.0'
+const VERSION = '5.11.2'
 
 const Avvio = require('avvio')
 const http = require('node:http')
@@ -80,7 +80,7 @@ const {
 } = errorCodes
 
 const { buildErrorHandler } = require('./lib/error-handler.js')
-const { FSTWRN004, FSTDEP023, FSTDEP024 } = require('./lib/warnings.js')
+const { FSTWRN004, FSTDEP023, FSTDEP024, FSTDEP025 } = require('./lib/warnings.js')
 
 const initChannel = diagnostics.channel('fastify.initialization')
 
@@ -392,7 +392,7 @@ function fastify (serverOptions) {
           if (forceCloseConnections === 'idle' && options.serverFactory) {
             instance.server.closeIdleConnections()
             /* istanbul ignore next: Cannot test this without Node.js core support */
-          } else if (serverHasCloseAllConnections && forceCloseConnections) {
+          } else if (serverHasCloseAllConnections && forceCloseConnections === true) {
             instance.server.closeAllConnections()
           } else if (forceCloseConnections === true) {
             for (const conn of fastify[kKeepAliveConnections]) {
@@ -823,11 +823,18 @@ function fastify (serverOptions) {
     return this
   }
 
-  function addHttpMethod (method, { hasBody = false } = {}) {
+  function addHttpMethod (method, { hasBody = false, overrideExisting = false } = {}) {
     if (typeof method !== 'string' || http.METHODS.indexOf(method) === -1) {
       throw new FST_ERR_ROUTE_METHOD_INVALID()
     }
 
+    const alreadyExists = this[kSupportedHTTPMethods].bodyless.has(method) ||
+      this[kSupportedHTTPMethods].bodywith.has(method)
+
+    if (alreadyExists && !overrideExisting) {
+      FSTDEP025(method)
+    }
+
     if (hasBody === true) {
       this[kSupportedHTTPMethods].bodywith.add(method)
       this[kSupportedHTTPMethods].bodyless.delete(method)

package/lib/warnings.js

@@ -9,9 +9,10 @@ const { createWarning } = require('process-warning')
  *   - FSTDEP022
  *   - FSTDEP023
  *   - FSTDEP024
+ *   - FSTDEP025
  *
  * Deprecation Codes FSTDEP001 - FSTDEP021 were used by v4 and MUST NOT be reused.
- *                             - FSTDEP022 is used by v5 and MUST NOT be reused.
+ *                             - FSTDEP022 - FSTDEP025 are used by v5 and MUST NOT be reused.
  * Warning Codes FSTWRN001 - FSTWRN002 were used by v4 and MUST NOT be reused.
  */
 
@@ -64,6 +65,13 @@ const FSTDEP024 = createWarning({
   unlimited: true
 })
 
+const FSTDEP025 = createWarning({
+  name: 'FastifyDeprecation',
+  code: 'FSTDEP025',
+  message: 'Calling addHttpMethod for existing method "%s" without { overrideExisting: true } is deprecated. In Fastify v6, this will throw an error.',
+  unlimited: true
+})
+
 module.exports = {
   FSTWRN001,
   FSTWRN003,
@@ -71,5 +79,6 @@ module.exports = {
   FSTSEC001,
   FSTDEP022,
   FSTDEP023,
-  FSTDEP024
+  FSTDEP024,
+  FSTDEP025
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "5.11.0",
+  "version": "5.11.2",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",

package/test/close.test.js

@@ -704,3 +704,42 @@ test('preClose execution order', (t, done) => {
     })
   })
 })
+
+test('does not destroy connections with in-flight requests (forceCloseConnections - idle)', { skip: noSupport }, async t => {
+  const fastify = Fastify({ forceCloseConnections: 'idle' })
+
+  fastify.get('/', async () => {
+    // the server starts closing while this request is still being served
+    fastify.close()
+    await sleep(200)
+    return { hello: 'world' }
+  })
+
+  await fastify.listen({ port: 0 })
+
+  const client = new Client('http://localhost:' + fastify.server.address().port)
+  t.after(() => client.close())
+
+  const response = await client.request({ path: '/', method: 'GET' })
+  t.assert.strictEqual(response.statusCode, 200)
+  t.assert.deepStrictEqual(await response.body.json(), { hello: 'world' })
+})
+
+test('does not destroy connections with in-flight requests (default options)', async t => {
+  const fastify = Fastify()
+
+  fastify.get('/', async () => {
+    fastify.close()
+    await sleep(200)
+    return { hello: 'world' }
+  })
+
+  await fastify.listen({ port: 0 })
+
+  const client = new Client('http://localhost:' + fastify.server.address().port)
+  t.after(() => client.close())
+
+  const response = await client.request({ path: '/', method: 'GET' })
+  t.assert.strictEqual(response.statusCode, 200)
+  t.assert.deepStrictEqual(await response.body.json(), { hello: 'world' })
+})

package/test/http-methods/custom-http-methods.test.js

@@ -112,3 +112,64 @@ test('addHttpMethod rejects fake http method', t => {
   const fastify = Fastify()
   t.assert.throws(() => { fastify.addHttpMethod('FOOO') }, /Provided method is invalid!/)
 })
+
+test('addHttpMethod warns when overriding an existing method', (t, done) => {
+  const fastify = Fastify()
+  const onWarning = warning => {
+    t.assert.strictEqual(warning.name, 'FastifyDeprecation')
+    t.assert.strictEqual(warning.code, 'FSTDEP025')
+    done()
+  }
+  process.once('warning', onWarning)
+
+  t.after(() => {
+    fastify.close()
+    process.removeListener('warning', onWarning)
+  })
+
+  fastify.addHttpMethod('GET', { hasBody: true })
+})
+
+test('addHttpMethod does not warn when overriding an existing method explicitly', t => {
+  const doNotWarn = () => {
+    t.assert.fail('should not warn')
+  }
+  process.on('warning', doNotWarn)
+
+  const fastify = Fastify()
+  t.after(() => {
+    fastify.close()
+    process.removeListener('warning', doNotWarn)
+  })
+
+  fastify.addHttpMethod('POST', { overrideExisting: true })
+})
+
+test('addHttpMethod can change an existing method body behavior', async t => {
+  const fastify = Fastify()
+
+  fastify.addHttpMethod('GET', {
+    hasBody: true,
+    overrideExisting: true
+  })
+  fastify.route({
+    method: 'GET',
+    url: '/',
+    exposeHeadRoute: false,
+    schema: {
+      body: {
+        type: 'object'
+      }
+    },
+    handler: async request => request.body
+  })
+
+  const response = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    payload: { hello: 'world' }
+  })
+
+  t.assert.strictEqual(response.statusCode, 200)
+  t.assert.deepStrictEqual(response.json(), { hello: 'world' })
+})

package/test/types/fastify.tst.ts

@@ -68,6 +68,17 @@ expect(fastify({ schemaController: {} })).type.toBe<
   FastifyInstance<http.Server, http.IncomingMessage, http.ServerResponse> &
   SafePromiseLike<FastifyInstance<http.Server, http.IncomingMessage, http.ServerResponse>>
 >()
+
+expect(fastify({ http2: false })).type.toBe<
+  FastifyInstance<http.Server, http.IncomingMessage, http.ServerResponse> &
+  SafePromiseLike<FastifyInstance<http.Server, http.IncomingMessage, http.ServerResponse>>
+>()
+
+expect(fastify({ https: {}, http2: false })).type.toBe<
+  FastifyInstance<https.Server, http.IncomingMessage, http.ServerResponse> &
+  SafePromiseLike<FastifyInstance<https.Server, http.IncomingMessage, http.ServerResponse>>
+>()
+
 expect(
   fastify({
     schemaController: {

package/test/types/instance.tst.ts

@@ -215,6 +215,8 @@ function invalidSchemaErrorFormatter (err: Error) {
 server.setSchemaErrorFormatter(invalidSchemaErrorFormatter)
 
 expect(server.addHttpMethod('SEARCH', { hasBody: true })).type.toBe<FastifyInstance>()
+expect(server.addHttpMethod('GET', { overrideExisting: true })).type.toBe<FastifyInstance>()
+expect(server.addHttpMethod('POST', { hasBody: true, overrideExisting: true })).type.toBe<FastifyInstance>()
 
 // test listen opts objects
 const options: FastifyListenOptions = {}

package/test/validation-error-handling.test.js

@@ -218,6 +218,40 @@ test('should be able to attach validation to request', async (t) => {
   t.assert.strictEqual(response.statusCode, 400)
 })
 
+test('attached validationError exposes the same message sent by the default handler', async (t) => {
+  t.plan(4)
+
+  const fastify = Fastify()
+
+  fastify.post('/attached', { schema, attachValidation: true }, function (req, reply) {
+    reply.code(400).send({
+      message: req.validationError.message,
+      code: req.validationError.code,
+      statusCode: req.validationError.statusCode,
+      validationContext: req.validationError.validationContext
+    })
+  })
+
+  fastify.post('/default', { schema }, echoBody)
+
+  const payload = { hello: 'michelangelo' }
+  const attached = await fastify.inject({ method: 'POST', payload, url: '/attached' })
+  const notAttached = await fastify.inject({ method: 'POST', payload, url: '/default' })
+
+  const attachedBody = attached.json()
+
+  t.assert.deepStrictEqual(attachedBody, {
+    message: "body must have required property 'name'",
+    code: 'FST_ERR_VALIDATION',
+    statusCode: 400,
+    validationContext: 'body'
+  })
+
+  t.assert.strictEqual(attachedBody.message, notAttached.json().message)
+  t.assert.strictEqual(attached.statusCode, 400)
+  t.assert.strictEqual(notAttached.statusCode, 400)
+})
+
 test('should respect when attachValidation is explicitly set to false', async (t) => {
   t.plan(2)
 

package/types/instance.d.ts

@@ -663,7 +663,10 @@ export interface FastifyInstance<
    * Methods defined by default include `GET`, `HEAD`, `TRACE`, `DELETE`,
    * `OPTIONS`, `PATCH`, `PUT` and `POST`
    */
-  addHttpMethod(method: string, methodOptions?: { hasBody: boolean }): FastifyInstance<RawServer, RawRequest, RawReply,
+  addHttpMethod(method: string, methodOptions?: {
+    hasBody?: boolean;
+    overrideExisting?: boolean;
+  }): FastifyInstance<RawServer, RawRequest, RawReply,
     Logger, TypeProvider>;
   /**
    * Fastify default JSON parser