build(deps): bump github.com/fhirlint/fhirlint from 1.4.0 to 1.10.0

[dependabot]

Bumps github.com/fhirlint/fhirlint from 1.4.0 to 1.10.0.

Release notes

Sourced from github.com/fhirlint/fhirlint's releases.

v1.10.0

Changelog

• beee39f9e9f85e921726dfe033e86c0cc3c242cf feat(#360): notify when a new fhirlint release exists, not only a new validator JAR (#362)
• 8d8e3fe992d9aa58d2bc9161d6ebd1d119763930 feat(#363): fhirlint packages — show the FHIR package cache and a package's dependency tree (#365)
• 0891ec1b26477e4cab0fbd0ba7399516b7bff428 feat(#364): audit the config's ig: list when there is no lock file (#366)
• 49ed4db6a526b25b2d06b472976219cb27d60fc7 fix(#358): verify the validator JAR against HL7's PGP signature, not a .sha256 that never existed (#359)

v1.9.0

Behaviour changes

Two built-in profile aliases now resolve to something that exists. Both were broken, not merely outdated:

• diga now means kbv.mio.diga#1.1.0, the KBV's MIO DiGA Toolkit. It pointed at de.bfarm.diga, which has never existed on any registry — the BfArM writes the regulation, the KBV publishes the FHIR artefacts. (#335)
• mii now loads the six MII Kerndatensatz modules. It pointed at a version of an umbrella package that does not exist, so --profile mii has never worked against a cold package cache. The modules are not on a common release train, so mii pulls two versions of the shared kerndatensatz.meta package; use the new per-module aliases (mii-person, mii-fall, mii-diagnose, mii-prozedur, mii-laborbefund, mii-medikation) to stay on one. (#334)
• kbv-basis / kbv-patient move from kbv.basis#1.5.0 to 1.9.0. (#335)

Two more changes you may notice:

• The validator's JVM is now started with -Duser.home set to the home directory fhirlint itself uses. On Linux the JVM reads user.home from the OS passwd entry and ignores $HOME, so on a CI runner that exports a writable $HOME the two disagreed — fhirlint wrote to one place and the validator read from another. Same directory on an ordinary machine, so nothing changes there; a user.home you set through JAVA_TOOL_OPTIONS still wins. (#351)
• pkg/fhirlint.ValidateDir picks up line-delimited exports and mapping files, which it silently skipped before. A directory of .ndjson used to return no results and no error. (#340)

Failures from the validator itself now carry what it printed. It writes even fatal errors to stdout while leaving stderr empty, which fhirlint discarded — so an unwritable cache, an unknown parameter or an uncaught exception all arrived as "validator produced no output" with nothing after it. (#351)

Changelog

• 6a24c482e40dc97bcd17327e99bcec276e9f8a92 feat(#337): export suppression rules as a validator advisor file (#346)
• 01a98a2890584eed00ceb9c3d7f64e1364e04514 feat(#338): surface and control the validator's code-checking size limit (#347)
• b04d9d0258267bff5a07d271370bf9629486f766 feat(#339): add --offline to forbid network access for a run (#348)
• b139a26e3cbf8fc96a7024856349cd6aca92d66d feat(#340,#341): derive input extensions from one table, accept .jsonl and .fml (#349)
• cb1bb3d1aba3de01299720dc72f53fdc53032918 feat(#353): authenticate to a terminology server with credentials from the environment (#355)
• 1a07def18b27b3e14e81598055c25405e3e3c3da fix(#334): resolve profile aliases to one or more packages and repair mii (#342)
• 3b253fc4048b1c6954f74ee117070d1a27986ad0 fix(#335): repoint diga at kbv.mio.diga and bump kbv.basis to 1.9.0 (#344)
• b170f458b3bf47bc66102745ee15b3db19388e55 fix(#351): report what the validator printed, and pin its user.home to $HOME (#354)
• 37d8ccfa94c18bf88d03d5dedf8a359ccea4422c fix: exclude scoped housekeeping commits from release notes (#333)

v1.8.0

Changelog

• 0ffd09246410d66d82d34b2906d0b4b327ca1646 build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 (#320)
• 9a7f4ef338ab5663848ea1b25bca8f8d1883e434 ci(#310): pin the validator for push runs, test latest in a weekly canary (#313)
• 349a9fca682b9dab0a66f7b973184d6259c8947f feat(#311): add severity-override to re-level findings instead of hiding them (#314)
• fb8ab6ede709d7360157e1b388eb3d4e4224753b feat(#312): add --group to collapse repeated findings in terminal output (#315)
• 3ae3bf146e289ffbab5193da76231663dcf35ac8 feat(#324): add fhirlint coverage for must-support element coverage (#329)
• a3a8042d34f8cc1c756e2bc37384c803c3b062de feat(#324): download missing IG packages for coverage, verified against the registry checksum (#330) (#331)
• 4c233a2a29f81f16474f0a1e92c9b6adaa9a943e feat(#325): add --redact to strip resource content from reports (#328)
• 34212416eac1352d3ed30b64053670ffde6f3a76 feat(#326): audit the IG packages in fhirlint.lock, not just the JAR (#327)
• d41fc51f61643c4c4fa231cd906d5df0fbeeb7c5 fix(#316): report cache read/write failures instead of failing silently (#317)
• f9f919c80eb16bdf19fe9544f763af59413aed84 fix(#321): bump Go to 1.25.13 and builder image to 1.26.6 for stdlib CVEs (#322)
• f3870eb86f24613d4e1aeffc9ec14c548c0e7bb4 refactor(#306): derive FHIR version list, names and paths from one table (#318)

v1.7.1

Changelog

... (truncated)

Commits

• 88a7a41 chore: bump version references to 1.10.0 (#367)
• 0891ec1 feat(#364): audit the config's ig: list when there is no lock file (#366)
• 8d8e3fe feat(#363): fhirlint packages — show the FHIR package cache and a package's d...
• beee39f feat(#360): notify when a new fhirlint release exists, not only a new validat...
• 49ed4db fix(#358): verify the validator JAR against HL7's PGP signature, not a .sha25...
• 295949f chore: bump version references to 1.9.0 (#357)
• c367d11 ci(#306): verify the FHIR version table against the registry, and watch for R...
• cb1bb3d feat(#353): authenticate to a terminology server with credentials from the en...
• b170f45 fix(#351): report what the validator printed, and pin its user.home to $HOME ...
• 193bf41 ci(#340): run the cmd integration tests, which CI never built (#350)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #72.