Fastify v6.0.0-alpha.6 Released With Security Fix and Breaking Changes

Fastify v6.0.0-alpha.6 was released by Matteo Collina on 2 November. This pre-release includes a security fix tracked as GHSA-3qgw-9275-xf8w, though the release notes omit details beyond the identifier.

Two breaking changes land in this version. First, Fastify fails closed if a response content type lacks a declaration in the route content map (#7132). Second, default validation errors are instantiated without a stack trace for performance reasons (#7057), which impacts any code reading stack traces from those errors.

New features add a routerOptions.compile option to enable compiler mode in the find-my-way router (#7096) and bring disposable support to the onClose hook (#7121).

Several bug fixes and performance updates are included. Stream trailers on replies now send after the stream finishes (#6953). Error status codes clamp to the 400–599 range with a 500 fallback (#7089), synchronous throws from custom content type parsers are contained (#7118), and getDecorator evaluates instance getters once (#7124). Type updates permit socket path strings in addresses (#6842) and add logSerializers to RouteShorthandOptions (#7143). An additional performance tweak moves a port regex to the module level in request code (#7110).

Documentation updates reorganize Reply and Request references by properties and methods (#7146, #7147), clarify that maxParamLength doesn't prevent ReDoS (#7140), clarify per-route observability on serverless platforms (#6802), fix code example syntax errors (#7159), add @guardcore/fastify to the ecosystem list (#7128), and add Tony133 to the core team (#7175).

Twelve contributors made their first contribution, including kyungseopk1m, zkasuran, swaraj792725, and YOGESH256.