Commit Graph
310 Commits
Author SHA1 Message Date
ohif-bot da9fd9057d chore(version): Update package versions to 3.13.0-beta.92 [skip ci] 2026-06-13 01:01:06 +00:00
ohif-bot a219822ad1 chore(version): Update package versions to 3.13.0-beta.91 [skip ci] 2026-06-13 00:10:16 +00:00
ohif-bot a64fceb009 chore(version): Update package versions to 3.13.0-beta.90 [skip ci] 2026-06-12 20:08:30 +00:00
f1cc2ee13a feat: Update to use pnpm (#6031)
* Initial pnpm change

* Install/update in pnpm sort of works

* Attempt to fix install

* fix pnpm

* Refactor build process to use RSPack instead of Webpack across multiple extensions and modes. Update package.json scripts for development and production builds, and adjust webpack configuration files to accommodate new plugin imports and settings.

* Update RSPack dependencies to version 2.0.0 across the project, enhancing compatibility and performance. Refactor webpack configuration in multiple extensions and modes to utilize the new library structure for UMD output. Adjust package.json scripts and settings for improved build processes.

* Implement migration guide for OHIF 3.13, detailing the transition from Webpack to Rspack v2, the shift to pnpm workspaces, and the increase in minimum Node.js version to 24. Include new build commands, plugin replacements, and updates to package configurations across the monorepo.

* Fix some dev:fast bugs

* Move netlify to top level and remove webpack builds

* Update version script to deal with lerna missing

* chore(tests): Update multiple screenshot test images for various specs

* feat(screenshot-reviewer): Add screenshot review tool and update package.json scripts

* fix(DICOMSRDisplayTool): Improve actor presence check in viewport

* chore(tests): Update multiple screenshot assets for various specs

* chore(tests): Integrate waitForPaintToSettle and waitForViewportsRendered in multiple specs for improved rendering stability

* chore(tests): Update screenshot assets for SEGHydration and SEGNoHydration specs

* test: update progressive loading screenshots

* jest 30 test fixes for compatibility with pnpm cs3d

* Use correct setDisplaySets instead of setDataId

* fix: Naming change for LegacyVolumeViewport3D

* Update to allow tolerance for contour tests

* update

* fix

* refactor: Replace instanceof checks with utility functions for viewport type validation

* fix: Update createSegmentationForViewport to handle undefined displaySetInstanceUID gracefully

* bun lock

* chore(pnpm): align workspace setup to cornerstone3D and address PR review

- .npmrc / pnpm-workspace.yaml: mirror cs3d (node-linker hoisted,
  strict-peer-dependencies=false, link/prefer workspace packages,
  minimumReleaseAge, frozenLockfile); sync axios 1.17.0 + tmp override
- root: packageManager pnpm@11.4.0, engines pnpm >=11, wire preinstall.js
- restore preinstall.js (token/private-repo + CLAUDE->AGENTS symlink)
- playwright.yml: keep base CS3D-integration workflow, switch only the
  package manager (bun/yarn -> pnpm) and node 20 -> 24
- webpack.base.js: revert prod devtool to source-map (drop hidden-source-map)
- remove @percy/cypress; .netlify + cli templates engines pnpm >=11
- Dockerfile pin pnpm@11; document tests/globalSetup.ts warmup
- drop dicom-sr -> measurement-tracking edge (breaks pnpm cyclic dep)

* chore(pnpm): regenerate lockfile and restore cs3d:* dev scripts

- Regenerate pnpm-lock.yaml against the resolved workspace (cycle removed,
  cs3d 4.22.10, workspace:* internal deps).
- Restore cs3d:checkout/check/build/watch/install/link/unlink helper scripts
  (dropped when taking the PR's root scripts), converted yarn -> pnpm since
  the local cornerstone3D checkout is now pnpm too.

* Merge base branch issues

* Link ohif app

* ci: pin pnpm to 11.4.0 in action-setup (was version: latest)

version: latest floats across runs and breaks reproducibility. Pin to the repo's packageManager version (pnpm@11.4.0) in both playwright and build-docs workflows.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: Accidental commit of .npmrc config

* Fix build issues

* build fix

* Dependency fixes

* fix: Dependency bug in app on extensions/modes

* Fix output configuration

* Replace percy screenshots with native cypress

* Remove percy screenshot entirely

* fix: Build issues

* force click to prevent canvas cover issues

* Enable swiftshader

* Update launch of electron

* fix: Broken size calculation

* Empty change to force a re-build

* fix(cypress): generate ui-next tailwind classes; drop unsupported electron arg

Tailwind only scanned @ohif/ui-next via ../../node_modules/@ohif/ui-next, which no longer resolves under the pnpm layout, so ui-next-unique classes (e.g. toolbar split-button sizing) were never generated. Those buttons' hit-boxes collapsed, producing Cypress 'covered by element' failures on toolbar interactions. Scan ui-next by direct filesystem path like ui/extensions/modes.

Also stop pushing --enable-unsafe-swiftshader into Electron's launchOptions.args (Electron ignores it and warns); it is supplied via ELECTRON_EXTRA_LAUNCH_ARGS in CI. The arg is still pushed for non-electron chromium (local chrome).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(e2e): disable dev-server overlay during coverage runs

The rspack dev-server client overlay injects an iframe (id=rspack-dev-server-client-overlay) that intercepts pointer events, causing Playwright/Cypress clicks on toolbar buttons to time out (e.g. MicroscopyPanel). Disable the overlay when COVERAGE=true (e2e/Playwright webServer) while keeping it for normal local dev.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(microscopy): provide dicom-microscopy-viewer runtime assets

The microscopy viewer is loaded at runtime via peerImport('dicom-microscopy-viewer'), which fetches the copied asset served at /dicom-microscopy-viewer/. Two issues prevented those assets from reaching dist, so the viewer never initialized and drawing produced no measurement row:

1) dicom-microscopy-viewer was declared in no workspace package.json (only under libs/@cornerstonejs), so it was not installed at root node_modules and the pluginConfig copy source did not exist. Declare it (0.48.6, matching libs) in the microscopy extension.

2) createCopyPluginToDist appended the public/dist folder name to entries that specify an explicit directory, breaking the dicom-microscopy-viewer public entry (looked for .../dynamic-import/public). Use an explicit directory as-is; only append the folder name for package-derived entries.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Update to pnpm 11.5.2 and cs3d 5.0.2

* Lock file

* fix: Update to newer versions of actions to try to fix hang

* Remove unnecessary version

* fix: Tests that are flaky

* PR comments

* Incorrect run name

* docs: Explain pluginConfig tooling

* Updated notes on pluginConfig and PR comments

* fix: resolve plugins in rsbuild build and fix directory-based asset copy

rsbuild.config.ts: merge getPluginResolveAliases() and an @ohif/app$ alias into resolve.alias, and add resolve.modules (root, platform/app, platform/ui node_modules) so extensions resolve their shared @ohif/* imports. Brings the rsbuild (dev:fast) path to parity with webpack.pwa.js / webpack.base.js.

writePluginImportsFile.js: treat a 'directory' on an extension/mode entry as the package root and copy its public/ and dist/ subdirs instead of the whole directory; public-section entries keep copying their directory verbatim via a new literalDirectory flag.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor: share resolve alias/modules between webpack and rsbuild configs

Extract the resolve.alias (@ohif/app, @, @components, ...) and the node_modules search paths into .webpack/resolveConfig.js, the single source of truth consumed by both webpack.base.js (and every per-package webpack.prod/.dev.js that merges it) and rsbuild.config.ts. getModules(srcDir) appends the building package's own source root, preserving the previous per-package behavior. Ends the drift where the rsbuild path kept missing aliases/module paths that webpack.base.js already had.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Add a timeout on git fetch and avoid all the unnecessary mirrros

* PR comments and tests

* Remove cache to prevent corrupting the cache key/setup.

* Fix stale/corrupted pnpm installer

---------

Co-authored-by: Alireza <ar.sedghi@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-12 16:04:56 -04:00
AlirezaandBill Wallace 6dd150d401 fix: ohif tests to run with cornerstone 3d 5.0 (#6043)
* chore(tests): Update multiple screenshot test images for various specs

* feat(screenshot-reviewer): Add screenshot review tool and update package.json scripts

* fix(DICOMSRDisplayTool): Improve actor presence check in viewport

* chore(tests): Update multiple screenshot assets for various specs

* chore(tests): Integrate waitForPaintToSettle and waitForViewportsRendered in multiple specs for improved rendering stability

* chore(tests): Update screenshot assets for SEGHydration and SEGNoHydration specs

* test: update progressive loading screenshots

* jest 30 test fixes for compatibility with pnpm cs3d

* Use correct setDisplaySets instead of setDataId

* fix: Naming change for LegacyVolumeViewport3D

* Update to allow tolerance for contour tests

* update

* fix

* refactor: Replace instanceof checks with utility functions for viewport type validation

* fix: Update createSegmentationForViewport to handle undefined displaySetInstanceUID gracefully

* bun lock

* fix: Install cs3d with pnpm instead of bun

* Update node version for playwright

* Update to v5.0.0 of cs3d

* fix: Build dependency

* audit

* Change to a web await retry assert

* Fix timing related test failures

* fix: Freehand close

---------

Co-authored-by: Bill Wallace <wayfarer3130@gmail.com>
2026-06-09 20:25:14 -04:00
Joe Boccanfuso 99c6154343 fix(security): Patch axios vulnerabilities. (#6063) 2026-06-05 08:46:09 -04:00
Joe Boccanfuso 9396e01107 chore: Fix netlify deploy by updating various @babel dependencies. (#6049) 2026-05-28 20:08:43 -04:00
Joe Boccanfuso ff3e855809 chore: Fix netlify deploy. (#6047) 2026-05-28 14:57:52 -04:00
Joe Boccanfuso bdcafc12de fix(security): Add tmp as a resolution to fix security vulnerability. (#6044) 2026-05-27 10:38:45 -04:00
Joe Boccanfuso 55b46f39c6 fix(security): Update various dependencies to fix security vulnerabilities. (#6023) 2026-05-15 15:07:13 -04:00
Joe Boccanfuso 5e624f1387 fix(security): Patch axios security vulnerabilities. (#5998)
Patch axios security vulnerabilities.
2026-05-06 13:49:13 -04:00
Joe Boccanfuso 1fc97fea43 fix(security): Patch protobufjs for CVE-2026-41242. (#5974) 2026-04-23 13:45:09 -04:00
Bill Wallace f6bbd5c779 fix: A couple of changes to enable cs3d integration build (#5944)
* fix: A couple of changes to enable cs3d integration build

* Bun update

* fix: Crosshairs tests due to order changes

* Fix a race in DicomTagBrowser.spec.ts and update the comparison for the screenshot for seg hydration.

* Fix sorting issues by using consistent sort

* fix: Inconsistency in scoord loader.  Will need an update to screenshot

* Fix crosshairs stability issues and random order issues in Scoord

* Update the comparison image

* Update navigate image

* fix: Axios issue

* Update to current CS3D
2026-04-10 16:51:37 -04:00
Joe Boccanfuso 5358a3985a fix(security): update dependencies to fix security vulnerabilities (#5936) 2026-04-02 18:06:19 -04:00
Bill Wallace 1df671e9ab feat: Add combined build (#5895)
* Add combined build

* Link script location update

* Security and validation fixes

* Allow specifying target path in PR description

* fix: Version match

* Fix build detection issue

* fix: Playwright deploy

* Separate out the branch merge guard

* Update docs and link info

* test: Update the layout change to wait for network idle

* Move audit late so the rest of the build can be worked on

* Add text with network check to ensure we see this change is updated

* Attempt to fix the mpr loading on ohif-downstream

* PR review comments

* Update docs

* Update to CS3D 4.20.0

* PR comments

* Add log on ohif-integration builds

* Update build test

* Removed unused space to kickoff build
2026-03-17 07:52:17 -04:00
Joe Boccanfuso d8d376edaf fix(security): Bump flattened version to address CVE-2026-32141. (#5897) 2026-03-13 15:25:21 -04:00
Joe Boccanfuso d015b2e32a fix(security): Bump tar version to address CVE-2026-31802. (#5893) 2026-03-11 20:53:17 -04:00
Joe Boccanfuso 61a1fccd7d fix(security): Bump svgo and tar to fix vulnerabilities. (#5877) 2026-03-05 15:09:05 -05:00
Joe Boccanfuso be8e266a80 fix(security): Address various security vulnerabilities. (#5869) 2026-03-04 12:23:49 -05:00
Bill WallaceandJoe Boccanfuso 5370b9382e fix: Update CS3D 4.18.2 (#5837)
* Update CS3D 4.17.4

* fix: Update to cs3d 4.18.2

* audit issues

* audit fixes

* fix: redos issue

* Simplify dependencies to fix audit alerts.

---------

Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com>
2026-02-26 09:49:44 -05:00
Joe Boccanfuso 27229609cd fix(security): CVE-2026-27212 patched. Various dependency updates as a result of CVE-2026-26996. (#5830)
fix(security):  CVE-2026-27212 patched.
Various dependency updates as a result of CVE-2026-26996.
Ultimately CVE-2026-26996 was ignored because it is only exposed in itk-wasm via CLI and OHIF's other use of minimatch is limited to build/dev environments.
2026-02-20 17:25:06 -05:00
Joe Boccanfuso 3d59c0d9d3 fix(security): Bump tar to 7.5.9 and lerna to 9.0.4 to fix CVE-2026-26960. (#5824)
* fix(security): Bump tar to 7.5.9 and lerna to 9.0.4 to fix CVE-2026-26960.
Bump sharp to 0.34.5 to fix tar-fs vulnerabilities.

* Update node version to 20.19.0 in circleci config. Needed for lerna and cypress tests.

* Now installing bun for cypress tests in circleci config.

* Use node version 20.19.0 in netlify config.
2026-02-18 16:46:02 -05:00
dependabot[bot]andJoe Boccanfuso f590fc05a8 chore(deps): bump webpack from 5.95.0 to 5.105.0 (#5795)
---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com>
2026-02-13 07:03:10 -05:00
dependabot[bot]andJoe Boccanfuso 4e9b5c2e22 chore(deps): bump diff from 4.0.2 to 4.0.4 - OHIF-2449 (#5731)
* fix(security): Use resolution for diff package to patch CVE-2026-24001.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com>
2026-02-11 08:24:34 -05:00
dependabot[bot]andJoe Boccanfuso b8adfdfc84 chore(deps): bump lodash-es from 4.17.21 to 4.17.23 - OHIF-2441 (#5736)
* fix(security): Moved react-color dependency to default extension because it is only used there.
Addressed CVE-2025-13465 by adding lodash-es as a resolution.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com>
2026-02-10 11:15:21 -05:00
dependabot[bot]andJoe Boccanfuso 02f99d5638 chore(deps): bump lodash from 4.17.21 to 4.17.23 - OHIF-2438 (#5744)
* fix(security): Update lodash to 4.17.23 using a resolution.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com>
2026-02-10 10:04:20 -05:00
Joe Boccanfuso 94c9e162f3 fix(security): Use a resolution for axios to address CVE-2026-25639. (#5793) 2026-02-09 16:43:50 -05:00
Bill Wallace 48f2f6fb13 fix(HistoryMemo): Segmentation delete wasn't remembered (#5775)
Will address a few more comments in a separate PR released after this one into 3.13

* fix(HistoryMemo): Segmentation delete wasn't remembered

* Temporary add of package.json linking

* fix: Use newer dcmjs version and delete segmentation with history cs3d
2026-02-05 11:49:49 -05:00
Joe BoccanfusoandBill Wallace 06612fe177 fix(TMTV): Consider blend mode when adding segmentation representations. OHIF-2416, OHIF-2369 (#5735)
* Updated screenshots for failing tests due to FOV improvements.

---------

Co-authored-by: Bill Wallace <wayfarer3130@gmail.com>
2026-01-27 08:47:29 -05:00
Joe Boccanfuso ca364a3af7 fix(security): update qs package to fix vulnerability CVE-2025-15284 (#5686)
fixes: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
2026-01-05 12:23:34 -05:00
dependabot[bot]andJoe Boccanfuso 6d6ce0ddae chore(deps): bump mdast-util-to-hast from 13.2.0 to 13.2.1 in /platform/docs (#5602)
* Fix node-forge security alerts as well.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com>
2025-12-02 09:08:43 -05:00
Bill Wallace 57205703bb Fix contour annotations RTSS saving (#5545)
* [WIP] Fix contour annotations RTSS saving

* fix: Export image sop image reference provider

* Fixes for download with filename

* Updates to fix metadata issues with CS3D

* Updates to save menu

* Fixing some additional re-save metadata

* Add support for saving with predecessor image sequence

* PR comment fixes

* fix: Load RTSS after save

* fix segmentation save

* fix load of mixed seg/rt studies

* Use frame module to get information on the frame shown

* Fix study browser to use instances.length when numImageFrames not present

* fix: Load of display set split from multiple non-FOR referenes

* Fix RT and SEG applying to wrong series because of using
referenced series sequence without checkout sop instances

* Fix save seg

* Update to released CS3D versions

* test: Add revokeObjectURL to test download blob

* Add hard dependency on mode-basic to fix build order issues

* fix: build

* Try to fix build segmentation

* PR comments

* PR comment update
2025-11-21 13:07:26 -05:00
dependabot[bot]andJoe Boccanfuso 62797acd9a chore(deps): bump glob from 10.4.5 to 10.5.0 (#5572)
Ignore CVE-2025-64756 (aka GHSA-5j98-mcp5-4vw2) in bun audit.

Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com>
2025-11-19 08:43:58 -05:00
Joe Boccanfuso 000e42e9a6 fix(security): Exact versioning and docs dependabot alerts (#5536) 2025-10-30 16:04:19 -04:00
Joe Boccanfuso 1f11c83006 fix(security): Addressed dependabot alert CVE-2025-59288 concerning playwright (#5527) 2025-10-27 15:16:43 -04:00
Joe Boccanfuso 1009c60911 fix(security): For bun, enforce frozen lockfile. For yarn, strongly suggest using frozen lockfile. (#5508)
* Updated docs for security information.
2025-10-24 16:48:35 -04:00
Ibrahim a1544432db feat(jpeg2000): Add 16-bit RGB support to JPEG2000 decoder (#5519) 2025-10-23 09:11:54 -04:00
Joe Boccanfuso c7d2017f08 fix(security): Use exact versioning for dependencies in package.json files. (#5494)
Added bun audit security check in build process.
Removed bun caching.
2025-10-14 16:23:36 -04:00
Bill WallaceandIbrahim 9ad0d7fc8c feat: Add inherit from basic/longitudinal modes (#5435)
Co-authored-by: Ibrahim <ibrahim.mdev@gmail.com>
2025-10-01 14:31:26 -04:00
Vinícius Alves de Faria Resende 12ac509c40 test(SegmentationService): Adding 98.63% of test line coverage to Segmentation Service through unit tests (#5421) 2025-09-30 13:49:13 -04:00
Joe Boccanfuso 80f314a422 fix(security): Removed dependency on tar-fs by removing dependencies on storybook and sharp. (#5438) 2025-09-28 22:28:06 -04:00
Joe Boccanfuso d41eca4ed5 chore(deps): update cornerstone to 4.3.10 (#5436) 2025-09-26 10:04:30 -04:00
dependabot[bot]andJoe Boccanfuso 06073af035 chore(deps): bump axios from 1.11.0 to 1.12.0 (#5412)
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com>
2025-09-17 12:02:33 -04:00
Pedro KöhlerandBill Wallace 735405a855 feat: add support to scoord3d (#5016)
Co-authored-by: Bill Wallace <wayfarer3130@gmail.com>
2025-07-31 00:21:26 -04:00
76a2b90c17 chore(deps): bump form-data from 4.0.3 to 4.0.4 (#5244)
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com>
Co-authored-by: Joe Boccanfuso <109477394+jbocce@users.noreply.github.com>
2025-07-22 13:30:29 -04:00
Joe Boccanfuso e0289dc49f fix(segmentation): Removed LOAD/hydrate button for segmentation overlays (#5214) 2025-07-15 09:02:36 -04:00
Vinícius Alves de Faria Resende 4a59126dd9 fix(UnitTests): Fixing "Cannot find module @cornerstonejs/core" error while running unit tests (#5148) 2025-07-11 16:36:49 -04:00
Ibrahim 10d93161b4 feat(rendering): Introduce WebGLContextPool for parallel rendering in ContextPoolRenderingEngine (#5196) 2025-07-11 12:33:24 -04:00
Joe Boccanfuso eeaf49c61a fix(security): Patch for Babel vulnerability (#5193) 2025-07-11 09:43:56 -04:00
Dan Rukasandsedghi 04ab79f8fb ui(feat): Adds light/dark mode support for viewport overlay text and markers (#5041)
Co-authored-by: sedghi <ar.sedghi@gmail.com>
2025-05-15 17:12:53 -04:00