v8.1.0

National reporting and CarePlus integration

• Team-specific configuration for CarePlus web service (MAV-5294) - Added per-team configuration for CarePlus credentials (namespace, username, password) used by the direct web service integration
• Code and CLI tool to send CarePlus reports to CarePlus web service (MAV-5295) - Added a CLI tool that transmits CarePlus reports directly to the CarePlus web service for a given team
• Create mock CarePlus service (MAV-5884) - Added a mock CarePlus service to support development and testing of the direct web service integration
• Reporting app uses environment variables for direct web service communication (MAV-6047) - Updated the reporting app to read web service configuration from environment variables

Consent management

• Consolidate consent reminder emails into a single Notify template (MAV-2841) - Merged the separate programme-specific consent reminder email templates into a single Notify template
• Add "Request scheduled" / "Request not scheduled" needs consent sub-status (MAV-5882) - Added sub-statuses to the "Needs consent" status so teams can see which children are due to receive a consent request

Patient management

• Remove important notices for archived patients (MAV-3119) - Added a way to remove important notices from archived patient records
• Patient-session page redesign: add overall status card (MAV-6226) - Added an overall status card to the patient-session page summarising the patient's status at a glance

Platform & Operations improvements

• Refactor PDS-related feature flags (MAV-2354) - Tidied up the PDS-related feature flag configuration
• Enable CIS2 permissions for ops tools in production (MAV-5292) - Granted relevant Mavis team members CIS2 permissions and enabled ops tools in production
• Pin GitHub Actions to commit SHAs (MAV-5897) - Pinned third-party GitHub Actions to specific commit SHAs to reduce supply chain risk
• Restrict deploy Grafana permissions (MAV-6048) - Tightened the permissions used by the deploy-Grafana workflow
• Refactor import code (MAV-6062, MAV-6063) - Reorganised the CSV import code and its specs to improve separation of responsibilities
• Performance improvements to ImmunisationImport and PatientStatusUpdater (MAV-6234, MAV-7073) - Simplified the batching query in PatientStatusUpdater and moved patient status updates outside the ImmunisationImport transaction to reduce lock contention
• Rotate the API key for GOV.UK Notify (MAV-6545) - Rotated the GOV.UK Notify API key
• Remove routes for internal reporting API endpoints (MAV-6745) - Removed unused internal reporting API routes
• Add on_delete: cascade to some foreign key relations with Patient (MAV-7064) - Added cascading delete constraints to patient-related foreign keys (created unvalidated; will be validated in the next release)

Bug fixes

• MAV-3418: Fixed "Vaccination already had" notification not being sent for historical vaccinations more than a year old
• MAV-5915: Fixed Gillick assessments not being automatically invalidated
• MAV-6059: Fixed child consent response showing "Needs consent - No response" instead of "Needs consent - Request not scheduled" when added to an active school session with a past consent request date
• MAV-6065: Added a warning message when mismatched bundle.link parameters are detected on IMMS API search
• MAV-6067: Fixed consent display showing "Needs consent - No response" when a new child is imported with parent contact details but no active session
• MAV-6221: Fixed consent status displaying incorrectly for children with an active school move to homeschool
• MAV-6541: Fixed silent import failures when dates were provided in DD/MM/YY format
• MAV-7075: Fixed "No consent recorded" boxes in Mavis reports not adding up to the total
• MAV-7076: Fixed patient programme status not updating immediately after consent requests are sent

Full Changelog: v8.0.1...v8.1.0

v8.0.1

What's Changed

• Fix a couple of security vulnerabilities by @thomasleese in #6642

Full Changelog: v8.0.0...v8.0.1

v8.0.0

What's Changed

Enable the Mavis national reporting flow to Imms FHIR API.

v7.9.0

Full Changelog: v7.8.0...v7.9.0

Vaccination history

• Consume more information from the Imms API (MAV-5715) - Extended the data captured from the NHS Immunisation API to store additional fields such as SNOMED product codes, procedure codes, and dose sequence
• Extend and improve CarePlus export data storage (MAV-5738, MAV-5742) - Extended the automated CarePlus export tool to store export data in the database and limited recording to programmes that appear in exports

Consent responses

• Add "Do not want vaccination at school" refusal reason (MAV-5574) - Added a new refusal reason for parents who do not want their child vaccinated at school, with a follow-up question about being contacted for community clinic alternatives
• Add consent request scheduling sub-statuses (MAV-5882) - Added "Request scheduled" and "Request not scheduled" sub-statuses to the "Needs consent" status, giving teams visibility of which children are due to receive a consent request

General improvements

• Disallow access to sensitive records for PII-enabled ops tools users (MAV-3019) - Restricted ops tools users with PII access from viewing records flagged as sensitive in timeline and graph views
• Reword and extend the national reporting cut-off data banner (MAV-5301) - Updated the banner wording and changed the NIVS switch-off date to be 2 days after the team's start date
• Split vaccination counts in reporting into school and community sub-totals (MAV-5741) - Added a column to the monthly vaccinations table showing how many vaccinations were given per setting (school or community)
• Make the "vaccination administered" emails more consistent across programmes (MAV-5749) - Consolidated five programme-specific vaccination confirmation email templates into one, with minor wording corrections for MMR and MMRV dose references
• Improve content on the upload page (MAV-5893) - Renamed the "How to format your CSV" dropdown to "What your CSV file must include" and updated the content for national reporting users
• Align vaccine page designs with the prototype (MAV-5896) - Updated the vaccines list and vaccine detail pages to show manufacturer, SNOMED code, and side effects, and restyled the "Add a batch" link

Platform & Operations improvements

• Remove unused code following clinics redesign (MAV-5304, MAV-5307) - Removed legacy code that was no longer needed after the clinics rework, deferred previously to support zero-downtime migration
• Rename internal school location type (MAV-5556) - Renamed the internal generic_school location type to gias_school for clarity
• HTTP/2 migration support (MAV-5723, MAV-6045) - Configured the reporting app MAVIS_ROOT_URL via infrastructure and prepared communications for SAIS teams ahead of the HTTP protocol upgrade
• Refactor import code (MAV-6050) - Removed unused update action from import-related controllers

Bug fixes

• MAV-5903: Fixed IMMS records ingested with primary source false then true not correctly linking the duplicate record
• MAV-6051: Fixed searching for school sessions by type returning no results
• MAV-6055: Fixed duplicate vaccination records causing Imms API search jobs to fail with a unique constraint violation

v7.8.0

Vaccination recording

• Add "Record already vaccinated" button to child record page (MAV-3905) - Added a "Record already vaccinated" button on the child record page, consolidating the journey into a single route and removing duplicate options from within sessions
• Create community clinics without registration by default (MAV-5885) - Removed the unnecessary registration step when recording a vaccination at an automatically created community clinic session

FHIR Imms API

• Handle dummy values from Imms API records (MAV-4095) - Mapped dummy values from the Imms API for batch expiry date, URN and ODS code to more meaningful display values in the UI
• Only sync records to the Imms API when relevant fields have been updated (MAV-5576) - Updated Imms API sync logic to only trigger when fields relevant to the API are changed, avoiding unnecessary duplicate syncs
• Store duplicate Imms API records in a discarded state (MAV-5578) - Changed duplicate record handling to store Imms API duplicates in the database marked as discarded, rather than silently rejecting them, to support vaccination history analysis
• Add Imms API sync status for pre-integration records (MAV-5592) - Added a "Not synced" status for vaccination records created before the Imms API integration was enabled for their programme, with records syncing automatically if subsequently edited

Imports and uploads

• Automate a daily GIAS update (MAV-2788) - Added an automated daily import of school data from GIAS to keep URNs up to date across the country
• Make VACCINE_GIVEN case insensitive in vaccination imports (MAV-4632) - Updated vaccination imports to accept VACCINE_GIVEN values regardless of case, preventing unnecessary import failures
• Remove the misleading "1 minute remaining" help text (MAV-5064) - Removed the inaccurate "1 minute remaining" time estimate shown during imports

General improvements

• Add consent response actions to consent summary (MAV-5309) - Added action links (withdraw, invalidate, follow up) directly on the consent summary card, so users can manage consent responses without navigating away
• Remove SNOMED vaccine code column from manual CarePlus report (MAV-4108) - Removed the SNOMED vaccine code column from the CarePlus vaccination download report to simplify the file and avoid upload issues
• Add CLI tool to merge teams (MAV-4839) - Added a CLI tool to merge multiple teams into a single team, supporting teams that were originally set up separately but want to work as one

Platform & Operations improvements

• Remove unused code following change to how clinics work (part 2) (MAV-5306) - Removed further unused clinic-related code that is no longer needed following the v7.6.0 clinic changes
• Enable separate endpoint for dedicated HTTP communication (MAV-5747) - Added an internal HTTP/1.1 endpoint to support the migration to HTTP/2 for external traffic

Bug fixes

• MAV-5523: Fixed vaccination confirmation side effects differing between SMS, email and NHS.uk by aligning content across all communication channels
• MAV-5713: Fixed healthcare assistants seeing the "Record a new clinic vaccination" button that they do not have permission to use
• MAV-5881: Fixed the back button on the reporting download page navigating to the dashboard instead of the reports tab

Full Changelog: v7.7.0...v7.8.0

v7.7.0

Consent forms

• Follow-up discussion option for parents who refuse consent (MAV-3378, MAV-526) - Added the ability for parents to request a follow-up call from the SAIS team when refusing consent for certain reasons (gelatine, medical, personal choice, other), with reason-specific hint text, and added SAIS-side tracking and management of follow-up requests
• Add "No contact details" needs consent sub-status (MAV-5591) - Added a "Needs consent: No contact details" sub-status for children who are eligible but have no parent contact details to send consent requests to

Imports and uploads

• Paginate sections of imports pages (MAV-4109) - Added pagination to individual import review page sections (new records, changed records, school moves, close matches) to improve load times for large imports
• Accept more anatomical sites in vaccination imports (MAV-4631) - Added support for additional anatomical site values (left lower, right lower, left lower arm, right lower arm) in vaccination record imports

General improvements

• Keep new parent contact information when rejecting new child details (MAV-5711) - Changed the import issue review process to retain updated parent contact information even when new child details are rejected

Platform & Operations improvements

• Remove unused code following change to how clinics work (MAV-5305) - Removed unused clinic-related code that is no longer needed following the v7.6.0 clinic changes
• Use httpx instead of requests in reporting app (MAV-5585) - Replaced the requests library with httpx in the reporting app to support HTTP/2
• Refactor patient programme components (MAV-5586) - Refactored patient programme page components for improved code clarity with no functional changes
• Fix missing Splunk logs (MAV-5714) - Fixed Splunk logging that stopped working after the migration from Puma to Falcon by explicitly re-opening the logger after forking

Bug fixes

• MAV-2782: Fixed import page totals not updating immediately after an import completes with issues
• MAV-5722: Fixed MMR and MMRV vaccination records using incorrect Read codes in SystmOne reports

Full Changelog: v7.6.0...v7.7.0

v7.6.0

Full Changelog: v7.5.0...v7.6.0

Simplify clinics and vaccination recording

• Record a new vaccination from the child record page (MAV-3187) - Added the ability to record a vaccination directly from a child's record page, replacing the need to find children through a clinic session
• Explicit school unknown and home-schooled locations (MAV-3159) - Replaced the generic clinic location with separate "school unknown" and "home-schooled" locations, with a data migration for existing records
• Download and reupload offline spreadsheet for clinic vaccinations (MAV-3900) - Added the ability to download offline spreadsheets from unknown school, home-educated school, and invited-to-clinic views, and reupload them using a new "clinic" session ID
• Send consent request from child record page (MAV-5308) - Added a "Send consent request" button on the child record page for children who have been invited to a clinic and need consent

Notifications

• Move session and clinic invitation rendering into Mavis (MAV-4114) - Moved session reminder and clinic invitation email and text rendering from GOV.UK Notify templates into the Mavis codebase, completing the comms migration
• Store subject and body of each email and SMS sent (MAV-3934) - Added storage of the full rendered content of every sent email and SMS in the database, enabling future display of message bodies in the activity log

General improvements

• Use primary source for national reporting records (MAV-5326) - Updated national reporting to use the primary source flag when selecting vaccination records for reporting
• Prevent searching per programme for vaccination records before September 2025 (MAV-5066) - Disabled per-programme Imms API search for vaccination records dated before September 2025 to avoid incorrect vaccination status during the MMR data migration period
• Accept Imms API records whose dose sequence exceeds internal limits (MAV-4848) - Changed Imms API record imports to save records with a dose sequence exceeding Mavis's maximum with a nil dose sequence instead of failing

Bug fixes

• MAV-5056: Fixed logic for sending initial clinic invitations and subsequent reminders so only the correct action appears on the child record page
• MAV-5059: Fixed child count on the Schools page not matching the Children page count for "No known school" after archiving children
• MAV-5060: Fixed wording difference for an allergic reaction health question between the MMR/MMRV online and verbal forms and the PDF form
• MAV-5564: Fixed clinic consent request emails having unpopulated placeholders for location and date

v7.5.0

Full Changelog: v7.4.0...v7.5.0

General improvements

• Enable Imms API search in production for remaining programmes (MAV-5171) - Enabled the Imms API search feature flag in production for HPV, Td/IPV, MenACWY, MMR and MMRV programmes
• Fix reporting codes for lower position arm anatomical sites (MAV-5175) - Updated anatomical site codes in CarePlus and SystmOne reports for lower arm position vaccinations to correctly reference the upper arm/deltoid instead of the forearm
• Move triage outcomes and vaccination confirmations rendering into Mavis (MAV-4112, MAV-4113) - Moved triage outcome and vaccination confirmation email and text rendering from GOV.UK Notify templates into the Mavis codebase, continuing the comms migration
• Allow editing of school year groups (MAV-5172) - Added the ability to edit year groups for schools and school sites, reducing reliance on GIAS data which can lag behind real-world changes
• Make SAIS side of Mavis more accessible (MAV-1379) - Improved accessibility across the SAIS interface including page structure, heading hierarchy, error summaries, visually hidden link context, and unique page titles
• Update label for gelatine-related refusal reason (MAV-5296) - Updated the wording of the gelatine-related refusal reason to clarify that it reflects a parent's concern about vaccine ingredients

Platform & Operations improvements

• Improve performance of reporting totals endpoint (MAV-3406) - Improved the performance of the reporting totals endpoint to prevent timeouts with large data volumes
• Improve performance of CLI tools (MAV-5182) - Improved the performance of CLI tools by restricting the scope of PatientTeamUpdater
• Fix ActiveRecord exports for web service (MAV-5297) - Fixed ActiveRecord metrics initialisation timing so metrics are correctly collected in the web service
• Tune indices for patient search (MAV-5299) - Added database indices on patient name fields to improve search and background job performance
• MAV-5317: Fixed Falcon container crashing in HTTPS mode due to directory write restrictions in ECS

Bug fixes

• MAV-5054: Fixed race condition causing 422 errors when syncing MMR vaccination records to the Imms FHIR API
• MAV-5057: Fixed MMR and MMRV PDF consent forms missing the blood/plasma transfusion health question
• MAV-5303: Fixed superfluous extra lines appearing in consent request and reminder emails for single-date sessions and Year 8 HPV cohorts

v7.4.0

Full Changelog: v7.3.0...v7.4.0

Vaccination reporting

• Code and CLI tool to generate new type of CarePlus report (MAV-4626) - Added a new automated CarePlus report format with required fields and a CLI tool for testing report generation
• Show a banner for national reporting users explaining the cut-off date (MAV-3867) - Added a banner on the national reporting uploads page to inform users about the reporting cut-off date

General improvements

• Remove review screen feature flag and redundant code (MAV-3066) - Removed the import review screen feature flag and associated redundant code, making the review screen permanently enabled
• Move consent requests and reminders rendering into Mavis (MAV-4111) - Moved consent request and reminder email and text rendering from GOV.UK Notify templates into the Mavis codebase, continuing the comms migration
• Change homepage and navigation for support team (MAV-4847) - Updated the homepage and navigation for support team users to restrict access to ops tools only
• Fix MMR status computation with mixed performed_at types (MAV-5061) - Fixed MMR vaccination status being incorrectly computed when vaccination records had mixed Date and TimeWithZone performed_at types
• Remove vaccination_record_organisation source from PatientTeam (MAV-5067) - Removed the now-obsolete vaccination_record_organisation source from patient-team relationships as a cleanup following the earlier PatientTeamUpdater change

Platform & Operations improvements

• Revert CITEXT column type (MAV-5183) - Reverted the case-insensitive column type change for patient names that was causing patient similarity searches to be significantly slower
• Export ActiveRecord metrics (MAV-5185) - Added export of ActiveRecord metrics for improved database monitoring
• Persist scaled web service in production (MAV-5187) - Persisted the scaled web service configuration in production
• MAV-5188: Fixed connection timeouts for users caused by database connection pool exhaustion

Bug fixes

• MAV-1189: Fixed error when creating a patient from a consent form where a patient with the same NHS number already exists in the service
• MAV-3896: Fixed users being able to attempt recording a 2nd dose of MMRV without first marking the child as attending
• MAV-4094: Fixed historical vaccination uploads showing in the activity log on the vaccination date instead of the upload date

Post-release tasks

PR #6219:

• Change the support team to be of type support instead of point_of_care.

v7.3.0

Full Changelog: v7.2.0...v7.3.0

Vaccination reporting

• Add CarePlus report model for traceability and link to vaccination records (MAV-4625) - Added a new database model to support automated CarePlus reporting, storing report details such as academic year, programme type, and reporting period
• Update CarePlus MenACWY vaccine code (MAV-4105) - Updated the vaccine code used for MenACWY in CarePlus reports
• Add LA list to regional reports (MAV-4628) - Added a list of local authorities to regional reports

General improvements

• Consent PDF form for MMRV (MAV-2847) - Added a downloadable PDF consent form for MMRV sessions, distinct from the existing MMR form
• Send clinic invitations to home-schooled and school unknown children (MAV-3428, MAV-3886) - Added a new page for manually sending clinic invitations to children with no known school or who are home-schooled, with a count of children due vaccination who have not yet been invited
• Move consent confirmation rendering into Mavis (MAV-3933) - Moved consent confirmation email and text rendering from GOV.UK Notify templates into the Mavis codebase, continuing the comms migration started in v7.1.0
• Update status colours (MAV-4422) - Updated status tag and session overview colours across the application for improved consistency
• Improve vaccination record import duplication validation error message (MAV-4827) - Improved the error message shown when duplicate rows are detected during vaccination record imports
• Add purpose column to notification log entries (MAV-4087) - Added a purpose column to notification log entries to categorise outbound emails and SMS by type, with a backfill data migration for existing records

Platform & Operations improvements

• Automate post-deployment steps (MAV-4101) - Added automation for post-deployment feature flag and data migration steps
• Improve patient lookup performance (MAV-3435) - Improved the performance of patient search and lookup queries
• Replace Thruster/Puma with Falcon (MAV-3446) - Replaced the Thruster/Puma web server with Falcon for improved performance
• Speed up deployments to test environments (MAV-3850) - Reduced deployment times for test environments
• MAV-3307: Fixed BulkRemoveParentRelationshipsJob not being throttled

Bug fixes

• MAV-3892: Fixed the "Send manual reminders" button on clinic sessions not doing anything when clicked
• MAV-3947: Fixed dose sequence not being visible or editable for vaccination records created before the dose sequence change
• MAV-3950: Fixed vaccination records without a vaccine brand breaking report downloads
• MAV-4629: Fixed the new "invited to clinic" filter being missing from the Children page