⚠️ Security fixes

• GHSA-3qgw-9275-xf8w

What's Changed

• feat: add routerOptions.compile to use find-my-way compiler mode by @mcollina in #7096
• chore: sync VERSION and check it before publishing by @mcollina in #7107
• fix(reply): send stream trailers after the stream actually finishes by @kyungseopk1m in #6953
• test(server): assert the server is listening instead of a literal by @zkasuran in #6962
• fix: clamp error statusCode between 400 and 599 with 500 fallback by @swaraj792725 in #7089
• fix: contain synchronous throws from custom content type parsers by @YOGESH256 in #7118
• docs(ecosystem): add @guardcore/fastify by @rennf93 in #7128
• perf!: create default validation errors without a stack trace by @gurgunday in #7057
• docs(serverless): clarify per-route observability on serverless platf… by @yassertawfik4 in #6802
• feat(hooks): support disposables in onClose hook (#5669) by @Prakhar007Pathak in #7121
• fix(types): allow socket path strings in addresses by @Ram-blip in #6842
• fix(types): add logSerializers to RouteShorthandOptions by @RubenPari in #7143
• test: do not assert a HEAD response body through inject() by @lprnmns in #7148
• docs(reply): reorganize Reply reference by properties and methods by @Eomm in #7146
• docs(request): reorganize Request reference by properties and methods by @Eomm in #7147
• perf(request): hoist port regex to module level by @TalhaHunter101 in #7110
• fix(decorators): evaluate instance getters once in getDecorator by @shoaibulhaque in #7124
• docs: clarify that maxParamLength does not prevent ReDoS by @RubenPari in #7140
• docs: fix syntax errors in code examples by @mayur-dhavan in #7159
• docs: join core team by @Tony133 in #7175
• feat!: fail closed when a response content type is not declared in the content map by @mcollina in #7132

New Contributors

• @kyungseopk1m made their first contribution in #6953
• @zkasuran made their first contribution in #6962
• @swaraj792725 made their first contribution in #7089
• @YOGESH256 made their first contribution in #7118
• @rennf93 made their first contribution in #7128
• @yassertawfik4 made their first contribution in #6802
• @Prakhar007Pathak made their first contribution in #7121
• @RubenPari made their first contribution in #7143
• @lprnmns made their first contribution in #7148
• @TalhaHunter101 made their first contribution in #7110
• @shoaibulhaque made their first contribution in #7124
• @mayur-dhavan made their first contribution in #7159

Full Changelog: v6.0.0-alpha.5...v6.0.0-alpha.6

⚠️ Security Release

• Fix for GHSA-3qgw-9275-xf8w

What's Changed

• [Backport 5.x] fix(types): restore this context in route shorthand hooks by @github-actions[bot] in #7055
• [Backport 5.x] fix(reply): send stream trailers after the stream actually finishes by @github-actions[bot] in #7111
• [Backport 5.x] test(server): assert the server is listening instead of a literal by @github-actions[bot] in #7112
• [Backport 5.x] feat: add routerOptions.compile to use find-my-way compiler mode by @Tony133 in #7116
• [Backport 5.x] fix: clamp error statusCode between 400 and 599 with 500 fallback by @github-actions[bot] in #7122
• [Backport 5.x] fix: contain synchronous throws from custom content type parsers by @github-actions[bot] in #7123
• [Backport 5.x] docs(serverless): clarify per-route observability on serverless platf… by @github-actions[bot] in #7134
• [Backport 5.x] feat(hooks): support disposables in onClose hook (#5669) by @github-actions[bot] in #7136
• [Backport 5.x] fix(types): allow socket path strings in addresses by @github-actions[bot] in #7138
• [Backport 5.x] fix(types): add logSerializers to RouteShorthandOptions by @github-actions[bot] in #7145
• [Backport 5.x] test: do not assert a HEAD response body through inject() by @github-actions[bot] in #7149
• [Backport 5.x] docs(request): reorganize Request reference by properties and methods by @Tony133 in #7150
• [Backport 5.x] docs(reply): reorganize Reply reference by properties and methods by @Tony133 in #7151
• [Backport 5.x] docs: remove plugins that do not support Fastify v5 by @Tony133 in #7152
• [Backport 5.x] perf(request): hoist port regex to module level by @github-actions[bot] in #7153
• [Backport 5.x] fix(decorators): evaluate instance getters once in getDecorator by @github-actions[bot] in #7154
• [Backport 5.x] docs: clarify that maxParamLength does not prevent ReDoS by @github-actions[bot] in #7158
• [Backport 5.x] docs: fix syntax errors in code examples by @github-actions[bot] in #7160

Full Changelog: v5.12.7...v5.12.8

What's Changed

• docs: clarify headers validation is additive, not a sanitized view by @mcollina in #7029
• perf: read the merged headers once in the trust proxy getters by @hktitof in #7039
• types: restrict route lookup methods by @Yanhaoxi in #6963
• fix(types): custom logger instance not assignable to FastifyInstance by @Tony133 in #6901
• fix(types): restore this context in route shorthand hooks by @lazerg in #6975
• perf: decode string bodies once instead of per chunk by @gurgunday in #7049
• docs(ecosystem): add @validex/fastify to community plugins by @chiptoma in #6660
• perf: avoid resetting the level of request child loggers by @gurgunday in #7056
• fix: omit absent compileSerializationSchema metadata instead of passing null by @Kjubikstronk in #7001
• fix: remove error when HTTP QUERY request has empty body by @LiviaMedeiros in #6929
• docs: list fastify-mariadb as a community plugin by @melroy89 in #7062
• fix: resolve reply.mediaType from raw response headers by @agustin18 in #7054
• perf: use a FIFO cache for parsed content-types by @gurgunday in #7071
• docs: remove plugins that do not support Fastify v5 by @ilteoood in #7075
• fix: copy a set-cookie array passed to reply.header instead of storing it by @fadiroot in #7068
• test: fix "recieve" typo in comment by @ump45nose in #7066
• docs: document fastify.query() shorthand for RFC 10008 by @Puppo in #7004
• docs(security): clarify scope of unvalidated template selection by @mcollina in #7065
• docs(ecosystem): Add fastify-mosquitto-dynsec to community plugins by @LuizTakeda in #7064
• docs: clarify reply.redirect encoding does not prevent open redirects by @mcollina in #6964
• docs: fix external link to node docs by @BenMotz in #7088
• test(validation): cover remaining propertyNames header branches by @mcollina in #7105

New Contributors

• @hktitof made their first contribution in #7039
• @Yanhaoxi made their first contribution in #6963
• @chiptoma made their first contribution in #6660
• @Kjubikstronk made their first contribution in #7001
• @agustin18 made their first contribution in #7054
• @fadiroot made their first contribution in #7068
• @ump45nose made their first contribution in #7066
• @LuizTakeda made their first contribution in #7064
• @BenMotz made their first contribution in #7088

Full Changelog: v6.0.0-alpha.4...v6.0.0-alpha.5

Full Changelog: v5.12.6...v5.12.7

⚠️ Security Release

• Fix for GHSA-389g-gv7q-r4x8

What's Changed

• [Backport 5.x] types: restrict route lookup methods by @github-actions[bot] in #7048
• [Backport 5.x] perf: decode string bodies once instead of per chunk by @github-actions[bot] in #7053
• [Backport 5.x] perf: avoid resetting the level of request child loggers by @github-actions[bot] in #7058
• [Backport 5.x] fix: resolve reply.mediaType from raw response headers by @github-actions[bot] in #7067
• [Backport 5.x] perf: use a FIFO cache for parsed content-types by @github-actions[bot] in #7072
• [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/const by @mcollina in #7104
• [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of storing it by @github-actions[bot] in #7087
• [Backport 5.x] fix: remove error when HTTP QUERY request has empty body by @github-actions[bot] in #7060
• [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 by @github-actions[bot] in #7094

Full Changelog: v5.12.5...v5.12.6

⚠️ Security release

• Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

• docs: add fastify-arktype to ecosystem by @BlairCurrey in #7000
• docs: link documentation style guide in contributing guidelines by @thePranav-kpk in #6819
• perf: reduce content-type parser overhead by @gurgunday in #7012
• perf: avoid redundant request-part reads during validation by @gurgunday in #7018
• chore(sponsor): add cloudways by @mcollina in #7021

New Contributors

• @BlairCurrey made their first contribution in #7000

Full Changelog: v6.0.0-alpha.3...v6.0.0-alpha.4

⚠️ Security release

• Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

• [Backport 5.x] perf: reduce content-type parser overhead by @github-actions[bot] in #7019
• [Backport 5.x] perf: avoid redundant request-part reads during validation by @github-actions[bot] in #7020

Full Changelog: v5.12.4...v5.12.5

Fixed the fastify.js version mismatch.

Full Changelog: v5.12.2...v5.12.4

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• docs: fix broken links in Style-Guide.md by @Snehal-Pradhan in #6966
• test(types): assert LogController.requestCompleted accepts an undefined error by @suzunn in #6875
• fix: callNotFound should run not-found preHandler regardless of registration order by @mcollina in #6965
• docs(ecosystem): remove deprecated http-wizard and rename fastify-better-sqlite3 by @ilteoood in #6972
• chore: npm ignore remaining agent files by @lazerg in #6996
• docs(contenttypeparser): new strict content-type validation by @bcomnes in #6925

New Contributors

• @Snehal-Pradhan made their first contribution in #6966
• @suzunn made their first contribution in #6875
• @bcomnes made their first contribution in #6925

Full Changelog: v6.0.0-alpha.2...v6.0.0-alpha.3

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @github-actions[bot] in #6973
• [Backport 5.x] chore: npm ignore remaining agent files by @github-actions[bot] in #7003

Full Changelog: v5.12.1...v5.12.2