What's Changed

• docs: fix broken links by @Fdawgs in #198
• ci: pin actions to commit-hash by @Fdawgs in #199
• chore: bump c8 from 11.0.0 to 12.0.0 by @dependabot[bot] in #200
• chore(.npmrc): add min-release-age by @Fdawgs in #201
• chore: bump fastify/workflows/.github/workflows/plugins-ci.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in #202
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in #203
• chore: bump @fastify/formbody from 8.0.2 to 9.0.0 by @dependabot[bot] in #204
• test: cover cookie parser compatibility by @vansh-nagar in #205
• ci: enable trusted publishing releases by @Puppo in #207

New Contributors

• @vansh-nagar made their first contribution in #205
• @Puppo made their first contribution in #207

Full Changelog: v4.0.7...v4.0.8

⚠️ Security Release

• Fix for GHSA-3wf5-7852-vcfq

What's Changed

• chore: update depedabot setting by @climba03003 in #193
• chore: bump fastify-plugin from 5.1.0 to 6.0.0 in the dependencies group by @dependabot[bot] in #194
• chore(package.json): fix delvedor's personal url by @Fdawgs in #195
• chore: replace http with https in urls by @Fdawgs in #196

New Contributors

• @climba03003 made their first contribution in #193

Full Changelog: v4.0.6...v4.0.7

What's Changed

• refactor(types): migrate from tsd to tstyche by @Tony133 in #190
• fix: set headerSent flag by @Eomm in #191

Full Changelog: v4.0.5...v4.0.6

⚠️ Security Release

This fixes CVE CVE-2026-33807 GHSA-hrwm-hgmj-7p9c.
This fixes CVE CVE-2026-33808 GHSA-6hw5-45gm-fj88.

What's Changed

• build(deps): bump express from 4.22.1 to 5.2.1 by @dependabot[bot] in #179
• ci: remove stale.yml by @Tony133 in #181
• build(deps-dev): bump c8 from 10.1.3 to 11.0.0 by @dependabot[bot] in #183
• chore(license): standardise license notice by @Fdawgs in #182
• build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @dependabot[bot] in #185
• build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @dependabot[bot] in #187
• ci: add lock-threads workflow by @Fdawgs in #188

New Contributors

• @Tony133 made their first contribution in #181

Full Changelog: v4.0.4...v4.0.5

What's Changed

• fix: decode url with query params by @nolway in #178

New Contributors

• @nolway made their first contribution in #178

Full Changelog: v4.0.3...v4.0.4

What's Changed

• build(dependabot): reduce npm updates to monthly by @Fdawgs in #157
• chore: rename master to main by @Fdawgs in #158
• test: migrate to node test runner by @ilteoood in #159
• ci(ci): set job permissions by @Fdawgs in #161
• docs(readme): update plugin version syntax by @Fdawgs in #162
• ci: set permissions at workflow level by @Fdawgs in #163
• ci: restore job level permissions by @Fdawgs in #164
• build(deps): bump express from 4.21.2 to 5.1.0 by @dependabot[bot] in #166
• build(deps-dev): bump serve-static from 1.16.2 to 2.2.0 by @dependabot[bot] in #165
• build(deps-dev): bump tsd from 0.31.2 to 0.32.0 by @dependabot[bot] in #168
• chore(license): update date ranges; standardise style by @Fdawgs in #169
• chore(.npmrc): ignore scripts by @Fdawgs in #171
• ci(ci): add concurrency config by @Fdawgs in #172
• build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in #170
• fix: decode paths before matching by @mcollina in #174
• fix: restore express4 by @Eomm in #176

New Contributors

• @ilteoood made their first contribution in #159

Full Changelog: v4.0.2...v4.0.3

What's Changed

• build(deps-dev): bump helmet from 7.2.0 to 8.0.0 by @dependabot in #144
• build(deps-dev): bump @types/express from 4.17.21 to 5.0.0 by @dependabot in #145
• build(deps): bump fastify/workflows from 5.0.0 to 5.0.1 by @dependabot in #146
• style: remove trailing whitespace by @Fdawgs in #147
• docs(readme): update ci badge syntax by @Fdawgs in #149
• build(deps-dev): replace standard with neostandard by @Fdawgs in #150
• build(deps-dev): bump neostandard from 0.11.9 to 0.12.0 by @dependabot in #151
• build(deps-dev): add eslint, peer dep of neostandard by @Fdawgs in #152
• chore(package): add funding and contribs by @Fdawgs in #153
• test: prefix unused params with underscores by @Fdawgs in #154
• docs(readme): spelling and grammar fixes by @Fdawgs in #155
• docs(readme): add compatibility table by @Fdawgs in #156

Full Changelog: v4.0.1...v4.0.2

What's Changed

• chore: update fastify to ^5.0.0 by @Fdawgs in #143

Full Changelog: v4.0.0...v4.0.1

What's Changed

• Merge next into master by @jsumners in #138
• build(deps-dev): bump tap from 16.3.10 to 21.0.0 by @dependabot in #137
• build(deps): bump fastify/workflows from 4.1.0 to 5.0.0 by @dependabot in #140
• chore: update min fastify version by @Fdawgs in #139

Full Changelog: v3.0.0...v4.0.0

What's Changed

• chore(.gitignore): add clinic by @Fdawgs in #107
• chore(.gitignore): add bun lockfile by @Fdawgs in #108
• build(deps-dev): bump tsd from 0.25.0 to 0.27.0 by @dependabot in #109
• build(deps-dev): bump tsd from 0.27.0 to 0.28.0 by @dependabot in #110
• ci: only trigger on pushes to main branches by @Fdawgs in #111
• build(deps-dev): bump helmet from 6.2.0 to 7.0.0 by @dependabot in #112
• build(deps-dev): bump tsd from 0.28.1 to 0.29.0 by @dependabot in #114
• docs: use node: prefix to bypass require.cache call for builtins by @Fdawgs in #115
• chore: add .gitattributes file by @Fdawgs in #119
• chore(package): explicitly declare js module type by @Fdawgs in #120
• build(deps-dev): bump passport from 0.6.0 to 0.7.0 by @dependabot in #121
• build(deps-dev): bump tsd from 0.29.0 to 0.30.0 by @dependabot in #122
• docs(readme): replace fastify.io links with fastify.dev by @Fdawgs in #124
• docs(readme): fix broken link by @Fdawgs in #125
• chore(.gitignore): add .tap/ dir by @Fdawgs in #126
• build(deps-dev): bump tsd from 0.30.7 to 0.31.0 by @dependabot in #131
• fix: express mutated request.url by @10xLaCroixDrinker in #132

New Contributors

• @10xLaCroixDrinker made their first contribution in #132

Full Changelog: v2.3.0...v3.0.0