Releases
FerroFED ships on the 0.0.x line. A milestone on the tracker is a release, cut when the milestone has no open issue left. This page lists what each release added to the gateway, newest first; the changelog has every change of every release, and Upgrading says how to move a deployment to a newer one.
| Release | Date | What it added |
|---|---|---|
| v0.0.18 | 2026-11-10 | Discharge and imaging reports, and the contact point. The FHIR face lists and serves discharge and imaging reports from a member’s openEHR record or its own FHIR endpoint, and receives discharge reports. A national contact point’s requests are held to the patient of its treatment relationship and to the MyHealth@EU emergency limit, and every node request goes under a token exchanged for its caller. |
| v0.0.16 | 2026-11-05 | Laboratory reports, and prescriptions from openEHR. The FHIR face receives, lists and serves laboratory reports in the European exchange format, from a member’s openEHR record or from the member’s own FHIR endpoint. A member that keeps its prescriptions in openEHR serves them as HL7 Europe prescriptions and receives dispensations, and the console draws every page on its server. |
| v0.0.15 | 2026-10-30 | The family’s server, and the MyHealth@EU catalogue. The gateway and its console run on the FerroHEALTH family’s shared server, configuration, health and telemetry crates, with TLS 1.3 by default and every error a problem details document. FerroFED’s reading of the MyHealth@EU requirements catalogue is published as a self-assessment, with the gateway changes it found for a national contact point. |
| v0.0.14 | 2026-10-28 | No patient index, and safer summaries. The gateway keeps no table of patients in any profile: every patient resolves through FerroPIX, the family’s patient index, which the quickstart runs. The patient summary marks a probable duplicate medicine across members, a repeated entry is never merged into one, and a dispensation is checked against the owner’s before it is written. |
| v0.0.13 | 2026-10-25 | The national contact point, served. A national contact point’s connector reads the patient summary, the document list and the prescriptions on the FHIR face and posts a dispensation, held by an end-to-end test. A received document is validated in full against its profiles, and the gateway ships a Kubernetes package with its images pinned by digest. |
| v0.0.12 | 2026-10-24 | The console rebuilt, and every finding judged. The operator console is rebuilt on FerroUI as ferrofed-console: every page is drawn on the server and every action works with no WebAssembly. Client authentication runs on the family’s shared resource-server crate, static bearer tokens are gone, and each release is refused while a scan finding in its images or binaries has no statement that judges it. |
| v0.0.11 | 2026-10-16 | Prescriptions on the FHIR face, and a new console. The FHIR face searches and reads a patient’s electronic prescriptions and writes a dispensation to the member that owns its prescription, passed through in the HL7 Europe MPD profiles from the members that serve them. The operator console is redesigned, and can keep the configuration as versioned revisions an operator saves, applies and rolls back. |
| v0.0.10 | 2026-10-15 | EHDS readiness, and ready for production. Every access to patient data is recorded with the verified caller and the categories of the data, as the EHDS logging component asks. A FHIR face answers the patient summary in the European exchange format and receives a patient summary into the member you name. Several replicas, restarts with no dropped request, TLS on the listener, overload limits and inbound metrics are built, and the specification is pinned at 1.0.0. |
| v0.0.9 | 2026-10-05 | An operator console, and a conformance statement. The operator console shows the members, incidents and stored queries and runs a federated query with every node’s status and completeness, signed in through OpenID Connect with no JavaScript of its own. The conformance statement scores each conformance point of the Federation Tier by a test or a recorded deferral, with the node profile checked against FerroEHR and EHRbase, and ferrofed conformance run scores your own deployment. |
| v0.0.8 | 2026-10-04 | Every caller verified, every node reached its own way. Each caller is authenticated at the gateway, and each node is reached with its own credential: OAuth 2.0 with DPoP, or the Dutch Nuts and FAPI 2.0 grants. Patients are located through XCPD, PIXm, PDQm or the Dutch NVI, consent can be checked with Mitz first, and every IHE exchange is audited. |
| v0.0.7 | 2026-10-03 | Ready to operate. A check to run before you admit a node, a registry reload on SIGHUP, health probes, Prometheus and OpenTelemetry metrics, a stored-query store on a file, PostgreSQL or a read-only directory, and a compose file in every release that starts the gateway in front of the CDRs you already run. |
| v0.0.7 | 2026-10-03 | Writes and definitions reach their owner. A versioned write goes only to the CDR that created the version. A template goes to the node you name, or to several on request, and stored queries live at the gateway as immutable versions it can distribute to the members. |
| v0.0.6 | 2026-10-03 | Follow-ups reach the right node. A request under /v1/ehr/{ehr_id} goes to the one node that holds that EHR: the node the client names, else the one the gateway learned, else the one it finds. Two nodes claiming one EHR id are refused, never guessed between. |
| v0.0.6 | 2026-10-03 | Directed and self-describing. A client names nodes in the AQL or in a header and can select each row’s endpoint as a column. OPTIONS / says what the gateway does and which members stand behind it. |
| v0.0.6 | 2026-10-03 | Merged as one CDR would. ORDER BY with LIMIT, bounded OFFSET pages, DISTINCT and the aggregates are applied across nodes, and a copied version can be kept once. What cannot be exact is refused with a reason. |
| v0.0.6 | 2026-10-03 | Never a silent partial answer. Every node in scope is reported with a status. When a node that was asked does not answer in its time budget, the default is to fail the query. A client that asks for flagged partial rows gets them, every missing node named. |
| v0.0.3 | 2026-10-02 | No identifier in what the gateway sends a node. The patient identifier is resolved to each node’s local EHR id outside AQL, through an IHE PIXm PIX Manager, and consumed at the gateway. The rewrite refuses a query that would leak it, and an outbound gate checks every request again before it leaves. A body the client writes reaches its node as the client sent it. |
| v0.0.3 | 2026-10-02 | Transparent to the client. /v1/query/aql takes a conformant openEHR query with no federation syntax and answers one ordinary ITS-REST result set, with the federation’s additions in one metadata member that names every endpoint. |
The milestones are the roadmap, and the open issues the worklist behind it.