# What changed in @fastify/static

> 17 changes in @fastify/static 8 to 10 from its official release notes, upgrade guides and advisories: 2 breaking, 4 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-22. HTML: https://unstale.sh/npm/@fastify/static/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @fastify/static 10

### Breaking changes

- setHeaders now receives FastifyReply instead of Response; use reply helpers such as reply.header to set headers. (10.0.0) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v10.0.0)

### Security

- Fixes the security issue tracked in advisory GHSA-8pvw-jcv7-9cmj; the notes do not describe its specific impact. (10.1.2) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v10.1.2), [security advisory](https://github.com/advisories/GHSA-8PVW-JCV7-9CMJ)
- Fixes the security issue tracked by the linked advisory; the notes do not describe its impact or affected behavior. (10.1.1) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v10.1.1), [security advisory](https://github.com/advisories/GHSA-83W8-P2F5-377R)

### New APIs and options

- Adds the suppressWarning option. (10.1.0) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v10.1.0)

### Fixes and other changes

- Files with # or ? in their names can now be served and listed. (10.1.7) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v10.1.7)
- Relative downloads now use the registered root. (10.1.5) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v10.1.5)
- Fixes a route guard and allowedPath bypass on case-insensitive filesystems. (10.1.4) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v10.1.4)
- Responses using preCompressed now set Vary: Accept-Encoding. (10.1.0) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v10.1.0)
- Unsupported deflate is now ignored for precompressed assets. (10.0.0) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v10.0.0)
- setHeaders can now override headers set during sending. (10.0.0) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v10.0.0)

## @fastify/static 9

### Security

- Fixes this security vulnerability. (9.1.1) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v9.1.1), [security advisory](https://github.com/advisories/GHSA-PR96-94W5-MX2H)
- Fixes this security vulnerability. (9.1.1) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v9.1.1), [security advisory](https://github.com/advisories/GHSA-X428-GHPX-8J92)

### Fixes and other changes

- Propagates the return value from fastify.errorHandler. (9.2.0) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v9.2.0)
- Wildcard prefixes now work with route params. (9.1.3) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v9.1.3)
- Wildcard paths are resolved in encapsulated contexts. (9.1.2) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v9.1.2)
- Fixed cases where sendFile ignored option overrides. (9.1.0) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v9.1.0)

## @fastify/static 8

### Breaking changes

- When serve is false and root is not defined, only files with absolute paths can be sent. (8.3.0) — [release notes](https://github.com/fastify/fastify-static/releases/tag/v8.3.0)