2602 release notes

docs/overview/release-notes.md

@@ -6,12 +6,49 @@ description: >-
 
 # Release Notes
 
-## February 2026 _`edge`_
+## March 2026 _`edge`_
+
+## February 2026 _`latest, 2602`_
 
 * Aidbox FHIR server
+
+  __Features__
+  * Integration with **External Vault** for managing secrets. See [full documentation](../configuration/secret-files.md) for details.
+  * Added [Amazon SNS](../tutorials/subscriptions-tutorials/aidboxtopicsubscription-sns-tutorial.md) as an AidboxTopicDestination.
+  * Added `$purge` operation for Patient compartment cleanup. See [full documentation](../api/bulk-api/purge.md) for details.
+  * SQL migrations via init bundle are now supported. See [full documentation](../tutorials/other-tutorials/how-to-run-sql-via-init-bundle.md) for details.
+  * Published **Aidbox IGs** — FHIR StructureDefinitions for Aidbox custom resources are now available as [packages](../artifact-registry/artifact-registry-overview.md).
+  * Configurable `cache_ttl` for [TokenIntrospector](../access-control/authentication/token-introspector.md).
+  * Configurable [JDBC application name](../reference/all-settings.md#db.application-name) for `pg_stat_activity` visibility.
+  * Enhanced [`_explain`](../api/rest-api/aidbox-search.md#_explain) parameter with PostgreSQL EXPLAIN options (analyze, buffers, verbose, etc.).
   * Aidbox now **validates JWT auth keys at startup** and will refuse to start if `BOX_SECURITY_AUTH_KEYS_PRIVATE` / `BOX_SECURITY_AUTH_KEYS_PUBLIC` are misconfigured — whether one key is missing, the PEM format is malformed, or the keypair doesn't match. Previously, these errors were only detected at runtime during authentication flows. See [key format requirements](../configuration/configure-aidbox-and-multibox.md#key-format-requirements) for details.
 
-## January 2026 _`latest, 2601`_
+  __Bug fixes and improvements__
+  * Fixed GCP and Azure URL signing for [`$export`](../api/bulk-api/export.md) operations.
+  * Fixed [BALP](../access-control/audit-and-logging.md) audit profiles for Patient resource.
+  * Fixed JWKS endpoint for EC keys.
+  * Fixed scope handling in `client_credentials` grant with `client_secret`.
+  * Fixed CORS headers for streaming responses.
+  * Fixed [package loading](../artifact-registry/artifact-registry-overview.md) when canonical URL clashes exist between packages.
+  * Fixed search input reset in Resource Browser after resource deletion.
+  * Fixed search parameters for recursive fields.
+  * Fixed [OrgBac](../access-control/authorization/scoped-api/organization-based-hierarchical-access-control.md) operation definitions.
+  * Invalidated caches across all replicas after [package install via UI](../tutorials/artifact-registry-tutorials/upload-fhir-implementation-guide/aidbox-ui/README.md).
+  * Optimized FHIR bundle processing with [TokenIntrospector](../access-control/authentication/token-introspector.md) authentication.
+  * Optimized [transaction bundle](../api/rest-api/bundle.md) processing by disabling unnecessary operation resolution.
+  * Added support for [`BOX_FHIR_SEARCH_CHAIN_SUBSELECT`](../reference/all-settings.md#fhir.search.chain.subselect) setting for [Search resource](../api/rest-api/aidbox-search.md#search-resource).
+  * Fixed FHIR validation:
+    - Min cardinality for required fields.
+    - Primitive extension with choice type.
+    - Reference validation when the same reference appears multiple times in the same resource.
+
+  __Removals__
+  * Removed deprecated ZEN Topic-Based Subscription implementation. Use [FHIR Topic-Based Subscriptions](../modules/topic-based-subscriptions/fhir-topic-based-subscriptions.md) instead.
+
+* Minor updates
+  * Fixed critical vulnerability CVE-2025-15467 in libcrypto3, libssl3, openssl for versions: 2601.1, 2512.3, 2511.4, 2510.4, 2509.4, 2508.4, 2507.5, 2506.3, 2505.5, 2504.4, 2503.7.
+
+## January 2026 _`stable, 2601`_
 
 * Aidbox FHIR server
   * Improved support for [FHIR Topic-based subscriptions](../modules/topic-based-subscriptions/fhir-topic-based-subscriptions.md).