Till Gerken

Fire Arrow Server 1.14.0 has been released.

• (breaking) The web UI now signs in through a server-side confidential OAuth client; every login profile must be given a client secret and have its identity provider redirect URI updated before upgrading, or the server will not start
• (feature) A new $drop-privilege operation lets a privileged caller mint a short-lived token scoped down to a single identity, never granting more access than the caller already has

Fire Arrow Server 1.14.1 has been released.

• (bugfix) Expired drop-privilege tokens are now cleaned up on schedule instead of failing every run and logging an error hourly
• (maintenance) The Oracle database driver has been removed from the shipped artifact

Fire Arrow Server 1.13.0 has been released.

• (feature) Care plan Tasks automatically move to a terminal status when their validity window expires, so Task?status=ready only returns currently actionable work
• (bugfix) GraphQL search modifiers such as _tag:not now work; previously they returned no results
• (maintenance) Upstream HAPI FHIR JPA starter sync (release 8.10.0-2) and dependency updates

Fire Arrow Server 1.12.2 has been released.

• (bugfix) QuestionnaireResponse/$extract works end-to-end when the client role is allowed to read the questionnaire and structure definitions the response depends on

Fire Arrow Server 1.12.0 has been released.

• (feature) Server warns at startup when authorization rules could allow a role to escalate its own access
• (feature) License details are now visible to administrators in the web UI
• (feature) Due-task transition throughput is configurable; defaults now drain backlogs of up to 5,000 Tasks per run
• (bugfix) QuestionnaireResponse/$extract is now granted by an operation: extract authorization rule as intended
• (maintenance) Dependency updates

Fire Arrow Server 1.11.0 has been released.

• (breaking) Token generation, binary upload, and CarePlan materialize operations no longer return distinct HTTP codes for unknown or deleted resource IDs
• (security) CareTeam-scoped access no longer includes patients outside the practitioner's actual teams
• (feature) New CarePlan $materialize and $dematerialize operations to start and stop task materialization without Subscription write access
• (bugfix) Token generation honors every matching practitioner-role-code rule, not only the first one in configuration
• (maintenance) HAPI FHIR 8.10.0 platform upgrade (HAPI CLI database migration required) and dependency updates including Spring Security 6.5.10 (CVE-2026-22732)

Fire Arrow Server 1.10.0 has been released.

• (feature) $generate-durable-token and $generate-one-time-token are now governed by all validators, not just Allowed
• (breaking) Token-generation rules using the wildcard resource: "*" are rejected at startup
• (security) Update Next.js to 16.2.6 (CVE-2026-23870, CVE-2026-44573, CVE-2026-44575, CVE-2026-44579, CVE-2026-44580, CVE-2026-44581, CVE-2026-44576, CVE-2026-44582, CVE-2026-45109)
• (feature) New _synchronous mode for CarePlan/$subscribe-due-events returns materialized Task IDs in the response
• (bugfix) Questionnaire media viewer recovers automatically when pre-signed URLs expire

Fire Arrow Server 1.9.1 has been released.

• (bugfix) Fix pre-signed attachment URLs not being recognized after client round-trip

Fire Arrow Server 1.9.0 has been released.

• (security) Remove the 100,000-resource scope limit that could silently restrict authorization for very large practitioner caseloads
• (feature) Add GeneralPractitioner authorization validator for Patient.generalPractitioner based access control
• (feature) Route Subscription notifications to per-Subscription Azure Storage Queues via channel.endpoint suffix
• (security) Dependency upgrades for org.postgresql:postgresql, spring-security-core, spring-security-oauth2-jose, and postcss

Fire Arrow Server 1.8.2 has been released.

• (feature) Support _total search parameter in GraphQL