Changed

• $lookup errors now say whether the code or the code system was not found, and $lookup returns code as a property when asked for it
• $validate-code for an unknown code now returns the code system version when one was requested
• $lookup now always returns system and version, including when specific properties are requested
• The terminology capabilities (/metadata?mode=terminology) now describe the running server (kind = instance)
• $validate (new engine) reports more of the reference validator's findings, including relative canonicals, Bundle reference rules and empty elements

Fixed

• Fixed CodeSystem upload failing when a designation is longer than 32,766 bytes
• Fixed requests such as CodeSystem/$subsumes/_history returning the full CodeSystem history instead of an error
• Fixed bug where $validate-code for a CodeableConcept reported valid codings as unknown when another coding's CodeSystem, or CodeSystem version, was not on the server
• Fixed bug where uploading a complete CodeSystem that declares count through the streaming index endpoint always failed
• Fixed bug where $validate-code reported a CodeSystem version as unknown while listing it as valid, when the newest revision's index needed repair
• Fixed bug where $expand did not apply CodeSystem supplements that name no version (or only a SNOMED CT edition), and failed on property filters using them
• Fixed bug where CodeSystem/$validate-code named an empty value set when no coding of a CodeableConcept was valid

Security

• Updated library versions to mitigate CVEs:
  • CVE-2026-19032
  • CVE-2026-68497
  • CVE-2026-71497
  • CVE-2026-73581
  • CVE-2026-75140
  • CVE-2026-75973
  • CVE-2026-76183
  • CVE-2026-77756
  • CVE-2026-77762
  • CVE-2026-77791
  • CVE-2026-78383
  • CVE-2026-78437
  • CVE-2026-79677
  • CVE-2026-83557
  • CVE-2026-86248
  • CVE-2026-86350
  • CVE-2026-87022
  • CVE-2026-89407
  • CVE-2026-89425
  • CVE-2026-91776
  • CVE-2026-91777
• Updated base image packages to mitigate CVEs:
  • CVE-2026-35189
  • CVE-2026-35191
  • CVE-2026-42772
  • CVE-2026-54872
  • CVE-2026-54873
  • CVE-2026-54875
  • CVE-2026-72897
  • CVE-2026-75804
  • CVE-2026-75805
  • CVE-2026-75806
  • CVE-2026-77696
  • CVE-2026-84782
  • CVE-2026-84784
  • CVE-2026-85091
  • CVE-2026-103111
• Removed GNU Wget from the Docker image to mitigate CVEs:
  • CVE-2026-58469
  • CVE-2026-58470
  • CVE-2026-58471
  • CVE-2026-58472
• Known CVEs:
  • CVE-2025-60876 (BusyBox wget, no fix available; not exploitable, as the image only uses wget for fixed requests to Ontoserver itself)

Changed

• meta.lastUpdated is now assigned by the database rather than the clock of the node handling the write
• Concurrent updates of the same resource are now applied in turn rather than failing with 409 (a stale If-Match still returns 412)
• Added per-type OperationDefinitions for $validate-code and $batch-validate-code, replacing the merged CodeSystemValueSet-* ones
• Added separate OperationDefinitions for system-level $diff (from/to) and instance-level {id}/$diff (fromVersion)
• Database migration now enforces unique (id, meta_version) per resource table and stops if duplicates exist
  • Set ontoserver.db.migration.cleanupDuplicateEntries to the affected table names to remove them on next start
• Added a faster $validate engine, in beta (opt in with ontoserver.validator.engine=new); the default remains hapi

Fixed

• Fixed regression (since 6.26.0) where $validate-code returned result=false for a CodeableConcept with a valid coding alongside a coding from an unknown CodeSystem
• Fixed regression (since 6.25.0) where instance $diff without fromVersion failed with a server error
• Fixed bug where _history/[version]/$diff diffed from the newest version instead of the preceding one
• Fixed bug where a cached $diff could be reused when includeMeta changed
• Fixed bug where system $diff returned a patch instead of 404 when from or to did not exist
• Fixed bug where instance $diff with an empty fromVersion diffed from the current version
• Fixed bug where $diff to a deleted Resource version failed or returned an empty delete
• Fixed bug where system $diff of mismatched Resource types failed with a server error
• Fixed bug where system $diff rejected Subscription Resources
• Fixed bug where $diff included meta in a whole-Resource insert when includeMeta was not set
• Fixed bug where $validate-code reported a CodeableConcept as not in the value set when its CodeSystem was missing, so it could not be checked
• Fixed bug (since 6.26.0) where FHIR search result Bundles had a quoted string as Bundle.id
• Fixed bug where PostgreSQL requests failed on a serialisation conflict or deadlock instead of being retried
• Fixed bug where a concurrent read could re-populate caches with the resource version being replaced
• Fixed bug where a superseded resource version could be read, searched or syndicated
• Fixed bug where _history?_since= and syndication polling could skip a version with an out-of-order meta.lastUpdated
• Fixed regression (since 6.25.0) where concurrent creates of the same new resource could both succeed, leaving duplicates
• Fixed bug where a request losing a concurrent write race returned 500 instead of 409
• Fixed bug where creating a resource waited for other in-progress creates of the same type (e.g., CodeSystem indexing)
• Fixed bug where paging search results or history was inconsistent when rows tied on the sort field
• Fixed bug where a search could report another resource type's total (e.g., CodeSystem search returning the StructureDefinition count)
• Fixed bug where date search prefixes (lt, le, gt, ge, eq, ne) compared against the wrong end of the searched period
• Fixed bug where rebuilding a missing local index during a read could lose the SNOMED CT or LOINC index version and checksum
• Fixed bug where rebuilding a missing local index during a read required write permission on the CodeSystem
• Fixed bug where repairing a SNOMED CT or LOINC index failed or reverted when its syndication zip could not be recreated
• Fixed bug where a failed index upgrade could leave a CodeSystem without an index
• Fixed bug where concurrent preloads could fail a feed entry and lose its resource
• Fixed bug where concurrent notifications to one Subscription could skip an event-number increment
• Fixed bug where a Subscription's event-number restarted from 0 when the Subscription got a new version
• Fixed bug where $translate rejected a request supplying the same dependency element more than once

Security

• Updated library versions to mitigate CVEs:
  • CVE-2026-49844
  • CVE-2026-54399
  • CVE-2026-54428
  • CVE-2026-64607
  • CVE-2026-65182
  • CVE-2026-65183
  • CVE-2026-65637
  • CVE-2026-65905
  • CVE-2026-65927
  • CVE-2026-66299
  • CVE-2026-66422
  • CVE-2026-68525
  • CVE-2026-68569
  • CVE-2026-68763
  • CVE-2026-73180
  • CVE-2026-73508
• Updated base image packages to mitigate CVEs:
  • CVE-2026-14456
  • CVE-2026-14457
  • CVE-2026-18798
  • CVE-2026-32316
  • CVE-2026-40164
  • CVE-2026-41254
  • CVE-2026-47063
  • CVE-2026-49839
  • CVE-2026-54874
  • CVE-2026-62574
  • CVE-2026-63072
  • CVE-2026-63073
  • CVE-2026-63075
  • CVE-2026-63076
  • CVE-2026-75803

Changed

• Improved performance of ValueSet resolution by URL
• Improved indexing failure messages to report which syndication entries were considered and why each was unusable
• Bulk indexing now rejects unusable syndication entries while planning and reports them as a single warning naming the artifact type
• A feed whose RF2 entries are all of an unusable type is now reported as an error rather than an empty success
• Bulk indexing now skips, without downloading, SNOMED CT entries that depend on unpublished Edition content
• The syndication entry and download URL used for indexing are now logged
• X-Request-Id and X-Correlation-Id values may now contain any printable ASCII character, up to 200 characters
• Index reader and spelling index caches are now bounded by memory rather than count; limits are configurable
• Added support for indexing SNOMED CT SCT_RF2_ALL syndication entries (treated as SCT_RF2_FULL)

Fixed

• Fixed bug where Bundles were rejected with a 503 despite ample free heap
• Fixed bug where designation order could change each time a code system was indexed; designations are now in source order
• Fixed $translate source output parameter to be a uri not a string
• Fixed bug where a restart with an unreachable syndication feed could delete an existing SNOMED CT or LOINC index
• Fixed bug where a code system with an intact index was treated as missing, or withdrawn from syndication, when a feed was unreachable at startup
• Fixed bug where a failed index upgrade left the code system unusable instead of restoring the previous index
• Fixed encoding error in config leading to extraneous characters in /fhir/metadata and certain SNOMED Edition names
• Fixed bug where a malformed syndication feed entry stopped the search for later entries
• Fixed bug where an RF2 row with no effective time was dated from the release's primary module rather than its own module
• Fixed bug where the OpenAPI specification omitted the terminology operations ($expand, $lookup, $translate, etc.)
• Fixed bug where a ValueSet defined by the FHIR specification failed to resolve during validation and for $expand with context
• Fixed bug where ValueSet.version was ignored when choosing a CodeSystem version for a ValueSet supplied directly to $expand or $validate-code
• Fixed bug where a failed CodeSystem create or update removed the existing version's index and left index files behind for the unsaved version
• Fixed bug where a failed CodeSystem delete removed the index, leaving a code system that could be read but not expanded or searched
• Fixed bug where requests concurrent with a CodeSystem update could briefly fail as the old index was removed too early
• Fixed bug where transient Oracle serialization failures at commit were not retried
• Fixed regression (since 6.24.2) where Resource validation did not check codes against non-stored code systems such as SNOMED CT
• Fixed bug where validation treated a code system the user may not read as checkable; its codes are now reported as unvalidated rather than invalid
• Fixed bug where an implicit ?vs ValueSet was resolved for a user who may not read the underlying code system
• Fixed bug where errors revealed the existence and versions of a code system the user may not read; it is now reported as not present
• Fixed bug where CodeSystem/$lookup with useSupplement did not use the supplement's translated designation as the display
• Fixed bug where translated displays were not returned for an unqualified preferred language (e.g., fr rather than fr-FR)
• Fixed bug where ConceptMap/$translate did not return match displays in the client's preferred language
• Fixed bug where a starting container was reported as unhealthy before the server had time to come up
• Fixed bug where terminology OperationDefinition resources declared non-FHIR parameter types

Changed

• Reverted date-format-specific version sorting changes for behaviour stability

Security

• Updated library versions to mitigate CVEs:
  • CVE-2026-54291
  • CVE-2026-59889

Fixed

• Fixed bug where selecting the latest Resource version failed for mixed numbering schemes (e.g., 2018-08-12 and 2.1.0)
  • Indistinguishable versions are now ranked by resource date

Security

• Updated library versions to mitigate CVEs:
  • CVE-2026-59083
  • CVE-2026-59084

Changed

• Added atom.preload.sync (default false) to delete preloaded content no longer in any preload feed on read-only deployments
  • Deletion cap atom.preload.sync.deleteLimit (default 10; < 0 unbounded; per-run override POST /synd/redoPreload?deleteLimit=N) and dry-run mode atom.preload.sync.dryRun
• Syndication retractions are now order-independent and prevent installation of the retracted content within the same preload
  • Applies to FHIR_CodeSystem/ConceptMap/ValueSet/StructureDefinition_RETRACT; BINARY_RETRACT/LOINC_RETRACT remain unimplemented and are ignored
• Reduced memory use for SNOMED CT indexing; International and AU now index within an 8GB heap
• SNOMED CT OWL representation is now taken from the OWL Expression reference sets rather than reconstructed from stated relationships

Fixed

• Fixed bug where $expand of a VCL ValueSet with useSupplement ignored supplement-only designations
• Fixed bug where VCL descendant-leaf !!<X returned X itself instead of its leaf descendants
• Fixed bug where VCL exists filters (e.g., parent ? true) matched nothing for true and everything for false
• Fixed bug where syndication retract of a ValueSet, ConceptMap, or StructureDefinition did not delete the resource
• Fixed bug where manual /synd retraction did not apply the preload date guard
  • A resource dated equal to the retraction is deleted; one with no date is spared and logged
• Fixed bug where $validate-code with inferSystem=true and no system returned a 500 when the ValueSet's CodeSystem could not be resolved

Security

• Updated library versions to mitigate CVEs:
  • CVE-2026-50229
  • CVE-2026-53404
  • CVE-2026-53434
  • CVE-2026-54515
  • CVE-2026-55276
  • CVE-2026-55955
  • CVE-2026-55956

Fixed

• Fixed bug where $expand and $validate-code could include inactive concepts for a ValueSet with compose.inactive = false

Fixed

• Fixed bug where Resource $validate ignored Coding.version, giving false “Unknown code” errors
• Fixed $validate-code status output parameter to be a code not a string
• Fixed possible NPE when syndicating LOINC Binary indexes (ONT-5624)
• Fixed potential bug parsing a syndication feed's atomSyndicationFormatProfile element

Security

• Updated library versions to mitigate CVEs:
  • CVE-2026-2100
  • CVE-2026-55470
  • CVE-2026-55471

Changed

• Added finer canonical version matching to syndication feed filtering (/synd/syndication.xml?canonical=...)
  • url or url|* matches any version, url| only versionless entries, url|1.0 that exact version
• Syndication index upload now honours Retry-After, falling back to ontoserver.index.upload.retry.wait (default 60s)
• Syndication index upload now fails fast on 403 and 422 instead of retrying

Fixed

• Fixed bug where syndication feed fhirVersion filtering dropped entries whose url already carried a fhirVersion parameter
• Fixed bug where syndication index upload retries could fail with “Connection manager has been shut down”
• Fixed bug where a 409 duplicate entry on index upload was treated as a failure
• Fixed bug where 4xx responses and client aborts were reported as Sentry issues
• Fixed bug where deleting a CodeSystem could leave a corrupt index directory (stray .nfsXXXX files) on NFS/EFS storage
• Fixed bug where $validate failed outright, rather than reporting an issue, for a missing or ambiguous terminology resource

Security

• Updated library versions to mitigate CVEs:
  • CVE-2026-22016
  • CVE-2026-34282
  • CVE-2026-41284
  • CVE-2026-41293
  • CVE-2026-42498
  • CVE-2026-43512
  • CVE-2026-43513
  • CVE-2026-43515
  • CVE-2026-43869
  • CVE-2026-44249
  • CVE-2026-44894
  • CVE-2026-45367
  • CVE-2026-45416
  • CVE-2026-45447
  • CVE-2026-45674
  • CVE-2026-47691
  • CVE-2026-50010
• Fixed potential XSS with stored resources; resource url/version are now HTML-escaped in _format=html views
• Added restrictive Content-Security-Policy to generated HTML resource views
• JWT aud claim is now enforced when ontoserver.security.audience is set (previously unchecked)

Changed

• Bundle search with _sort=_identifier now returns 400 Bad Request, consistent with other unsupported sort keys
• FHIR CodeSystem index format changed to 2.9.2; standards-status=deprecated/withdrawn no longer implies inactive
  • Existing indexes are rebuilt on startup
• $validate-code against a fragment CodeSystem now returns result = true with a warning when the code is not present
• Added support for useSupplement parameter on CodeSystem/$lookup
• CodeSystem/$lookup now uses the same RFC 4647 language matching as $expand and $validate-code (ONT-3511)
• ValueSet/$expand now always includes the status property for concepts with deprecated or withdrawn standards-status
• CodeSystem supplements (stored or tx-resource) no longer need a versioned base reference, except SNOMED supplements with post-coordinated expressions
• Added support for check-system-version and force-system-version on $validate-code and $expand
• system-version parameter now accepts wildcards (e.g., 1.x.x)
• $validate-code now honours abstract=false by rejecting abstract (notSelectable) codes
• $validate-code on a CodeableConcept with multiple codings now returns result=false if any coding has a non-display error
• Improved memory usage when paging large FHIR search result sets
• Added ontoserver.fhir.search.too.costly.threshold (default 200000) to cap FHIR search result sets
  • Above the cap Bundle.total is omitted and pages carry an incomplete OperationOutcome
• JGroups cluster channel name now has a version suffix (<ontoserver.cluster.name>.v<N>) so nodes only cluster with compatible cache formats

Fixed

• Fixed bug where $lookup returned definition nested as a property sub-parameter rather than top-level
• Fixed regression (since 6.23.0) where $validate skipped the diagnostic for CodeSystem.property entries without a uri (ONT-5549)
• Fixed displayLanguage/Accept-Language matching so a listed language beats a region-only same-language fallback (ONT-5481, ONT-3511)
• Fixed bug where VCL $expand failed with a NullPointerException when the leading term had no code system in scope
• Fixed bug where a bare VCL ^<valueset> reference expanded to an empty result
• Fixed VCL SNOMED CT version handling
  • An Edition URI resolves to its latest version; unversioned http://snomed.info/sct to the default Edition; http://snomed.info/sct/<edition> as a system URI is rejected
• Improved matching of displayLanguage to ValueSet languages (ONT-5481)
• Improved error message when an uploaded LOINC release is missing an expected folder (ONT-3343)

Security

• Updated library versions to mitigate CVEs:
  • CVE-2026-42198
  • CVE-2026-42577
  • CVE-2026-42579

Changed

• Added ontoserver.fhir.expand.timeoutSeconds to abort long-running $expand requests with HTTP 408 (default 0, disabled)

Fixed

• Fixed bug (since 6.23.1) where validating Resources referencing UCUM, BCP 13, BCP 47, or ISO 3166 codes errored with “CodeSystem is unknown” (ONT-5529)
• Fixed AmbiguousResourceException for trailing-zero version variants (e.g., 2.9 and 2.9.0); now treated as equivalent (ONT-5529)
• Improved behaviour when the server is flooded with large batch requests

Changed

• Added support for :above, :below, and :missing modifiers on the ValueSet reference search parameter
• Improved performance of $expand and $validate-code

Fixed

• Fixed bug where SQL LIKE metacharacters (%, _, \) in search values acted as wildcards
• Fixed bug where bare-number search terms (e.g., 1000) did not match designations with comma thousands separators (1,000)
• Fixed DateTimeParseException when importing LOINC or SNOMED CT Binary Indexes via syndication (no re-indexing required)
• Fixed bug where ValueSet/$validate gave an internal error for unknown codes after the first compose.include.concept (ONT-5503)
• Fixed bug where $expand returned an internal error, rather than 4xx, when the context parameter or its bound ValueSet could not be resolved

Fixed

• Fixed default SNOMED French language reference set configuration (from 722131000 to 10031000315102)
• Updated $expand displayLanguage logic and SNOMED language aliases to align with $validate-code

Security

• Updated library versions to mitigate CVEs:
  • CVE-2026-34483
  • CVE-2026-34486
  • CVE-2026-34487
  • CVE-2026-34500
  • CVE-2026-40200

Security

• Hardened healthcheck.sh against CVE-2025-60876 (BusyBox wget URL injection) by validating the PORT environment variable and shadowing BusyBox wget with full GNU wget
• Updated library versions to mitigate CVEs:
  • CVE-2025-67030
  • CVE-2026-1605
  • CVE-2026-22731
  • CVE-2026-22732
  • CVE-2026-22733
  • CVE-2026-22735
  • CVE-2026-22737
  • CVE-2026-24734
  • CVE-2026-33180
  • CVE-2026-34359
  • CVE-2026-34361
  • GHSA-2m67-wjpj-xhg9

Changed

• Index standards-status extension as a concept status property and use it for inactive determination in FHIR CodeSystems (FHIR index version has been incremented to 2.9.1)
• Added OpenTelemetry support via spring-boot-starter-opentelemetry. Disabled by default; enable with management.tracing.enabled=true and configure management.otlp.tracing.endpoint.
• Added $batch-validate-code operation on both ValueSet and CodeSystem for validating multiple codes in a single request
• Added lenient-display-validation and valueset-membership-only boolean parameters on $validate-code to replace the deprecated mode and valuesetMode string parameters
• The deprecated version expansion parameter in $expand responses is now controlled by ontoserver.feature.compat.expandVersionParameter (default true); the standard used-codesystem parameter is always included
• Set meta.source on resources loaded from FHIR packages to the package canonical URL

Deprecated

• The mode and valuesetMode string parameters on $validate-code are deprecated in favour of lenient-display-validation and valueset-membership-only boolean parameters

Fixed

• Fix SNOMED RF2 snapshot filter non-deterministically discarding active rows when two rows share the same key (id, effectiveTime) but differ in active status (as per TRAG conclusion).
• Fix semver version sorting to follow full semver spec (pre-release precedence, build metadata)
• When an explicit ValueSet overlaps an implicit ‘all codes’ ValueSet, compose.include.version is now honoured rather than silently overwritten. Version is resolved from include.version, then system-version parameters, then ValueSet.version, then defaults to the sole CodeSystem version (ONT-5239)
• Fixed healthcheck.sh initialization wget failing with a TLS certificate error when ONTOSERVER_INSECURE=false (HTTPS mode). The wget call that triggers FHIR metadata initialization now passes --no-check-certificate to tolerate the bundled self-signed keystore.
• Improved error messages for invalid ValueSet filter operations with structured OperationOutcome, message IDs, and expression paths

Security

• Updated library versions to mitigate CVEs:
  • CVE-2026-22184
  • CVE-2026-27171
  • GHSA-72hv-8253-57qq

Fixed

• Fixed race condition introduced in 6.24.0 with the expansion query cache that could cause ValueSet $expand to intermittently return total:0 under concurrent load
• Fixed bug that prevented query caching from being disabled via ontoserver.cache.expansionQueries=false

Security

• Updated library versions to mitigate CVEs:
  • CVE-2025-15467
  • CVE-2025-66021 (branch build of owasp-java-html-sanitizer superseded by official release)
  • CVE-2025-69419
  • CVE-2025-69421
  • CVE-2026-21932
  • CVE-2026-21945

Fixed

• Fix additional IndexReader already closed errors (follow-up to 6.24.0)
• Fix UnsupportedOperationException when evaluating authorization scopes
• Fix ECL prefix queries failing when searching across multiple CodeSystems
• Fix potential errors when extracting ZIP files with nested directories

Security

• Updated library versions to mitigate CVEs:
  • CVE-2025-66021

Fixed

• Fix bug where IndexReaders could be prematurely closed.
• Fixed bug with evaluation of gt, lt and eb prefixes for dateTime in ValueSet filters
• Fix bug where malformed release_package_information.json file in SNOMED RF2 could produce an NPE.

Changed

• FHIR Subscriptions can now be enabled using the ontoserver.fhir.subscriptions.enabled=true configuration
  • This is based on the Subscriptions R5 Backport IG
  • Currently supported Subscription topics are changes to CodeSystem, ValueSet, ConceptMap, NamingSystem, StructureDefinition resources, as well as Subscriptions themselves
  • The only Subscription.channelType supported is rest-hook
  • The only Subscription.content supported is id-only
  • This implementation is intended for trial use. We would welcome feedback.
  • More information can be found at https://ontoserver.csiro.au/docs/6/subscriptions.html
• Include CodeSystem supplements in TerminologyCapabilities along with content-type in an R5 extension
• Expire IndexReader cache entries after ontoserver.cache.indexer.maxAgeMinutes minutes (default 30)
• Added designation filter support as per this proposal https://jira.hl7.org/browse/FHIR-36651?focusedCommentId=251481

Fixed

• Reverted an upgrade to infinispan dependency that complicated upgrades of scaled servers

Security

• Updated library versions to mitigate CVEs:
  • CVE-2025-55752
  • CVE-2025-41248
  • CVE-2025-41249

Fixed

• Fixed bug where implicit ValueSets “defined” by tx-resources were not properly handled.
• Fixed bug (since 6.22.6) affecting ValueSets referencing CodeSystems/ValueSets from the FHIR spec
• Fixed bug where codes in ValueSet.compose.include.concept would not be checked during validation
• Fixed bug where a declared CodeSystem property of “status” with a URL other than http://hl7.org/fhir/concept-properties#status and type of code would still be treated as having the FHIR status semantics
• Fixed bug regarding filters on decimal properties that used scientific notation for the filter value
• Fixed bug where a ValueSearch by URL with no matches would return an OperationOutcome instead of an empty Bundle.

Changed

• Added support for customizing elements in the metadata resources:
  • name, title and purpose of CapabilityStatement and TerminologyCapabilities
  • text.div of CapabilityStatement
  • text.div of TerminologyCapabilities
• Added support for searching CodeSystem, ValueSet, ConceptMap, NamingSystem, and StructureDefinition by date
• The deprecated expansion parameter version is now omitted by default (see used-codesystem instead). This behaviour is controlled by the ontoserver.feature.compat.expandVersionParameter configuration parameter.

Security

• Updated library versions to mitigate CVEs:
  • CVE-2025-7962
  • CVE-2025-41242
  • CVE-2025-48989

Fixed

• Fixed caching bug with respect to the activeOnly parameter in $expand
• Fixed missing logging of X-Request-Id and X-Correlation-Id values

Changed

• Support parameterised ValueSets as per https://build.fhir.org/ig/FHIR/fhir-tools-ig/parameterized-valuesets.html
• Added support for implicit ValueSets in ValueSet search by url.

Security

• Updated library versions to mitigate CVEs:
  • CVE-2025-30749
  • CVE-2025-48976
  • CVE-2025-48988
  • CVE-2025-49146
  • CVE-2025-50059
  • CVE-2025-50106

Fixed

• Added special handling of Norwegian language codes for SNOMED CT translations.
• The configuration option ontoserver.feature.identifier-resolition-enabled has been renamed to ontoserver.feature.identifier-resolution-enabled.

Changed

• Updated syndication semantics to:
  1. check and warn about syndication entries with a published date that does not match the Resource.date field of the referenced FHIR Resource.
  2. further skip updating a Resource if the current Resource's date matches that of the syndicated Resource's date field.
• Advertise admin and syndication API endpoints in the http://ontoserver.csiro.au/profiles/ontoserver-endpoints extension on CapabilityStatement.implementation

Changed

• Add support for module composition metadata from release_package_information.json when indexing RF2 files
• Add support for statically configured module compositions of the form snomed.edition.composition.<edition>=module1,module2,module3
• Added support for answers-for properties and filters on LOINC terms (as well as lists)
  • NOTE: This includes a change in the LOINC index format version from 2.0.6 to 2.0.7
• Added config to allow default SNOMED module names to be supplied for the Indexer.
• Added detail to SNOMED Indexing failure messages.
• Add definition as a default property for $lookup; it is also language-sensitive, derived from designation.use, and populated appropriately for SNOMED CT
  • NOTE: This includes a change in the SNOMED index format version from 2.0.14 to 2.0.15
• Add RF2 text definition content to a concept's designations

Security

• Updated library versions to mitigate CVEs:
  • CVE-2025-21587
  • CVE-2025-22235
  • CVE-2025-23083

Fixed

• Fix regression; specifying language for ValueSet/$expand should not force includeDesignations=true
• Fix missing support for “+HISTORY” in ECL
• Fix preload update support for Resources other than CodeSystems
• Fixed caching bug in resource validation, whereby updating terminology resources would not invalidate the cache.

Changed

• RF2 Index Format change to 2.0.14
• Add text definition content to a concept's designations
• Add support for importing RF2 Identifiers content (for LOINC Ontology)
• Prefer explicit ValueSet over implicit all-codes ValueSet, but also enforce all-codes definition semantics
• Add support for SNOMED language aliases to display validation

Security

• Updated library versions to mitigate CVEs:
  • CVE-2025-22228

Fixed

• Pay attention to CodeSystem version(s) in Coding and CodeableConcept when performing $validate-code

Fixed

• Fix internal caching for ValueSets with boosting

Security

• Updated library versions to mitigate CVEs:
  • CVE-2024-12133
  • CVE-2024-12797
  • CVE-2024-13176
  • CVE-2024-57699
  • CVE-2025-0725
  • CVE-2025-21502

Fixed

• Work around JDK bug parsing displayLanguage of -
• Support unicode in Zip filenames through consistent use of Apache Commons Zip

Changed

• Ontoserver now meets version 1.7.6 of the HL7 Terminology Tests, including support for the default-valueset-version parameter on $expand and $validate-code

Fixed

• Fix bug with non-renewal of expired Authorisation tokens.

Fixed

• Tightened validation of syndication feed entries; ensure that advertised item canonical matches actual resource canonical for Metadata Resources (CodeSystem, ConceptMap, StructureDefinition, and ValueSet).

Changed

• Preload will now update a Metadata Resource (one with a canonical), if it has a later Resource.date than the matching currently persisted one.
• Fix reporting of used-supplement in ValueSet.expansion.parameter
• Fix bug where Authorization header might not be included in certain HEAD requests for syndication content.
• Fix version numbers in internal preload feed.
• The ontoserver.feature.syndication.rejectInconsistentContentItemValues can be enabled to validate that a syndication entry's ContentItemIdentifier and ContentItemVersion match the resource's URL and version.

Security

• Updated library versions to mitigate CVEs:
  • CVE-2024-50379
  • CVE-2024-56337
  • CVE-2024-55887

Fixed

• Fixes to code identifying the appropriate display for a code in an expansion, and the set of associated designations.
• Fix match.source value to be valueUri not valueString in $translate output.
• Fix bug where Ontoserver could not verify the signature of JWT tokens while using secured syndication feeds.
• Fixes to cache invalidation propagation when in scaled mode.

Changed

• Report fhir-test-cases version in TerminologyCapabilities using Feature extension: http://hl7.org/fhir/uv/tx-tests/FeatureDefinition/test-version
• preAdopt match.originMap in $translate output to include canonical for the ConceptMap.
• Ontoserver log messages generated in the context of an API call now include a RequestId so they can be grouped/correlated in log analysis.

Security

• Updated library versions to mitigate CVEs:
  • CVE-2024-52007
  • CVE-2024-51132
  • CVE-2024-9681

Fixed

• Fix bug with overly aggressive language matching for display validation.
• Fix bug with caching of TerminologyCapabilities statement and fine grained permissions.
• Fix bug where CodeSystem/$lookup would not trigger an index restore (affecting scaled deployments).

Changed

• Migrated from old spring-security-oauth2 library.
• Add support for check-system-version parameter to ValueSet/$expand.
• Add check for used-codesystem when considering use of a pre-existing ValueSet expansion.

Security

• Updated library versions to mitigate CVEs:
  • CVE-2024-38821

Fixed

• Fix bugs with $validate-code, default / unspecified languages, and displays provided in the ValueSet.compose.
• Fix bug handling empty search criteria for context-type-value.
• Fix regression introduced in 6.20.1 with Resource and Resource_Blob table creation.

Changed

• Added support for auto-detecting MMDDYYYY style versions (after 1300) when sorting for most recent
• Added ontoserver.feature.compat.lookupTypedValue flag to force retention of old (broken) response for $lookup. If you need to the old valueString etc names in $lookup responses, then set ontoserver.feature.compat.lookupTypedValue=true
• Uplift to support terminology fhir-tests: tests v1.6.0, runner v6.4.0

Security

• Updated library versions to mitigate CVEs:
  • CVE-2024-45294
  • CVE-2024-38807
  • CVE-2024-38816

Fixed

• Fix bug when $find-matches is called without any values for property.
• Fix bug with internal caching and CodeSystem supplement support.
• Fix bug with internal caching and useSupplement parameter.
• Fix bug with overly agressive language matching when validating display strings.
• Fix bug where ValueSets including versioned CodeSystems would not match in a reference search.

Security

• Updated library versions to mitigate CVEs:
  • CVE-2024-38807
  • CVE-2024-38810
  • CVE-2024-7264

Fixed

• Fix lazy initialisation of MappingR4.product / MappingR4.dependsOn bug.
• Fix bug identifying latest binary index version in syndication feed.
• Fix bug where $expand?designation=... for a “use” would erroneously filter out all languages.
• More robust ZIP file handling for unicode filenames.
• Ignore __MACOSX metadata directories in RF2 ZIP files.

Changed

• Removed dependency on old 3rd party Atom feed parser (Rome)

• Added ValueSet filter operator EXISTS support for subproperties.

• Add support for targetsystem parameter to $translate with unspecified ConceptMap.

• Upgraded HAPI to 7.4.0 for latest FHIR Validation support: org.hl7.fhir.validation:6.3.11

Fixed

• Fix bug where Community write permissions (e.g., grouping/mycommunity.write) were being ignored.

Fixed

• Fix bug with handling of ValueSet filter criteria in the presence of SNOMED and LOINC supplements.
• Fix bug with JWT token handling where the authorities field was empty and only scope was being used.

Security

• Updated library versions to mitigate CVEs:
  • CVE-2024-21147
  • CVE-2024-6197
  • CVE-2024-6874
  • CVE-2024-21140
  • CVE-2024-21145

Fixed

• Fix bug in ValueSet filter regex handling wrt escaped chars: \t \n \r \f
• Fix bug where content at /static was inaccessible with security enabled.
• Fix bug where content at /fhir/.well-known could return 401 rather than 404.
• Improve index cache invalidation following index deletion.

Changed

• Add support for target and targetsystem parameters to ConceptMap/$translate.
• Support SCALE_TYP = "DOC" (for any case of “Doc”) in ValueSet definitions for legacy reasons: https://chat.fhir.org/#narrow/stream/179202-terminology/topic/LOINC.20properties.20in.20filters

Security

• Updated library versions to mitigate CVEs:
  • CVE-2024-34750
  • CVE-2024-4741
  • CVE-2024-5535
  • CVE-2023-42364
  • CVE-2023-42365

Fixed

• Fix bug where $closure would fail when no CodeSystem version was specified and > 1 version of the CodeSystem was available.
• Fix bug where deduplication of Syndication feed entries did not correctly check contentItemIdentifier and contentItemVersion.
• Fix bug where stale Lucene index readers were retained in cache.
• Fix bug where an index that is OK gets marked in the database as not OK (e.g., due to a transient failure during an earlier repair task) but repair never updates the status back to OK.
• Fixed bug where create/update operations on ConceptMap and other resources would fail due to primary key violations after an Ontoserver upgrade.
• Fix bug where LOINC/SNOMED-CT CodeSystems indexed with older versions of Ontoserver would appear with caseSensitive=false.

Fixed

• Fix bug where display text from ValueSet compose would override a translation selected for the preferred language
• Fix bug where older index versions could be preloaded over newer ones.
  • If you have been experiencing unexpectedly high disk usage, we recommend using the /api/vacuum endpoint to diagnose and/or remedy that.
• Fix bug where specifying a fhirVersion other than 4.0 in the ContentType header would fail for an empty body.
• Fix bug where Lucene indexes were not being closed during a cache flush.
• Fix bug where failure to fetch a preload feed might not be flagged as a Preload Job failure.
• Fix bug where caching of syndication feed entries always failed.
• Only binary indexes, FHIR resources and FHIR packages can be preloaded (no RF2 or LOINC sources)
• Fixed bug relating to ETags and caching of search results

Changed

• Added validation of partition id and check digit for SNOMED Codes.

Fixed

• Fix bug in multipart handling for $x-upload-external following Spring 3.0 migration
• Fix bug in internal caching of feed entries when generating the syndication feed
• Improved handling of LOINC Linguistic variants (translations) for server LOINC Parts
  • This results in a change in the LOINC index format version from 2.0.4 to 2.0.5

Changed

• Ontoserver will now filter syndication feeds as a server as well as as a client
• Add support for the “top” and “bottom” operators, !!> and !!<, from ECL 2.2
• Add validation that itemIdentifier and itemVersion from a feed entry matches url and version in the FHIR Resource
• Assign stable ids to Bundle / Package resources that do not have an id already provided

Security

• Updated library versions to mitigate CVEs:
  • CVE-2024-22262
  • CVE-2024-21892

Fixed

• Improved logging for certain syndication errors
• Fix bug in syndication feed generation when atom.syndication.publish.index.enabled=true

Fixed

• Fixed $validate-code bug where inferSystem was used with case-insensitive CodeSystems

Security

• The following CVE has been withdrawn
  • CVE-2024-31033

Fixed

• Fixed bugs with actuator endpoints including health when operating in secure mode
• Removed bogus warnings about an “Unsupported authentication class”

Security

• Updated library versions to mitigate CVEs:
  • CVE-2016-1000027
  • CVE-2024-22257
  • CVE-2024-22259
  • CVE-2024-24549
  • CVE-2023-52428
• Known CVEs:
  • CVE-2024-31033 (disputed, medium severity)

Changed

• The ontoserver.search.summary configuration parameter can be used to control whether search requests default to summary or complete resources.
• Cached internal syndication feed entries for significant performance improvement

Fixed

• Avoid considering CodeSystems with content = example / missing for operations like $lookup, $subsumes, and validation
• Work around possible case of missing id in persisted JSON blobs

Security

• Removed unused h2 jar to resolve warnings regarding CVE-2022-45868
• Updated library versions to mitigate CVEs:
  • CVE-2024-25710
  • CVE-2024-26308
  • CVE-2024-1597
  • CVE-2024-22243

Changed

• Added support for the content-mode search parameter on CodeSystem
• Added support for context, context-type and context-type-value search parameters for CodeSystem, ConceptMap, NamingSystem, StructureDefinition and ValueSet resources
• Broadened support for filter operators on some of the FHIR specification's Defined Concept Properties

Fixed

• Fix bug affecting identifier:missing queries
• Improved some validation messages for post-coordinated expressions
• Fixed bug where failures to fetch a Syndication feed were cached indefinitely
• Fixed performance issues with SEARCH and the reference parameter. e.g., [base]/ValueSet?reference=http://loinc.org
• Fixed bug where certain incorrect SNOMED CT versions were allowed in a ValueSet definition
• Fixed bug where ValueSet-specified display text would be ignored when SNOMED CT Editions were used in a ValueSet definition
• Improved handling of an invalid displayLangauge parameter
• Fix bug with regex and case-insensitive code systems
• Fix bugs affecting _id search parameters
• Fix bug where SNOMED designations with use display could have incorrect language

Fixed

• Fixed bug with pre-existing LOINC indexes and case-sensitivity

Security

• Updated library versions to mitigate CVEs:
  • None

Changed

• Add support for delete-history interactions (e.g., DELETE {Resource}/{id}/_history) from R6
• Improved support for case-insensitive CodeSystems. This includes an index format change for FHIR CodeSystems (migration is performed automatically)

Fixed

• Fixed resolution of implicit ValueSets for CodeSystems provided via the tx-resource parameter.
• Fixed bug processing CodeSystems without an id provided via the tx-resource parameter.
• Fixed bug handling a valid coding in CodeableConcept that is not also in the ValueSet.

Fixed

• Fixed regression with $expand, the property parameter, and implicit SNOMED reference sets.

Security

False positives:

• CVE-2024-22233 affects specific Spring Boot 3 versions. Ontoserver currently uses Spring Boot 2. The CVE explicitly states these older versions are not affected.

• Updated library versions to mitigate CVEs:

  • CVE-2023-5072
  • CVE-2024-20918
  • CVE-2024-20932
  • CVE-2024-20952
  • CVE-2024-20919
  • CVE-2024-20921
  • CVE-2024-20926
  • CVE-2024-20945
  • CVE-2024-20955
  • CVE-2023-33201

Fixed

• Add support for caseInsensitive CodeSystem in $validate-code
• Fixed healthcheck.sh -l semantics to only look at startup preload, and add -L to look for any preload (eg including redoPreload)
• Fixed bug where failing HEAD requests on syndication feeds would not trigger authorisation token renewal
• Fixed bug where SNOMED FSN's were mis-characterised during validation

Changed

• Tolerate CodeSystems that attempt to re-define the URIs for standard properties like parent and child.

Fixed

• Fixed ValueSet resolution bug where tx-resource supplied ValueSets could conflict with persisted ValueSets.
• Work around Infinispan change that affects Search results when running in a scaled deployment mode.

Security

• Updated library versions to mitigate CVEs:
  • CVE-2023-6378
  • CVE-2023-6481
  • CVE-2023-46589

Changed

• Improved handling and validation of default CodeSystem properties like status
• Enabled R5 support for the $convert operation
• Added support for contained CodeSystems. For example, a ValueSet may contain a CodeSystem (or supplements) that are then used in operations on the ValueSet.
• Added support for the useSupplement parameter, pre-adopted from R5.
• Added support for ValueSet.expansion.property (via Extensions) pre-adopted from R5.
• Added support for various SDC extensions:
  • http://hl7.org/fhir/StructureDefinition/codesystem-conceptOrder
  • http://hl7.org/fhir/StructureDefinition/codesystem-label
  • http://hl7.org/fhir/StructureDefinition/itemWeight
  • http://hl7.org/fhir/StructureDefinition/rendering-style
  • http://hl7.org/fhir/StructureDefinition/rendering-xhtml
  • http://hl7.org/fhir/StructureDefinition/valueset-concept-definition
  • http://hl7.org/fhir/StructureDefinition/valueset-deprecated
  • http://hl7.org/fhir/StructureDefinition/valueset-label
  • http://hl7.org/fhir/StructureDefinition/valueset-conceptOrder
• MANY additional changes to support using Ontoserver with the FHIR Validator or IG Publisher as described here and to align with the tx tests in https://github.com/FHIR/fhir-test-cases
  • Improved consistency and detail in $validate-code messages
  • Additional machine-readable output for $validate-code
  • Eliminated redundant designations for use="display" translations
  • …
• Added support for the Extension http://hl7.org/fhir/tools/StructureDefinion/valueset-expansion-param
• Added spell-correction support to ValueSet/$expand?filter=...
• Added the atom.syndication.republishUpstreamFeeds configuration parameter, which specifies the upstream feeds whose entries should be republished.
• Added support for prometheus endpoint (disabled and not exposed by default) at /actuator/prometheus.
• Exclude CodeSystems with content=example or content=not-present from use with $validate-code.

Fixed

• Improved consistency in CodeSystem version resolution within a ValueSet.compose when performing an $expand or $validate-code.
• Fixed bug with ECL cardinality constraints on role-grouped attributes.
• Fixed bug in PATCH interactions that used delete with where conditions
• Improved consistency in CodeSystem version resolution within a ValueSet.compose when performing an $expand or $validate-code.
• Fixed bug with ECL cardinality constraints on role-grouped attributes.
• Fixed bug with ECL cardinality constraints of the form [0..n] not matching concepts with no (non-IS A) relationships.

Changed

• Added caching for TerminologyCapabilites to improve performance for large sets of CodeSystems.
• Added support for SNOMED International's new Edition dependency element in a syndication feed.
• Optional support ValueSet.identifier matching when resolving ValueSet uri in $expand.
• Allow for inactive concepts to have an inactive FSN.

Fixed

• Fixed bug resolving appropriate CodeSystem version for the LOINC all-codes implicit ValueSet.
• Fixed bug storing compressed JSON form of very large resources.

Security

• Updated library versions to mitigate CVEs:
• CVE-2023-38286

Fixed

• Fixed bug where certain hash collisions could cause incorrect $expand, $validate-code, or $validate behaviour. This was extremely rare except in cases where two ValueSet compose clauses differed in only a single concept from a very large CodeSystem.
• SNOMED Binary Index format changed to 2.0.10; Fixed bug with handling of ECL wildcard and regular expression term matches containing whitespace.
• Fixed bug where ValueSet.expansion.offset was not being set when paging.
• Cleaned up unused default Spring Boot user management.

Changed

• NCTS Composed ValueSet profile updated to 4.1.0 (relaxes cardinality of ValueSet.purpose)

Fixed

• Handle case where SNOMED CT RF2 files contain logically duplicate language reference set entries.
• Fixed bug in PATCH support where code-typed elements with bindings were not properly handled.
• Fixed bug where an empty search parameter could trigger an IndexOutOfBoundsException.

Fixed

• Based on change in 20220228, updated default type config for reference set: 1193544002

Security

• Updated library versions to mitigate CVEs:
• CVE-2023-35945

Changed

• Added support for concept-typed fields in ECL reference set membership filters.

Security

• Updated library versions to mitigate CVEs:
• CVE-2023-2650

Fixed

• Fixed regression where alpha-sorted designation without a “use” could be mis-identified as the display value.
• Improved error message for ambiguous SNOMED editions

Security

• Updated library versions to mitigate CVEs:
• CVE-2023-20862
• CVE-2023-20873
• CVE-2023-20883
• CVE-2023-21930
• CVE-2023-29491

Changed

• Added caching layer to speed up $validate
• Changes to support using Ontoserver with the FHIR Validator or IG Publisher as described here
  • Add support for valuesetMode and implySystem parameters to ValueSet/$validate-code.
  • Add support for excludeNested parameter to ValueSet/$expand.
  • The ValueSet expansion.parameter element may now include more parameters that affect expansion.
  • The Parameters resource resulting from a ValueSet/$validate-code can now include issues.
  • Only specific extensions that affect $expand are propagated to expanded ValueSets.

Fixed

• Fixed bug where id field value of search result Bundles was non-conformant.

Security

• Updated library versions to mitigate CVEs:
• CVE-2023-1370

Changed

• Reduce space consumption when storing very large resources.
• Specific ValueSet expansions now include extension content from concepts in ValueSet definition into expansion result. This is important for, for example, the ordinalValue extension and Questionnaires.
• ValueSet expansions now include ValueSet-specified display/designations from nested ValueSet includes.
• Added support for PATCH operation (FHIRPath Patch only)
• Added support $diff operation
• Improved validation of CodeSystem.count element value, if present.
• The FHIR base URL (which otherwise has no content) now redirects to OntoCommand by default for an improved user experience.
• Added support for inequality matching for numbers and dateTimes in ValueSet filters as per https://jira.hl7.org/browse/FHIR-38171 The syntax mirrors that used in the FHIR search syntax using prefixes, e.g., releaseDate = ge2021-01-01.
• FHIR index version has been incremented to 2.4.0 to support the above change.

Fixed

• Fixed matching for the dependency parameter in $translate. Note that this can only be used in a POST request.
• ETags now generated by default for read and vread operations.
• Fixed bug with caching of expansion-only ValueSet expansion results.
• Certain ECL errors will no longer be reported as 5xx but instead as 4xx.
• Fixed bug where cached expansion queries would ignore supplement content.

Fixed

• Fixed bug where re-validation of selected FHIR_* resources in syndication feeds would still happen even if disabled.

Fixed

• Fixed regression where $find-matches failed to establish a transaction.

Security

• Updated library versions to mitigate CVEs:
• CVE-2021-46848 – libtasn1: Out-of-bound access in ETYPE_OK
• CVE-2022-43551 – curl: HSTS bypass via IDN
• CVE-2022-45143 – The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to …
• CVE-2023-0286 – There is a type confusion vulnerability relating to X.400 address proc …

Changed

• Added explicit configuration flags for readonly and scaled (readonly) deployment mode.
• Added support for $closure and search result paging when in scaled (readonly) deployment mode.
• Added support for skipping re-validation of selected FHIR_* resources in syndication feeds.

Fixed

• Fixed bug in filtering syndication feeds by fhirVersion where BINARY indexes would never match.
• Fixed bug expanding some CodeSystem supplements.
• Fixed bug where Lucene indexes were not being deleted after CodeSystem deletion.
• Fixed bug where onto/* style scopes would be ignored.
• Fixed bug where experimental versions of SNOMED would be treated as newer than non-experimental versions.
• Fixed bug where a malformed fullUrl in a Bundle could result in a Resource with a blank id.
• Fixed bug where synd/getBinaryIndexZip failed due to a missing transaction context.
• Fixed bug where Loinc indexing might use the wrong part link file.
• Fixed bug where SNOMED CT string-valued concrete domains had their last character truncated.

Fixed

• Fixed bug validating security tag syntax.

Security

• Updated library versions to mitigate CVEs:
• CVE-2022-31690
• CVE-2022-31692
• CVE-2022-40153
• CVE-2022-42889

Changed

• Added MRCM Attribute Domain checking support for validation of SNOMED CT post coordinated expressions.
• Updated /synd/redoPreload to return 201 status and associated jobId on success
• Additional validation of ECL in ValueSet.compose - check for inactive concepts
• Ontoserver will now detect malformed security permissions (those not ending in .read or .write)

Fixed

• Fixed bug where the display text supplied in a ValueSet would not override that from the CodeSystem.
• Fixed bug where stored expansion might be used inadvertently.
• Fixed bug where CodeSystem supplements were not being ignored when resolving CodeSystem references.
• Fixed bug where setting certain logging levels to less than INFO (eg WARN) caused failures
• Fixed bug where an explicit definition property was silently ignored.
• Fixed bug where the same version of both experimental and non-experimental Editions of SNOMED are loaded.
• Fixed bug whereby OperationOutcomes for some custom operations were not valid resources.

Fixed

• Fixed bug where /api/startupProbe required authentication.
• Fixed bug where empty search parameters were not being ignored.

Changed

• Added /api/startupProbe to support AGIC and similar.
• Add support for the dependency parameter to ConceptMap/$translate.

Fixed

• Fixed bugs that caused valueSetVersion to be ignored sometimes on $expand and $validate-code
• Fixed typo in displayLanguage parameter of CodeSystem/$validate-code and ValueSet/$validate-code
• Fixed bug importing Loinc 2.72
• Fixed race conditions in /api/getJobs

Changed

• LOINC index version has been incremented to 2.0.4
• Add support for LOINC Linguistic Variants

Fixed

• Fix import of LOINC from source via syndication
• Fix LOINC Hierarchy import (for LOINC 2.73 and above)
• Fix bug in $preferred-id where deleted resources were not ignored

Changed

• FHIR index version has been incremented to 2.3.0
• Support POST of application/tar+tgz to $x-load-package to allow adding the Ontoserver-compatible contents of a FHIR Package.
• Changed indexCodeSystemDebug message output, it now prints one argument per line so it's easier to see what was passed to the java application.

Fixed

• Significantly improved performance of ConceptMap update and delete.
• Fixed bug where $lookup of property that is a container of sub-properties would be ignored.
• Fixed bug where post coordinated expressions would fail to validate with respect to a suitable ValueSet.
• Fixed bug enforcing permissions on instance-level $find-matches
• Fixed bug reporting on permissions failure for instance-level $validate-code
• Fixed bug invoking $validate with a Parameters specifying the profile as a Canonical.
• Fixed bug where CodeSystem version would be omitted from tabular-formatted ValueSet/$expand responses.
• Fixed bug property.url values for standard “parent” and “child” semantics were being ignored.
• Fixed bug in logging of start_ms for batch request operations.
• Fixed bug where system-version and force-system-version would not be effective for implicit SNOMED ValueSets.
• Fix Docker image entry point where the passed command line argument with quotes was split at the whitespaces into separate arguments.

Changed

• Added indexCodeSystemDebug Indexer mode to display command line arguments passed to the Docker container's entry point.
• Added text/tab-separated-values as an addition valid Accept MIME type for ValueSet/$expand.

Fixed

• Fixed broken Indexer mode where classpath was pointing to non-existent ontoserver.jar file.

Fixed

• Fixed bug where a ValueSet with overlapping codes from different CodeSystems could be treated as equivalent.
• Fixed Bundle/Package add semantics to treat NamingSystem resources with same id and date values as related. If related, then only update the resource if the new one has a later date.
• Fix bug with _summary/_elements for NamingSystem and Bundle

Changed

• Docker image is now multi-architecture; includes ARM support
• Search requests can now provide multiple values for all search parameters, using AND semantics (e.g. ?name=Chronic&name:contains=Kidney) or OR semantics (e.g. ?name=Chronic,Recurrent)
• Include code, system, version in $validate-code and $lookup results by default, pre-adopted from R5
• If a ValueSet includes an existing expansion that is compatible with the $expand call, then use it directly
• Support csv, tsv, scsv as values for _format for $expand
• Improved logging of user/principal

Fixed

• Support equivalent codes (hierarchy cycles) in a CodeSystem
• Fix missing keywords ‘accept’ and ‘prefer’ in ECL parser
• $expand?property=... no longer causes all sub-properties to be automatically included

Changed

• Updated to Spring Boot 2.6.5
• Updated to Flyway 8.5.5
• Enhance algorithmic concept map results to respect Accept-Language header for display term.
• Minor enhancements to CapabilitiesStatement and explicit handling of date parameter for $expand

Fixed

• Fix incorrect ETags for implicit algorithmic $translate results.
• Fix incorrect sufficientlyDefined status for inactive SNOMED CT concepts.
• Add support for SNOMED ValueSet filters on: moduleId and effectiveTime.

Changed

• FHIR index version has been incremented to 2.2.2
• Add support for typed values in target.product and target.dependsOn, pre-adopted from R5
• Add support for concept subproperties specified in a CodeSystem using extensions (FHIR index version change).
• Add initial support for history supplements in ECL (from v2.0).
• Add initial support for member filters in ECL (from v2.0).
• Add initial support for description and concept filters in ECL (from v1.5, v.1.6). The concept filters: definitionStatus, moduleFilter, effectiveTimeFilter, and activeFilter are supported. The description filter: termFilter is supported.
• All resources now support the _lastUpdated search parameter, including the lt, gt, le, ge and eq prefixes, and also including multiple values (e.g. for searching for resources updated between two times)
• Update to HAPI 5.7.0 Changes
• Add support for “all known codes” implicit ValueSet: http://hl7.org/fhir/ValueSet/@all
• Add support for SNOMED CT attribute names as filter properties for operators = and in; all concept model attributes are concept properties and thus should support = and in as filter operators.
• metadata?mode=terminology now returns information on CodeSystem instances rather than generic capabilities.
• Add support for the conceptMapVersion parameter on the ConceptMap $translate operation.

Fixed

• Fix long-standing error in naming property parts in $lookup results; old names deprecated but are retained for backwards compatibility
• Fix handling of corrected/alternate spellings/stems in Automap
• Fix support for multi-valued Coding typed properties (FHIR index version change).
• Fix bug handling ValueSets with an empty ValueSet.compose

Fixed

• Fix transaction boundary error in validation leading to spurious rollback errors

Fixed

• Fix error handling fully declared status property when adding a CodeSystem
• Fix bug in $find-matches for SNOMED CT where some valid properties would be rejected
• When logging, treat clientId in token as alternative to client_id

Fixed

• Fix regression in calculation of length and sha256 values for syndication feed entries.

Changed

• Add simple support for /CodeSystem/$find-matches.
• Optimise Syndication feed generation for large Resources.
• New config (atom.syndication.excludeLength and atom.syndication.excludeXml, both defaulting to false) to further speed Syndication feed generation.

Fixed

• Fix bug in $expand where a search string involving repeated units could return additional concepts.

Changed

• SNOMED Binary Index format changed to 2.0.6; RF2 Concrete Domains and improved Language Reference Set support
• Designation use of preferredForLanguage can now be used to select preferred terms in languages other than the primary one, analogous to display.
• CodeSystem/$lookup now respects the Accept-Language header
• SNOMED CT Language Reference Sets are now handled through a BCP-47 language tag extension. This provides the capability for preferring a code's display on both language AND reference-set dimensions.
• Faster _search performance when large resources are involved.
• Generalised version sorting; relaxes the constraints around version strings for selecting the “latest version” of resources.
• Health status now checks for database connectivity.

Fixed

• Fix bug in $subsumes for post-coordinated expressions where order mattered checking for equivalence.
• Fix bug in $expand where R5 pre-adopted property support did not respect the type of property values.
• Fix bug in /synd/setSyndicationStatus where calling it for SNOMED or LOINC would fail to properly manage the binary index file.
• Fix bug where Ontoserver was performing too many URIdecode operations on URI-typed request parameters.

Fixed

• Fix bug where Indexer mode did not handle duplicates when processing multiple RF2 Zip files

Security

• Fix bug where security tag of *.read effectively disabled Resource-level protections for that Resource.

Changed

• Support :not modifier for the url search parameter.
• Ignore duplicates when processing multiple RF2 Zip files

Fixed

• Fix handling of uri-typed search parameters with modifiers.

Fixed

• Fix issue when TextDefinitions do not have language referenceset entries; SNOMED Binary Index format changed to 2.0.5

Changed

• The results of the $translate operation will now include any dependencies or products of the matches
• The Text Definition for a SNOMED CT concept is now used as its concept.definition; SNOMED Binary Index format changed to 2.0.4
• Updated to HAPI 5.4.0

Fixed

• Fix bug where string properties without a value can cause $expand?property=... to fail.
• Fix bug where codes with colons can be confused with SNOMED post coordinated expressions.
• Fix bug where ValueSet filter on property of Coding type failed for most values.
• Fix bug where ECL expressions containing only optional grouped relationships would fail.
• Fix potential concurrency bug when downloading binary indexes.
• Fix concurrency issue when repairing multiple SNOMED CT indexes.
• Fix bug where system-version or force-system-version were being ignored for implicit ValueSets.
• Fix syntax error in necessaryNormalForm property of SNOMED CT concepts (expressions contained extraneous + symbols)
• Fix bug where automap failed for CodeSystems other than SNOMED CT and LOINC

Fixed

• Fix bug in handling _summary=false parameter

Changed

• Add support for decimal-typed CodeSystem properties
• Add support for $expand?property=... pre-adopted from R5
• ValueSet regex filter has implied anchors; also allow for explicit ones (at start and end only).
• Ensure that searches for codes that look like quantities (e.g., 50L) still match the code.
• Properly support multiple CodeSystems in $closure.
• When $closure is called with codes not known to belong to the specified CodeSystem, include in result as “unmapped” (previously these were silently ignored).
• Added a parameter -s to Ontoserver's healthcheck.sh script so an Ontoserver container can report as unhealthy unless and until it has successfully loaded all the content of a preload feed.
• Add support for atom.syndication.client.connectTimeout, atom.syndication.client.requestTimeout, and atom.syndication.client.socketTimeout configuration to allow overriding the 10 second default

Fixed

• Fix bug where passing both parameters _elements=*&_summary=true triggers 5xx instead of 4xx error.
• Fix bug where codes without display text can cause $expand to fail.
• Fix bug where last set of codes in ValueSet.expansion with same score were not alpha-sorted.

Changed

• Add extra validation of LOINC codes when indexing and handling implicit ValueSets.

Fixed

• Fix issue where concept.display has a translation. Results in additional designation for every concept corresponding to it's display(s). Both FHIR and Loinc patch-level index versions have been incremented due to this fix.
• Fix issue where ValueSet supplement extension references a non-supplement CodeSystem.
• Fix issue where a CodeSystem supplement specifies an implicit “all codes” ValueSet.

Fixed

• Fix issue preventing LOINC index creation using Ontoserver in start/finish “indexer mode”.

Fixed

• Fix enabling overriding security labels on FHIR resources imported from a syndication/preload feed using the feed entry's permissions extension.

Changed

• Support the Syndication Feed content-type FHIR_Package.
• Significantly enhanced validation support due to upgrade to HAPI 5 (5.2.0).

Changed

• Speed improvements for various operations, including translate with SNOMED implicit ConceptMaps
• Adjust the order of preload such that FHIR resources are scheduled first, then all SNOMED and LOINC indexes from newest to oldest.

Changed

• SNOMED Index version patch change to fix issue with preferredTerm selection and multiple languages.
• Updated directory layout for Lucene indexes to avoid possible location contention.
• Improved robustness of indexRepair.
• Added work-around for bug in FHIR Validator code.
• Now include logs for rejected FHIR requests following refactored request handling layer.
• More robust handling of errors during preload.

Changed

• Improved error messages relating to language reference sets when indexing SNOMED CT.
• Minor docker-packaging updates.

Fixed

• Fixed bug where fhirVersion was not being checked in syndication feed entries.
• Fixed bug when attempting to return history of Bundle resource.

Fixed

• Fixed typo in default configuration that would lead to a healthy ontoserver being reported as unhealthy when running in secure mode.

Changed

• Support SNOMED CT post-coordinated expressions with $subsumes, $closure, and $lookup
• Support SNOMED CT CodeSystem supplements referencing post-coordinated expressions
• Add support for $meta-add and $meta-delete
• meta.tag and meta.label are now associated with a resource instance, and not the resource instance version. This provides a better experience and more flexible model for managing per-resource permissions
• Surface Ontoserver resource permissions in syndication feed
• Support ;fhirVersion=3.0 in Content-Type header auto-convert STU3 inputs to R4
• Optionally redirect a request to the base to the Administration UI
• Expanded the list of parameters that can be used for sorting resource searches. These are now listed in the documentation.
• Individual FHIR resources can now be selected for publication in the downstream syndication feed by setting atom.syndication.publish.fhir.enabled=selected and calling /synd/setSyndicationStatus for the individual resources.
• Added the parameter atom.syndication.publish.index.enabled (default=selected) allowing 3 values for publication of binary indexes in the syndication feed - all, selected, or none
• Added ontoserver.well-known.openid-configuration config as redirect target for [base]/fhir/.well-known/smart-configuration to simplify OAuth2 config for SMART on FHIR.
• Support POST of multipart/form-data to $x-upload-external to allow for releases split over multiple RF2 zips.
• Support for adding a set of resources to the server by POSTing a Collection-typed Bundle to the FHIR base URL. This is conditionally enabled with the parameter ontoserver.fhir.batch.addBundle (default is false).
• Support additional hierarchy-based concept filter operators for LOINC.
• Add support for ‘title’ as a search/sort parameter for CodeSystem, ConceptMap, ValueSet and StructureDefinition
• The downstream syndication feed title can now be configured using atom.syndication.publish.feedTitle
• Search requests can now sort (but not yet search) using the _lastUpdated search parameter.
• Syndication status on a FHIR resource can now be used in search and sort criteria using the ‘x-syndication-status’ parameter.
• FHIR resources explicitly marked for syndication using setSyndicationStatus can be protected from modification using the atom.syndication.publish.fhir.secureSyndicated config option.

Removed

• Remove support for internal RF2 caching including the (deprecated) APIs /api/sct/addRf2 and /api/sct/modules. Note, this also includes removal of support for RF2 in the /synd/fetchSyndicatedContentEntry API.

Fixed

• Fix potential issue with HTTP caching - added Authorization to the Vary header.
• Fix bug where old ConceptMap data would interfere with url-less type-level $translate
• Fix for FHIR syndication entry length calculation where resources contain multibyte UTF-8 characters, Atom specification is based on data length (octets) not characters https://tools.ietf.org/html/rfc4287#section-4.2.7.6
• Fixed syndication feed to contain a “self” rel type link and remove incorrect “alternate” type links for upstream feeds.

Changed

• Improved error messages when indexes on disk are missing and cannot be retrieved from upstream Atom feed(s).

Fixed

• Fix for SHA256 and length calculation for FHIR resources in the syndication feed, including accounting for multi-byte UTF8 characters in FHIR resource length.
• Fixed duplicated CodeSystem resource entries in the syndication feed.

Changed

• Updated NCTS profiles
• Added an API call to re-execute preload on a running server (see /synd/redoPreload), and a parameter to enabled scheduled re-execution of preload using cron expressions (see atom.preload.schedule.cron)

Fixed

• Some $validate requests were failing because of outdated snapshots in built-in profiles. These have been fixed.

Changed

• Syndication and preload feeds can now be filtered by category, content identifier, content version or FHIR version. More information on how to do this is provided in the Syndication Configuration page of the online documentation.
• Implement support for ConceptMap.group.unmapped
• Performance improvements for searches with _elements parameter(s)

Fixed

• Fix performance bug with internal caching of search results
• Fixed default syndication endpoints

Changed

• Update docker-compose examples to cater for Postgres image changes
• Add support for the ‘definition’ property in $lookup
• Add support for ‘display’ as a filter, including regex support (does not include designations)
• Ensure required properties ‘name’ and ‘display’ are returned by $lookup
• Initial support for Coding-typed properties in FHIR CodeSystem resources

Fixed

• Fix bug when passing ValueSet URI containing | as parameter to $expand

Changed

• Support FHIR R4. This brings major index version changes, across all index-types, which are not compatible with FHIR STU3 and Ontoserver 5.x
• Support CodeSystem.supplements
• Support /$versions operation
• Support for NamingSystem and $preferred-id
• Allow an RF2 SNAPSHOT .zip to be POSTed to [base]/CodeSystem/$x-upload-external to create a SNOMED CT index.
• FHIR Search requests now default to _summary=true for significant performance improvements
• Support reference parameter in ValueSet search
• More detailed validation of ValueSets; implicits and ECL filters are parsed for correctness
• A FHIR CodeSystem claiming to be http://snomed.info/sct (or http://loinc.org) can now be created directly as long as CodeSystem.content != complete. This is primarily to support the SNOMED CT GPS for users that are not SNOMED-licensed and therefore unable to load an RF2-backed instance.
• Tidy up JSON logging format - blank fields are omitted rather than the empty string
• Refactored indexing to reduce memory footprint
• Refactored index filesystem layout to support dynamic healing
• Migrate from Java 8 to Java 11
• Migrate from Lucene 6 to Lucene 8

Removed

• Remove support for FHIR STU3
• Remove support for legacy ‘identifier’ parameter to the ValueSet/$expand operation

Changed

• Add support for alternate negation syntax and childOrSelf (<<!) etc in ECL
• Less noisy (in logs) healthcheck mechanism using Spring Boot health endpoint on private port
• Update security model to use scope values in JWT token in preference to authorities. This also includes changes to the values - see documentation for details.
• SNOMED CT Long normal forms that get really long will now be shortened somewhat (but still conformantly)

Changed

• Work-arounds for changes in HAPI 4.1.0

Fixed

• Fix error where preload would attempt to import incompatible binary index versions

Fixed

• Fix bug regarding handling of preload and syndicated indexes

Changed

• Add support for validating using “remote” profiles
• Added support for “publisher” and “status” search parameters on ValueSet, CodeSystem, ConceptMap and StructureDefinition resources

Fixed

• Fix normalForm syntax to use RF2 syntax for numbers rather than scientific notation, correct grouping for concrete domain info, and nested relationships
• Fix bug in MML automap strategy where low-ranked matches were returned

Changed

• Adjusted ranking scores where synonyms are best matches
• Badly formatted count and offset parameters for $expand will now result in a 400 instead of a 500

Fixed

• Fixed bug in recorded index version of SNOMED CT binary indexes
• Fixed bug where some CodeSystem $validate-code requests would produce a 500 instead of a 400
• Fixed bug in syndication feed; ids must be absolute URIs

Changed

• Designations added to ValueSets should not be available using $expand with includeDesignations=true

Fixed

• Fixed bug in Ontoserver initialization that would cause problematic repair of CodeSystem indexes on startup
• Fixed bug where unrecognized syndication entry categories would break the ability to fetch upstream syndicated content
• Bug fixes related to fetching Bundle resources from syndication

Changed

• Support for preloading content into Ontoserver on startup using a Bundle resource or ATOM syndication feed/s.
• Support for indexing SNOMED CT releases based on the July 2019 international release
• The /synd/fetchSyndicatedContentEntry endpoint now supports ‘resourceType’, ‘url’ and ‘version’ parameters, as an alternative to fetching using the ATOM entry ID

Fixed

• Fix bug when generating syndication feed of FHIR resources; exclude SCT and LOINC

Changed

• Documentation improvements, especially for Authorization configuration to support RBAC

Fixed

• Fix bug where HTTP 500 rather than 404 would be returned when asking to index a non-existant code system

Fixed

• Fix syndication bug resulting in excessive redundant downloading of resources

Changed

• Add support for [base]/$convert
• Produce much more compact OperationOutcome Issue lists from $validate

Fixed

• Fix bug with paged _search results and ETags
• Fix bugs with support for authorization using RS256 keys

Changed

• Add support for experimental versions of SNOMED CT with special-case version URIs
• Support SNOMED Edition URIs in version parameters (for $lookup etc)
• Include Provenance resource for SNOMED CT CodeSystems
• Support default filters parent EQUALS and child EQUALS for SNOMED CT
• X-Correlation-Id and X-Request-Id support
• Support version:text in _search for terminology resources
• Support distribution format changes for Loinc 2.65
• Improve robustness of syndication client when encountering unrecognized categories

Fixed

• Fix bug where ECL cardinality constraints of [0..*] were incorrectly applied
• Fix bug where CodeSystem.system was usable as an implicit ValueSet.url under certain circumstances
• Fix bug with automap and stemmed words that are not also prefixes
• Fix bug with ValueSet filter on the ‘inactive’ property for FHIR CodeSystems
• Fix syndication bug whereby StructureDefinition syndication entries would have the wrong category

Deprecated

• Deprecate /api/sct/addRf2 and /api/sct/getModules

Changed

• Support human-friendly HTML rendering of FHIR responses
• Exception stack traces are now logged on a single line as a JSON array
• Add support for kind as a search parameter on StructureDefinition
• Add support for the _tag:not modifier
• Add support for .well-known and .well-known/logo.png in particular

Fixed

• Fix bug with $validate-code and multiple versions of the same CodeSystem

Fixed

• Fix index error to support ValueSets with cross-version CodeSystems This includes an index minor-version update and will trigger re-indexing of all (LOINC, SNOMED, and FHIR) CodeSystems
• Fix bug in ECL that allowed never-grouped attributes (eg laterality) to match inside groups
• Fix bug in language detection for designations without language

Fixed

• Fix bug where displayLanguage / Accept-Language support was ignoring the default display text

Changed

• Enable support for HTTP(S)_PROXY_HOST, HTTP(S)_PROXY_PORT and HTTP_NON_PROXY_HOSTS
• Support * as a property name in $lookup to represent all known properties
• Add support for language ranges (eg en-*) with displayLanguage parameter

Fixed

• Fix bug with overly permissive parsing of RF2 syndication feed entries
• Fix bug related to $translate using implicit ConceptMaps in reverse
• Fix bug where ECL expressions with certain unicode characters were incorrectly escaped
• Fix bug that would block ConceptMap create/update when source or target ValueSets were ambiguous

Fixed

• Fix bug where caching of ECL constraints with multiple relationship clauses could return incorrect results

Changed

• Upgrade LOINC importer and indexer to support more recent LOINC releases (2.59-2.64). Note: Because of this, the Binary Index Format for LOINC is now 1.6.0.
• The LOINC property/filter DOCUMENT_SECTION is no longer supported, as it has been removed from the LOINC distribution
• Greatly expanded the set of available LOINC Answer List and Part codes
• LOINC implicit ValueSet URIs now allow versions (e.g. http://loinc.org/2.64/vs), reflecting a likely upcoming normative change. Unversioned LOINC URIs are still valid, too
• The following additional code-typed LOINC CodeSystem properties are now available on LOINC Terms: CHALLENGE, COUNT, TIME MODIFIER, SUPER SYSTEM, DIVISORS, ADJUSTMENT
• Support context parameter for ValueSet/$expand and ValueSet/$validate-code
• Support displayLanguage parameter for $expand
• $validate-code now returns display text when code is valid
• Support CodeSystem/$validate-code and CodeSystem/[id]/$validate-code, pre-adopted from R4
• Support default = and in filters for all defined CodeSystem properties
• Type-level $translate with no url parameter no longer uses available ConceptMap instances rather than a term-based string matching algorithm
• $translate now includes match.source in most cases
• $translate now includes match.concept.display when the CodeSystem of the concept is available
• Add support for latest-version semantics when only a single Edition of SNOMED CT is available
• Return ETag on DELETE
• Support returning alternate display text in top-level ValueSet.compose.include
• Support instance-level and type-level _history operations with both _since and _at parameters
• Support type-level $validate for all Resource types
• Switch to using validator reference implementation
• Significantly reduce heap usage when obtaining syndicated content. Minimum required heap now documented as only 2GB

Fixed

• LOINC axis properties and filters (PROPERTY, COMPONENT, SYSTEM, TIME_ASPCT, METHOD_TYP and SCALE_TYP) now correctly use codes instead of display strings
• Fixed bug in $expand of ValueSets using LOINC and ‘exists’ filters
• Fixed bug triggered by empty property parameter to $lookup operations on SNOMED-CT

Changed

• Very slightly reduce scores for inactive concepts
• Allow (encoded) newlines in ECL Implicit ValueSet URIs
• Include request protocol in logs
• SNOMED Concept Inactivation Indicators are now available as an implicit concept map
• Support direct POST of Bundle to addBundle in addition to POST of multipart/form-data
• Add support for bundleInterpretation=collection in /synd/fetchSyndicatedContentEntry
• Relax constraints around acceptable display text when validating SNOMED codes; now also allows any acceptable synonym
• Report http://hl7.org/fhir/StructureDefinition/valueset-unclosed for expansion of certain SNOMED ValueSets
• Support additional FHIR code properties in LOINC: EXAMPLE_UCUM_UNITS and STATUS

Fixed

• Fix rare bug when automapping unversioned codes and other complex conditions satisfied
• Fix bug where CodeSystems with corrupt/missing index data could sometimes appear in search results
• Fix bug in addBundle where reported resource Identities were of the supplied Resources rather than the updated Resources
• Fix race condition loading default and built-in profiles on startup

Changed

• Pre-adopt the new SNOMED CT Implicit ValueSet URI pattern for the Expression Constraint Language, as defined for FHIR R4
• Support consumption of FHIR_Bundle artifact type in the syndication feed.
• Ontoserver now supports SCRUD operations on Bundle resources.
• Ontoserver now supports SCRUD operations on StructureDefinition resources. Stored StructureDefinitions can be used for validation of terminology resources
• $validate methods now support the profile parameter

Changed

• Stricter parsing checks for JSON and XML Resources
• Support CTV3 implicit map
• Improve handling of inactive rows in the MDRS when building SNOMED indexes
• Certain resource validation errors that were not previously being reported are now being reported

Fixed

• Fix problem where, in rare cases, inactive concepts would have missing display text
• Fix bug where deleted ValueSets could cause $expand to fail in rare cases

Changed

• Add support for Edition-specific language-reference-sets in config
• Add explicit handling of OutOfMemory exceptions to allow Ontoserver to shutdown
• Add optimisations for ECL-based ValueSets with expensive match criteria
• Check codes are valid during $subsumes

Fixed

• Fix bug handling malformed ValueSets with incompletely specified filters
• Fix recall performance in “automap” algorithms associated with automated spelling correction
• Fix bug in scoring algorithm that was failing to weight the score of preferred terms properly

Changed

• Document minimum Java heap size and likely need to set it explicitly in docker-compose configuration.

Fixed

• Fix bug where ValueSet.compose.inactive=false was being ignored.

Changed

• SNOMED Index version patch to 1.6.2
• Explicitly index SNOMED acronyms / abbreviations for better search behaviour
• Support “inactive” property for FHIR Code Systems (already supported for SNOMED CT)
• Use “inactive” property in ValueSet expansions to indicate whether an included code is inactive in the underlying code system.
• Support SNOMED CT relationship properties as per http://hl7.org/fhir/snomedct.html#props
• New buildLocal parameter for indexCodeSystem to avoid syndicated binary indexes
• Binary index versions are now included in the Ontoserver CapabilityStatement
• Avoid file copy when syndicating local content
• Improved ranking of searches involving FSN semantic tag matches

Deprecated

• Ontoserver-specific extension was used to indicate inactive concepts is now deprecated and is scheduled for removal in the 5.1.0 release.

Changed

• Improve error reporting for malformed ValueSet filters
• Improve metadata for LOINC CodeSystem and implicit ValueSets

Fixed

• Fix bug where inactive map entries were appearing in SNOMED implicit concept maps

Changed

• When syndicating from an upstream feed, Ontoserver will now be stricter about the presence of a SHA256 checksum attribute (either ‘sha256Hash’ or the deprecated ‘sha256’) on links. (If necessary, this can be disabled using the atom.syndication.disableChecksums configuration property)
• Improve cleanup of files when an index is deleted

Fixed

• Fix bug in syndication where downstream syndication entries were using an incorrectly named attribute for SHA256 checksums on download links (‘sha256’ instead of ‘sha256Hash’). Links will now have the correct attribute.

Changed

• Support Concrete Domains in ECL and use flatter DL representation of AMT Concrete Domains information ready for integration with SNOMED International drug model changes.
• Minor improvements to error reporting for $subsumes requests, and LOINC implicit ValueSets
• Improve performance of batch requests.

Changed

• Add support for version ordering. Resources whose versions are uniformly formatted using semantic versioning (x.y.z) or date versions (yyyymmdd) can now share a url, and will be resolved to the latest version if no specific version is provided.
• Certain ECL errors no longer result in a 500 series error, instead producing a 422

Fixed

• Fix syndication bug when local binary index exists as well as an upstream binary index of the same version

Changed

• Improve performance of batch operations by allowing concurrent execution
• Adde JSON-style logging for api/syndication methods
• Update NCTS profiles for ValueSet, CodeSystem and ConceptMap
• $validate requests using the unsupported profile parameter will now result in 400-code responses.

Fixed

• Fix bug with batch operations when Ontoserver RBAC security is enabled
• Fix bug for $subsumes requests that use codings rather than codes

Changed

• Instance-level $translate no longer returns an empty ‘source’ parameter
• $expand on an ambiguous ValueSet url will now result in a 422 error, not a 500 error
• SNOMED CT ECL parser now correctly recognizes ChildrenOf
• AuditEvent reporting is now turned off by default. Consult config documentation to enable and configure endpoint/s.
• Some improvements to robustness of syndication.

Fixed

• Fix bug in SNOMED CT indexer that affected some ECL cardinality constraints inside role groups
• Fix bug in ECL compiler that affected cardinality constraints on grouped relationships
• Fix problems arising when publishing older binary indexes for syndication
• Fix bug related to indexing extra columns in RF2 refsets, which affected the SNOMED International release

Changed

• Migrate to STU3 version of FHIR
• Support inactive = true/false filter for SNOMED CT
• HTTP/2 support added
• Add support for explicit properties and filters on FHIR code systems
• Add support for implicit filters on FHIR code systems: concept =/is-a/is-not-a/in/not-in, parent =/in/not-in
• CodeSystems created/updated with content=not-present will now not list concepts in a read (concepts are still accessible through expand, lookup, etc)
• Add support for lang.X values in the property parameter of $lookup requests
• Update properties and filters for LOINC CodeSystems including support for CLASS, CONSUMER_NAME, CLASSTYPE, ORDER_OBS and DOCUMENT_SECTION
• Add support for the $subsumes operation (including within batch requests) for testing subsumption/equivalence between concepts within a code system
• The ‘descendent-of’ filter is now available for the ‘concept’ property in both SNOMED and FHIR CodeSystems
• Add support for the includeDesignations and includeDefinition parameters on ValueSet $expand
• Support boosting in ValueSets via http://ontoserver.csiro.au/profiles/boost extension on ValueSet.compose.include
• Update properties and filters for SNOMED CT CodeSystems including support for sufficientlyDefined, effectiveTime, moduleId, normalForm, and normalFormTerse
• Support multiple Syndication feed sources
• Support implicit concept maps for SNOMED CT Historical Associations reference sets
• Support implicit concept maps URI http://ontoserver.csiro.au/profiles/automapstrategy/default as default Automap strategy
• Support the logging of code selection, through the creation of AuditEvent resources
• $validate-code requests for SNOMED codes now respect concept permanence
• Support for the _tag search parameter on all resources
• Support for the source-uri, target-uri, source-system, target-system, source-code and target-code search parameters on ConceptMap

Removed

• Remove support for DSTU2.1

Fixed

• Fixed a bug where filters longer than 20 characters would return no matches

Fixed

• Fix problem with syndicating newer binary indexes (from Ontoserver >= 5.0.0)

Fixed

• Fix long standing bug related to OWL generation from RF2 (SNOMED Binary Index version incremented to 1.3.4)

Fixed

• Fix bug related to SNOMED codes without descriptions

Fixed

• Fix bug in CodeSystem/$lookup
• Fix bug in SNOMED indexes where non-defining relationships were being treated as defining (SNOMED Binary Index version incremented to 1.3.3)

Changed

• Bump SNOMED Binary Index version to 1.3.2 for following five fixes/improvements
• Make description IDs searchable terms
• Ensure that FSNs are always acceptable synonyms

Fixed

• Fix bug where | symbols in RF2 files would confuse the CSV parser during an addRf2 call
• Fix bug where multiple language reference sets referring to the same description id would result in multiple designations
• Fix minor bug where “fall-through semantics” for language reference sets was not being applied. Note, these semantics are under-specified in the SNOMED CT TIG.

Fixed

• Fix bug where Vary response header was incorrect when Accept-Encoding did not include gzip

Fixed

• Revert flyway change that broke database migration

Changed

• $lookup now returns inactive status as a property (as per spec) rather than directly as an output parameter
• Adding RF2 content to the database has been significantly sped up (Postgres only)
• The If-None-Match request header (used to support caching) is now supported for read, vread and search operations on ValueSets, CodeSystems and ConceptMaps, as well as $lookup and instance-level $translate operations
• ETag headers (usable for caching) are now produced by GET-style $lookup and instance-level $translate operations, and by search requests on ValueSets, CodeSystems and ConceptMaps
• Change syndication OAuth2 endpoint in line with NCTS change

Fixed

• Fix bug related to incorrect formats reported in Conformance resource
• Fix bug related to international RF2 release package structure

Fixed

• Fix (benign) bug where LOINC and FHIR index versions were not incremented with change to support index version compatibility
• Fix bug where some existing compatible indexes were not being detected in the file system, which triggered unnecessary updating of SNOMED indexes

Changed

• Improve automap precision
• Update SNOMED CT binary index file format to 1.3.1 and implemented support for semantic versioning of binary indexes with forward and backward compatibility
• ValueSets that come back from $expand requests will now include the identifier and version elements (if any) of the originating ValueSet

Fixed

• Fix limitation that prevented support for type-level $translate without a source CodeSystem / value set and only display text in a Coding/CodeableConcept
• Fix bug that prevented expansion of multi-version ValueSets with exclude criteria from working
• Fix bug related to empty codes in batch validate-code requests
• Fix bug that prevented including all of a LOINC code system in a ValueSet

Changed

• Improve speed of SNOMED (RF2) indexing from source; if RF2 not in db then work directly from ZIP. To get RF2 in db, use /synd/fetchSyndicatedContentEntry or /api/sct/addRf2
• Improve log format to facilitate automated log processing
• Improve transactional behaviour to avoid race conditions during creates/updates/deletes
• Update HL7 Sharable ValueSet Profile from 1.0.2 to 1.4.0
• Add support for the Prefer: return=representation Header

Fixed

• Fix bug in $closure where incorrect subsumptions could be computed
• Fix bug in $expand that made it impossible to use count/offset to retrieve concepts beyond the maxResults threshold

Changed

• Update IHTSDO ECL implementation to match v1.1.1
• Significant speed increase for the ‘automap’ flavour of $translate
• Performance improvement for loading RF2 data of SNOMED CT

Fixed

• Fix implementation of cardinality constraints in SNOMED CT ‘expression’ filters
• Fix bug where republished entries would not all have source links
• Fix bug regarding incorrect diagnosis of snomed/loinc index version mismatch on startup

Changed

• Batch requests now permit String values for Code-typed parameters
• Make $validate-code less dogmatic about matching the version parameter
• Allow the parameters ‘valueSet’ and ‘source’ to be used as alternatives on $translate
• Allow CORS requests from Origin file://

Fixed

• Fix handling of valueSet parameter on $validate-code
• Fix handling of type-level $validate requests that do not provide a resource parameter
• Fix bug in $closure where #additional edges > maxResults limit (default 10,000)

Changed

• Include Vary and HTML Content-Type headers for exception responses
• Improve handling of batch/transaction requests, especially regarding error handling
• Add /api/mode endpoint for querying security mode
• Support “property” parameter in batch GET $lookup

Changed

• Include Vary header with Accept and Accept-Encoding to avoid caching problems
• Include comment in Conformance to indicate which operations are supported in batch
• Customise CodeSystem.publisher for known editions of SNOMED (SCT-AU, AMT)

Fixed

• Fix error code for unsupported conditional deletes

Changed

• Return a 422 error when invoking operations with ambiguous resource references (URLs)
• Include the HTTP ‘Prefer’ header as an acceptable CORS header
• Add version search parameter for ValueSet, CodeSystem and ConceptMap
• Add system search parameter for CodeSystem

Fixed

• Fix incorrect behaviour of id:present and id:missing search modifiers
• Fix bug with validation of multi-typed properties, e.g. ConceptMap.sourceUri

Changed

• Issue a 400 Bad Request for $translate requests that do not specify a target value set

Fixed

• Fix bug that was causing Ontoserver to not log to file.

Changed

• Ontoserver no longer includes headers to disable caching
• $closure operation now supports arbitrary CodeSystems (with hierarchy), not just SNOMED CT
• Updated to Spring-Boot 1.3.6

Fixed

• Fix $closure table bug relating to the order of the added codes
• Fix incorrect response code 5xx rather than 4xx when source/target URIs are omitted from a $translate request
• Fix CodeSystem validation to report all duplicate codes at once, rather than just the first one found