fastify 5.6.2 → 5.7.1

package/docs/Reference/Validation-and-Serialization.md

@@ -775,6 +775,12 @@ with the following payload:
 }
 ```
 
+> ⚠ Security Consideration: By default, validation error details from the schema
+> are included in the response payload. If your organization requires sanitizing
+> or customizing these error messages (e.g., to avoid exposing internal schema
+> details), configure a custom error handler using
+> [`setErrorHandler()`](./Server.md#seterrorhandler).
+
 To handle errors inside the route, specify the `attachValidation` option. If
 there is a validation error, the `validationError` property of the request will
 contain the `Error` object with the raw validation result as shown below:
@@ -1032,7 +1038,7 @@ const refToSharedSchemaDefinitions = {
 
 - [JSON Schema](https://json-schema.org/)
 - [Understanding JSON
-  Schema](https://spacetelescope.github.io/understanding-json-schema/)
+  Schema](https://json-schema.org/understanding-json-schema/about)
 - [fast-json-stringify
   documentation](https://github.com/fastify/fast-json-stringify)
 - [Ajv documentation](https://github.com/epoberezkin/ajv/blob/master/README.md)

package/examples/benchmark/webstream.js

@@ -0,0 +1,27 @@
+'use strict'
+
+const fastify = require('../../fastify')({
+  logger: false
+})
+
+const payload = JSON.stringify({ hello: 'world' })
+
+fastify.get('/', function (req, reply) {
+  const stream = new ReadableStream({
+    start (controller) {
+      controller.enqueue(payload)
+      controller.close()
+    }
+  })
+  return new Response(stream, {
+    status: 200,
+    headers: {
+      'content-type': 'application/json; charset=utf-8'
+    }
+  })
+})
+
+fastify.listen({ port: 3000 }, (err, address) => {
+  if (err) throw err
+  console.log(`Server listening on ${address}`)
+})

package/fastify.d.ts

@@ -3,10 +3,10 @@ import * as http2 from 'node:http2'
 import * as https from 'node:https'
 import { Socket } from 'node:net'
 
-import { Options as AjvOptions, ValidatorFactory } from '@fastify/ajv-compiler'
+import { BuildCompilerFromPool, ValidatorFactory } from '@fastify/ajv-compiler'
 import { FastifyError } from '@fastify/error'
 import { Options as FJSOptions, SerializerFactory } from '@fastify/fast-json-stringify-compiler'
-import { ConstraintStrategy, HTTPVersion } from 'find-my-way'
+import { Config as FindMyWayConfig, ConstraintStrategy, HTTPVersion } from 'find-my-way'
 import { InjectOptions, CallbackFunc as LightMyRequestCallback, Chain as LightMyRequestChain, Response as LightMyRequestResponse } from 'light-my-request'
 
 import { AddContentTypeParser, ConstructorAction, FastifyBodyParser, FastifyContentTypeParser, getDefaultJsonParser, hasContentTypeParser, ProtoAction } from './types/content-type-parser'
@@ -77,6 +77,7 @@ declare namespace fastify {
   }
 
   type FindMyWayVersion<RawServer extends RawServerBase> = RawServer extends http.Server ? HTTPVersion.V1 : HTTPVersion.V2
+  type FindMyWayConfigForServer<RawServer extends RawServerBase> = FindMyWayConfig<FindMyWayVersion<RawServer>>
 
   export interface ConnectionError extends Error {
     code: string,
@@ -89,20 +90,17 @@ declare namespace fastify {
 
   type TrustProxyFunction = (address: string, hop: number) => boolean
 
-  export type FastifyRouterOptions<RawServer extends RawServerBase> = {
-    allowUnsafeRegex?: boolean,
-    buildPrettyMeta?: (route: { [k: string]: unknown, store: { [k: string]: unknown } }) => object,
-    caseSensitive?: boolean,
-    constraints?: {
-      [name: string]: ConstraintStrategy<FindMyWayVersion<RawServer>, unknown>,
-    },
-    defaultRoute?: (req: FastifyRequest, res: FastifyReply) => void,
-    ignoreDuplicateSlashes?: boolean,
-    ignoreTrailingSlash?: boolean,
-    maxParamLength?: number,
-    onBadUrl?: (path: string, req: FastifyRequest, res: FastifyReply) => void,
-    querystringParser?: (str: string) => { [key: string]: unknown },
-    useSemicolonDelimiter?: boolean,
+  export type FastifyRouterOptions<RawServer extends RawServerBase> = Omit<FindMyWayConfigForServer<RawServer>, 'defaultRoute' | 'onBadUrl' | 'querystringParser'> & {
+    defaultRoute?: (
+      req: RawRequestDefaultExpression<RawServer>,
+      res: RawReplyDefaultExpression<RawServer>
+    ) => void,
+    onBadUrl?: (
+      path: string,
+      req: RawRequestDefaultExpression<RawServer>,
+      res: RawReplyDefaultExpression<RawServer>
+    ) => void,
+    querystringParser?: (str: string) => { [key: string]: unknown }
   }
 
   /**
@@ -122,7 +120,7 @@ declare namespace fastify {
     pluginTimeout?: number,
     bodyLimit?: number,
     maxParamLength?: number,
-    disableRequestLogging?: boolean,
+    disableRequestLogging?: boolean | ((req: FastifyRequest) => boolean),
     exposeHeadRoutes?: boolean,
     onProtoPoisoning?: ProtoAction,
     onConstructorPoisoning?: ConstructorAction,
@@ -153,10 +151,7 @@ declare namespace fastify {
       };
     };
     return503OnClosing?: boolean,
-    ajv?: {
-      customOptions?: AjvOptions,
-      plugins?: (Function | [Function, unknown])[]
-    },
+    ajv?: Parameters<BuildCompilerFromPool>[1],
     frameworkErrors?: <RequestGeneric extends RequestGenericInterface = RequestGenericInterface, TypeProvider extends FastifyTypeProvider = FastifyTypeProviderDefault, SchemaCompiler extends FastifySchema = FastifySchema>(
       error: FastifyError,
       req: FastifyRequest<RequestGeneric, RawServer, RawRequestDefaultExpression<RawServer>, FastifySchema, TypeProvider>,

package/fastify.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const VERSION = '5.6.2'
+const VERSION = '5.7.1'
 
 const Avvio = require('avvio')
 const http = require('node:http')
@@ -82,7 +82,7 @@ const { FSTWRN004 } = require('./lib/warnings.js')
 const initChannel = diagnostics.channel('fastify.initialization')
 
 /**
- * @param {import('./fastify.js').FastifyServerOptions} options
+ * @param {import('./fastify.js').FastifyServerOptions} serverOptions
  */
 function fastify (serverOptions) {
   const {
@@ -94,9 +94,7 @@ function fastify (serverOptions) {
   } = processOptions(serverOptions, defaultRoute, onBadUrl)
 
   // Default router
-  const router = buildRouting({
-    config: options.routerOptions
-  })
+  const router = buildRouting(options.routerOptions)
 
   // 404 router, used for handling encapsulated 404 handlers
   const fourOhFour = build404(options)
@@ -643,16 +641,22 @@ function fastify (serverOptions) {
       const request = new Request(id, null, req, null, childLogger, onBadUrlContext)
       const reply = new Reply(res, request, childLogger)
 
-      if (disableRequestLogging === false) {
+      const resolvedDisableRequestLogging = typeof disableRequestLogging === 'function' ? disableRequestLogging(req) : disableRequestLogging
+      if (resolvedDisableRequestLogging === false) {
         childLogger.info({ req: request }, 'incoming request')
       }
 
       return options.frameworkErrors(new FST_ERR_BAD_URL(path), request, reply)
     }
-    const body = `{"error":"Bad Request","code":"FST_ERR_BAD_URL","message":"'${path}' is not a valid url component","statusCode":400}`
+    const body = JSON.stringify({
+      error: 'Bad Request',
+      code: 'FST_ERR_BAD_URL',
+      message: `'${path}' is not a valid url component`,
+      statusCode: 400
+    })
     res.writeHead(400, {
       'Content-Type': 'application/json',
-      'Content-Length': body.length
+      'Content-Length': Buffer.byteLength(body)
     })
     res.end(body)
   }
@@ -668,7 +672,8 @@ function fastify (serverOptions) {
           const request = new Request(id, null, req, null, childLogger, onBadUrlContext)
           const reply = new Reply(res, request, childLogger)
 
-          if (disableRequestLogging === false) {
+          const resolvedDisableRequestLogging = typeof disableRequestLogging === 'function' ? disableRequestLogging(req) : disableRequestLogging
+          if (resolvedDisableRequestLogging === false) {
             childLogger.info({ req: request }, 'incoming request')
           }