It's August, so it's time for our next quarterly relese: HAPI FHIR 5.2.0 (Codename: Numbat).

Security Notice:

• Security Issue CVE-2020-24301: An XSS vulnerability has been fixed in the testpage overlay project. This issue affects only the testpage overlay module, but users of this module should upgrade immediately. Note that this issue is addressed in HAPI FHIR 5.1.0 (as well as 5.2.0+) so users who have already upgraded to HAPI FHIR 5.1.0 do not need to upgrade again to resolve this issue. It is listed here as we experienced a delay in obtaining a CVE number.

Major New Features:

• The JPA SearchBuilder (which turns FHIR searches into SQL statements to be executed by the database) has been completely rewritten to not use Hibernate. This allows for much more efficient SQL to be generated in some cases. For some specific queries on a very large test repository running on Postgresql this new search builder performed 10x faster. Note that this new module is enabled by default in HAPI FHIR 5.2.0 but can be disabled via a JpaStorageSettings setting. It is disabled by default in Smile CDR 2020.11.R01 but will be enabled by default in the next major release.

• Support for RDF Turtle encoding has been added, finally bringing native support for the 3rd official FHIR encoding to HAPI FHIR. This support was contributed by Josh Collins and Eric Prud'hommeaux of the company Janeiro Digital. We greatly appreciate the contribution! To see an example of the RDF encoding: hapi.fhir.org/baseR4/Patient?_format=rdf

Terminology Enhancements:

• Integration with remote terminology services has been improved so that required bindings to closed valuesets are no longer delegated to the remote terminology server. This improves performance since there is no need for remote services in this case.

• The CodeSystem/$validate-code operation has been implemented for R4+ JPA servers.

• The JPA Terminology Server is now version aware, meaning that multiple versions of a single CodeSystem can now be stored in a single FHIR terminology server repository. ValueSet expansion, CodeSystem lookup, and ConceptMap translation are all now fully version aware. Note that implementing support for fully versioned terminology is mostly complete, but some validation operations may still not work. This should be completed by our next major release.

• ValueSet expansion with filtering (e.g. using the filter parameter on the $expand operation) has now been implemented in such a way that it fully supports filtering on pre-expanded ValueSets, including using offsets and counts. This is a major improvement for people building picker UIs leveraging the $expand operation.

EMPI Improvements:

• Identifier matchers have been added, providing native FHIR support for matching on resource identifiers

• The $empi-clear operation performance has been greatly improved

Other Notable Improvements:

• A new combined "delete+expunge" mode has been added to the DELETE operation in the JPA server. This mode deletes resources and expunges (physically deletes) them in a single fast operation. Note that with this mode must be enabled, and completely bypasses interceptor hooks notifying registered listeners that data is being deletes and expunged. It is several orders of magnitude faster when deleting large sets of data, and is generally intended for test scenarios.

• The Package Server module now supports installing non-conformance resources from packages.

• The _typeFilter parameter has been implemented for the $bulk-export module.

As always, see the changelog for a full list of changes.

Thanks to everyone who contributed to this release!