fastify 5.9.0 → 5.10.0

package/lib/reply.js

@@ -16,7 +16,6 @@ const {
   kReplyHasStatusCode,
   kReplyIsRunningOnErrorHook,
   kReplyNextErrorHandler,
-  kDisableRequestLogging,
   kSchemaResponse,
   kReplyCacheSerializeFns,
   kSchemaController,
@@ -24,7 +23,8 @@ const {
   kRouteContext,
   kTimeoutTimer,
   kOnAbort,
-  kRequestSignal
+  kRequestSignal,
+  kLogController
 } = require('./symbols.js')
 const {
   onSendHookRunner,
@@ -58,6 +58,7 @@ const {
   FST_ERR_DEC_UNDECLARED
 } = require('./errors')
 const decorators = require('./decorate')
+const ContentType = require('./content-type.js')
 
 const toString = Object.prototype.toString
 const HTTP2_WRITE_CHUNK_SIZE = 64 * 1024
@@ -135,6 +136,14 @@ Reply.prototype.hijack = function () {
       this.request[kOnAbort] = null
     }
   }
+  // Clear socket._meta so hijacked replies (e.g. WebSocket upgrades) do not
+  // retain request/reply objects for the lifetime of the keep-alive socket
+  // when an onTimeout hook is registered.
+  const socket = this.request.raw.socket
+  if (socket?._meta?.request === this.request) {
+    socket.removeListener('timeout', socket._meta.onTimeout)
+    socket._meta = null
+  }
   return this
 }
 
@@ -159,8 +168,8 @@ Reply.prototype.send = function (payload) {
     return this
   }
 
-  const contentType = this.getHeader('content-type')
-  const hasContentType = contentType !== undefined
+  const contentType = ContentType.from(this.getHeader('content-type'))
+  const hasContentType = contentType.isEmpty === false
 
   if (payload !== null) {
     if (
@@ -201,18 +210,17 @@ Reply.prototype.send = function (payload) {
     payload = this[kReplySerializer](payload)
 
     // The indexOf below also matches custom json mimetypes such as 'application/hal+json' or 'application/ld+json'
-  } else if (!hasContentType || contentType.indexOf('json') !== -1) {
+  } else if (!hasContentType || contentType.mediaType.indexOf('json') !== -1) {
     if (!hasContentType) {
       this[kReplyHeaders]['content-type'] = CONTENT_TYPE.JSON
-    } else if (contentType.indexOf('charset') === -1) {
+    } else if (contentType.parameters.has('charset') === false) {
+      // The lookup is case-insensitive because HTTP parameter names are
+      // case-insensitive (RFC 9110 section 5.6.6).
       // If user doesn't set charset, we will set charset to utf-8
-      const customContentType = contentType.trim()
-      if (customContentType.endsWith(';')) {
-        // custom content-type is ended with ';'
-        this[kReplyHeaders]['content-type'] = `${customContentType} charset=utf-8`
-      } else {
-        this[kReplyHeaders]['content-type'] = `${customContentType}; charset=utf-8`
-      }
+      const customContentType = contentType.toString()
+      // ContentType.toString already handle the trailing ;
+      // We can safely append the charset parameter to the end of the string
+      this[kReplyHeaders]['content-type'] = `${customContentType}; charset=utf-8`
     }
 
     if (typeof payload !== 'string') {
@@ -688,6 +696,12 @@ function isHttp2Reply (reply) {
 
 function writePayload (payload, res, reply) {
   if (!isHttp2Reply(reply) || Buffer.byteLength(payload) <= HTTP2_WRITE_CHUNK_SIZE) {
+    if (reply[kReplyTrailers] === null) {
+      // end(payload) corks the socket, so headers, payload and the
+      // finishing chunk are flushed with a single write
+      res.end(payload, null, null) // avoid ArgumentsAdaptorTrampoline from V8
+      return
+    }
     res.write(payload)
     // then send trailers
     sendTrailer(payload, res, reply)
@@ -727,14 +741,8 @@ function writeHttp2Payload (payload, res, done) {
   writeChunk()
 }
 
-function logStreamError (logger, err, res) {
-  if (err.code === 'ERR_STREAM_PREMATURE_CLOSE') {
-    if (!logger[kDisableRequestLogging]) {
-      logger.info({ res }, 'stream closed prematurely')
-    }
-  } else {
-    logger.warn({ err }, 'response terminated with an error with headers already sent')
-  }
+function logStreamError (err, reply, res) {
+  reply.server[kLogController].streamError(err, reply.request, reply)
 }
 
 function sendWebStream (payload, res, reply) {
@@ -751,7 +759,7 @@ function sendWebStream (payload, res, reply) {
     if (sourceOpen) {
       if (err != null && res.headersSent && !errorLogged) {
         errorLogged = true
-        logStreamError(reply.log, err, res)
+        logStreamError(err, reply, res)
       }
       reader.cancel().catch(noop)
     }
@@ -799,7 +807,7 @@ function sendWebStream (payload, res, reply) {
     if (res.headersSent || reply.request.raw.aborted === true) {
       if (!errorLogged) {
         errorLogged = true
-        logStreamError(reply.log, err, reply)
+        logStreamError(err, reply, reply)
       }
       res.destroy()
     } else {
@@ -823,7 +831,7 @@ function sendStream (payload, res, reply) {
       if (res.headersSent || reply.request.raw.aborted === true) {
         if (!errorLogged) {
           errorLogged = true
-          logStreamError(reply.log, err, reply)
+          logStreamError(err, reply, reply)
         }
         res.destroy()
       } else {
@@ -837,7 +845,7 @@ function sendStream (payload, res, reply) {
     if (sourceOpen) {
       if (err != null && res.headersSent && !errorLogged) {
         errorLogged = true
-        logStreamError(reply.log, err, res)
+        logStreamError(err, reply, res)
       }
       if (typeof payload.destroy === 'function') {
         payload.destroy()
@@ -966,6 +974,7 @@ function setupResponseListeners (reply) {
     // past the response on keep-alive connections.
     const socket = reply.request.raw.socket
     if (socket && socket._meta && socket._meta.request === reply.request) {
+      socket.removeListener('timeout', socket._meta.onTimeout)
       socket._meta = null
     }
 
@@ -986,25 +995,7 @@ function setupResponseListeners (reply) {
 }
 
 function onResponseCallback (err, request, reply) {
-  if (reply.log[kDisableRequestLogging]) {
-    return
-  }
-
-  const responseTime = reply.elapsedTime
-
-  if (err != null) {
-    reply.log.error({
-      res: reply,
-      err,
-      responseTime
-    }, 'request errored')
-    return
-  }
-
-  reply.log.info({
-    res: reply,
-    responseTime
-  }, 'request completed')
+  reply.server[kLogController].requestCompleted(err, request, reply)
 }
 
 function buildReply (R) {

package/lib/req-id-gen-factory.js

@@ -1,5 +1,7 @@
 'use strict'
 
+const { kGenReqId } = require('./symbols.js')
+
 /**
  * @callback GenerateRequestId
  * @param {Object} req
@@ -22,7 +24,8 @@ function reqIdGenFactory (requestIdHeader, optGenReqId) {
 }
 
 function getGenReqId (contextServer, req) {
-  return contextServer.genReqId(req)
+  // direct symbol access skips the `genReqId` getter indirection
+  return contextServer[kGenReqId](req)
 }
 
 function buildDefaultGenReqId () {

package/lib/request.js

@@ -18,6 +18,7 @@ const {
 } = require('./symbols')
 const { FST_ERR_REQ_INVALID_VALIDATION_INVOCATION, FST_ERR_DEC_UNDECLARED } = require('./errors')
 const decorators = require('./decorate')
+const ContentType = require('./content-type')
 
 const HTTP_PART_SYMBOL_MAP = {
   body: kSchemaBody,
@@ -258,8 +259,7 @@ Object.defineProperties(Request.prototype, {
   port: {
     get () {
       const portReg = /(?<port>:\d+)$/
-      const host = this.headers.host ?? this.headers[':authority'] ?? ''
-      const matches = portReg.exec(host)
+      const matches = portReg.exec(this.host)
       if (matches === null || matches[1] === undefined) {
         return null
       }
@@ -287,7 +287,7 @@ Object.defineProperties(Request.prototype, {
   mediaType: {
     get () {
       if (!this[kRequestContentType] && this.headers['content-type'] !== undefined) {
-        this[kRequestContentType] = this[kRouteContext].contentTypeParser.getContentType(this.headers['content-type'])
+        this[kRequestContentType] = ContentType.from(this.headers['content-type'])
       }
       return this[kRequestContentType]?.mediaType
     }

package/lib/route.js

@@ -43,7 +43,6 @@ const {
   kReplySerializerDefault,
   kReplyIsError,
   kRequestPayloadStream,
-  kDisableRequestLogging,
   kSchemaErrorFormatter,
   kErrorHandler,
   kHasBeenDecorated,
@@ -52,10 +51,11 @@ const {
   kRouteContext,
   kRequestSignal,
   kTimeoutTimer,
-  kOnAbort
+  kOnAbort,
+  kLogController
 } = require('./symbols.js')
 const { buildErrorHandler } = require('./error-handler')
-const { createChildLogger } = require('./logger-factory.js')
+const { createChildLogger, defaultChildLoggerFactory } = require('./logger-factory.js')
 const { getGenReqId } = require('./req-id-gen-factory.js')
 const { FSTDEP022 } = require('./warnings')
 
@@ -83,8 +83,6 @@ function buildRouting (options) {
   let hasLogger
   let setupResponseListeners
   let throwIfAlreadyStarted
-  let disableRequestLogging
-  let disableRequestLoggingFn
   let ignoreTrailingSlash
   let ignoreDuplicateSlashes
   let return503OnClosing
@@ -107,10 +105,6 @@ function buildRouting (options) {
       throwIfAlreadyStarted = fastifyArgs.throwIfAlreadyStarted
 
       globalExposeHeadRoutes = options.exposeHeadRoutes
-      disableRequestLogging = options.disableRequestLogging
-      if (typeof disableRequestLogging === 'function') {
-        disableRequestLoggingFn = options.disableRequestLogging
-      }
 
       ignoreTrailingSlash = options.routerOptions.ignoreTrailingSlash
       ignoreDuplicateSlashes = options.routerOptions.ignoreDuplicateSlashes
@@ -463,16 +457,21 @@ function buildRouting (options) {
   function routeHandler (req, res, params, context, query) {
     const id = getGenReqId(context.server, req)
 
-    const loggerOpts = {
-      level: context.logLevel
-    }
+    let childLogger
+    if (hasLogger === false && context.childLoggerFactory === defaultChildLoggerFactory) {
+      // the null logger children are the logger itself, so we can skip
+      // the child logger creation altogether
+      childLogger = logger
+    } else {
+      const loggerOpts = {
+        level: context.logLevel
+      }
 
-    if (context.logSerializers) {
-      loggerOpts.serializers = context.logSerializers
+      if (context.logSerializers) {
+        loggerOpts.serializers = context.logSerializers
+      }
+      childLogger = createChildLogger(context, logger, req, id, loggerOpts)
     }
-    const childLogger = createChildLogger(context, logger, req, id, loggerOpts)
-    // Set initial value; will be re-evaluated after FastifyRequest is constructed if it's a function
-    childLogger[kDisableRequestLogging] = disableRequestLoggingFn ? false : disableRequestLogging
 
     if (closing === true) {
       /* istanbul ignore next mac, windows */
@@ -493,7 +492,9 @@ function buildRouting (options) {
         }
         res.writeHead(503, headers)
         res.end('{"error":"Service Unavailable","message":"Service Unavailable","statusCode":503}')
-        childLogger.info({ res: { statusCode: 503 } }, 'request aborted - refusing to accept new requests as server is closing')
+
+        context.server[kLogController].serviceUnavailable(childLogger, context.server)
+
         return
       }
     }
@@ -518,16 +519,7 @@ function buildRouting (options) {
     const request = new context.Request(id, params, req, query, childLogger, context)
     const reply = new context.Reply(res, request, childLogger)
 
-    // Evaluate disableRequestLogging after FastifyRequest is constructed
-    // so the caller has access to decorations and customizations
-    const resolvedDisableRequestLogging = disableRequestLoggingFn
-      ? disableRequestLoggingFn(request)
-      : disableRequestLogging
-    childLogger[kDisableRequestLogging] = resolvedDisableRequestLogging
-
-    if (resolvedDisableRequestLogging === false) {
-      childLogger.info({ req: request }, 'incoming request')
-    }
+    context.server[kLogController].incomingRequest(request, reply)
 
     // Handler timeout setup — only when configured (zero overhead otherwise)
     const handlerTimeout = context.handlerTimeout
@@ -558,6 +550,13 @@ function buildRouting (options) {
       setupResponseListeners(reply)
     }
 
+    if (context.onTimeout !== null) {
+      if (!request.raw.socket._meta) {
+        request.raw.socket.on('timeout', handleTimeout)
+      }
+      request.raw.socket._meta = { context, request, reply, onTimeout: handleTimeout }
+    }
+
     if (context.onRequest !== null) {
       onRequestHookRunner(
         context.onRequest,
@@ -581,13 +580,6 @@ function buildRouting (options) {
         }
       })
     }
-
-    if (context.onTimeout !== null) {
-      if (!request.raw.socket._meta) {
-        request.raw.socket.on('timeout', handleTimeout)
-      }
-      request.raw.socket._meta = { context, request, reply }
-    }
   }
 }
 

package/lib/symbols.js

@@ -13,7 +13,6 @@ const keys = {
   kContentTypeParser: Symbol('fastify.contentTypeParser'),
   kState: Symbol('fastify.state'),
   kOptions: Symbol('fastify.options'),
-  kDisableRequestLogging: Symbol('fastify.disableRequestLogging'),
   kPluginNameChain: Symbol('fastify.pluginNameChain'),
   kRouteContext: Symbol('fastify.context'),
   kGenReqId: Symbol('fastify.genReqId'),
@@ -67,6 +66,7 @@ const keys = {
   kHasBeenDecorated: Symbol('fastify.hasBeenDecorated'),
   kKeepAliveConnections: Symbol('fastify.keepAliveConnections'),
   kRouteByFastify: Symbol('fastify.routeByFastify'),
+  kLogController: Symbol('fastify.logController'),
   kDiagnosticsStore: Symbol('fastify.diagnosticsStore')
 }
 

package/lib/validation.js

@@ -146,6 +146,15 @@ function validateParam (validatorFunction, request, paramName) {
 function validate (context, request, execution) {
   const runExecution = execution === undefined
 
+  if (runExecution &&
+    context[paramsSchema] === undefined &&
+    context[bodySchema] === undefined &&
+    context[querystringSchema] === undefined &&
+    context[headersSchema] === undefined) {
+    // the route has no validation schemas
+    return false
+  }
+
   if (runExecution || !execution.skipParams) {
     const params = validateParam(context[paramsSchema], request, 'params')
     if (params) {

package/lib/warnings.js

@@ -7,6 +7,8 @@ const { createWarning } = require('process-warning')
  *   - FSTWRN001
  *   - FSTSEC001
  *   - FSTDEP022
+ *   - FSTDEP023
+ *   - FSTDEP024
  *
  * Deprecation Codes FSTDEP001 - FSTDEP021 were used by v4 and MUST NOT be reused.
  *                             - FSTDEP022 is used by v5 and MUST NOT be reused.
@@ -48,10 +50,26 @@ const FSTDEP022 = createWarning({
   unlimited: true
 })
 
+const FSTDEP023 = createWarning({
+  name: 'FastifyDeprecation',
+  code: 'FSTDEP023',
+  message: 'disableRequestLogging option is deprecated. Use the logController option with disableRequestLogging or isLogDisabled override instead. The disableRequestLogging top-level option will be removed in `fastify@6`.',
+  unlimited: true
+})
+
+const FSTDEP024 = createWarning({
+  name: 'FastifyDeprecation',
+  code: 'FSTDEP024',
+  message: 'requestIdLogLabel option is deprecated. Use the logController option with requestIdLogLabel instead. The requestIdLogLabel top-level option will be removed in `fastify@6`.',
+  unlimited: true
+})
+
 module.exports = {
   FSTWRN001,
   FSTWRN003,
   FSTWRN004,
   FSTSEC001,
-  FSTDEP022
+  FSTDEP022,
+  FSTDEP023,
+  FSTDEP024
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "5.9.0",
+  "version": "5.10.0",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",
@@ -170,7 +170,7 @@
     "@sinonjs/fake-timers": "^11.2.2",
     "@stylistic/eslint-plugin": "^5.1.0",
     "@stylistic/eslint-plugin-js": "^4.1.0",
-    "@types/node": "^25.0.3",
+    "@types/node": "^26.0.1",
     "ajv": "^8.12.0",
     "ajv-errors": "^3.0.0",
     "ajv-formats": "^3.0.1",
@@ -210,7 +210,7 @@
     "@fastify/proxy-addr": "^5.0.0",
     "abstract-logging": "^2.0.1",
     "avvio": "^9.0.0",
-    "fast-json-stringify": "^6.0.0",
+    "fast-json-stringify": "^7.0.0",
     "find-my-way": "^9.6.0",
     "light-my-request": "^6.0.0",
     "pino": "^9.14.0 || ^10.1.0",

package/test/content-type.test.js

@@ -179,3 +179,23 @@ describe('ContentType class', () => {
     )
   })
 })
+
+describe('ContentType class cache', () => {
+  test('allow access cache', (t) => {
+    const contentType1 = ContentType.from('application/json')
+    const contentType2 = ContentType.cache.get('application/json')
+    t.assert.equal(contentType1, contentType2)
+  })
+
+  test('returns same instance for the same content type string', (t) => {
+    const contentType1 = ContentType.from('application/json')
+    const contentType2 = ContentType.from('application/json')
+    t.assert.equal(contentType1, contentType2)
+  })
+
+  test('returns different instances for different content type strings', (t) => {
+    const contentType1 = ContentType.from('application/json')
+    const contentType2 = ContentType.from('text/plain')
+    t.assert.notEqual(contentType1, contentType2)
+  })
+})

package/test/genReqId.test.js

@@ -85,6 +85,30 @@ test('Should handle properly requestIdHeader option', t => {
   t.assert.strictEqual(Fastify({ requestIdHeader: 'x-request-id' }).initialConfig.requestIdHeader, 'x-request-id')
 })
 
+test('Should expose the genReqId function via the getter', (t, done) => {
+  t.plan(5)
+
+  const fastify = Fastify()
+  t.assert.strictEqual(typeof fastify.genReqId, 'function')
+  t.assert.strictEqual(typeof fastify.genReqId({ headers: {} }), 'string')
+
+  const custom = function (req) {
+    return 'custom'
+  }
+
+  fastify.register(function (instance, opts, next) {
+    instance.setGenReqId(custom)
+    t.assert.strictEqual(instance.genReqId(), 'custom')
+    next()
+  })
+
+  fastify.ready(err => {
+    t.assert.ifError(err)
+    t.assert.notStrictEqual(fastify.genReqId, custom)
+    done()
+  })
+})
+
 test('Should accept option to set genReqId with setGenReqId option', (t, done) => {
   t.plan(9)
 

package/test/hooks.test.js

@@ -3599,3 +3599,74 @@ test('onRequestAbort should handle async errors / 2', (t, testDone) => {
     sleep(500).then(() => socket.destroy())
   })
 })
+
+test('socket timeout listener is removed when socket._meta is cleared after response', async t => {
+  t.plan(4)
+
+  const fastify = Fastify({ connectionTimeout: 200 })
+  t.after(() => fastify.close())
+
+  fastify.addHook('onTimeout', function (req, reply, done) { done() })
+
+  fastify.addHook('onResponse', function (req, reply, done) {
+    const socket = req.raw.socket
+    t.assert.strictEqual(socket._meta, null, 'socket._meta must be null after response')
+    t.assert.strictEqual(socket.listeners('timeout').some(listener => listener.name === 'handleTimeout'), false, 'Fastify timeout listener must be removed after response')
+    done()
+  })
+
+  fastify.get('/', async () => ({ ok: true }))
+
+  const address = await fastify.listen({ port: 0 })
+  const result = await fetch(address)
+  t.assert.ok(result.ok)
+  t.assert.strictEqual(result.status, 200)
+})
+
+test('socket._meta and timeout listener are cleared on reply.hijack() when onTimeout is registered', async t => {
+  // reply.hijack() opts out of Fastify's response lifecycle so onResFinished
+  // never fires. Before this fix, socket._meta was left pointing at the
+  // request/reply objects for the full keep-alive socket lifetime when
+  // an onTimeout hook was registered.
+  t.plan(3)
+
+  const net = require('node:net')
+  const fastify = Fastify({ connectionTimeout: 300 })
+  t.after(() => fastify.close())
+
+  fastify.addHook('onTimeout', function (req, reply, done) { done() })
+
+  let metaAfterHijack = 'not-set'
+  let hasFastifyTimeoutListenerAfterHijack = true
+  fastify.get('/', async (req, reply) => {
+    reply.hijack()
+    // _meta must be cleared synchronously inside hijack()
+    metaAfterHijack = req.raw.socket._meta
+    hasFastifyTimeoutListenerAfterHijack = req.raw.socket.listeners('timeout').some(listener => listener.name === 'handleTimeout')
+    // Write a minimal valid HTTP/1.1 response and close
+    reply.raw.write('HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok')
+    reply.raw.end()
+    return reply
+  })
+
+  await fastify.listen({ port: 0 })
+
+  // Use raw TCP so we are not affected by fetch() rejecting a closed socket.
+  // Extract host/port from the server address object to handle IPv6 (::1) on Windows.
+  const { port, address: host } = fastify.server.address()
+  await new Promise((resolve, reject) => {
+    const socket = net.connect(port, host, () => {
+      socket.write('GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n')
+    })
+    socket.on('data', () => {})
+    socket.on('close', resolve)
+    socket.on('error', reject)
+  })
+
+  t.assert.ok(true, 'no crash during hijacked request with onTimeout registered')
+  t.assert.ok(
+    metaAfterHijack == null,
+    `socket._meta must be null or undefined after reply.hijack() — got: ${JSON.stringify(metaAfterHijack)}`
+  )
+  t.assert.strictEqual(hasFastifyTimeoutListenerAfterHijack, false, 'Fastify timeout listener must be removed after reply.hijack()')
+})

package/test/internals/errors.test.js

@@ -5,7 +5,7 @@ const errors = require('../../lib/errors')
 const { readFileSync } = require('node:fs')
 const { resolve } = require('node:path')
 
-const expectedErrors = 91
+const expectedErrors = 92
 
 test(`should expose ${expectedErrors} errors`, t => {
   t.plan(1)