chore(fastify): Update dependency fastify to v5.12.5 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
fastify (source)	5.8.5 → 5.12.5

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

CVE-2026-16732 / GHSA-3m5p-2c4r-xxw2

More information

Details

Impact

The fix for CVE-2026-3635 (GHSA-444r-cwp2-x5xf) added a proxyFn(socket.remoteAddress, 0) guard on the X-Forwarded-* reads in request.host, request.protocol, request.hostname, request.ip, and request.ips. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly because those forms compile to predicates that inspect the connecting address. The hop-count form (trustProxy: <number>) compiles to a predicate that structurally ignores the address argument, so the guard reduces to 0 < tp, always true for any tp >= 1.

Applications configured with trustProxy: <number> (documented as "behind N reverse proxies", trustProxy: 1 being the canonical single-proxy setting) remain vulnerable. An attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the request fields exactly as in the unpatched version. Impact class matches the parent CVE-2026-3635: host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie / CSRF-origin bypass, host-based routing and cache poisoning.

Patches

Patched in fastify 5.12.1. The numeric form of trustProxy is now disabled at runtime and removed from the TypeScript type union.

Workarounds

• Migrate to an IP / CIDR / custom-function trustProxy value that validates the connecting address. Custom functions must inspect the address argument, not only the hop index.
• Ensure the Fastify origin is only reachable through the trusted proxy chain (no direct network path).

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2
• https://nvd.nist.gov/vuln/detail/CVE-2026-16732
• https://github.com/fastify/fastify/commit/8acfea7eada05383a7357e3eb21c2628416df280
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.1
• https://github.com/advisories/GHSA-3m5p-2c4r-xxw2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

CVE-2026-18504 / GHSA-w2qp-rph6-63g4

More information

Details

Impact

fastify before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced to the number 10 and passes an integer 1 to 10 schema, but request.body stays the string "10". An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.

Patches

Upgrade to fastify 5.12.1.

Workarounds

Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept { "value": 10 } and read request.body.value, or re-check the type in the handler.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4
• https://nvd.nist.gov/vuln/detail/CVE-2026-18504
• https://github.com/fastify/fastify/commit/1ef8a60c87e94f42f666aa15ad68957772a83655
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.1
• https://github.com/advisories/GHSA-w2qp-rph6-63g4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to header validation bypass via incomplete schema case normalization

CVE-2026-84428 / GHSA-9q9j-q6p8-xq58

More information

Details

Impact

Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7 dependencies keyword (its trigger keys and dependent property names) or names in nested subschemas. As a result, a header schema that uses dependencies to require one header when another is present (for example X-Admin requiring X-Admin-Token) never matches the lowercased request headers, so the dependency assertion is silently skipped. An unauthenticated remote client can send the header that activates a privileged path while omitting the header the dependency was meant to require, bypassing a schema-enforced security control. The header schema is idiomatic, valid JSON Schema Draft 7, and no custom validator, malformed request, or misconfiguration is required.

Patches

Header-schema names are now normalized across all schema positions (properties, required, dependencies, dependentRequired, dependentSchemas, and nested subschemas). Patched in fastify 5.12.2. The fix is also included in the 6.0.0 release. Header schemas referenced through an external shared $ref (registered with addSchema) are not reached by this normalization and now emit an FSTSEC002 startup warning; inline the header schema to keep case-insensitive assertions in effect.

Workarounds

If upgrading is not immediately possible, write header-schema names in lowercase so the dependencies and other case-sensitive assertions match Node's lowercased request headers, or enforce the cross-header requirement in an onRequest or preValidation hook instead of the schema.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58
• https://nvd.nist.gov/vuln/detail/CVE-2026-84428
• https://github.com/fastify/fastify/commit/179619c8e99d54924309b9933402151ef9af37e0
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-9q9j-q6p8-xq58

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to request validation bypass via skipped boolean false schemas

CVE-2026-84469 / GHSA-hwr6-493r-vm6h

More information

Details

Impact

Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had that part left uncompiled: no validator was attached and the request reached the handler. An application that used false as a deny-all schema to make a route unreachable was therefore fully bypassed, and an unauthenticated remote client could reach the handler with any input. The same applied to the documented query alias for querystring. This is a complete bypass rather than a weak-schema issue, since false is the strongest JSON Schema assertion and must always fail.

Patches

Request-part schemas are now selected by an explicit presence check rather than truthiness, so a boolean false (or true) schema is compiled and enforced, including through the query alias. Patched in fastify 5.12.2. The fix is also included in the 6.0.0 release.

Workarounds

If upgrading is not immediately possible, express a deny-all request schema with an always-failing object schema instead of the boolean false (for example { "not": {} }), or reject the request in an onRequest hook.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h
• https://nvd.nist.gov/vuln/detail/CVE-2026-84469
• https://github.com/fastify/fastify/commit/7de6e81697778f9f41bd327a3b1c5c9a0d9637b4
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-hwr6-493r-vm6h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

CVE-2026-76169 / GHSA-p68q-wchp-6fh7

More information

Details

Impact

Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler(). When the request method has no route in the main router, a malformed request target reaches Fastify's internal not-found router before URL decoding and is dispatched through a single shared handler pointer, regardless of prefix and without the normal request lifecycle. An unauthenticated request to a public prefix can therefore reach an authentication-protected not-found handler registered under a different prefix and receive its full response, breaking prefix encapsulation and bypassing the authentication hook. Applications whose private or tenant fallbacks return protected data from a not-found handler are affected.

Patches

Patched in fastify 5.12.2. Malformed URLs are now routed through the configured onBadUrl and onMaxParamLength handlers so they fail closed before any application not-found handler runs, and the shared not-found handler pointer has been removed.

Workarounds

Reject malformed request targets before they reach the application, for example at an upstream proxy or gateway, and do not rely on a not-found handler to serve protected data. A global onRequest authentication hook does not mitigate this, because the malformed-URL path skips it.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7
• https://nvd.nist.gov/vuln/detail/CVE-2026-76169
• https://github.com/fastify/fastify/commit/93c239a380f3f2778bb7565fcdf777e91cfe1fbc
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-p68q-wchp-6fh7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to request body replacement via an async validation result collision

CVE-2026-84504 / GHSA-667r-xxjv-c9mm

More information

Details

Impact

Fastify runs a route's validator and, for a result shaped like { value, error }, unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers (for example Joi). A JSON Schema $async validator, however, resolves with the validated data itself, so Fastify applied the same unwrapping to it. If a request part validated by an $async schema contains a value property, Fastify replaced the whole request part with that nested value before the handler ran, so a value or error property in the payload was attacker-controlled. An application that dispatches operations from the validated request body could then act on data that never satisfied the route schema, leading to unauthorized state changes or disclosure. Reaching the vulnerable path requires the route to use an $async request schema.

Patches

Fastify no longer treats an asynchronous validation result as a { value, error } wrapper: an async validator's resolved value is used only to determine pass or fail, and it can no longer replace the request part or inject an error. The synchronous custom-compiler contract is unchanged. Patched in fastify 5.12.2 and 6.0.0.

Workarounds

If upgrading is not immediately possible, avoid $async request schemas, or perform the security-sensitive check in an onRequest or preHandler hook rather than relying on the schema-validated request part. Custom async validator compilers should signal failure by throwing (rejecting) rather than returning an { error } object.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm
• https://nvd.nist.gov/vuln/detail/CVE-2026-84504
• https://github.com/fastify/fastify/commit/f02d8d4ab1ab208f10819c4dc213595b06497833
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-667r-xxjv-c9mm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

CVE-2026-92081 / GHSA-4mh8-r7rc-xpvc

More information

Details

Impact

fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.

One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.

Patches

Upgrade to fastify 5.12.5 or later.

Workarounds

Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc
• https://nvd.nist.gov/vuln/detail/CVE-2026-92081
• https://github.com/fastify/fastify/issues/6574
• https://github.com/fastify/fastify/commit/ad06a4c3fe8a944a904f38068249b18b8f552e90
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.5
• https://github.com/advisories/GHSA-4mh8-r7rc-xpvc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fastify (fastify)

v5.12.5

Compare Source

⚠️ Security release

• Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

• [Backport 5.x] perf: reduce content-type parser overhead by @​github-actions[bot] in #​7019
• [Backport 5.x] perf: avoid redundant request-part reads during validation by @​github-actions[bot] in #​7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Compare Source

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.3

Compare Source

v5.12.2

Compare Source

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in #​6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in #​7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

v5.12.1

Compare Source

⚠️ Security release

• Fix for GHSA-w2qp-rph6-63g4
• Fix for GHSA-3m5p-2c4r-xxw2

What's Changed

• [Backport 5.x] test: fix reply.mediaType by @​github-actions[bot] in #​6950
• [Backport 5.x] ci: allow backport in pr title by @​github-actions[bot] in #​6952
• [Backport 5.x] fix: run preClose hook exactly once per declaring instance by @​github-actions[bot] in #​6954
• [Backport 5.x] fix: report canonical route url for hidden prefix slash route by @​github-actions[bot] in #​6961

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

Compare Source

What's Changed

• chore(sponsor): add testmu ai by @​Eomm in #​6922
• docs: add per-route logging for Google Cloud Functions by @​slegarraga in #​6907
• test: remove @​sinonjs/fake-timers by @​climba03003 in #​6934
• [Backport 5.x] fix: remove raw response headers by @​github-actions[bot] in #​6939
• [Backport 5.x] test: use process-warning spyWarning for testing by @​github-actions[bot] in #​6945
• [Backport 5.x] feat: add Reply.prototype.mediaType by @​github-actions[bot] in #​6946
• [Backport 5.x] fix(content-type): return undefined for invalid media types by @​github-actions[bot] in #​6947

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

Compare Source

What's Changed

• fix: clear trailer state when removing all trailers by @​Ram-blip in #​6845
• docs: document percent-decoded route params as untrusted input by @​mcollina in #​6903
• docs(errors): document what the default error handler sends by @​basteez in #​6894
• docs(readme): fix grammar and cjs capitalization by @​minirang in #​6899
• fix: pass null instead of undefined to requestCompleted on success by @​lazerg in #​6837
• docs(encapsulation): clarify nested plugin scopes by @​jean-michelet in #​6893
• chore: Bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6916
• chore: Bump fastify/workflows/.github/workflows/nested-quality.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6917
• fix: recognize constructor-assigned built-in properties as decorator … by @​aquie00t in #​6892
• fix: reset lastIndex before testing global/sticky content-type RegExp parsers by @​zelinewang in #​6846

New Contributors

• @​minirang made their first contribution in #​6899
• @​lazerg made their first contribution in #​6837
• @​zelinewang made their first contribution in #​6846

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

Compare Source

v5.11.1

Compare Source

What's Changed

• fix: add http method override warning by @​jean-michelet in #​6879
• fix(types): allow explicit http2: false in server options by @​Tony133 in #​6888
• docs: clarify what attachValidation exposes on request.validationError by @​basteez in #​6891
• fix: do not force close in-flight connections when forceCloseConnections is 'idle' by @​aquie00t in #​6889

New Contributors

• @​basteez made their first contribution in #​6891

Full Changelog: fastify/fastify@v5.11.0...v5.11.1

v5.11.0

Compare Source

What's Changed

• chore: Bump markdownlint-cli2 from 0.22.1 to 0.23.0 by @​dependabot[bot] in #​6839
• fix: normalize method in findRoute by @​Ram-blip in #​6838
• docs: fix incorrect description for validateInput in Request.md by @​thePranav-kpk in #​6823
• feat: rfc10008 http query method by @​climba03003 in #​6832
• perf: reuse cached content types for response serialization by @​gurgunday in #​6854
• chore(sponsor): add n-ix by @​Eomm in #​6852
• ci: pin actions to commit-hash by @​Fdawgs in #​6853
• ci(dependabot): temporarily ignore typescript updates by @​Tony133 in #​6869
• style(types): enforce max line length by @​jean-michelet in #​6864
• docs(ecosystem): update fastify-prisma repo URL by @​zrosenbauer in #​6724
• docs(getting-started): align import with exported routes by @​Solaris-star in #​6859
• docs(server): fix contradictory requestIdHeader default by @​sobol-sudo in #​6872
• fix(validation): correctly update falsy values from validator by @​jackjin1997 in #​6483
• docs: specific warning suppression by @​jean-michelet in #​6871
• ci(links-check): pin linkinator server root to the workspace by @​aquie00t in #​6877
• docs: update TypeScript docs to reference Fastify 5.x by @​Sasireddy001 in #​6880
• docs: use async trailer handlers in Reply examples by @​Ram-blip in #​6856
• docs: fix logController migration example and links by @​aquie00t in #​6876
• fix: uncatchable throws in writeHead when using async hook by @​climba03003 in #​6881
• fix: honor quoted-string in Content-Type parameter values by @​aquie00t in #​6865
• chore(.npmrc): add min-release-age by @​Fdawgs in #​6873
• chore: Bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​6866
• chore: Bump actions/labeler from 6.2.0 to 7.0.0 by @​dependabot[bot] in #​6867

New Contributors

• @​Ram-blip made their first contribution in #​6838
• @​Solaris-star made their first contribution in #​6859
• @​sobol-sudo made their first contribution in #​6872
• @​jackjin1997 made their first contribution in #​6483
• @​Sasireddy001 made their first contribution in #​6880

Full Changelog: fastify/fastify@v5.10.0...v5.11.0

v5.10.0

Compare Source

v5.9.0

Compare Source

What's Changed

• feat: add request.mediaType by @​climba03003 in #​6653
• docs: remove deprecated leveldb plugin and update ecosystem by @​Tony133 in #​6661
• chore(sponsor): add bestforandroid by @​Eomm in #​6659
• ci: drop Node.js 20 from yarn matrix in package-manager-ci.yml by @​Tony133 in #​6662
• fix: prevent duplicate res.end in sendTrailer with sync callbacks by @​climba03003 in #​6676
• fix: avoid duplicate closeIdleConnections call on native servers by @​trivikr in #​6669
• fix: error.code not present on some routing errors by @​mcollina in #​6678
• fix: correct isCustomSerializerCompiler flag check by @​eddieran in #​6657
• fix: validate invalid route logLevel at registration by @​maxpetrusenko in #​6523
• docs: update contribution rules by @​Tony133 in #​6670
• fix: use ContentType parser for response schema lookup by @​UlisesGascon in #​6685
• ci(ci): use shared quality workflow by @​Fdawgs in #​6688
• fix(types): allow request.getValidationFunction() to return undefined by @​trivikr in #​6665
• fix: do not trust forwarded host/proto when socket is missing by @​mcollina in #​6684
• perf: defer ContentType parsing in getSchemaSerializer until needed by @​aquie00t in #​6692
• perf: cache parsed ContentType objects in ContentTypeParser by @​aquie00t in #​6694
• perf: add typeof guard before toString.call in send and onSendEnd by @​aquie00t in #​6693
• chore: Bump pnpm/action-setup from 5.0.0 to 6.0.4 by @​dependabot[bot] in #​6704
• chore: Bump actions/github-script from 8 to 9 by @​dependabot[bot] in #​6705
• chore: Bump JustinBeckwith/linkinator-action from 2.4.0 to 2.4.2 by @​dependabot[bot] in #​6706
• docs: correct return503OnClosing comment in route.js by @​mcollina in #​6712
• fix: enable diagnostics tracking for async error handlers by @​irzix in #​6458
• fix: ignore duplicate trailer completions by @​mcollina in #​6714
• feat: add support of onMaxParamLength by @​climba03003 in #​6716
• chore: introduce TSTyche for type testing by @​mrazauskas in #​6532
• docs(reference): grammar and readability fixes by @​Fdawgs in #​6710
• chore: update depedabot setting by @​climba03003 in #​6715
• fix: include hint and docs URL in FSTWRN004 warning message by @​aquie00t in #​6723
• ci(ci): do not pass secrets to reusable workflow by @​Fdawgs in #​6744
• docs: add fastify-intlayer to ecosystem documentation by @​aymericzip in #​6594
• chore: Bump concurrently from 9.2.1 to 10.0.0 by @​dependabot[bot] in #​6752
• docs(Errors): fix incorrect usage of root fastify inside plugin scope by @​Rpaudel379 in #​6731
• ci: add node 26 to test matrices by @​Fdawgs in #​6728
• docs(Warnings): remove retired FSTWRN002 warning code by @​leestana01 in #​6754
• fix: chunk large HTTP/2 buffer replies by @​mcollina in #​6746
• chore: migrate type tests to TSTyche assertions (part one) by @​mrazauskas in #​6726
• chore: migrate type tests to TSTyche assertions (part two) by @​mrazauskas in #​6727
• docs: fix doubled braces in serializerCompiler signature by @​DucMinhNe in #​6747
• docs: remove HackerOne reporting link by @​jhcpeixoto in #​6735
• refactor(decorate): replace find with some in hasKey for correct boolean semantics by @​aquie00t in #​6759
• fix: replace AssertionError with FST_ERR_PLUGIN_DEPENDENCY_NOT_REGISTERED in checkDependencies by @​aquie00t in #​6774
• docs(ecosystem): add @​inferdi/fastify by @​maxrendel in #​6742
• docs(typo): Write-Plugin.md by @​zakirimadullahprogrammer-tech in #​6776
• docs: fix duplicate anchor IDs causing broken TOC links by @​AliMahmoudDev in #​6770
• docs: add fastify-ata as a JSON Schema validator option by @​mertcanaltin in #​6733
• chore: rename type test files by @​mrazauskas in #​6762
• docs: update ajv-errors guidance by @​Herrtian in #​6741
• chore(warnings): correct duplicate 'not' typos in inline comments by @​mixelburg in #​6713
• docs: add fastify-param-schema-validation to ecosystem by @​Player1205 in #​6760
• docs(ecosystem): add @​thecodepace/fastify-http-query by @​Puppo in #​6785
• chore: Bump esbuild from 0.25.12 to 0.28.1 in /test/bundler/esbuild in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​6788
• fix: clear socket._meta after response to prevent keep-alive leaks by @​nerkoux in #​6799
• fix: avoid double slash when joining nested prefixes by @​rohithvegesna in #​6803
• docs(sponsors): Update sponsors list by removing two entries by @​Eomm in #​6792
• chore: Bump fastify-plugin from 5.1.0 to 6.0.0 by @​dependabot[bot] in #​6801
• chore(package.json): fix delvedor's personal url by @​Fdawgs in #​6808
• chore: replace http with https in urls by @​Fdawgs in #​6809
• chore: add new sponsor by @​Eomm in #​6813
• chore: Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​6812
• fix: hasRequestDecorator/hasReplyDecorator misses constructor-assigned built-in properties by @​LeSingh1 in #​6753
• docs: migrate Zod type provider to official @​fastify package by @​Tony133 in #​6686
• docs: add warning about empty string coercion with nullable types by @​ritambh888 in #​6452
• docs: fix incorrect code examples in Hooks and Server reference by @​rrodj in #​6622
• docs: update Serverless guide Dockerfile to a supported Node.js version by @​harish885 in #​6789
• docs(types): mark request metadata accessors as untrusted input by @​mcollina in #​6572
• Bumped v5.9.0 by @​Eomm in #​6816

New Contributors

• @​eddieran made their first contribution in #​6657
• @​irzix made their first contribution in #​6458
• @​aymericzip made their first contribution in #​6594
• @​Rpaudel379 made their first contribution in #​6731
• @​leestana01 made their first contribution in #​6754
• @​DucMinhNe made their first contribution in #​6747
• @​jhcpeixoto made their first contribution in #​6735
• @​maxrendel made their first contribution in #​6742
• @​zakirimadullahprogrammer-tech made their first contribution in #​6776
• @​AliMahmoudDev made their first contribution in #​6770
• @​mertcanaltin made their first contribution in #​6733
• @​Herrtian made their first contribution in #​6741
• @​mixelburg made their first contribution in #​6713
• @​Player1205 made their first contribution in #​6760
• @​Puppo made their first contribution in #​6785
• @​nerkoux made their first contribution in #​6799
• @​rohithvegesna made their first contribution in #​6803
• @​LeSingh1 made their first contribution in #​6753
• @​ritambh888 made their first contribution in #​6452
• @​rrodj made their first contribution in #​6622
• @​harish885 made their first contribution in #​6789

Full Changelog: fastify/fastify@v5.8.5...v5.9.0

---

Configuration

📅 Schedule: (in timezone GMT)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 3, 2026 11:13pm UTC
swingset	Ready	Preview	Oct 3, 2026 11:13pm UTC

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

.../electron-passkeys/npm/darwin-arm64   |  WARN  Unsupported platform: wanted: {"cpu":["arm64"],"os":["darwin"],"libc":["any"]} (current: {"os":"linux","cpu":"x64","libc":"glibc"})
.../electron-passkeys/npm/darwin-x64     |  WARN  Unsupported platform: wanted: {"cpu":["x64"],"os":["darwin"],"libc":["any"]} (current: {"os":"linux","cpu":"x64","libc":"glibc"})
.../npm/win32-arm64-msvc                 |  WARN  Unsupported platform: wanted: {"cpu":["arm64"],"os":["win32"],"libc":["any"]} (current: {"os":"linux","cpu":"x64","libc":"glibc"})
.../electron-passkeys/npm/win32-x64-msvc |  WARN  Unsupported platform: wanted: {"cpu":["x64"],"os":["win32"],"libc":["any"]} (current: {"os":"linux","cpu":"x64","libc":"glibc"})
Scope: all 33 workspace projects
Progress: resolved 1, reused 0, downloaded 0, added 0
packages/clerk-js                        |  WARN  deprecated crypto-js@4.2.0
packages/eslint-plugin                   |  WARN  deprecated eslint@9.31.0
packages/express                         |  WARN  deprecated supertest@6.3.4
Progress: resolved 81, reused 0, downloaded 0, added 0
Progress: resolved 190, reused 0, downloaded 0, added 0
Progress: resolved 303, reused 0, downloaded 0, added 0
Progress: resolved 477, reused 0, downloaded 0, added 0
Progress: resolved 660, reused 0, downloaded 0, added 0
Progress: resolved 1104, reused 0, downloaded 0, added 0
Progress: resolved 1366, reused 0, downloaded 0, added 0
Progress: resolved 1592, reused 0, downloaded 0, added 0
Progress: resolved 1912, reused 0, downloaded 0, added 0
Progress: resolved 2270, reused 0, downloaded 0, added 0
Progress: resolved 2440, reused 0, downloaded 0, added 0
Progress: resolved 2661, reused 0, downloaded 0, added 0
Progress: resolved 2942, reused 0, downloaded 0, added 0
Progress: resolved 2957, reused 0, downloaded 0, added 0
Progress: resolved 2997, reused 0, downloaded 0, added 0
Progress: resolved 3091, reused 0, downloaded 0, added 0
/tmp/renovate/repos/github/clerk/javascript/packages/expo:
 ERR_PNPM_TRUST_DOWNGRADE  High-risk trust downgrade for "fast-xml-parser@4.5.7" (possible package takeover)

This error happened while installing the dependencies of @react-native-community/cli@12.3.7
 at @react-native-community/cli-doctor@12.3.7
 at @react-native-community/cli-platform-ios@12.3.7

Trust checks are based solely on publish date, not semver. A package cannot be installed if any earlier-published version had stronger trust evidence. Earlier versions had trusted publisher, but this version has no trust evidence. A trust downgrade may indicate a supply chain incident.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5a29bb3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 16c7fdbd-828d-4043-9c69-f3e201bc91a7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10058

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10058

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10058

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10058

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10058

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10058

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10058

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10058

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10058

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10058

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10058

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10058

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10058

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10058

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10058

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10058

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10058

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10058

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10058

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10058

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10058

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10058

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10058

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10058

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10058

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10058

commit: 5a29bb3