Fastify 5.12

Apply the Node.js 24, TypeScript 7, and JavaScript ES2026 prompts first. These rules cover Fastify 5.12 routing, validation, hooks, plugins, and deployment on Node.js 24 LTS.

Patch and plugin scope

• Run the newest Fastify 5 release and take each one as it ships. Fastify can ship a security fix, even a breaking one, as a new minor rather than a patch, so declare Fastify with a caret range instead of a tilde range and read the release notes for each minor.
• Select plugin releases that are compatible with Fastify 5, and update each @fastify/* plugin on its own: every plugin has its own releases and advisories, so check the resolved plugin versions with npm ls after each Fastify upgrade, and read each plugin repository's security advisories as well as running npm audit; a registry report does not establish that every repository advisory is covered. Declare plugin version requirements and dependencies through fastify-plugin, and fail startup when register() or ready() reports an incompatible or missing dependency.

Request schemas and validation

• Use full JSON Schemas for params, querystring, headers, and body; specify the actual type, required fields, and size/range bounds. Use type: 'object' for object contracts rather than the removed shorthand syntax.
• Require rejection of unknown command fields with additionalProperties: false and ajv.customOptions.removeAdditional: false, or an equivalent per-part validator. Fastify's default removeAdditional: true silently strips those fields instead of rejecting the request.
• Account for default