OpenEMR Files

8.5.0 - 2026-10-26

Minimum supported versions

• PHP 8.3+
• MariaDB 10.11+
• MySQL 8.4+

See the tested CI matrix for all tested version combinations.

Security Fixes

• [Critical] Chained: a Front Office clerk escalates to whole-database read, a patient identity, and approved forged clinical records (GHSA-vr7f-7c3w-49g7)
• [Critical] OAuth scope canonicalization and containment flaws allow unauthenticated Patient read/write access (GHSA-6xh3-fmm5-jjp4)
• [Critical] OpenEMR local file disclosure through user-controlled PDF HTML (GHSA-h4xc-pqg3-8459)
• [Critical] Remote code execution via Stored ERA upload (GHSA-r6wm-8m2j-c3q9)
• [Critical] SQL injection in openemr (GHSA-hrf6-qx6w-vgh9)
• [Critical] SQL injection through CCR/CCDA approval patient-data field names (GHSA-wh28-4qcg-5hcc)
• [High] Arbitrary Global Configuration Override via Unrestricted User Settings Injection (GHSA-v997-jphq-wvvr)
• [High] Cross-patient C-CDA disclosure in ccdaservice/ccda_gateway.php (missing authorization) (GHSA-6fxw-69cq-m7g6)
• [High] diagnosis_full.php exposes unauthenticated billing delete and clear operations with user-controlled ID (GHSA-r65f-fxf6-4fwr)
• [High] Document-template renderer bypasses patient document and clinical-data permissions (GHSA-vc2h-x8xf-8jcv)
• [High] Dynamic patient finder omits patients/demo (GHSA-79g8-hm7q-xrh4)
• [High] Five Module Manager actions run without the admin/manage_modules check (GHSA-gpcx-xcp2-2rhx)
• [High] Incomplete Fix for CVE-2026-33910 Stored / Second-Order SQL Injection Still Reachable via getByPatientDemographics() in library/patient.inc.php (GHSA-pc2q-9pcw-v899)
• [High] Low-privilege core users can replace arbitrary patient portal credentials (GHSA-83hq-c876-fcwf)
• [High] Low-privilege users can change another patient's tracker and appointment status (GHSA-cxjf-fmpw-qc34)
• [High] Missing authorization on portal/import_template.php allows any authenticated staff to wipe document-template profiles and read template bodies (GHSA-phvv-q7m7-8mc2)
• [High] No rate limiting or lockout on TOTP submission in web login and OAuth2 authorization code flows (GHSA-rp7c-25mm-8g74)
• [High] OAuth2 clients not restricted to their registered grant types (GHSA-qjj7-c4m9-6f92)
• [High] OAuth2 Password Grant bypasses MFA when mfa_token parameter is omitted (GHSA-6xc2-v6mv-w3g3)
• [High] OpenEMR 8.3.0 - Persistent SQL Injection in ERA File Reprocessing (Second-Order via Server-Side File) (GHSA-hqjp-rcv8-7p9c)
• [High] OpenEMR user_settings.php unauthorized global configuration override (GHSA-prmv-3m3j-9v7j)
• [High] OpenEMR immunizations.php, diagnosis_full.php and billing_process.php skip the ACL their same-dataset siblings enforce (GHSA-xp7w-8fx3-642x)
• [High] OpenEMR Missing ACL on custom/ export & chart-tracker scripts (PHI disclosure, chart-tracker forgery, stored XML injection) (GHSA-3h5w-672p-v4m9)
• [High] OpenEMR Patient create and search endpoints missing ACL (GHSA-cwpg-qv34-gx8x)
• [High] OpenEMR SMART/OAuth scope finalization can lead to unauthorized write-capable token scopes (GHSA-6cmr-r2rh-755m)
• [High] OpenEMR SQL injection via string-concatenated user input (billing parse, reports, Zend modules) (GHSA-g7m7-pc2p-7h7q)
• [High] OpenEMR Syndromic Surveillance Module Authenticated Error-Based SQL Injection (GHSA-w99c-jwcm-24hh)
• [High] Path traversal in ERA (X12 835) upload allows writing attacker-controlled files outside the ERA directory (era_payments.php, sl_eob_search.php) (GHSA-mf55-7h68-r2rp)
• [High] Procedure-order endpoint permits cross-patient disclosure and unauthorized lab-order modification (GHSA-q5c6-96vf-rx9v)
• [High] Second-order SQL injection through the Carecoordination CCDA mapper (GHSA-8rgh-38j4-6pxf)
• [High] SQL injection in OpenEMR patient portal OnsiteActivityView API via _BitwiseAnd Criteria attribute (GHSA-vvj8-xpx8-p293)
• [High] SQL injection in patient portal query API via _BitwiseAnd mass-assignment (GHSA-g2xw-rvhq-x543)
• [High] SQL injection in SLEOB::slInvoiceNumber() via the CLP01 claim identifier of an uploaded X12 835 (ERA) file (GHSA-cw3f-mhw8-44jp)
• [High] SQL injection via form_icd_codes[] unquoted IN() clause in Syndromic Surveillance report (GHSA-q6f8-4pm7-q39r)
• [High] SQL injection via HTTP parameter names in CcrTable::insertApprovedData(), on a CCR route with no ACL and no CSRF protection (GHSA-86hf-j825-r56h)
• [High] SQL Injection Vulnerability in the IPPF contraceptive issue feature (OpenEMR <=8.0.0.3) (GHSA-8j6v-q545-q9q7)
• [High] Stored XSS from patient portal into staff sessions via document template rendering (GHSA-hfpq-j3fj-cpmv)
• [High] Stored XSS via OnsitePortalActivity tableArgs (GHSA-r4hm-frcj-qr39)
• [Medium] 301 Incomplete CVE-2026-33299 fix leaves stored XSS in Eye Exam orders (GHSA-rgv4-6mf9-hxwx)
• [Medium] [SECURITY] Reflected XSS in OpenEMR ACL Module (GHSA-mccm-83g2-7v57)
• [Medium] [SECURITY] Reflected XSS in OpenEMR Application Module Auto-Suggest Endpoint (application/index/search, searchEleNo) (GHSA-pv5m-vjm7-x355)
• [Medium] [SECURITY] Reflected XSS in OpenEMR Application Module Auto-Suggest Endpoint (application/index/search, searchMode (GHSA-8mwp-vq82-x5mr)
• [Medium] [SECURITY] Stored XSS in OpenEMR 8.2.0 — Eye Exam Defaults (eye_mag module (GHSA-gr77-7xgh-5gwf)
• [Medium] Billing and Carecoordination users can exhaust PHP workers through four ZIP upload paths (GHSA-pqmf-m4h6-wjh4)
• [Medium] Billing claim downloader exposes unrelated files from the shared temporary directory (GHSA-9rw5-h7xf-57mc)
• [Medium] C-CDA gateway bypasses patient-report authorization (GHSA-7cfr-7h7r-f2x9)
• [Medium] CAMOS prescription printer discloses another patient's prescription by global ID (GHSA-gf9c-4hh8-gh49)
• [Medium] CAMOS template administration authorizes everyone (GHSA-5r7f-fg5x-3gcp)
• [Medium] Care Coordination import reassigns inaccessible documents and bypasses category ACLs (GHSA-mmpv-ph5x-x4m3)
• [Medium] Clinician billing code causes stored XSS when EOB staff enter a payment (GHSA-v7qh-q4xq-28v3)
• [Medium] Destroyed-drug report omits its declared ACLs (GHSA-pf2f-4xph-fhjx)
• [Medium] Ensora eRx entry point omits patients/rx (GHSA-mcr3-5rq6-9vvj)
• [Medium] Idle session timeout never fires while the Eye Exam form is open in read-only mode (GHSA-fc6f-f47r-j9x8)
• [Medium] Incomplete patient-creation fix lets read-only users create charts through FaxSMS (GHSA-ppg9-2f9f-chc4)
• [Medium] Inverted document-expiration check exposes time-limited PHI (FHIR Bulk Export / $docref) (GHSA-fp98-qfh5-xjhc)
• [Medium] Medical-record users can exhaust PHP workers through an unbounded lab-label PDF count (GHSA-3j3r-w7q7-h9fj)
• [Medium] Missing appointment ACL permits arbitrary Patient Flow Board status changes (GHSA-2984-qxv9-6r62)
• [Medium] Missing authorization allows any core user to send as the clinic's Direct identity (GHSA-vf9m-wg38-vcc2)
• [Medium] Missing Authorization Allows Front Office Users to Access Patient Vitals and PHI (GHSA-h9rv-wxcp-x85f)
• [Medium] Missing authorization in authorizations_full.php allows any authenticated user to authorize arbitrary patients' clinical records (GHSA-j467-662w-jwvj)
• [Medium] Missing Authorization in OpenEMR Patient Validation Module Allows Unrestricted Patient Record Disclosure (interface/modules/zend_modules/module/Patientvalidation/) (GHSA-q4jf-6gcg-m3jx)
• [Medium] Missing authorization lets any core user e-sign and lock arbitrary patient forms (GHSA-6x2w-9gwv-mc7v)
• [Medium] Missing authorization on the portal OnsiteActivityView API discloses every patient's demographics and Social Security number (GHSA-9f97-gqgj-wr6g)
• [Medium] Module administration actions in InstallerController have no permission check (GHSA-32cq-gh7x-jpqw)
• [Medium] Nation Notes configuration mutations omit nationnotes/nn_configure (GHSA-m4cw-vx96-p6fj)
• [Medium] Observation form deletion endpoint has no CSRF check, while the sibling save action in the same controller does (GHSA-7gjr-359j-5q93)
• [Medium] OpenEMR Carecoordination module: IDOR across CCDA/CCR/QRDA document download, preview, transmit, import, and generation (GHSA-3vxh-7hh5-vhhm)
• [Medium] OpenEMR missing function-level ACL on reports and reminder/batch endpoints (GHSA-6h9j-m5w9-8938)
• [Medium] OpenEMR Observation form mass assignment (authorized flag forge and cross-record tamper) (GHSA-qv6p-57wj-w55p)
• [Medium] OpenEMR Patient Portal PDF SSRF via HTMLPurifier/mPDF external resource loading (GHSA-wc8m-q5xj-j34x)
• [Medium] OpenEMR: MFA factors can be deleted, and a U2F key registered, without the password re-entry that TOTP registration requires (GHSA-rcrp-xxch-gxfh)
• [Medium] Privileged billing-code editor can execute stored XSS when a clinician selects a code (GHSA-qv97-cvw6-8j53)
• [Medium] Privileged stored SQL injection through History layout field identifiers (GHSA-fq58-jp5g-x44q)
• [Medium] Read-only drug administration permits dispensing and inventory mutation (GHSA-hp8p-h8g8-xmg3)
• [Medium] Read-only medical permission modifies lab-order transmission flags (GHSA-xmjf-8fc9-hh38)
• [Medium] Read-only medical permission permits arbitrary lab-order transmission (GHSA-3xjm-656g-cfj5)
• [Medium] Read-only medical permission permits clinical-rule result modification (GHSA-xqq3-59h5-xhmr)
• [Medium] Restricted staff can mark another patient's clinical lists as "None known" (GHSA-924r-c6jp-67px)
• [Medium] Second-Order Eval Injection leading to Remote Code Execution (RCE) via Database Category IDs in Tree.class.php (GHSA-55q2-3hm8-v9hp)
• [Medium] SQL injection in the IPPF statistics report via form_facility (GHSA-p2ch-6856-w69j)
• [Medium] Stored XSS in OpenEMR 6.1.0-8.4.0 - User external ID / view prescriptions (GHSA-w2f7-289j-92pp)
• [Medium] Stored XSS in the Fee Sheet: the notecodes field is escaped for the wrong context (GHSA-ff55-qvf9-2fgm)
• [Medium] Stored XSS in the printed fee sheet via appointment comments (GHSA-c997-5w2m-grrf)
• [Low] Active Debug Code in fax_view.php Discloses Web Server Group Membership (GHSA-wc2f-fvpv-c32r)

Fixed

• accept date search values with minutes and no seconds (#14520)
• add assert-inputs-nonempty.sh to byte-identical manifest (G45) (#14126)
• add Item 3 composite actions to byte-identical manifest (G47) (#14178)
• add missing actions/checkout to acceptance-only rerun workflows (#13972)
• add missing FROM keyword to DELETE statements (#14286)
• Added arg for specifying custom git repo as source (#13709)
• address patient statements to the guarantor (#14794)
• align PRIORS tropicamide with 1% and keep legacy 2.5% checked (#14228)
• align week-view appointments with their time-slot labels (#14266)
• allow mode-less AJAX requests through eye_mag save whitelist (#14054)
• appointment list endpoints return 200 for empty results (#14605)
• archive results files before importing them (#14402)
• ask for the retrieve key before embedding documents in the report (#14600)
• bearer-authenticate the /api/version check (#14566)
• bill Tests Performed drugs as the fee sheet does (#14746)
• build Validate Only claims for the payer selected (#14552)
• bump Docker Upgrade Process recreate wait_for_healthy from 600s to 1200s (G40) (#14081)
• commit synthetic CHANGELOG stub so package-assemble sees clean tree (#14014)
• convert date search values with the offset of the searched date (#14642)
• convert scanned PDFs to TIFFs tiff2pdf can file (#14229)
• convert uuid params to binary in appointment getOneForPatient (#14625)
• correct inverted comparison in Document::has_expired() (#14049)
• count a form in a signed encounter as signed on the report (#14718)
• count a Vitals blood pressure typed with spaces (#14670)
• count ongoing records and visits saved without an end time (#14621)
• count prepayment distributions to any patient (#14189)
• daylight savings time fixes for the calendar preview (#14399)
• decouple acceptance-gate skip from dry_run in build-release.yml (G43) (#14118)
• decouple delete refresh from SQL display (#13713)
• decouple workflow_call gate expected_version from checkout tree (root cause of 8.4.0 ship cascade) (#13974)
• default pc_prefcatid to 0 on portal appointment insert (#14260)
• derive_from_version excludes to_version from candidates (#14018)
• differentiate acceptance-docker concurrency by inputs.to_tag (G46) (#14131)
• don't link an issue to an encounter twice (#14789)
• don't list encounters without charges as unbilled (#14361)
• don't mark a failed X12 SFTP upload as sent (#14336)
• don't poll inactive procedure providers for results (#14400)
• don't post an ERA check twice (#14619)
• drop sparse-checkout from sync-byte-identical composite checkout (#14203)
• enable patient selection for transmission (#13533)
• fail the Inferno job when certification tests fail (#14482)
• fall back instead of fataling when a global is unusable (#13950)
• filter payment activity and align alert counts (#13961)
• Fix bind array mismatch in patient finder count query (#14003)
• fix module lifecycle settings and the EtherFax unread count (#14481)
• grant SMART scopes by permission union and keep consent in the client's spelling (#14317)
• guard find_appt_popup opener-chain + capture acceptance failure artifacts (#14491)
• guard opener-refresh chain so appointment-save modal always closes (#14325)
• guard window.top derefs so form init survives a transiently null top (#14486)
• handle patients without insurance (#14356)
• honor the provider filter in the AMC tracking report (#14240)
• include Composer-installed modules in release image (#14638)
• isolate sync-byte-identical composite checkout to prevent sparse-checkout leak (#14199)
• keep checkout totals and message text readable in every theme (#14590)
• keep fitness/referral_source defaults when creating a patient (#14620)
• keep invoices moved back to insurance out of Due Pt (#14604)
• keep the background-service poll from resetting the idle timeout (#14550)
• keep the Config editor usable when a stored secret cann… (#14474)
• keep the fee sheet on an e-signed, locked encounter (#14661)
• keep the site when logging out a window whose session is gone (#14586)
• keep Weno background services off while the module is disabled (#14787)
• label each receipt payment with its own payer (#14458)
• label the facility list's physical address column "Physical Address" (#14739)
• leave deleted observations out of eCQM calculations (#14587)
• leave inactive facilities out of the facility picker (#14296)
• let copy forward through save.php again (#14611)
• let the view page's Delete button delete the document (#14262)
• limit available appointments to schedule hours (#13804)
• list and save User Permissions for the same users (#14676)
• list the forms in Patient > Visit Forms (#14446)
• list the grants, scopes and auth methods the server accepts (#14234)
• load the calendar helpers for Nth-weekday recurrences (#14238)
• lower the variable.undefined cap to 467 (#14339)
• make faxsms, ehi-exporter, and weno install SQL safe to re-run (#14230)
• make InsuranceCompanyService::update behave as a semantic PATCH (#14688)
• make the missing modifier work on binary columns on MySQL 8 (#14221)
• match misc_billing_options table.sql to database.sql (#14404)
• MFA and password grant improvements (#14110)
• net a patient's credit encounters on statements (#14548)
• normalize recent patient date metadata keys (#14247)
• offer the custom fee sheet list codes as review choices again (#14395)
• omit 2330B DTP*573 when 2430 reports the payer's lines (#14588)
• open a provider appointment on the provider tab (#14488)
• open Misc Billing Options for patients with no referring provider (#14460)
• open the editor on the current policy, not one without a start date (#14534)
• open the fee sheet from Fees menu on a locked encounter (#14674)
• OPENEMR__ENVIRONMENT dev (#14070)
• pass scoped CSRF token when loading portal payment card (#13951)
• pass the forced-reset flag when creating an invitee's portal credentials (#14236)
• pass the web root to the reason code widget unencoded (#14291)
• pass the web root unencoded to the observation and procedure order code pickers (#14578)
• patch pcov -std=c99 to c11 for 8.7 dev-track build (#14259)
• patch-prep row template adds gate_with_acceptance + finalize backfills it (G44) (#14122)
• PatchPrepReleaseTargetsMutator strips next from master row (G39) (#14075)
• patient-compartment appointment GET must scope by pid (#14734)
• populate the fee sheet with the code row the fee sheet uses (#14719)
• post a reviewed portal payment to the patient who made it (#14807)
• PostReleaseTargetsMutator strips latest from prior-patch row on same rel branch (G41) (#14111)
• preselect the user's default warehouse on product lines (#14466)
• preserve eid when switching Patient/Provider/Group tabs (#14263)
• preserve master-composite/ across rel-branch checkout to stop cosmetic post-cleanup failure (#14216)
• preserve site context in main shell URL (#14009)
• preserve timestamps for unchanged notes (#14321)
• prevent archive audit logging failure (#13963)
• remove dangling LEFT JOIN in ProcedureService::getAll SQL (#14720)
• remove dead pmsfh guard (#14311)
• remove invalid ledger controls lookup (#13952)
• reorder apis rewrite before portal/patient (rel-850 backport of [#14822]) (#14823)
• repair campaign sending and make cancelled statuses configurable (#14237)
• require ESign/SignatureIF.php so Patient Flow can load (#14265)
• resolve PHPStan 2.2.16 findings (unprinted translations, dead duplicate conditions) (#14398)
• REST and FHIR endpoint bugs found running a client against 8.4 (#14653)
• restore medical history issue saves (#13971)
• restore missing bootstrap require in dated_reminders_log.php (#14192)
• restore query assignment swallowed by nosemgrep comment (#14052)
• restore staff demographics review (#13965)
• restrict secure message editor toolbar (#13967)
• rewrite sync-byte-identical with single-checkout to end the post-cleanup failure cycle (#14226)
• route drug/direct-message/batch senders through MyMailer (#14076)
• run multisite services against their own site (#14359)
• run the IPPF statistics report again, and require acct/rep_a (#14461)
• run the Pending Followup from Results report again, and require patients/lab (#14696)
• schedule certificate renewal on every start (#14417)
• scope patient-compartment PUT routes by pid (#14747)
• send CLM10 patient signature source only on workers' comp claims (#14362)
• send each diagnosis to Ensora once and the patient's cell phone (#14239)
• send form_pid with the card payment forms (#14709)
• send prior payer claim control number in 837P loop 2330B (#14136)
• send the 837P pay-to address from the facility's mailing address (#14741)
• send the window to login when its session is gone (#14233)
• show family medical history and stop clearing what the panel lacks (#14735)
• show patient on payment receipts (#13969)
• show the dispensed medications card only when there is something in it (#14541)
• show the Modules menu to users who may manage modules (#14293)
• show the New Patient form's section names in the Manila and Solar themes (#14740)
• silence PHP 8.5 warnings in observation and document rendering (#14358)
• size the billing note box on the server (#14618)
• skip the key permission check for the public key (#14331)
• smoketest uses current-rel shipped version + tag/Release safety gates (#14017)
• stop emitting extensions without a url for missing performers and subjects (#14496)
• stop sql.inc.php clobbering the $config install flag (#13429)
• store info.txt names and categories without the newline (#14447)
• store sent etherFax faxes as outbound (#14678)
• store the encounter id on questionnaire responses (#14654)
• store the payer claim control number on ERA adjustments (#14551)
• stub CHANGELOG for synthetic recovery-path smoketest version (#14010)
• support April 1 mid-year ICD-10 releases (#13762)
• swap reversed SNOMED CT codes for administrative sex (#14022)
• tie AM/PM enable state to the time input, not the duration input (#14261)
• TransactionRestController GetPatientTransactions returns 200 for empty list (#14727)
• type mb_is_string_equal_ci parameters as string (#14697)
• use form->submit() + staleness gate to eliminate api-enable flake (#14290)
• use the code system's display for HL7 category and timing codings (#14499)
• use the ST position when keying trace-search segments (#14462)
• validate-source-run.sh accepts comma-separated workflow paths (unblocks 8.4.0 ship bypass) (#13973)

ACL & Permissions

• give Clinicians a single 'write' ACL again (#14707)

Database Layer

• quote identifiers and bind values in upgrade guard checks (#14312)

Added

• add Observation write support for vital signs (#14217)
• add release-mode guardrail requiring upgrade-cell to run (#14215)
• add surface assignments for questionnaire availability (#14485)
• add the 2026 performance period measures (#14536)
• admin unblock UI for MFA and portal-account counters (#14187) (#14288)
• auto-merge byte-identical sync PRs on green CI (#14028)
• count vitals from the Vitals form in eCQMs (#14656)
• custom fee sheet list entries can name the drug for a HCPCS code (#14394)
• default units and NDC for injection codes from inventory (#14330)
• display client registration warnings for write scopes (#14509)
• docker sibling for recovery-path smoketest + related docs (#14035)
• docker sibling smoketest v2 -- dry_run mode on docker-build-release (#14037)
• expand native runtime SDC/R4 coverage and per-instance repeats (rel-850 backport of [#14744]) (#14826)
• fee sheet appt status prompt (#14790)
• Fhir writes continued (#13281)
• let a site supply its own base drawings (#14612)
• let the release image's apache uid be set at build time (#14363)
• nightly recovery-path smoketest workflow (#13991)
• no_publish mode on acceptance-only + docker-acceptance-only (#13985)
• record a reason with the checkout discount (#14583)
• refresh the main menu without reloading OpenEMR (#14523)
• register background_service OAuth2 scopes and add api coverage (#14749)
• replace Node schematron service with pure PHP validator continued from [#13884] (#14005)
• replace Node.js CCDA service with PHP service-Continued from [#12470] (#13983)
• replace the Node CQM service with PHP (#14469)
• show each drug's billing code, fee sheet units and NDC quantity (#14540)
• synthea bundle importer for openemr-cmd irp --format=fhir (#14357)
• Task create and update (part 2 of [#14521]) (#14660)
• Task resource, read and search (part 1 of [#14521]) (#14614)

Changed

• add /api/user coverage (#14721)
• add api-tier consent-page render regression gates (#14633)
• add consent-scope-narrowing regression tests (#14628)
• add cross-session csrf_token_form replay deny-path test (#14589)
• add DCR edge-case regression gates (#14798)
• add DORA-aligned release performance metrics section (#13981)
• add Drug + Immunization standard-api regression gates (batch 1) (#14675)
• add EHR-launch CSRF + unknown-client-id regression gates (#14668)
• add Encounter + SOAP note CRUD coverage (standard-api batch 4 slice 1) (#14722)
• add error-path browser regression gates to SmartLaunch suite (#14666)
• add FHIR MedicationDispense API tests (#12343) (#14038)
• add FHIR Organization API tests (#12343) (#14034)
• add FHIR Patient read and update API tests (#12343) (#14051)
• add FHIR write-path smoke to oe-module-api-explorer (#14665)
• add Followup opportunities subsection (#13984)
• add G36 recovery-path smoketest gap + cross-doc updates (#14024)
• add G48 entry for sync-byte-identical sparse-checkout leak arc (#14204)
• add http-layer regression gate for /token brute-force lockout (#14577)
• add insufficient-scope deny-path regression gates (#14759)
• add invocation contexts reference section (Item 5) (#14186)
• add isolated split for TokenIntrospectionRestController (#14664)
• add missing FHIR resource read scopes to ApiTestClient ALL_SCOPES (#14762)
• add missing permission gates on staff endpoints (#14015)
• add missing permission gates on staff endpoints (#14231)
• add OAuth2 audit log integrity regression gates (#14796)
• add oe-module-api-explorer round-trip smoke (#14533)
• add OIDC id_token claims structure regression gates (#14799)
• add patient-compartment insurance CRUD coverage (standard-api batch 4 slice 2) (#14728)
• add permission gates (#14270)
• add permission gates and whitelist update column names (#14344)
• add portal api positive-shape smoke tests (#14591)
• add portal-api smoke to oe-module-api-explorer (#14673)
• add positive-shape test for GET /portal/patient/encounter/{euuid} (#14603)
• add public-client PKCE mint-level coverage (#14659)
• add refresh-token scope-persistence regression gates (#14658)
• add regression gates for FHIR _sort search modifier (#14667)
• add response_type validation regression gates (#14795)
• add SMART v2 constraint-scope end-to-end coverage (#14763)
• add SMART-launch smoke driving oe-smart-questionnaire end-to-end (#14529) (#14532)
• add standard-api coverage for appointment DELETE, insurance_company list/single, medication CRUD (#14680)
• add Surgery + Dental_issue CRUD coverage, fix ListRestController empty-array-as-404 (#14681)
• add swap-insurance operation coverage (#14732)
• add the missing license header to AuthorizationListener (#13946)
• add token revocation race-condition regression gates (#14797)
• add V2 scope-set api-tier equivalence coverage (#14760)
• add Vital CRUD + Patient Transaction CRUD api coverage (#14689)
• apply correct output escaping (#14287)
• apply correct output escaping (#14324)
• array return types for billing, CDR, and common (#14351)
• array return types for FHIR services (#14349)
• array return types for legacy classes (#14348)
• array return types for legacy functions (#14347)
• array return types for services (#14350)
• array return types for zend modules (#14354)
• audit-PR a+b+c — insurance_type, patient-employer, appointment compartment, message CRUD (#14729)
• audit-PR d+e+f — allergy / medical_problem CRUD + top-level reads (#14733)
• bump binary image to OpenEMR 8.4.1 (#14346)
• bump binary image to PHP 8.5.12 forge release (#14773)
• bump openemr/openemr:flex digest to fc384ddecedf (#14419)
• bump phpstan/phpstan to 2.3.1 (#14576)
• bump rector/rector to 2.7.0 (#14582)
• bump sabberworm/php-css-parser 9.4.0 -> 9.5.0 (#14289)
• bump updatecli/updatecli-action from 3.6.0 to 3.7.0 (#14142)
• bump updatecli/updatecli-action from 3.7.0 to 3.8.0 (#14366)
• bump updatecli/updatecli-action from 3.8.0 to 3.9.0 (#14428)
• capture api_log request bodies, redact OAuth2 fields (#14445)
• complete AuthCodeRepository stubs + expand end-to-end tests (#14531)
• correctness pass across grant, route, cors, and token flows (#14475)
• cover the patient_data date column lookup (#14255)
• deepen HttpRestRequest unconstrained-scope isolated coverage (#14662)
• derive upgrade-cell from_tag per-row from checkout sql files (#14440)
• document Item 4 followup release-mode guardrail in plan doc (#14227)
• documentation for vendor hooks (#13953)
• drop 8.4.0 row post-8.4.1 ship (#14135)
• drop file timestamp restore step (#14405)
• expand deny-path test gates and tighten JWKS null-guard (#14574)
• expand oe-module-api-explorer smoke to confidential auth-code + public PKCE (#14538)
• expand oe-module-api-explorer smoke to password grant (#14663)
• expand SMART-launch smoke with 4 new tests (#14529 follow-up) (#14537)
• expect the profiles the CapabilityStatement leaves out on purpose (#14492)
• extract 3 shared scripts + BATS from recovery-path smoketest (#14045)
• extract acceptance workflow step composites (Item 3) (#14168)
• extract acceptance-docker inline logic into 3 scripts with unit tests (#14182)
• fix phantom codecov/project drops from shared flags (#14388)
• fix the screening observation and C-CDA certification failures (#14655)
• forbid mail() and direct PHPMailer instantiation (#14077)
• FY 2027 ICD-10-CM and ICD-10-PCS code sets (#14280)
• G37 audit findings + preflight guards on the two publish reusables (#14050)
• G38 + Quick-Action-2 hyphen callout + swap section order (#14073)
• G41 outcome + G42 acknowledgements co-author bug cycle + tighten next-release framing (#14117)
• index oe_faxsms_queue.receive_date for the fax list (#14677)
• introduce AcceptanceContext resolver (Item 1) (#14137)
• load Phreeze via composer classmap (#13845)
• move gprelations.inc.php bodies into GpRelationService (#14055)
• move patientvalidation.inc.php body into PatientValidationService (#14112)
• move the agent development guide to AGENTS.md (#14487)
• optimize input validation and permission gates on several AJAX and form endpoints (#14679)
• optimize input validation and permission gates on several AJAX and form endpoints (rel-850 backport of [#14761]) (#14825)
• optimize list-option, finder, and IPPF form handlers (#14672)
• optimize report, portal, and transaction entry points (#14627)
• parameterize residual concat values (#14329)
• pin code-version via bind-mount in Docker Upgrade Process test (#13928)
• point api-explorer smoke at openemr/oe-module-api-explorer (#14748)
• post-8.4.0 updates to release-automation + acceptance-testing plans (#13982)
• post-8.4.0-ship update — G35 + semi-auto merge-order note (#13977)
• post-rel-840 update — G34 + latest-cut pointer (#13936)
• promote 8.7 into fpm test matrix; keep 8.6/8.7 as prerelease opt-ins (#14269)
• record Phase 4h ACL assertion + G52 gap entry for [#14707] (#14731)
• Rector type coverage level 10 (#14364)
• Rector type coverage level 11 (#14365)
• Rector type coverage level 12 (#14389)
• Rector type coverage level 13 (#14390)
• Rector type coverage level 14 (#14392)
• Rector type coverage level 15 (#14397)
• Rector type coverage level 16 (#14401)
• Rector type coverage level 17 (#14403)
• Rector type coverage level 8 (again) (#14345)
• Rector type coverage level 9 (#14355)
• Rector type coverage levels 18-19 (#14409)
• refresh stale group-name pseudocode + resolve-step wording post-refactor (#14198)
• reorganize tests/Acceptance/ into concern-based subdirs (Item 6) (#14196)
• require a v_database bump when upgrade SQL changes (#14501)
• resolve docker acceptance version from version.php + fail-hard on missing (Item 4) (#14173)
• retarget 8.6 fpm to RC image; add 8.7 dev-track build (#14257)
• retire the Node C-CDA service (#14470)
• retire the Node CQM calculation service (#14524)
• retire the standalone US Core 3.1.1 Inferno test (#14498)
• role-context symmetry regression gates across the route matrix (#14810)
• run the v_database check when it changes; explain edits (#14519)
• scope code-version bind-mount to the recreate step only (#13934)
• scope document deletion to the submitted patient context (#13958)
• set SourceForge default download after a release is published (#14539)
• skip 3-day dependabot cooldown for our own docker images (#14425)
• skip certification tests in the Codecov patch check (#14493)
• split scenario/state group tags + persistence-test structural fix (Item 2) (#14141)
• stop carrying forward retired flags; address [#14388] review (#14441)
• stop carrying forward the remaining retired Codecov flags (#14453)
• swap defunct ccdaservice/ fixture path in FallbackRouterTest (#14575)
• tighten 3 weak assertions across api test suite (#14809)
• tighten CCDA/CCR module entry points (#14579)
• tighten CORS Allow-Origin from per-server union to per-client scope (#14527)
• tighten patient-record access across document render paths (#14471)
• tighten upload hygiene across ERA, ZIP, and related paths (#14530)
• tolerate between-cycles state during daily master-row dispatch (#14416)
• two-invocation wizard-install split for post-install-tests coverage (Item 2.5) (#14146)
• update gaps for 8.4.1 patch cycle in-flight + G39/G40 outcomes (#14084)
• Update PHP versions (#14771)
• upgrade the stylelint toolchain to stylelint 17 (#14418)
• upload only the named files to Codecov (#14465)

Documentation

• document AI agent dev environment and LXC reference setup (#11900)

PHP

• bump claimrevolution/oe-module-claimrev-connect from 2.1.9 to 2.2.0 (#14692)
• bump doctrine/orm from 3.6.8 to 3.7.0 (#14000)
• bump ergebnis/composer-normalize from 2.52.0 to 2.53.0 (#14002)
• bump ergebnis/composer-normalize from 2.53.0 to 2.54.0 (#14306)
• bump ezyang/htmlpurifier from 4.19.0 to 4.19.1 (#14155)
• bump giggsey/libphonenumber-for-php from 9.0.38 to 9.0.39 (#13995)
• bump giggsey/libphonenumber-for-php from 9.0.39 to 9.0.40 (#14305)
• bump giggsey/libphonenumber-for-php from 9.0.40 to 9.0.41 (#14555)
• bump google/apiclient from 2.19.4 to 2.20.0 (#14273)
• bump google/apiclient from 2.20.0 to 2.20.1 (#14377)
• bump justinrainbow/json-schema from 6.11.0 to 6.12.0 (#13996)
• bump justinrainbow/json-schema from 6.12.0 to 6.13.0 (#14303)
• bump justinrainbow/json-schema from 6.13.0 to 6.13.1 (#14376)
• bump monolog/monolog from 3.11.0 to 3.12.0 (#13993)
• bump monolog/monolog from 3.12.0 to 3.12.1 (#14385)
• bump nikic/php-parser from 5.8.0 to 5.9.0 (#14163)
• bump phpmyadmin/sql-parser from 6.0.0 to 6.0.1 (#14558)
• bump phpoffice/phpspreadsheet from 5.9.0 to 5.10.0 (#14157)
• bump phpstan/phpstan from 2.2.13 to 2.2.16 (#14382)
• bump phpstan/phpstan-phpunit from 2.0.18 to 2.1.1 (#14559)
• bump ramsey/uuid from 4.9.3 to 4.9.4 (#14160)
• bump smarty/smarty from 4.5.7 to 4.5.8 (#14560)
• bump the development group across 1 directory with 2 updates (#14553)
• bump twig/twig from 3.28.0 to 3.29.0 (#14276)
• bump twig/twig from 3.29.0 to 3.30.0 (#14387)
• bump zircote/swagger-php from 6.10.0 to 6.15.0 (#14690)
• bump zircote/swagger-php from 6.7.1 to 6.10.0 (#14274)

javascript

• bump @babel/core from 7.26.10 to 7.29.7 (#14258)
• bump autoprefixer from 10.5.4 to 10.5.6 (#14001)
• bump autoprefixer from 10.5.6 to 10.6.1 (#14151)
• bump body-parser from 1.20.6 to 1.20.8 in /ccdaservice (#13992)
• bump brace-expansion from 1.1.18 to 1.1.21 (#14396)
• bump brace-expansion in /ccdaservice (#14323)
• bump compression from 1.8.1 to 1.8.2 in /ccdaservice (#14158)
• bump dompurify from 3.4.14 to 3.4.15 (#13998)
• bump dompurify from 3.4.15 to 3.4.16 (#14304)
• bump dompurify from 3.4.16 to 3.4.17 (#14693)
• bump eslint from 10.9.1 to 10.10.0 in /ccdaservice (#13994)
• bump express from 4.22.2 to 4.22.3 in /ccdaservice (#14154)
• bump ip-address from 10.5.0 to 10.7.2 in /ccdaservice (#14313)
• bump jest-environment-jsdom from 30.5.1 to 30.5.2 in the testing group across 1 directory (#14272)
• bump jszip from 3.10.1 to 3.10.2 (#13999)
• bump mocha from 12.0.1 to 12.0.2 in /ccdaservice (#14153)
• bump mocha from 12.0.2 to 12.0.3 in /ccdaservice (#14379)
• bump moment from 2.30.1 to 2.31.0 (#14149)
• bump moment from 2.30.1 to 2.31.0 in /ccdaservice (#14156)
• bump postcss from 8.5.28 to 8.5.29 (#14554)
• bump postcss from 8.5.29 to 8.5.30 (#14694)
• bump proxy-addr from 2.0.7 to 2.0.8 in /ccdaservice (#14406)
• bump purecss from 3.0.0 to 3.1.0 (#14380)
• bump sass from 1.104.0 to 1.105.0 (#14275)
• bump sass from 1.105.0 to 1.105.1 (#14383)
• bump sass from 1.105.1 to 1.105.2 (#14695)
• bump serialize-javascript from 7.1.1 to 7.1.2 in /ccdaservice (#14338)
• bump source-map-js from 1.2.1 to 1.2.2 (#14407)
• bump the build-tools group with 2 updates (#14691)
• bump webpack from 5.110.3 to 5.111.1 in the build-tools group across 1 directory (#14147)

phpstan

• refresh RESERVED_WORD_SUPPLEMENT (#14145)