Fire Arrow Server 2.0.0 has been released. This is a major release driven by two large bodies of work.
The first is a performance push. Coordinated load tests against production deployments, together with work to optimize real client access patterns — particularly around CarePlan Task materialization — surfaced a number of bottlenecks. This release rewrites the hot paths behind Task materialization and subscription matching and adds bounds and caching throughout.
The second is a systematic review of code quality, security, and scalability. Recent reports of language-model tooling finding previously unknown security issues in old, well-tested code prompted us to run the same kind of review across Fire Arrow Server. Despite already performing manual review and automated quality and security checks on every change, the review turned up a surprising number of issues. We have addressed them here.
Because these two efforts touch a large part of the server — authorization, logging, subscriptions, binary storage, GraphQL, HFQL, the admin proxy, scheduled jobs, and the shipped production configuration — the combined change surface is large enough that we are declaring this a 2.0.0 release. Customers are strongly advised to test 2.0.0 in a staging environment before upgrading production systems.
- (breaking)
CarePlan/$materialize now reconciles by default instead of only adding Tasks; pass _reconcile=false for the previous additive behavior
- (breaking) Several defaults now fail safe: binary uploads are restricted to a content-type allow-list, multi-node API-token deployments must set an explicit signing secret, the terminology-upload and subscription-trigger operations are off by default, and the built-in MCP bridges have been removed with MCP disabled by default
- (breaking)
Group/$everything, multi-search, and GraphQL now reject over-large or unsigned requests with 413/errors instead of silently truncating
- (breaking) Container health probes now target the liveness endpoint instead of the aggregate health status
- (security) Broad hardening pass across authorization, logging, GraphQL, HFQL, binary storage, and the admin proxy, including PHI redaction in logs, tighter multi-node cache and identity bounds, and injection-hardened query and error paths
- (feature) Large performance improvements to CarePlan Task materialization and subscription matching, validated with production load tests
- (feature) FHIR
Binary resources are now offloaded to Azure Blob Storage, with idempotent content-addressed uploads and optional orphan-blob cleanup
- (feature) Safer production image defaults and configurable Azure client timeouts and retries
- (bugfix) CarePlan scheduling edits now preserve in-flight Tasks instead of deleting and recreating them; monthly and yearly schedules no longer drift
- (bugfix) Numerous multi-node and large-dataset correctness and reliability fixes across subscriptions, scheduled jobs, licensing, and uploads
- (maintenance) Broad internal code-quality pass and Fire Arrow database migrations that apply automatically on startup
