Skip to content

SNYK: Upgrade ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine from 7.4.0 to 7.6.1 #1342

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seanmcilvenna merged 5 commits into from
Jan 7, 2026
Merged

SNYK: Upgrade ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine from 7.4.0 to 7.6.1 #1342

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
afc05a8
fix: upgrade ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine from 7.4.0 t…
snyk-bot Dec 25, 2025
664b88d
Merge branch 'dev' into snyk-upgrade-7170125e99f3edeec68e2d321843a476
seanmcilvenna Jan 6, 2026
a04f958
Merge branch 'dev' into snyk-upgrade-7170125e99f3edeec68e2d321843a476
seanmcilvenna Jan 6, 2026
45ccb00
Merge branch 'dev' into snyk-upgrade-7170125e99f3edeec68e2d321843a476
seanmcilvenna Jan 7, 2026
2e36448
Merge branch 'dev' into snyk-upgrade-7170125e99f3edeec68e2d321843a476
seanmcilvenna Jan 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Java/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@

<properties>
<cqf-fhir.version>3.12.0</cqf-fhir.version>
<hapi-fhir.version>7.4.0</hapi-fhir.version>
<hapi-fhir.version>7.6.1</hapi-fhir.version>

@coderabbitai coderabbitai Bot Jan 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

HAPI FHIR 7.6.1 release notes changelog breaking changes

💡 Result:

HAPI FHIR 7.6.1 (Despina) — release date: 2024-12-18. Breaking changes (summary):

  • Device membership in Patient Compartment: For FHIR < R5, the Device.patient search parameter is now treated as part of the Patient compartment. This affects Patient _revInclude=*, Patient instance/type $everything, automatic search narrowing, and Bulk Export (previous shims removed). [1]

  • FHIRPath PATCH semantics: PATCH operations that match multiple elements will no longer replace multiple values and will throw an exception (now aligned with the spec). [2]

  • Authorization / patient-compartment rules: Auth rules that grant access to resources in the patient compartment will no longer implicitly grant access to Group or List resources in that compartment; additional permissions are required. [2]

  • $export and $everything behavior: $export and $everything on Patient compartment (instance or type) will no longer return List or Group resources regardless of auth rules. [2]

  • Database / subscription-related change: HFJ_RESOURCE_MODIFIED table schema changes (affects zero-downtime upgrades; subscriptions must be healthy to avoid prolonged locks). This is noted as a breaking change. [2]

(References: HAPI FHIR changelog / 7.6.1 release notes.) [1] [2]

Sources:
[1] HAPI FHIR changelog — HAPI FHIR 7.6.1 (Despina) (release info).
[2] HAPI FHIR changelog — Breaking Changes (7.6.1).

🌐 Web query:

HAPI FHIR 7.4.0 to 7.6.1 XXE vulnerability security fix

💡 Result:

Short answer: The XXE issues (multiple advisories/CVEs: e.g. CVE-2024-51132 / CVE-2024-52007 and related XXE reports) were fixed by upgrading the org.hl7.fhir.core / org.hl7.fhir.utilities components to 6.4.0. Any HAPI FHIR build that depends on org.hl7.fhir.core >= 6.4.0 includes that fix; versions that depend on older core artifacts remain vulnerable. (nvd.nist.gov)

What to do:

  • If your HAPI FHIR 7.4.0–7.6.1 installation pulls org.hl7.fhir.core (or org.hl7.fhir.utilities) version < 6.4.0, upgrade those artifacts to 6.4.0+ (or upgrade to a HAPI release that bundles core 6.4.0+). (advisories.gitlab.com)

References:

If you want, tell me the exact HAPI 7.x artifact(s) (pom or jar) you’re using and I’ll check which org.hl7.fhir.core version they depend on.

Citations:

🏁 Script executed:

#!/bin/bash
# Check Maven Central for HAPI FHIR versions
echo "=== Latest HAPI FHIR BOM versions from Maven Central ==="
curl -s https://repo1.maven.org/maven2/ca/uhn/hapi/fhir/hapi-fhir-bom/maven-metadata.xml 2>/dev/null | grep -oP '(?<=<version>)[^<]+' | tail -10

Repository: lantanagroup/link-cloud

Length of output: 183

🌐 Web query:

HAPI FHIR latest version January 2026

💡 Result:

The latest stable HAPI FHIR release as of January 6, 2026 is HAPI FHIR 8.6.0 (released November 20, 2025). [1]

The HAPI FHIR docs site is currently showing documentation for 8.8.0 (and changelog entries for 8.8.0 exist), which appears to be a newer/TBD release on the docs site. [2]

Sources:

  • HAPI FHIR changelog / 8.6.0 release notes (released Nov 20, 2025). [1]
  • HAPI FHIR documentation showing 8.8.0 (TBD/release entry). [2]

Version upgrade is outdated; address major breaking changes and provide required testing details.

The upgrade to 7.6.1 addresses XXE vulnerabilities (CVE-2024-51132, CVE-2024-52007) fixed in org.hl7.fhir.core 6.4.0+, but version 7.6.1 (released Dec 2024) is significantly outdated—HAPI FHIR 8.6.1 is currently available. Proceeding with 7.6.1 creates immediate technical debt requiring another major upgrade soon.

Critical breaking changes in 7.6.1 require comprehensive testing:

  • Device/Patient compartment membership rules changed
  • FHIRPath PATCH now throws exceptions on multi-element matches (breaking change)
  • Authorization rules no longer implicitly grant Group/List access in patient compartment
  • $export and $everything behavior altered for compartment queries
  • HFJ_RESOURCE_MODIFIED table schema changes (affects zero-downtime upgrades and subscription health)

Per coding guidelines, all non-TECH_DEBT PRs must include testing information. Add to PR description:

  • Integration tests validating FHIR PATCH operations (especially multi-element scenarios)
  • Tests confirming Patient compartment and Group/List authorization behavior
  • Validation of $export and $everything operations on patient compartments
  • Subscription health verification before and after schema migration
  • Regression testing for any custom FHIRPath operations

Recommend: Either commit to comprehensive testing for 7.6.1's breaking changes and plan imminent 8.x migration, or evaluate jumping directly to 8.6.1 if major version compatibility allows.

🤖 Prompt for AI Agents 
In @Java/pom.xml at line 24, The pom property hapi-fhir.version currently set to
7.6.1 introduces major breaking changes and technical debt; either update the
property to a supported 8.6.1 (if compatible) or keep 7.6.1 but augment the PR
with a comprehensive testing and migration plan: list integration tests for FHIR
PATCH multi-element behavior, Patient compartment and Group/List authorization
changes, $export and $everything compartment behavior, subscription/
HFJ_RESOURCE_MODIFIED schema migration health checks, and regression tests for
custom FHIRPath operations; explicitly state the chosen path (immediate 8.x
migration vs. 7.6.1 + testing) in the PR description so the upgrade risk is
documented.

<janino.version>2.6.1</janino.version>
</properties>

Expand Down
Loading