@fastify/multipart is a Fastify plugin that parses multipart content types, exposing uploaded files and form fields via async handlers and iterators. It supports streaming or disk modes, optional in-memory accumulation, and configuration for upload limits, making it useful for implementing file upload endpoints in Fastify applications.
Project status
- Actively maintained, with very recent GitHub activity (last upstream push on 2026-09-22) and multiple tagged updates in 2026.
- Update cadence appears steady but not daily, with releases around every 1 to 3 months (v10.1.2 on 2026-09-22, v10.1.1 on 2026-08-14, v10.1.0 on 2026-07-08, and v10.0.0 on 2026-04-07).
AI summary generated
Recent updates
v10.1.2
This release (v10.1.2) adds and improves regression coverage around multipart limit handling, specifically around how busboy errors surface when the request body is fully buffered. It also clarifies in documentation that Fastify's bodyLimit is not enforced as an aggregate limit by the multipart parser, and updates README/type comments about the fileSize default behavior.
v10.1.1
v10.1.1 is presented as a security release with two GHSA advisories addressed. The documented changes also include CI workflow pinning and some maintenance dependency bumps. However, the code diff shows substantive behavior changes in the temp upload saving flow (error handling and cleanup), which are not described in the release notes.
Securityv10.1.0
v10.1.0 includes a fix for multipart iteration where req.parts() could stop early while busboy still had buffered parts. The change also refines error handling around truncated multipart bodies and premature request closure, introducing a new PrematureCloseError for the latter. Alongside runtime changes, the release updates development tooling and some dependencies.
Featuresv10.0.0
v10.0.0 introduces a change to `saveRequestFiles` so callers can receive both the saved file descriptors and the parsed non-file form field values. The release notes also include dependency and CI chore updates, plus minor README and type definition adjustments to match the new return shape.
BreakingFeaturesv9.4.0
v9.4.0 adds support for per-route Busboy configuration via `config.multipartOptions`, allowing route-level limits and other Busboy settings to affect parsing. The release also updates TypeScript typings and documentation, removes a stray console.log from a test, and bumps the development dependency `@types/node` to 25.0.3.
Featuresv9.3.0
v9.3.0 primarily addresses stability for malformed multipart requests by preventing uncaught exceptions. The release also includes CI and project hygiene changes (npmrc script ignoring, dependency pre-commit cleanup, concurrency config) plus README Node.js reference updates.
v9.2.1
v9.2.1 is a small release that updates the package manifest only. The change is centered on dependency classification for `c8`, moving it from runtime dependencies to development dependencies.
v9.2.0
v9.2.0 migrates the project test suite from the tap runner to Node's built-in node:test runner. The diff shows widespread updates across test files to replace tap APIs with node:test equivalents and assertions.
v9.1.0
v9.1.0 is a maintenance release that updates CI configuration (renaming master to main and tightening workflow/job permissions), refreshes license/README metadata, and adds Zod validation documentation via a new example. It also bumps several dependencies, notably fastify-multipart utilities (deepmerge to 3.0.0, secure-json-parse to 4.0.0) and developer tooling types (tsd, @types/node).
BreakingFeaturesv8.3.1
Release v8.3.1 primarily contains dependency bumps (swagger-ui, deepmerge, error, busboy) and a generic fix referenced as PR #567. The provided code diff also shows behavioral changes in multipart file handling and how temporary upload paths are tracked during upload processing.
v9.0.3
v9.0.3 release notes document two changes: switching Dependabot npm updates from weekly to monthly, and fixing a case where temporary files are deleted when a client cancels a multipart upload request. The provided code diff shows additional, substantial implementation and dependency changes that are not mentioned in the release notes, including stream consumption behavior changes and major runtime dependency upgrades.
v9.0.2
v9.0.2 is a maintenance release focused on dependency bumps, style/lint cleanups, and small internal refactors. The only runtime code changes shown are parameter signature simplifications (unused params renamed/removed) and a small optional-chaining tweak for tmpdir selection, with corresponding test updates.