fix(deps): bump health.matchbox:matchbox-engine from 4.1.16 to 4.1.17 in /fhir-mapbuilder-validation

[dependabot]

Bumps health.matchbox:matchbox-engine from 4.1.16 to 4.1.17.

Release notes

Sourced from health.matchbox:matchbox-engine's releases.

Release v4.1.17

2026/09/21 Release 4.1.17

• GUI: browse the FHIR package registry packages2.fhir.org on the IGs page, filtered by package name, FHIR version and publication date, mark the installed packages, and install a selected package version (hidden when the server is in httpReadOnly mode) (#583)
• Add the validator version to the validation OperationOutcome, as per the FHIR Tooling Extensions (#581)
• Add proposed profiles in the validator even if a meta.profile is present (#335)
• Add information about the proposed profiles in the validator: package ID and version, title, and canonical URL (#355)
• Allow filtering proposed profiles by current version (#355)
• Update to HAPI FHIR 8.12.1

Full Changelog: ahdis/matchbox@v4.1.16...v4.1.17

Changelog

Sourced from health.matchbox:matchbox-engine's changelog.

2026/10/xx Release 4.1.19

• Add a manual workflow (Create a release) that creates the tag and the GitHub release of the version in the POM with the notes from the changelog, and starts the Docker and Maven Central workflows
• Tests: replace the fixed 10 s "give the server some time to start up" sleep of the server integration tests with a readiness check (ServerStartup) that waits for the validation engine to be initialized and /fhir/metadata to answer. The startup, including the loading of the IGs, is already synchronous, so the check passes immediately and each test class starts about 10 s earlier
• Make the initialized flag of MatchboxEngineSupport volatile, as it's polled by request threads

2026/09/26 Release 4.1.18

• Docker: size the heap relative to the memory limit of the container (-XX:MaxRAMPercentage=70 instead of -Xmx12g in the default JDK_JAVA_OPTIONS); a memory limit of 4 GB is enough for a typical setup of implementation guides (measured with the 12 IGs of with-preload: about 1.3 GB of live heap) (#599)
• Docker: enable the string deduplication of the garbage collector (-XX:+UseStringDeduplication) by default; it reduces the heap used by the ch-elm validation engine by about 15% at no measurable cost in validation time (#597)
• Don't keep the whole content of a package in memory for the few binaries of its other folder: this kept e.g. all files of hl7.fhir.uv.xver-r5.r4 and hl7.fhir.r4.core (about 210 MB) on the heap of the main engine (#597)
• Load the terminology resources (CodeSystem, ValueSet, NamingSystem, ConceptMap) of the implementation guide packages and their dependencies lazily: they're registered with the metadata of the package index and parsed when they're first used, like the core validator does. For the ch-elm implementation guide, which pulls in 7 versions of hl7.terminology.r4, the engine keeps about 225 MB less heap and is created about 6 s faster (#599)
• Load the terminology resources of the FHIR core package and of the packages from the classpath (hl7.terminology, extensions, xver, CDA) lazily too; the core terminology resources are pinned to the core versions when they're parsed. Another 105 MB less heap and 4–6 s faster startup (#599)
• Don't make HAPI parse and keep all StructureDefinitions of the FHIR core (about 40 MB for R4) for the FHIRPath engine of the JPA search parameter extractors, which only uses them for its static type analysis (#599)
• Don't load a package again when a dependency with a wildcard version (e.g. ch.fhir.ig.ch-term#3.3.x) resolves to an already loaded version (#599)
• Share the conformance resources of a package between the validation engines of several IGs that depend on it: an engine registers the resources that another engine has loaded instead of loading and parsing the package again. The cache keeps them only as long as an engine that uses them is alive. With ch-core and ch-epr-fhir, the resources that were loaded in both engines (53 MB) exist once (#599)
• Update the with-preload sample configuration to the latest released versions of its IGs (ihe.iti.mhd and ihe.iti.pixm replace ihe.mhd.fhir and IHE.ITI.PIXm, ch.fhir.ig.ch-epr-fhir replaces ch.fhir.ig.ch-epr-mhealth)
• Fix the with-ch sample configuration, which didn't start since 4.1.12: its local terminology server is reached over http, so it needs matchbox.fhir.context.ssrfProtectionEnabled: false
• Add a JMeter test with several IGs (jmeter/multi-ig.jmx) to check which packages the validation engines share (#599)
• Add a JMeter runbook with the memory and validation time of the ch-elm images from 1.13.1 to 1.15.2 (jmeter/claude-jmeter-check.md)
• Docker: the JVM options can be configured with the JDK_JAVA_OPTIONS environment variable, which defaults to -Xmx12g -XX:+ExitOnOutOfMemoryError (#594)
• Docker: exit on the first OutOfMemoryError (-XX:+ExitOnOutOfMemoryError) instead of continuing in an undefined state while the health check still reports UP, so that the container gets restarted (#457)
• Docker: use the exec form of the entrypoint, so that matchbox receives the stop signal and shuts down gracefully; arguments given to the container are now passed to matchbox as Spring Boot arguments instead of being ignored (#594). Thanks @​reva!
• Fix the Gazelle Validation Service API reporting PASSED when nothing could be validated (unknown profile, engine not initialized, engine creation failure): the result is now UNDEFINED (#590)

... (truncated)

Commits

• cfff2ba v4.1.17
• 56812e6 Update to HAPI FHIR 8.12.1
• 3e16bc6 Add comment about patch upstream PR
• 9884252 Fix the MCP response of get-profiles-for-document-bundle
• 16ce382 #429 serve Gazelle validation API v1 next to v2
• b5a6794 #429 update to Gazelle validation API 2.0
• 45c4c96 server: rebuild the Angular GUI resources
• f435e7c GUI: mark installed packages in the registry browser, show a spinner while in...
• d18a2e5 GUI: browse packages2.fhir.org on the IGs page and install packages
• 59a4d5a server: rebuild the Angular GUI resources
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.07%. Comparing base (8aefcc4) to head (8229873).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #225   +/-   ##
=========================================
  Coverage     96.07%   96.07%           
  Complexity       51       51           
=========================================
  Files            19       19           
  Lines          1913     1913           
  Branches        239      239           
=========================================
  Hits           1838     1838           
  Misses           70       70           
  Partials          5        5           

Flag	Coverage Δ
java	95.31% <ø> (ø)
ts	96.16% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.