Borehole · Project · free tier
hapifhir/hapi-fhir
Free reading: not for reliance
852fe5f · 11,073 commits · 13,816 files
Read 2026-11-05

hapifhir/hapi-fhir: technical due diligence, read from its repository

What Borehole read in hapifhir/hapi-fhir's code and history at 852fe5f: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.

DimensionRating
Architecture & Codebase — including AI provenancestrong
Engineering Process & SDLC Maturityadequate
Product & Engineering Maturitystrong
Security & Reliability Posturestrong
Observability & Operationsnot assessable
Fit with the Acquirernot assessable

What the repository says

  • Releases are cut from another branch than the one surveyed
  • AI_POLICY.md:1: states a policy on AI-generated contributions

Architecture & Codebase — including AI provenance

strong
01.6

hapi-fhir-jpaserver-base/src/main/java/ca/uhn/fhir/jpa/migrate/tasks/HapiFhirJpaMigrationTasks.java is 4,680 lines, 47× this codebase's median file

adequate

The median source file here is 98 lines. 55 files exceed 1,000 lines, the largest being 4,680. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Evidence
hapi-fhir-jpaserver-base/src/main/java/ca/uhn/fhir/jpa/migrate/tasks/HapiFhirJpaMigrationTasks.java:1 — 4,680 lines (47× median)
hapi-fhir-base/src/main/java/ca/uhn/fhir/interceptor/api/Pointcut.java:1 — 3,865 lines (39× median)
hapi-tinder-plugin/src/main/java/ca/uhn/fhir/model/dstu2/composite/ElementDefinitionDt.java:1 — 3,638 lines (37× median)
hapi-fhir-jpaserver-base/src/main/java/ca/uhn/fhir/jpa/search/builder/QueryStack.java:1 — 3,581 lines (36× median)
hapi-fhir-jpaserver-base/src/main/java/ca/uhn/fhir/jpa/term/TermReadSvcImpl.java:1 — 3,530 lines (36× median)

Engineering Process & SDLC Maturity

adequate
02.29

Pinned dependencies have not moved in 17 months

adequate

The lockfile last changed 519 days before the newest commit, and 755 commits have landed since. Every security fix published upstream in that time is absent until someone updates it, and the longer the gap the larger and riskier that update becomes.

Evidence
.github/workflows/cdr_check/poetry.lock last changed 2025-06-03
02.24

6% of recent commits change more than 2,000 lines

adequate

52 of 863 commits in the last 24 months changed over 2,000 lines of code, not counting reformatting, renames, vendored or generated code. A change that size is rarely reviewed line by line. Ask how they were reviewed, and what made them that large.

Evidence
52 commits over 2,000 lines

Product & Engineering Maturity

strong
04.62

Releases are cut from another branch than the one surveyed

adequate

The newest release, v8.12.1, is not on the branch this survey read; the newest release on it is v8.10.0. The shipped product may differ from what this report describes. Survey the release branch too.

Evidence
tag v8.12.1

Security & Reliability Posture

strong
05.65

10 advisories against this project in the last 24 months, 9 high or critical

adequate

The newest was published on 2026-09-16. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 10 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 8.10.0. Answer lives in: the release you run, set against each fixed version. The record is incomplete: NVD: 5 records name hapi-fhir with nothing tying them to this repository (CVE-2019-12741, CVE-2026-113873, CVE-2026-113874, …).

Evidence
2026-09-16: CVE-2026-81875 (high): HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/s
2026-09-16: CVE-2026-81876 (high): HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/s
2026-08-07: CVE-2026-62293 (moderate): HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates a
2026-08-07: CVE-2026-62295 (high): HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhi
2026-08-07: CVE-2026-62296 (high): HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum el

Observability & Operations

not assessable

Not rated: only 5 of 16 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.

Fit with the Acquirer

not assessable

Not rated: structurally not assessable from a repository.

Read more, or read your own

The full report on hapifhir/hapi-fhir: every dimension, the questions for the room, and the audit log.

Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.