Sourced from fastify's releases.

v5.8.1

Security Release

Fixes "Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation": GHSA-573f-x89g-hqp9.

CVE-2026-3419

Full Changelog: fastify/fastify@v5.8.0...v5.8.1

v5.8.0

What's Changed

• docs(request): add host security warning references by @ mcollina in fastify/fastify#6476
• docs: fix note style by @ Fdawgs in fastify/fastify#6487
• chore: rename deploy website ci by @ Eomm in fastify/fastify#6492
• chore: support pino v9 and v10 by @ mcollina in fastify/fastify#6496
• chore: update logger types and fix TODO comment by @ Tony133 in fastify/fastify#6470
• refactor(test-types): migrate dummy-plugin to FastifyPluginAsync by @ Tony133 in fastify/fastify#6472
• docs: fix markdown typo in README.md by @ droppingbeans in fastify/fastify#6491
• test: cover non-numeric content-length client error path by @ mcollina in fastify/fastify#6500
• ci: remove tests-checker workflow by @ Tony133 in fastify/fastify#6481
• ci: remove stale.yml file by @ Tony133 in fastify/fastify#6504
• docs(security): remove hackerone references; change note style by @ Fdawgs in fastify/fastify#6501
• chore: rename @ sinclair/typebox to typebox by @ Tony133 in fastify/fastify#6494
• ci(links-check): add external link checker using linkinator-action by @ umxr in fastify/fastify#6386
• chore: upgrade borp to v1.0.0 by @ Tony133 in fastify/fastify#6510
• docs: Add OpenJS CNA reference to SECURITY.md by @ mcollina in fastify/fastify#6516
• fix: avoid mutating shared routerOptions across instances by @ mcollina in fastify/fastify#6515
• fix(types): accept async route hooks in shorthand options by @ mcollina in fastify/fastify#6514
• docs: Improve shutdown lifecycle documentation by @ kibertoad in fastify/fastify#6517
• chore: remove unused tsconfig.eslint.json by @ mrazauskas in fastify/fastify#6524
• feat: First-class support for handler-level timeouts by @ kibertoad in fastify/fastify#6521
• docs(security): clarify insecureHTTPParser threat model scope by @ mcollina in fastify/fastify#6533
• chore(license): standardise license notice by @ Fdawgs in fastify/fastify#6511
• docs: clarify anyOf nullable coercion behavior with primitive types by @ slegarraga in fastify/fastify#6531
• fix: remove format placeholder from FST_ERR_CTP_INVALID_MEDIA_TYPE message by @ super-mcgin in fastify/fastify#6528
• docs(reference/hooks): fix note style by @ Fdawgs in fastify/fastify#6538
• chore: Bump lycheeverse/lychee-action from 2.7.0 to 2.8.0 by @ dependabot[bot] in fastify/fastify#6539
• chore: Bump actions/dependency-review-action from 4.8.2 to 4.8.3 by @ dependabot[bot] in fastify/fastify#6540
• chore: Bump markdownlint-cli2 from 0.20.0 to 0.21.0 by @ dependabot[bot] in fastify/fastify#6542
• ci: remove broken links and add ecosystem link validator by @ mcollina in fastify/fastify#6421
• ci(validate-ecoystem-links): add job level permission by @ Fdawgs in fastify/fastify#6545
• style: remove trailing whitespace by @ Fdawgs in fastify/fastify#6543

New Contributors

• @ droppingbeans made their first contribution in fastify/fastify#6491
• @ umxr made their first contribution in fastify/fastify#6386
• @ slegarraga made their first contribution in fastify/fastify#6531
• @ super-mcgin made their first contribution in fastify/fastify#6528

Full Changelog: fastify/fastify@v5.7.4...v5.8.0

• 073ff81 Bumped v5.8.1
• 67f6c9b Merge commit from fork
• 161578a chore: sync version
• 9b06a78 Bumped v5.8.0
• bbdfe82 style: remove trailing whitespace (#6543)
• cd58ed4 ci(validate-ecoystem-links): add job level permission (#6545)
• 2590592 ci: remove broken links and add ecosystem link validator (#6421)
• 09b55b6 chore: Bump markdownlint-cli2 from 0.20.0 to 0.21.0 (#6542)
• 43c4e38 chore: Bump actions/dependency-review-action from 4.8.2 to 4.8.3 (#6540)
• 3b40573 chore: Bump lycheeverse/lychee-action from 2.7.0 to 2.8.0 (#6539)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.