feat: upgrade fastify to v5

[ferhatelmas]

What kind of change does this PR introduce?

feature

What is the current behavior?

Using fastify v4.

What is the new behavior?

Using fastify v5 and addressing various security fixes.

Additional context

• upgrade pino to match fastify internal version
• drop fastify-xml-body-parser dependency for fastify native body parser
• supersedes feat: upgrade to fastify 5 #792

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: b016a8e2-4fb6-4ce0-bb36-20acd9150672

📥 Commits

Reviewing files that changed from the base of the PR and between 64dbec5 and e877f9a.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• package.json
• src/http/plugins/xml.ts
• src/http/routes/object/getObject.ts
• src/http/routes/object/getObjectInfo.ts
• src/test/xml-parser-plugin.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/http/routes/object/getObjectInfo.ts

---

📝 Walkthrough

Summary by CodeRabbit

Release Notes

• Chores

  • Updated core runtime and framework dependencies, including major version upgrades to fastify and logging libraries.

• New Features

  • Enhanced XML payload parsing with improved error handling and validation.

• Improvements

  • Added proper error responses for invalid media types.
  • Refined structured logging across the application.

Walkthrough

This PR upgrades Fastify and related ecosystem packages (Fastify 4→5, multiple @fastify/* bumps, pino 9→10, etc.), replaces the previous XML body parser with a custom xml2js-based xmlParser plugin (with typed options and array-forcing), adds tests for the new XML plugin, and extends Fastify error handling to handle FST_ERR_CTP_INVALID_MEDIA_TYPE producing an InvalidMimeType error. Other changes: request decorators remove explicit null defaults, logger argument ordering and types adjusted (metadata-first), builder options renamed from logger to loggerInstance, and router maxParamLength moved under routerOptions.

Sequence Diagram(s)

sequenceDiagram
participant Client
participant Fastify
participant xmlParser as "xml2js parser"
participant Route as "Route Handler"
Client->>Fastify: POST /xml (Content-Type: application/xml, body)
Fastify->>xmlParser: parse XML body
xmlParser-->>Fastify: parsed JSON or parse error
alt parsed successfully
    Fastify->>Route: deliver request with parsed body
    Route-->>Fastify: response payload (JSON or XML)
    Fastify-->>Client: 200 OK with payload
else parse error
    Fastify->>Fastify: create standardized error (status 400)
    Fastify-->>Client: 400 "Invalid XML payload" response
end

Loading

sequenceDiagram
participant Client
participant Fastify
participant ErrorHandler
participant ERRORS as "ERRORS.InvalidMimeType"
Client->>Fastify: Request with invalid Content-Type
Fastify->>ErrorHandler: emits FST_ERR_CTP_INVALID_MEDIA_TYPE
ErrorHandler->>ERRORS: construct InvalidMimeType (uses Content-Type/mime)
ERRORS-->>ErrorHandler: rendered error payload + status
ErrorHandler-->>Client: response with InvalidMimeType userStatusCode and payload

Loading

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 72: Remove the incompatible dependency "fastify-xml-body-parser" from
package.json and implement XML parsing using Fastify v5's addContentTypeParser
on the Fastify instance (e.g., in the server bootstrap or function that creates
the Fastify instance such as createServer/buildFastify/bootFastify).
Specifically, delete the package entry, then add a content type parser for
"application/xml" and "text/xml" using fastify.addContentTypeParser(...) and
wire it into the request lifecycle where the existing plugin was relied upon
(ensure the parser returns parsed XML or sets request.body accordingly and
handles errors). If you prefer a plugin, fork/update the plugin to depend on
fastify-plugin@^5.0.0 and make it register using addContentTypeParser for
Fastify v5 compatibility.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 753fed94-f2ce-4075-a3f0-4d7a60b78803

📥 Commits

Reviewing files that changed from the base of the PR and between 41e7eb2 and 64dbec5.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (14)

• package.json
• src/http/error-handler.ts
• src/http/plugins/db.ts
• src/http/plugins/storage.ts
• src/http/routes/iceberg/bucket.ts
• src/http/routes/object/getObject.ts
• src/http/routes/object/getObjectInfo.ts
• src/internal/cluster/cluster.ts
• src/internal/database/pubsub.ts
• src/internal/monitoring/logger.ts
• src/internal/queue/event.ts
• src/start/server.ts
• src/start/worker.ts
• src/test/tus.test.ts

🚧 Files skipped from review as they are similar to previous changes (8)

• src/internal/database/pubsub.ts
• src/http/plugins/storage.ts
• src/internal/cluster/cluster.ts
• src/internal/monitoring/logger.ts
• src/test/tus.test.ts
• src/http/plugins/db.ts
• src/http/routes/object/getObject.ts
• src/http/error-handler.ts