[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@fastify/static	^8.2.0 → ^10.0.0

---

Release Notes

fastify/fastify-static (@​fastify/static)

v10.1.10

Compare Source

What's Changed

• fix: use @​fastify/error for forbidden path errors by @​SkySails in #​624
  The 403 response for forbidden paths now includes code: "FST_STATIC_FORBIDDEN_PATH"; the error no longer has a status property, use statusCode.

New Contributors

• @​SkySails made their first contribution in #​624

Full Changelog: fastify/fastify-static@v10.1.9...v10.1.10

v10.1.9

Compare Source

What's Changed

• chore: bump fastify/workflows/.github/workflows/reusable-release.yml from b1a11bc to 731d0cc by @​dependabot[bot] in #​621
• build(deps): bump glob from ^13.0.0 to ^14.0.0 by @​mcollina in #​627
• fix: return callNotFound for directories without index file by @​mcollina in #​626
• fix: try every encoding in a root before falling back to the next root by @​RaphaelFakhri in #​629

New Contributors

• @​RaphaelFakhri made their first contribution in #​629

Full Changelog: fastify/fastify-static@v10.1.8...v10.1.9

v10.1.8

Compare Source

What's Changed

• docs: document the dotfiles option and its default by @​mcollina in #​619

Full Changelog: fastify/fastify-static@v10.1.7...v10.1.8

v10.1.7

Compare Source

What's Changed

• fix: serve and list files with # or ? in their names by @​lprnmns in #​616

Full Changelog: fastify/fastify-static@v10.1.6...v10.1.7

v10.1.6

Compare Source

What's Changed

• ci: enable trusted publishing releases by @​Puppo in #​615

Full Changelog: fastify/fastify-static@v10.1.5...v10.1.6

v10.1.5

Compare Source

What's Changed

• fix: use registered root for relative downloads by @​lprnmns in #​610

New Contributors

• @​lprnmns made their first contribution in #​610

Full Changelog: fastify/fastify-static@v10.1.4...v10.1.5

v10.1.4

Compare Source

This is a security release for GHSA-r799-r9gc-m956 (CVE-2026-90982).

It fixes a route guard and allowedPath bypass on case-insensitive filesystems. Users should upgrade to @fastify/static 10.1.4.

Full Changelog: fastify/fastify-static@v10.1.3...v10.1.4

v10.1.3

Compare Source

What's Changed

• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in #​602
• chore(.npmrc): add min-release-age by @​Fdawgs in #​603
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​605

Full Changelog: fastify/fastify-static@v10.1.2...v10.1.3

v10.1.2

Compare Source

⚠️ Security Release

• Fix for GHSA-8pvw-jcv7-9cmj

What's Changed

• ci: pin actions to commit-hash by @​Fdawgs in #​601

Full Changelog: fastify/fastify-static@v10.1.1...v10.1.2

v10.1.1

Compare Source

⚠️ Security Release

• Fix for GHSA-83w8-p2f5-377r

What's Changed

• docs(readme): fix typos by @​Fdawgs in #​600

Full Changelog: fastify/fastify-static@v10.1.0...v10.1.1

v10.1.0

Compare Source

What's Changed

• fix: set Vary: Accept-Encoding for preCompressed responses by @​LeSingh1 in #​586
• feat: use @fastify/error for errors and add option suppressWarning by @​climba03003 in #​599

New Contributors

• @​LeSingh1 made their first contribution in #​586

Full Changelog: fastify/fastify-static@v10.0.0...v10.1.0

v10.0.0

Compare Source

Breaking Changes

• setHeaders now using FastifyReply instead of Response.

You should refactor your code to use the reply helpers.
For example,

// Before
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(res) {
    res.setHeader('X-Test', 'Foo')
  }
})
// After
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(reply) {
    reply.header('X-Test', 'Foo')
  }
})

What's Changed

• chore!: bump content-disposition fom 1.0.1 to 2.0.1 by @​climba03003 in #​597
• fix: ignore unsupported deflate for precompressed assets by @​jibin7jose in #​596
• fix!: allow setHeaders to override send headers by @​climba03003 in #​598

New Contributors

• @​jibin7jose made their first contribution in #​596

Full Changelog: fastify/fastify-static@v9.3.0...v10.0.0

v9.3.0

Compare Source

What's Changed

• chore: update fastify-plugin dependency to version 6.0.0 by @​Puppo in #​594

New Contributors

• @​Puppo made their first contribution in #​594

Full Changelog: fastify/fastify-static@v9.2.0...v9.3.0

v9.2.0

Compare Source

What's Changed

• chore(.gitattributes): retain binary file eol style by @​Fdawgs in #​577
• refactor(types): migrate from tsd to tstyche by @​Tony133 in #​579
• fix: propagate return value from fastify.errorHandler by @​abdulmunimjemal in #​582
• chore: update depedabot setting by @​climba03003 in #​583
• chore: bump @​fastify/compress from 8.3.1 to 9.0.0 by @​dependabot[bot] in #​590
• chore: bump @​types/node from 25.9.4 to 26.0.0 in the dev-dependencies-typescript group by @​dependabot[bot] in #​592
• docs: fix broken links by @​Fdawgs in #​591
• docs: clarify precompressed allowedPath behavior by @​mcollina in #​593

New Contributors

• @​abdulmunimjemal made their first contribution in #​582

Full Changelog: fastify/fastify-static@v9.1.3...v9.2.0

v9.1.3

Compare Source

What's Changed

• fix: support wildcard prefixes with route params by @​mcollina in #​576

Full Changelog: fastify/fastify-static@v9.1.2...v9.1.3

v9.1.2

Compare Source

What's Changed

• fix: resolve wildcard paths in encapsulated contexts by @​mcollina in #​574

Full Changelog: fastify/fastify-static@v9.1.1...v9.1.2

v9.1.1

Compare Source

⚠️ Security Release

This fixes CVE CVE-2026-6410 GHSA-pr96-94w5-mx2h.
This fixes CVE CVE-2026-6414 GHSA-x428-ghpx-8j92.

What's Changed

• ci: add lock-threads workflow by @​Fdawgs in #​570

Full Changelog: fastify/fastify-static@v9.1.0...v9.1.1

v9.1.0

Compare Source

What's Changed

• build(deps-dev): bump @​types/node from 24.10.4 to 25.0.3 by @​dependabot[bot] in #​552
• test: move ignoreTrailingSlash under routerOptions by @​lraveri in #​553
• build(deps-dev): bump borp from 0.20.2 to 0.21.0 by @​dependabot[bot] in #​543
• chore: bump pino and borp dependencies, delete stale.yml by @​Tony133 in #​557
• chore: update syntax typescript by @​Tony133 in #​558
• chore(license): standardise license notice by @​Fdawgs in #​560
• fix: sendFile ignoring option overrides in some cases by @​bakugo in #​559
• chore: upgrade c8 to v11.0.0 and improvements test by @​Tony133 in #​564
• build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @​dependabot[bot] in #​566

New Contributors

• @​lraveri made their first contribution in #​553
• @​Tony133 made their first contribution in #​557
• @​bakugo made their first contribution in #​559

Full Changelog: fastify/fastify-static@v9.0.0...v9.1.0

v9.0.0

Compare Source

What's Changed

• build(deps): bump content-disposition from 0.5.4 to 1.0.1 by @​dependabot[bot] in #​547
• Update glob@​13 by @​mcollina in #​550

Full Changelog: fastify/fastify-static@v8.3.0...v9.0.0

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Sunday and Saturday (* 0-6 * * 6,0)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.