What's Changed

• test: mv routes-* from tap by @jean-michelet in #6092
• test: mv skip-reply-send from tap by @jean-michelet in #6094
• test: mv plugins from tap by @jean-michelet in #6088
• fix(ci): ignore alternative runtime result by @Eomm in #6125
• test: mv schema-* from tap by @jean-michelet in #6093
• test: mv hooks-async from tap by @jean-michelet in #6084
• fix(types): add missing version to request.routeOptions by @inyourtime in #6126
• docs: remove fastify-sentry plugin by @dnlup in #6131
• docs: add community plugins disclaimer by @jean-michelet in #6132
• docs: use cross-platform compatible info emoji by @Fdawgs in #6134
• perf: nits in reply.js by @Cangit in #6136
• docs: join core team by @jean-michelet in #6142
• docs: fix typo in hash.digest function by @piotr-cz in #6145
• test: mv hooks from tap by @jean-michelet in #6087
• test: improve issue 4959 unit test by @Uzlopak in #6147
• chore: Bump markdownlint-cli2 from 0.17.2 to 0.18.1 by @dependabot in #6150
• chore: remove dependencie tap and others updated by @Tony133 in #6148
• fix: hook async flaky by @ilteoood in #6155
• chore: Bump lycheeverse/lychee-action from 2.4.0 to 2.4.1 by @dependabot in #6151
• chore: removing simple-get from allow-unsafe-regex by @ilteoood in #6154
• chore: remove simple get on 404s test file by @ilteoood in #6153
• chore: remove simple-get in handle-request.test.js by @ilteoood in #6159
• chore: remove simple-get from url-rewriting by @ilteoood in #6163
• chore: remove simple-get in report.test.js by @ilteoood in #6157
• chore: remove simple-get from custom parser async by @ilteoood in #6164
• chore: removed simple-get from mkcol tests by @ilteoood in #6194
• chore: removed simple-get from proto-poisoning test by @ilteoood in #6185
• ci: Added Node.js v24 by @mcollina in #6113
• chore: removed simple-get from nullable validation test by @ilteoood in #6191
• feat: configure errorhandler override by @jean-michelet in #6104
• chore: remove simple-get from search test by @ilteoood in #6158
• chore: remove simple get from secure with fallback test by @ilteoood in #6162
• chore: removed simple-get from als test by @ilteoood in #6187
• chore: remove simple-get from listen 4 by @ilteoood in #6173
• fix: do not freeze request.routeOptions by @mcollina in #6141
• chore: removed simple-get from sync-delay-request tests by @ilteoood in #6212
• chore: removed simple-get from output-validation tests by @ilteoood in #6213
• chore: removed simple-get from async-delay-request tests by @ilteoood in #6211
• chore: removed simple-get from body-limit tests by @ilteoood in #6209
• chore: removed simple-get from trust-proxy tests by @ilteoood in #6205
• chore: removed simple-get from proppatch tests by @ilteoood in #6200
• chore(ci): cleanup citgm.yml by @Eomm in #6195
• chore: removed simple-get from https tests by @ilteoood in #6197
• chore: removed simple-get from lock test by @ilteoood in #6186

Full Changelog: v5.3.3...v5.4.0

What's Changed

• docs: update Vercel section by @leerob in #6046
• docs(ecosystem): add fastify-papr plugin by @inaiat in #6051
• test: migrated helper and input validation to node test runner by @ilteoood in #6074
• style: add "no comma-dangle" rule to eslint config and remove trailing commas by @cecia234 in #6069
• test: migrate stream tests to node test runner by @ilteoood in #6065
• test: logger response by @ilteoood in #6055
• test: migrate schema feature to node test runner by @ilteoood in #6066
• fix: Added more cases for JSON schema validation by @mcollina in #6067
• test: migrated inject.test.js from tap to node:test by @Tony133 in #6068
• test: migrated plugin 1 to node test runner by @ilteoood in #6075
• ci: fix branch pattern by @Eomm in #6090
• docs: added Jeasx to Ecosystem.md by @jablonski in #6082
• test: mv promises from tap by @jean-michelet in #6085
• refactor: node:http2 is always available by @Cangit in #6073
• fix: update borp to 0.20.0. by @lholmquist in #6091
• chore: Bump fluent-json-schema from 5.0.0 to 6.0.0 by @dependabot in #6101
• chore: Bump tsd from 0.31.2 to 0.32.0 in the dev-dependencies-typescript group by @dependabot in #6100
• test: migrated decorator.test.js from tap to node:test by @Tony133 in #5957
• test: stabilize pipelining shutdown test with controlled close timing by @jean-michelet in #6099
• test: migrated output-validation.test.js from tap to node:test by @Tony133 in #6076
• test: remove tap from hooks-on ready file by @IcaroSilvaFK in #6080
• test: mv hooks.on-listen from tap by @jean-michelet in #6086
• ci: ignore scripts by @Fdawgs in #6108
• docs: add a warning about setErrorHandler overriding a previously defined error handler on an encapsulated context by @jean-michelet in #6097
• docs(ecosystem): remove fastify-diagnostics-channel by @inyourtime in #6117
• fix: internal function _addHook failure should be turned into the rejection app.ready is waiting for by @jean-michelet in #6105
• test: replace removed request properties and update docs by @inyourtime in #6111
• test: mv reply from tap by @jean-michelet in #6089
• test: updated promises.test.js re-added the plan() method by @Tony133 in #6057
• ci: add support to test release candidates by @RafaelGSS in #6103

New Contributors

• @leerob made their first contribution in #6046
• @inaiat made their first contribution in #6051
• @cecia234 made their first contribution in #6069
• @jablonski made their first contribution in #6082
• @lholmquist made their first contribution in #6091
• @IcaroSilvaFK made their first contribution in #6080

Full Changelog: v5.3.2...v5.3.3

⚠️ Security Release ⚠️

Fix for "Invalid content-type parsing could lead to validation bypass" and CVE-2025-32442.

Full Changelog: v4.29.0...v4.29.1

⚠️ Security Release ⚠️

Unfortunately, v5.3.1 did not include a complete fix for "Invalid content-type parsing could lead to validation bypass" and CVE-2025-32442. This is a follow-up patch to cover an edge case.

What's Changed

• docs: fix archived concurrently link to point to active repo by @TimTeylor in #6063
• fix: treat space as a delimiter in content-type parsing by @mcollina in #6064

New Contributors

• @TimTeylor made their first contribution in #6063

Full Changelog: v5.3.1...v5.3.2

⚠️ Security Release ⚠️

• Fix for "Invalid content-type parsing could lead to validation bypass" and CVE-2025-32442

What's Changed

• test: migrate logger options to node test runner by @ilteoood in #6059
• test: migrate logger logging to node test runner by @ilteoood in #6060
• test: convert custom parser 1 to node test runner by @ilteoood in #6053
• test: custom querystring parser by @ilteoood in #6054
• test: migrate stream 4 to node test runner by @ilteoood in #6062
• test: migrate request logger to node test runner by @ilteoood in #6058
• test: migrate custom parser 0 to node test runner by @ilteoood in #6052
• test: migrate logger instantiation to node test runner by @ilteoood in #6061

New Contributors

• @ilteoood made their first contribution in #6059

Full Changelog: v5.3.0...v5.3.1

What's Changed

• fix: wrong reply return type by @dangkyokhoang in #6026
• feat: allow to access decorators by @jean-michelet in #5768
• ci: continue-on-error on alternative runtime by @Eomm in #6031
• fix: clear [kState].readyPromise for garbage collection by @LiviaMedeiros in #6030
• ci: set workflow permissions to read-only by default by @Fdawgs in #6035
• chore: Bump the dependencies-major group with 2 updates by @dependabot in #6036
• chore: Bump lycheeverse/lychee-action from 2.3.0 to 2.4.0 by @dependabot in #6037
• chore: remove sponsort by @Eomm in #6040
• test: fix skip in upgrade test by @LiviaMedeiros in #6044
• chore: migrate custom-parser.4.test.js to node:test by @Matthew-Mallimo in #6042
• docs: add fastify-lm to Ecosystem.md by @galiprandi in #6032
• test: skip IPv6 tests if its support is not present by @LiviaMedeiros in #6048

New Contributors

• @dangkyokhoang made their first contribution in #6026
• @Matthew-Mallimo made their first contribution in #6042
• @galiprandi made their first contribution in #6032

Full Changelog: v5.2.2...v5.3.0

What's Changed

• build: use static path instead of __filename by @climba03003 in #5922
• fix(linting): fix linting error in error-handler.js by @Uzlopak in #5926
• chore: Bump the dev-dependencies group across 1 directory with 6 updates by @dependabot in #5930
• fix: don't check for payload type in default json parser by @gurgunday in #5933
• docs: Include req.hostname change in upgrade guide by @tmcw in #5935
• build(dependabot): regroup dev dependencies by @Fdawgs in #5931
• chore: Bump borp from 0.18.0 to 0.19.0 by @dependabot in #5936
• chore: don't return the done function by @gurgunday in #5937
• ci(workflows): unpin node 22 version by @Fdawgs in #5941
• perf: don't use optional chaining for typeof .then checks by @gurgunday in #5942
• docs: the no floating promise guide is not needed anymore by @mcollina in #5946
• docs: grammar and spelling fixes by @Fdawgs in #5944
• perf(lib/pluginutils): cache rc version regex by @Fdawgs in #5940
• build(dependabot): reduce npm updates to monthly by @Fdawgs in #5939
• docs(guides): grammar and spelling fixes by @Fdawgs in #5947
• test: migrated genReqId.test.js from tap to node:test by @Tony133 in #5943
• chore: Bump lycheeverse/lychee-action from 2.1.0 to 2.2.0 by @dependabot in #5948
• docs(reference/contenttypeparser): make more concise by @Fdawgs in #5950
• docs(getting-started): clarify fastify-cli is separate by @Fdawgs in #5949
• docs(validation-and-serialization): fix typo by @matthyk in #5952
• test: migrated route-shorthand.test.js from tap to node:test by @Tony133 in #5923
• test: migrated register.test.js from tap to node:test by @Tony133 in #5918
• Update broken link to N|Solid by @xuhdev in #5954
• docs(reference): even more conciseness by @Fdawgs in #5951
• test: migrate from tap to node test for close & custom-parser-async by @coluzziandrea in #5915
• docs(reference/type-providers): conciseness improvements by @Fdawgs in #5962
• docs(reference/errors): conciseness improvements by @Fdawgs in #5963
• docs(reference/logging): conciseness improvements by @Fdawgs in #5958
• docs(reference/request): conciseness improvements by @Fdawgs in #5965
• docs(ecosystem): add @fastify/otel to core list by @Fdawgs in #5967
• docs(reference/validation): conciseness improvements by @Fdawgs in #5964
• docs(reference/plugins): conciseness improvements by @Fdawgs in #5956
• docs(reference/decorators): conciseness improvements by @Fdawgs in #5966
• chore(sponsor): Add Lokalise sponsorship reference by @kibertoad in #5968
• test: migrated listen.2.test.js from tap to node:test by @Tony133 in #5960
• docs(ecosystem): add fastify-enforce-routes-pattern by @Jerome1337 in #5961
• chore(sponsor): add Jspreadsheet by @Eomm in #5971
• docs(reference/routes): conciseness improvements by @Fdawgs in #5969
• fix(types): missing supportedMethods by @johaven in #5970
• chore: Bump the dev-dependencies-eslint group with 2 updates by @dependabot in #5975
• ci: remove master branch support by @Fdawgs in #5974
• docs(reference): mimic github notes and warning style by @Fdawgs in #5973
• docs: Drop platformatic cloud reference in serverless.md by @mcollina in #5982
• docs: add a Genezio step by step guide by @cristim67 in #5980
• docs(lts): fix anchor tag format by @kadoshita in #5986
• docs: Update documentation for listening to 0.0.0.0 by @jonasongg in #5988
• docs(serverless): cut down genezio example by @Fdawgs in #5990
• docs: add link to official demo by @jean-michelet in #5994
• chore(license): update licensing year by @Tony133 in #5992
• docs: wrong query string parser information by @smith558 in #5993
• docs: typo in v5 migration docs by @salmanm in #5995
• docs: update example to use correct parser by @smith558 in #5996
• test: migrated request-error.test.js from tap to node:test by @Tony133 in #5987
• chore: Bump the dev-dependencies-eslint group with 2 updates by @dependabot in #5999
• chore: Bump lycheeverse/lychee-action from 2.2.0 to 2.3.0 by @dependabot in #6001
• docs: fix docorators example by @logan272 in #5997
• chore: fix docs by @Eomm in #6007
• test: migrated stream.5.test.js from tap to node:test by @Tony133 in #5955
• build(test/bundler/esbuild): bump esbuild by @Fdawgs in #6010
• test: migrated throw.test.js from tap to node:test by @Tony133 in #6002
• docs(guides/ecosystem): update broken link to scalar by @inyourtime in #6015
• feat: add listen async callback warning by @Eomm in #6011
• docs(readme): fix broken ci badges by @Fdawgs in #6016
• docs: remove --node-arg prefix by @piotr-cz in #6018
• test: migrated listen.1.test.js from tap to node:test by @Tony133 in #6014
• chore: Bump typescript from 5.7.3 to 5.8.2 in the dev-dependencies-typescript group by @dependabot in #6000
• test: migrated upgrade.test.js from tap to node:test and update inde… by @Tony133 in #5917
• test: fix flaky by @Eomm in #6021
• test: migrated listen.3.test.js from tap to node:test by @Tony133 in #6022
• test: migrated listen.4.test.js from tap to node:test by @Tony133 in #6024
• fix: double hook execution by @Eomm in #6013
• test(content-type-parser): replace tiny-lru proxy with toad-cache by @Fdawgs in #6025

New Contributors

• @xuhdev made their first contribution in #5954
• @coluzziandrea made their first contribution in #5915
• @Jerome1337 made their first contribution in #5961
• @cristim67 made their first contribution in #5980
• @jonasongg made their first contribution in #5988
• @smith558 made their first contribution in #5993
• @logan272 made their first contribution in #5997
• @piotr-cz made their first contribution in #6018

Full Changelog: v5.2.1...v5.2.2

What's Changed

• chore: org members reorder by @Eomm in #5898
• docs(request): clarify request host functionality by @Fdawgs in #5904
• chore(package): add fdawgs to contributors array by @Fdawgs in #5905
• chore: updated test reporter by @jsumners in #5907
• test: migrated custom-parser.2.test.js from tap to node:test by @Tony133 in #5902
• test: migrated nullable-validation.test.js from tap to node:test by @Tony133 in #5880
• test: migrated custom-parser.3.test.js from tap to node:test by @Tony133 in #5903
• test: migrate delete test from tap to node test runner by @Kalpana98 in #5906
• docs: add climba03003 to team by @climba03003 in #5910
• build(deps): replace proxy-addr with @fastify/proxy-addr by @Fdawgs in #5913
• fix: ReadableStream.locked crashes application by @climba03003 in #5920
• docs: fix typo by @FKPSC in #5921

New Contributors

• @Kalpana98 made their first contribution in #5906
• @FKPSC made their first contribution in #5921

Full Changelog: v5.2.0...v5.2.1

What's Changed

• docs: add HeroDevs mentions to README and LTS docs by @AndreAngelantoni in #5730
• test: migrated reply-early-hints.test.js from tap to node:test by @Tony133 in #5803
• chore: Bump lycheeverse/lychee-action from 1.10.0 to 2.0.2 by @dependabot in #5807
• chore: Bump thollander/actions-comment-pull-request from 2 to 3 by @dependabot in #5806
• test: migrated request-timeout.test.js from tap to node:test by @Tony133 in #5805
• fix: streamline migrated tests, make migrated the filenames of migrated tests kebab-case by @Uzlopak in #5800
• ci(benchmark): fix github token input by @Fdawgs in #5809
• test: migrated reply-code.test.js from tap to node:test by @Tony133 in #5808
• test: migrated middleware.test.js from tap to node:test by @Tony133 in #5795
• fix: test asserts to strict asserts by @dancastillo in #5815
• chore: renamed test files in kebab-case by @Tony133 in #5814
• style(.gitattributes): standardize style across fastify repos by @Fdawgs in #5816
• style: remove trailing whitespace by @Fdawgs in #5817
• test: migrated encapsulated-error-handler.test.js from tap to node:test by @Tony133 in #5824
• docs: Add fastify-mongo-sanitize and remix-fastify to comm. by @ExorTek in #5822
• test: migrated encapsulated-child-logger-factory.test.js from tap to … by @Tony133 in #5823
• docs: add loggerInstance to Server doc by @llimllib in #5786
• test: migrated post-empty-body.test.js from tap to node:test by @Tony133 in #5813
• docs(CONTRIBUTING.md): read the announcements by @Eomm in #5825
• test: migrated listen.5.test.js from tap to node:test by @Tony133 in #5827
• test: migrated use-semicolon-delimiter.test.js from tap to node:test by @Tony133 in #5812
• docs: smaller documentation fixes by @metcoder95 in #5834
• fix(types): addHttpMethod type signature on fastify instance (#5810) by @kalvenschraut in #5811
• test: migrated schema-examples.test.js from tap to node:test by @Tony133 in #5833
• test: Migrate tests to Node test container by @KristianLentino99 in #5777
• test: migrated max-requests-per-socket.test.js from tap to node:test by @Tony133 in #5828
• test: migrated proto-poisoning.test.js from tap to node:test by @Tony133 in #5836
• test: migrated content-type and context-config tests from tap to node:test by @stojkov-z in #5778
• docs: Added fastify-passkit-webservice to community plugins by @alexandercerutti in #5819
• test: migrate trust-proxy, type-provider, url-rewriting to node:test by @dancastillo in #5829
• test: migrated fluent-schema.test.js from tap to node:test by @Tony133 in #5832
• test: migrated set-error-handler.test.js and header-overflow.test.js from tap to node:test by @Tony133 in #5835
• chore: Bump secure-json-parse from 2.7.0 to 3.0.1 in the dependencies-major group by @dependabot in #5845
• test: migrated pretty-print.test.js from tap to node:test by @Tony133 in #5844
• test: migrated custom-parser.4.test.js and custom-parser.5.test.js fr… by @Tony133 in #5837
• docs: fix example for supplying own logger instance by @keithito in #5857
• feat: Add hook name within timeout error message by @kibertoad in #5851
• docs: make whitespace consistent by @joeytwiddle in #5863
• test: migrated fastify-instance.test.js from tap to node:test by @Tony133 in #5859
• test: migrated request-id.test.js from tap to node:test by @Tony133 in #5858
• test: migrated tests from tap to node test by @Tony133 in #5839
• test: migrated router-options.test.js from tap to node:test by @Tony133 in #5840
• test: migrated route.8.test.js from tap to node:test by @Tony133 in #5864
• chore: Bump lycheeverse/lychee-action from 2.0.2 to 2.1.0 by @dependabot in #5869
• test: migrated validation-error-handling from tap to node:test by @reidn3r in #5856
• test: migrated handler-context.test.js from tap to node:test by @Tony133 in #5868
• test: migrated find-route.test.js from tap to node:test by @Tony133 in #5867
• chore: sponsor link by @Eomm in #5871
• docs(readme): point ci badge at main branch by @Fdawgs in #5873
• test: migrate content-parser test to use node:test by @Rantoledo in #5847
• docs(readme): revert to standard workflow badge syntax by @Fdawgs in #5877
• chore: readme lighter install script by @giulianok in #5872
• docs(CONTRIBUTING.md): added v4 to version branches by @giuliowaitforitdavide in #5886
• fix(errorHandler.js): linting problems in pipeline by @giuliowaitforitdavide in #5885
• ci: pin node version 22.11 by @climba03003 in #5889
• docs(ecosystem): update apitally description by @itssimon in #5891
• types: remove connection property in FastifyRequest by @giuliowaitforitdavide in #5884
• fix: crash when host header is missing by various of reason by @climba03003 in #5892
• chore: fix flaky test by @Eomm in #5881
• perf: use node: prefix to bypass require.cache call for builtins by @Fdawgs in #5894
• chore: bump dev fastify-plugin by @Eomm in #5879
• types: use node: prefix for builtins by @Fdawgs in #5896
• test: migrated content-length.test.js from tap to node:test by @Tony133 in #5878

New Contributors

• @AndreAngelantoni made their first contribution in #5730
• @ExorTek made their first contribution in #5822
• @llimllib made their first contribution in #5786
• @KristianLentino99 made their first contribution in #5777
• @stojkov-z made their first contribution in #5778
• @alexandercerutti made their first contribution in #5819
• @keithito made their first contribution in #5857
• @joeytwiddle made their first contribution in #5863
• @reidn3r made their first contribution in #5856
• @giulianok made their first contribution in #5872

Full Changelog: v5.1.0...v5.2.0

What's Changed

• fix(backport v4.x): config type in RouteShorthandOptions by @bastienmenis in #5527
• feat(backport 4.x): add body parsing on copy move mkcol methods by @johaven in #5549
• [Backport 4.x] fix: res serializer not given reply (#5556) by @github-actions in #5563
• chore(backport 4.x): allow ! in PR title by @github-actions in #5572
• [Backport 4.x] feat: support different body schema per content type by @github-actions in #5559
• [Backport 4.x] chore(sponsor): add valtown by @github-actions in #5593
• [Backport 4.x] fix: nullish host by @github-actions in #5594
• refactor(4.x): add deprecate warning of json shorthand by @climba03003 in #5587
• [Backport 4.x] chore(sponsor): add handsontable by @github-actions in #5595
• [Backport 4.x] fix: throwing "FST_ERR_DUPLICATED_ROUTE" error instead of raw error by @github-actions in #5624
• fix(backport 4.x): reorder handling of Response replies by @github-actions in #5629
• [Backport 4.x] docs: add default value for maxParamLength by @github-actions in #5631
• [Backport 4.x] chore: fix sponsor link by @github-actions in #5641
• [Backport 4.x] feat: add fastify v4 codemods by @github-actions in #5654
• [Backport 4.x] feat: bind this to instance in onclose by @github-actions in #5679
• [Backport 4.x] docs: update v4 codemods by @github-actions in #5686

New Contributors

• @bastienmenis made their first contribution in #5527

Full Changelog: v4.28.1...v4.29.0