0.0.32

Changed

• Breaking for crate users: ihe-iti 0.11.0 requires ihe-atna 0.19,
  and nl-generic-functions 0.11.0 requires ihe-iti 0.11. Their public
  API carries ihe-atna types (the audit user an exchange is made for), so
  a consumer moves ihe-atna, and ehds-logging with it, to 0.19 in the
  same change and links one copy. The server pins ihe-atna 0.19.0, which
  changes nothing FerroPIX records (#663).

Fixed

• The server and the operator console move to ferrohealth-telemetry 0.5, ferrohealth-server 0.9 and ferrohealth-usage-report 0.5, whose subscriber installs its own bridge from the log crate in place of tracing-log's LogTracer. Under a console filter that lets a target through above its default level, such as info,ferrohealth_smart=debug, a dependency's log::log_enabled! check no longer drops the next event on its thread, which lost the request line of a request that ran such a check (FerroHEALTH/FerroSYS#388) (#662).

Support period

Only the newest release is supported: there are no maintenance branches, no long-term-support line and no backports, and upgrading is free. Under the Cyber Resilience Act, Cadasto B.V. commits to keep publishing security fixes for at least five years after each release (Art 13(8)) and ships them only in the newest release (Art 13(10)). For this release that commitment runs until the end of November 2031 (Regulation (EU) 2024/2847 Art 13(19)); see SECURITY.md.

0.0.31

Added

• The ITI-93 sender authenticates to each Patient Identity Consumer named
  in [[pmir.feed.consumers]], the family's endpoint table: a message to a
  subscription whose channel endpoint lies under the entry's url carries
  its IUA client credentials token (credentials.oauth), renewed once when
  the Consumer answers 401, and presents its client certificate for ATNA
  mutual TLS (tls.client_identity_file), as PMIR 1.6.0 §2:3.93.5 asks.
  The token replaces any Authorization header the subscription names,
  and an endpoint under no entry gets no credential. A 401 or 403 after
  the renewal is retried within [pmir.feed] and then sets the
  subscription to error naming the refusal (#655).
• ihe-iti 0.10.1 makes pmir::subscription::Subscribed::at public: a
  PMIR subscriber that keeps no state between requests rebuilds the
  subscription handle from the Location it stored, to read its status or
  delete it. A Location off the Registry's [base]/Subscription is
  refused as before, so the subscriber's credential never goes elsewhere (#658).

Changed

• FerroPIX moves to ferrohealth-smart 0.21, ferrohealth-session 0.16,
  ihe-atna 0.15, ferrobridge-term 0.8 and ferrobridge-hl7v2 0.12, the
  releases on the smart line that chooses the described SMART issuer by one
  shared rule and adds the optional described_issuer key to AuthSection (#647).
• Breaking for crate users: ihe-iti 0.7.0 requires ferrohealth-smart
  0.21 and ihe-atna 0.15, and nl-generic-functions 0.7.0 requires
  ferrohealth-smart 0.21 and ihe-iti 0.7. Their public API carries the
  types of those crates (the outbound client, the endpoint table and the
  audit user), so a consumer moves to the same lines (#647).
• FerroPIX moves to ferrohealth-smart 0.22, ferrohealth-session 0.17,
  ihe-atna 0.16, ferrobridge-term 0.9 and ferrobridge-hl7v2 0.13, the
  releases on the smart line where DpopSection no longer carries
  external_url. FerroPIX sets no [auth.dpop], so no configuration key
  changes (#649).
• Breaking for crate users: ihe-iti 0.8.0 requires ferrohealth-smart
  0.22 and ihe-atna 0.16, and nl-generic-functions 0.8.0 requires
  ferrohealth-smart 0.22 and ihe-iti 0.8. Their public API carries the
  types of those crates (the outbound client, the endpoint table and the
  audit user), so a consumer moves to the same lines (#649).
• Breaking: a Basic user's scopes move out of [[auth.basic.users]],
  which holds the credential alone (user, password_hash,
  password_hash_file), into FerroPIX's own [basic_grants.<user-id>]
  table with scopes and roles. A scopes or roles key in
  [[auth.basic.users]] now refuses the start as an unknown key, and so
  does a [basic_grants] table naming a user [[auth.basic.users]] does
  not list. A granted system/ scope or role is refused as before, now
  naming basic_grants.<user-id>. Upgrade: move each user's scopes line
  into a [basic_grants.<user>] table named by its user (#651).
• FerroPIX moves to ferrohealth-smart 0.24, ferrohealth-session 0.19,
  ihe-atna 0.18, ferrobridge-term 0.10 and ferrobridge-hl7v2 0.14,
  the releases on the smart line where the caller classification asks each
  issuer's standing source. FerroPIX keeps its client lists in [auth],
  the default source, so no further configuration key changes (#651).
• Breaking for crate users: ihe-iti 0.9.0 requires ferrohealth-smart
  0.24 and ihe-atna 0.18, and nl-generic-functions 0.9.0 requires
  ferrohealth-smart 0.24 and ihe-iti 0.9. Their public API carries the
  types of those crates (the outbound client, the endpoint table and the
  audit user), so a consumer moves to the same lines (#651).
• Breaking for crate users: ihe-iti 0.10.0 reads the state of every
  Patient an ITI-93 message carries. pmir::feed::PatientIdentity now has
  active and every Patient.link, read as pmir::feed::Link with its
  LinkType (FHIR R4 link-type) and the other reference, and
  Feed::read refuses a created, updated or merged Patient that omits
  active (FeedError::NoActive) or a link with an unknown type or no
  reference (FeedError::Link). A subscriber reads an unmerge, an update
  with active true and no replaced-by link, from the message alone.
  nl-generic-functions 0.10.0 requires ihe-iti 0.10 (#656).
• The ITI-93 feed FerroPIX sends states active and the current links of
  every Patient, and a steward's revert of a merge is one message with
  both patients as they now stand, each active true with no
  replaced-by link (PMIR 1.6.0 §2:3.93.4.1.3) (#656).

Support period

Only the newest release is supported: there are no maintenance branches, no long-term-support line and no backports, and upgrading is free. Under the Cyber Resilience Act, Cadasto B.V. commits to keep publishing security fixes for at least five years after each release (Art 13(8)) and ships them only in the newest release (Art 13(10)). For this release that commitment runs until the end of November 2031 (Regulation (EU) 2024/2847 Art 13(19)); see SECURITY.md.

0.0.30

Changed

• FerroPIX moves to ferrohealth-smart 0.20, ferrohealth-session 0.15,
  ihe-atna 0.14, ferrobridge-term 0.7 and ferrobridge-hl7v2 0.10. A
  refusal of a role issuer (ConfigError::RoleIssuer) renders the issuer
  with its userinfo masked (#643).
• Breaking for crate users: ihe-iti 0.6.0 requires ferrohealth-smart
  0.20 and ihe-atna 0.14, and nl-generic-functions 0.6.0 requires
  ferrohealth-smart 0.20 and ihe-iti 0.6. Their public API carries the
  types of those crates (the outbound client, the endpoint table and the
  audit user), so a consumer moves to the same lines (#643).

Support period

Only the newest release is supported: there are no maintenance branches, no long-term-support line and no backports, and upgrading is free. Under the Cyber Resilience Act, Cadasto B.V. commits to keep publishing security fixes for at least five years after each release (Art 13(8)) and ships them only in the newest release (Art 13(10)). For this release that commitment runs until the end of November 2031 (Regulation (EU) 2024/2847 Art 13(19)); see SECURITY.md.

0.0.29

Changed

• FerroPIX moves to ferrohealth-smart 0.19, ferrohealth-session 0.14,
  ihe-atna 0.13, ferrobridge-term 0.6 and ferrobridge-hl7v2 0.9. The
  issuer [[auth.attributes]], [[auth.federation]], [[auth.party]] and
  auth.scopeless_subjects name is a SecretUrl now, so a password in its
  userinfo appears in no config check output, no written-back
  configuration and no Debug rendering (#636).
• Breaking for crate users: ihe-iti 0.5.0 requires ferrohealth-smart
  0.19 and ihe-atna 0.13, and nl-generic-functions 0.5.0 requires
  ferrohealth-smart 0.19 and ihe-iti 0.5. Their public API carries the
  types of those crates (the outbound client, the endpoint table and the
  audit user), so a consumer moves to the same lines (#636).

Fixed

• The Helm chart moves to 0.3.21 for FerroPIX 0.0.28. The v0.0.28 release
  raised the chart's appVersion without raising the chart version, so its
  chart leg refused to publish over 0.3.20. A pull request that changes the
  packaged chart now has to raise its version (#632).
• A private_key_jwt client assertion the server signs, for an OAuth 2.0
  client of an outbound lane or of [auth.issuer.introspection], is valid
  for 60 seconds, down from 300, so an authorization server that caps the
  assertion lifetime below SMART App Launch 2.2.0's five-minute ceiling
  accepts it. FerroPIX moves to ferrohealth-smart 0.19.1,
  ferrohealth-secret 0.2.1, ferrohealth-config 0.4.4,
  ferrohealth-telemetry 0.4.1, ferrohealth-server 0.8.4 and
  ferrohealth-usage-report 0.4.1; ihe-iti and nl-generic-functions
  move to 0.5.1 and take the same lines (#640).

Support period

Only the newest release is supported: there are no maintenance branches, no long-term-support line and no backports, and upgrading is free. Under the Cyber Resilience Act, Cadasto B.V. commits to keep publishing security fixes for at least five years after each release (Art 13(8)) and ships them only in the newest release (Art 13(10)). For this release that commitment runs until the end of November 2031 (Regulation (EU) 2024/2847 Art 13(19)); see SECURITY.md.

0.0.28

Fixed

• ferropix-console config check and every other rendering of the console's configuration
  show an [oidc] issuer, redirect_uri or post_logout_redirect_uri
  written with userinfo as https://***@…, never its password. The console
  moves to ferrohealth-session 0.13, which holds the three URLs as
  SecretUrl (#627).

Support period

Only the newest release is supported: there are no maintenance branches, no long-term-support line and no backports, and upgrading is free. Under the Cyber Resilience Act, Cadasto B.V. commits to keep publishing security fixes for at least five years after each release (Art 13(8)) and ships them only in the newest release (Art 13(10)). For this release that commitment runs until the end of November 2031 (Regulation (EU) 2024/2847 Art 13(19)); see SECURITY.md.

0.0.27

Added

• Each release attaches the quickstart as one self-contained compose.yaml,
  with its .sha256sum. The server's configuration and the database role
  are inlined as Compose configs, so the file needs Docker Compose 2.23.1 or
  newer and no checkout, and the README and book quick start download it
  from the latest release. scripts/quickstart/compose-configs.sh holds
  each inlined copy to its source in the repository, and CI runs the
  quickstart tour over that same file (#619).

Changed

• FerroPIX moves to ferrohealth-smart 0.18, ferrohealth-session 0.12,
  ihe-atna 0.12 and ferrobridge-term 0.5. A configured issuer is a
  SecretUrl now, so a password in an issuer's userinfo appears in no
  config check output, no written-back configuration and no Debug
  rendering. The start still refuses such an issuer, naming it masked (#624).
• Breaking for crate users: ihe-iti 0.4.0 requires ferrohealth-smart
  0.18 and ihe-atna 0.12, and nl-generic-functions 0.4.0 requires
  ferrohealth-smart 0.18 and ihe-iti 0.4. Their public API carries the
  types of those crates (the outbound client, the endpoint table and the
  audit user), so a consumer moves to the same lines. Where an
  issuer is read, use .expose(), and build one with SecretUrl::new (#624).

Removed

• The Helm chart's values schema, which refused config.auth.audience by
  name in the charts of v0.0.26. The value now reaches the server's
  configuration as an unknown key under [auth], and the config check
  each image runs over the rendered configuration refuses it. Write each
  issuer's audience under config.auth.issuer, as v0.0.26 asked (#605).

Fixed

• [auth] refuses the start on a table FerroPIX would read and never
  apply, naming the key: [auth.dpop] (FerroPIX checks no DPoP proof),
  [[auth.party]] and [auth.idp] (FerroPIX binds no login to a party),
  and a Basic user's roles (the permission table reads scopes). A
  configuration that sets one of them must drop it.
  [[auth.federation]] and [[auth.attributes]] are applied, and the book
  documents both. The IHE IUA attributes that an [[auth.attributes]] table
  reads from a token (the user's name, role, purpose of use, provider id and
  organisation) now appear on the BALP record's user agent, as BALP 1.1.4
  §3:5.7.5.4 maps them (#595).
• With [pmir] on, GET {base}/fhir/metadata declares the ITI-93 message
  as sender and as receiver, as the PMIR 1.6.0 Patient Identity Registry
  statement does: the Registry sends the feed to each subscriber. With
  [pixm] and [pdqm] on as well, the statement instantiates
  https://profiles.ihe.net/ITI/PMIR/CapabilityStatement/IHE.PMIR.PatientIdentityRegistry.
  implementation.description now names the IHE actors the instance
  serves (#597).
• docs.rs documents every module of ihe-iti and nl-generic-functions.
  Both crates turn no feature on by default, and docs.rs built them with
  their default features, so the published API reference listed no item.
  Each manifest now carries [package.metadata.docs.rs] all-features = true,
  published with ihe-iti 0.4.0 and nl-generic-functions 0.4.0, and CI builds each
  crate's docs the way docs.rs does (#598).
• An [[auth.issuer]] that sets role_claims refuses the start, naming
  auth.issuer[N].role_claims: FerroPIX's permission table reads scopes,
  so a role read from the token would never apply. Drop the key from the
  issuer's table (#616).
• The CapabilityStatement declares the Subscription Profile for PMIR,
  https://profiles.ihe.net/ITI/PMIR/StructureDefinition/IHE.PMIR.Subscription.Request,
  as the supportedProfile of Subscription. That is the profile PMIR
  1.6.0 §2:3.94.4.1.2.1 constrains an ITI-94 create with, and the profile
  the PMIR Patient Identity Registry statement declares. The statement
  declared the base IHE.PMIR.Subscription before (#617).

Support period

Only the newest release is supported: there are no maintenance branches, no long-term-support line and no backports, and upgrading is free. Under the Cyber Resilience Act, Cadasto B.V. commits to keep publishing security fixes for at least five years after each release (Art 13(8)) and ships them only in the newest release (Art 13(10)). For this release that commitment runs until the end of November 2031 (Regulation (EU) 2024/2847 Art 13(19)); see SECURITY.md.

0.0.26

Changed

• Breaking for a crate user: ihe-iti 0.3.0 and nl-generic-functions 0.3.0 require ferrohealth-smart 0.17, whose OutboundClient and endpoint tables their clients are built from, and ihe-iti requires ihe-atna 0.11. In smart 0.17 every token and introspection endpoint a configuration table names is a SecretUrl, so a password in its userinfo reaches no rendering of the running configuration. Upgrade: take ferrohealth-smart 0.17 and ihe-atna 0.11, and build OauthSection::token_endpoint with SecretUrl::new and read it with .expose(). The server and the console move to ferrohealth-smart 0.17.0, ferrohealth-session 0.11.0, ferrohealth-config 0.4.3, ferrohealth-server 0.8.2, ihe-atna 0.11.0, ferrobridge-term 0.4.0 and ferrobridge-hl7v2 0.6.0, with no configuration key changed (#591).

Fixed

• The Helm chart 0.3.18, published ahead of this release, and this release's chart 0.3.19 fix the defaults. Chart 0.3.17 could not start FerroPIX 0.0.25 at its defaults: its values set config.auth.audience, which the server stopped reading when the audience moved into each [[auth.issuer]] entry, so every install, standalone or as a dependency, stopped at start with "unknown field audience". The values carry no audience now, the values schema refuses config.auth.audience by name and points at config.auth.issuer[].audience (in the charts of this release, 0.3.18 and 0.3.19, only; the chart of the next release refuses it as any other value the server does not read), and the chart refuses to render without a config.auth.issuer entry, each with its issuer, kind and audience. Upgrade: move the audience into each issuer entry and give each its kind. CI and the release's chart leg now render the chart over every value set under deploy/helm/ci, the defaults among them, and run the server's and the console's config check over the configuration it renders, so a chart whose values its images refuse is never published (#585).

Support period

Only the newest release is supported: there are no maintenance branches, no long-term-support line and no backports, and upgrading is free. Under the Cyber Resilience Act, Cadasto B.V. commits to keep publishing security fixes for at least five years after each release (Art 13(8)) and ships them only in the newest release (Art 13(10)). For this release that commitment runs until the end of November 2031 (Regulation (EU) 2024/2847 Art 13(19)); see SECURITY.md.

0.0.25

Changed

• Breaking for a crate user: every client of ihe-iti 0.2.0 (PixmClient, PdqmClient, McsdClient, PmirSubscriber, XcpdClient) and the NviClient and MitzClient of nl-generic-functions 0.2.0 is built from ferrohealth-smart 0.16's OutboundClient, as ihe-atna's FeedRepository::new is, so a product configures each service with its shared endpoint table: the base URL, the TLS, the timeouts, no redirect, the retry table and the credential, HTTP Basic or a client credentials token with its DPoP proof and its one renewal on a 401 (IUA ITI-72 §3.72.4.3). Upgrade: build OutboundClient::build(&endpoint, key, tls) and pass it, PixmClient::new(client) for PixmClient::new(base, http), and the same for the others; MitzClient::new and unencrypted_for_development return InvalidInput. The call's timeout bounds every try the retry table allows. A credential that cannot be had is each client's Unauthenticated error over the outbound client's SendError, which XcpdError and MitzError gain, and XcpdClient::discover refuses a gateway off the origin of the table's url with XcpdError::ForeignGateway before anything is sent (#580).

Removed

• Breaking for a crate user: ihe-iti 0.2.0 drops the authorizer and smart features with the ihe_iti::authorizer module (Authorizer, Authorizable and with_authorizer, AuthorizerError, Retry, send, and smart::TokenAuthorizer), and nl-generic-functions 0.2.0 drops NviClient::with_authorizer and mitz::error::ClientError. The credential an authorizer made comes from the endpoint table of the client's OutboundClient; the send every client goes through is the new outbound feature's ihe_iti::outbound::send (#580).
• The server and the console no longer refuse by name the configuration keys
  v0.0.24 renamed or moved, under the one-release rule for removal aids: the
  millisecond, second, day and byte keys of FerroPIX's own sections
  (timeout_ms, retention_days, spool_max_bytes and the rest), the
  earlier [terminology] keys (base_url, timeout_ms, retry,
  credentials, tls) and audit.url, audit.timeout_ms and
  audit.retry_max_ms that moved under endpoint, the renamed keys of the
  shared [server], [auth], [telemetry], [session] and [oidc]
  sections, and the console's pix.timeout_ms. Each now fails at start as
  an unknown key, named in the refusal; write the key that replaced it, as
  the v0.0.24 entries say (#582).

Support period

Only the newest release is supported: there are no maintenance branches, no long-term-support line and no backports, and upgrading is free. Under the Cyber Resilience Act, Cadasto B.V. commits to keep publishing security fixes for at least five years after each release (Art 13(8)) and ships them only in the newest release (Art 13(10)). For this release that commitment runs until the end of November 2031 (Regulation (EU) 2024/2847 Art 13(19)); see SECURITY.md.

0.0.24

Changed

• The ITI-21 RSP^K22 is checked against RSP_K21 as IHE ITI TF-2 constrains it before it leaves: QRI optional (Table 3.21-6) and QPD-3 repeating, one parameter a repetition (§3.21.4.1.2.3), through ferrobridge-hl7v2 0.4.0's IHE_ITI_21. An answer that does not conform, such as a PID with no name, is answered AE, as the RSP^K23 is (#538).
• The compose quickstart and the Helm chart's CI values run the development OpenID Provider mock-oauth2-server 6.1.5, and the release and image scans run Trivy 0.76.2 (#557).
• ihe-iti 0.0.84 requires ferrohealth-smart 0.15 (caret 0.15.0) and ihe-atna 0.9 (caret 0.9.0), and nl-generic-functions 0.0.51 requires ferrohealth-smart 0.15 and ihe-iti 0.0.84. Both name ferrohealth-smart and ihe-atna types in their public API, so a product on those lines needs this release; no signature of either crate moves. Upgrade: move ferrohealth-smart to 0.15.0 and ihe-atna to 0.9.0 beside them (#561).
• Breaking for an operator: the server and the console move to ferrohealth-smart 0.15.1, ferrohealth-session 0.9.0, ihe-atna 0.9.1, ferrohealth-config 0.4.0, ferrohealth-server 0.8.0, ferrohealth-telemetry 0.4.0 and ferrohealth-usage-report 0.4.0, so the lock holds one copy of each family crate. Every span of time and size in the sections those crates own is now a string with its unit, under a key that names none, and a bare number is refused. Upgrade: in [server] write body_limit = "1MiB", request_timeout, header_read_timeout, idle_timeout, drain_delay, shutdown_timeout, retry_after and compression_min_size (each was …_ms, …_s or …_bytes) and [server.tls] reload_interval; in each [[auth.issuer]] write clock_skew, jwks_max_age, jwks_refresh_interval and timeout, with introspection.cache_max_age, [auth.basic] cache_ttl and the OAuth tables' refresh_margin and timeout; move auth.ca_file to [auth.tls] trust_roots_file, and the OTLP collector's trust_roots_file and client_identity_file under [telemetry.otlp.tls]. In the console write [session] sign_in_timeout, idle_timeout and absolute_timeout ("30min", not idle_timeout_s = 1800) and [oidc] timeout, and move oidc.ca_file to [oidc.tls] trust_roots_file. Each old key fails the start as an unknown key, and the loader names the new one where it can. The [auth] keys of the shapes before ferrohealth-smart 0.9 now fail as unknown keys too, without naming their replacement (#561).
• Breaking for an operator: FerroPIX's own sections write every span of time and size the same way, under a key that names no unit. Upgrade: [audit] spool_max_size = "64MiB" and spool_write_timeout, with the delivery's timeout and retry.max_backoff under [audit.endpoint] (below); [outbox] retention = "30d"; [pmir.feed] initial_backoff and max_backoff; [hl7v2] frame_limit, idle_timeout and frame_timeout, each consumer's connect_timeout and reply_timeout, and [hl7v2.notification] initial_backoff and max_backoff; [xcpd] delivery_initial_backoff, delivery_max_backoff and delivery_timeout; the terminology server's timeout with its retry.initial_backoff and retry.max_backoff under [terminology.endpoint] (below); and the console's [pix] timeout. In this release each old key refuses the start and names the key that replaces it, all of them in one refusal; from the next release each fails as an unknown key (#561).
• Breaking for a crate user: ihe-iti 0.1.0 requires ferrohealth-smart 0.16 (caret 0.16.0) and ihe-atna 0.10 (caret 0.10.0), and nl-generic-functions 0.1.0 requires ferrohealth-smart 0.16 and ihe-iti 0.1.0. Both name ferrohealth-smart and ihe-atna types in their public API, so the move of those public dependencies takes each crate's minor step, and a product on those lines needs this release; no signature of either crate moves. Upgrade: move ferrohealth-smart to 0.16.0 and ihe-atna to 0.10.0 beside them (#571).
• Breaking for an operator: the server reaches the audit repository and the terminology server through ferrohealth-smart's outbound client, each configured by its endpoint table, so the lock holds one copy of each family crate (ferrohealth-smart 0.16.2, ferrohealth-session 0.10.0, ihe-atna 0.10.0, ferrohealth-config 0.4.1, ferrohealth-server 0.8.1, ferrobridge-term 0.3.0, ferrobridge-hl7v2 0.5.0). Upgrade: write the audit repository as [audit.endpoint] with url, timeout and [audit.endpoint.retry] max_backoff (was audit.url, audit.timeout_ms and audit.retry_max_ms); its max_backoff is also the wait between two delivery rounds, and the table takes connect_timeout, retry.max_attempts, tls and credentials (HTTP Basic or the client credentials grant) as well. Write the terminology server as [terminology.endpoint] with url, timeout, retry, credentials and tls (was terminology.base_url, timeout_ms, [terminology.retry], [terminology.credentials] and [terminology.tls]); compose and the Helm chart (0.3.16) name it FERROPIX__TERMINOLOGY__ENDPOINT__URL and config.terminology.endpoint.url. In this release each old key refuses the start and names its place under the endpoint table; from the next release each fails as an unknown key (#571).
• A configuration the server or the console does not start on is refused with a line that opens cannot start (exit 78), and healthcheck with one that opens not up (exit 1), through ferrohealth-server's run path; the server's line opened the configuration is refused before (#571).
• ihe-iti 0.1.0 and nl-generic-functions 0.1.0 require the FerroBRIDGE crates by caret ranges, fhir-search 0.1.130 and fhir-types 0.1.130, where ihe-iti 0.0.84 required fhir-search exactly, so a product whose other family crates take another compatible patch of them builds with one copy (#543) (#571).
• The keys of the family sections that v0.0.24 renamed are refused by name in this release, each with the key that replaces it, all of them in one refusal, read from the file, the environment and --set before the rest of the configuration. On the server: [server] request_timeout_ms, header_read_timeout_ms, idle_timeout_ms, body_limit_bytes, drain_delay_ms, shutdown_timeout_ms, retry_after_s, compression_min_bytes and tls.reload_interval_s; auth.ca_file, auth.basic.cache_ttl_seconds, auth.dpop.max_age_seconds and clock_skew_seconds; each [[auth.issuer]] entry's clock_skew_seconds, jwks_max_age_seconds, jwks_refresh_interval_seconds, timeout_ms and introspection.cache_max_age_seconds; the OAuth tables' refresh_margin_ms, timeout_ms, ca_file, client_certificate_file, client_key_file and previous_key_overlap_ms; and the OTLP collector's trust_roots_file and client_identity_file. On the console: [session] sign_in_timeout_s, idle_timeout_s and absolute_timeout_s, [oidc] timeout_s and ca_file, [oidc.tls] client_certificate, client_key and client_key_file, and the OTLP collector's files. From the next release each fails as an unknown key (#575).

Removed

• The named refusal of [xcpd] client_certificate_file, client_key_file and reply_trust_file, which v0.0.22 retired in favour of [xcpd.tls]. Each key now fails the start as an unknown key of [xcpd] (#561).

Fixed

• The server exports its spans and metrics over the TLS [telemetry.otlp.tls] names: it installs its telemetry through ferrohealth-server's installer, which reads the collector's trust roots and client identity, where before it built the exporter without them (#571).

Support period

Only the newest release is supported: there are no maintenance branches, no long-term-support line and no backports, and upgrading is free. Under the Cyber Resilience Act, Cadasto B.V. commits to keep publishing security fixes for at least five years after each release (Art 13(8)) and ships them only in the newest release (Art 13(10)). For this release that commitment runs until the end of November 2031 (Regulation (EU) 2024/2847 Art 13(19)); see SECURITY.md.

0.0.23

The re-cut of v0.0.22, whose release run published nothing. Read the
v0.0.22 section below for what this release changes: the HL7 v2 face needs
the new [terminology] section before you upgrade. Nothing else in the
server, the console or the crates differs from v0.0.22.

Fixed

• v0.0.22 was tagged, and its release run published nothing: the performance gate handed the v0.0.21 server it measures against a [terminology] setting that release does not know, so the run could not judge it. The gate now hands each server only the settings its own source defines. v0.0.23 is the first published release with the changes of v0.0.22, and changes nothing else in the server, the console or the crates (#568).

Support period

Only the newest release is supported: there are no maintenance branches, no long-term-support line and no backports, and upgrading is free. Under the Cyber Resilience Act, Cadasto B.V. commits to keep publishing security fixes for at least five years after each release (Art 13(8)) and ships them only in the newest release (Art 13(10)). For this release that commitment runs until the end of November 2031 (Regulation (EU) 2024/2847 Art 13(19)); see SECURITY.md.