Skip to content

v3.2.0

Choose a tag to compare

View all tags
@mechanik-daniel mechanik-daniel released this 30 Sep 08:49
· 1 commit to main since this release
v3.2.0
cd49639
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

FUME Community 3.2.0

This release strengthens the HTTP error contract, updates the FUME mapping runtime, and improves FHIR package installation compatibility.

HTTP error redaction

Verbose HTTP error responses are now filtered at the FUME Community API boundary. Undeclared nested error data, including raw sourceError objects, request configuration, authentication details, and other upstream payload fragments, is removed before a response is returned.

The OpenAPI schema and runtime response now consistently use fhirParent. Diagnostics received from an upstream dependency that still use instanceOf are normalized to fhirParent for compatibility.

Clients using ?verbose=true should rely only on the documented diagnostic fields: code, message, position, start, line, fhirParent, fhirElement, severity, level, and timestamp.

Updated dependencies and runtime behavior

FHIR package installation

FUME Community now uses fhir-package-installer 1.13.1. When a downloaded FHIR package does not include package/.index.json, installation now creates a strict FHIR-spec-compatible legacy index while retaining the richer internal .fpi.index.json. Existing package-provided .index.json files are preserved. This applies to both package materialization and tarball extraction.

FHIR client behavior

FUME Community now uses @outburn/fhir-client 1.6.0. HTTP transport failures used by FHIR operations are normalized to the package's supported safe error contract instead of exposing raw Axios errors. This complements the HTTP response redaction described above by preventing Axios request configuration and nested authentication data from reaching serialized error payloads.

Mappings that use paginated $search calls can now apply an inline FUME function as a transform when fetchAll: true is enabled. The transform runs for every fetched resource, including included resources; returning no value filters that resource from the result. maxResults continues to apply before transform filtering.

FUME mapping runtime

FUME Community now uses fumifier 2.4.0, which adds the following mapping capabilities:

  • Higher-order functions: $safe, $all, $any, and $memoize.
  • Formatting support for $rightNow(), plus date, dateTime, instant, and time aliases for $now(), $fromMillis(), and $rightNow().
  • Canonical UTC conversion when numeric epoch-millisecond values are assigned to FHIR date, dateTime, or instant primitives. Invalid, non-finite, or out-of-range numeric values now raise F5111 instead of being emitted as strings.

The runtime update also fixes nested block comments, FLASH wildcard assignments such as $value := *;, nested array pattern injection, parser recovery around regular expressions and division, and diagnostic source locations. Verbose diagnostics retain more accurate helper and function-call positions.

Upgrade notes

  • Nested sourceError, error, and cause payloads are no longer available in verbose HTTP diagnostics or wrapped mapping errors. Consume the documented safe fields instead.
  • Consumers of exported mapping ASTs or browser tokens should read regular-expression metadata from value and flags; live RegExp instances are no longer exposed.
  • $memoize() rejects argument trees containing functions or symbols.
  • $search transforms are valid only with fetchAll: true.

Build and distribution

  • CI and container builds now run on Node.js 24.
  • The published Docker image now uses the Node.js 24 Alpine base image, reducing the base image vulnerability exposure.

Dependency release notes

What's Changed

Full Changelog: v3.1.1...v3.2.0

Contributors

mechanik-daniel
Assets 2
Loading