Release Version 5.1.18 (medplum#9517)

## What's Changed

* [Docs] - Shared Projects (medplum#9459)
* Update headshots (medplum#9432)
* chore(vscode): enforce `organizeImports` in VSCode for repo (medplum#9464)
* fix(core/ws): fix `ReconnectingWebSocket` types, fix error handler shape (medplum#9461)
* Update OTel auto-instrumentation for ESM (medplum#9462)
* Add multi-lingual FHIR support docs and demo app (medplum#9417)
* Provider: fix back button after fax loading (medplum#9466)
* feat(react): Add customization props to ChooseScopeForm (medplum#9463)
* Propagate AWS Trace IDs (medplum#9467)
* Fix BullMQ backoff config (medplum#9473)
* Add agentic engineering guide and companion blog post (medplum#9445)
* Update medplum-multilingual-demo dependencies to match siblings (medplum#9474)
* testing(packages/react): porting from jest to vitest (medplum#9425)
* fix(ws): bind message listener before redis SUBSCRIBE (medplum#9475)
* Adding the rest of DAW ScriptSure documentation (medplum#9448)
* feat(provider): externalize view in candid url using bot (medplum#9454)
* fix(spaces): group fhir request with correspoding response (medplum#9465)
* feat(email): implement project-level SMTP configuration for sending emails (medplum#9396)
* Hold quota delay until after transaction in async mode (medplum#9446)
* docs: update transaction bundle references to be up to date (medplum#9477)
* Adding documentation for Frequently Asked Questions in May (medplum#9440)
* testing(app): migrate from jest to vitest (medplum#9480)
* chore: remove unused dep, identity-obj-proxy (medplum#9482)
* fix(agent,ws): reconnect agent in various error states (medplum#9479)
* Remove beta tag from transaction-bundles feature (medplum#9496)
* Fixing broken link (medplum#9495)
* added ai-realtime docs (medplum#9487)
* feat(data warehouse): restore ORDER BY (medplum#9435)
* fix(ws): tear down WebSocket subscription Redis listener on shutdown (medplum#9494)
* Kubernetes docs fixes (medplum#9504)
* feat(ai): support LiteLLM via configurable base URL and dynamic model list (medplum#9483)
* Removing messages example in favor of provider app (medplum#9503)
* Azure and GCP docs fixes (medplum#9505)
* Patient everything inline attachments (medplum#9481)
* Fixed cursor pagination with _type multi-type search (medplum#9511)
* Fixed Patient-everything operation pagination links (medplum#9512)
* Fixed Group export with POST requests (medplum#9513)
* Dependency upgrades 2026-06-15 (medplum#9515)
* Ensure that Coding properties are attached to primary row (medplum#9498)
* Server: Scheduling Parameters can be inherited from HealthcareService (medplum#9453)
* Simplified example app config settings (medplum#9507)
* Fixes medplum#9509 - date ranges when system is not on UTC (medplum#9510)

**Full Changelog**: medplum/medplum@v5.1.17...v5.1.18

Signed-off-by: Medplum Bot <bot@medplum.com>

Release Version 5.1.17 (medplum#9457)

## What's Changed

* ci(build): avoid running sonar on forks (medplum#9455)
* fix(core): recreate WebSocket subscriptions on reconnect (medplum#9447)

**Full Changelog**: medplum/medplum@v5.1.16...v5.1.17

Signed-off-by: Medplum Bot <bot@medplum.com>

Release Version 5.1.16 (medplum#9452)

## What's Changed

* Add $update-email endpoint to UI (medplum#9266)
* Deduplicate filters in search dataloader (medplum#9411)
* SMART Health Cards and Links (medplum#9349)
* testing(react-hooks): migrate @medplum/react-hooks from Jest to Vitest (medplum#9321)
* Add FHIR quota usage to server request log (medplum#9413)
* fix(server-app): Read project resource to display name (medplum#9402)
* remove reference to private medplum compliance repo, directing to vanta instead (medplum#9415)
* Conditionally deploy previews only if files changed (medplum#9397)
* fix(agent): check for `upgrade.json` b4 unlink (medplum#9416)
* feat(data warehouse): include and exclude filters for tables to sync (medplum#9405)
* feat(react): AI real time questionnaire form (medplum#9303)
* testing(agent): migrating from jest to vitest (medplum#9414)
* docs(agent): add docs page for `Agent/$upgrade` (medplum#9392)
* fix(core/version): only read from cache for explicit vers (medplum#9418)
* docs(agent): document upgrade bugfix (medplum#9426)
* logging(data warehouse): decreased logging and duplicates (medplum#9433)
* Provider: Navbar visual tweaks + HeaderDropdown Refactor (medplum#9281)
* Data Warehouse DuckDB Lifecycle Cleanup (medplum#9434)
* Track idle in transaction time (medplum#9354)
* Dependency upgrades 2026-06-08 (medplum#9438)
* fix(agent): record ack b4 return in aaMode (medplum#9443)
* Prevent traces for outbound HTTP requests (medplum#9441)
* Update professional-claims.md (medplum#9419)
* Fixed eslint-plugin-jsdoc peer dependency version (medplum#9444)
* Fix api-extractor warnings in react package (medplum#9450)
* Fixes medplum#9439 - ResourcePropertyDisplay handle primitive extension  (medplum#9449)
* feat(provider): Add performing practitioner support in care team field (medplum#9451)

**Full Changelog**: medplum/medplum@v5.1.15...v5.1.16

Signed-off-by: Medplum Bot <bot@medplum.com>

Release Version 5.1.15 (medplum#9404)

## What's Changed

* Allow project admins to expunge with everything=true (medplum#9330) (medplum#9363)
* Fix auto syncing order set (medplum#9352)
* docs(api): add documentation for User $rescope operation (medplum#9345)
* ci(build-agent): add version override (medplum#9369)
* Updating Candid docs (medplum#9329)
* logging(warehouse): better logging of startDate (medplum#9370)
* Remove browser history pollution from some internal redirects (medplum#9367)
* fix(provider): Create/update claim during export or submit (medplum#9366)
* feat(server): include claim submit operation (medplum#9295)
* Provider: Add Appointment confirm button (medplum#9302)
* Fixes draft->queued->approved Rx sync with DAW (medplum#9372)
* Remove meta.accounts from non-extended mode (medplum#9379)
* [Stedi] Claim Submission Docs (medplum#9312)
* Adding HITRUST documentation (medplum#9384)
* fix(agent): trigger shutdown b4 awaiting channel start (medplum#9382)
* Do not report traces for healthcheck requests (medplum#9387)
* Update some docs "admonitions" (medplum#9390)
* fix(provider): fix autoscrolling and scroll to bottom  (medplum#9380)
* testing(cli): migrate @medplum/cli from Jest to Vitest (medplum#9336)
* feat(react): realtime voice - keep socket active (medplum#9355)
* feat(data warehouse): adding config to set which tables to sync, and minor changes (medplum#9378)
* Fixed provider previews (medplum#9383)
* fix(agent): fix duplicated messages during upgrade (medplum#9339)
* feat(server): record authenticating ClientApplication on AuditEvent.agent[] (medplum#9337)
* Fixes medplum#8835 - prevent duplicate resources in `convertToTransactionBundle` (medplum#9293)
* Add CDK permissions for S3 Tables (medplum#9395)
* Implement FHIRPath Patch utility (medplum#9377)
* Provider encounter creation: link appointment.slot (medplum#9279)
* Typo: "memebership" -> "membership" (medplum#9391)
* Constrain scheduling operations with `Schedule.planningHorizon` (medplum#9388)
* ci(build): make build job fail when sonar fails to run (medplum#9393)
* Scheduling: default availability to "always" (medplum#9389)
* Include requested time slot in scheduling availability error message (medplum#9306)

**Full Changelog**: medplum/medplum@v5.1.14...v5.1.15

Signed-off-by: Medplum Bot <bot@medplum.com>

Release Version 5.1.14 (medplum#9365)

## What's Changed

* feat(server): delete Lambda when a Bot is deleted (medplum#9259)
* Add `Appointment/:id/$confirm` operation (medplum#9210)
* React and Provider App components for Meds Ordering (medplum#8999)
* Add test case for Patient using $book operation (medplum#8700)
* fix(provider): Filter selfpay coverage from visit eligibility check (medplum#9261)
* Soft-delete draft MR on order-medication failure (medplum#9273)
* Use batched searches for preferred pharmacies and orgs for med prescribing (medplum#9284)
* Added order set bundle and import button to provider (medplum#9283)
* fix(cdk): Send prefix instead of bucket name (medplum#9288)
* Dependency upgrades 2026-05-25 (medplum#9290)
* Fixed plumcon avatar images (medplum#9292)
* Add $book support for proposed appointment input (medplum#9179)
* Provider: Add "Cancel Visit" button (medplum#9213)
* feat(server): support server-scoped Patient users in invite endpoint (medplum#9278)
* Provider: Use Appointment-based scheduling flow (medplum#9272)
* fix(server): derive bare-id reference prefix from SearchParameter.target (closes medplum#9254) (medplum#9256)
* Increase pre auth code max lifetime to 7 days (medplum#9274)
* Unify helper function for computing FHIR quota limits (medplum#9301)
* Various oauth2 fixes for spec compliance (medplum#9294)
* Serialize transaction state transitions (medplum#9260)
* Fixes medplum#9269 - GC IP userinfo support (medplum#9286)
* docs(dosespot): add Step 2 and Step 4 prescriber login sections and registration statuses reference (medplum#9271)
* feature(data warehouse): export from Postgres to Parquet / Iceberg (S3 Tables) (medplum#8941)
* Adding DAW ScriptSure integration docs (medplum#9299)
* Revert "fix(server): derive bare-id reference prefix from SearchParameter.tar…" (medplum#9324)
* test(definitions): Migrate @medplum/definitions from Jest to Vitest (medplum#9318)
* Migrate @medplum/mock from Jest to Vitest (medplum#9322)
* fix(server): derive bare-id reference prefix from SearchParameter.target (medplum#9325)
* Migrate @medplum/ccda from Jest to Vitest (medplum#9323)
* Migrate @medplum/cdk from Jest to Vitest (medplum#9317)
* Migrate @medplum/create-medplum from Jest to Vitest (medplum#9320)
* testing(generator): migrate @medplum/generator from Jest to Vitest (medplum#9319)
* testing(fhir-router): migrate @medplum/fhir-router from Jest to Vitest (medplum#9315)
* DoseSpot sync button fix (medplum#9305)
* Migrates @medplum/hl7 from Jest to Vitest (medplum#9316)
* Added vmcontext bots security note (medplum#9333)
* Require HTTPS for rest-hook Subscription URLs by default (medplum#9334)
* feat(data warehouse): add startDate parameter (medplum#9326)
* fix(server): don't refresh if membership inactive (medplum#9340)
* fix(core,react-hooks): don't refresh subs if unauthenticated (medplum#9341)
* Vendor JSON Patch library (medplum#9335)
* Display onBehalfOf in History, Timeline, and Blame (medplum#9206)
* Add "Tasks" section to Provider App Manual (medplum#7491)
* Added order set sync bot trigger after importing example order set (medplum#9307)
* Uptime docs (medplum#9344)
* feat(provider): Use operations instead of bots for claim submit (medplum#9280)
* Fixes medplum#9276 - unified external auth (medplum#9289)
* Support `resource:number` in `convertToTransactionBundle` (medplum#9356)
* fix(aws): Handle complex server configuration (medplum#7258)
* feat(core/client): expose a wrapped fetch method in MedplumClient  (medplum#9357)
* Scroll to top of viewport on route change (medplum#9358)
* Digital Ocean docs (medplum#9348)
* S3 Deploy util (medplum#7635)
* Add docs destination for new s3deploy (medplum#9361)
* More helm docs (medplum#7282)
* Adding May Update (medplum#9362)
* Dependency upgrades 2026-06-01 (medplum#9364)

**Full Changelog**: medplum/medplum@v5.1.13...v5.1.14

Signed-off-by: Medplum Bot <bot@medplum.com>

Release Version 5.1.13 (medplum#9264)

## What's Changed

* Dependency upgrades 2026-05-18 (medplum#9233)
* Website updates (medplum#9238)
* Update website content-security-policy (medplum#9239)
* Add cookie consent dialog (medplum#9240)
* Update website content-security-policy (medplum#9241)
* Update website content-security-policy (medplum#9242)
* Electronic Prior Auth testing docs (medplum#9245)
* Add youtube video to spaces.mdx (medplum#9249)
* [Docs] Add Health Gorilla Sync Back Resources Docs  (medplum#9235)
* medplum-provider: hide Get Started screen via project setting (medplum#9253)
* Add Project.link search parameter (medplum#9250)
* Update project-vs-server-scoped-users.mdx (medplum#9248)
* fix(provider): Disable conditions autocomplete after selection one value (medplum#9236)
* add rate limits operation docs (medplum#9243)
* Fix implementations of FHIRPath functions (medplum#9176)
* fix(server): index fragment CodeSystems in CodingTable (medplum#9209)
* Provider: Reveal more slots in SchedulePage (medplum#9146)
* refactor(server): combine `systemLogger` + `globalLogger` (medplum#9186)
* Async Batch Docs (medplum#9216)

**Full Changelog**: medplum/medplum@v5.1.12...v5.1.13

Signed-off-by: Medplum Bot <bot@medplum.com>

Release Version 5.1.12 (medplum#9232)

## What's Changed

* Add scheduling feature flag (medplum#9134)
* Scheduling error path improvements (medplum#9088)
* Tenant Selector Options (medplum#9121)
* refactor(agent): always collect HL7 conn stats (medplum#9141)
* Add clarification on Bots with ProjectMemberships (medplum#9150)
* Backport R5 type guard syntax in search parameter expressions (medplum#9138)
* Restrict patient scope tokens to context Patient compartment (medplum#9123)
* fix(provider): Pre fill patient in lab ordering (medplum#9143)
* Fixed core jsdoc warnings (medplum#9155)
* Added support for AWS GuardDuty Malware Protection (medplum#9153)
* chore(node): tighten Node engine ranges and require Node LTS version 22 or 24 (medplum#9067)
* Add admin API endpoint for rate limit utilization status (medplum#9152)
* Faster tests by mocking slow SQL queries and quicker wait loops when appropriate (medplum#9165)
* Fixes medplum#9039 - Server option to require verified email address (medplum#9156)
* Handle broken images due to malware scanner (medplum#9162)
* Range search (medplum#9159)
* Transform body parser error to HTTP 413 (medplum#9173)
* feat(server/bots): prune old bot lambda versions (medplum#9167)
* Dependency upgrades 2026-05-11 (medplum#9169)
* Add Rate Limits tab to admin page (medplum#9164)
* Convert Examples/FooMedical tests from Jest to Vitest (medplum#9180)
* Delete old versions of all lambda bots (medplum#9175)
* feat(provider): realtime ai speech to text  (medplum#9174)
* Adding updated event info (medplum#9181)
* Fix test: PatientPage hardcoded age (medplum#9185)
* Lambda Cleaner uses lower concurrency and has improved logging (medplum#9187)
* Fixes medplum#9182 - www-authenticate: bearer (medplum#9188)
* feat(agent): add `Agent/$stats` operation (medplum#9078)
* docs(dosespot): document self-service prescriber enrollment bot (medplum#9193)
* Stop sharing lambda clients across requests (medplum#9195)
* Attempt to revive coveralls PR comments (medplum#9189)
* Disable GIN Fastupdate on Appointment, Slot in tests (medplum#9194)
* docs: Restructure our charting documentation and add additional content based on decision guide (medplum#9163)
* Add $hold Scheduling operation (medplum#9148)
* feat(server,app): add `User/$rescope` operation (medplum#9154)
* Adding Business Operations Associate JD to careers page (medplum#9196)
* fix(server/config): Add `defaultProjectFeatures` to objectKeys set (medplum#9120)
* Update direct-external-auth.md (medplum#9202)
* FooMedical: Use Appointment/$find + Appointment/$hold (medplum#9177)
* Avoid duplicated code from op defs (medplum#9205)
* Add $cancel Scheduling operation (medplum#9157)
* docs: add Spaces feature documentation for Medplum Provider (medplum#9212)
* fix(core): include more accurate msg in WS sub error handler (medplum#9214)
* Add active consumer index to $rate-limits operation (medplum#9192)
* Fix `act()` warnings in provider tests (medplum#9224)
* perf(server/ratelimit): optimize calls to Redis keys (medplum#9219)
* chore(react-hooks): Move whisper hook to react-hooks package  (medplum#9184)
* fix(server): $ai-realtime updates (medplum#9215)
* Fixes medplum#9183 - offline_access when refresh_token in grant_types (medplum#9228)
* OAuth2 pre-authorized code (magic links) (medplum#9231)
* Fixed the RECAPTCHA_SITE_KEY always being reverted to the default. (medplum#9230)
* Updateing links to go to the trust center (medplum#9229)
* Added 'log-streaming' feature and Project.features search param (medplum#9049)

**Full Changelog**: medplum/medplum@v5.1.11...v5.1.12

Signed-off-by: Medplum Bot <bot@medplum.com>

Release Version 5.1.11 (medplum#9145)

## What's Changed

* docs: add multiple locations guide to Health Gorilla integration (medplum#9084)
* Provider: Make `<AlphaBanner>` dark-mode friendly (medplum#9092)
* docs: set title and sidebar_label for pages with MDX heading IDs (medplum#9099)
* fix(docs): fix broken notes on `Enabling Rollbacks` page (medplum#9101)
* Validate search types for chained search and includes (medplum#9100)
* Enforce login membership before scope (medplum#9105)
* fix(core): "graph[vertex] is not iterable" when importing FHIR bundles without ID (medplum#9107)
* Dependency upgrades 2026-05-04 (medplum#9114)
* Use `node:assert` instead of custom `invariant` (medplum#9108)
* Introduce Appointment/$find multi-schedule search (medplum#8793)
* fix(server/cors): expose `RateLimit` header for cors (medplum#9116)
* Consistent Repository connection state tracking and sharing (medplum#9082)
* Added fhir quota mention to async batch docs (medplum#9106)
* Merge commit from fork
* Range search  (medplum#9051)
* Revert "Range search  (medplum#9051)" (medplum#9127)
* Route AsyncJob operations through user repo (medplum#9126)
* feat(provider): spaces render markdown responses (medplum#9130)
* chore(provider): use LinkTabs in provider patient page (medplum#9122)
* Add NPI Lookup Example Bot using NPPES API (medplum#9115)
* fix(agent): return explicit error when upgrade artifact is missing (medplum#7940) (medplum#9131)
* fix(agent): respond at least with `agent:error` on exception (medplum#9135)
* chore(react): Remove selfpay coverage from PatientSummary insurance (medplum#9136)
* add clinicalimpression to patient timeline (medplum#9139)
* Provider: Fix "Details" link tab (medplum#9133)
* Extract distinct functionality from `repo.ts` (medplum#9052)
* fix(core): serialize cross-tab token refresh with Web Locks API (medplum#9113)

**Full Changelog**: medplum/medplum@v5.1.10...v5.1.11

Signed-off-by: Medplum Bot <bot@medplum.com>

Release Version 5.1.10 (medplum#9095)

## What's Changed

* feat(cdk): add `loadBalancerAlgorithm` config (medplum#9036)
* Always set JWT jti claim (medplum#9040)
* feat(provider): Submit to Stedi (medplum#8997)
* Added ai-realtime websocket for speech-to-text (medplum#8998)
* Consolidate logic for permitted project IDs (medplum#9041)
* Tightens access controls for linked projects (medplum#9042)
* Range search (medplum#8950)
* Revert "Range search (medplum#8950)" (medplum#9046)
* Range search (retry) (medplum#9047)
* fix(subscription): tie WS sub to membership, not profile (medplum#9030)
* Revert "Range search (retry) (medplum#9047)" (medplum#9050)
* Test that data manifest agrees with migration files (medplum#9048)
* feat(subscription): add logging of `remoteAddress` with WebSocket connect event (medplum#9055)
* fix(provider):  pre populate coverage selection during submit claim review (medplum#8996)
* fix(provider): Fix submit claim tests (medplum#9059)
* test(subscription): add thorough tests around user auth revocation (medplum#9056)
* consolidate test logic (medplum#9068)
* Dependency upgrades 2026-04-27 (medplum#9044)
* fix(react): QuestionnaireForm remove disabled item/responses from QuestionnaireResponse (medplum#9065)
* fix(agent): more feedback to caller, throw on 4xx during upgrade dl (medplum#8379)
* Use DiagnosticReportDisplay on lab results page (medplum#9072)
* Suppress ECONNRESET errors (medplum#9076)
* feat(server): ActivityDefinition dynamicValue in plan definition $apply   (medplum#9073)
* Document login rate limit category in rate limits docs (medplum#9080)
* Enrich subscription logs (medplum#9079)
* optimize(core): cache `Hl7Message`: `toString()`; `getAllSegments()` (medplum#8931)
* Documentation for suggested Bot code architecture (medplum#9063)
* Adds single-type reference search match to memory repo (medplum#9085)
* Add wider retry spacing and jitter to subscription queue (medplum#9064)
* Handle 'url' keys in reference replacer (medplum#9087)
* Monthly blog post for April  (medplum#9058)
* ci(sonar): re-enable `Sonar` on all PRs and merge groups (medplum#9086)
* chore(provider): Update PlanDefinition sample data (medplum#9083)
* Deploy graphiql in staging.yml (medplum#9093)
* feat(server/pubsub): log PubSub subscriber lifecycle (medplum#9091)
* Revoke active sessions on password reset (medplum#9081)
* Fixed bug with SMART scopes and MFA (medplum#9094)

**Full Changelog**: medplum/medplum@v5.1.9...v5.1.10

Signed-off-by: Medplum Bot <bot@medplum.com>

Release Version 5.1.9 (medplum#9032)

## What's Changed

* Added profile card to about page. Signed-off-by: AndyStoneman <astoneman10@gmail.com> (medplum#8971)
* Minor tweaks to allow data load and refresh tokens (medplum#8848)
* fix(otel): use `ExponentialHistogram` view (medplum#8964)
* Collapse duplicate problems in ProblemList (medplum#8968)
* React hooks for DoseSpot prescriber self-enrollment bot (medplum#8942)
* docs(auth): add direct-external-auth to sidebar and overview (medplum#8977)
* Add admin endpoint to reset user MFA enrollment (medplum#8970)
* Update docusaurus admonition formatting (medplum#8976)
* Failed login cleanup (medplum#8982)
* Include Project in presigned URLs (medplum#8981)
* Small document touch up (medplum#8979)
* Delay in async context instead of consuming rate limit (medplum#8965)
* Transaction dead connection management (medplum#8987)
* Client assertion docs (medplum#8973)
* feat(server): support externalAuthProviders via environment variable (medplum#8978)
* Add MedplumClient support for ReadableStream and Readable (medplum#8989)
* docs(self-hosting): add docs for enabling rollbacks (medplum#8986)
* feat(agent): track messages independently of clients (medplum#8797)
* docs(health-gorilla): emphasize email uniqueness in user management (medplum#8939)
* Dependency upgrades 2026-04-20 (medplum#8991)
* Remove resource input folder (medplum#8994)
* Sort resource array columns without an accompanying sort column (medplum#8961)
* Deduplicate reads by reference in GraphQL dataloader (medplum#8995)
* Added docs to FhirRepository class (medplum#8990)
* Added all DoseSpot registration statuses to DoseSpot > Prescriber Enrollment (medplum#8975)
* Updating sample access policy to support scenarios that are now enabl… (medplum#8628)
* Fixed misleading resource diff on first version (medplum#9007)
* Unify sendBotResponse (medplum#9005)
* Disable CodeQL on merge queue (medplum#9011)
* Use Delta aggregation temporality for OTel metrics (medplum#9010)
* MFA reset flow docs (medplum#9002)
* Insurance Eligibility Check Custom Fhir Operation (medplum#8918)
* Dependency upgrades (medplum#9022)
* Remove GraphQL query limit documentation. (medplum#9018)
*  Apply markdown rendering to Resource documentation fields (medplum#9008)
* Adding patient match documentation (medplum#9003)
* Fix scheduling Month view (medplum#9023)
* Fixed docs broken links (medplum#9024)
* Fix agent channel reload when endpoint protocol changes (medplum#9006)
* Use explicit HealthcareService references in Scheduling (medplum#8927)
* Backport R5 `HealthcareService.offeredIn` field to Medplum R4 (medplum#9004)
* Enforce Project.exportedResourceType on cached reads (medplum#9031)

**Full Changelog**: medplum/medplum@v5.1.8...v5.1.9

Signed-off-by: Medplum Bot <bot@medplum.com>