SNYK: Upgrade ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine from 7.4.0 to 7.6.1 - #1342
Conversation
…o 7.6.1 Snyk has created this PR to upgrade ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine from 7.4.0 to 7.6.1. See this package in maven: ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine See this project in Snyk: https://app.snyk.io/org/kissalk/project/c2b0e7db-dcef-4bb4-8cee-4296fed9fe1d?utm_source=github&utm_medium=referral&page=upgrade-pr
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the 📝 WalkthroughWalkthroughThe HAPI FHIR dependency version in the Maven configuration was updated from 7.4.0 to 7.6.1. This is a straightforward version bump in the project's property definitions that affects the resolved dependency across the Maven build. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
Pre-merge checks❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (22)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seanmcilvenna
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI Agents
In @Java/pom.xml:
- Line 24: The pom property hapi-fhir.version currently set to 7.6.1 introduces
major breaking changes and technical debt; either update the property to a
supported 8.6.1 (if compatible) or keep 7.6.1 but augment the PR with a
comprehensive testing and migration plan: list integration tests for FHIR PATCH
multi-element behavior, Patient compartment and Group/List authorization
changes, $export and $everything compartment behavior, subscription/
HFJ_RESOURCE_MODIFIED schema migration health checks, and regression tests for
custom FHIRPath operations; explicitly state the chosen path (immediate 8.x
migration vs. 7.6.1 + testing) in the PR description so the upgrade risk is
documented.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
Java/pom.xml
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
**: Pull requests that have "TECH_DEBT" in the title should only contain changes related to typos, unused code, linter/IDE suggestions, swagger specification updates,
and logging improvements. These TECH_DEBT PRs must not affect core functionality. All PRs that are not considered technical debt must include information on what
testing was performed in the description of the PR. If it does not, ask the author to provide details on what testing was performed.
When reviewing code, suggest unit tests using XUnit in the following scenarios:
- If/Else or Switch/Case blocks are introduced or modified — ensure each branch has a corresponding unit test.
- Logic that depends on service or interface configuration — suggest tests to validate different implementations are correctly resolved.
- No network activity (HTTP calls, sockets, etc.) should appear in unit tests. Recommend using mocks (via Moq) for any external communication.
Large unit tests should be avoided; keeping unit tests small and focused on targeted business logic (i.e. string sanitization)
**: Pull requests that have DOCS in the title should only contain changes related to documentation within the /docs folder or in .md files through-out the code-base. The description
of the PR should specify what documentation was updated. Documentation updates should use EventCatalog.dev structure, where service-specific functionality should be described
in the service's index.mdx (i.e. /services/XXX/index.mdx or /domains/XXX/services/YYY/index.mdx). Configurations that are shared by multiple services should be
reflected in the /docs/docs/config files.
Files:
Java/pom.xml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: Smoke Test with Docker Compose
- GitHub Check: Unit Tests for DotNet
- GitHub Check: Integration Tests
- GitHub Check: Build Documentation
- GitHub Check: Analyze (java-kotlin)
- GitHub Check: Analyze (csharp)
| <properties> | ||
| <cqf-fhir.version>3.12.0</cqf-fhir.version> | ||
| <hapi-fhir.version>7.4.0</hapi-fhir.version> | ||
| <hapi-fhir.version>7.6.1</hapi-fhir.version> |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
HAPI FHIR 7.6.1 release notes changelog breaking changes
💡 Result:
HAPI FHIR 7.6.1 (Despina) — release date: 2024-12-18. Breaking changes (summary):
-
Device membership in Patient Compartment: For FHIR < R5, the Device.patient search parameter is now treated as part of the Patient compartment. This affects Patient _revInclude=*, Patient instance/type $everything, automatic search narrowing, and Bulk Export (previous shims removed). [1]
-
FHIRPath PATCH semantics: PATCH operations that match multiple elements will no longer replace multiple values and will throw an exception (now aligned with the spec). [2]
-
Authorization / patient-compartment rules: Auth rules that grant access to resources in the patient compartment will no longer implicitly grant access to Group or List resources in that compartment; additional permissions are required. [2]
-
$export and $everything behavior: $export and $everything on Patient compartment (instance or type) will no longer return List or Group resources regardless of auth rules. [2]
-
Database / subscription-related change: HFJ_RESOURCE_MODIFIED table schema changes (affects zero-downtime upgrades; subscriptions must be healthy to avoid prolonged locks). This is noted as a breaking change. [2]
(References: HAPI FHIR changelog / 7.6.1 release notes.) [1] [2]
Sources:
[1] HAPI FHIR changelog — HAPI FHIR 7.6.1 (Despina) (release info).
[2] HAPI FHIR changelog — Breaking Changes (7.6.1).
🌐 Web query:
HAPI FHIR 7.4.0 to 7.6.1 XXE vulnerability security fix
💡 Result:
Short answer: The XXE issues (multiple advisories/CVEs: e.g. CVE-2024-51132 / CVE-2024-52007 and related XXE reports) were fixed by upgrading the org.hl7.fhir.core / org.hl7.fhir.utilities components to 6.4.0. Any HAPI FHIR build that depends on org.hl7.fhir.core >= 6.4.0 includes that fix; versions that depend on older core artifacts remain vulnerable. (nvd.nist.gov)
What to do:
- If your HAPI FHIR 7.4.0–7.6.1 installation pulls org.hl7.fhir.core (or org.hl7.fhir.utilities) version < 6.4.0, upgrade those artifacts to 6.4.0+ (or upgrade to a HAPI release that bundles core 6.4.0+). (advisories.gitlab.com)
References:
- NVD summary for CVE-2024-52007 (fix in org.hl7.fhir.core 6.4.0). [NVD]. (nvd.nist.gov)
- GitLab / package advisories for CVE-2024-51132 (fixed in 6.4.0). (advisories.gitlab.com)
- HAPI FHIR changelog showing org.hl7.fhir.core bumped to 6.4.0. (hapifhir.io)
If you want, tell me the exact HAPI 7.x artifact(s) (pom or jar) you’re using and I’ll check which org.hl7.fhir.core version they depend on.
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2024-52007?utm_source=openai
- 2: https://advisories.gitlab.com/pkg/maven/ca.uhn.hapi.fhir/org.hl7.fhir.convertors/CVE-2024-51132/?utm_source=openai
- 3: https://nvd.nist.gov/vuln/detail/CVE-2024-52007?utm_source=openai
- 4: https://advisories.gitlab.com/pkg/maven/ca.uhn.hapi.fhir/org.hl7.fhir.convertors/CVE-2024-51132/?utm_source=openai
- 5: https://hapifhir.io/hapi-fhir/docs/introduction/changelog.html?utm_source=openai
🏁 Script executed:
#!/bin/bash
# Check Maven Central for HAPI FHIR versions
echo "=== Latest HAPI FHIR BOM versions from Maven Central ==="
curl -s https://repo1.maven.org/maven2/ca/uhn/hapi/fhir/hapi-fhir-bom/maven-metadata.xml 2>/dev/null | grep -oP '(?<=<version>)[^<]+' | tail -10Repository: lantanagroup/link-cloud
Length of output: 183
🌐 Web query:
HAPI FHIR latest version January 2026
💡 Result:
The latest stable HAPI FHIR release as of January 6, 2026 is HAPI FHIR 8.6.0 (released November 20, 2025). [1]
The HAPI FHIR docs site is currently showing documentation for 8.8.0 (and changelog entries for 8.8.0 exist), which appears to be a newer/TBD release on the docs site. [2]
Sources:
- HAPI FHIR changelog / 8.6.0 release notes (released Nov 20, 2025). [1]
- HAPI FHIR documentation showing 8.8.0 (TBD/release entry). [2]
Version upgrade is outdated; address major breaking changes and provide required testing details.
The upgrade to 7.6.1 addresses XXE vulnerabilities (CVE-2024-51132, CVE-2024-52007) fixed in org.hl7.fhir.core 6.4.0+, but version 7.6.1 (released Dec 2024) is significantly outdated—HAPI FHIR 8.6.1 is currently available. Proceeding with 7.6.1 creates immediate technical debt requiring another major upgrade soon.
Critical breaking changes in 7.6.1 require comprehensive testing:
- Device/Patient compartment membership rules changed
- FHIRPath PATCH now throws exceptions on multi-element matches (breaking change)
- Authorization rules no longer implicitly grant Group/List access in patient compartment
- $export and $everything behavior altered for compartment queries
- HFJ_RESOURCE_MODIFIED table schema changes (affects zero-downtime upgrades and subscription health)
Per coding guidelines, all non-TECH_DEBT PRs must include testing information. Add to PR description:
- Integration tests validating FHIR PATCH operations (especially multi-element scenarios)
- Tests confirming Patient compartment and Group/List authorization behavior
- Validation of $export and $everything operations on patient compartments
- Subscription health verification before and after schema migration
- Regression testing for any custom FHIRPath operations
Recommend: Either commit to comprehensive testing for 7.6.1's breaking changes and plan imminent 8.x migration, or evaluate jumping directly to 8.6.1 if major version compatibility allows.
🤖 Prompt for AI Agents
In @Java/pom.xml at line 24, The pom property hapi-fhir.version currently set to
7.6.1 introduces major breaking changes and technical debt; either update the
property to a supported 8.6.1 (if compatible) or keep 7.6.1 but augment the PR
with a comprehensive testing and migration plan: list integration tests for FHIR
PATCH multi-element behavior, Patient compartment and Group/List authorization
changes, $export and $everything compartment behavior, subscription/
HFJ_RESOURCE_MODIFIED schema migration health checks, and regression tests for
custom FHIRPath operations; explicitly state the chosen path (immediate 8.x
migration vs. 7.6.1 + testing) in the PR description so the upgrade risk is
documented.
3 participants
Snyk has created this PR to upgrade ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine from 7.4.0 to 7.6.1.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 6 versions ahead of your current version.
The recommended version was released a year ago.
Issues fixed by the recommended upgrade:
SNYK-JAVA-CAUHNHAPIFHIR-7924769
SNYK-JAVA-CAUHNHAPIFHIR-8344149
SNYK-JAVA-CAUHNHAPIFHIR-8366327
SNYK-JAVA-CAUHNHAPIFHIR-7924770
SNYK-JAVA-CAUHNHAPIFHIR-8344148
SNYK-JAVA-CAUHNHAPIFHIR-8366328
SNYK-JAVA-CAUHNHAPIFHIR-7924771
SNYK-JAVA-CAUHNHAPIFHIR-8344147
SNYK-JAVA-CAUHNHAPIFHIR-8366326
SNYK-JAVA-CAUHNHAPIFHIR-7924772
SNYK-JAVA-CAUHNHAPIFHIR-8344146
SNYK-JAVA-CAUHNHAPIFHIR-8366323
SNYK-JAVA-CAUHNHAPIFHIR-7924773
SNYK-JAVA-CAUHNHAPIFHIR-8344145
SNYK-JAVA-CAUHNHAPIFHIR-8366324
SNYK-JAVA-CAUHNHAPIFHIR-7924774
SNYK-JAVA-CAUHNHAPIFHIR-8344144
SNYK-JAVA-CAUHNHAPIFHIR-8366325
SNYK-JAVA-CAUHNHAPIFHIR-8344142
SNYK-JAVA-CAUHNHAPIFHIR-8344143
SNYK-JAVA-CAUHNHAPIFHIR-8344150
SNYK-JAVA-COMMONSIO-8161190
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.