fastify 5.9.0 → 5.11.0

package/lib/warnings.js

@@ -7,6 +7,8 @@ const { createWarning } = require('process-warning')
  *   - FSTWRN001
  *   - FSTSEC001
  *   - FSTDEP022
+ *   - FSTDEP023
+ *   - FSTDEP024
  *
  * Deprecation Codes FSTDEP001 - FSTDEP021 were used by v4 and MUST NOT be reused.
  *                             - FSTDEP022 is used by v5 and MUST NOT be reused.
@@ -48,10 +50,26 @@ const FSTDEP022 = createWarning({
   unlimited: true
 })
 
+const FSTDEP023 = createWarning({
+  name: 'FastifyDeprecation',
+  code: 'FSTDEP023',
+  message: 'disableRequestLogging option is deprecated. Use the logController option with disableRequestLogging or isLogDisabled override instead. The disableRequestLogging top-level option will be removed in `fastify@6`.',
+  unlimited: true
+})
+
+const FSTDEP024 = createWarning({
+  name: 'FastifyDeprecation',
+  code: 'FSTDEP024',
+  message: 'requestIdLogLabel option is deprecated. Use the logController option with requestIdLogLabel instead. The requestIdLogLabel top-level option will be removed in `fastify@6`.',
+  unlimited: true
+})
+
 module.exports = {
   FSTWRN001,
   FSTWRN003,
   FSTWRN004,
   FSTSEC001,
-  FSTDEP022
+  FSTDEP022,
+  FSTDEP023,
+  FSTDEP024
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "5.9.0",
+  "version": "5.11.0",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",
@@ -170,7 +170,7 @@
     "@sinonjs/fake-timers": "^11.2.2",
     "@stylistic/eslint-plugin": "^5.1.0",
     "@stylistic/eslint-plugin-js": "^4.1.0",
-    "@types/node": "^25.0.3",
+    "@types/node": "^26.0.1",
     "ajv": "^8.12.0",
     "ajv-errors": "^3.0.0",
     "ajv-formats": "^3.0.1",
@@ -191,7 +191,7 @@
     "joi": "^18.0.1",
     "json-schema-to-ts": "^3.0.1",
     "JSONStream": "^1.3.5",
-    "markdownlint-cli2": "^0.22.0",
+    "markdownlint-cli2": "^0.23.0",
     "neostandard": "^0.12.0",
     "node-forge": "^1.3.1",
     "proxyquire": "^2.1.3",
@@ -210,7 +210,7 @@
     "@fastify/proxy-addr": "^5.0.0",
     "abstract-logging": "^2.0.1",
     "avvio": "^9.0.0",
-    "fast-json-stringify": "^6.0.0",
+    "fast-json-stringify": "^7.0.0",
     "find-my-way": "^9.6.0",
     "light-my-request": "^6.0.0",
     "pino": "^9.14.0 || ^10.1.0",

package/test/content-type.test.js

@@ -161,12 +161,11 @@ describe('ContentType class', () => {
     t.assert.equal(found.mediaType, 'application/json')
     t.assert.equal(found.type, 'application')
     t.assert.equal(found.subtype, 'json')
-    t.assert.equal(found.parameters.size, 3)
+    t.assert.equal(found.parameters.size, 2)
 
     const expected = [
       ['charset', 'utf-8'],
-      ['foo', 'BaR'],
-      ['baz', 'invalid quoted string']
+      ['foo', 'BaR']
     ]
     t.assert.deepStrictEqual(
       Array.from(found.parameters.entries()),
@@ -175,7 +174,55 @@ describe('ContentType class', () => {
 
     t.assert.equal(
       found.toString(),
-      'application/json; charset="utf-8"; foo="BaR"; baz="invalid quoted string"'
+      'application/json; charset="utf-8"; foo="BaR"'
     )
   })
+
+  test('preserves a semicolon inside a quoted parameter value', (t) => {
+    // RFC 9110 §5.6.6: ';' is a literal qdtext octet inside a quoted-string
+    // and does not terminate the parameter value.
+    const found = new ContentType('application/json; name="foo;bar"; charset=utf-8')
+    t.assert.equal(found.isValid, true)
+    t.assert.equal(found.mediaType, 'application/json')
+    t.assert.equal(found.parameters.get('name'), 'foo;bar')
+    t.assert.equal(found.parameters.get('charset'), 'utf-8')
+  })
+
+  test('does not leak a fake parameter out of a quoted value', (t) => {
+    // A `key=value;` sequence inside a quoted-string is opaque content of the
+    // enclosing value, not a subsequent parameter.
+    const found = new ContentType('application/json; name="a=b;charset=fake"; boundary=xyz')
+    t.assert.equal(found.isValid, true)
+    t.assert.equal(found.parameters.get('name'), 'a=b;charset=fake')
+    t.assert.equal(found.parameters.get('boundary'), 'xyz')
+    t.assert.equal(found.parameters.has('charset'), false)
+  })
+
+  test('unescapes a quoted-pair inside a quoted-string', (t) => {
+    // RFC 9110 §5.6.4: a quoted-pair MUST be handled as if replaced by
+    // the octet following the backslash.
+    const found = new ContentType('application/json; name="he said \\"hi\\""')
+    t.assert.equal(found.isValid, true)
+    t.assert.equal(found.parameters.get('name'), 'he said "hi"')
+  })
+})
+
+describe('ContentType class cache', () => {
+  test('allow access cache', (t) => {
+    const contentType1 = ContentType.from('application/json')
+    const contentType2 = ContentType.cache.get('application/json')
+    t.assert.equal(contentType1, contentType2)
+  })
+
+  test('returns same instance for the same content type string', (t) => {
+    const contentType1 = ContentType.from('application/json')
+    const contentType2 = ContentType.from('application/json')
+    t.assert.equal(contentType1, contentType2)
+  })
+
+  test('returns different instances for different content type strings', (t) => {
+    const contentType1 = ContentType.from('application/json')
+    const contentType2 = ContentType.from('text/plain')
+    t.assert.notEqual(contentType1, contentType2)
+  })
 })

package/test/find-route.test.js

@@ -66,6 +66,22 @@ test('findRoute should return null when when url is not passed', t => {
   }), null)
 })
 
+test('findRoute should return null when method is not passed', t => {
+  t.plan(1)
+  const fastify = Fastify()
+
+  fastify.get('/artists/:artistId', {
+    schema: {
+      params: { artistId: { type: 'integer' } }
+    },
+    handler: (req, reply) => reply.send(typeof req.params.artistId)
+  })
+
+  t.assert.strictEqual(fastify.findRoute({
+    url: '/artists/:artistId'
+  }), null)
+})
+
 test('findRoute should return null when route cannot be found due to a different path', t => {
   t.plan(1)
   const fastify = Fastify()
@@ -103,6 +119,25 @@ test('findRoute should return the route when found', t => {
   t.assert.strictEqual(route.params.artistId, ':artistId')
 })
 
+test('findRoute should find a route even if method is not uppercased', t => {
+  t.plan(2)
+  const fastify = Fastify()
+
+  fastify.get('/artists/:artistId', {
+    schema: {
+      params: { artistId: { type: 'integer' } }
+    },
+    handler: (req, reply) => reply.send(typeof req.params.artistId)
+  })
+
+  const route = fastify.findRoute({
+    method: 'get',
+    url: '/artists/:artistId'
+  })
+  t.assert.notStrictEqual(route, null)
+  t.assert.strictEqual(route.params.artistId, ':artistId')
+})
+
 test('findRoute should work correctly when used within plugins', (t, done) => {
   t.plan(1)
   const fastify = Fastify()

package/test/fix-6411.test.js

@@ -0,0 +1,65 @@
+'use strict'
+
+const { test } = require('node:test')
+const Fastify = require('..')
+
+test('custom validatorCompiler returning falsy values should update request param', async (t) => {
+  const fastify = Fastify()
+
+  fastify.setValidatorCompiler(() => {
+    return (data) => {
+      if (typeof data === 'object' && data !== null && 'coerceTo' in data) {
+        return { value: data.coerceTo }
+      }
+      return true
+    }
+  })
+
+  fastify.post('/test', { schema: { body: { type: 'object' } } }, (request, reply) => {
+    reply.send({ body: request.body })
+  })
+
+  // value: 0 (falsy)
+  {
+    const res = await fastify.inject({
+      method: 'POST',
+      url: '/test',
+      payload: { coerceTo: 0 }
+    })
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.strictEqual(JSON.parse(res.payload).body, 0, 'should update body to 0')
+  }
+
+  // value: "" (falsy)
+  {
+    const res = await fastify.inject({
+      method: 'POST',
+      url: '/test',
+      payload: { coerceTo: '' }
+    })
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.strictEqual(JSON.parse(res.payload).body, '', 'should update body to empty string')
+  }
+
+  // value: false (falsy)
+  {
+    const res = await fastify.inject({
+      method: 'POST',
+      url: '/test',
+      payload: { coerceTo: false }
+    })
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.strictEqual(JSON.parse(res.payload).body, false, 'should update body to false')
+  }
+
+  // value: null (falsy)
+  {
+    const res = await fastify.inject({
+      method: 'POST',
+      url: '/test',
+      payload: { coerceTo: null }
+    })
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.strictEqual(JSON.parse(res.payload).body, null, 'should update body to null')
+  }
+})

package/test/genReqId.test.js

@@ -85,6 +85,30 @@ test('Should handle properly requestIdHeader option', t => {
   t.assert.strictEqual(Fastify({ requestIdHeader: 'x-request-id' }).initialConfig.requestIdHeader, 'x-request-id')
 })
 
+test('Should expose the genReqId function via the getter', (t, done) => {
+  t.plan(5)
+
+  const fastify = Fastify()
+  t.assert.strictEqual(typeof fastify.genReqId, 'function')
+  t.assert.strictEqual(typeof fastify.genReqId({ headers: {} }), 'string')
+
+  const custom = function (req) {
+    return 'custom'
+  }
+
+  fastify.register(function (instance, opts, next) {
+    instance.setGenReqId(custom)
+    t.assert.strictEqual(instance.genReqId(), 'custom')
+    next()
+  })
+
+  fastify.ready(err => {
+    t.assert.ifError(err)
+    t.assert.notStrictEqual(fastify.genReqId, custom)
+    done()
+  })
+})
+
 test('Should accept option to set genReqId with setGenReqId option', (t, done) => {
   t.plan(9)
 

package/test/hooks.test.js

@@ -3599,3 +3599,74 @@ test('onRequestAbort should handle async errors / 2', (t, testDone) => {
     sleep(500).then(() => socket.destroy())
   })
 })
+
+test('socket timeout listener is removed when socket._meta is cleared after response', async t => {
+  t.plan(4)
+
+  const fastify = Fastify({ connectionTimeout: 200 })
+  t.after(() => fastify.close())
+
+  fastify.addHook('onTimeout', function (req, reply, done) { done() })
+
+  fastify.addHook('onResponse', function (req, reply, done) {
+    const socket = req.raw.socket
+    t.assert.strictEqual(socket._meta, null, 'socket._meta must be null after response')
+    t.assert.strictEqual(socket.listeners('timeout').some(listener => listener.name === 'handleTimeout'), false, 'Fastify timeout listener must be removed after response')
+    done()
+  })
+
+  fastify.get('/', async () => ({ ok: true }))
+
+  const address = await fastify.listen({ port: 0 })
+  const result = await fetch(address)
+  t.assert.ok(result.ok)
+  t.assert.strictEqual(result.status, 200)
+})
+
+test('socket._meta and timeout listener are cleared on reply.hijack() when onTimeout is registered', async t => {
+  // reply.hijack() opts out of Fastify's response lifecycle so onResFinished
+  // never fires. Before this fix, socket._meta was left pointing at the
+  // request/reply objects for the full keep-alive socket lifetime when
+  // an onTimeout hook was registered.
+  t.plan(3)
+
+  const net = require('node:net')
+  const fastify = Fastify({ connectionTimeout: 300 })
+  t.after(() => fastify.close())
+
+  fastify.addHook('onTimeout', function (req, reply, done) { done() })
+
+  let metaAfterHijack = 'not-set'
+  let hasFastifyTimeoutListenerAfterHijack = true
+  fastify.get('/', async (req, reply) => {
+    reply.hijack()
+    // _meta must be cleared synchronously inside hijack()
+    metaAfterHijack = req.raw.socket._meta
+    hasFastifyTimeoutListenerAfterHijack = req.raw.socket.listeners('timeout').some(listener => listener.name === 'handleTimeout')
+    // Write a minimal valid HTTP/1.1 response and close
+    reply.raw.write('HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok')
+    reply.raw.end()
+    return reply
+  })
+
+  await fastify.listen({ port: 0 })
+
+  // Use raw TCP so we are not affected by fetch() rejecting a closed socket.
+  // Extract host/port from the server address object to handle IPv6 (::1) on Windows.
+  const { port, address: host } = fastify.server.address()
+  await new Promise((resolve, reject) => {
+    const socket = net.connect(port, host, () => {
+      socket.write('GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n')
+    })
+    socket.on('data', () => {})
+    socket.on('close', resolve)
+    socket.on('error', reject)
+  })
+
+  t.assert.ok(true, 'no crash during hijacked request with onTimeout registered')
+  t.assert.ok(
+    metaAfterHijack == null,
+    `socket._meta must be null or undefined after reply.hijack() — got: ${JSON.stringify(metaAfterHijack)}`
+  )
+  t.assert.strictEqual(hasFastifyTimeoutListenerAfterHijack, false, 'Fastify timeout listener must be removed after reply.hijack()')
+})

package/test/internals/all.test.js

@@ -9,7 +9,8 @@ test('fastify.all should add all the methods to the same url', async t => {
   const requirePayload = [
     'POST',
     'PUT',
-    'PATCH'
+    'PATCH',
+    'QUERY'
   ]
 
   const supportedMethods = fastify.supportedMethods

package/test/internals/errors.test.js

@@ -5,7 +5,7 @@ const errors = require('../../lib/errors')
 const { readFileSync } = require('node:fs')
 const { resolve } = require('node:path')
 
-const expectedErrors = 91
+const expectedErrors = 94
 
 test(`should expose ${expectedErrors} errors`, t => {
   t.plan(1)
@@ -770,6 +770,26 @@ test('FST_ERR_ROUTE_REWRITE_NOT_STR', t => {
   t.assert.ok(error instanceof TypeError)
 })
 
+test('FST_ERR_ROUTE_MISSING_CONTENT_TYPE', t => {
+  t.plan(5)
+  const error = new errors.FST_ERR_ROUTE_MISSING_CONTENT_TYPE()
+  t.assert.strictEqual(error.name, 'FastifyError')
+  t.assert.strictEqual(error.code, 'FST_ERR_ROUTE_MISSING_CONTENT_TYPE')
+  t.assert.strictEqual(error.message, "Method '%s' must provide a 'Content-Type' header.")
+  t.assert.strictEqual(error.statusCode, 400)
+  t.assert.ok(error instanceof Error)
+})
+
+test('FST_ERR_ROUTE_MISSING_CONTENT', t => {
+  t.plan(5)
+  const error = new errors.FST_ERR_ROUTE_MISSING_CONTENT()
+  t.assert.strictEqual(error.name, 'FastifyError')
+  t.assert.strictEqual(error.code, 'FST_ERR_ROUTE_MISSING_CONTENT')
+  t.assert.strictEqual(error.message, "Method '%s' must provide a request body.")
+  t.assert.strictEqual(error.statusCode, 400)
+  t.assert.ok(error instanceof Error)
+})
+
 test('FST_ERR_REOPENED_CLOSE_SERVER', t => {
   t.plan(5)
   const error = new errors.FST_ERR_REOPENED_CLOSE_SERVER()