OpenEMR Files

8.3.0 - 2026-08-18

Minimum supported versions

• PHP 8.3+
• MariaDB 10.6+
• MySQL 5.7+

See the tested CI matrix for all tested version combinations.

Security Fixes

• [Critical] Authenticated arbitrary file read/write in oe-module-faxsms leading to potential RCE (GHSA-38jw-pwgq-9hpj)
• [Critical] Authenticated SQL injection in the Fee Sheet inventory check (ORDER BY) (GHSA-cg8c-2v5q-29g7)
• [Critical] openemr 8.2.0: authenticated arbitrary file read/write in the fax/sms module (disposeDocument) (GHSA-wf4w-mx2w-j4vv)
• [High] Missing authorization (IDOR) in DICOM document-state AJAX library/ajax/upload.php — incomplete fix of GHSA-qj9f-x7v2-hrr7 (GHSA-7h7v-29jv-527v)
• [High] Arbitrary file read and arbitrary-path write via file_path in FaxSMS RCFaxClient/SignalWireClient disposeDocument (GHSA-x2vr-jgg8-c57c)
• [High] Arbitrary Patient Recall Deletion (GHSA-776r-c638-hw6j)
• [High] Arbitrary Patient Recall Update (GHSA-j347-wp33-79q9)
• [High] Authenticated arbitrary SQL execution via backup import in backup.php (GHSA-26g3-9466-c639)
• [High] Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration (GHSA-9rj4-fxmj-c4r7)
• [High] Broken object authorization in SOAP note update API allows unauthorized overwrite of another patient’s SOAP note (GHSA-jf26-6rhx-xw6m)
• [High] Classic document controller can lead to cross-patient document exfiltration and chart tampering (GHSA-89j2-7cg2-mm93)
• [High] Cross-patient IDOR across many encounter-form viewers and save handlers (missing patient/encounter ownership check) (GHSA-3mg9-27fw-m9j6)
• [High] Cross-patient PHI disclosure (IDOR) in patient portal via case-sensitive Pid parameter — bypass of the portal pid authorization guard (GHSA-39jh-r9hg-rwg7)
• [High] CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations (GHSA-p8j4-vmx9-rfhj)
• [High] eval() on Database-Sourced Data in Tree Construction (GHSA-4rj4-g6h7-wvfg)
• [High] GET/POST /interface/main/messages/save.php Trust Attacker-Supplied pid, Allow Arbitrary Patient Demographics Read and Overwrite (GHSA-jwvx-828p-m5hq)
• [High] High-Sensitivity Encounter Forms Bypass via Direct Loaders (GHSA-v58f-jcq4-pc4w)
• [High] IDOR in portal/lib/persist.php (setting_patient) Allows Cross-Patient Settings Tamper / Notification Hijack (GHSA-jvhx-fg6j-8c9x)
• [High] Missing ACL Checks on Portal Payment Page (GHSA-j2cx-3p5q-ppx5)
• [High] Missing Authorization & IDOR in sl_eob_invoice.php Allows Any Authenticated User to Read & Modify Billing Data for Any Encounter (GHSA-55gc-5wj7-xxp7)
• [High] Missing Authorization & IDOR in sl_eob_patient_note.php Allows Any Authenticated User to Read & Modify Any Patient's Billing Note (GHSA-74j7-7q95-rvxg)
• [High] Missing authorization in DORN compendium_install.php — non-admin destructive lab-compendium reinstall (GHSA-jh2v-595q-h9vc)
• [High] OpenEMR CAMOS Rx Print Stored XSS (GHSA-rc6m-6pq4-r69x)
• [High] Path traversal in ERA/EOB processor (sl_eob_process.php eraname): arbitrary file write + arbitrary .edi read (GHSA-m6q6-5j87-3cmp)
• [High] Patient portal onsite documents API can lead to cross-patient consent artifact disclosure (GHSA-v688-m84c-5h4v)
• [High] Portal OnsitePortalActivity Update IDOR allows cross-patient audit data disclosure via PUT by id (GHSA-x8rm-m66w-qhh5)
• [High] SQL injection vulnerability in standard REST API patient insurance/employer search (GHSA-fhc4-8f9p-8mcc)
• [High] Stored XSS in CCDA/CCD clinical document preview via XSLT-preserved event-handler attributes (incomplete fix after CVE-2026-33932) (GHSA-rghp-vwvf-c2r9)
• [High] Stored XSS in Eye Exam Document Notes (GHSA-xwjf-6q28-9vj7)
• [High] Stored XSS via text() Misuse in Double-Quoted HTML Attribute (GHSA-pm2v-5p99-37p2)
• [High] Unsanitized Deserialization of User-Controlled Request Parameter in Patient Matching Dialog (GHSA-r52j-mq9p-mh85)
• [Medium] Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions (GHSA-q366-cv5v-83w8)
• [Medium] /interface/billing/edih_main.php archrestore_sel Directory Traversal to File Enumeration (GHSA-gfwc-jg5p-jcp4)
• [Medium] /library/dicom_frame.php web_path Cross-Site Request Forgery (GHSA-wffp-pj5h-xqwp)
• [Medium] /portal/import_template.php template_files[] Stored Cross-Site Scripting (GHSA-5293-8q47-cf44)
• [Medium] /portal/import_template.php templateHtml Reflected Cross-Site Scripting (GHSA-rmmr-8498-463g)
• [Medium] Arbitrary Patient Recall and Contact Detail Read (GHSA-x6w3-3g4m-5m5v)
• [Medium] BOLA in portal/report/portal_custom_report.php allows authenticated portal patients to read other patients' problem list entries (GHSA-xcrj-xc98-x8g6)
• [Medium] Cross-patient IDOR in portal OnsiteDocument query (Pid_Equals mass-assignment) (GHSA-hvp7-q2hp-6j6g)
• [Medium] IDOR - Portal Patient Settings Written for Arbitrary PID (GHSA-rrw3-g25h-x68h)
• [Medium] IDOR in portal/lib/paylib.php (form_pid) Allows Cross-Patient Payment-Audit Write / Financial Fraud (GHSA-c9wg-vrr9-65wj)
• [Medium] IDOR in patient portal allows an authenticated patient to read another patient's pending demographic change requests (GHSA-rw79-jfg7-fgpm)
• [Medium] Insecure Direct Object Reference (IDOR) in OnsitePortalActivityController allows patients to modify other patients' portal activity records (GHSA-5hx3-92fw-6jm6)
• [Medium] Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth (GHSA-4269-grc6-qr62)
• [Medium] Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email) (GHSA-xhfm-5pwg-3cxv)
• [Medium] Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI (GHSA-r3q3-p493-95x8)
• [Medium] Missing authorization on QRDA Category I/III download endpoints (GHSA-6p9h-59cp-8hxj)
• [Medium] Patient Data Search Without Sufficient ACL (GHSA-h5hw-xfj8-vgrv)
• [Medium] Prior-Authorizations module: cross-patient PHI disclosure + cross-patient IDOR write (GHSA-9cgf-m88m-9cvx)
• [Medium] Unauthenticated Open Redirect via OIDC End Session Endpoint (GHSA-5h9g-m7q2-pv45)
• [Medium] Username Enumeration via Pre-Authentication User Settings Loading (GHSA-rr38-hpxq-wwff)
• [Medium] Weno file_download.php: missing ACL/CSRF truncates the e-prescribing pharmacy directory (GHSA-xhv3-qr55-56h3)

Fixed

• aclCheckCore false parameter (#12994)
• adapt ExportState to escapeTableName() backtick contract from [#11297]. (#13061)
• add ACL and typed input to recall handlers (#13343)
• add explicit return type to session callback closures in EventAuditLoggerTest (#13322)
• add several staff-write checks (#13353)
• auto-accept alerts at driver level, drop wait dance in addPatientViaUi (#13355)
• bump post-navigation content-render waits 30s to 60s in UiSeedingTrait (#13365)
• CCDA to pass ONC USCDI V3 test scenarios. (#12765)
• change int to float before rounding (#13125)
• ChangelogMutator resolves prev release via manifest, not tag walk (#13015)
• cherry-pick [#13496] mutator fix onto rel-830 to unblock [#13482] (#13503)
• cherry-pick LOCAL_TAG + shopt fixes onto rel-830 to unblock branch-cut (#13489)
• convert upload steps to single hyphenated composite flags (#13167)
• correct invalid type annotations flagged as notFound in library and src (#13319)
• correct malformed getAll return-type docblocks in FHIR REST controllers (#13316)
• correct STC composite comparison and field indexing (#13155)
• detect-mode falls back to build_locally=false on orphaned base SHA (#13346)
• drop return statements from constructors (#12973)
• echo nothing (#13008)
• edit payment both grids emit dupe input names (#13468)
• Ensure xl() doesn't leave hints when translation is disabled (#12842)
• escape document note and rx content before rendering as HTML (#13404)
• extend generate-app-token composite to rel-800/rel-704 for sync POST cleanup (#13326)
• extract CHANGELOG section before peter-evans opens PR (#13004)
• Fix rendering bug in authorize.net payments (#13422)
• fix stylelint errors in interface/super folder (#13347)
• fix stylelint errors in openemr_questionnaire (#13436)
• fix stylelint errors in track_anything/style (#13437)
• fix stylelint issues in contraception_products and forms/observation (#13432)
• follow up refactor remit accounting test (#13150)
• forbidden $_FILES access (#12985)
• forbidden $_REQUEST in help.php (#12991)
• general list template typo (#12972)
• graceful-restart httpd in enable_coredumps so cores actually land (#13001)
• handle null Provenance in createProvenanceResource() during bulk $export (#13060)
• handle optional JWKS metadata during app registration. (#12919)
• import Mpdf\MpdfException so custom_report catch blocks match (#13314)
• inline $arr_files_php (#12979)
• int cast return getNextSequenceNumber() (#13389)
• invoke srcConfirmSave directly in addPatientViaUi, revert content-render wait bump (#13372)
• iterate url search params for ajax save (#13335)
• light text on dark background edit payments (#13421)
• link add issue expose date (#13377)
• linked documents update dashboard and encounters (#13296)
• muzzle window.alert via CDP in UiSeedingTrait seeding helpers (#13358)
• newpatient aclCheckCore call (#12997)
• pass --from to sql_upgrade.php instead of sed-patching it (backport [#13583] to rel-830) (#13586)
• pass GH_TOKEN to release-amendment mutator steps (#12999)
• path typo in email readme (#13122)
• point truncated Release body at rel branch + version anchor (#13040)
• preserve executable bit when sync-byte-identical.sh copies files from master (#13237)
• preserve persisted diagnosis ordering on save (#12133)
• prevent {headerTemplate} from rendering the page header twice (#12569)
• relax ChangelogGenerator noise filter — keep backports + release-scope PRs (#13005)
• remove double escaping (#13152)
• remove rel-checkout before master peter-evans to prevent submodule leak (#13007)
• remove unused direct $_GET access (#12974)
• replace $_GET (#13022)
• replace sleep+click+wait with clickUntilAlertPresent helper (#13348)
• reset STC status codes so they don't leak across segments (#13156)
• resolve address verify fields (#13166)
• resolve all 157 phpstan findings in fax_dispatch.php (#12986)
• retry gh CLI on transient failures in GitHubApi (#13141)
• Run fax dispatch through standard document handling (#12879)
• scan non-autoloaded class dirs for stable type inference (#13020)
• scope REST WRITE endpoints by patient/encounter (#13435)
• server-status polling now terminates reliably (#12826)
• simplify edih_format_percent, add return type (#13171)
• skip audit logging on the status poll endpoint (#12831)
• skip unshipped tags when deriving prev_release (#12769)
• stop "Undefined array key 0" on appointment search (#12861)
• strict equality ins count batch payments (#13393)
• strict types string errors (#12652)
• summary.php works with empty milestone; port missing checklist templates (#13126)
• sync workflow filters add-paths by target rel branch (#12920)
• sync workflow parses object-form manifest entries (#12916)
• sync-byte-identical rename-sweep must skip main-loop-handled paths (#13100)
• sync-byte-identical.yml materializes lib/glob-expand.sh alongside sync script (#12906)
• truncate release-amendment body over 125K to link-only pointer (#13038)
• trust manifest over annotated-tag filter for prev_release (#12771)
• unblock dry-run build path (Phase 5.5 findings) (#13115)
• unbreak release-mechanism workflows post-#13287 (blocks rel-830 cut) (#13480)
• unify Controller::default_action() on string return (#13011)
• use docker/* glob so docker/production/ actually ships in tarball (#12834)
• use record provider_uuid for patient and social-history Observation performer (#13205)
• version-check backup + smart dropdown default (#12840)
• view document from clinical view past encounters (#11152)
• waitFor poll selector loginForm (#13349)

Added

• 3-PR ship-release + mode selector (Phase 3b) (#13098)
• add DBAL query-audit middleware (#12810)
• add internal deprecation utility (#12753)
• add list and discover actions to zfc-module CLI (#12847)
• add OpenEMR FHIR Questionnaire Runtime (#12880)
• add release-amendment workflow (post-GHSA-publish CHANGELOG rerun) (#12996)
• add release-mechanism surface to byte-identical.yml (12 new entries) (#12910)
• Add view only mode to portal appointments (#12820)
• build-release + build-release-on-tag + build-patch workflows (Phase 2 PR 2b) (#13087)
• CompatibilityMutator + fix inject() idempotence (PR 8) (#12928)
• copy PackageAssembler + PreflightChecker from openemr-devops (Phase 2 PR 1) (#13062)
• dry-run mode builds real artifacts (Phase 3b-2) (#13099)
• expand billing note textarea when editing, add collapse to view (#13405)
• finalize job now updates release-finalize PR post-tag (#12889)
• gate GitHub-releases publish on acceptance-package passing (Phase 7c, package side) (#13207)
• glob-pattern support in byte-identical validator + sync scripts (#12904)
• invert canonical/vendored for cross-repo contracts (Phase 5.1) (#13110)
• make Install Code Set extensible and add a LOINC importer (#13466)
• migrate ship-release orchestrator + workflow (Phase 3a) (#13096)
• move ChangelogGenerator + friends from devops, wire ChangelogMutator (#12925)
• openemr-tag dispatch now carries prev_release (#12887)
• per-entry exclude-branches in byte-identical manifest (#12915)
• Phase 1 InstallTest against openemr Docker artifact (#13149)
• Phase 12 -- extend acceptance-gate to all rel-820+ branches (#13332)
• Phase 2 workflow + UpgradeIntegrityTest + byte-identical wiring (#13159)
• Phase 2.5 build-from-codebase for PR image validation (#13163)
• Phase 3 acceptance-package workflow for tarball artifact (#13165)
• Phase 3.5 — build-from-codebase tarball validation for PR CI (#13204)
• Phase 3.6 slice 2 — upgrade-side ZIP coverage (#13262)
• Phase 3.6 — ZIP acceptance coverage for fresh-install + wizard-install (#13261)
• Phase 4a — FhirSmokeTest + LoginFlow extraction (#13193)
• Phase 4a-2 — OAuth2SmokeTest (OIDC discovery + DCR) (#13194)
• Phase 4a-3 (1/2) — API-enable bootstrap + OAuth2 successful-flow assertions (#13201)
• Phase 4a-3 (2/2) — Bearer-authenticated /api/facility via full DCR+auth-code flow (#13203)
• Phase 4b — Panther plumbing + E2eCriticalPathTest (#13196)
• Phase 4c-1 — InstallWizardUiTest walks setup.php (#13198)
• Phase 4c-2 — UpgradeWizardUiTest walks sql_upgrade.php (#13199)
• Phase 7a-docker — release-prep.yml dispatches acceptance-docker alongside acceptance-package (#13210)
• Phase 9 — acceptance-only re-run for release recovery (#13272)
• retarget openemr-tag dispatch to openemr (Phase 2 PR 2c) (#13092)
• retire CreateReleaseChangelogCommand (PR 7) (#12964)
• skip transaction control statements (#13301)
• Taskfile + bin scripts for build workflows (Phase 2 PR 2a) (#13079)
• verify uploaded release assets byte-match local build output (Phase 7b) (#13217)

Backend Modernization Project

• forbid direct access to the $_SESSION superglobal (#13224)

Changed

• ACL improvements and misc to several staff endpoints (#13200)
• add appointment endpoint tests (#12419)
• add coverage for the patient document endpoints and validate the pid (#13409)
• add coverage for version, product, and list endpoints (#12914)
• add library/edihistory to scanDirectories (#13222)
• add post-release GHSA amendment as Quick action 4 (#13438)
• add Quick actions cheat sheet at top of the runbook (#13401)
• add release-mechanism gaps + open questions doc (#12599)
• add release-mechanism migration plan from openemr-devops (#12598)
• add release-mechanism smoke test workflow (#13000)
• add tests for FHIR Condition endpoints (#12808)
• add Windows compatibility testing (#13049)
• address review, type implode_funcs callables (#13019)
• allowlist attributes in CCDA/CCD/QRDA preview stylesheets (#13195)
• analyze all phpstan-covered paths (#13017)
• apply UnnecessaryTernaryExpressionRector (#13012)
• arm64 acceptance-docker always-on (was gated behind test_arm64 input) (#13264)
• artifact acceptance testing plan (living doc) (#12811)
• authenticated version.php pre-fetch + distinguish 404 from 429 (#12883)
• autoload declaration-only library files and drop redundant requires (#13251)
• Automatic Rector type coverage L5->L7 (#13320)
• bake pcov coverage driver into dev-php-fpm images (#13085)
• batch commit->PR resolution via /search/issues (#13146)
• Bb -- add happy-path breadcrumb to modal-close recovery (#13396)
• Bb -- modal-close recovery via isUserExist DB row oracle (#13397)
• Bb -- modal-close recovery via users-table row oracle (#13391)
• bump actions/checkout from 5 to 7 (#12781)
• bump actions/download-artifact from 4 to 8 (#13184)
• bump actions/setup-node from 6 to 7 (#13063)
• bump actions/setup-node from 6 to 7 (#13182)
• bump actions/setup-python from 6 to 7 (#13064)
• bump actions/upload-artifact from 4 to 7 (#13179)
• bump lewagon/wait-on-check-action from 1.8.0 to 1.8.1 (#12780)
• bump lewagon/wait-on-check-action from 1.8.1 to 1.9.0 (#13213)
• bump nanasess/setup-chromedriver from 2 to 3 (#13214)
• capture third-exercise state — as-built for release-automation-plan.md (#12745)
• carry forward coverage for flags (#13223)
• CDP window.alert muzzle + yank dead unhandledPromptBehavior capability (#13398)
• centralize encounter-form patient-ownership helper (#13333)
• clarify setup wording (#12853)
• CLI argument-shell coverage for 7 remaining bin scripts (#13132)
• close Phase 3c gap references — docs PR auto-flip is live (#13108)
• consolidate patient-context enforcement (#13472)
• correct author + copyright on new-authorship files (#13144)
• dead code (#13013)
• Deprecate the non-setting-checked cryptography APIs (#13225)
• direct $_SERVER access in gacl/admin/acl_test.php (#12954)
• document Docker Hub tag model + slot promotion (#13357)
• document finalize-on-master + changelog PRs in release process (#12863)
• document GHSA "Patched versions" convention for CHANGELOG auto-inclusion (#12993)
• drift-sweep release-mechanism docs - 8.1.1 history, announcement pipeline, ship-flow PR count (#13373)
• drop leftover 8.1.0 refs from dispatch fixtures + goldens (#12893)
• drop PHP 8.2 support; minimum is now PHP 8.3 (#13280)
• drop rel-820 exclusion from acceptance surface + build-release.yml (unblocked by [#13227]) (#13233)
• dual-tag 4e Small-tier ports for post-upgrade coverage (#13345)
• eliminate PHPStan findings in the physical exam form (#13009)
• exclude docker-build-release.yml from rel-800/rel-704 sync (#13244)
• extract byte-identical manifest parsing into a shared script + BATS coverage (#12924)
• extract edih_277 segment renderers into a testable class (#13153)
• extract PantherAcceptanceTestCase + UiSeedingTrait from Small-tier ports (#13344)
• extract release app-token generation into composite action (#13287)
• failure diagnostics for redis-sentinel/apache e2e (#12438) (#13295)
• Fix SignalWire fax support in oe-module-faxsms (#12526)
• Fix weird variant type in legacy phreeze path (#12764)
• fixture-based regression regenerating 8.2.0 CHANGELOG entry (PR 9) (#12969)
• harden logout regression suite and tighten full-flow assertions (#13175)
• incidental cleanups (#13232)
• include docker/production/ in release tarball (#12776)
• incorporate CSRF checks to several GET requests (#13197)
• inline edih_round_cb as array_map callback (#13118)
• Integrate OEGlobalsBag key deprecation tooling (#12763)
• isolate ChangelogMutatorTest + CompatibilityMutatorTest from developer git config (#13053)
• isolate csv_file_type's file-type alias table (#13151)
• little clean ups (#13050)
• make G10 trait suite-prefix helper deterministic (#13433)
• Merge commit from fork (backport 069c4a7f52 to rel-830) (#13569)
• Merge commit from fork (backport 31e13ee2d9 to rel-830) (#13566)
• Merge commit from fork (backport 92d7240567 to rel-830) (#13567)
• Merge commit from fork (backport e0c5962594 to rel-830) (#13565)
• Merge commit from fork (backport ff59ad1ff6 to rel-830) (#13568)
• move event subscriber out of zend_modules (#13302)
• move event subscriber out of zend_modules (#13299)
• move event subscribers out of zend_modules (#13297)
• narrow release-prep trigger to version.php + gate on active dev cycle (#12868)
• no empty (#12881)
• note prev_release manifest derivation + docs PR shape updates (#12773)
• only pass gate_with_acceptance when true (#13258)
• per-test-instance seed identity in UiSeedingTrait (#13351)
• Phase 10a — extract OCI-label verify to shared script (#13274)
• Phase 10c — extract publish flows + automate Phase 9 recovery (#13279)
• Phase 10d — extract shared ZIP-extract helper for boot-package + upgrade-package (#13286)
• Phase 10e-2 -- extract acceptance-only source-run guardrails (#13294)
• Phase 10e-3 -- extract Docker Hub tag-delete to shared script (#13293)
• Phase 10e-4 -- extract acceptance-package detect-mode to script (#13306)
• Phase 10e-5 -- extract create-release-tag to shared script (#13310)
• Phase 10e-6 -- extract changelog section + release body (#13311)
• Phase 10f — audit RELEASE_PROCESS recovery paragraphs post-Phase-9 + 10c (#13285)
• Phase 11 -- native arm64 release builds (#13330)
• Phase 14 -- skip-acceptance escape hatch for rerun workflows (#13394)
• Phase 4e-1 -- port AaLoginTest scenarios to acceptance (#13336)
• Phase 4e-2 -- port GgUserMenuLinks scenarios to acceptance (#13338)
• Phase 4e-3 -- port FrontPaymentCssContrast to acceptance (#13340)
• Phase 4e-4 -- port KkEncounterFormNavbarUrl to acceptance (#13341)
• Phase 4f Medium Bb -- port BbCreateStaffTest (#13383)
• Phase 4f Medium Dd -- port DdOpenPatientTest (#13354)
• Phase 4f Medium Ff -- port FfOpenEncounterTest (#13382)
• Phase 4g -- persist-through-upgrade flow tests (#13388)
• Phase 7c-docker-latest-gate — acceptance-gate latest builds (#13239)
• Phase 7d-1 — multi-arch ChromeDriver setup composite action (#13254)
• Phase 7d-2 — PR-time build_locally arm64 coverage (#13259)
• port [#13554] to rel-830 (PHP 8.6 non-blocking) — unblocks 8.3.0 release (#13557)
• port [#13558] to rel-830 (ignore PHP 8.6 check) — companion to [#13557] (#13564)
• pre-auth cleanups (#13133)
• probe statuses:write (#13120)
• quote mermaid arrow label containing dots to fix render (#13400)
• raise guzzlehttp/psr7 floor to ^2.13 for Utils::asciiToUpper (#13315)
• reflect Phase 7 acceptance-gate + byte-verify + arm64 + ZIP automation (#13269)
• reflect workstream 7 Phase 2 migration in RELEASE_PROCESS.md (#13094)
• Remove all remaining first-party use of eval (#13048)
• remove commented-out csv_files_header (#13172)
• remove dead code in edih_errseg_parse and segment renderers (#13170)
• remove getUuid to ServiceContainer (#12953)
• remove interface/main/backup.php and its menu entry (#13471)
• remove redundant typecheck-as-test (#12888)
• remove unused csv_array_flatten (#13127)
• remove unused edih_997_sbmtfile (#13138)
• remove unused edih_change_loop (#13131)
• remove unused edih_csv_order (#13130)
• remove unused php 7 polyfill (#13123)
• rename byte-identical manifest + validator workflow to drop docker prefix (#12896)
• replace manual transaction control with QueryUtils::inTransaction (#13321)
• replace unknown param types in Log docblocks (#13318)
• retarget devops->openemr for canonical ownership post-Phase-6 (#13137)
• retire the vestigial form_exit_url global (#13252)
• rewrite RELEASE_PROCESS.md for mutator-driven changelog flow (#12976)
• Set up HTTP client in ServiceContainer and DI (#12987)
• single dispatch surface + concurrency serialization for docker-build-release (#12862)
• skip analysis of generated PHPFHIRParserMap.php (#13051)
• skip CHANGELOG.md (auto-generated from historical PR titles) (#13043)
• sync release-automation-plan with actual workflow list + fix TBD (#13356)
• trigger docker-test-release on version.php bumps (#12778)
• trigger on rel-* branches (#12774)
• type params of 835 html helpers, drop runtime guards (#13173)
• type the load_fee_sheet_options() signature (#13317)
• update .stylelintignore file (#13375)
• Update audit logger sql path to be DI-friendly (#12699)
• update RELEASE_PROCESS.md for announcement migration (PR 5 of announcements slice) (#13055)
• use attr() instead of text() in HTML attribute contexts (#13192)
• use HTMLPurifier for document template content and drop dead GET branch (backport [#13541] to rel-830) (#13553)
• use portable mktemp -d across 5 helper suites (Phase 10e slice 1) (#13292)
• validate site_id and encapsulate (#12878)
• yank the dead unhandledPromptBehavior grid capability (#13364)

PHP

• bump claimrevolution/oe-module-claimrev-connect from 2.1.6 to 2.1.7 (#12945)
• bump doctrine/dbal from 4.4.3 to 4.4.4 (#13186)
• bump doctrine/orm from 3.6.7 to 3.6.8 (#13461)
• bump dompdf/dompdf from 3.1.5 to 3.1.6 (#13136)
• bump giggsey/libphonenumber-for-php from 9.0.33 to 9.0.34 (#12793)
• bump giggsey/libphonenumber-for-php from 9.0.34 to 9.0.35 (#13072)
• bump giggsey/libphonenumber-for-php from 9.0.35 to 9.0.36 (#13458)
• bump google/apiclient from 2.19.3 to 2.19.4 (#12802)
• bump guzzlehttp/guzzle from 7.12.3 to 7.13.2 (#12801)
• bump guzzlehttp/guzzle from 7.13.2 to 7.14.1 (#12939)
• bump guzzlehttp/guzzle from 7.14.1 to 7.14.2 (#13014)
• bump guzzlehttp/guzzle from 7.14.2 to 7.15.1 (#13077)
• bump guzzlehttp/guzzle from 7.15.1 to 7.15.3 (#13455)
• bump guzzlehttp/psr7 from 2.12.3 to 2.12.5 (#12938)
• bump guzzlehttp/psr7 from 2.12.5 to 2.13.0 (#13074)
• bump knplabs/knp-snappy from 1.7.2 to 1.7.3 (#13371)
• bump league/flysystem from 3.35.1 to 3.35.2 (#12934)
• bump nikic/php-parser from 5.7.0 to 5.8.0 (#12794)
• bump phpoffice/phpspreadsheet from 5.8.0 to 5.9.0 (#12944)
• bump phpseclib/phpseclib from 3.0.55 to 3.0.56 (#13459)
• bump psy/psysh from 0.12.23 to 0.12.24 (#12800)
• bump slevomat/coding-standard from 8.30.1 to 8.31.0 (#13181)
• bump slevomat/coding-standard from 8.31.0 to 8.31.1 (#13457)
• bump smarty/smarty from 4.5.6 to 4.5.7 (#12796)
• bump squizlabs/php_codesniffer from 4.0.1 to 4.0.2 (#13426)
• bump squizlabs/php_codesniffer from 4.0.1 to 4.0.4 (#13453)
• bump the development group across 1 directory with 6 updates (#13366)
• bump the symfony group with 12 updates (#13368)
• bump the symfony group with 5 updates (#13449)
• bump twig/twig from 3.27.1 to 3.28.0 (#12799)
• bump vlucas/phpdotenv from 5.6.3 to 5.6.4 (#12946)

javascript

• bump autoprefixer from 10.5.2 to 10.5.4 (#13076)
• bump body-parser from 1.20.5 to 1.20.6 in /ccdaservice (#12941)
• bump dompurify from 3.4.11 to 3.4.12 (#12940)
• bump eslint from 10.5.0 to 10.7.0 in /ccdaservice (#12942)
• bump eslint from 9.39.4 to 9.39.5 in the build-tools group (#12935)
• bump fast-uri from 3.1.2 to 3.1.4 (#13105)
• bump fast-uri from 3.1.2 to 3.1.4 in /interface/modules/custom_modules/oe-module-comlink-telehealth/public/assets/js (#13104)
• bump fast-uri from 3.1.4 to 3.1.5 (#13386)
• bump fast-uri from 3.1.4 to 3.1.5 in /interface/modules/custom_modules/oe-module-comlink-telehealth/public/assets/js (#13385)
• bump globals from 17.7.0 to 17.9.0 in /ccdaservice (#13452)
• bump immutable from 5.1.5 to 5.1.9 (#13103)
• bump interactjs from 1.10.27 to 1.10.28 (#13456)
• bump ip-address from 10.2.0 to 10.4.0 in /ccdaservice (#13378)
• bump mocha from 11.7.6 to 11.8.0 in /ccdaservice (#13454)
• bump mongoose from 7.8.9 to 7.8.11 in /ccdaservice (#13169)
• bump postcss from 8.5.16 to 8.5.18 (#12936)
• bump postcss from 8.5.18 to 8.5.20 (#13075)
• bump postcss from 8.5.20 to 8.5.25 (#13369)
• bump postcss from 8.5.25 to 8.5.26 (#13451)
• bump sass from 1.101.0 to 1.102.0 (#13187)
• bump svgo from 4.0.1 to 4.0.2 (#13106)
• bump tar from 7.5.16 to 7.5.20 in /ccdaservice (#13091)
• bump tar from 7.5.20 to 7.5.22 in /ccdaservice (#13168)
• bump webpack from 5.108.1 to 5.108.4 in the build-tools group (#12797)
• bump webpack from 5.108.4 to 5.109.0 in the build-tools group (#13185)
• bump webpack from 5.109.0 to 5.109.2 in the build-tools group (#13367)
• bump ws from 8.20.1 to 8.21.0 (#12867)

phpstan

• refresh RESERVED_WORD_SUPPLEMENT (#13448)

pre-commit

• bump https://github.com/codespell-project/codespell from v2.4.2 to 2.4.3 (#13078)