fhirsmith 0.15.1 → 0.16.0

package/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to Health Intersections FHIRsmith will be documented in this
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.16.0] - 2026-10-15
+
+### Security
+- 
+- Token: the login session store is now FHIRsmith's own (`library/sqlite-session-store.js`), in place of connect-sqlite3. connect-sqlite3 depends on sqlite3 5, which brought node-gyp 8, tar 6 and @tootallnate/once into every npm install of FHIRsmith (12 advisories, one critical). The `overrides` in package.json kept them out of a clone + `npm ci` (and so out of the Docker image and the repo's own `npm audit`), but npm ignores overrides when installing the published package, so `npm install -g fhirsmith` still got them. Sessions are kept in the same `sessions` table of the token database, in the same layout, so existing logins carry over
+- Dependencies: fhirpath 5 (its ucum-lhc no longer brings csv-parse 4) and node-cron 4 (no longer depends on uuid), for the same reason: the csv-parse and uuid overrides didn't reach npm installs. The csv-parse override is gone
+- Dependencies: natural 8 (uuid 13). Its stemmers are unchanged - every stemmer we use gives the same stem as natural 6 on ~1.6M words (RxNorm, LOINC's translations, and English, French, Spanish, Italian and Portuguese word lists), so existing SNOMED caches and RxNorm databases don't need rebuilding. FHIRsmith now loads only `natural/lib/natural/stemmers`: the package index also loads natural's storage backends, which run dotenv (reading any `.env` in the working directory into the environment, and in natural 8 printing a banner to stdout)
+- Development: jest 30 and jest-junit 17, and `npm run dev` uses Node's own `node --watch` in place of nodemon. With these, `npm audit` is clean for the dev tooling too (jest 29 and nodemon brought braces, and jest's coverage tooling sprintf-js, neither of which has a fixed version). The package.json overrides are down to one, js-yaml 4 for @istanbuljs/load-nyc-config, which only affects the dev install; the rest were no longer doing anything
+- The PR pipeline fails on high/critical advisories anywhere in the dependency tree, on moderate ones in what ships, and audits a fresh install of the packed package (installed the way users install it, so the repo's overrides don't apply)
+
+### Changed
+
+- The npm audit self-check looks up the latest FHIRsmith release, and only tells the administrator to upgrade when there is a newer release to upgrade to; a server already on the latest release says so instead
+
+### Tx Conformance Statement
+
+FHIRsmith v0.16.0 passed all 3630 HL7 terminology service tests (modes tx.fhir.org+omop+general+snomed+mimetypes+icd-11+closure, tests v1.9.6, runner v7.0.1)
+
 ## [0.15.1] - 2026-10-15
 
 ### Security

package/library/npm-audit.js

@@ -12,6 +12,11 @@
 //
 // Config (all optional), top level of config.json:
 //   "npmAudit": { "enabled": true, "intervalHours": 24 }
+//
+// Each check also looks up the latest fhirsmith release on npm, so the advice can say
+// whether upgrading will help. When this server is already on the latest release it won't:
+// npm ignores our package.json "overrides" for anything but a clone + npm ci, so an
+// npm-installed server can carry transitive versions the repo itself has overridden away.
 
 const fs = require('fs');
 const path = require('path');
@@ -19,6 +24,7 @@ const axios = require('axios');
 const escape = require('escape-html');
 
 const DEFAULT_URL = 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk';
+const DEFAULT_LATEST_URL = 'https://registry.npmjs.org/fhirsmith/latest';
 const SEVERITIES = ['critical', 'high', 'moderate', 'low', 'info'];
 const HOUR_MS = 60 * 60 * 1000;
 const FIRST_RUN_DELAY_MS = 60 * 1000; // let startup finish first
@@ -38,11 +44,34 @@ function describeAgo(time, now = Date.now()) {
   return `${Math.floor(hours / 24)} days ago`;
 }
 
+/**
+ * Compare two x.y.z versions numerically (pre-release and build suffixes ignored).
+ * Returns <0, 0 or >0, or null if either can't be read
+ */
+function compareVersions(a, b) {
+  const parse = v => {
+    const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(v || '').trim());
+    return m ? m.slice(1).map(Number) : null;
+  };
+  const x = parse(a);
+  const y = parse(b);
+  if (!x || !y) {
+    return null;
+  }
+  for (let i = 0; i < 3; i++) {
+    if (x[i] !== y[i]) {
+      return x[i] - y[i];
+    }
+  }
+  return 0;
+}
+
 class NpmAudit {
   constructor(config = {}, logger = null, appDir = path.join(__dirname, '..'), stats = null) {
     this.enabled = config.enabled !== false;
     this.intervalHours = config.intervalHours > 0 ? config.intervalHours : 24;
     this.url = config.url || DEFAULT_URL;
+    this.latestUrl = config.latestUrl || DEFAULT_LATEST_URL;
     this.timeout = config.timeout || 60000;
     this.logger = logger;
     this.appDir = appDir;
@@ -55,6 +84,8 @@ class NpmAudit {
     this.findings = []; // [{name, installed: [versions], id, severity, title, url, range}]
     this.lastError = null; // message from the last attempt, if it failed
     this.lastAttempt = null;
+    this.installedVersion = null; // this server's fhirsmith version, from package.json
+    this.latestVersion = null; // the latest fhirsmith release on npm, if it could be found
   }
 
   /**
@@ -93,6 +124,7 @@ class NpmAudit {
       const pkg = JSON.parse(fs.readFileSync(path.join(this.appDir, 'package.json'), 'utf8'));
       if (pkg.name && pkg.version) {
         add(pkg.name, pkg.version);
+        this.installedVersion = pkg.version;
       }
     } catch (e) {
       // no package.json - nothing to add
@@ -153,6 +185,39 @@ class NpmAudit {
     return true;
   }
 
+  /**
+   * Look up the latest fhirsmith release. A failure only means the advice is less specific,
+   * so it is logged and otherwise ignored (the previous answer is kept)
+   */
+  async checkLatest() {
+    try {
+      const response = await axios.get(this.latestUrl, { timeout: this.timeout, headers: { 'Accept': 'application/json' } });
+      const version = response.data && response.data.version;
+      if (typeof version === 'string' && compareVersions(version, version) === 0) {
+        this.latestVersion = version;
+      }
+    } catch (error) {
+      if (this.logger) {
+        this.logger.info('npm audit: could not look up the latest FHIRsmith release: ' + error.message);
+      }
+    }
+  }
+
+  /**
+   * What the administrator can do about the findings
+   */
+  advice() {
+    const cmp = compareVersions(this.installedVersion, this.latestVersion);
+    if (cmp === null) {
+      return 'The server administrator should upgrade to the latest FHIRsmith release.';
+    }
+    if (cmp < 0) {
+      return `The server administrator should upgrade to FHIRsmith ${this.latestVersion} (this server is running ${this.installedVersion}).`;
+    }
+    return `This server is already running the latest FHIRsmith release (${this.installedVersion}), ` +
+      'so these will be fixed by a future FHIRsmith release.';
+  }
+
   async run() {
     if (this.running) {
       return;
@@ -190,6 +255,7 @@ class NpmAudit {
       this.lastError = null;
       const summary = this.summary();
       if (findings.length > 0) {
+        await this.checkLatest();
         if (this.logger) {
           this.logger.warn(`npm audit: ${summary} in ${this.packageCount} packages: ` +
             findings.map(f => `${f.name} (${f.severity}) ${f.url}`).join('; '));
@@ -278,7 +344,7 @@ class NpmAudit {
     return `<div class="alert ${cls}" role="alert"><strong>Security:</strong> npm audit found ` +
       `${escape(this.summary())} in the packages this server uses ` +
       `(checked ${escape(describeAgo(this.checkedAt.getTime(), now))}). ` +
-      'The server administrator should upgrade to the latest FHIRsmith release. ' +
+      `${escape(this.advice())} ` +
       '<a href="/dashboard#npm-audit">Details</a></div>';
   }
 
@@ -303,6 +369,7 @@ class NpmAudit {
     }
     html += '</p>';
     if (this.findings.length > 0) {
+      html += `<p>${escape(this.advice())}</p>`;
       html += '<table class="grid"><tr><th>Severity</th><th>Package</th><th>Installed</th><th>Vulnerable</th><th>Advisory</th></tr>';
       for (const f of this.findings) {
         const link = /^https:\/\//.test(f.url) ? `<a href="${escape(f.url)}">${escape(f.title || f.url)}</a>` : escape(f.title);
@@ -315,4 +382,4 @@ class NpmAudit {
   }
 }
 
-module.exports = { NpmAudit, describeAgo };
+module.exports = { NpmAudit, describeAgo, compareVersions };

package/library/sqlite-session-store.js

@@ -0,0 +1,133 @@
+// library/sqlite-session-store.js
+// An express-session store kept in a table of an already-open sqlite3 database.
+//
+// This replaces connect-sqlite3, which depends on sqlite3 ^5 and so brought a second, old
+// copy of sqlite3 (and with it node-gyp 8 and tar 6) into every npm install of FHIRsmith.
+// Our package.json "overrides" hid that from npm audit in the repo, but npm ignores
+// overrides for anyone installing the published package.
+//
+// The table layout is the one connect-sqlite3 used - (sid PRIMARY KEY, expired, sess),
+// with expired in epoch ms and sess as JSON - so sessions in an existing database carry over.
+
+const session = require('express-session');
+
+const ONE_DAY_MS = 24 * 60 * 60 * 1000;
+const TABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+class SqliteSessionStore extends session.Store {
+  /**
+   * @param {object} options
+   * @param {object} options.db - an open sqlite3 Database; the caller owns it and closes it
+   * @param {string} [options.table='sessions']
+   * @param {number} [options.cleanupIntervalMs=one day] - how often expired sessions are deleted
+   */
+  constructor(options = {}) {
+    super();
+    if (!options.db) {
+      throw new Error('SqliteSessionStore needs an open sqlite3 database');
+    }
+    const table = options.table || 'sessions';
+    if (!TABLE_NAME.test(table)) {
+      throw new Error('Invalid session table name: ' + table);
+    }
+    this.db = options.db;
+    this.table = table;
+    this.timer = null;
+    this.ready = this.run(`CREATE TABLE IF NOT EXISTS ${table} (sid PRIMARY KEY, expired, sess)`)
+      .then(() => this.cleanup());
+    this.ready.catch(() => { /* reported by the first operation that waits on it */ });
+    const interval = options.cleanupIntervalMs > 0 ? options.cleanupIntervalMs : ONE_DAY_MS;
+    this.timer = setInterval(() => void this.cleanup().catch(() => {}), interval);
+    if (this.timer.unref) {
+      this.timer.unref();
+    }
+  }
+
+  run(sql, params = []) {
+    return new Promise((resolve, reject) => {
+      this.db.run(sql, params, function (err) {
+        if (err) {
+          reject(err);
+        } else {
+          resolve(this);
+        }
+      });
+    });
+  }
+
+  query(method, sql, params = []) {
+    return new Promise((resolve, reject) => {
+      this.db[method](sql, params, (err, result) => err ? reject(err) : resolve(result));
+    });
+  }
+
+  // adapt a promise to express-session's callback style
+  done(promise, cb) {
+    promise.then(result => cb && cb(null, result), err => cb && cb(err));
+  }
+
+  cleanup() {
+    return this.run(`DELETE FROM ${this.table} WHERE expired < ?`, [Date.now()]);
+  }
+
+  static expiry(sess) {
+    if (sess && sess.cookie) {
+      if (sess.cookie.expires) {
+        const t = new Date(sess.cookie.expires).getTime();
+        if (!isNaN(t)) {
+          return t;
+        }
+      }
+      if (sess.cookie.maxAge) {
+        return Date.now() + sess.cookie.maxAge;
+      }
+    }
+    return Date.now() + ONE_DAY_MS;
+  }
+
+  get(sid, cb) {
+    this.done(this.ready
+      .then(() => this.query('get', `SELECT sess FROM ${this.table} WHERE sid = ? AND expired >= ?`, [sid, Date.now()]))
+      .then(row => row ? JSON.parse(row.sess) : null), cb);
+  }
+
+  set(sid, sess, cb) {
+    this.done(this.ready
+      .then(() => this.run(`INSERT OR REPLACE INTO ${this.table} (sid, expired, sess) VALUES (?, ?, ?)`,
+        [sid, SqliteSessionStore.expiry(sess), JSON.stringify(sess)]))
+      .then(() => undefined), cb);
+  }
+
+  touch(sid, sess, cb) {
+    this.done(this.ready
+      .then(() => this.run(`UPDATE ${this.table} SET expired = ? WHERE sid = ? AND expired >= ?`,
+        [SqliteSessionStore.expiry(sess), sid, Date.now()]))
+      .then(() => undefined), cb);
+  }
+
+  destroy(sid, cb) {
+    this.done(this.ready
+      .then(() => this.run(`DELETE FROM ${this.table} WHERE sid = ?`, [sid]))
+      .then(() => undefined), cb);
+  }
+
+  length(cb) {
+    this.done(this.ready
+      .then(() => this.query('get', `SELECT COUNT(*) AS count FROM ${this.table} WHERE expired >= ?`, [Date.now()]))
+      .then(row => row.count), cb);
+  }
+
+  clear(cb) {
+    this.done(this.ready.then(() => this.run(`DELETE FROM ${this.table}`)).then(() => undefined), cb);
+  }
+
+  /** Stop the cleanup timer. The database itself belongs to the caller. */
+  close() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
+}
+
+module.exports = { SqliteSessionStore };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fhirsmith",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "txVersion": "1.9.6",
   "description": "A Node.js server that provides a collection of tools to serve the FHIR ecosystem",
   "main": "server.js",
@@ -9,18 +9,18 @@
   },
   "scripts": {
     "start": "node server.js",
-    "dev": "nodemon server.js",
+    "dev": "node --watch server.js",
     "test": "jest",
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage",
     "test:ci": "jest --ci --coverage --watchAll=false --reporters=default --reporters=jest-junit --verbose",
-    "test:shl": "jest --testPathPattern=shl",
-    "test:vcl": "jest --testPathPattern=vcl",
-    "test:xig": "jest --testPathPattern=xig",
-    "test:packages": "jest --testPathPattern=packages",
-    "test:token": "jest --testPathPattern=token",
-    "test:integration": "jest --testPathPattern=integration",
-    "test:unit": "jest --testPathPattern=unit",
+    "test:shl": "jest --testPathPatterns=shl",
+    "test:vcl": "jest --testPathPatterns=vcl",
+    "test:xig": "jest --testPathPatterns=xig",
+    "test:packages": "jest --testPathPatterns=packages",
+    "test:token": "jest --testPathPatterns=token",
+    "test:integration": "jest --testPathPatterns=integration",
+    "test:unit": "jest --testPathPatterns=unit",
     "lint": "eslint . --ext .js --ignore-path .gitignore",
     "lint:fix": "eslint . --fix --ignore-pattern 'static/assets/js/html5shiv.js'",
     "lint:relaxed": "eslint . --config .eslintrc.relaxed.js",
@@ -41,21 +41,20 @@
     "cli-progress": "^3.12.0",
     "commander": "^14.0.3",
     "commonmark": "^0.31.2",
-    "connect-sqlite3": "^0.9.18",
     "cors": "^2.8.6",
     "express": "^5.2.1",
     "express-rate-limit": "^7.4.1",
     "express-session": "^1.19.0",
     "fast-xml-parser": "^5.3.4",
     "fhir-validator-wrapper": "1.4.0",
-    "fhirpath": "^4.8.3",
+    "fhirpath": "^5.2.1",
     "fs-extra": "^11.3.3",
     "ini": "^6.0.0",
     "inquirer": "^8.2.5",
     "liquidjs": "^10.25.5",
     "lusca": "^1.7.0",
-    "natural": "^6.12.0",
-    "node-cron": "^3.0.3",
+    "natural": "^8.1.1",
+    "node-cron": "^4.6.0",
     "pako": "^2.1.0",
     "passport": "^0.7.0",
     "passport-facebook": "^3.0.0",
@@ -71,18 +70,17 @@
     "yaml": "^2.8.2"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.8",
+    "@types/jest": "^30.0.0",
     "@typescript-eslint/eslint-plugin": "^8.54.0",
     "@typescript-eslint/parser": "^8.54.0",
     "ajv": "^8.20.0",
     "eslint": "^8.57.1",
     "eslint-plugin-promise": "^7.2.1",
-    "jest": "^29.7.0",
-    "jest-environment-node": "^29.7.0",
-    "jest-junit": "^16.0.0",
+    "jest": "^30.5.2",
+    "jest-environment-node": "^30.5.2",
+    "jest-junit": "^17.0.0",
     "mock-fs": "^5.5.0",
     "nock": "^13.4.0",
-    "nodemon": "^3.1.11",
     "supertest": "^7.2.2",
     "tmp": "^0.2.5"
   },
@@ -107,16 +105,8 @@
   "author": "Health Intersections Pty Ltd",
   "license": "BSD-3",
   "overrides": {
-    "tar": "^7.5.7",
-    "fast-xml-parser": "^5.3.4",
-    "inquirer": {
-      "lodash": "4.18.1"
-    },
-    "brace-expansion": "^5.0.8",
-    "csv-parse": "^7.0.3",
-    "uuid": "^11.1.1",
-    "connect-sqlite3": {
-      "sqlite3": "$sqlite3"
+    "@istanbuljs/load-nyc-config": {
+      "js-yaml": "^4.1.0"
     }
   },
   "bin": {

package/token/token.js

@@ -11,7 +11,6 @@ const crypto = require('crypto');
 const path = require('path');
 const fs = require('fs');
 const session = require('express-session');
-const SQLiteStore = require('connect-sqlite3')(session);
 const passport = require('passport');
 const GoogleStrategy = require('passport-google-oauth20').Strategy;
 const FacebookStrategy = require('passport-facebook').Strategy;
@@ -19,6 +18,7 @@ const GitHubStrategy = require('passport-github2').Strategy;
 const rateLimit = require('express-rate-limit');
 const lusca = require('lusca');
 const folders = require('../library/folder-setup');
+const { SqliteSessionStore } = require('../library/sqlite-session-store');
 const escape = require('escape-html');
 
 
@@ -155,17 +155,11 @@ class TokenModule {
   }
 
   initializeSession() {
-    const configDb = this.config.database || 'token.db';
-    const sessionDbPath = path.isAbsolute(configDb)
-      ? configDb
-      : folders.ensureFilePath('token', configDb);
+    // sessions live in the module's own database (initializeDatabase has opened it)
+    this.sessionStore = new SqliteSessionStore({ db: this.db, table: 'sessions' });
 
     const sessionConfig = {
-      store: new SQLiteStore({
-        dir: path.dirname(sessionDbPath),
-        db: path.basename(sessionDbPath),
-        table: 'sessions'
-      }),
+      store: this.sessionStore,
       secret: this.config.sessionSecret || crypto.randomBytes(64).toString('hex'),
       name: 'fhir.token.sid', // Don't use default session name
       resave: false,
@@ -1287,6 +1281,9 @@ class TokenModule {
   }
 
   async shutdown() {
+    if (this.sessionStore) {
+      this.sessionStore.close();
+    }
     if (this.db) {
       await new Promise((resolve) => {
         this.db.close((err) => {

package/tx/importers/import-rxnorm.module.js

@@ -780,7 +780,7 @@ class RxNormImporter {
     if (this.options.verbose) console.log('Generating word stems...');
 
     // Simple English stemmer implementation
-    var natural = require('natural');
+    var natural = require('natural/lib/natural/stemmers'); // just the stemmers: the package index also loads its storage backends, and dotenv with them
     const stems = new Map();
 
     // Get all RXNORM concepts

package/tx/importers/import-sct.module.js

@@ -4,7 +4,7 @@ const inquirer = require('inquirer');
 const path = require('path');
 const readline = require('readline');
 const chalk = require('chalk');
-const natural = require('natural');
+const natural = require('natural/lib/natural/stemmers'); // just the stemmers: the package index also loads its storage backends, and dotenv with them
 
 const {
   SnomedStrings, SnomedWords, SnomedStems, SnomedReferences,

package/tx/library/designations.js

@@ -1,6 +1,6 @@
 const { LanguagePartType, Languages, Language, LanguageDefinitions} = require('../../library/languages');
 const {validateParameter, validateOptionalParameter, validateArrayParameter} = require("../../library/utilities");
-const natural = require('natural');
+const natural = require('natural/lib/natural/stemmers'); // just the stemmers: the package index also loads its storage backends, and dotenv with them
 /**
  * Display checking modes for concept designations
  */

package/tx/sct/text-index.js

@@ -27,7 +27,7 @@
  * event loop as it goes, and a search takes milliseconds once it exists.
  */
 
-const natural = require('natural');
+const natural = require('natural/lib/natural/stemmers'); // just the stemmers: the package index also loads its storage backends, and dotenv with them
 
 const stemmer = natural.PorterStemmer;