template security issue

[JohnMoehrke]

Load Template from fhir.base.template#1.0.0 (00:00.891 / 00:15.223, 25Mb)
This content depends on fhir.base.template which is no longer considered secure to use
See Security notification at https://www.fhir.org/guides/security-notices/2026-03-npm-dependencies.html

should be based on fhir2.base.template rather than fhir.base.template

Note this will cause errors with some paths, as the new fhir2 supports language.

[costateixeira]

If the issue is security, we don't need to use fhir2.base.template.
Is this an urgent security fix? or an upgrade?

[JohnMoehrke]

is there a different solution that doesn't require fhir2.base.template? I am fine, as long as the security issue is addressed. This is why I said "should", as that is what I understand is the solution from HL7.

The groups should discuss if language is important.

[oliveregger]

Reading the security message I don't see a security issue now (fhir.base.template is blocked on npmjs.com), but we need to move to new template, so the sooner we have this in place the better.

The security researcher who reported the original exploit created a demonstration malicious package at fhir.base.template. This package name is now blocked on npmjs.com, and cannot be used. fhir.base.template is the base template that is no longer supported, so all IG authors are strongly encourage to move to the new multi-language template fhir2.base.template as their base template. At some stage in the near future, the IG Publisher will refuse to run for IGs that have a dependency on fhir.base.template.