build(deps): bump github.com/fhirlint/fhirlint from 1.4.0 to 1.7.0

[dependabot]

Bumps github.com/fhirlint/fhirlint from 1.4.0 to 1.7.0.

Release notes

Sourced from github.com/fhirlint/fhirlint's releases.

v1.7.0

Changelog

• fb143098f794c906dab273ebd212968d52521532 build(deps): bump docker/login-action from 4.4.0 to 4.5.2 (#291)
• 5687045de236827c6f36f07dda8e22b54faf86c5 build(deps): bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 (#290)
• 9dec82c8f13a84a732d632d93da9a8ac2af2cfba chore: bump version references to 1.7.0 (#299)
• 5a9c0308465415036cdc670cb84b70eb594efb74 feat(#287): add a language server so findings appear inline in the editor (#296)
• f1293a52289f03f6b80de4d2d51b5e5a2b665aa3 feat(#288): add --since to validate only files changed against a git ref (#294)
• 4cd8d8190e9dfd23dff04304028ff2fc9b59d851 feat(#289): replay recorded terminology with --tx-offline and fhirlint tx warm (#295)
• e4af627d9fad9b0eab0b94eac6d62c2c8712a3f4 feat(#297): expose --since and --tx-offline as action inputs (#298)
• a85d8947e348a526941934942c93791e401af6e7 fix(#292): bump golang.org/x/text to v0.40.0 for CVE-2026-56852 (#293)

v1.6.0

Four new features, all aimed at making a validation run reproducible and survivable in CI.

One behaviour change

The validator now uses your proxy environment. If HTTP_PROXY or HTTPS_PROXY is set, fhirlint passes it to the validator JAR, which previously ignored it and went straight out. On a proxied network that is the fix you wanted. If you had those variables set and were relying on the JAR reaching tx.fhir.org directly, set --terminology-server or --no-terminology-server instead.

Pin the validator version

fhirlint.lock recorded the IG packages but not the validator, so a fresh CI runner picked up whatever HL7 published that morning and could report different findings from unchanged sources.

# fhirlint.yml
validator-version: "6.9.12"

--lock now records the version in use, and a later run against a different validator fails instead of quietly producing different results. Move the pin with fhirlint update --validator-version <new>. Lock files written before this carry no version and only warn, so nothing breaks on upgrade.

Bound a run

--validation-timeout 2m and --max-messages 500 stop a pathological input from stalling a job or flooding a report. Both differ from --timeout, which kills the JVM and yields nothing.

Hitting either bound fails the run, and that is deliberate. When the validator stops early it returns only what it gathered, so files with real errors come back with none and count as valid: the same input that reports Valid: 0 Errors: 5 unbounded reports Valid: 2 Errors: 0 under --max-messages 1. Exiting 0 there would make a bound a way to turn a red pipeline green. Use --fail-on never if you want partial results accepted.

Proxy support

--proxy and --https-proxy route the validator's terminology calls, defaulting to the standard environment variables. Credentials go in FHIRLINT_PROXY_AUTH. There is deliberately no flag and no config key for them, since one would land in shell history and CI logs and the other in a committed file. Note that the validator takes the credential as a command-line argument, so it stays visible in ps for the duration of the run. fhirlint cannot change that.

Move the cache

FHIRLINT_CACHE_DIR relocates the JAR, the version files and the result cache. Useful for read-only-home containers and for CI runners caching a mounted volume. It was previously referenced in a test but read by nothing.

Better failure messages

An unreachable terminology server used to surface as validator produced no output — JAR may have crashed, with the cause buried under forty frames of stack trace. It now names the server, the reason, and the three ways out. Unrecognised failures keep the exception message and the first few frames instead of the whole trace.

Also

Unit tests now run on macOS and Windows, not just Linux. That immediately turned up three tests in internal/iglock that had been passing on Windows without ever reaching their assertion.

... (truncated)

Commits

• 9dec82c chore: bump version references to 1.7.0 (#299)
• e4af627 feat(#297): expose --since and --tx-offline as action inputs (#298)
• 5a9c030 feat(#287): add a language server so findings appear inline in the editor (#296)
• 4cd8d81 feat(#289): replay recorded terminology with --tx-offline and fhirlint tx war...
• f1293a5 feat(#288): add --since to validate only files changed against a git ref (#294)
• 5687045 build(deps): bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 (#290)
• fb14309 build(deps): bump docker/login-action from 4.4.0 to 4.5.2 (#291)
• a85d894 fix(#292): bump golang.org/x/text to v0.40.0 for CVE-2026-56852 (#293)
• 7a38472 chore: bump version references to 1.6.0 (#286)
• ec41f0e fix(#284): explain terminology server failures instead of blaming a JAR crash...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #62.