Fastify 4 to 5

Fixed the fastify.js version mismatch.

⚠️ Security release Fix for https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58 Fix for https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h Fix for https://github.com/fastify/fastify/security/ad

⚠️ Security release Fix for https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4 Fix for https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2 What's Changed [Backport 5.x] test: fix reply.mediaTyp

chore(sponsor): add testmu ai by @Eomm in https://github.com/fastify/fastify/pull/6922 docs: add per-route logging for Google Cloud Functions by @slegarraga in https://github.com/fastify/fastify/pull/6907 test: remove @sinonjs/fake-timers b

fix: clear trailer state when removing all trailers by @Ram-blip in https://github.com/fastify/fastify/pull/6845 docs: document percent-decoded route params as untrusted input by @mcollina in https://github.com/fastify/fastify/pull/6903 doc

fix fastify version in fastify.js

fix: add http method override warning by @jean-michelet in https://github.com/fastify/fastify/pull/6879 fix(types): allow explicit http2: false in server options by @Tony133 in https://github.com/fastify/fastify/pull/6888 docs: clarify what

chore: Bump markdownlint-cli2 from 0.22.1 to 0.23.0 by @dependabot[bot] in https://github.com/fastify/fastify/pull/6839 fix: normalize method in findRoute by @Ram-blip in https://github.com/fastify/fastify/pull/6838 docs: fix incorrect desc

docs(type-providers): clarify as const usage by @smith558 in https://github.com/fastify/fastify/pull/6772 docs: fix broken and redirected links by @Eomm in https://github.com/fastify/fastify/pull/6817 docs: remove marko from @fastify/view e

feat: add request.mediaType by @climba03003 in https://github.com/fastify/fastify/pull/6653 docs: remove deprecated leveldb plugin and update ecosystem by @Tony133 in https://github.com/fastify/fastify/pull/6661 chore(sponsor): add bestfora

⚠️ Security Release This fixes CVE CVE-2026-33806 https://github.com/fastify/fastify/security/advisories/GHSA-247c-9743-5963. What's Changed chore: Fix port parsing by @jsumners in https://github.com/fastify/fastify/pull/6603 chore: upgrade

⚠️ Security Release This fixes CVE CVE-2026-3635 https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf. What's Changed docs(readme): add @Tony133 to plugin team by @Tony133 in https://github.com/fastify/fastify/pull/656

docs(ecosystem): add @yeliex/fastify-problem-details by @yeliex in https://github.com/fastify/fastify/pull/6546 Revert "chore: upgrade borp to v1.0.0" by @climba03003 in https://github.com/fastify/fastify/pull/6564 docs: document body valid

⚠️ Security Release Fixes "Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation": https://github.com/fastify/fastify/security/advisories/GHSA-573f-x89g-hqp9. CVE-2026-3419

docs(request): add host security warning references by @mcollina in https://github.com/fastify/fastify/pull/6476 docs: fix note style by @Fdawgs in https://github.com/fastify/fastify/pull/6487 chore: rename deploy website ci by @Eomm in htt

⚠️ Security Release Fix https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77c CVE-2026-25224. What's Changed docs: update Reply.send() documentation for string serialization by @mcollina in https://github.com/fastify/fa

⚠️ Notice ⚠️ Parsing of the content-type header has been improved to a strict parser in PR #6414. This means only header values in the form described in RFC 9110 are accepted. What's Changed chore: npm ignore AI related files by @climba0300

chore: Bump actions/checkout from 5 to 6 by @dependabot[bot] in https://github.com/fastify/fastify/pull/6434 chore: updated version in the fastify.js by @Tony133 in https://github.com/fastify/fastify/pull/6446

docs: Improved firebase serverless guide about process remaining stuck by @alexandercerutti in https://github.com/fastify/fastify/pull/6380 docs: update migration guide with date-time breaking change by @craftsman01 in https://github.com/fa

refactor: rename source file names with kebab-case by @jean-michelet in https://github.com/fastify/fastify/pull/6331 ci(ci): check dependabot prs originate from repo by @Fdawgs in https://github.com/fastify/fastify/pull/6330 fix: accept hta

fix: fix typo of deprecation warning FSTDEP022 by @Uzlopak in https://github.com/fastify/fastify/pull/6313 docs(decorators): fix TypeScript inconsistency by @emicovi in https://github.com/fastify/fastify/pull/6224 chore: fix typos by @deini

fix: update typescript pino type to pick by @dancastillo in https://github.com/fastify/fastify/pull/6287 feat(types): router option types by @dancastillo in https://github.com/fastify/fastify/pull/6282 fix(types): Fix use of "esModuleIntero

docs: fix markdown linting issue by @Uzlopak in https://github.com/fastify/fastify/pull/6175 chore: removed simple-get from mkcalendar tests by @ilteoood in https://github.com/fastify/fastify/pull/6199 chore: removed simple-get from version

test: mv routes-* from tap by @jean-michelet in https://github.com/fastify/fastify/pull/6092 test: mv skip-reply-send from tap by @jean-michelet in https://github.com/fastify/fastify/pull/6094 test: mv plugins from tap by @jean-michelet in

docs: update Vercel section by @leerob in https://github.com/fastify/fastify/pull/6046 docs(ecosystem): add fastify-papr plugin by @inaiat in https://github.com/fastify/fastify/pull/6051 test: migrated helper and input validation to node te

⚠️ Security Release ⚠️ Unfortunately, v5.3.1 did not include a complete fix for "Invalid content-type parsing could lead to validation bypass" and CVE-2025-32442. This is a follow-up patch to cover an edge case. What's Changed docs: fix arc

⚠️ Security Release ⚠️ Fix for "Invalid content-type parsing could lead to validation bypass" and CVE-2025-32442 What's Changed test: migrate logger options to node test runner by @ilteoood in https://github.com/fastify/fastify/pull/6059 te

fix: wrong reply return type by @dangkyokhoang in https://github.com/fastify/fastify/pull/6026 feat: allow to access decorators by @jean-michelet in https://github.com/fastify/fastify/pull/5768 ci: continue-on-error on alternative runtime b

build: use static path instead of __filename by @climba03003 in https://github.com/fastify/fastify/pull/5922 fix(linting): fix linting error in error-handler.js by @Uzlopak in https://github.com/fastify/fastify/pull/5926 chore: Bump the dev

chore: org members reorder by @Eomm in https://github.com/fastify/fastify/pull/5898 docs(request): clarify request host functionality by @Fdawgs in https://github.com/fastify/fastify/pull/5904 chore(package): add fdawgs to contributors arra

docs: add HeroDevs mentions to README and LTS docs by @AndreAngelantoni in https://github.com/fastify/fastify/pull/5730 test: migrated reply-early-hints.test.js from tap to node:test by @Tony133 in https://github.com/fastify/fastify/pull/58

chore: Update Migration-Guide-V5.md by @jsumners in https://github.com/fastify/fastify/pull/5688 fix(guide-v5): wrong link for diagnostics channel by @corradopetrelli in https://github.com/fastify/fastify/pull/5693 chore: fix typo in reply-

add missing route shorthands by @Uzlopak in https://github.com/fastify/fastify/pull/4409 lib: drop setDefaultRoute and getDefaultRoute methods by @RafaelGSS in https://github.com/fastify/fastify/pull/4485 Sync next-branch by @github-actions