build(deps): bump github.com/fhirlint/fhirlint from 1.4.0 to 1.7.1

[dependabot]

Bumps github.com/fhirlint/fhirlint from 1.4.0 to 1.7.1.

Release notes

Sourced from github.com/fhirlint/fhirlint's releases.

v1.7.1

Changelog

• 974d298a6b44abfcfdee67b52c4fdf7794eace45 build(deps): bump actions/setup-java from 5.6.0 to 5.7.0 (#302)
• be9857f8fbadc05fd86eb48b8515540e7110819b build(deps): bump docker/login-action from 4.5.2 to 4.6.0 (#301)
• ff0ad919d5a63f02a71ea88139e1103e8fe8b368 build(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#300)
• fdf44fa54ef2d27dffcd07fe171d0e7fb82950c3 build(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#303)
• 0aba602cd2f7b01426fd1ef6ea86867d194b1e0f chore: bump version references to 1.7.1 (#309)
• b1035bd802e893d1d79093f7d39ba6a68233a98f fix(#304): exempt the local replay server from validator 6.10 SSRF protection (#305)
• 44230c473a9a94f30a12b9e25c7d1ed17c1a3b4c fix(#307): strip ANSI colour codes from validator output before parsing FHIRPath results (#308)

v1.7.0

Changelog

• fb143098f794c906dab273ebd212968d52521532 build(deps): bump docker/login-action from 4.4.0 to 4.5.2 (#291)
• 5687045de236827c6f36f07dda8e22b54faf86c5 build(deps): bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 (#290)
• 9dec82c8f13a84a732d632d93da9a8ac2af2cfba chore: bump version references to 1.7.0 (#299)
• 5a9c0308465415036cdc670cb84b70eb594efb74 feat(#287): add a language server so findings appear inline in the editor (#296)
• f1293a52289f03f6b80de4d2d51b5e5a2b665aa3 feat(#288): add --since to validate only files changed against a git ref (#294)
• 4cd8d8190e9dfd23dff04304028ff2fc9b59d851 feat(#289): replay recorded terminology with --tx-offline and fhirlint tx warm (#295)
• e4af627d9fad9b0eab0b94eac6d62c2c8712a3f4 feat(#297): expose --since and --tx-offline as action inputs (#298)
• a85d8947e348a526941934942c93791e401af6e7 fix(#292): bump golang.org/x/text to v0.40.0 for CVE-2026-56852 (#293)

v1.6.0

Four new features, all aimed at making a validation run reproducible and survivable in CI.

One behaviour change

The validator now uses your proxy environment. If HTTP_PROXY or HTTPS_PROXY is set, fhirlint passes it to the validator JAR, which previously ignored it and went straight out. On a proxied network that is the fix you wanted. If you had those variables set and were relying on the JAR reaching tx.fhir.org directly, set --terminology-server or --no-terminology-server instead.

Pin the validator version

fhirlint.lock recorded the IG packages but not the validator, so a fresh CI runner picked up whatever HL7 published that morning and could report different findings from unchanged sources.

# fhirlint.yml
validator-version: "6.9.12"

--lock now records the version in use, and a later run against a different validator fails instead of quietly producing different results. Move the pin with fhirlint update --validator-version <new>. Lock files written before this carry no version and only warn, so nothing breaks on upgrade.

Bound a run

--validation-timeout 2m and --max-messages 500 stop a pathological input from stalling a job or flooding a report. Both differ from --timeout, which kills the JVM and yields nothing.

Hitting either bound fails the run, and that is deliberate. When the validator stops early it returns only what it gathered, so files with real errors come back with none and count as valid: the same input that reports Valid: 0 Errors: 5 unbounded reports Valid: 2 Errors: 0 under --max-messages 1. Exiting 0 there would make a bound a way to turn a red pipeline green. Use --fail-on never if you want partial results accepted.

Proxy support

--proxy and --https-proxy route the validator's terminology calls, defaulting to the standard environment variables. Credentials go in FHIRLINT_PROXY_AUTH. There is deliberately no flag and no config key for them, since one would land in shell history and CI logs and the other in a committed file. Note that the validator takes the credential as a command-line argument, so it stays visible in ps for the duration of the run. fhirlint cannot change that.

Move the cache

... (truncated)

Commits

• 0aba602 chore: bump version references to 1.7.1 (#309)
• 44230c4 fix(#307): strip ANSI colour codes from validator output before parsing FHIRP...
• b1035bd fix(#304): exempt the local replay server from validator 6.10 SSRF protection...
• ff0ad91 build(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#300)
• be9857f build(deps): bump docker/login-action from 4.5.2 to 4.6.0 (#301)
• 974d298 build(deps): bump actions/setup-java from 5.6.0 to 5.7.0 (#302)
• fdf44fa build(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#303)
• 9dec82c chore: bump version references to 1.7.0 (#299)
• e4af627 feat(#297): expose --since and --tx-offline as action inputs (#298)
• 5a9c030 feat(#287): add a language server so findings appear inline in the editor (#296)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)