build(deps): bump github.com/fhirlint/fhirlint from 1.4.0 to 1.6.0

[dependabot]

Bumps github.com/fhirlint/fhirlint from 1.4.0 to 1.6.0.

Release notes

Sourced from github.com/fhirlint/fhirlint's releases.

v1.6.0

Four new features, all aimed at making a validation run reproducible and survivable in CI.

One behaviour change

The validator now uses your proxy environment. If HTTP_PROXY or HTTPS_PROXY is set, fhirlint passes it to the validator JAR, which previously ignored it and went straight out. On a proxied network that is the fix you wanted. If you had those variables set and were relying on the JAR reaching tx.fhir.org directly, set --terminology-server or --no-terminology-server instead.

Pin the validator version

fhirlint.lock recorded the IG packages but not the validator, so a fresh CI runner picked up whatever HL7 published that morning and could report different findings from unchanged sources.

# fhirlint.yml
validator-version: "6.9.12"

--lock now records the version in use, and a later run against a different validator fails instead of quietly producing different results. Move the pin with fhirlint update --validator-version <new>. Lock files written before this carry no version and only warn, so nothing breaks on upgrade.

Bound a run

--validation-timeout 2m and --max-messages 500 stop a pathological input from stalling a job or flooding a report. Both differ from --timeout, which kills the JVM and yields nothing.

Hitting either bound fails the run, and that is deliberate. When the validator stops early it returns only what it gathered, so files with real errors come back with none and count as valid: the same input that reports Valid: 0 Errors: 5 unbounded reports Valid: 2 Errors: 0 under --max-messages 1. Exiting 0 there would make a bound a way to turn a red pipeline green. Use --fail-on never if you want partial results accepted.

Proxy support

--proxy and --https-proxy route the validator's terminology calls, defaulting to the standard environment variables. Credentials go in FHIRLINT_PROXY_AUTH. There is deliberately no flag and no config key for them, since one would land in shell history and CI logs and the other in a committed file. Note that the validator takes the credential as a command-line argument, so it stays visible in ps for the duration of the run. fhirlint cannot change that.

Move the cache

FHIRLINT_CACHE_DIR relocates the JAR, the version files and the result cache. Useful for read-only-home containers and for CI runners caching a mounted volume. It was previously referenced in a test but read by nothing.

Better failure messages

An unreachable terminology server used to surface as validator produced no output — JAR may have crashed, with the cause buried under forty frames of stack trace. It now names the server, the reason, and the three ways out. Unrecognised failures keep the exception message and the first few frames instead of the whole trace.

Also

Unit tests now run on macOS and Windows, not just Linux. That immediately turned up three tests in internal/iglock that had been passing on Windows without ever reaching their assertion.

This is the first image with an SBOM attestation (#266 is fixed). See Verifying the image.

Changelog

• cbe406472a952085ed2e7988f2eb2c3a0e6a4f33 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#270)
• 5661202eeaed7d70ca5c7b3e80f7213b3a33e4e8 build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#269)
• fcff584af3913739ec4550e1c1640128673aa543 build(deps): bump actions/setup-java from 5.5.0 to 5.6.0 (#272)
• 443b1619d79133e67f31d4714255edb6c5f2bfb0 build(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 (#271)
• 7a38472f12aff70652183ecd061c129ea5d2b91d chore: bump version references to 1.6.0 (#286)
• ab9db1f30ea925377471df992e0c7bc3e8d6310d ci(#274): run unit tests on macOS and Windows (#275)
• a74dcf67cabdb12d7c1f0412b7288d6d217a9d15 feat(#276): pin the validator JAR version and record it in the lock file (#279)

... (truncated)

Commits

• 7a38472 chore: bump version references to 1.6.0 (#286)
• ec41f0e fix(#284): explain terminology server failures instead of blaming a JAR crash...
• d8800b5 feat(#277): first-class proxy support for the validator's terminology calls (...
• ba5b2ed feat(#278): add --validation-timeout and --max-messages as CI guard rails (#282)
• 2f43751 fix(#280): honour FHIRLINT_CACHE_DIR so tests stop mutating the real cache (#...
• a74dcf6 feat(#276): pin the validator JAR version and record it in the lock file (#279)
• ab9db1f ci(#274): run unit tests on macOS and Windows (#275)
• 195e407 ci: verify module cache integrity with go mod verify (#273)
• cbe4064 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#270)
• 443b161 build(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 (#271)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)