Till Gerken

Fire Arrow Server 2.2.1 has been released.

• (bugfix) The Azure production image for 2.2.x now builds; use 2.2.1 in place of 2.2.0

Fire Arrow Server 2.2.0 has been released.

• (feature) LegitimateInterest now finds Consent resources through Consent.performer as well as Consent.patient
• (bugfix) Patient Task search with no Tasks no longer falls through to default-validator
• (bugfix) _include and _revinclude results ride with their matching resources instead of consuming _count slots
• (bugfix) Task search during $renew-due-events no longer returns 403 Forbidden
• (bugfix) Identity lookup outages return a retryable 503 instead of 403 Forbidden
• (bugfix) $renew-due-events and $subscribe-due-events no longer fail with 409 Conflict while a Subscription is activating
• (bugfix) Recurring CarePlan Task ids stay stable across reconciles
• (bugfix) A transient uniqueness check no longer reports a new email as already taken
• (bugfix) Expected subscription-create retries no longer log as ERROR
• (maintenance) HAPI FHIR 8.12.0 platform upgrade and dependency updates including PostCSS CVE-2026-69153

Fire Arrow Server 2.1.6 has been released.

• (bugfix) Updating an externalized Binary no longer leaves it permanently unreadable through $binary-access-read

Fire Arrow Server 2.1.3 has been released.

• (feature) Faster subscription activation removes a roughly one-second delay from CarePlan event and materialization requests

Fire Arrow Server 2.1.4 has been released.

• (bugfix) Reading attachment content with $binary-access-read now follows your existing read rules instead of returning 403 Forbidden

Fire Arrow Server 2.1.5 has been released.

• (bugfix) Reading externalized Binary content with $binary-access-read no longer fails with 500 Internal Server Error

Fire Arrow Server 2.1.2 has been released.

• (bugfix) CarePlan activity.reference values that pin a historical resource version (…/_history/N) are now stored and used as sent

Fire Arrow Server 2.1.1 has been released.

• (bugfix) The Azure production image no longer fails to start because of a duplicate binary-storage configuration key

Fire Arrow Server 2.1.0 has been released.

• (security) When the MCP interface is enabled, its endpoints now apply each caller's own authorization rules, and the MCP CDS bridge now enforces an access check (MCP remains off by default)
• (feature) Faster CarePlan Task materialization when the server reaches its database over a network connection
• (bugfix) Attachment reads on historical resource versions no longer break after cleanup or garbage collection
• (bugfix) An invalid CarePlan Task status in configuration now stops the server at startup instead of failing later

Fire Arrow Server 2.0.0 has been released. This is a major release driven by two large bodies of work.

The first is a performance push. Coordinated load tests against production deployments, together with work to optimize real client access patterns — particularly around CarePlan Task materialization — surfaced a number of bottlenecks. This release rewrites the hot paths behind Task materialization and subscription matching and adds bounds and caching throughout.

The second is a systematic review of code quality, security, and scalability. Recent reports of language-model tooling finding previously unknown security issues in old, well-tested code prompted us to run the same kind of review across Fire Arrow Server. Despite already performing manual review and automated quality and security checks on every change, the review turned up a surprising number of issues. We have addressed them here.

Because these two efforts touch a large part of the server — authorization, logging, subscriptions, binary storage, GraphQL, HFQL, the admin proxy, scheduled jobs, and the shipped production configuration — the combined change surface is large enough that we are declaring this a 2.0.0 release. Customers are strongly advised to test 2.0.0 in a staging environment before upgrading production systems.

• (breaking) CarePlan/$materialize now reconciles by default instead of only adding Tasks; pass _reconcile=false for the previous additive behavior
• (breaking) Several defaults now fail safe: binary uploads are restricted to a content-type allow-list, multi-node API-token deployments must set an explicit signing secret, the terminology-upload and subscription-trigger operations are off by default, and the built-in MCP bridges have been removed with MCP disabled by default
• (breaking) Group/$everything, multi-search, and GraphQL now reject over-large or unsigned requests with 413/errors instead of silently truncating
• (breaking) Container health probes now target the liveness endpoint instead of the aggregate health status
• (security) Broad hardening pass across authorization, logging, GraphQL, HFQL, binary storage, and the admin proxy, including PHI redaction in logs, tighter multi-node cache and identity bounds, and injection-hardened query and error paths
• (feature) Large performance improvements to CarePlan Task materialization and subscription matching, validated with production load tests
• (feature) FHIR Binary resources are now offloaded to Azure Blob Storage, with idempotent content-addressed uploads and optional orphan-blob cleanup
• (feature) Safer production image defaults and configurable Azure client timeouts and retries
• (bugfix) CarePlan scheduling edits now preserve in-flight Tasks instead of deleting and recreating them; monthly and yearly schedules no longer drift
• (bugfix) Numerous multi-node and large-dataset correctness and reliability fixes across subscriptions, scheduled jobs, licensing, and uploads
• (maintenance) Broad internal code-quality pass and Fire Arrow database migrations that apply automatically on startup