build(deps): bump github.com/fhirlint/fhirlint from 1.4.0 to 1.8.0

[dependabot]

Bumps github.com/fhirlint/fhirlint from 1.4.0 to 1.8.0.

Release notes

Sourced from github.com/fhirlint/fhirlint's releases.

v1.8.0

Changelog

• 0ffd09246410d66d82d34b2906d0b4b327ca1646 build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 (#320)
• 9a7f4ef338ab5663848ea1b25bca8f8d1883e434 ci(#310): pin the validator for push runs, test latest in a weekly canary (#313)
• 349a9fca682b9dab0a66f7b973184d6259c8947f feat(#311): add severity-override to re-level findings instead of hiding them (#314)
• fb8ab6ede709d7360157e1b388eb3d4e4224753b feat(#312): add --group to collapse repeated findings in terminal output (#315)
• 3ae3bf146e289ffbab5193da76231663dcf35ac8 feat(#324): add fhirlint coverage for must-support element coverage (#329)
• a3a8042d34f8cc1c756e2bc37384c803c3b062de feat(#324): download missing IG packages for coverage, verified against the registry checksum (#330) (#331)
• 4c233a2a29f81f16474f0a1e92c9b6adaa9a943e feat(#325): add --redact to strip resource content from reports (#328)
• 34212416eac1352d3ed30b64053670ffde6f3a76 feat(#326): audit the IG packages in fhirlint.lock, not just the JAR (#327)
• d41fc51f61643c4c4fa231cd906d5df0fbeeb7c5 fix(#316): report cache read/write failures instead of failing silently (#317)
• f9f919c80eb16bdf19fe9544f763af59413aed84 fix(#321): bump Go to 1.25.13 and builder image to 1.26.6 for stdlib CVEs (#322)
• f3870eb86f24613d4e1aeffc9ec14c548c0e7bb4 refactor(#306): derive FHIR version list, names and paths from one table (#318)

v1.7.1

Changelog

• 974d298a6b44abfcfdee67b52c4fdf7794eace45 build(deps): bump actions/setup-java from 5.6.0 to 5.7.0 (#302)
• be9857f8fbadc05fd86eb48b8515540e7110819b build(deps): bump docker/login-action from 4.5.2 to 4.6.0 (#301)
• ff0ad919d5a63f02a71ea88139e1103e8fe8b368 build(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#300)
• fdf44fa54ef2d27dffcd07fe171d0e7fb82950c3 build(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#303)
• 0aba602cd2f7b01426fd1ef6ea86867d194b1e0f chore: bump version references to 1.7.1 (#309)
• b1035bd802e893d1d79093f7d39ba6a68233a98f fix(#304): exempt the local replay server from validator 6.10 SSRF protection (#305)
• 44230c473a9a94f30a12b9e25c7d1ed17c1a3b4c fix(#307): strip ANSI colour codes from validator output before parsing FHIRPath results (#308)

v1.7.0

Changelog

• fb143098f794c906dab273ebd212968d52521532 build(deps): bump docker/login-action from 4.4.0 to 4.5.2 (#291)
• 5687045de236827c6f36f07dda8e22b54faf86c5 build(deps): bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 (#290)
• 9dec82c8f13a84a732d632d93da9a8ac2af2cfba chore: bump version references to 1.7.0 (#299)
• 5a9c0308465415036cdc670cb84b70eb594efb74 feat(#287): add a language server so findings appear inline in the editor (#296)
• f1293a52289f03f6b80de4d2d51b5e5a2b665aa3 feat(#288): add --since to validate only files changed against a git ref (#294)
• 4cd8d8190e9dfd23dff04304028ff2fc9b59d851 feat(#289): replay recorded terminology with --tx-offline and fhirlint tx warm (#295)
• e4af627d9fad9b0eab0b94eac6d62c2c8712a3f4 feat(#297): expose --since and --tx-offline as action inputs (#298)
• a85d8947e348a526941934942c93791e401af6e7 fix(#292): bump golang.org/x/text to v0.40.0 for CVE-2026-56852 (#293)

v1.6.0

Four new features, all aimed at making a validation run reproducible and survivable in CI.

One behaviour change

The validator now uses your proxy environment. If HTTP_PROXY or HTTPS_PROXY is set, fhirlint passes it to the validator JAR, which previously ignored it and went straight out. On a proxied network that is the fix you wanted. If you had those variables set and were relying on the JAR reaching tx.fhir.org directly, set --terminology-server or --no-terminology-server instead.

Pin the validator version

fhirlint.lock recorded the IG packages but not the validator, so a fresh CI runner picked up whatever HL7 published that morning and could report different findings from unchanged sources.

# fhirlint.yml
validator-version: "6.9.12"

... (truncated)

Commits

• dcd4251 chore: bump version references to 1.8.0 and exclude chore commits from releas...
• a3a8042 feat(#324): download missing IG packages for coverage, verified against the r...
• 3ae3bf1 feat(#324): add fhirlint coverage for must-support element coverage (#329)
• 4c233a2 feat(#325): add --redact to strip resource content from reports (#328)
• 3421241 feat(#326): audit the IG packages in fhirlint.lock, not just the JAR (#327)
• ecb7aef chore: remove Reddit post draft from the repo (#323)
• 0ffd092 build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 (#320)
• f9f919c fix(#321): bump Go to 1.25.13 and builder image to 1.26.6 for stdlib CVEs (#322)
• f3870eb refactor(#306): derive FHIR version list, names and paths from one table (#318)
• d41fc51 fix(#316): report cache read/write failures instead of failing silently (#317)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #68.