PVA/EVSRESTAPI-707: edit fhir terminology version handling

build.gradle

@@ -1,6 +1,6 @@
  buildscript {
   ext {
-    springBootVersion = '3.4.12'
+    springBootVersion = '3.5.13'
     // Remove this line to see what version is favored by springBootVersion
     // and the version brought in by spring-data-elasticsearch
     set('elasticsearch.version', '7.12.1')
@@ -87,26 +87,23 @@ dependencies {
 
   implementation "org.springframework.boot:spring-boot-devtools"
   implementation "org.springframework.boot:spring-boot-starter-actuator"
-  // Explicit patch for spring-core to mitigate CVE-2025-41249
-  implementation 'org.springframework:spring-core:6.2.11'
   implementation "org.springframework.boot:spring-boot-starter-cache"
   implementation "org.springframework.boot:spring-boot-properties-migrator"
   implementation "org.springframework:spring-aop"
 
-  // For vulnerabilities - may not be needed with Spring Boot 3.4.10
-  // implementation "org.apache.tomcat.embed:tomcat-embed-core:10.1.44"
-  implementation "com.fasterxml.jackson.core:jackson-core:2.18.6"
+  // These override org.hl7.fhir.*:6.4.0 requested by hapi-fhir-validation:7.6.1 and hapi-fhir-converter:7.6.1.
+  // 6.4.0 contains a vulnerability; 6.9.4 is the version co-packaged with HAPI FHIR that fixes it.
+  // These overrides can only be removed by upgrading to HAPI FHIR 8.x (a major breaking-change migration).
   implementation "org.fhir:ucum:1.0.9"
-  // These are needed to override dependencies from hapi-fhir-base (until it is fixed)
-  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.convertors:6.9.0"
-  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.dstu2:6.9.0"
-  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may:6.9.0"
-  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.dstu3:6.9.0"
-  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.r4:6.9.0"
-  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.r4b:6.9.0"
-  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.r5:6.9.0"
-  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.utilities:6.9.0"
-  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.validation:6.9.0"
+  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.convertors:6.9.4"
+  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.dstu2:6.9.4"
+  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may:6.9.4"
+  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.dstu3:6.9.4"
+  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.r4:6.9.4"
+  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.r4b:6.9.4"
+  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.r5:6.9.4"
+  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.utilities:6.9.4"
+  implementation "ca.uhn.hapi.fhir:org.hl7.fhir.validation:6.9.4"
 
   //implementation "org.springframework.data:spring-data-elasticsearch:4.2.12"
   implementation "org.opensearch.client:spring-data-opensearch-starter:1.7.1"
@@ -118,14 +115,15 @@ dependencies {
   //Java Mail Sender dependency
   implementation "org.springframework.boot:spring-boot-starter-mail"
 
-  implementation "org.aspectj:aspectjweaver:1.9.2"
+  // aspectjweaver is now managed by Spring Boot BOM (1.9.25.1 in 3.5.x)
+  implementation "org.aspectj:aspectjweaver"
   implementation "org.apache.commons:commons-text:1.10.0"
   //implementation "org.apache.opennlp:opennlp-tools:2.2.0"
 
   // Upgrade ecache to use jakarta - https://groups.google.com/g/ehcache-users/c/sKfxWuTpY-U
   // See also: https://stackoverflow.com/questions/75813659/gradle-could-not-find-org-ehcacheehcache-after-upgrading-to-spring-boot-3-0-x
   // Note: ehcache 3.10.8 uses Jakarta by default, no classifier needed
-  implementation "org.ehcache:ehcache:3.10.8"
+  implementation "org.ehcache:ehcache:3.10.9"
 
   // JAXB dependencies required for ehcache with Java 9+
   // ehcache 3.10.8 still uses javax.xml.bind internally for XML parsing

src/main/java/gov/nih/nci/evs/api/fhir/R4/CodeSystemProviderR4.java

@@ -141,6 +141,7 @@ public Parameters lookupImplicit(
         } else if (coding != null) {
           codeToLookup = coding.getCode();
         }
+        // This should be the latest (+monthly) version
         final CodeSystem codeSys = cs.get(0);
         final Terminology term =
             termUtils.getIndexedTerminology(codeSys.getTitle(), osQueryService, true);
@@ -296,6 +297,7 @@ public Parameters lookupInstance(
         } else if (coding != null) {
           codeToLookup = coding.getCode();
         }
+        // This should be the latest (+monthly) version
         final CodeSystem codeSys = cs.get(0);
         // if system is supplied, ensure it matches the url returned on the codeSys found by id
         if ((systemToLookup != null) && !codeSys.getUrl().equals(systemToLookup.getValue())) {
@@ -467,6 +469,7 @@ public Parameters validateCodeImplicit(
         } else if (coding != null) {
           codeToValidate = coding.getCode();
         }
+        // This should be the latest (+monthly) version
         final CodeSystem codeSys = cs.get(0);
         final Terminology term =
             termUtils.getIndexedTerminology(codeSys.getTitle(), osQueryService, true);
@@ -583,6 +586,7 @@ public Parameters validateCodeInstance(
         } else if (coding != null) {
           codeToValidate = coding.getCode();
         }
+        // This should be the latest (+monthly) version
         final CodeSystem codeSys = cs.get(0);
         // if url is supplied, ensure it matches the url returned on the codeSys found by id
         if ((systemToLookup != null) && !codeSys.getUrl().equals(systemToLookup.getValue())) {
@@ -707,6 +711,7 @@ public Parameters subsumesImplicit(
           throw FhirUtilityR4.exception(
               "No codeB parameter provided in request", OperationOutcome.IssueType.EXCEPTION, 400);
         }
+        // This should be the latest (+monthly) version
         final CodeSystem codeSys = cs.get(0);
         final Terminology term =
             termUtils.getIndexedTerminology(codeSys.getTitle(), osQueryService, true);
@@ -809,6 +814,7 @@ public Parameters subsumesInstance(
           throw FhirUtilityR4.exception(
               "No codeB parameter provided in request", OperationOutcome.IssueType.EXCEPTION, 400);
         }
+        // This should be the latest (+monthly) version
         final CodeSystem codeSys = cs.get(0);
         final Terminology term =
             termUtils.getIndexedTerminology(codeSys.getTitle(), osQueryService, true);
@@ -880,11 +886,9 @@ public Bundle findCodeSystems(
       FhirUtilityR4.notSupportedSearchParams(request);
       FhirUtilityR4.mutuallyExclusive("url", url, "system", system);
 
-      final List<Terminology> terms = termUtils.getIndexedTerminologies(osQueryService);
-
       final List<CodeSystem> list = new ArrayList<>();
-      for (final Terminology terminology : terms) {
-        final CodeSystem cs = FhirUtilityR4.toR4(terminology);
+      for (final CodeSystem cs : findPossibleCodeSystems(null, null, null)) {
+
         // Skip non-matching
         if ((id != null && !id.getValue().equals(cs.getId()))
             || (system != null && !system.getValue().equals(cs.getUrl()))) {
@@ -911,7 +915,7 @@ public Bundle findCodeSystems(
         list.add(cs);
       }
 
-      // Apply sorting if requested
+      // Apply sorting if requested via API
       applySorting(list, sort);
 
       return FhirUtilityR4.makeBundle(request, list, count, offset);
@@ -935,17 +939,16 @@ public Bundle findCodeSystems(
    * @throws Exception the exception
    */
   private List<CodeSystem> findPossibleCodeSystems(
-      @OptionalParam(name = "_id") final IdType id,
-      @OptionalParam(name = "url") final UriType url,
-      @OptionalParam(name = "version") final StringType version)
-      throws Exception {
+      final IdType id, final UriType url, final StringType version) throws Exception {
     try {
-      // If no ID and no url are specified, no code systems match
-      if (id == null && url == null) {
-        return new ArrayList<>(0);
-      }
+      // If no ID and no url are specified, ALL code systems match
+      //      if (id == null && url == null) {
+      //        return new ArrayList<>(0);
+      //      }
 
+      // Get all terminologies sorted on version
       final List<Terminology> terms = termUtils.getIndexedTerminologies(osQueryService);
+      Collections.sort(terms, TerminologyUtils.SORT_LATEST_MONTHLY);
 
       final List<CodeSystem> list = new ArrayList<>();
       for (final Terminology terminology : terms) {
@@ -963,6 +966,7 @@ private List<CodeSystem> findPossibleCodeSystems(
 
         list.add(cs);
       }
+
       return list;
     } catch (final FHIRServerResponseException e) {
       throw e;

src/main/java/gov/nih/nci/evs/api/fhir/R4/ConceptMapProviderR4.java

@@ -502,6 +502,7 @@ private List<ConceptMap> findPossibleConceptMaps(
         map.put(terminology.getTerminology(), terminology);
       }
       final List<Concept> mapsets = osQueryService.getMapsets(new IncludeParam("properties"));
+      Collections.sort(mapsets, TerminologyUtils.REVERSE_SORT_VERSIONS);
 
       final List<ConceptMap> list = new ArrayList<>();
       for (final Concept mapset : mapsets) {
@@ -554,6 +555,7 @@ private List<ConceptMap> findPossibleConceptMaps(
 
         list.add(cm);
       }
+
       return list;
     } catch (final FHIRServerResponseException e) {
       throw e;

src/main/java/gov/nih/nci/evs/api/fhir/R4/ValueSetProviderR4.java

@@ -1638,17 +1638,15 @@ public ValueSet getValueSet(@IdParam final IdType id) throws Exception {
    * @throws Exception the exception
    */
   private List<ValueSet> findPossibleValueSets(
-      @OptionalParam(name = "_id") final IdType id,
-      @OptionalParam(name = "system") final UriType system,
-      @OptionalParam(name = "url") final UriType url,
-      @OptionalParam(name = "version") final StringType version)
+      final IdType id, final UriType system, final UriType url, final StringType version)
       throws Exception {
     // If no ID and no url are specified, no code systems match
     if (id == null && url == null) {
       return new ArrayList<>(0);
     }
 
     final List<Terminology> terms = termUtils.getIndexedTerminologies(osQueryService);
+    Collections.sort(terms, TerminologyUtils.SORT_LATEST_MONTHLY);
     final Map<String, Terminology> map = new HashMap<>();
 
     final List<ValueSet> list = new ArrayList<ValueSet>();
@@ -1675,6 +1673,8 @@ private List<ValueSet> findPossibleValueSets(
 
       list.add(vs);
     }
+
+    // This currently only gets latest monthly subsets, not earlier versions
     final List<Concept> subsets = getNcitSubsets();
     final List<Concept> subsetsAsConcepts =
         subsets.stream().flatMap(Concept::streamSelfAndChildren).toList();

src/main/java/gov/nih/nci/evs/api/fhir/R5/CodeSystemProviderR5.java

@@ -122,12 +122,10 @@ public Bundle findCodeSystems(
       FhirUtilityR5.mutuallyExclusive("url", url, "system", system);
 
       // Get the indexed terms
-      final List<Terminology> terms = termUtils.getIndexedTerminologies(osQueryService);
       final List<CodeSystem> list = new ArrayList<>();
 
       // Find the matching code systems in the list of terms
-      for (final Terminology terminology : terms) {
-        final CodeSystem cs = FhirUtilityR5.toR5(terminology);
+      for (final CodeSystem cs : findPossibleCodeSystems(null, null, null)) {
 
         // Skip non-matching
         if ((id != null && !id.getValue().equals(cs.getIdPart()))
@@ -246,6 +244,7 @@ public Parameters lookupImplicit(
         } else if (coding != null) {
           codeToLookup = coding.getCode();
         }
+        // This should be the latest (+monthly) version
         final CodeSystem codeSys = cs.get(0);
         final Terminology term =
             termUtils.getIndexedTerminology(codeSys.getTitle(), osQueryService, true);
@@ -399,6 +398,7 @@ public Parameters lookupInstance(
         } else if (coding != null) {
           codeToLookup = coding.getCode();
         }
+        // This should be the latest (+monthly) version
         final CodeSystem codeSys = cs.get(0);
         if ((systemToLookup != null) && !codeSys.getUrl().equals(systemToLookup.getValue())) {
           throw FhirUtilityR5.exception(
@@ -989,16 +989,16 @@ public CodeSystem getCodeSystem(@IdParam final IdType id) throws Exception {
    * @throws Exception exception
    */
   private List<CodeSystem> findPossibleCodeSystems(
-      @OperationParam(name = "_id") final IdType id,
-      @OperationParam(name = "url") final UriType url,
-      @OperationParam(name = "version") final StringType version)
-      throws Exception {
+      final IdType id, final UriType url, final StringType version) throws Exception {
     try {
-      if (id == null && url == null) {
-        return new ArrayList<>(0);
-      }
+      // If no ID and no url are specified, ALL code systems match
+      //      if (id == null && url == null) {
+      //        return new ArrayList<>(0);
+      //      }
 
       final List<Terminology> terms = termUtils.getIndexedTerminologies(osQueryService);
+      Collections.sort(terms, TerminologyUtils.SORT_LATEST_MONTHLY);
+
       final List<CodeSystem> list = new ArrayList<>();
       // Find the matching code systems
       for (final Terminology terminology : terms) {
@@ -1015,6 +1015,7 @@ private List<CodeSystem> findPossibleCodeSystems(
         }
         list.add(cs);
       }
+
       return list;
     } catch (final FHIRServerResponseException e) {
       throw e;

src/main/java/gov/nih/nci/evs/api/fhir/R5/ConceptMapProviderR5.java

@@ -588,6 +588,7 @@ private List<ConceptMap> findPossibleConceptMaps(
         map.put(terminology.getTerminology(), terminology);
       }
       final List<Concept> mapsets = osQueryService.getMapsets(new IncludeParam("properties"));
+      Collections.sort(mapsets, TerminologyUtils.REVERSE_SORT_VERSIONS);
 
       final List<ConceptMap> list = new ArrayList<>();
       // Find the matching mapsets
@@ -633,6 +634,7 @@ private List<ConceptMap> findPossibleConceptMaps(
 
         list.add(cm);
       }
+
       return list;
     } catch (final FHIRServerResponseException e) {
       throw e;

src/main/java/gov/nih/nci/evs/api/fhir/R5/OpenApiInterceptorR5.java

@@ -932,6 +932,7 @@ private CapabilityStatement getCapabilityStatement(
    * @param theResourceType the resource type
    * @param theOperation the operation
    */
+  @SuppressWarnings("null")
   private void addFhirOperation(
       final FhirContext theFhirContext,
       final OpenAPI theOpenApi,

src/main/java/gov/nih/nci/evs/api/fhir/R5/ValueSetProviderR5.java

@@ -1259,17 +1259,16 @@ public ValueSet getValueSet(@IdParam final IdType id) throws Exception {
    * @throws Exception the exception
    */
   public List<ValueSet> findPossibleValueSets(
-      @OptionalParam(name = "_id") final IdType id,
-      @OptionalParam(name = "system") final UriType system,
-      @OptionalParam(name = "url") final UriType url,
-      @OptionalParam(name = "version") final StringType version)
+      final IdType id, final UriType system, final UriType url, final StringType version)
       throws Exception {
     // If no ID and no url are specified, no code systems match
     if (id == null && url == null) {
       return new ArrayList<>(0);
     }
 
     final List<Terminology> terms = termUtils.getIndexedTerminologies(osQueryService);
+    Collections.sort(terms, TerminologyUtils.SORT_LATEST_MONTHLY);
+
     final List<ValueSet> list = new ArrayList<ValueSet>();
     final Map<String, Terminology> map = new HashMap<>();
     for (final Terminology terminology : terms) {
@@ -1294,6 +1293,7 @@ public List<ValueSet> findPossibleValueSets(
       }
       list.add(vs);
     }
+    // This currently only gets latest monthly subsets, not earlier versions
     final List<Concept> subsets = getNcitSubsets();
     final Set<Concept> subsetsAsConcepts =
         subsets.stream().flatMap(Concept::streamSelfAndChildren).collect(Collectors.toSet());
@@ -1315,6 +1315,7 @@ public List<ValueSet> findPossibleValueSets(
       }
       list.add(vs);
     }
+
     return list;
   }
 

src/main/java/gov/nih/nci/evs/api/service/LoaderServiceImpl.java

@@ -72,7 +72,6 @@ public static void setStaticServices(
   }
 
   @PostConstruct
-  @SuppressWarnings("static-access")
   public void init() {
     setStaticServices(this.operationsService, this.osQueryService, this.termUtils);
   }

src/main/java/gov/nih/nci/evs/api/service/OpenSearchServiceImpl.java

@@ -129,7 +129,8 @@ public ConceptResultList findConcepts(
             .withQuery(boolQuery)
             .withPageable(pageable)
             .withSourceFilter(
-                new FetchSourceFilter(include.getIncludedFields(), include.getExcludedFields()));
+                new FetchSourceFilter(
+                    true, include.getIncludedFields(), include.getExcludedFields()));
 
     // avoid setting min score
     // .withMinScore(0.01f);