From b8adfdfc84eb652bcc1a7d761b3189903797a20b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 10 Feb 2026 11:15:21 -0500 Subject: [PATCH] chore(deps): bump lodash-es from 4.17.21 to 4.17.23 - OHIF-2441 (#5736) * fix(security): Moved react-color dependency to default extension because it is only used there. Addressed CVE-2025-13465 by adding lodash-es as a resolution. --------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Joe Boccanfuso --- bun.lock | 7 +++---- extensions/cornerstone-dicom-pmap/package.json | 3 +-- extensions/cornerstone-dicom-rt/package.json | 3 +-- extensions/cornerstone-dicom-seg/package.json | 3 +-- extensions/default/package.json | 3 ++- package.json | 3 ++- yarn.lock | 8 ++++---- 7 files changed, 14 insertions(+), 16 deletions(-) diff --git a/bun.lock b/bun.lock index 288f3d772..f2d3a4049 100644 --- a/bun.lock +++ b/bun.lock @@ -190,7 +190,6 @@ "@cornerstonejs/adapters": "4.15.29", "@cornerstonejs/core": "4.15.29", "@kitware/vtk.js": "34.15.1", - "react-color": "2.19.3", }, "peerDependencies": { "@ohif/core": "3.13.0-beta.4", @@ -210,7 +209,6 @@ "version": "3.13.0-beta.4", "dependencies": { "@babel/runtime": "7.28.2", - "react-color": "2.19.3", }, "peerDependencies": { "@ohif/core": "3.13.0-beta.4", @@ -233,7 +231,6 @@ "@cornerstonejs/adapters": "4.15.29", "@cornerstonejs/core": "4.15.29", "@kitware/vtk.js": "34.15.1", - "react-color": "2.19.3", }, "peerDependencies": { "@ohif/core": "3.13.0-beta.4", @@ -300,6 +297,7 @@ "@cornerstonejs/calculate-suv": "1.1.0", "lodash.get": "4.4.2", "lodash.uniqby": "4.7.0", + "react-color": "2.19.3", }, "peerDependencies": { "@ohif/core": "3.13.0-beta.4", @@ -979,6 +977,7 @@ "dcmjs": "0.49.4", "glob-parent": "6.0.2", "lodash": "4.17.23", + "lodash-es": "4.17.23", "node-forge": "1.3.2", "nth-check": "2.1.1", "package-json": "8.1.1", @@ -3696,7 +3695,7 @@ "lodash": ["lodash@4.17.23", "", {}, "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w=="], - "lodash-es": ["lodash-es@4.17.21", "", {}, "sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw=="], + "lodash-es": ["lodash-es@4.17.23", "", {}, "sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg=="], "lodash.clonedeep": ["lodash.clonedeep@4.5.0", "", {}, "sha512-H5ZhCF25riFd9uB5UCkVKo61m3S/xZk1x4wA6yp/L3RFP6Z/eHH1ymQcGLo7J3GMPfm0V/7m1tryHuGVxpqEBQ=="], diff --git a/extensions/cornerstone-dicom-pmap/package.json b/extensions/cornerstone-dicom-pmap/package.json index 9b32fd93f..4bb8e8d73 100644 --- a/extensions/cornerstone-dicom-pmap/package.json +++ b/extensions/cornerstone-dicom-pmap/package.json @@ -48,7 +48,6 @@ "@babel/runtime": "7.28.2", "@cornerstonejs/adapters": "4.15.29", "@cornerstonejs/core": "4.15.29", - "@kitware/vtk.js": "34.15.1", - "react-color": "2.19.3" + "@kitware/vtk.js": "34.15.1" } } diff --git a/extensions/cornerstone-dicom-rt/package.json b/extensions/cornerstone-dicom-rt/package.json index d209d60f3..72fedbeb3 100644 --- a/extensions/cornerstone-dicom-rt/package.json +++ b/extensions/cornerstone-dicom-rt/package.json @@ -45,7 +45,6 @@ "react-router-dom": "6.30.3" }, "dependencies": { - "@babel/runtime": "7.28.2", - "react-color": "2.19.3" + "@babel/runtime": "7.28.2" } } diff --git a/extensions/cornerstone-dicom-seg/package.json b/extensions/cornerstone-dicom-seg/package.json index 3504d17f6..6cd09153e 100644 --- a/extensions/cornerstone-dicom-seg/package.json +++ b/extensions/cornerstone-dicom-seg/package.json @@ -48,7 +48,6 @@ "@babel/runtime": "7.28.2", "@cornerstonejs/adapters": "4.15.29", "@cornerstonejs/core": "4.15.29", - "@kitware/vtk.js": "34.15.1", - "react-color": "2.19.3" + "@kitware/vtk.js": "34.15.1" } } diff --git a/extensions/default/package.json b/extensions/default/package.json index 69120659a..7169bdd48 100644 --- a/extensions/default/package.json +++ b/extensions/default/package.json @@ -50,6 +50,7 @@ "@babel/runtime": "7.28.2", "@cornerstonejs/calculate-suv": "1.1.0", "lodash.get": "4.4.2", - "lodash.uniqby": "4.7.0" + "lodash.uniqby": "4.7.0", + "react-color": "2.19.3" } } diff --git a/package.json b/package.json index 449fd700d..1003434fa 100644 --- a/package.json +++ b/package.json @@ -155,7 +155,8 @@ "@cornerstonejs/codec-openjpeg": "1.3.0", "node-forge": "1.3.2", "qs": "6.14.1", - "lodash": "4.17.23" + "lodash": "4.17.23", + "lodash-es": "4.17.23" }, "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e" } diff --git a/yarn.lock b/yarn.lock index 64f39e133..7e6253953 100644 --- a/yarn.lock +++ b/yarn.lock @@ -12174,10 +12174,10 @@ locize-lastused@1.1.1: resolved "https://registry.yarnpkg.com/locize-lastused/-/locize-lastused-1.1.1.tgz#ca83a7386dcd74ee0cae07c8ef579cb24f345b9b" integrity sha512-zq310En1BWRRjWaYdTScUwCWUcvLJuOUqFpN5LBQoCccWg9CQB5gDg/D+b8YjR2GkofRGy08C+4LGpqcGqfkHA== -lodash-es@^4.17.15: - version "4.17.21" - resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.17.21.tgz#43e626c46e6591b7750beb2b50117390c609e3ee" - integrity sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw== +lodash-es@4.17.23, lodash-es@^4.17.15: + version "4.17.23" + resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.17.23.tgz#58c4360fd1b5d33afc6c0bbd3d1149349b1138e0" + integrity sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg== lodash.clonedeep@4.5.0, lodash.clonedeep@^4.5.0: version "4.5.0"