fastify 5.11.1 → 5.11.3

package/README.md

@@ -73,7 +73,7 @@ mkdir my-app
 cd my-app
 ```
 
-Generate a fastify project with `npm init`:
+Generate a Fastify project with `npm init`:
 
 ```sh
 npm init fastify
@@ -121,7 +121,7 @@ import Fastify from 'fastify'
 const fastify = Fastify({
   logger: true
 })
-// CommonJs
+// CommonJS
 const fastify = require('fastify')({
   logger: true
 })
@@ -147,7 +147,7 @@ import Fastify from 'fastify'
 const fastify = Fastify({
   logger: true
 })
-// CommonJs
+// CommonJS
 const fastify = require('fastify')({
   logger: true
 })
@@ -181,7 +181,7 @@ If you learn best by reading code, explore the official [demo](https://github.co
 ### Core features
 
 - **Highly performant:** as far as we know, Fastify is one of the fastest web
-  frameworks in town, depending on the code complexity we can serve up to 76+
+  frameworks in town, depending on the code complexity we can serve more than 76
   thousand requests per second.
 - **Extensible:** Fastify is fully extensible via its hooks, plugins, and
   decorators.
@@ -189,7 +189,7 @@ If you learn best by reading code, explore the official [demo](https://github.co
   Schema](https://json-schema.org/) to validate your routes and serialize your
   outputs. Internally Fastify compiles the schema in a highly performant
   function.
-- **Logging:** logs are extremely important but are costly; we chose the best
+- **Logging:** logs are extremely important, but are costly; we chose the best
   logger to almost remove this cost, [Pino](https://github.com/pinojs/pino)!
 - **Developer friendly:** the framework is built to be very expressive and help
   developers in their daily use without sacrificing performance and
@@ -212,8 +212,8 @@ second average
 | -                  |                            |              |               |
 | `http.Server`      | 16.14.2	                  | ✗     | 74,513        |
 
-These benchmarks taken using https://github.com/fastify/benchmarks. This is a
-synthetic "hello world" benchmark that aims to evaluate the framework overhead.
+These benchmarks were taken using https://github.com/fastify/benchmarks. This is
+a synthetic "hello world" benchmark that aims to evaluate the framework overhead.
 The overhead that each framework has on your application depends on your
 application. You should __always__ benchmark if performance matters to you.
 

package/docs/Reference/Encapsulation.md

@@ -140,7 +140,7 @@ update the code as follows:
 'use strict'
 
 const fastify = require('fastify')()
-const fastifyPlugin = require('fastify-plugin')
+const fp = require('fastify-plugin')
 
 fastify.decorateRequest('answer', 42)
 
@@ -161,7 +161,7 @@ fastify.register(async function publicContext (childServer) {
     }
   })
 
-  childServer.register(fastifyPlugin(grandchildContext))
+  childServer.register(fp(grandchildContext))
 
   async function grandchildContext (grandchildServer) {
     grandchildServer.decorateRequest('bar', 'bar')
@@ -192,4 +192,33 @@ curl http://127.0.0.1:8000/three
 # {"answer":42,"foo":"foo","bar":"bar"}
 ```
 
+`fastify-plugin` breaks encapsulation only for the plugin it wraps. Plugins
+registered inside it without `fastify-plugin` still create new encapsulated
+contexts:
+
+```js
+'use strict'
+
+const fastify = require('fastify')()
+const fp = require('fastify-plugin')
+
+fastify.register(fp(async function sharedContext (childServer) {
+  childServer.decorate('foo', 'foo')
+
+  childServer.register(async function encapsulatedContext (grandchildServer) {
+    grandchildServer.decorate('bar', 'bar')
+  })
+}))
+
+await fastify.ready()
+
+console.log(fastify.foo) // 'foo'
+console.log(fastify.bar) // undefined
+```
+
+The `foo` decorator is available in the root context because it is added
+directly by the plugin wrapped with `fastify-plugin`. The nested `register`
+call still creates a grandchild context, so the `bar` decorator remains
+available only in that context and its children.
+
 [fastify-plugin]: https://github.com/fastify/fastify-plugin

package/docs/Reference/Errors.md

@@ -11,6 +11,7 @@
   - [Errors In Fastify](#errors-in-fastify)
     - [Errors In Input Data](#errors-in-input-data)
     - [Catching Uncaught Errors In Fastify](#catching-uncaught-errors-in-fastify)
+    - [What The Default Error Handler Sends](#what-the-default-error-handler-sends)
   - [Errors In Fastify Lifecycle Hooks And A Custom Error Handler](#errors-in-fastify-lifecycle-hooks-and-a-custom-error-handler)
   - [Fastify Error Codes](#fastify-error-codes)
     - [FST_ERR_NOT_FOUND](#fst_err_not_found)
@@ -142,10 +143,82 @@ performance. This includes:
    })`
 
 In both cases, the error will be caught safely and routed to Fastify's default
-error handler, resulting in a generic `500 Internal Server Error` response.
+error handler, resulting in a `500 Internal Server Error` response.
 
-To customize this behavior, use
-[`setErrorHandler`](./Server.md#seterrorhandler).
+#### What The Default Error Handler Sends
+The default error handler serializes the error into a JSON body with the
+`statusCode`, `error`, and `message` properties, plus `code` when the error
+carries one:
+
+```js
+app.get('/', async () => { throw new Error('kaboom') })
+```
+
+```json
+{
+  "statusCode": 500,
+  "error": "Internal Server Error",
+  "message": "kaboom"
+}
+```
+
+The `error` property is the generic HTTP status text, but **`message` is
+`error.message` verbatim**. This applies to every status code, including `500`.
+Fastify's built-in error serializer emits only these four properties, so the
+stack trace is not part of the default payload — but a route-level response
+schema replaces that serializer, and one that declares a `stack` property will
+serialize it.
+
+> Security:
+> Because `message` and `code` are forwarded as-is, errors thrown by libraries
+> deeper in your application are exposed to the client. A database driver
+> error, for example, can leak schema details and query text:
+>
+> ```json
+> {
+>   "statusCode": 500,
+>   "code": "ER_BAD_FIELD_ERROR",
+>   "error": "Internal Server Error",
+>   "message": "Unknown column 'username' in 'field list'"
+> }
+> ```
+>
+> Fastify does not distinguish between development and production here. If
+> unexpected errors must not reach the client, handle this explicitly.
+
+Register a [`setErrorHandler`](./Server.md#seterrorhandler) to replace the
+message for errors you did not raise deliberately, while letting the ones you
+did pass through:
+
+```js
+app.setErrorHandler(function (error, request, reply) {
+  // Errors with a statusCode below 500 were raised deliberately by this
+  // application, as were validation errors. A status code below 500 is not on
+  // its own a guarantee that the message is safe to expose — narrow this
+  // condition if any of yours are not.
+  if (error.validation || (error.statusCode && error.statusCode < 500)) {
+    return reply.send(error)
+  }
+
+  // Anything else is unexpected: log it, but do not describe it to the client.
+  this.log.error({ err: error }, 'unhandled error')
+  reply.status(500).send({
+    statusCode: 500,
+    error: 'Internal Server Error',
+    message: 'Internal Server Error'
+  })
+})
+```
+
+The handler above is registered on the root instance, so it applies to every
+route. Error handlers are encapsulated; for how they resolve across plugin
+contexts, see
+[the next section](#errors-in-fastify-lifecycle-hooks-and-a-custom-error-handler).
+
+Note that a route-level response schema is still applied to whatever the error
+handler sends, and will reshape the payload accordingly — including properties
+the built-in error serializer would have omitted, such as `stack`. See
+[Serialization](./Validation-and-Serialization.md#serialization).
 
 ### Errors In Fastify Lifecycle Hooks And A Custom Error Handler
 

package/docs/Reference/Request.md

@@ -9,7 +9,11 @@ Request is a core Fastify object containing the following fields:
 - `body` - The request payload, see [Content-Type Parser](./ContentTypeParser.md)
   for details on what request payloads Fastify natively parses and how to support
   other content types.
-- `params` - The params matching the URL.
+- `params` - The params matching the URL. Values are percent-decoded
+  (for example `%20` becomes a space, and `%2f` becomes `/`). Decoded
+  values may contain `.`, `..`, `/`, or other characters; treat them as
+  untrusted input. See the security note below and
+  [Routes - Url building](./Routes.md#url-building).
 - [`headers`](#headers) - The headers getter and setter.
 - `raw` - The incoming HTTP request from Node core.
 - `server` - The Fastify server instance, scoped to the current
@@ -35,13 +39,21 @@ Request is a core Fastify object containing the following fields:
   [`trustProxy`](./Server.md#factory-trust-proxy) is enabled).
 
 > ⚠️ Security:
+> `request.params`, `request.query`, `request.headers`, and `request.body`
+> are untrusted network input. Route parameter values are percent-decoded
+> before your handler runs, so a segment like `..%2ffile` becomes `../file`
+> in `request.params`. Do not use parameter values as filesystem paths,
+> template names, or redirect targets without validating or containing
+> them. Prefer [`@fastify/static`](https://github.com/fastify/fastify-static)
+> (or `reply.sendFile`) when serving files from a root directory.
+>
 > `request.ip`, `request.ips`, `request.host`, `request.hostname`,
 > `request.port`, and `request.protocol` come from request metadata
-> (socket and/or forwarding headers) and should be treated as untrusted input.
-> Fastify does not perform security validation for business logic.
-> If these values are used in security-sensitive decisions, they must 
-> be validated explicitly (for example: trusted proxy configuration,
-> allow-lists, strict parsing, and normalization).
+> (socket and/or forwarding headers) and should also be treated as
+> untrusted input. Fastify does not perform security validation for
+> business logic. If these values are used in security-sensitive decisions,
+> they must be validated explicitly (for example: trusted proxy
+> configuration, allow-lists, strict parsing, and normalization).
 
 - `method` - The method of the incoming request.
 - `url` - The URL of the incoming request.

package/docs/Reference/Routes.md

@@ -328,6 +328,19 @@ Prefer a single parameter approach, especially on routes that are on the hot
 path of your application. For more details, see
 [find-my-way](https://github.com/delvedor/find-my-way).
 
+> ⚠️ Security:
+> Fastify (via find-my-way) percent-decodes route parameters and wildcards
+> before they reach your handler. Encoded separators in a segment are
+> decoded in the parameter value: for a route `/download/:file`, a request
+> to `/download/..%2fsecret.txt` yields
+> `request.params.file === '../secret.txt'`. Parameters are untrusted
+> input. Do not pass them to `path.join`, `fs` APIs, template engines, or
+> redirects without validation or path containment. To serve files from a
+> directory root, use
+> [`@fastify/static`](https://github.com/fastify/fastify-static) instead of
+> joining `request.params` into a filesystem path yourself. See also
+> [Request](./Request.md).
+
 To include a colon in a path without declaring a parameter, use a double colon.
 For example:
 ```js

package/fastify.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const VERSION = '5.11.0'
+const VERSION = '5.11.3'
 
 const Avvio = require('avvio')
 const http = require('node:http')

package/lib/content-type-parser.js

@@ -145,6 +145,10 @@ ContentTypeParser.prototype.getParser = function (contentType) {
 
   for (let j = 0; j !== this.parserRegExpList.length; ++j) {
     const parserRegExp = this.parserRegExpList[j]
+    // A parser registered with a `g`/`y` flagged RegExp keeps a mutable
+    // lastIndex between calls, so a plain `.test()` would skip part of the
+    // next content type and match inconsistently. Reset it before testing.
+    parserRegExp.lastIndex = 0
     if (parserRegExp.test(ct)) {
       parser = this.customParsers.get(parserRegExp.toString())
       this.cache.set(ct, parser)

package/lib/decorate.js

@@ -121,7 +121,7 @@ function checkDependencies (instance, name, deps) {
   }
 
   for (let i = 0; i !== deps.length; ++i) {
-    if (!checkExistence(instance, deps[i])) {
+    if (!checkExistence(instance, deps[i]) && !hasInstanceProperty(instance, deps[i])) {
       throw new FST_ERR_DEC_MISSING_DEPENDENCY(deps[i])
     }
   }

package/lib/log-controller.js

@@ -54,7 +54,7 @@ class LogController {
    * Logs the outcome of a completed request.
    * Uses `error` level when an error is present, `info` otherwise.
    *
-   * @param {Error | null} error  Error that occurred during the response, if any.
+   * @param {Error | null | undefined} error  Error that occurred during the response, if any.
    * @param {object} request      Fastify request object.
    * @param {object} reply        Fastify reply object.
    * @param {object} [metadata]   Extra contextual data (unused).

package/lib/reply.js

@@ -595,9 +595,13 @@ function onSendEnd (reply, payload) {
       header += ' '
       header += trailerName
     }
-    // it must be chunked for trailer to work
-    reply.header('Transfer-Encoding', 'chunked')
-    reply.header('Trailer', header.trim())
+    if (header !== '') {
+      // it must be chunked for trailer to work
+      reply.header('Transfer-Encoding', 'chunked')
+      reply.header('Trailer', header.trim())
+    } else {
+      reply[kReplyTrailers] = null
+    }
   }
 
   // since Response contain status code, headers and body,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "5.11.1",
+  "version": "5.11.3",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",

package/test/content-parser.test.js

@@ -578,6 +578,38 @@ test('content-type match parameters - regexp', async t => {
   })
 })
 
+test('content-type match - RegExp with global flag', async t => {
+  t.plan(4)
+
+  const fastify = Fastify()
+  fastify.addContentTypeParser(/^application\/.+\+xml$/g, { parseAs: 'string' }, function (request, body, done) {
+    done(null, body)
+  })
+
+  fastify.post('/', async (request) => request.body)
+
+  // Two distinct content types that both match the parser. A RegExp with the
+  // `g` flag keeps a mutable lastIndex between test() calls, so the second
+  // content type must still match rather than fall through to 415.
+  const first = await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: { 'content-type': 'application/vnd.a+xml' },
+    body: '<a/>'
+  })
+  const second = await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: { 'content-type': 'application/vnd.b+xml' },
+    body: '<b/>'
+  })
+
+  t.assert.strictEqual(first.statusCode, 200)
+  t.assert.strictEqual(first.payload, '<a/>')
+  t.assert.strictEqual(second.statusCode, 200)
+  t.assert.strictEqual(second.payload, '<b/>')
+})
+
 test('content-type fail when parameters not match - string 1', async t => {
   t.plan(1)
 

package/test/decorator-instance-properties.test.js

@@ -61,3 +61,52 @@ test('decorateRequest still works for non-built-in names', (t, done) => {
     done()
   })
 })
+
+test('decorateRequest accepts built-in request properties as dependencies', t => {
+  t.plan(6)
+  const fastify = Fastify()
+  for (const name of ['id', 'params', 'raw', 'query', 'log', 'body']) {
+    t.assert.doesNotThrow(() => fastify.decorateRequest(`uses_${name}`, null, [name]))
+  }
+})
+
+test('decorateReply accepts built-in reply properties as dependencies', t => {
+  t.plan(3)
+  const fastify = Fastify()
+  for (const name of ['raw', 'request', 'log']) {
+    t.assert.doesNotThrow(() => fastify.decorateReply(`uses_${name}`, null, [name]))
+  }
+})
+
+test('decorateRequest accepts built-in properties as dependencies inside a plugin', (t, done) => {
+  t.plan(2)
+  const fastify = Fastify()
+  fastify.register(async (instance) => {
+    instance.decorateRequest('scopedExtra', null, ['body'])
+    t.assert.equal(instance.hasRequestDecorator('scopedExtra'), true)
+  })
+  fastify.ready((err) => {
+    t.assert.ifError(err)
+    done()
+  })
+})
+
+test('decorateRequest accepts built-in properties mixed with user decorators as dependencies', t => {
+  t.plan(1)
+  const fastify = Fastify()
+  fastify.decorateRequest('userProp', null)
+  t.assert.doesNotThrow(() => fastify.decorateRequest('mixed', null, ['userProp', 'body']))
+})
+
+test('decorateRequest still throws FST_ERR_DEC_MISSING_DEPENDENCY for unknown dependencies', t => {
+  t.plan(2)
+  const fastify = Fastify()
+  t.assert.throws(
+    () => fastify.decorateRequest('withUnknown', null, ['nonExistent']),
+    (err) => err.code === 'FST_ERR_DEC_MISSING_DEPENDENCY'
+  )
+  t.assert.throws(
+    () => fastify.decorateReply('withUnknown', null, ['body']),
+    (err) => err.code === 'FST_ERR_DEC_MISSING_DEPENDENCY'
+  )
+})

package/test/reply-trailers.test.js

@@ -142,6 +142,37 @@ test('send trailers when payload is stream', (t, testDone) => {
   })
 })
 
+test('remove trailer while stream is being consumed', (t, testDone) => {
+  t.plan(5)
+
+  const fastify = Fastify()
+
+  fastify.get('/', function (request, reply) {
+    const stream = Readable.from((function * () {
+      reply.removeTrailer('ETag')
+      yield 'hello'
+    })())
+
+    reply.trailer('ETag', function () {
+      t.assert.fail('removed trailer should not be called')
+    })
+
+    reply.send(stream)
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/'
+  }, (error, res) => {
+    t.assert.ifError(error)
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.strictEqual(res.payload, 'hello')
+    t.assert.strictEqual(res.headers.trailer, 'etag')
+    t.assert.strictEqual(res.trailers.etag, undefined)
+    testDone()
+  })
+})
+
 test('send trailers when using async-await', (t, testDone) => {
   t.plan(5)
 
@@ -395,10 +426,67 @@ test('remove all trailers', (t, testDone) => {
   }, (error, res) => {
     t.assert.ifError(error)
     t.assert.strictEqual(res.statusCode, 200)
-    t.assert.ok(!res.headers.trailer)
-    t.assert.ok(!res.trailers.etag)
-    t.assert.ok(!res.trailers['should-not-call'])
-    t.assert.ok(!res.headers['content-length'])
+    t.assert.strictEqual(res.headers.trailer, undefined)
+    t.assert.strictEqual(res.trailers.etag, undefined)
+    t.assert.strictEqual(res.trailers['should-not-call'], undefined)
+    t.assert.strictEqual(res.headers['content-length'], '0')
+    testDone()
+  })
+})
+
+test('remove some trailers should keep trailer mode for the remaining ones', (t, testDone) => {
+  t.plan(6)
+
+  const fastify = Fastify()
+
+  fastify.get('/', function (request, reply) {
+    reply.trailer('ETag', function () {
+      t.assert.fail('removed trailer should not be called')
+    })
+    reply.removeTrailer('ETag')
+    reply.trailer('Content-MD5', function (reply, payload, done) {
+      done(null, 'custom-md5')
+    })
+    reply.send('hello')
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/'
+  }, (error, res) => {
+    t.assert.ifError(error)
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.strictEqual(res.headers.trailer, 'content-md5')
+    t.assert.strictEqual(res.headers['transfer-encoding'], 'chunked')
+    t.assert.strictEqual(res.headers['content-length'], undefined)
+    t.assert.strictEqual(res.trailers['content-md5'], 'custom-md5')
+    testDone()
+  })
+})
+
+test('remove all trailers should behave like no trailers were registered', (t, testDone) => {
+  t.plan(6)
+
+  const fastify = Fastify()
+
+  fastify.get('/', function (request, reply) {
+    reply.trailer('ETag', function () {
+      t.assert.fail('removed trailer should not be called')
+    })
+    reply.removeTrailer('ETag')
+    reply.send('hello')
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/'
+  }, (error, res) => {
+    t.assert.ifError(error)
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.strictEqual(res.headers.trailer, undefined)
+    t.assert.strictEqual(res.headers['transfer-encoding'], undefined)
+    t.assert.strictEqual(res.headers['content-length'], '5')
+    t.assert.strictEqual(res.trailers.etag, undefined)
     testDone()
   })
 })

package/types/logger.d.ts

@@ -124,7 +124,7 @@ export declare class LogController {
   isLogDisabled (request: FastifyRequest): boolean
   incomingRequest (request: FastifyRequest, reply: FastifyReply, metadata?: Record<string, unknown>): void
   requestCompleted (
-    error: Error | null,
+    error: Error | null | undefined,
     request: FastifyRequest,
     reply: FastifyReply,
     metadata?: Record<string, unknown>

package/.pi/bash-confirm-whitelist.json

@@ -1,180 +0,0 @@
-{
-  "entries": [
-    {
-      "type": "exact",
-      "value": "git fetch --all --prune --quiet && echo FETCH_OK || echo FETCH_FAILED",
-      "addedAt": "2026-02-07T10:03:03.909Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "npm install --ignore-scripts",
-      "addedAt": "2026-02-07T10:21:13.104Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "npm run coverage:ci-check-coverage",
-      "addedAt": "2026-02-07T15:10:08.412Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "node --test test/web-api.test.js",
-      "addedAt": "2026-02-07T15:24:46.872Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "gpg --list-secret-keys --keyid-format=long || true && git config --get user.signingkey && git config --get commit.gpgsign",
-      "addedAt": "2026-02-11T04:42:44.716Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && npm run test:typescript",
-      "addedAt": "2026-02-19T20:22:59.298Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && git checkout -- types/route.d.ts",
-      "addedAt": "2026-02-19T20:23:45.912Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && git status --short && git diff -- types/route.d.ts test/types/route.test-d.ts | sed -n '1,220p'",
-      "addedAt": "2026-02-19T20:25:10.175Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && git checkout -- types/route.d.ts test/types/route.test-d.ts && npm run test:typescript",
-      "addedAt": "2026-02-19T20:25:56.421Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && npm run lint:eslint -- types/route.d.ts test/types/route.test-d.ts",
-      "addedAt": "2026-02-19T20:27:12.547Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && git checkout -b fix/6513-route-hook-meta-return",
-      "addedAt": "2026-02-19T20:27:31.569Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && git add types/route.d.ts test/types/route.test-d.ts && git commit -m \"fix(types): allow async route hooks in shorthand options\"",
-      "addedAt": "2026-02-19T20:27:35.261Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && npx tsc /tmp/ctx-test2.ts --noEmit --strict",
-      "addedAt": "2026-02-19T20:44:45.451Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && npx tsd --files test/types/hooks.test-d.ts",
-      "addedAt": "2026-02-19T20:47:16.815Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && npx tsd --files test/types/route.test-d.ts",
-      "addedAt": "2026-02-19T20:47:37.607Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && npx tsd",
-      "addedAt": "2026-02-19T20:48:17.812Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "cd /home/matteo/repositories/fastify && npm run lint:eslint -- types/route.d.ts && npx tsd --files test/types/hooks.test-d.ts && npx tsd --files test/types/route.test-d.ts",
-      "addedAt": "2026-02-19T20:51:05.173Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "which gh && gh --version && gh auth status",
-      "addedAt": "2026-02-20T07:03:43.023Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "gh api repos/fastify/fastify/rulesets",
-      "addedAt": "2026-02-22T22:29:22.020Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "node --test test/fastify-instance.test.js",
-      "addedAt": "2026-02-23T07:23:34.147Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "exact",
-      "value": "nl -ba scripts/validate-ecosystem-links.js | sed -n '1,220p'",
-      "addedAt": "2026-02-23T07:23:55.927Z",
-      "note": "Always accept",
-      "source": "user"
-    },
-    {
-      "type": "pattern",
-      "value": "^npx\\s+eslint\\s+[\\w./~-]+\\s+[\\w./~-]+\\s+[\\w./~-]+\\s+[\\w./~-]+$",
-      "addedAt": "2026-03-09T12:41:11.065Z",
-      "note": "Always accept generic",
-      "source": "ai"
-    },
-    {
-      "type": "pattern",
-      "value": "^node\\s+--test\\s+[\\w./~-]+\\s+[\\w./~-]+$",
-      "addedAt": "2026-03-09T12:41:58.425Z",
-      "note": "Always accept generic",
-      "source": "ai"
-    },
-    {
-      "type": "pattern",
-      "value": "^npm\\s+run\\s+test:typescript$",
-      "addedAt": "2026-03-09T12:42:48.283Z",
-      "note": "Always accept generic",
-      "source": "ai"
-    },
-    {
-      "type": "exact",
-      "value": "gh search code \"request.host org:fastify\" --limit 20 --json repository,path,url",
-      "addedAt": "2026-03-09T21:03:22.953Z",
-      "note": "Always accept exact",
-      "source": "user"
-    }
-  ],
-  "version": 2
-}