2.0.1 (2026-11-06)
- strip unknown query parameters instead of rejecting them (b522589)
2.0.0 (2026-11-06)
- feat!: ship as ESM only (4beafda)
- fix!: log through Fastify's logger and drop colons from operationIds (2ec0afe)
- fix!: safer defaults for authentication and rate limiting (3cb83ff)
- fix!: use Fastify's validated request in handlers and unify validation errors (4727d7b)
- feat!: drop dotenv and require Node.js 24 (c3a5850)
- deps: update runtime dependencies to latest (68893e8)
- defining a
bodyschema on a GET endpoint now throws. - fastify-metrics now uses @prometheus-io/client instead of prom-client. Custom metrics registered on prom-client's global registry no longer appear at /metrics; use
server.instance.metrics.clientinstead. - generated operationIds for routes with path parameters have changed, which renames methods in generated API clients.
- in production,
authenticated: trueendpoints throw unless apiToken or API_TOKEN is set, and the development token is rejected. - Node.js 24 or later is now required.
- request validation errors are now
{ statusCode, error, message: 'Validation failed', details: [{ field, message }] }instead of Fastify's{ code: 'FST_ERR_VALIDATION', message: 'body/a ...' }. - requests from 127.0.0.1 are now rate limited; add it to
rateLimitAllowto restore the old behaviour. - start() no longer prints a banner to stdout; the details are logged at info level instead.
- the
loadEnvoption has been removed and.envfiles are no longer loaded automatically. - the package is ESM-only and has an
exportsmap, so deep imports such as@bitfocusas/api/dist/...no longer resolve. CommonJS consumers can stillrequire('@bitfocusas/api')on Node 24.
1.2.2 (2025-12-17)
- Add support for optional Fastify instance - you can now bring your own Fastify instance and attach the API server to it, or continue using the default behavior where the library creates its own instance
1.1.3 (2025-10-17)
1.1.2 (2025-10-09)
1.1.1 (2025-10-09)
1.1.0 (2025-10-09)
- add endpoint-level authentication support (6f9507c)