@fastify/send is a Node.js library for streaming files from the file system as HTTP responses. It supports range requests (partial responses), conditional GET negotiation, and configurable response headers such as Content-Type, Last-Modified, ETag, and Cache-Control. This fastify-specific fork is provided via npm under @fastify/send and was created to address CVE-2017-20165.
Project status
- Actively maintained: The repo shows an upstream push on 2026-08-08, and the latest recorded update (v4.1.1 on 2026-08-08) is very recent relative to today (2026-08-13), suggesting ongoing maintenance.
- Update cadence: Updates appear irregular. Recent cadence is tight (v4.1.1 on 2026-08-08), but the prior code update (v4.1.0 on 2025-06-05) is about 14 months earlier, with earlier changes clustering in 2024 to mid-2025.
AI summary generated
Recent updates
v4.1.1
Release v4.1.1 is primarily a tooling and CI update, with development dependency bumps and a migration of TypeScript type tests from tsd to tstyche. It also updates GitHub workflows (including concurrency and a new lock-threads scheduled workflow) and refreshes repository configuration files (.npmrc, dependabot).
v4.1.0
v4.1.0 adds a new streaming option, highWaterMark, and documents it in the public API. It also includes CI workflow permission adjustments and a dev dependency bump (tsd). Code changes show highWaterMark is wired into the underlying fs.createReadStream configuration and covered by new tests.
Featuresv4.0.0
v4.0.0 drops Node 18 support and updates the repository to modern tooling, including switching tests to Node's built-in test runner and renaming CI/fixtures related to branch and scanner behavior. The release notes mostly describe these operational changes, with no runtime/library code diff shown in the provided changes.
Breakingv3.3.1
v3.3.1 is a small release focused on developer tooling and type-definition hygiene. It updates the TypeScript declarations to use the `node:` prefix for built-in modules and refreshes linting configuration, along with minor README and test changes.
v3.3.0
v3.3.0 introduces a new send option, `maxContentRangeChunkSize`, intended to cap how much content is returned for HTTP range requests when range support is enabled. The implementation updates TypeScript types and docs, and adds tests covering several capped-range scenarios.
Featuresv3.2.0
v3.2.0 introduces a new `contentType` option to control whether `Content-Type` is set for served static files. It also changes the charset casing in generated `Content-Type` headers from `UTF-8` to `utf-8` and updates some package metadata and CI workflow references.
BreakingFeaturesv2.1.1
Release v2.1.1 primarily documents CI adjustments, several dev dependency bumps, a small performance tweak for builtin imports, and an XSS security fix related to template injection in the v2.x line. The provided code diff, however, shows only a change to the redirect HTML content in SendStream and the corresponding test expectations.
Securityv3.1.1
v3.1.1 includes a dependency maintenance bump (tap, @types/node, and the fastify/workflows CI plugin) plus a security fix for XSS via template injection. However, the actual code changes between the previous version and v3.1.1 show a much larger API rewrite than what the release notes describe.
Securityv3.1.0
v3.1.0 enhances @fastify/send to return a richer result object so callers can implement custom handling for returned outcomes (file, directory, and error). The TypeScript types and runtime behavior were updated to include a discriminant `type` plus a `metadata` object, enabling custom logic like directory listing and custom error responses.
Featuresv3.0.0
v3.0.0 includes several CI and development dependency bumps, plus a “new implementation” refactor. However, the code diff shows a major public API change: the previous `SendStream` class based API is removed and `send()` now returns a Promise with `{ statusCode, headers, stream }` instead of an event emitter stream that supports `.pipe(res)` directly.
BreakingFeatures