Skip to main content
Till Gerken

Till Gerken

CTO
View all authors

Fire Arrow Server 1.12.0

· 5 min read
Till Gerken
Till Gerken
CTO

Fire Arrow Server 1.12.0 has been released.

  • (feature) Server warns at startup when authorization rules could allow a role to escalate its own access
  • (feature) License details are now visible to administrators in the web UI
  • (feature) Due-task transition throughput is configurable; defaults now drain backlogs of up to 5,000 Tasks per run
  • (bugfix) QuestionnaireResponse/$extract is now granted by an operation: extract authorization rule as intended
  • (maintenance) Dependency updates

Fire Arrow Server 1.11.0

· 8 min read
Till Gerken
Till Gerken
CTO

Fire Arrow Server 1.11.0 has been released.

  • (breaking) Token generation, binary upload, and CarePlan materialize operations no longer return distinct HTTP codes for unknown or deleted resource IDs
  • (security) CareTeam-scoped access no longer includes patients outside the practitioner's actual teams
  • (feature) New CarePlan $materialize and $dematerialize operations to start and stop task materialization without Subscription write access
  • (bugfix) Token generation honors every matching practitioner-role-code rule, not only the first one in configuration
  • (maintenance) HAPI FHIR 8.10.0 platform upgrade (HAPI CLI database migration required) and dependency updates including Spring Security 6.5.10 (CVE-2026-22732)

Fire Arrow Server 1.10.0

· 7 min read
Till Gerken
Till Gerken
CTO

Fire Arrow Server 1.10.0 has been released.

  • (feature) $generate-durable-token and $generate-one-time-token are now governed by all validators, not just Allowed
  • (breaking) Token-generation rules using the wildcard resource: "*" are rejected at startup
  • (security) Update Next.js to 16.2.6 (CVE-2026-23870, CVE-2026-44573, CVE-2026-44575, CVE-2026-44579, CVE-2026-44580, CVE-2026-44581, CVE-2026-44576, CVE-2026-44582, CVE-2026-45109)
  • (feature) New _synchronous mode for CarePlan/$subscribe-due-events returns materialized Task IDs in the response
  • (bugfix) Questionnaire media viewer recovers automatically when pre-signed URLs expire

Fire Arrow Server 1.9.0

· 4 min read
Till Gerken
Till Gerken
CTO

Fire Arrow Server 1.9.0 has been released.

  • (security) Remove the 100,000-resource scope limit that could silently restrict authorization for very large practitioner caseloads
  • (feature) Add GeneralPractitioner authorization validator for Patient.generalPractitioner based access control
  • (feature) Route Subscription notifications to per-Subscription Azure Storage Queues via channel.endpoint suffix
  • (security) Dependency upgrades for org.postgresql:postgresql, spring-security-core, spring-security-oauth2-jose, and postcss

Fire Arrow Server 1.8.0

· 4 min read
Till Gerken
Till Gerken
CTO

Fire Arrow Server 1.8.0 has been released.

  • (security) Close search-parameter side-channel for property-filtered fields
  • (feature) Resolve FHIR R4 conditional and logical Patient references in authorization
  • (bugfix) Fix inherited roles being dropped when a child organization has a direct role
  • (bugfix) Fix HFQL rejecting every request with 403 Forbidden when no explicit search/read rules are configured
  • (maintenance) Dependency upgrades across server, UI, and tooling