As mentioned on docs :

Fastify uses a schema-based approach, and even if it is not mandatory we recommend using JSON Schema to validate your routes and serialize your outputs. Internally, Fastify compiles the schema into a highly performant function.

As both validation and serialization features dynamically evaluate code with new Function(), it is not safe to use them with user-provided data. See Ajv and fast-json-stringify for more details.

Question :

1. So fastify team recomended using .json file to validate and serialize outputs since it uses ajv? or doing it like all the code example on docs?

2. What does 'user-provided data' in security notices mean?

Thanks, 😄