Changelog

2026/09/26 Release 4.1.18

  • Docker: size the heap relative to the memory limit of the container (-XX:MaxRAMPercentage=70 instead of -Xmx12g in the default JDK_JAVA_OPTIONS); a memory limit of 4 GB is enough for a typical setup of implementation guides (measured with the 12 IGs of with-preload: about 1.3 GB of live heap) (#599)
  • Docker: enable the string deduplication of the garbage collector (-XX:+UseStringDeduplication) by default; it reduces the heap used by the ch-elm validation engine by about 15% at no measurable cost in validation time (#597)
  • Don't keep the whole content of a package in memory for the few binaries of its other folder: this kept e.g. all files of hl7.fhir.uv.xver-r5.r4 and hl7.fhir.r4.core (about 210 MB) on the heap of the main engine (#597)
  • Load the terminology resources (CodeSystem, ValueSet, NamingSystem, ConceptMap) of the implementation guide packages and their dependencies lazily: they're registered with the metadata of the package index and parsed when they're first used, like the core validator does. For the ch-elm implementation guide, which pulls in 7 versions of hl7.terminology.r4, the engine keeps about 225 MB less heap and is created about 6 s faster (#599)
  • Load the terminology resources of the FHIR core package and of the packages from the classpath (hl7.terminology, extensions, xver, CDA) lazily too; the core terminology resources are pinned to the core versions when they're parsed. Another 105 MB less heap and 4–6 s faster startup (#599)
  • Don't make HAPI parse and keep all StructureDefinitions of the FHIR core (about 40 MB for R4) for the FHIRPath engine of the JPA search parameter extractors, which only uses them for its static type analysis (#599)
  • Don't load a package again when a dependency with a wildcard version (e.g. ch.fhir.ig.ch-term#3.3.x) resolves to an already loaded version (#599)
  • Share the conformance resources of a package between the validation engines of several IGs that depend on it: an engine registers the resources that another engine has loaded instead of loading and parsing the package again. The cache keeps them only as long as an engine that uses them is alive. With ch-core and ch-epr-fhir, the resources that were loaded in both engines (53 MB) exist once (#599)
  • Update the with-preload sample configuration to the latest released versions of its IGs (ihe.iti.mhd and ihe.iti.pixm replace ihe.mhd.fhir and IHE.ITI.PIXm, ch.fhir.ig.ch-epr-fhir replaces ch.fhir.ig.ch-epr-mhealth)
  • Fix the with-ch sample configuration, which didn't start since 4.1.12: its local terminology server is reached over http, so it needs matchbox.fhir.context.ssrfProtectionEnabled: false
  • Add a JMeter test with several IGs (jmeter/multi-ig.jmx) to check which packages the validation engines share (#599)
  • Add a JMeter runbook with the memory and validation time of the ch-elm images from 1.13.1 to 1.15.2 (jmeter/claude-jmeter-check.md)
  • Docker: the JVM options can be configured with the JDK_JAVA_OPTIONS environment variable, which defaults to -Xmx12g -XX:+ExitOnOutOfMemoryError (#594)
  • Docker: exit on the first OutOfMemoryError (-XX:+ExitOnOutOfMemoryError) instead of continuing in an undefined state while the health check still reports UP, so that the container gets restarted (#457)
  • Docker: use the exec form of the entrypoint, so that matchbox receives the stop signal and shuts down gracefully; arguments given to the container are now passed to matchbox as Spring Boot arguments instead of being ignored (#594). Thanks @reva!
  • Fix the Gazelle Validation Service API reporting PASSED when nothing could be validated (unknown profile, engine not initialized, engine creation failure): the result is now UNDEFINED (#590)
  • Gazelle Validation Service API: reject a request without validationProfileId or inputs with a 400 instead of a 500, and answer a request arriving while the engine is not yet initialized with a retryable 503 (#590)
  • Gazelle Validation Service API: send an ETag on the profile list (v1 and v2) and answer If-None-Match with a 304, so that a client revalidating the list does not transfer it again (#591)

2026/09/21 Release 4.1.17

  • GUI: browse the FHIR package registry packages2.fhir.org on the IGs page, filtered by package name, FHIR version and publication date, mark the installed packages, and install a selected package version (hidden when the server is in httpReadOnly mode) (#583)
  • Add the validator version to the validation OperationOutcome, as per the FHIR Tooling Extensions (#581)
  • Add proposed profiles in the validator even if a meta.profile is present (#335)
  • Add information about the proposed profiles in the validator: package ID and version, title, and canonical URL (#355)
  • Allow filtering proposed profiles by current version (#355)
  • Update to HAPI FHIR 8.12.1

2026/09/14 Release 4.1.16

  • Fix starting the MCP server in onlyOneEngine mode
  • Fix the FHIR type of the profile in the $get-profiles response

2026/09/11 Release 4.1.15

  • Fix reading a conformance resource (StructureMap, StructureDefinition, ...) by the string id it was created with, which failed with a 500 because the id was always parsed as a number; an unknown id now returns a 404 (#573)
  • Fix debug mode of the $transform operation (#572)
  • GUI: ask the engine to analyze Bundle documents for possible validation profiles (#355)
  • GUI: fix the XML syntax highlighting
  • GUI: fix the XML resource data extraction
  • Update to HAPI FHIR 8.12.0
  • Fix the MCP server tool declarations
  • Fix the resolution of unversioned canonicals in the validation engines copied from the main engine: the copy of the context lost the package dependencies and the preference for the core package definitions, so the latest version of a resource was used (e.g. the R5 CodeSystem http://hl7.org/fhir/encounter-status from hl7.fhir.uv.xver-r5.r4 instead of the R4 one), which rejected the code finished of Encounter.status (#538)
  • Update org.hl7.fhir.core to 6.10.4
  • Allow matching document Bundle by their Composition type code, without Composition category code (#355)

2026/08/31 Release 4.1.14

  • Try to parse the LLM providers' JSON error responses to provide more meaningful error messages (#531)
  • Mark logical models as profiles that can be used in validations (#446)
  • Fix StructureMap/$list returning empty when using onlyOneEngine mode (#472)
  • Make StructureMap/$transform always available, not only on onlyOneEngine mode (#428)
  • Fix StructureMap/$transform not reading the source parameter from the Parameters body
  • Fix the rendering of the StructureMap/$transform operation in the GUI
  • Don't copy the suppressedWarnInfos/suppressedErrors from the main engine to the validation engines (#539)
  • Allow using an FML file as a map for StructureMap/$transform in the GUI (#560)
  • Remove the configuration property matchbox.fhir.context.analyzeOutcomeWithAI (#561)
  • Remove the configuration property matchbox.fhir.context.analyzeOutcomeWithAIOnError (#561)
  • Add the configuration property matchbox.fhir.validation.analyzeErrorsWithLlm (#561)
  • Add the configuration property matchbox.fhir.mcp.requestAnalysisFromClient (#561)
  • Allow to override llmProvider in the validation GUI
  • Revert the temporary workaround for "Slicing cannot be evaluated" in ProfileUtilities.findProfile() (#487); the canonical version resolution rules are honoured again, as org.hl7.fhir.core 6.10.0 resolves versioned extension canonicals correctly
  • Fix national core IGs (hl7.fhir.fr.core, hl7.fhir.us.core, ...) failing to resolve because they were treated as FHIR core packages and looked up on the classpath (#568). Thanks @achrafachkari!
  • Support R4 StructureMaps in $transform (#559)
  • Fix support of StructureMaps with pinned-version targets (#431)
  • When an ImplementationGuide is uninstalled, evict all cached engines that loaded it (#322)
  • Add a META_VERSION column to MB_INSTALLED_STRUCT_DEF, defaulting to 1, to allow future data migration
  • Add DOC_COMP_TYPE_CODE and DOC_COMP_CAT_CODE columns to MB_INSTALLED_STRUCT_DEF, storing the Composition type and category codes when the current profile is a document Bundle making direct use of that Composition.
  • Add the Bundle/$get-profiles to infer possible validation profiles for a document Bundle, based on its Composition type and category codes (#355)
  • Don't keep the narrative of resources loaded in the engine context (#566). Thanks @achrafachkari!
  • Add custom metrics
  • Update org.hl7.fhir.core to 6.10.3

2026/08/14 Release 4.1.13

  • Force Spring Data to 3.5.12 (spring-data-commons, spring-data-jpa, spring-data-envers), which HAPI FHIR still pulls in as 3.3.5, to fix three vulnerabilities in spring-data-commons: CVE-2026-41716 (denial of service, attacker-supplied strings are permanently retained as property-lookup cache keys and can exhaust the heap), CVE-2026-41711 and CVE-2026-41721
  • Align spring-core and spring-websocket, which HAPI FHIR pulls in as 6.2.18, with the Spring Framework version already used elsewhere (6.2.19), fixing CVE-2026-41838 in spring-websocket and CVE-2026-41848 in spring-core
  • Force spring-retry to 2.0.13, which HAPI FHIR pulls in as 2.0.10, to fix CVE-2026-41710
  • Fix the GUI not displaying markdown content (#555)
  • Isolate each database write during the migration of MB_INSTALLED_STRUCT_DEF

2026/08/11 Release 4.1.12

  • Update org.hl7.fhir.core to 6.10.0
  • Added the parameter matchbox.fhir.context.ssrfProtectionEnabled to control the new HAPI SSRF protection mechanism (Important: if you use a local terminology server you need to put that parameter)
  • Update HAPI FHIR to 8.10.1
  • Fix the GUI not able to send resources larger than 64 KiB (#542)
  • Fix Ambiguous type id validation errors: the FHIR core package of another FHIR version (e.g. hl7.fhir.r5.core#5.0.0 for an R4 validation) is no longer loaded when it is declared as a dependency of an IG, matching the behaviour of the FHIR validator
  • Fix requests larger than 2 MiB being rejected by Undertow (UT000020): the maximum request body size is now 100 MB, configurable with server.undertow.max-http-post-size (#543)
  • Update hl7.terminology to 7.3.0 and hl7.fhir.uv.extensions to 5.3.0. Note that 5.3.0 widens the context of some extensions, e.g. patient-citizenship is now allowed on Patient, RelatedPerson and Person; validations that expected an Extension_EXTP_Context_Wrong error for these extensions will no longer report it
  • Fix java.lang.Error: failed to validate, but no errors when validating a bundle whose entry slice allows several profiles and that contains a reference to another bundle entry (#543): with showMessagesFromReferences (enabled by default in matchbox), warnings and hints from the referenced resource, such as the dom-6 best practice warning, no longer make the referring resource fail validation
  • Optimize listing validatable profiles by caching them to a new database table. It will be automatically created on the first startup after the update.
  • Fix copy() aliasing bug in StructureMap transforms (#552) thanks @mrunibe for PR's !
  • Upgrade Spring Boot from 3.5.14 to 3.5.16, which brings Micrometer 1.15.12 to fix two DoS vulnerabilities in micrometer-core (CVE-2026-40983 via specially crafted gRPC requests, CVE-2026-40984 via specially crafted HTTP requests)
  • Fix the unit tests being killed by the OOM killer on the CI runner: the forked test JVMs were allowed to grow to 100% of the machine's memory (-XX:MaxRAMPercentage), so the garbage of the already-dirtied Spring test contexts was never reclaimed; the heap is now capped at 70% in both modules, and the Maven processes of the unit and integration test workflows are sized down so they cannot claim the memory the test JVMs need

2026/07/01 Release 4.1.11

  • Fix for issue #528: Validation through MCP with AI analysis via Sampling will only get the result of the AI analysis back, not the full OperationOutcome
  • Update org.hl7.fhir.core to 6.9.11
  • Frontend maintenance: upgrade to Angular 22, replace unmaintained dependencies

2026/06/08 Release 4.1.10

  • Validation requests through MCP will no longer invoke a separate LLM for AI analysis. Instead matchbox will give the Operation Outcome together with a prompt back to the MCP client.
  • MCP sampling enabled. If client supports sampling, the AI analysis will get performed by the clients LLM.

2026/05/27 Release 4.1.9

  • Upgrade Undertow from 2.3.24.Final to 2.4.1.Final to fix DoS via multipart/form-data parsing on HTTP GET requests (CVE-2026-3260). Since Undertow 2.4.0 the servlet and websocket modules were extracted to io.undertow.ee (UNDERTOW-2646); we now use io.undertow.ee:undertow-servlet:1.0.0.Final and io.undertow.ee:undertow-websockets:1.0.0.Final for Jakarta EE 10 compatibility (Spring Framework 6.2).
  • Upgrade Spring Framework from 6.2.17 to 6.2.18 to fix DoS via static resource resolution on Windows (CVE-2026-22745)
  • Update spring ai to 1.0.7 for CVE-2026-41712

2026/05/26 Release 4.1.8

  • Fix for loading custom SearchParameter -Exception during startup (#520) when matchbox.validation.save-statistics is enabled
  • Update frontend dependencies
  • Update org.hl7.fhir.core to 6.9.8

2026/05/11 Release 4.1.7

  • Force opennlp-tools >= 2.5.9 to fix CVE-2026-40682, CVE-2026-42027, CVE-2026-42440 (transitive via langchain4j)
  • Fix Trivy Docker image scan failing due to rekor.sigstore.dev timeout: replace TRIVY_OFFLINE_SCAN with TRIVY_SBOM_SOURCES='' to skip SBOM attestation lookups
  • Pin babel/plugin-transform-modules-systemjs >= 7.29.4 to fix CVE-2026-44728 (arbitrary code generation via malicious input)
  • Pin fast-uri >= 3.1.1 to fix CVE-2026-6321 (path traversal via percent-encoded dot segments)

2026/05/07 Release 4.1.6

  • Re-add support for the JRE 17 in matchbox-engine (#510)
  • Add validation statistics feature (#462)
  • Upgrade Spring Boot from 3.5.12 to 3.5.14 to fix predictable temp directory vulnerability (CVE-2026-40973)
  • Upgrade Thymeleaf from 3.1.4.RELEASE to 3.1.5.RELEASE to fix improper recognition of unauthorized syntax patterns (CVE-2026-40478)
  • Upgrade PostgreSQL JDBC driver from 42.7.10 to 42.7.11 to fix SCRAM-SHA-256 authentication DoS vulnerability (CVE-2026-42198)

2026/04/20 Release 4.1.5

  • Apply Debian security patches in the server Docker image (apt-get upgrade on base image) to fix HIGH CVEs CVE-2026-33416, CVE-2026-33636 (libpng16-16) and CVE-2026-28390 (openssl/libssl3)

2026/04/17 Release 4.1.4

  • Upgrade thymeleaf from 3.1.2.RELEASE to 3.1.4.RELEASE to fix CVE-2026-40478
  • Upgrade Angular to 21.2.9, Angular Material/CDK to 21.2.7, angular-eslint to 21.3.1 (fixes vite 7.3.1 vulnerability via transitive update to vite 7.3.2)
  • Upgrade lodash and lodash-es to 4.18.x via npm override (fixes CVE-2026-4800 and Dependabot alerts, transitive via karma and mermaid)
  • Add FHIRPath test for data-absent-reason with hasValue() checks
  • the suppressed warnings and errors are now stored in a Set instead of a List to prevent duplication (#482)

2026/04/01 Release 4.1.3

  • increase heap size requirement in Docker container to 12G

2026/04/01 Release 4.1.2

  • integrated new xver packages, hl7.fhir.uv.xver#0.1.0 and configure r4 with hl7.fhir.uv.xver-r5.r4 extensions (#502)
  • NOTE: xversion fml mapping package does not work anymore with above extensions pack, support had to be dropped

2026/03/31 Release 4.1.1

  • update org.hl7.fhir.core 6.9.4

2026/03/30 Release 4.1.0

  • fix ClassCastException in $validate-code when expanding inline ValueSet on R4/R4B servers (#497)
  • Upgrade HAPI FHIR from 8.0.0 to 8.8.0, Spring Boot from 3.3.13 to 3.5.12
  • Upgrade jackson-core to 2.21.2 to fix async parser DoS vulnerability (GHSA-72hv-8253-57qq)
  • Upgrade Angular from 21.1.3 to 21.2.5 to fix XSS vulnerability in i18n attribute bindings (CVE-2026-32635)
  • Upgrade Tomcat from 10.1.48 to 10.1.52 to fix input validation vulnerability (CVE-2025-31651)
  • Upgrade Spring Boot from 3.5.9 to 3.5.12 to fix actuator authentication bypass (CVE-2025-49470, CVE-2025-49471)
  • Fix prototype pollution in flatted (GHSA-v5vr-gp4q-wv4p)
  • Fix undici WebSocket parser crash (GHSA-7r4h-r29g-6p4p)
  • Add Docker HEALTHCHECK instruction (DS-0026), configurable via HEALTHCHECK_URL env variable
  • Bundle next link returns HAPI-0287 error (#489)

2026/03/22 Release 4.0.20

  • FHIRPath Slicing cannot be evaluated (#487) temporary workaround

2026/02/12 Release 4.0.19

  • fix FML NPE with translate(), cc(), and c() when assigning to polymorphic elements like value[x] or location[x] (#480)
  • load internal dependencies (ig-internal-dependency extension) from ImplementationGuide resources (#481)
  • update org.hl7.fhir.core 6.9.1

2026/02/12 Release 4.0.18

  • fix forwarding of anyExtensionsAllowed/extensionDomains in the validator (#464)
  • update dependencies

2026/01/27 Release 4.0.17

  • fixed search params not being included in the call to the server (#453)
  • unrestrict transport layer jackson for mcp (#455)
  • memory error / security issue (#457)

2026/01/08 Release 4.0.16

NOTE: Remove in your installation existing classpath entries for hl7.terminology#x.x.x in application.yaml

2025/11/03 Release 4.0.15

2025/10/21 Release 4.0.14

  • Further MCP Server integration (#398)

2025/10/04 Release 4.0.13

  • MCP Server integration (#398)

2025/08/26 Release 4.0.12

  • update org.hl7.fhir.core 6.6.5 (#425)
  • fix for multithreading issue and increasing terminology logs (#425)
  • separating internal terminology server to /tx endpoint

2025/08/12 Release 4.0.11

  • update for scanned vulnerabilities

2025/08/07 Release 4.0.10

  • update org.hl7.fhir.core 6.6.3 (#415)
  • document validation parameters (#407)
  • CDANarrative serialization issue (#417)
  • add HL7 Terminology (THO) 6.5.0

2025/07/01 Release 4.0.9

  • unable to resolve resource with reference (#409)
  • disableDefaultResource Fetcher provokes an error (#408)
  • update org.hl7.fhir.core 6.5.27 (#411)

2025/06/22 Release 4.0.8

  • suppressErrors not taken into account on gazelle interface (#405)

2025/06/18 Release 4.0.7

  • fix security issues

2025/06/15 Release 4.0.6

  • fix capability statement for production mode (#399)
  • allow llm api key to be set over gui (#392)

2025/06/13 Release 4.0.5

  • Add MCP Server integration (#398)
  • suppress error messages for known issues (#395)
  • unknown extensions should not raise an error for validation (IPS) (#394)
  • Update org.hl7.fhir.core to 6.5.25
  • SuppressError does not catch constraints (#401)

2025/05/13 Release 4.0.4

2025/05/09 Release 4.0.3

  • matchbox validation: fix ai analysis of xml resources (#378)
  • Fix error thrown when opening a validation link in the GUI (#379)
  • Remove matchbox.fhir.context.fhirVersion, use hapi.fhir.fhir_version instead (#382)
  • API: Matchbox is more respectful of the 'Accept' header (format and FHIR version) (#382)
  • Validation GUI: allow locking the profile selection (#385)
  • Update org.hl7.fhir.core to 6.5.21

2025/05/01 Release 4.0.2

  • matchbox validation: html tags in result (#371)
  • matchbox validation: make showMessagesFromReferences default to true (#370)
  • matchbox validation: fix exception during ai validation (#375)
  • Update org.hl7.fhir.core to 6.5.20

2025/04/15 Release 4.0.1

2025/03/19 Release 4.0.0

  • Upgrade to HAPI 8.0.0 and FHIR Core 6.5.15, plus various other dependency upgrades
  • Hide primitive/complex datatypes and logical models in the validators (#352)
  • Fix handling of the hl7.fhir.uv.extensions packages (#343)

2025/03/05 Release 3.9.13

  • No more GUI version mismatch (#346)
  • Support for bundle option to validate directly a resource within the bundle (#348)
  • Automatically validate composition within bundle if profile can be deduced (#348)
  • Update org.hl7.fhir.core to 6.5.9

2025/02/05 Release 3.9.12

  • Update org.hl7.fhir.core to 6.5.7
  • Update hl7.terminology.r4 to 6.2.0 (note you need to update your application.yaml) (#339)
  • Validation GUI: handle non-200 responses that contain an OperationOutcome (#326)
  • Set the right PostgreSQL dialect in Hibernate configuration (#321)
  • Customize the NpmPackageVersionResourceEntities before saving them for the first time (#341)
  • Optimize NpmPackageIndexBuilder.seeFile for memory consumption (#342)
  • Matchbox too strict in document validation (#345)
  • Duplicate ID for contained resource in IG Publisher 1.8.10 / core 6.5.7 (#344)

2025/01/24 Release 3.9.11

  • remove introduced FML limitation to R5 (#329), (#331) thanks @mrunibe for PR's !
  • load testing example for matchbox with jmeter
  • memory leaks with precached implementation guides (#336)
  • Update org.hl7.fhir.core to 6.5.5, additional validation parameters -check-references -resolution-context and -disableDefaultResourceFetcher (#334) and (#337)

2025/01/13 Release 3.9.10

  • Performance improvement fml parsing (#323)
  • Update org.hl7.fhir.core to 6.5.4 and hapi-fhir to 7.6.1
  • Update integration tests with correct url
  • make autoinstall new ig (#325)
  • support for terminology servers which require authentication (#327), thanks @echiu-infoway for support!

2024/12/09 Release 3.9.9

  • Upgrade org.hl7.fhir.core to 6.4.4 and hapi-fhir to 7.6.0
  • Remove the devMode configuration parameter, it is now enabled when httpReadOnly is not (#315)
  • Remove the autoInstallMissingIgs configuration parameter, it is now enabled when httpReadOnly is not (#315)
  • Improve the Matchbox server documentation (#315)
  • Respect the 'onlyOneEngine' mode in MappingLanguageInterceptor (#316)
  • Use the proper encoding when returning a transformed resource (#318)

2024/11/25 Release 3.9.8

  • Allow providing map and models in the StructureMap $transform operation (#305)
  • Introduce parameter 'autoInstallMissingIgs' to automatically install IGs from the public registry (#306)
  • Introduce the configuration parameter 'devMode' to enable the development environment; it allows installing an ImplementationGuide by posting its NPM package to the operation $install-npm-package (#306)
  • Add filtering to the list of StructureMaps in the GUI
  • Move from the hash-based Angular routing to the path-based routing
  • Upgrade hapifhir org.hl7.fhir.core to 6.4.2
  • Upgrade hl7.terminology to 6.1.0 (#313)

2024/11/13 Release 3.9.7

  • Upgrade hapifhir org.hl7.fhir.core to 6.4.1

2024/10/24 Release 3.9.6

  • Remove lucene dependencies (#301)

2024/10/24 Release 3.9.5

  • Updated dependencies (#301)

2024/10/17 Release 3.9.4

  • Validation: Tutorial for validating FHIR resources with matchbox
  • Validation: add button to copy a direct link to the validation (#296)
  • Validation: support additional validation parameters (#299)
  • Validation: Allow validating a resource through the GUI with URL search parameters (#288)
  • Validation: Terminology: support CodeableConcept in ValueSet/$validate operation (#291)
  • FML: Use FMLParser in StructureMapUtilities and support for identity transform (#289)
  • FML: FML transform performance tuning #264 (via @mrunibe)
  • Gazelle reports: add test to ensure https://gazelle.ihe.net/jira/browse/EHS-831 is fixed
  • Upgrade hapifhir org.hl7.fhir.core to 6.3.32

2024/10/07 Release 3.9.3

  • Gazelle reports: add an information message if there are no other messages (#274)
  • Additional tx Parameters txLog and txUseEcosystem (#281)
  • FML: updates to work with fhir-mapping-tutorial (#283)
  • Container: Create config directory already in base image (#284)

2024/09/16 Release 3.9.2

  • Fix security issues (#279)
  • where clause on alias (#278)

2024/09/16 Release 3.9.1

  • Make CORS configurable, default not activated make cors configurable (now activated) (#271)
  • server API FML transforms between different FHIR versions (R4, R4B, R5) (#265), set flag xVersion
  • show a notification on errors in the validation GUI (#272)
  • ignore info/warnings also in slicing info (#273)
  • Gazelle validation reports with no issues should pass (#274)
  • update frontend dependencies
  • provide version-less Gazelle profiles for current packages (#276)

2024/09/10 Release 3.9.0

  • initial support for FML transforms between different FHIR versions (R4, R4B, R5) (#265), set flag xVersion
  • support for FHIR R4B in engine and server (#65)
  • upgrade to hapi-fhir 7.4.0 and org.hl7.fhir.core 6.3.24 (#267)
  • Ignore info/warnings also in slicing info (#269)

2024/08/13 Release 3.8.10

2024/07/10 Release 3.8.9

  • add support for dateTime (#243)
  • fix code editor high-jacking of the search keyboard shortcut (CTRL + f) (#260)
  • upgrade Tomcat to fix CVE-2024-34750

2024/06/25 Release 3.8.8

  • validation for 3 letter country codes (#259)
  • making caching of txServer configurable
  • add support for dateTime (#243)

2024/06/24 Release 3.8.7

  • docker image for v3.8.6 not starting up (#258)

2024/06/24 Release 3.8.6

  • fhirpath date add/minus with variables in fml (#243)
  • update to published CDA FHIR logical model with matchbox patches 2.0.0-sd (#241)
  • update frontend for high security vulnerabilities (#246)
  • CH:IPS validation problem (#248)
  • improved the validation GUI (#242), upgraded to angular@18
  • update to hl7.fhir.core 6.3.11 (#254)
  • fixed validation problems (#250),(#251),(#252)
  • enable Terminology Caching (#257)

2024/06/14 Release 3.8.5

  • Exception when using internal terminology server (#236)
  • Extension profiles are not shown for validation anymore (#237)
  • Ignore suppressWarnInfo Version independent (#239)

2024/05/27 Release 3.8.4

  • R5 validation problem from EVS Client (#234)
  • IPS validation with unknown extensions should not give an error (#233)
  • Only download NPM package from localhost or ci-build if already installed in container (#232)

2024/04/29 Release 3.8.3

  • profile validation with different ig version issues, GUI & EVS Client (#225)
  • improved the profile selection in the validation GUI
  • FML: Side effect exception when updating a StructureMap (#227)

2024/04/22 Release 3.8.2

  • Improvements in the Gazelle validation API
  • Upgrade to Spring 6.1.6 to fix CVE-2024-22262
  • Fix CVE-2023-4043
  • Upgrade to HAPI FHIR 7.0.2 and org.hl7.fhir.core 6.3.5 (#222)

2024/04/09 Release 3.8.1

  • update to latest cda logical model 2.0.0-sd-snapshot1 (CDA Serialization issue) (#196)
  • adapt the simple terminology server to the new API (#217)
  • loading of ig's in dev mode into engine (#219)
  • upgrade to JDK 21 (LTS)
  • Path traversal in webpack-dev-middleware (#221)

2024/03/19 Release 3.8.0

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.8.0
  • update to fhir.core.version 6.3.2 (#210)
  • support for target CDA observation.value as xsi:type CS (#205)
  • update to latest cda logical model 2.0.0-sd-snapshot1 (Note: breaking changes for existing CDA to FHIR maps, see details in issue) (#196)
  • Update to Spring 6.1.5 to fix CVE-2024-22259
  • Update to Tomcat 10.1.19 to fix CVE-2024-24549
  • Update frontend dependencies
  • Fixed invalid imports in FhirPathR4 #5

2024/03/07 Release 3.7.0

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.7.0
  • Implemented the new Gazelle validation API (#141)
  • Fixed some validation GUI issues (#207)
  • Renamed the keyword "current" to "last" for Implementation Guide versions (#206)
  • Added support for R5 (#55)
  • Fixed an XXE vulnerability in the XmlParser #45
  • Upgraded to HAPI FHIR 7.0.1

2024/02/28 Release 3.6.1

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.6.1
  • Fixed support for the date format YYYYMMDDHHMMSS.UUUU[+|-ZZzz] (#202)

2024/02/27 Release 3.6.0

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.6.0
  • Upgraded to HAPI FHIR 7.0.0 and org.hl7.fhir.core 6.1.2.2 (#191)
  • Added matchbox validation API tests (#193)

2024/01/31 Release 3.5.4

2024/01/05 Release 3.5.3

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.5.3
  • Updated hl7.terminology from 5.3.0 to 5.4.0 (#174)
  • Prevented initializing a matchbox engine in only_load_packages mode (#172)
  • Fixed the issue count in validation results (#173)
  • Improved the validation interface
  • GUI: updated to Angular 17

2023/12/27 Release 3.5.2

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.5.2
  • IG ballot versions are not considered "current" if the same version, non-balloted is also loaded (#168)
  • Removed wrong warning about R5 specials not being loaded (#167)
  • Fixed loading of hl7.terminology (#166)
  • Added onlyOneEngine and httpReadOnly flags to the validation OperationOutcome (#164)
  • Implemented feature to suppress warning/information-level issues from validation result (#163)
  • Fixed configuration of the terminology server when onlyOneEngine mode is used (#160)
  • Improved common error messages about engine malfunctions (#159)
  • Improved waiting loop for the validation engine initialization (you should not get the "engine not ready" error message anymore)
  • Reworked exception handling and logging in the validation engine
  • Updated the validation OperationOutcome to include more information, the GUI was also updated

2023/12/11 Release 3.5.1

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.5.1
  • The terminology system advertises support for more code systems

2023/12/08 Release 3.5.0

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.5.0
  • Upgraded to HAPI FHIR 6.10.0 and Core 6.1.16
  • Implemented an HTTP read-only mode (#158)
  • Implemented a simple terminology server for offline validation (#152)
  • Upgraded logback to fix CVE-2023-6378
  • Fixed a bug in package loading on Windows filesystem

2023/10/05 Release 3.4.5

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.4.5
  • CDA Logical Model update for xsi-type ST (#145)

2023/10/03 Release 3.4.4

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.4.4
  • CDA Logical Model update for xsi-type ST (#145)
  • update hl7.terminology package from 5.1.0 to 5.3.0 (#146)
  • Validation: Upload of new IG over API does not configure it for validation (#144)

2023/09/20 Release 3.4.3

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.4.3
  • FML: Contained ConceptMap in StructureMap does not work for transformation (#137)
  • FML: POST / PUT for StructureMap should return HTTP error code 404 instead of 200 in deployment mode (#133)
  • FHIR Validation problem with not support R5 extensions (#135)
  • FHIR Validation Errors for display values should only be warnings (#132)
  • GET all and query for url is not working in development mode (#129)
  • matchbox app assumed matchboxv3 as the app location (#128)
  • FHIR R4 validation error with cross version Extension for R5 (#138)

2023/09/05 Release 3.4.2

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.4.2
  • Query all conformance resources by type (#129)

2023/09/04 Release 3.4.1

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.4.1
  • development mode to create conformance resources (#125)
  • matchbox version in capability statement matchbox#126

2023/08/30 Release 3.4.0

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.4.0
  • Updated to HAPI FHIR 6.8.0 and Core 6.0.22
  • Added support for custom paths with the filesystem package cache manager

2023/08/09 Release 3.3.3

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.3.3
  • Upgraded Jackson to allow parsing longer JSON documents

2023/08/09 Release 3.3.2

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.3.2
  • Increased the max heap to 2.5 giga to allow loading more IGs

2023/07/27 Release 3.3.1

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.3.1
  • Updated to HAPI FHIR 6.6.2
  • GUI: updated to Angular 16
  • Fix hl7#terminology version in MatchboxEngineSupport
  • GUI: all IGs are now showing, fixes #119
  • GUI: remove the backend URL field, fixes #84
  • Improve the MatchboxEngineBuilder, fixes #113
  • Prepare for R4B/R5 support

2023/07/10 Release 3.3.0

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.3.0
  • Updated to Core 6.0.1 and hapi-fhir 6.6.0
  • Updated to hl7#terminology 5.1.0
  • Loaded hl7.fhir.uv.extensions.r4 1.0.0
  • Improved testing

2023/05/15 Release 3.2.3

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.2.3
  • fix validation engine caching mechanism

2023/05/08 Release 3.2.2

  • docker pull europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.2.2
  • dependency upgrade (core 5.6.971, HAPI 6.4.4, Spring 5.3.27, Spring Boot 2.7.11)
  • replaced IgLoaderFromClassPath with #loadPackage()

2023/04/05 Release 3.2.1

  • docker pull \ europe-west6-docker.pkg.dev/ahdis-ch/ahdis/matchbox:v3.2.1
  • reenable proxy support for downloading packages
  • update to core 5.6.116

2023/03/06 Release 3.2.0

  • updated CDA core logical model 2.0 and added tests
  • docker multiarchitecture support and ci-build setup (#76)
  • proxy support for downloading packages, thanks @ValentinLorand for your PR, (#76)
  • matchbox-server: disable caching for specific engines / implementation guides (#77)
  • update to core 5.6.100 and hapi-fhir 5.4.1 for r4 and r5 maps support (#81)

2023/02/01 Release 3.1.0

  • Reenable FHIR Mapping Language tutorial, xml and json issues with matchbox (#51)
  • Enable create and update on conformance resources (#70), valid for 60 minutes (not persisting)
  • GUI: more intuitive order for validation (#69)
  • GUI: paged ig's page does not work (#67)
  • Update to https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/5.6.92 and hapi-fhir 6.2.5
  • validation difference to HL7 FHIR validator (#71): only selected ig (and dependencies) for selected canonical will be used for validation if configured on matchbox (including no dynamic loading of packages depending on meta.profile)
  • spurios validation erros with package validation (#72)
  • Fixed package configuration, not loading additional ig / conformance resources (#71)
  • loading IG from package by filepath does not work (#26)
  • base release with no ig's configured: docker pull eu.gcr.io/fhir-ch/matchbox:v313

2023/01/16 Release 3.0.0

2022/09/11 Release 2.4.0

  • hapi-fhir 6.2.0 and org.hl7.fhir.core 5.6.43
  • update mobile access
  • ihe.iti.pmir#1.5.0 cannot be uploaded to matchbox (#59): removed Subscription from resources to import
  • show all cda2fhir and fhir2cda maps (#58)
  • hapi.fhir.version: 6.2.0-PRE5-SNAPSHOT and fhir.core.version 5.6.65

2022/07/11 Release 2.3.0

  • favicon fixed (#53)
  • add possiblity to add a static file location (#57)

2022/06/08 Release 2.2.0

  • FHIR Mapping Language tutorial, xml and json issues (#51)
  • base release with no ig's configured: docker pull eu.gcr.io/fhir-ch/matchbox:v220

2022/05/25 Release 2.1.0

  • hapi-fhir 6.0.0 and org.hl7.fhir.core 5.6.43
  • Validation: CapabilityStatement caching fixed (#43)
  • prototype SDC $assembly operation (#46)
  • Enable SDC extraction with unknown ValueSets (#48)
  • Patch for FHIR Mapping Language: funcMemberOf/resolveValueSet: Not Implemented Yet (#49)
  • validation without terminology server and with hl7.terminology (#50)
  • base release with no ig's configured: docker pull eu.gcr.io/fhir-ch/matchbox:v210

2022/04/28 Release 2.0.0

  • version of ig, validator and matchbox should be provided in the validation report (#40)
  • hapi-fhir 6.0.0-PRE10-SNAPSHOT and org.hl7.fhir.core 5.6.43
  • allow xml in gui for validation (#38)
  • mobile access gateway gui: prefix DocumentEntry.identifier with urn:uuid in GUI (#41)
  • base release with no ig's configured: docker pull eu.gcr.io/fhir-ch/matchbox:v200

2022/03/21 Release 1.9.1

2022/03/10 Release 1.9.0

  • Updated to hap-fhir 5.7.0, fhir.core.version (validator) 5.6.27
  • Extended Mobile Access Gateway support for PMP (replacing FHIR documents with selected Patient in Mobile Access Gateway, transforming to CDA and MDH publish)
  • base release with no ig's configured: docker pull eu.gcr.io/fhir-ch/matchbox:v190
  • docker-compose setup for postgres and for postgres and swiss igs

2022/02/21 Release 1.8.2

2022/02/21 Release 1.8.1

2022/02/08 Release 1.8.0

  • Integrate webapp running on matchbox port and root itself (#35)
  • NPM can be downloaded with Accept:application/gzip on Implementation Guide Resource

2022/01/13 Release 1.7.1

  • JSON POST Requests have a size limit (filler issue) (#33)
  • FHIRPathEnginge construction is expensive (#31)
  • SNOMED CT Code validation problem for Quantity in Medication.amount (#30)
  • Validation: Uploaded StructureDefinitions via NPM are not available in same session for $validate (#29)
  • StructureMap transformation: Bundle request element not correctly ordered (#27)
  • Error on release V1.6.0 (#24), thanks @delcroip
  • Integrated PR and PR for translate in Structure Map, thanks @aralych
  • base release with no ig's configured: docker pull eu.gcr.io/fhir-ch/matchbox:v171

2022/01/04 Release 1.6.0

  • extend FHIR API based on Implementation Guide NPM packages (#23)
  • add spring actuator for health checks (#22)
  • disable special questionnaire validation (#21)
  • base release with no ig's configured: docker pull eu.gcr.io/fhir-ch/matchbox:v160

2021/12/17 Release 1.5.0

  • updated hapi-fhir to 5.6.0
  • patched slicing validation problems in bundle
  • activated $expand operation on ValueSet
  • base release with no ig's configured: docker pull eu.gcr.io/fhir-ch/matchbox:v150

2021/09/14 Release 1.4.0

  • updated hapi-fhir to 5.5.1, no more dependencies on forked packages
  • $extract on QuestionnaireResponse for StructureMap based extraction
  • support for the $transform operation for StructureMap
  • FHIR Mapping Language Support (POST FHIR Mapping language, transform)
  • fixed issues #7 and #8 (custom SearchParmeters and validation)
  • public test instance https://test.ahdis.ch/matchbox/fhir
  • base release with no ig's configured: docker pull eu.gcr.io/fhir-ch/matchbox:v140
  • swiss epr release: docker pull eu.gcr.io/fhir-ch/matchbox-swissepr:v140

2021/07/05 Release 1.3.0

  • updated hapi-fhir to 5.5.0-PRE5-SNAPSHOT with patches for hapi-fhir and org.hl7.fhir.core (dev branch on ahdis foreach project)
  • updated swiss epr implementation guides to STU2 Ballot
  • renamed project to matchbox-validator
  • base release with no ig's configured: docker pull eu.gcr.io/fhir-ch/matchbox-validator:v130
  • swiss epr release: docker pull eu.gcr.io/fhir-ch/matchbox-validator-swissepr:v130
  • testsystem endpoint for siwssepr validator: https://test.ahdis.ch/matchbox-validator/fhir

2020/12/23 Release 1.2.0

  • updated hapi-fhir to 5.2.0
  • updated ch-epr-mhealth to 0.1.2
  • Release is available here: docker pull eu.gcr.io/fhir-ch/hapi-fhir-jpavalidator:v120

2020/10/22 Release 1.1.0

2020/09/02 Release 1.0.0

  • system level $validate operation for $ig's
  • based on hapi-fhir-jpaserverstarter 5.1.0