build(deps): bump github.com/fhirlint/fhirlint from 1.4.0 to 1.11.1

[dependabot]

Bumps github.com/fhirlint/fhirlint from 1.4.0 to 1.11.1.

Release notes

Sourced from github.com/fhirlint/fhirlint's releases.

v1.11.1

A patch release: one fix to the update notice, plus the integration-test validator pin moved to 6.10.3.

About the feat( prefix below

#377 is a bug fix, not a feature. The commit was typed wrong; the version follows what the change does.

The update notice was recommending fhirlint update for a validator release that could not be installed. Upstream 6.10.3 briefly shipped a validator_cli.jar that did not match its own signature (hapifhir/org.hl7.fhir.core#2595, since fixed), so fhirlint refused it, while the notice went on suggesting it every 24 hours.

fhirlint now remembers a release that failed verification and says so instead:

validator  6.10.2 → 6.10.3    the PGP signature did not verify here on 2026-09-01;
                              retry with: fhirlint update

The row stays visible, so nobody is left stuck on an older JAR without an explanation, and the retry stays available, so an upstream fix is picked up on the next attempt and the note clears itself.

Nothing was added that anyone asked for, which is why this is 1.11.1 and not 1.12.0.

Changelog

• 9d9e806fb84c1fee3ca0af2391024e4c1ca63794 feat(#377): record rejected validator releases so the update notice stops recommending them (#379)

v1.11.0

Changelog

• bcc63eb728be060ebeb0f9c66cffa37e2319664f build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#374)
• 62c9d4ab6e4122e8ce3ea248a8875969cd694e8e build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.24 (#373)
• 0f48b1c2daeffaa8f2795917f119995b4170d4c8 build(deps): bump golang from 1.26.6-alpine to 1.27.0-alpine (#372)
• 5bf47a6abde21ba5fb35305d83fbf21eb8b3541b feat(#368): built-in aliases for the gematik ISiK profiles (#370)
• 40f703319c8823877e34c661ee80bb8fd525af38 fix: exclude the runtime stage from the build cache so apk upgrade actually runs (#371)
• 8c6280e6210556a2ddf497062dc1247f35c34e65 fix: say what to do when the validator JAR fails verification (#375)

v1.10.0

Changelog

• beee39f9e9f85e921726dfe033e86c0cc3c242cf feat(#360): notify when a new fhirlint release exists, not only a new validator JAR (#362)
• 8d8e3fe992d9aa58d2bc9161d6ebd1d119763930 feat(#363): fhirlint packages — show the FHIR package cache and a package's dependency tree (#365)
• 0891ec1b26477e4cab0fbd0ba7399516b7bff428 feat(#364): audit the config's ig: list when there is no lock file (#366)
• 49ed4db6a526b25b2d06b472976219cb27d60fc7 fix(#358): verify the validator JAR against HL7's PGP signature, not a .sha256 that never existed (#359)

v1.9.0

Behaviour changes

Two built-in profile aliases now resolve to something that exists. Both were broken, not merely outdated:

• diga now means kbv.mio.diga#1.1.0, the KBV's MIO DiGA Toolkit. It pointed at de.bfarm.diga, which has never existed on any registry — the BfArM writes the regulation, the KBV publishes the FHIR artefacts. (#335)
• mii now loads the six MII Kerndatensatz modules. It pointed at a version of an umbrella package that does not exist, so --profile mii has never worked against a cold package cache. The modules are not on a common release train, so mii pulls two versions of the shared kerndatensatz.meta package; use the new per-module aliases (mii-person, mii-fall, mii-diagnose, mii-prozedur, mii-laborbefund, mii-medikation) to stay on one. (#334)
• kbv-basis / kbv-patient move from kbv.basis#1.5.0 to 1.9.0. (#335)

Two more changes you may notice:

... (truncated)

Commits

• 641e586 chore: bump version references to 1.11.1 (#380)
• 9d9e806 feat(#377): record rejected validator releases so the update notice stops rec...
• 010fa51 chore: bump the integration-test validator pin to 6.10.3 (#378)
• 84d2819 chore: bump version references to 1.11.0 (#376)
• 8c6280e fix: say what to do when the validator JAR fails verification (#375)
• bcc63eb build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#374)
• 62c9d4a build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.24 (#373)
• 0f48b1c build(deps): bump golang from 1.26.6-alpine to 1.27.0-alpine (#372)
• f808ef3 chore: bump the integration-test validator pin to 6.10.2 (#369)
• 5bf47a6 feat(#368): built-in aliases for the gematik ISiK profiles (#370)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)