fastify 5.8.0 → 5.8.2

package/docs/Guides/Ecosystem.md

@@ -188,6 +188,9 @@ section.
   A Fastify plugin that protects against No(n)SQL injection by sanitizing data.
 - [`@exortek/remix-fastify`](https://github.com/ExorTek/remix-fastify)
   Fastify plugin for Remix.
+- [`@glidemq/fastify`](https://github.com/avifenesh/glidemq-fastify)
+  Queue management plugin for glide-mq with REST API endpoints, SSE events,
+  and in-memory testing mode. Powered by Valkey/Redis Streams.
 - [`@gquittet/graceful-server`](https://github.com/gquittet/graceful-server)
   Tiny (~5k), Fast, KISS, and dependency-free Node.js library to make your
   Fastify API graceful.
@@ -207,6 +210,9 @@ section.
   A Fastify plugin that enforces naming pattern for routes path.
 - [`@joggr/fastify-prisma`](https://github.com/joggrdocs/fastify-prisma)
   A plugin for accessing an instantiated PrismaClient on your server.
+- [`@matths/fastify-svelte-view`](https://github.com/matths/fastify-svelte-view)
+  A Fastify plugin for rendering Svelte components with support for SSR
+  (Server-Side Rendering), CSR (Client-Side Rendering), and SSR with hydration.
 - [`@mgcrea/fastify-graceful-exit`](https://github.com/mgcrea/fastify-graceful-exit)
   A plugin to close the server gracefully
 - [`@mgcrea/fastify-request-logger`](https://github.com/mgcrea/fastify-request-logger)
@@ -225,6 +231,8 @@ section.
   Beautiful OpenAPI/Swagger API references for Fastify
 - [`@trubavuong/fastify-seaweedfs`](https://github.com/trubavuong/fastify-seaweedfs)
   SeaweedFS for Fastify
+- [`@yeliex/fastify-problem-details`](https://github.com/yeliex/fastify-problem-details)
+  RFC 9457 Problem Details implementation for Fastify, with typed HTTP errors.
 - [`apitally`](https://github.com/apitally/apitally-js) Fastify plugin to
   integrate with [Apitally](https://apitally.io/fastify), an API analytics,
   logging and monitoring tool.
@@ -366,6 +374,8 @@ section.
   Fastify feature flags plugin with multiple providers support (e.g. env,
   [config](https://lorenwest.github.io/node-config/),
   [unleash](https://github.com/Unleash/unleash)).
+- [`fastify-file-router`](https://github.com/bhouston/fastify-file-router)
+  A typesafe TanStack Start / Next.JS-style router with JSON + Zod schema support.
 - [`fastify-file-routes`](https://github.com/spa5k/fastify-file-routes) Get
   Next.js based file system routing into fastify.
 - [`fastify-formidable`](https://github.com/climba03003/fastify-formidable)

package/docs/Guides/Migration-Guide-V4.md

@@ -14,24 +14,19 @@ To help with the upgrade, we’ve worked with the team at
 publish codemods that will automatically update your code to many of
 the new APIs and patterns in Fastify v4.
 
-Run the following
-[migration recipe](https://go.codemod.com/fastify-4-migration-recipe) to
-automatically update your code to Fastify v4:
 
-```
+```bash
 npx codemod@latest fastify/4/migration-recipe
 ```
+This applies the following codemods:
 
-This will run the following codemods:
-
-- [`fastify/4/remove-app-use`](https://go.codemod.com/fastify-4-remove-app-use)
-- [`fastify/4/reply-raw-access`](https://go.codemod.com/fastify-4-reply-raw-access)
-- [`fastify/4/wrap-routes-plugin`](https://go.codemod.com/fastify-4-wrap-routes-plugin)
-- [`fastify/4/await-register-calls`](https://go.codemod.com/fastify-4-await-register-calls)
+- fastify/4/remove-app-use
+- fastify/4/reply-raw-access
+- fastify/4/wrap-routes-plugin
+- fastify/4/await-register-calls
 
-Each of these codemods automates the changes listed in the v4 migration guide.
-For a complete list of available Fastify codemods and further details,
-see [Codemod Registry](https://go.codemod.com/fastify).
+For information on the migration recipe, see
+https://app.codemod.com/registry/fastify/4/migration-recipe.
 
 
 ## Breaking Changes

package/docs/Reference/ContentTypeParser.md

@@ -17,6 +17,13 @@ declared in a plugin, it is available only in that scope and its children.
 Fastify automatically adds the parsed request payload to the [Fastify
 request](./Request.md) object, accessible via `request.body`.
 
+> **Important:** When using a body schema with the
+> [`content`](./Validation-and-Serialization.md#body-content-type-validation)
+> property to validate per content type, only content types listed in the schema
+> will be validated. If you add a custom content type parser but do not include
+> its content type in the body schema's `content` property, the incoming data
+> will be parsed but **not validated**.
+
 Note that for `GET` and `HEAD` requests, the payload is never parsed. For
 `OPTIONS` and `DELETE` requests, the payload is parsed only if a valid
 `content-type` header is provided. Unlike `POST`, `PUT`, and `PATCH`, the

package/docs/Reference/Server.md

@@ -1784,7 +1784,10 @@ call is encapsulated by prefix, so different plugins can set different not found
 handlers if a different [`prefix` option](./Plugins.md#route-prefixing-option)
 is passed to `fastify.register()`. The handler is treated as a regular route
 handler so requests will go through the full [Fastify
-lifecycle](./Lifecycle.md#lifecycle). *async-await* is supported as well.
+lifecycle](./Lifecycle.md#lifecycle) for unexisting URLs.
+*async-await* is supported as well.
+Badly formatted URLs are sent to the [`onBadUrl`](#onbadurl)
+handler instead.
 
 You can also register [`preValidation`](./Hooks.md#route-hooks) and
 [`preHandler`](./Hooks.md#route-hooks) hooks for the 404 handler.

package/docs/Reference/Validation-and-Serialization.md

@@ -5,7 +5,11 @@ Fastify uses a schema-based approach. We recommend using
 [JSON Schema](https://json-schema.org/) to validate routes and serialize outputs.
 Fastify compiles the schema into a highly performant function.
 
-Validation is only attempted if the content type is `application/json`.
+Validation is only attempted if the content type is `application/json`,
+unless the body schema uses the [`content`](#body-content-type-validation)
+property to specify validation per content type. When the body schema defines
+a `content` field, it must enumerate all possible content types the
+application expects to handle with the associated handler.
 
 All examples use the
 [JSON Schema Draft 7](https://json-schema.org/specification-links.html#draft-7)
@@ -228,6 +232,9 @@ const schema = {
 fastify.post('/the/url', { schema }, handler)
 ```
 
+#### Body Content-Type Validation
+<a id="body-content-type-validation"></a>
+
 For `body` schema, it is further possible to differentiate the schema per content
 type by nesting the schemas inside `content` property. The schema validation
 will be applied based on the `Content-Type` header in the request.
@@ -250,6 +257,36 @@ fastify.post('/the/url', {
 }, handler)
 ```
 
+> **Important:** When using [custom content type
+> parsers](./ContentTypeParser.md), the parsed body will **only** be validated
+> if the request's content type is listed in the `content` object above. If
+> a parser for a content type (e.g., `application/yaml`) is defined,
+> but it is not not included in the body schema's `content` property,
+> the incoming data will be parsed but **not validated**.
+>
+> ```js
+> // Add a custom parser for YAML
+> fastify.addContentTypeParser('application/yaml', { parseAs: 'string' }, (req, body, done) => {
+>   done(null, YAML.parse(body))
+> })
+>
+> fastify.post('/the/url', {
+>   schema: {
+>     body: {
+>       content: {
+>         'application/json': {
+>           schema: { type: 'object', properties: { name: { type: 'string' } }, required: ['name'] }
+>         },
+>         // Without this entry, application/yaml requests will NOT be validated
+>         'application/yaml': {
+>           schema: { type: 'object', properties: { name: { type: 'string' } }, required: ['name'] }
+>         }
+>       }
+>     }
+>   }
+> }, handler)
+> ```
+
 Note that Ajv will try to [coerce](https://ajv.js.org/coercion.html) values to
 the types specified in the schema `type` keywords, both to pass validation and
 to use the correctly typed data afterwards.

package/fastify.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const VERSION = '5.7.4'
+const VERSION = '5.8.2'
 
 const Avvio = require('avvio')
 const http = require('node:http')

package/lib/content-type.js

@@ -2,16 +2,20 @@
 
 /**
  * keyValuePairsReg is used to split the parameters list into associated
- * key value pairings.
+ * key value pairings. The leading `(?:^|;)\s*` anchor ensures the regex
+ * only attempts matches at parameter boundaries, preventing quadratic
+ * backtracking on malformed input.
  *
  * @see https://httpwg.org/specs/rfc9110.html#parameter
  * @type {RegExp}
  */
-const keyValuePairsReg = /([\w!#$%&'*+.^`|~-]+)=([^;]*)/gm
+const keyValuePairsReg = /(?:^|;)\s*([\w!#$%&'*+.^`|~-]+)=([^;]*)/gm
 
 /**
  * typeNameReg is used to validate that the first part of the media-type
- * does not use disallowed characters.
+ * does not use disallowed characters. Types must consist solely of
+ * characters that match the specified character class. It must terminate
+ * with a matching character.
  *
  * @see https://httpwg.org/specs/rfc9110.html#rule.token.separators
  * @type {RegExp}
@@ -20,12 +24,16 @@ const typeNameReg = /^[\w!#$%&'*+.^`|~-]+$/
 
 /**
  * subtypeNameReg is used to validate that the second part of the media-type
- * does not use disallowed characters.
+ * does not use disallowed characters. Subtypes must consist solely of
+ * characters that match the specified character class, and optionally
+ * terminated with any amount of whitespace characters. Without the terminating
+ * anchor (`$`), the regular expression will match the leading portion of a
+ * string instead of the whole string.
  *
  * @see https://httpwg.org/specs/rfc9110.html#rule.token.separators
  * @type {RegExp}
  */
-const subtypeNameReg = /^[\w!#$%&'*+.^`|~-]+\s*/
+const subtypeNameReg = /^[\w!#$%&'*+.^`|~-]+\s*$/
 
 /**
  * ContentType parses and represents the value of the content-type header.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "5.8.0",
+  "version": "5.8.2",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",
@@ -177,7 +177,7 @@
     "ajv-i18n": "^4.2.0",
     "ajv-merge-patch": "^5.0.1",
     "autocannon": "^8.0.0",
-    "borp": "^1.0.0",
+    "borp": "^0.21.0",
     "branch-comparer": "^1.1.0",
     "concurrently": "^9.1.2",
     "cross-env": "^10.0.0",

package/test/content-type.test.js

@@ -74,6 +74,44 @@ describe('ContentType class', () => {
     found = new ContentType('foo/π; param=1')
     t.assert.equal(found.isEmpty, true)
     t.assert.equal(found.isValid, false)
+
+    found = new ContentType('application/json<script>alert(1)</script>')
+    t.assert.equal(found.isEmpty, true)
+    t.assert.equal(found.isValid, false)
+
+    found = new ContentType('application/json/extra/slashes')
+    t.assert.equal(found.isEmpty, true)
+    t.assert.equal(found.isValid, false)
+
+    found = new ContentType('application/json(garbage)')
+    t.assert.equal(found.isEmpty, true)
+    t.assert.equal(found.isValid, false)
+
+    found = new ContentType('application/json@evil')
+    t.assert.equal(found.isEmpty, true)
+    t.assert.equal(found.isValid, false)
+
+    found = new ContentType('application/json\x00garbage')
+    t.assert.equal(found.isEmpty, true)
+    t.assert.equal(found.isValid, false)
+  })
+
+  test('subtype with multiple fields validates as incorrect', (t) => {
+    let found = new ContentType('application/json whatever')
+    t.assert.equal(found.isValid, false)
+    t.assert.equal(found.isEmpty, true)
+
+    found = new ContentType('application/    json whatever')
+    t.assert.equal(found.isValid, false)
+    t.assert.equal(found.isEmpty, true)
+
+    found = new ContentType('application/json whatever; foo=bar')
+    t.assert.equal(found.isValid, false)
+    t.assert.equal(found.isEmpty, true)
+
+    found = new ContentType('application/    json whatever; foo=bar')
+    t.assert.equal(found.isValid, false)
+    t.assert.equal(found.isEmpty, true)
   })
 
   test('returns a plain media type instance', (t) => {

package/AGENTS.md

@@ -1,290 +0,0 @@
-# AGENTS.md - Guide for AI Agents Working with Fastify
-
-This document provides information and guidelines for AI agents (such as GitHub Copilot, Cursor, pi, or other AI coding assistants) working with the Fastify codebase.
-
-## Project Overview
-
-Fastify is a high-performance web framework for Node.js focused on:
-- **Speed**: One of the fastest Node.js web frameworks
-- **Extensibility**: Powerful plugin architecture with hooks and decorators
-- **Schema-based**: JSON Schema validation and serialization
-- **Developer experience**: Expressive API with minimal overhead
-- **TypeScript support**: Full type definitions included
-
-**Current Version**: 5.7.1 (main branch)
-**Repository**: https://github.com/fastify/fastify
-
-## Repository Structure
-
-```
-fastify/
-├── docs/                 # Documentation (Guides and Reference)
-│   ├── Guides/          # Tutorials and how-to guides
-│   └── Reference/       # API documentation
-├── examples/            # Example applications and benchmarks
-├── lib/                 # Core library code
-├── test/                # Test files
-├── types/               # TypeScript type definitions
-├── build/               # Build scripts
-├── integration/         # Integration tests
-├── fastify.js           # Main entry point
-├── fastify.d.ts         # Main TypeScript definitions
-└── package.json         # Dependencies and scripts
-```
-
-## Key Files for Agents
-
-### Core Files
-- **`fastify.js`** - Main Fastify class and entry point
-- **`fastify.d.ts`** - TypeScript type definitions (keep these in sync)
-- **`lib/`** - All core functionality:
-  - `route.js` - Route handling
-  - `req-res.js` - Request and Reply objects
-  - `hooks.js` - Lifecycle hooks
-  - `plugin.js` - Plugin system
-  - `validation.js` - Schema validation
-  - `content-type-parser.js` - Body parsing
-  - `logger.js` - Pino logger integration
-
-### Configuration Files
-- **`package.json`** - Scripts, dependencies, and contributors
-- **`eslint.config.js`** - Linting configuration (uses neostandard)
-- **`.markdownlint-cli2.yaml`** - Markdown linting rules
-
-### Documentation Files
-- **`README.md`** - Project overview and quick start
-- **`CONTRIBUTING.md`** - Contribution guidelines
-- **`GOVERNANCE.md`** - Links to organization governance
-- **`SECURITY.md`** - Security policy
-- **`docs/Guides/Contributing.md`** - Detailed contributing guide
-- **`docs/Guides/Style-Guide.md`** - Coding style conventions
-
-## Testing Conventions
-
-### Test Framework
-Fastify uses **Borp** (a custom test runner) for testing.
-
-### Test Structure
-- Tests are in the **`test/`** directory
-- Test files follow the pattern: `test/<module>.test.js`
-- Integration tests are in **`integration/`** directory
-
-### Running Tests
-
-```bash
-# Run all tests
-npm test
-
-# Run unit tests only
-npm run unit
-
-# Run tests with coverage
-npm run coverage
-
-# Run tests in watch mode
-npm run test:watch
-
-# Run TypeScript type tests
-npm run test:typescript
-
-# Run CI tests (minimal)
-npm run test:ci
-```
-
-### Test Requirements
-- **100% line coverage** is required for all changes (enforced by CI)
-- Tests must pass on all supported Node.js versions
-- TypeScript types must be tested (using `tsd`)
-
-## Code Style and Conventions
-
-### Linting
-- Uses **Neostandard** JavaScript style guide
-- ESLint is configured in `eslint.config.js`
-- Run `npm run lint` to check code style
-- Run `npm run lint:fix` to auto-fix issues
-
-### Key Style Rules (from Style-Guide.md)
-- Use `const` and `let`, never `var`
-- Use arrow functions for callbacks
-- Use async/await instead of promises
-- Follow semicolon usage (neostandard enforces this)
-- Use template literals for string interpolation
-- Prefer functional methods (`map`, `filter`, `reduce`) over loops
-- Error-first callback pattern for async operations where needed
-
-### Naming Conventions
-- **Files**: kebab-case (`content-type-parser.js`)
-- **Variables**: camelCase
-- **Constants**: UPPER_SNAKE_CASE
-- **Classes**: PascalCase
-- **Private methods**: prefixed with `_`
-
-## Common Tasks
-
-### Adding a New Feature
-1. Implement the feature in `lib/`
-2. Add tests in `test/`
-3. Update TypeScript types in `fastify.d.ts` or `types/`
-4. Update documentation in `docs/`
-5. Run `npm test` to ensure all tests pass
-6. Run `npm run lint` to check code style
-7. Add changelog entry for release
-
-### Fixing a Bug
-1. Add a failing test case in `test/`
-2. Fix the bug in `lib/`
-3. Ensure all tests pass
-4. Check if TypeScript types need updating
-5. Update documentation if behavior changes
-
-### Working with Plugins
-- See `docs/Guides/Write-Plugin.md` for plugin authoring
-- See `docs/Guides/Plugins-Guide.md` for plugin usage
-- Plugin example: `lib/plugin.js`
-
-## Architecture Highlights
-
-### Core Components
-
-1. **Server (`fastify.js`)**
-   - Main Fastify class
-   - Server initialization and configuration
-   - Plugin system integration (via `avvio`)
-
-2. **Routing (`lib/route.js`)**
-   - Uses `find-my-way` for fast route matching
-   - Route registration and lookup
-   - Shorthand methods (get, post, put, delete, etc.)
-
-3. **Request/Response (`lib/req-res.js`)**
-   - Request object extensions
-   - Reply object with fluent API
-   - Decorator support
-
-4. **Hooks (`lib/hooks.js`)**
-   - Lifecycle hooks (onRequest, preHandler, etc.)
-   - Hook execution order and timing
-
-5. **Validation (`lib/validation.js`)**
-   - JSON Schema validation via AJV
-   - Response serialization
-   - Built-in error serializer
-
-6. **Content Type Parser (`lib/content-type-parser.js`)**
-   - Request body parsing
-   - Custom parser support
-   - JSON and other formats
-
-### Plugin System
-- Plugins are loaded asynchronously via `avvio`
-- Supports encapsulation (scoped plugins)
-- Hooks and decorators can be scoped
-- See `lib/plugin.js` for implementation
-
-## TypeScript Integration
-
-- TypeScript definitions are in `fastify.d.ts` and `types/`
-- Types must be tested with `tsd`
-- Run `npm run test:typescript` to verify types
-- Keep types in sync with JavaScript implementation
-
-## Performance Considerations
-
-Fastify prioritizes performance:
-- **Routes**: Pre-compiled functions for fast matching
-- **Validation**: Compiled JSON Schema validators
-- **Serialization**: Compiled serializers (fast-json-stringify)
-- **Logging**: Low-overhead Pino logger
-- **Caching**: Route context caching with `toad-cache`
-
-When making changes:
-- Profile performance impact for hot paths
-- Use benchmarks in `examples/benchmark/`
-- Run `npm run benchmark` to measure
-
-## Documentation Updates
-
-Documentation is critical for Fastify. When changing behavior:
-
-1. Update relevant docs in `docs/Reference/` for API changes
-2. Update `docs/Guides/` for usage pattern changes
-3. Check for broken links (CI validates this)
-4. Update examples in `examples/` if needed
-5. Run `npm run lint:markdown` to check docs
-
-## Pre-commit Checks
-
-Before submitting changes, ensure:
-
-1. ✅ All tests pass: `npm test`
-2. ✅ 100% coverage: `npm run coverage`
-3. ✅ Linting passes: `npm run lint`
-4. ✅ TypeScript types pass: `npm run test:typescript`
-5. ✅ Markdown linting passes: `npm run lint:markdown`
-6. ✅ Documentation is updated
-7. ✅ Examples still work if affected
-
-## Working with CI
-
-Fastify uses GitHub Actions for CI. Workflows are in `.github/workflows/`:
-- **`ci.yml`** - Main CI pipeline
-- **`package-manager-ci.yml`** - Tests multiple package managers
-- **`website.yml`** - Website deployment
-
-## Agent-Specific Tips
-
-### When Generating Code
-1. Check existing patterns in `lib/` before creating new patterns
-2. Follow the established error handling patterns
-3. Use async/await consistently
-4. Add appropriate hooks if extending lifecycle
-5. Consider TypeScript types from the start
-
-### When Refactoring
-1. Ensure all tests still pass
-2. Don't change public APIs without semver consideration
-3. Update TypeScript definitions if signatures change
-4. Check for deprecation needs
-5. Update documentation for changed behavior
-
-### When Analyzing Issues
-1. Check `test/` for usage examples
-2. Review relevant `docs/Reference/` files
-3. Look at similar implementations in `lib/`
-4. Consider the plugin system and encapsulation
-5. Check hook timing and order
-
-### Common Gotchas
-- **Encapsulation**: Plugins are isolated - decorators don't leak
-- **Hook order**: Hooks run in specific order (see docs/Reference/Hooks.md)
-- **Async boot**: Server starts asynchronously - use `ready()` or `after()`
-- **Error handling**: Use Fastify error classes from `@fastify/error`
-- **Validation**: Schemas are compiled - changes require recompilation
-
-## Key Dependencies
-
-- **`avvio`** - Plugin loading and boot
-- **`find-my-way`** - Fast HTTP router
-- **`fast-json-stringify`** - Response serialization
-- **`pino`** - Logging
-- **`@fastify/ajv-compiler`** - JSON Schema validation
-- **`light-my-request`** - HTTP injection for testing
-
-## Contact and Resources
-
-- **Documentation**: https://fastify.dev/
-- **Discord**: https://discord.gg/fastify
-- **GitHub Issues**: https://github.com/fastify/fastify/issues
-- **GitHub Discussions**: https://github.com/fastify/fastify/discussions
-- **Help**: https://github.com/fastify/help
-
-## Version Information
-
-- **Main branch**: Fastify v5
-- **v4 branch**: https://github.com/fastify/fastify/tree/4.x
-- **LTS Policy**: See `docs/Reference/LTS.md`
-
----
-
-This document is maintained by the Fastify team. For questions or suggestions, please open an issue or discussion.