fastify 5.8.5 → 5.10.0

package/lib/symbols.js

@@ -13,7 +13,6 @@ const keys = {
   kContentTypeParser: Symbol('fastify.contentTypeParser'),
   kState: Symbol('fastify.state'),
   kOptions: Symbol('fastify.options'),
-  kDisableRequestLogging: Symbol('fastify.disableRequestLogging'),
   kPluginNameChain: Symbol('fastify.pluginNameChain'),
   kRouteContext: Symbol('fastify.context'),
   kGenReqId: Symbol('fastify.genReqId'),
@@ -32,6 +31,7 @@ const keys = {
   kRequestPayloadStream: Symbol('fastify.RequestPayloadStream'),
   kRequestAcceptVersion: Symbol('fastify.RequestAcceptVersion'),
   kRequestCacheValidateFns: Symbol('fastify.request.cache.validateFns'),
+  kRequestContentType: Symbol('fastify.request.contentType'),
   kRequestOriginalUrl: Symbol('fastify.request.originalUrl'),
   kRequestSignal: Symbol('fastify.request.signal'),
   kHandlerTimeout: Symbol('fastify.handlerTimeout'),
@@ -65,7 +65,9 @@ const keys = {
   kChildLoggerFactory: Symbol('fastify.childLoggerFactory'),
   kHasBeenDecorated: Symbol('fastify.hasBeenDecorated'),
   kKeepAliveConnections: Symbol('fastify.keepAliveConnections'),
-  kRouteByFastify: Symbol('fastify.routeByFastify')
+  kRouteByFastify: Symbol('fastify.routeByFastify'),
+  kLogController: Symbol('fastify.logController'),
+  kDiagnosticsStore: Symbol('fastify.diagnosticsStore')
 }
 
 module.exports = keys

package/lib/validation.js

@@ -146,6 +146,15 @@ function validateParam (validatorFunction, request, paramName) {
 function validate (context, request, execution) {
   const runExecution = execution === undefined
 
+  if (runExecution &&
+    context[paramsSchema] === undefined &&
+    context[bodySchema] === undefined &&
+    context[querystringSchema] === undefined &&
+    context[headersSchema] === undefined) {
+    // the route has no validation schemas
+    return false
+  }
+
   if (runExecution || !execution.skipParams) {
     const params = validateParam(context[paramsSchema], request, 'params')
     if (params) {
@@ -162,9 +171,7 @@ function validate (context, request, execution) {
     if (typeof context[bodySchema] === 'function') {
       validatorFunction = context[bodySchema]
     } else if (context[bodySchema]) {
-      // TODO: add request.contentType and reuse it here
-      const contentType = getEssenceMediaType(request.headers['content-type'])
-      const contentSchema = context[bodySchema][contentType]
+      const contentSchema = context[bodySchema][request.mediaType]
       if (contentSchema) {
         validatorFunction = contentSchema
       }
@@ -262,16 +269,6 @@ function wrapValidationError (result, dataVar, schemaErrorFormatter) {
   return error
 }
 
-/**
- * simple function to retrieve the essence media type
- * @param {string} header
- * @returns {string} Mimetype string.
- */
-function getEssenceMediaType (header) {
-  if (!header) return ''
-  return header.trimStart().split(/[ ;]/, 1)[0].trim().toLowerCase()
-}
-
 module.exports = {
   symbols: { bodySchema, querystringSchema, responseSchema, paramsSchema, headersSchema },
   compileSchemasForValidation,

package/lib/warnings.js

@@ -7,10 +7,12 @@ const { createWarning } = require('process-warning')
  *   - FSTWRN001
  *   - FSTSEC001
  *   - FSTDEP022
+ *   - FSTDEP023
+ *   - FSTDEP024
  *
- * Deprecation Codes FSTDEP001 - FSTDEP021 were used by v4 and MUST NOT not be reused.
+ * Deprecation Codes FSTDEP001 - FSTDEP021 were used by v4 and MUST NOT be reused.
  *                             - FSTDEP022 is used by v5 and MUST NOT be reused.
- * Warning Codes FSTWRN001 - FSTWRN002 were used by v4 and MUST NOT not be reused.
+ * Warning Codes FSTWRN001 - FSTWRN002 were used by v4 and MUST NOT be reused.
  */
 
 const FSTWRN001 = createWarning({
@@ -30,7 +32,7 @@ const FSTWRN003 = createWarning({
 const FSTWRN004 = createWarning({
   name: 'FastifyWarning',
   code: 'FSTWRN004',
-  message: 'It seems that you are overriding an errorHandler in the same scope, which can lead to subtle bugs.',
+  message: 'It seems that you are overriding an errorHandler in the same scope, which can lead to subtle bugs. To disable this behavior, set \'allowErrorHandlerOverride\' to false. For more information, visit: https://fastify.dev/docs/latest/Reference/Server/#allowerrorhandleroverride',
   unlimited: true
 })
 
@@ -48,10 +50,26 @@ const FSTDEP022 = createWarning({
   unlimited: true
 })
 
+const FSTDEP023 = createWarning({
+  name: 'FastifyDeprecation',
+  code: 'FSTDEP023',
+  message: 'disableRequestLogging option is deprecated. Use the logController option with disableRequestLogging or isLogDisabled override instead. The disableRequestLogging top-level option will be removed in `fastify@6`.',
+  unlimited: true
+})
+
+const FSTDEP024 = createWarning({
+  name: 'FastifyDeprecation',
+  code: 'FSTDEP024',
+  message: 'requestIdLogLabel option is deprecated. Use the logController option with requestIdLogLabel instead. The requestIdLogLabel top-level option will be removed in `fastify@6`.',
+  unlimited: true
+})
+
 module.exports = {
   FSTWRN001,
   FSTWRN003,
   FSTWRN004,
   FSTSEC001,
-  FSTDEP022
+  FSTDEP022,
+  FSTDEP023,
+  FSTDEP024
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "5.8.5",
+  "version": "5.10.0",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",
@@ -19,11 +19,11 @@
     "lint:markdown": "markdownlint-cli2",
     "lint:eslint": "eslint",
     "prepublishOnly": "cross-env PREPUBLISH=true borp --reporter=@jsumners/line-reporter && npm run test:validator:integrity && npm run build:sync-version",
-    "test": "npm run lint && npm run unit && npm run test:typescript",
-    "test:ci": "npm run unit && npm run test:typescript",
-    "test:report": "npm run lint && npm run unit:report && npm run test:typescript",
+    "test": "npm run lint && npm run unit && npm run test:types",
+    "test:ci": "npm run unit && npm run test:types",
+    "test:report": "npm run lint && npm run unit:report && npm run test:types",
     "test:validator:integrity": "npm run build:validation && git diff --quiet --ignore-all-space --ignore-blank-lines --ignore-cr-at-eol lib/error-serializer.js && git diff --quiet --ignore-all-space --ignore-blank-lines --ignore-cr-at-eol lib/config-validator.js",
-    "test:typescript": "tsc test/types/import.ts --target es2022 --moduleResolution node16 --module node16 --noEmit && tsd",
+    "test:types": "tstyche",
     "test:watch": "npm run unit -- --watch --coverage-report=none --reporter=terse",
     "unit": "borp",
     "unit:report": "c8 --reporter html borp --reporter=@jsumners/line-reporter",
@@ -45,7 +45,7 @@
   "contributors": [
     {
       "name": "Tomas Della Vedova",
-      "url": "http://delved.org",
+      "url": "https://delvedor.dev",
       "author": true
     },
     {
@@ -59,7 +59,7 @@
     },
     {
       "name": "Dustin Deus",
-      "url": "http://starptech.de",
+      "url": "https://starptech.com",
       "email": "deusdustin@gmail.com"
     },
     {
@@ -74,7 +74,7 @@
     },
     {
       "name": "Trivikram Kamat",
-      "url": "http://trivikr.github.io",
+      "url": "https://trivikr.github.io",
       "email": "trivikr.dev@gmail.com"
     },
     {
@@ -170,7 +170,7 @@
     "@sinonjs/fake-timers": "^11.2.2",
     "@stylistic/eslint-plugin": "^5.1.0",
     "@stylistic/eslint-plugin-js": "^4.1.0",
-    "@types/node": "^25.0.3",
+    "@types/node": "^26.0.1",
     "ajv": "^8.12.0",
     "ajv-errors": "^3.0.0",
     "ajv-formats": "^3.0.1",
@@ -179,11 +179,12 @@
     "autocannon": "^8.0.0",
     "borp": "^1.0.0",
     "branch-comparer": "^1.1.0",
-    "concurrently": "^9.1.2",
+    "concurrently": "^10.0.0",
     "cross-env": "^10.0.0",
     "eslint": "^9.0.0",
     "fast-json-body": "^1.1.0",
-    "fastify-plugin": "^5.0.0",
+    "fastify-plugin": "^6.0.0",
+    "fastify-tsconfig": "^3.0.0",
     "fluent-json-schema": "^6.0.0",
     "h2url": "^0.2.0",
     "http-errors": "^2.0.0",
@@ -195,7 +196,7 @@
     "node-forge": "^1.3.1",
     "proxyquire": "^2.1.3",
     "split2": "^4.2.0",
-    "tsd": "^0.33.0",
+    "tstyche": "^7.0.0",
     "typebox": "^1.0.81",
     "typescript": "~6.0.2",
     "undici": "^7.11.0",
@@ -209,8 +210,8 @@
     "@fastify/proxy-addr": "^5.0.0",
     "abstract-logging": "^2.0.1",
     "avvio": "^9.0.0",
-    "fast-json-stringify": "^6.0.0",
-    "find-my-way": "^9.0.0",
+    "fast-json-stringify": "^7.0.0",
+    "find-my-way": "^9.6.0",
     "light-my-request": "^6.0.0",
     "pino": "^9.14.0 || ^10.1.0",
     "process-warning": "^5.0.0",
@@ -218,8 +219,5 @@
     "secure-json-parse": "^4.0.0",
     "semver": "^7.6.0",
     "toad-cache": "^3.7.0"
-  },
-  "tsd": {
-    "directory": "test/types"
   }
 }

package/scripts/validate-ecosystem-links.js

@@ -14,6 +14,7 @@
 
 const fs = require('node:fs')
 const path = require('node:path')
+const { fetch } = require('undici')
 
 const ECOSYSTEM_FILE = path.join(__dirname, '../docs/Guides/Ecosystem.md')
 const GITHUB_OWNER_REGEX = /^[a-z\d](?:[a-z\d-]{0,38})$/i

package/test/bundler/esbuild/package.json

@@ -5,6 +5,6 @@
     "test": "npm run bundle && node bundler-test.js"
   },
   "devDependencies": {
-    "esbuild": "^0.25.0"
+    "esbuild": "^0.28.1"
   }
 }

package/test/close-pipelining.test.js

@@ -41,8 +41,7 @@ test('Should return 503 while closing - pipelining', async t => {
 })
 
 test('Should close the socket abruptly - pipelining - return503OnClosing: false', async t => {
-  // Since Node v20, we will always invoke server.closeIdleConnections()
-  // therefore our socket will be closed
+  // Node.js will always invoke server.closeIdleConnections() therefore our socket will be closed
   const fastify = Fastify({
     return503OnClosing: false,
     forceCloseConnections: false

package/test/content-type.test.js

@@ -179,3 +179,23 @@ describe('ContentType class', () => {
     )
   })
 })
+
+describe('ContentType class cache', () => {
+  test('allow access cache', (t) => {
+    const contentType1 = ContentType.from('application/json')
+    const contentType2 = ContentType.cache.get('application/json')
+    t.assert.equal(contentType1, contentType2)
+  })
+
+  test('returns same instance for the same content type string', (t) => {
+    const contentType1 = ContentType.from('application/json')
+    const contentType2 = ContentType.from('application/json')
+    t.assert.equal(contentType1, contentType2)
+  })
+
+  test('returns different instances for different content type strings', (t) => {
+    const contentType1 = ContentType.from('application/json')
+    const contentType2 = ContentType.from('text/plain')
+    t.assert.notEqual(contentType1, contentType2)
+  })
+})

package/test/custom-http-server.test.js

@@ -63,6 +63,44 @@ async function setup () {
     )
   })
 
+  test('Should not make an extra closeIdleConnections call for native servers', async t => {
+    const fastify = Fastify({
+      forceCloseConnections: 'idle'
+    })
+
+    await fastify.listen({ port: 0 })
+
+    let called = 0
+    fastify.server.closeIdleConnections = function () {
+      called++
+    }
+
+    await fastify.close()
+
+    t.assert.strictEqual(called, 1)
+  })
+
+  test('Should preserve the extra closeIdleConnections call for custom servers', async t => {
+    let called = 0
+    const fastify = Fastify({
+      forceCloseConnections: 'idle',
+      serverFactory (handler) {
+        const server = http.createServer(handler)
+        const originalCloseIdleConnections = server.closeIdleConnections.bind(server)
+        server.closeIdleConnections = function () {
+          called++
+          return originalCloseIdleConnections()
+        }
+        return server
+      }
+    })
+
+    await fastify.listen({ port: 0 })
+    await fastify.close()
+
+    t.assert.strictEqual(called, 2)
+  })
+
   test('Should accept user defined serverFactory and ignore secondary server creation', async t => {
     const server = http.createServer(() => { })
     t.after(() => new Promise(resolve => server.close(resolve)))

package/test/decorator-instance-properties.test.js

@@ -0,0 +1,63 @@
+'use strict'
+
+const { test } = require('node:test')
+const Fastify = require('..')
+
+test('hasRequestDecorator returns true for built-in constructor-assigned request properties', t => {
+  t.plan(6)
+  const fastify = Fastify()
+  t.assert.equal(fastify.hasRequestDecorator('id'), true)
+  t.assert.equal(fastify.hasRequestDecorator('params'), true)
+  t.assert.equal(fastify.hasRequestDecorator('raw'), true)
+  t.assert.equal(fastify.hasRequestDecorator('query'), true)
+  t.assert.equal(fastify.hasRequestDecorator('log'), true)
+  t.assert.equal(fastify.hasRequestDecorator('body'), true)
+})
+
+test('hasReplyDecorator returns true for built-in constructor-assigned reply properties', t => {
+  t.plan(3)
+  const fastify = Fastify()
+  t.assert.equal(fastify.hasReplyDecorator('raw'), true)
+  t.assert.equal(fastify.hasReplyDecorator('request'), true)
+  t.assert.equal(fastify.hasReplyDecorator('log'), true)
+})
+
+test('decorateRequest throws FST_ERR_DEC_ALREADY_PRESENT for built-in request properties', t => {
+  t.plan(4)
+  const fastify = Fastify()
+  for (const name of ['id', 'params', 'raw', 'body']) {
+    t.assert.throws(
+      () => fastify.decorateRequest(name, null),
+      (err) => err.code === 'FST_ERR_DEC_ALREADY_PRESENT'
+    )
+  }
+})
+
+test('decorateReply throws FST_ERR_DEC_ALREADY_PRESENT for built-in reply properties', t => {
+  t.plan(2)
+  const fastify = Fastify()
+  for (const name of ['raw', 'request']) {
+    t.assert.throws(
+      () => fastify.decorateReply(name, null),
+      (err) => err.code === 'FST_ERR_DEC_ALREADY_PRESENT'
+    )
+  }
+})
+
+test('hasRequestDecorator returns false for unknown properties', t => {
+  t.plan(1)
+  const fastify = Fastify()
+  t.assert.equal(fastify.hasRequestDecorator('nonExistent'), false)
+})
+
+test('decorateRequest still works for non-built-in names', (t, done) => {
+  t.plan(2)
+  const fastify = Fastify()
+  fastify.decorateRequest('myExtra', null)
+  t.assert.equal(fastify.hasRequestDecorator('myExtra'), true)
+  fastify.get('/', async (req) => req.myExtra)
+  fastify.ready((err) => {
+    t.assert.ifError(err)
+    done()
+  })
+})

package/test/diagnostics-channel/async-error-handler.test.js

@@ -0,0 +1,74 @@
+'use strict'
+
+const { test } = require('node:test')
+const diagnostics = require('node:diagnostics_channel')
+const Fastify = require('../..')
+const Request = require('../../lib/request')
+const Reply = require('../../lib/reply')
+
+test('diagnostics channel tracks async operations in async error handlers', async t => {
+  t.plan(17)
+  let callOrder = 0
+  let firstEncounteredMessage
+  let asyncStartFired = false
+  let asyncEndFired = false
+
+  const fastify = Fastify()
+
+  function subscribe (name, handler) {
+    const wrapped = (msg) => {
+      if (msg.request.server === fastify) handler(msg)
+    }
+    diagnostics.subscribe(name, wrapped)
+    t.after(() => diagnostics.unsubscribe(name, wrapped))
+  }
+
+  subscribe('tracing:fastify.request.handler:start', (msg) => {
+    t.assert.strictEqual(callOrder++, 0)
+    firstEncounteredMessage = msg
+    t.assert.ok(msg.request instanceof Request)
+    t.assert.ok(msg.reply instanceof Reply)
+  })
+
+  subscribe('tracing:fastify.request.handler:error', (msg) => {
+    t.assert.strictEqual(callOrder++, 1)
+    t.assert.ok(msg.error instanceof Error)
+    t.assert.strictEqual(msg.error.message, 'handler error')
+  })
+
+  subscribe('tracing:fastify.request.handler:end', (msg) => {
+    t.assert.strictEqual(callOrder++, 2)
+    t.assert.strictEqual(msg, firstEncounteredMessage)
+    t.assert.strictEqual(msg.async, true)
+  })
+
+  subscribe('tracing:fastify.request.handler:asyncStart', (msg) => {
+    t.assert.strictEqual(callOrder++, 3)
+    t.assert.strictEqual(msg, firstEncounteredMessage)
+    asyncStartFired = true
+  })
+
+  subscribe('tracing:fastify.request.handler:asyncEnd', (msg) => {
+    t.assert.strictEqual(callOrder++, 4)
+    t.assert.strictEqual(msg, firstEncounteredMessage)
+    asyncEndFired = true
+  })
+
+  fastify.setErrorHandler(async (error, request, reply) => {
+    await new Promise(resolve => setImmediate(resolve))
+    reply.status(503).send({ error: error.message })
+  })
+
+  fastify.get('/', () => {
+    throw new Error('handler error')
+  })
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+  t.after(() => fastify.close())
+
+  const response = await fetch(fastifyServer)
+  t.assert.ok(!response.ok)
+  t.assert.strictEqual(response.status, 503)
+  t.assert.ok(asyncStartFired, 'asyncStart should fire for async error handler')
+  t.assert.ok(asyncEndFired, 'asyncEnd should fire for async error handler')
+})

package/test/genReqId.test.js

@@ -85,6 +85,30 @@ test('Should handle properly requestIdHeader option', t => {
   t.assert.strictEqual(Fastify({ requestIdHeader: 'x-request-id' }).initialConfig.requestIdHeader, 'x-request-id')
 })
 
+test('Should expose the genReqId function via the getter', (t, done) => {
+  t.plan(5)
+
+  const fastify = Fastify()
+  t.assert.strictEqual(typeof fastify.genReqId, 'function')
+  t.assert.strictEqual(typeof fastify.genReqId({ headers: {} }), 'string')
+
+  const custom = function (req) {
+    return 'custom'
+  }
+
+  fastify.register(function (instance, opts, next) {
+    instance.setGenReqId(custom)
+    t.assert.strictEqual(instance.genReqId(), 'custom')
+    next()
+  })
+
+  fastify.ready(err => {
+    t.assert.ifError(err)
+    t.assert.notStrictEqual(fastify.genReqId, custom)
+    done()
+  })
+})
+
 test('Should accept option to set genReqId with setGenReqId option', (t, done) => {
   t.plan(9)
 

package/test/hooks.test.js

@@ -12,6 +12,7 @@ const proxyquire = require('proxyquire')
 const { connect } = require('node:net')
 const { sleep } = require('./helper')
 const { waitForCb } = require('./toolkit.js')
+const { fetch } = require('undici')
 
 process.removeAllListeners('warning')
 
@@ -3277,6 +3278,28 @@ test('onTimeout should be triggered and socket _meta is set', async t => {
   }
 })
 
+test('socket._meta is cleared after response to prevent keep-alive leaks', async t => {
+  t.plan(3)
+  const fastify = Fastify({ connectionTimeout: 500 })
+  t.after(() => { fastify.close() })
+
+  fastify.addHook('onTimeout', function (req, res, done) { done() })
+
+  fastify.addHook('onResponse', function (req, reply, done) {
+    t.assert.strictEqual(req.raw.socket._meta, null, 'socket._meta must be null after response')
+    done()
+  })
+
+  fastify.get('/', async (req, reply) => {
+    return { hello: 'world' }
+  })
+
+  const address = await fastify.listen({ port: 0 })
+  const result = await fetch(address)
+  t.assert.ok(result.ok)
+  t.assert.strictEqual(result.status, 200)
+})
+
 test('registering invalid hooks should throw an error', async t => {
   t.plan(3)
 
@@ -3576,3 +3599,74 @@ test('onRequestAbort should handle async errors / 2', (t, testDone) => {
     sleep(500).then(() => socket.destroy())
   })
 })
+
+test('socket timeout listener is removed when socket._meta is cleared after response', async t => {
+  t.plan(4)
+
+  const fastify = Fastify({ connectionTimeout: 200 })
+  t.after(() => fastify.close())
+
+  fastify.addHook('onTimeout', function (req, reply, done) { done() })
+
+  fastify.addHook('onResponse', function (req, reply, done) {
+    const socket = req.raw.socket
+    t.assert.strictEqual(socket._meta, null, 'socket._meta must be null after response')
+    t.assert.strictEqual(socket.listeners('timeout').some(listener => listener.name === 'handleTimeout'), false, 'Fastify timeout listener must be removed after response')
+    done()
+  })
+
+  fastify.get('/', async () => ({ ok: true }))
+
+  const address = await fastify.listen({ port: 0 })
+  const result = await fetch(address)
+  t.assert.ok(result.ok)
+  t.assert.strictEqual(result.status, 200)
+})
+
+test('socket._meta and timeout listener are cleared on reply.hijack() when onTimeout is registered', async t => {
+  // reply.hijack() opts out of Fastify's response lifecycle so onResFinished
+  // never fires. Before this fix, socket._meta was left pointing at the
+  // request/reply objects for the full keep-alive socket lifetime when
+  // an onTimeout hook was registered.
+  t.plan(3)
+
+  const net = require('node:net')
+  const fastify = Fastify({ connectionTimeout: 300 })
+  t.after(() => fastify.close())
+
+  fastify.addHook('onTimeout', function (req, reply, done) { done() })
+
+  let metaAfterHijack = 'not-set'
+  let hasFastifyTimeoutListenerAfterHijack = true
+  fastify.get('/', async (req, reply) => {
+    reply.hijack()
+    // _meta must be cleared synchronously inside hijack()
+    metaAfterHijack = req.raw.socket._meta
+    hasFastifyTimeoutListenerAfterHijack = req.raw.socket.listeners('timeout').some(listener => listener.name === 'handleTimeout')
+    // Write a minimal valid HTTP/1.1 response and close
+    reply.raw.write('HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok')
+    reply.raw.end()
+    return reply
+  })
+
+  await fastify.listen({ port: 0 })
+
+  // Use raw TCP so we are not affected by fetch() rejecting a closed socket.
+  // Extract host/port from the server address object to handle IPv6 (::1) on Windows.
+  const { port, address: host } = fastify.server.address()
+  await new Promise((resolve, reject) => {
+    const socket = net.connect(port, host, () => {
+      socket.write('GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n')
+    })
+    socket.on('data', () => {})
+    socket.on('close', resolve)
+    socket.on('error', reject)
+  })
+
+  t.assert.ok(true, 'no crash during hijacked request with onTimeout registered')
+  t.assert.ok(
+    metaAfterHijack == null,
+    `socket._meta must be null or undefined after reply.hijack() — got: ${JSON.stringify(metaAfterHijack)}`
+  )
+  t.assert.strictEqual(hasFastifyTimeoutListenerAfterHijack, false, 'Fastify timeout listener must be removed after reply.hijack()')
+})

package/test/http-methods/get.test.js

@@ -1,7 +1,7 @@
 'use strict'
 
 const { test } = require('node:test')
-const { Client } = require('undici')
+const { Client, fetch } = require('undici')
 const fastify = require('../../fastify')()
 
 const schema = {