It's time for another release of HAPI FHIR.

HAPI FHIR 5.4.0 (Codename: Pangolin) brings a whole bunch of great new features, bugfixes, and more.

Highlights of this release are shown below. See the Changelog for a complete list. There will be a live Webinar (recording available on-demand afterward) on May 20 2021. Details available here: https://www.smilecdr.com/quarterly-product-release-webinar-reminder

Security Changes

• A resource exhaustion vulnerability in the HAPI FHIR JPA server was corrected. Learn more about CVE-2021-32053 here. Thanks to Zachary Minneker at Security Innovation for reporting!

General Client/Server/Parser Changes

• HAPI FHIR now supports OpenAPI (aka Swagger). See here for an example.
• Normalization and Standardization interceptors have been added. These can be used to normalize selected data fields according to configurable rules prior to storage.
• Contained resources can now reference to containing resources, as allowed in the FHIR Specification. Previously this direction was blocked and contained resources with no incoming reference from the containing resource were automatically stripped, as this style was not permitted in early versions of the FHIR specification. In addition, contained resource order will now be preserved during parsing round-trips.
• New interceptors have been added that can automatically map terminology in response resources using HAPI FHIR terminology services, returning configurable canonical terminology in the response payload.
• Support for the FHIR Prefer: handling=lenient header has been added via an optional interceptor.
• The automatic CapabiityStatement generation has been completely rewritten for R4+ servers. CapabilityStatements now include many new data elements, such as supported profiles, revincludes, resource level operations, and more.
• Token Search Parameters in GraphQL expressions are now correctly parsed.

JDK Changes

• HAPI FHIR now supports JDK 16, and this version is used to execute our CI test suite in order to ensure continued compliance. The minimum Java version required in order to use HAPI FHIR remains JDK 8. This may be updated to JDK 11 in an upcoming release, as many of the libraries we use are now either contemplating or have already completed an upgrade to JDK 11 as a minimum requirement.

JPA Server General Changes

• Support for the _list search parameter has been added to the JPA server
• Support for the :contained modifier has been added, allowing searches to select from data in contained resources found within the resource being searches. Note that this feature is disabled by default and must be enabled if needed.
• The JPA server now supports persisting FHIR extensions in Resource.meta
• Bulk Export now supports Patient- and Group- based exports
• Auto-created reference target placeholder resources now include an extension and an identifier if one is known
• A profiling effort led to improvements in performance when processing large FHIR Transaction bundles
• Resources imported into a repository via NPM Packages will now attempt to preserve the resource ID defined in the source package.

JPA Server Performance Changes

• Searches with only a single search parameter now generate a more streamlined SQL expression (one unnecessary JOIN was removed), improving performance.
• A new header X-Upsert-Extistence-Check (note there is a typo in the name, this will be addressed in the next release of HAPI FHIR! Please be aware if you are planning on using this feature) can be added which avoids existence checks when using client assigned IDs to create new records. This can speed up performance.

JPA Server Partitioning Changes

• Resource Reindexing is now supported on partitioned servers.
• FHIR Bulk Export is now supported on partitioned servers (note that this operation is run at the system level and includes data from all partitions. Future enhancements may allow for more nuanced exports on partitioned servers.)

Terminology Server and Validation Changes

• ValueSet expansion can now optionally return codes in the same hierarchy that they are defined in their source CodeSystem.
• Validation can now be configured to return only a warning when a code is found from a CodeSystem that is unknown/unavailable to the validator.

JPA Server MDM Enhancements

• A new search mdm-expansion syntax has been added to FHIR searches on MDM-enabled servers. For example Observation?patient:mdm=Patient/123 can be used to search for Observation resources belonging to Patient/123 but also to other MDM-linked patient records.
• MDM matching rules can now use FHIRPath expressions as selection criteria.
• A new syntax has been added to Group Bulk Export that allows MDM matching to be used to include matches in the group to export.
• MDM matching rules can now match on extensions, checking the URL and Value for equality.
• A new NUMERIC matcher has been added, allowing matching using numeric values.