chore(version): Update package versions [skip ci]

Skip the peer-dep commit when nothing is staged and skip the lerna
version step when the workspace is already at the target version.
Allows the release pipeline to be re-triggered after a partial run.

.circleci/config.yml

@@ -6,7 +6,7 @@ orbs:
 
 defaults: &defaults
   docker:
-    - image: cimg/node:20.18.1
+    - image: cimg/node:20.19.0
       environment:
         TERM: xterm
         QUICK_BUILD: true
@@ -112,19 +112,31 @@ jobs:
       - checkout
       - attach_workspace:
           at: ~/repo
-      # SECURITY AUDIT
+      # SECURITY AUDIT - only when bun.lock has changed
       - run:
           name: 'Security Audit - High Risk Vulnerabilities'
           command: |
-            echo "🔍 Running bun audit for security vulnerabilities..."
+            git fetch origin master 2>/dev/null || true
+            BASE_REF=$(git merge-base HEAD origin/master 2>/dev/null)
+            if [[ -z "$BASE_REF" ]]; then
+              echo "Could not determine base ref (e.g. shallow clone or no origin/master), skipping security audit."
+              exit 0
+            fi
+            CHANGED_FILES=$(git diff --name-only origin/master...HEAD 2>/dev/null || echo "")
+            if ! echo "$CHANGED_FILES" | grep -qx 'bun.lock'; then
+              echo "⏭️ bun.lock unchanged - skipping security audit."
+              exit 0
+            fi
+            echo "🔍 bun.lock changed - running bun audit for security vulnerabilities..."
             echo "Checking for HIGH-RISK vulnerabilities..."
 
             # Define ignored vulnerabilities with comments
             IGNORED_VULNS=(
-              "GHSA-5j98-mcp5-4vw2"  # CVE-2025-64756 - glob is not used on the command line
-              "GHSA-8qq5-rm4j-mr97"  # CVE-2026-23745 - limited to build/dev environments
-              "GHSA-r6q2-hw4h-h46w"  # CVE-2026-23950 - limited to build/dev environments
-              "GHSA-34x7-hfp2-rc4v"  # CVE-2026-24842 - limited to build/dev environments
+              "GHSA-3ppc-4f35-3m26"  # CVE-2026-26996 - minimatch via itk-wasm and glob is safe because it does NOT use the CLI
+                                     # CVE-2026-26996 - minimatch via other packages are strictly for building and CI/CD purposes; no user supplied expressions are passed to minimatch
+              "GHSA-7r86-cg39-jmmj"  # CVE-2026-27903 - minimatch same as above
+              "GHSA-23c5-xmqv-rm74"  # CVE-2026-27904 - minimatch same as above
+              "GHSA-c2c7-rcm5-vvqj"  # CVE-2026-33671 - picomatch is generally used for development and CI/CD purposes
             )
 
             # Build ignore flags
@@ -374,6 +386,7 @@ jobs:
     resource_class: large
     parallelism: 8
     steps:
+      - install_bun
       - run:
           name: Install System Dependencies
           command: |

.github/.dependabot.yaml

@@ -2,6 +2,8 @@ version: 2
 enable-beta-ecosystems: true
 updates:
   - package-ecosystem: 'bun'
+    # Disable all pull requests for bun version updates.
+    open-pull-requests-limit: 0
     directory: '/'
     schedule:
       interval: 'daily'
@@ -10,6 +12,8 @@ updates:
       prefix: 'chore'
       include: 'scope'
   - package-ecosystem: 'npm'
+    # Disable all pull requests for npm version updates.
+    open-pull-requests-limit: 0
     directory: '/'
     schedule:
       interval: 'daily'

CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+
+### Bug Fixes
+
+* **release:** make publish-version.mjs idempotent for re-runs ([647fd02](https://github.com/OHIF/Viewers/commit/647fd025cf7212acc03b66807974f5d0f8ba0708))
+* **security:** Update various dependencies to fix security vulnerabilities. Release 3.12.2 ([#6024](https://github.com/OHIF/Viewers/issues/6024)) ([75a24a3](https://github.com/OHIF/Viewers/commit/75a24a33935bda8779da30ef9b725b387d80723d))
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package ohif-monorepo-root
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 

addOns/externals/devDependencies/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @externals/devDependencies
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @externals/devDependencies
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @externals/devDependencies

addOns/externals/devDependencies/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@externals/devDependencies",
   "description": "External dev dependencies - put dev build dependencies here",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "license": "MIT",
   "private": true,
   "engines": {
@@ -20,7 +20,6 @@
     "react-dom": "18.3.1"
   },
   "devDependencies": {
-    "@babel/eslint-parser": "7.28.0",
     "@pmmmwh/react-refresh-webpack-plugin": "0.5.17",
     "@rsbuild/core": "1.5.1",
     "@rsbuild/plugin-node-polyfill": "1.4.2",
@@ -28,30 +27,27 @@
     "@svgr/webpack": "8.1.0",
     "@swc/helpers": "0.5.17",
     "@types/jest": "27.5.2",
-    "@typescript-eslint/eslint-plugin": "6.21.0",
-    "@typescript-eslint/parser": "6.21.0",
+    "@typescript-eslint/eslint-plugin": "8.56.0",
+    "@typescript-eslint/parser": "8.56.0",
     "autoprefixer": "10.4.21",
     "babel-loader": "8.4.1",
-    "babel-plugin-module-resolver": "5.0.2",
     "clean-webpack-plugin": "3.0.0",
     "copy-webpack-plugin": "9.1.0",
     "cross-env": "7.0.3",
     "css-loader": "6.11.0",
     "dotenv": "8.6.0",
-    "eslint": "8.57.1",
+    "eslint": "9.39.3",
     "eslint-config-prettier": "7.2.0",
-    "eslint-config-react-app": "6.0.0",
+    "eslint-config-react-app": "7.0.1",
     "eslint-plugin-cypress": "2.15.2",
-    "eslint-plugin-flowtype": "7.0.0",
     "eslint-plugin-import": "2.32.0",
     "eslint-plugin-jsx-a11y": "6.10.2",
     "eslint-plugin-node": "11.1.0",
     "eslint-plugin-prettier": "5.5.1",
-    "eslint-plugin-promise": "5.2.0",
+    "eslint-plugin-promise": "7.2.1",
     "eslint-plugin-react": "7.37.5",
-    "eslint-plugin-react-hooks": "4.6.2",
+    "eslint-plugin-react-hooks": "7.0.1",
     "eslint-plugin-tsdoc": "0.2.17",
-    "eslint-webpack-plugin": "2.7.0",
     "execa": "8.0.1",
     "extract-css-chunks-webpack-plugin": "4.10.0",
     "html-webpack-plugin": "5.6.3",
@@ -60,7 +56,7 @@
     "jest-canvas-mock": "2.5.2",
     "jest-environment-jsdom": "29.7.0",
     "jest-junit": "6.4.0",
-    "lerna": "7.4.2",
+    "lerna": "9.0.4",
     "lint-staged": "9.5.0",
     "mini-css-extract-plugin": "2.9.2",
     "optimize-css-assets-webpack-plugin": "6.0.1",
@@ -72,7 +68,7 @@
     "prettier-plugin-tailwindcss": "0.6.9",
     "react-refresh": "0.14.2",
     "semver": "7.7.2",
-    "serve": "14.2.4",
+    "serve": "14.2.5",
     "shader-loader": "1.3.1",
     "shx": "0.3.4",
     "source-map-loader": "4.0.2",
@@ -80,7 +76,7 @@
     "terser-webpack-plugin": "5.3.14",
     "typescript": "5.5.4",
     "unused-webpack-plugin": "2.4.0",
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-bundle-analyzer": "4.10.2",
     "webpack-cli": "5.1.4",
     "webpack-dev-server": "5.2.2",

addOns/externals/dicom-microscopy-viewer/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @externals/dicom-microscopy-viewer
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @externals/dicom-microscopy-viewer
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @externals/dicom-microscopy-viewer

addOns/externals/dicom-microscopy-viewer/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@externals/dicom-microscopy-viewer",
   "description": "External reference to dicom-microscopy-viewer",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "license": "MIT",
   "dependencies": {
     "dicom-microscopy-viewer": "0.48.17"

addOns/package.json

@@ -31,7 +31,7 @@
     "@babel/plugin-transform-regenerator": "7.28.1",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1"
   },

commit.txt

@@ -1 +1 @@
-45739b31a2c72cb646c733929f733a8e180a616c
+75a24a33935bda8779da30ef9b725b387d80723d

extensions/cornerstone-dicom-pmap/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-pmap
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-pmap
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-cornerstone-dicom-pmap

extensions/cornerstone-dicom-pmap/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone-dicom-pmap",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "DICOM Parametric Map read workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -33,10 +33,10 @@
     "start": "yarn run dev"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/i18n": "3.12.2",
     "prop-types": "15.8.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
@@ -48,7 +48,6 @@
     "@babel/runtime": "7.28.2",
     "@cornerstonejs/adapters": "4.15.29",
     "@cornerstonejs/core": "4.15.29",
-    "@kitware/vtk.js": "34.15.1",
-    "react-color": "2.19.3"
+    "@kitware/vtk.js": "34.15.1"
   }
 }

extensions/cornerstone-dicom-rt/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-rt
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-rt
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-cornerstone-dicom-rt

extensions/cornerstone-dicom-rt/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone-dicom-rt",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "DICOM RT read workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -33,10 +33,10 @@
     "start": "yarn run dev"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/i18n": "3.12.2",
     "prop-types": "15.8.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
@@ -45,7 +45,6 @@
     "react-router-dom": "6.30.3"
   },
   "dependencies": {
-    "@babel/runtime": "7.28.2",
-    "react-color": "2.19.3"
+    "@babel/runtime": "7.28.2"
   }
 }

extensions/cornerstone-dicom-seg/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-seg
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-seg
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-cornerstone-dicom-seg

extensions/cornerstone-dicom-seg/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone-dicom-seg",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "DICOM SEG read workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -33,10 +33,10 @@
     "start": "yarn run dev"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/i18n": "3.12.2",
     "prop-types": "15.8.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
@@ -48,7 +48,6 @@
     "@babel/runtime": "7.28.2",
     "@cornerstonejs/adapters": "4.15.29",
     "@cornerstonejs/core": "4.15.29",
-    "@kitware/vtk.js": "34.15.1",
-    "react-color": "2.19.3"
+    "@kitware/vtk.js": "34.15.1"
   }
 }

extensions/cornerstone-dicom-sr/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-sr
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-sr
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-cornerstone-dicom-sr

extensions/cornerstone-dicom-sr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone-dicom-sr",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "OHIF extension for an SR Cornerstone Viewport",
   "author": "OHIF",
   "license": "MIT",
@@ -34,10 +34,10 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-measurement-tracking": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-measurement-tracking": "3.12.2",
+    "@ohif/ui": "3.12.2",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/cornerstone-dynamic-volume/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dynamic-volume
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dynamic-volume
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-cornerstone-dynamic-volume

extensions/cornerstone-dynamic-volume/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone-dynamic-volume",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "OHIF extension for 4D volumes data",
   "author": "OHIF",
   "license": "MIT",
@@ -29,11 +29,11 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/i18n": "3.12.2",
+    "@ohif/ui": "3.12.2",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/cornerstone/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 

extensions/cornerstone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "OHIF extension for Cornerstone",
   "author": "OHIF",
   "license": "MIT",
@@ -41,8 +41,8 @@
     "@cornerstonejs/codec-openjpeg": "1.3.0",
     "@cornerstonejs/codec-openjph": "2.4.7",
     "@cornerstonejs/dicom-image-loader": "4.15.29",
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/ui": "3.12.2",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",
@@ -63,10 +63,10 @@
     "@itk-wasm/morphological-contour-interpolation": "1.1.0",
     "@kitware/vtk.js": "34.15.1",
     "html2canvas": "1.4.1",
+    "immutability-helper": "3.1.1",
     "lodash.compact": "3.0.1",
     "lodash.debounce": "4.0.8",
     "lodash.flatten": "4.4.0",
-    "lodash.merge": "4.6.2",
     "lodash.zip": "4.2.0",
     "shader-loader": "1.3.1",
     "worker-loader": "3.0.8"

extensions/cornerstone/src/index.tsx

@@ -59,6 +59,7 @@ import utils from './utils';
 import { useMeasurementTracking } from './hooks/useMeasurementTracking';
 import { setUpSegmentationEventHandlers } from './utils/setUpSegmentationEventHandlers';
 import { setUpAnnotationEventHandlers } from './utils/setUpAnnotationEventHandlers';
+import update from 'immutability-helper';
 export * from './components';
 
 const { imageRetrieveMetadataProvider } = cornerstone.utilities;
@@ -75,7 +76,7 @@ const OHIFCornerstoneViewport = props => {
   );
 };
 
-const stackRetrieveOptions = {
+const DEFAULT_STACK_RETRIEVE_OPTIONS = {
   retrieveOptions: {
     single: {
       streaming: true,
@@ -84,6 +85,12 @@ const stackRetrieveOptions = {
   },
 };
 
+/** Normalize to immutability-helper spec: plain object → $merge, otherwise use as-is. */
+const toUpdateSpec = (obj: object) =>
+  obj != null && typeof obj === 'object' && Object.keys(obj).some(k => k.startsWith('$'))
+    ? obj
+    : { $merge: (obj ?? {}) as object };
+
 const unsubscriptions = [];
 /**
  *
@@ -94,7 +101,11 @@ const cornerstoneExtension: Types.Extensions.Extension = {
    */
   id,
 
-  onModeEnter: ({ servicesManager, commandsManager }: withAppTypes): void => {
+  onModeEnter: ({
+    servicesManager,
+    commandsManager,
+    extensionManager,
+  }: withAppTypes): void => {
     const { cornerstoneViewportService, toolbarService, segmentationService } =
       servicesManager.services;
 
@@ -131,10 +142,17 @@ const cornerstoneExtension: Types.Extensions.Extension = {
       'volume',
       cornerstone.ProgressiveRetrieveImages.interleavedRetrieveStages
     );
-    // The default stack loading option is to progressive load HTJ2K images
-    // There are other possible options, but these need more thought about
-    // how to define them.
-    imageRetrieveMetadataProvider.add('stack', stackRetrieveOptions);
+
+    /**
+     * Stack retrieve options: read from active data source configuration.
+     * Pass an immutability-helper spec (e.g. { $merge: {...} } or { $set: {...} }) in
+     * stackRetrieveOptions to customize. Plain object is treated as $merge for backward compat.
+     * Set streaming: false for uncompressed DICOM that requires full file before decode.
+     */
+    const sourceConfig = extensionManager?.getActiveDataSource?.()?.[0]?.getConfig?.() ?? {};
+    const config = sourceConfig.stackRetrieveOptions ?? {};
+    const stackOptions = update(DEFAULT_STACK_RETRIEVE_OPTIONS, toUpdateSpec(config)) as typeof DEFAULT_STACK_RETRIEVE_OPTIONS;
+    imageRetrieveMetadataProvider.add('stack', stackOptions);
   },
   getPanelModule,
   onModeExit: ({ servicesManager }: withAppTypes): void => {

extensions/default/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-default
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-default
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-default

extensions/default/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-default",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "Common/default features and functionality for basic image viewing",
   "author": "OHIF Core Team",
   "license": "MIT",
@@ -34,8 +34,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/i18n": "3.12.2",
     "dcmjs": "0.49.4",
     "dicomweb-client": "0.10.4",
     "prop-types": "15.8.1",
@@ -43,13 +43,14 @@
     "react-dom": "18.3.1",
     "react-i18next": "12.3.1",
     "react-window": "1.8.11",
-    "webpack": "5.89.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "@cornerstonejs/calculate-suv": "1.1.0",
     "lodash.get": "4.4.2",
-    "lodash.uniqby": "4.7.0"
+    "lodash.uniqby": "4.7.0",
+    "react-color": "2.19.3"
   }
 }

extensions/default/src/DicomJSONDataSource/index.js

@@ -4,6 +4,7 @@ import qs from 'query-string';
 
 import getImageId from '../DicomWebDataSource/utils/getImageId';
 import getDirectURL from '../utils/getDirectURL';
+import { resolveConfigFetchPolicy, fetchConfigJson } from '../utils/secureConfigFetch';
 
 const metadataProvider = OHIF.classes.MetadataProvider;
 
@@ -59,13 +60,18 @@ const findStudies = (key, value) => {
   return studies;
 };
 
-function createDicomJSONApi(dicomJsonConfig) {
+function createDicomJSONApi(dicomJsonConfig, servicesManager) {
+  const { userAuthenticationService } = servicesManager.services;
   const implementation = {
     initialize: async ({ query, url }) => {
       if (!url) {
         url = query.get('url');
       }
-      let metaData = getMetaDataByURL(url);
+      const evaluatedUrl = resolveConfigFetchPolicy(url, {
+        allowedOrigins: dicomJsonConfig.dangerouslyAllowedOriginsForAuthenticatedEnvironments,
+        userAuthenticationService,
+      });
+      let metaData = getMetaDataByURL(evaluatedUrl.normalizedUrl);
 
       // if we have already cached the data from this specific url
       // We are only handling one StudyInstanceUID to run; however,
@@ -76,8 +82,7 @@ function createDicomJSONApi(dicomJsonConfig) {
         });
       }
 
-      const response = await fetch(url);
-      const data = await response.json();
+      const data = await fetchConfigJson(evaluatedUrl);
 
       let StudyInstanceUID;
       let SeriesInstanceUID;
@@ -105,11 +110,11 @@ function createDicomJSONApi(dicomJsonConfig) {
       });
 
       _store.urls.push({
-        url,
+        url: evaluatedUrl.normalizedUrl,
         studies: [...data.studies],
       });
       _store.studyInstanceUIDMap.set(
-        url,
+        evaluatedUrl.normalizedUrl,
         data.studies.map(study => study.StudyInstanceUID)
       );
     },
@@ -252,6 +257,8 @@ function createDicomJSONApi(dicomJsonConfig) {
         console.warn(' DICOMJson store dicom not implemented');
       },
     },
+    reject: {},
+    deleteStudyMetadataPromise: () => {},
     getImageIdsForDisplaySet(displaySet) {
       const images = displaySet.images;
       const imageIds = [];
@@ -297,8 +304,21 @@ function createDicomJSONApi(dicomJsonConfig) {
     },
     getStudyInstanceUIDs: ({ params, query }) => {
       const url = query.get('url');
-      return _store.studyInstanceUIDMap.get(url);
+      if (!url) {
+        return;
+      }
+
+      try {
+        const evaluatedUrl = resolveConfigFetchPolicy(url, {
+          allowedOrigins: dicomJsonConfig.dangerouslyAllowedOriginsForAuthenticatedEnvironments,
+          userAuthenticationService,
+        });
+        return _store.studyInstanceUIDMap.get(evaluatedUrl.normalizedUrl);
+      } catch {
+        return;
+      }
     },
+    getConfig: () => dicomJsonConfig,
   };
   return IWebApiDataSource.create(implementation);
 }

extensions/default/src/DicomWebProxyDataSource/index.ts

@@ -1,5 +1,6 @@
 import { IWebApiDataSource } from '@ohif/core';
 import { createDicomWebApi } from '../DicomWebDataSource/index';
+import { resolveConfigFetchPolicy, fetchConfigJson } from '../utils/secureConfigFetch';
 
 /**
  * This datasource is initialized with a url that returns a JSON object with a
@@ -11,6 +12,7 @@ import { createDicomWebApi } from '../DicomWebDataSource/index';
  */
 function createDicomWebProxyApi(dicomWebProxyConfig, servicesManager: AppTypes.ServicesManager) {
   const { name } = dicomWebProxyConfig;
+  const { userAuthenticationService } = servicesManager.services;
   let dicomWebDelegate = undefined;
 
   const implementation = {
@@ -20,12 +22,14 @@ function createDicomWebProxyApi(dicomWebProxyConfig, servicesManager: AppTypes.S
       if (!url) {
         throw new Error(`No url for '${name}'`);
       } else {
-        const response = await fetch(url);
-        const data = await response.json();
+        const evaluatedUrl = resolveConfigFetchPolicy(url, {
+          allowedOrigins: dicomWebProxyConfig.dangerouslyAllowedOriginsForAuthenticatedEnvironments,
+          userAuthenticationService,
+        });
+        const data = await fetchConfigJson(evaluatedUrl);
         if (!data.servers?.dicomWeb?.[0]) {
           throw new Error('Invalid configuration returned by url');
         }
-
         dicomWebDelegate = createDicomWebApi(
           data.servers.dicomWeb[0].configuration || data.servers.dicomWeb[0],
           servicesManager
@@ -54,9 +58,16 @@ function createDicomWebProxyApi(dicomWebProxyConfig, servicesManager: AppTypes.S
     store: {
       dicom: (...args) => dicomWebDelegate.store.dicom(...args),
     },
-    deleteStudyMetadataPromise: (...args) => dicomWebDelegate.deleteStudyMetadataPromise(...args),
-    getImageIdsForDisplaySet: (...args) => dicomWebDelegate.getImageIdsForDisplaySet(...args),
-    getImageIdsForInstance: (...args) => dicomWebDelegate.getImageIdsForInstance(...args),
+    reject: {
+      series: (...args) => dicomWebDelegate?.reject?.series?.(...args),
+    },
+    deleteStudyMetadataPromise: (...args) => dicomWebDelegate?.deleteStudyMetadataPromise?.(...args),
+    getImageIdsForDisplaySet: (...args) => dicomWebDelegate?.getImageIdsForDisplaySet?.(...args),
+    getImageIdsForInstance: (...args) => dicomWebDelegate?.getImageIdsForInstance?.(...args),
+    getConfig: (...args) =>
+      dicomWebDelegate?.getConfig?.(...args) ?? {
+        dicomUploadEnabled: false,
+      },
     getStudyInstanceUIDs({ params, query }) {
       let studyInstanceUIDs = [];
 

extensions/default/src/utils/secureConfigFetch.js

@@ -0,0 +1,115 @@
+// @ts-nocheck
+
+function normalizeAllowedOrigins(allowedOrigins = []) {
+  if (!Array.isArray(allowedOrigins)) {
+    return [];
+  }
+
+  const configuredOrigins = allowedOrigins
+    .filter(origin => typeof origin === 'string')
+    .map(origin => origin.trim())
+    .filter(Boolean);
+
+  return configuredOrigins
+    .map(origin => {
+      try {
+        const parsedOrigin = new URL(origin);
+        if (!['http:', 'https:'].includes(parsedOrigin.protocol)) {
+          console.error(
+            `[secureConfigFetch] Ignoring misconfigured allowed origin "${origin}". ` +
+              'Entries must use http:// or https://.'
+          );
+          return null;
+        }
+        if (
+          parsedOrigin.username ||
+          parsedOrigin.password ||
+          parsedOrigin.pathname !== '/' ||
+          parsedOrigin.search ||
+          parsedOrigin.hash
+        ) {
+          console.error(
+            `[secureConfigFetch] Ignoring misconfigured allowed origin "${origin}". ` +
+              'Entries must be bare origins only (scheme + host + optional port), with no username/password, path, query, or hash.'
+          );
+          return null;
+        }
+        return parsedOrigin.origin;
+      } catch {
+        console.error(
+          `[secureConfigFetch] Ignoring misconfigured allowed origin "${origin}". Entry is not a valid URL.`
+        );
+        return null;
+      }
+    })
+    .filter(Boolean);
+}
+
+function resolveConfigUrl(rawUrl) {
+  if (!rawUrl || typeof rawUrl !== 'string') {
+    throw new Error('Missing required "url" query parameter');
+  }
+
+  try {
+    return new URL(rawUrl, window.location.href);
+  } catch {
+    throw new Error('Invalid URL in "url" query parameter');
+  }
+}
+
+function resolveConfigFetchPolicy(rawUrl, policy = {}) {
+  const { allowedOrigins = [], userAuthenticationService } = policy;
+  const parsedUrl = resolveConfigUrl(rawUrl);
+  const protocol = parsedUrl.protocol.toLowerCase();
+  const isSameOrigin = parsedUrl.origin === window.location.origin;
+
+  if (!['http:', 'https:'].includes(protocol)) {
+    throw new Error('Only HTTP(S) URLs are allowed for dynamic datasource configuration');
+  }
+
+  if (parsedUrl.hash) {
+    throw new Error('URL fragments are not allowed for dynamic datasource configuration');
+  }
+
+  if (parsedUrl.username || parsedUrl.password) {
+    throw new Error('URL userinfo is not allowed for dynamic datasource configuration');
+  }
+
+  const isAuthenticated = Boolean(
+    userAuthenticationService?.getAuthorizationHeader?.()?.Authorization
+  );
+
+  if (isAuthenticated && !isSameOrigin) {
+    const normalizedAllowedOrigins = normalizeAllowedOrigins(allowedOrigins);
+    if (!normalizedAllowedOrigins.length || !normalizedAllowedOrigins.includes(parsedUrl.origin)) {
+      throw new Error(
+        `Blocked remote configuration origin "${parsedUrl.origin}" in authenticated environment`
+      );
+    }
+  }
+
+  return {
+    parsedUrl,
+    normalizedUrl: parsedUrl.toString(),
+    isAuthenticated,
+    isSameOrigin,
+  };
+}
+
+async function fetchConfigJson(normalizedPolicy) {
+  const { normalizedUrl } = normalizedPolicy;
+  const response = await fetch(normalizedUrl, {
+    method: 'GET',
+    mode: 'cors',
+    credentials: 'same-origin',
+    redirect: 'error',
+    referrerPolicy: 'no-referrer',
+  });
+
+  if (!response.ok) {
+    throw new Error(`Failed to fetch dynamic datasource configuration (${response.status})`);
+  }
+
+  return response.json();
+}
+export { resolveConfigFetchPolicy, fetchConfigJson };

extensions/default/src/utils/secureConfigFetch.test.js

@@ -0,0 +1,163 @@
+// @ts-nocheck
+import { resolveConfigFetchPolicy, fetchConfigJson } from './secureConfigFetch';
+
+describe('secureConfigFetch', () => {
+  describe('resolveConfigFetchPolicy', () => {
+    it('allows arbitrary origin in unauthenticated environments', () => {
+      const result = resolveConfigFetchPolicy('https://untrusted.example.com/config.json', {
+        userAuthenticationService: {
+          getAuthorizationHeader: () => ({}),
+        },
+      });
+
+      expect(result.normalizedUrl).toBe('https://untrusted.example.com/config.json');
+      expect(result.isAuthenticated).toBe(false);
+      expect(result.isSameOrigin).toBe(false);
+    });
+
+    it('blocks non-allowlisted origins in authenticated environments', () => {
+      expect(() =>
+        resolveConfigFetchPolicy('https://untrusted.example.com/config.json', {
+          allowedOrigins: ['https://trusted.example.com'],
+          userAuthenticationService: {
+            getAuthorizationHeader: () => ({ Authorization: 'Bearer token123' }),
+          },
+        })
+      ).toThrow('Blocked remote configuration origin');
+    });
+
+    it('allows allowlisted origin in authenticated environments', () => {
+      const result = resolveConfigFetchPolicy('http://localhost:5000/config.json', {
+        allowedOrigins: ['http://localhost:5000', 'https://trusted.example.com'],
+        userAuthenticationService: {
+          getAuthorizationHeader: () => ({ Authorization: 'Bearer token123' }),
+        },
+      });
+
+      expect(result.normalizedUrl).toBe('http://localhost:5000/config.json');
+      expect(result.isAuthenticated).toBe(true);
+      expect(result.isSameOrigin).toBe(false);
+    });
+
+    it('blocks authenticated fetch when allowlist is missing', () => {
+      expect(() =>
+        resolveConfigFetchPolicy('https://noTrustList.example.com/config.json', {
+          userAuthenticationService: {
+            getAuthorizationHeader: () => ({ Authorization: 'Bearer token123' }),
+          },
+        })
+      ).toThrow('Blocked remote configuration origin');
+    });
+
+    it('allows same-origin in authenticated environments without allowlist', () => {
+      const result = resolveConfigFetchPolicy('/protected/config.json', {
+        userAuthenticationService: {
+          getAuthorizationHeader: () => ({ Authorization: 'Bearer token123' }),
+        },
+      });
+
+      expect(result.normalizedUrl).toBe(`${window.location.origin}/protected/config.json`);
+      expect(result.isAuthenticated).toBe(true);
+      expect(result.isSameOrigin).toBe(true);
+    });
+
+    it('rejects embedded userinfo in config URLs', () => {
+      expect(() =>
+        resolveConfigFetchPolicy('https://user:pass@trusted.example.com/config.json', {
+          allowedOrigins: ['https://trusted.example.com'],
+          userAuthenticationService: {
+            getAuthorizationHeader: () => ({ Authorization: 'Bearer token123' }),
+          },
+        })
+      ).toThrow('URL userinfo is not allowed for dynamic datasource configuration');
+    });
+  });
+
+  describe('fetchConfigJson', () => {
+    const originalFetch = global.fetch;
+
+    beforeEach(() => {
+      global.fetch = jest.fn();
+    });
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+      global.fetch = originalFetch;
+    });
+
+    it('uses hardened fetch options for unauthenticated cross-origin requests', async () => {
+      global.fetch.mockResolvedValue({
+        status: 200,
+        ok: true,
+        json: async () => ({ ok: true }),
+      });
+
+      await fetchConfigJson({
+        normalizedUrl: 'https://example.com/config.json',
+        isAuthenticated: false,
+        isSameOrigin: false,
+      });
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        'https://example.com/config.json',
+        expect.objectContaining({
+          method: 'GET',
+          mode: 'cors',
+          credentials: 'same-origin',
+          redirect: 'error',
+          referrerPolicy: 'no-referrer',
+        })
+      );
+    });
+
+    it('uses hardened fetch options for unauthenticated same-origin requests', async () => {
+      global.fetch.mockResolvedValue({
+        status: 200,
+        ok: true,
+        json: async () => ({ ok: true }),
+      });
+
+      await fetchConfigJson({
+        normalizedUrl: `${window.location.origin}/protected/config.json`,
+        isAuthenticated: false,
+        isSameOrigin: true,
+      });
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        `${window.location.origin}/protected/config.json`,
+        expect.objectContaining({
+          method: 'GET',
+          mode: 'cors',
+          credentials: 'same-origin',
+          redirect: 'error',
+          referrerPolicy: 'no-referrer',
+        })
+      );
+    });
+
+    it('uses hardened fetch options in authenticated environments', async () => {
+      global.fetch.mockResolvedValue({
+        status: 200,
+        ok: true,
+        json: async () => ({ ok: true }),
+      });
+
+      await fetchConfigJson({
+        normalizedUrl: 'https://trusted.example.com/config.json',
+        isAuthenticated: true,
+        isSameOrigin: false,
+      });
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        'https://trusted.example.com/config.json',
+        expect.objectContaining({
+          method: 'GET',
+          mode: 'cors',
+          credentials: 'same-origin',
+          redirect: 'error',
+          referrerPolicy: 'no-referrer',
+        })
+      );
+    });
+  });
+});

extensions/dicom-microscopy/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-dicom-microscopy
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-dicom-microscopy
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-dicom-microscopy

extensions/dicom-microscopy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-dicom-microscopy",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "OHIF extension for DICOM microscopy",
   "author": "Bill Wallace, md-prog",
   "license": "MIT",
@@ -30,10 +30,10 @@
     "start": "yarn run dev"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/i18n": "3.12.2",
+    "@ohif/ui": "3.12.2",
     "prop-types": "15.8.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",

extensions/dicom-pdf/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-dicom-pdf
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-dicom-pdf
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-dicom-pdf

extensions/dicom-pdf/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-dicom-pdf",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "OHIF extension for PDF display",
   "author": "OHIF",
   "license": "MIT",
@@ -30,8 +30,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/ui": "3.12.2",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/dicom-video/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-dicom-video
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-dicom-video
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-dicom-video

extensions/dicom-video/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-dicom-video",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "OHIF extension for video display",
   "author": "OHIF",
   "license": "MIT",
@@ -30,8 +30,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/ui": "3.12.2",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/measurement-tracking/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-measurement-tracking
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-measurement-tracking
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-measurement-tracking

extensions/measurement-tracking/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-measurement-tracking",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "Tracking features and functionality for basic image viewing",
   "author": "OHIF Core Team",
   "license": "MIT",
@@ -34,22 +34,22 @@
   "peerDependencies": {
     "@cornerstonejs/core": "4.15.29",
     "@cornerstonejs/tools": "4.15.29",
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/ui": "3.12.2",
     "classnames": "2.5.1",
     "dcmjs": "0.49.4",
     "lodash.debounce": "4.0.8",
     "prop-types": "15.8.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
-    "webpack": "5.89.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/ui": "3.12.2",
     "@xstate/react": "3.2.2",
     "xstate": "4.38.3"
   }

extensions/test-extension/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-test
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-test
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-test

extensions/test-extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-test",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "OHIF extension used inside e2e testing",
   "author": "OHIF",
   "license": "MIT",
@@ -30,8 +30,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/ui": "3.12.2",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/tmtv/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-tmtv
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-tmtv
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-tmtv

extensions/tmtv/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-tmtv",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "OHIF extension for Total Metabolic Tumor Volume",
   "author": "OHIF",
   "license": "MIT",
@@ -30,8 +30,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/ui": "3.12.2",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/usAnnotation/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+
+### Bug Fixes
+
+* **security:** Update various dependencies to fix security vulnerabilities. Release 3.12.2 ([#6024](https://github.com/OHIF/Viewers/issues/6024)) ([75a24a3](https://github.com/OHIF/Viewers/commit/75a24a33935bda8779da30ef9b725b387d80723d))
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-ultrasound-pleura-bline
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-ultrasound-pleura-bline

extensions/usAnnotation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-ultrasound-pleura-bline",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "",
   "author": "Rodrigo Basilio",
   "license": "MIT",
@@ -37,22 +37,21 @@
     "react-i18next": "12.3.1",
     "react-router": "6.30.3",
     "react-router-dom": "6.30.3",
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "@cornerstonejs/core": "4.15.29",
     "@cornerstonejs/tools": "4.15.29",
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
-    "@ohif/ui-next": "3.12.0-beta.135"
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/i18n": "3.12.2",
+    "@ohif/ui-next": "3.12.2"
   },
   "devDependencies": {
     "@babel/core": "7.28.0",
-    "@babel/eslint-parser": "7.28.0",
     "@babel/plugin-syntax-dynamic-import": "7.8.3",
     "@babel/plugin-transform-arrow-functions": "7.27.1",
     "@babel/plugin-transform-class-properties": "7.27.1",
@@ -62,19 +61,16 @@
     "@babel/plugin-transform-regenerator": "7.28.1",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1",
     "@svgr/webpack": "8.1.0",
     "babel-loader": "8.4.1",
-    "babel-plugin-module-resolver": "5.0.2",
     "clean-webpack-plugin": "3.0.0",
     "copy-webpack-plugin": "9.1.0",
     "cross-env": "7.0.3",
     "dotenv": "8.6.0",
-    "eslint": "8.57.1",
-    "eslint-loader": "2.2.1",
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-cli": "5.1.4",
     "webpack-merge": "5.10.0"
   }

lerna.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "packages": ["extensions/*", "platform/*", "modes/*", "addOns/externals/*"],
   "npmClient": "yarn"
 }

modes/basic-dev-mode/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-basic-dev-mode
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-basic-dev-mode
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-basic-dev-mode

modes/basic-dev-mode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-basic-dev-mode",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "Basic OHIF Viewer Using Cornerstone",
   "author": "OHIF",
   "license": "MIT",
@@ -31,19 +31,19 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135"
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/extension-dicom-pdf": "3.12.2",
+    "@ohif/extension-dicom-video": "3.12.2"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "i18next": "17.3.1"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   }
 }

modes/basic-test-mode/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-test
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-test
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-test

modes/basic-test-mode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-test",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "Basic mode for testing",
   "author": "OHIF",
   "license": "MIT",
@@ -34,21 +34,21 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135",
-    "@ohif/extension-measurement-tracking": "3.12.0-beta.135",
-    "@ohif/extension-test": "3.12.0-beta.135"
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/extension-dicom-pdf": "3.12.2",
+    "@ohif/extension-dicom-video": "3.12.2",
+    "@ohif/extension-measurement-tracking": "3.12.2",
+    "@ohif/extension-test": "3.12.2"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "i18next": "17.3.1"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   }
 }

modes/basic/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-basic
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-basic
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-basic

modes/basic/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-basic",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "A basic mode used to build other modes on top of",
   "author": "OHIF Contributors",
   "license": "MIT",
@@ -21,20 +21,20 @@
     "yarn": ">=1.16.0"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-rt": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-seg": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135"
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-rt": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-seg": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/extension-dicom-pdf": "3.12.2",
+    "@ohif/extension-dicom-video": "3.12.2"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   },
   "scripts": {

modes/longitudinal/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-longitudinal
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-longitudinal
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-longitudinal

modes/longitudinal/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-longitudinal",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "Longitudinal Workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -34,23 +34,23 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-rt": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-seg": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135",
-    "@ohif/extension-measurement-tracking": "3.12.0-beta.135",
-    "@ohif/mode-basic": "3.12.0-beta.135"
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-rt": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-seg": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/extension-dicom-pdf": "3.12.2",
+    "@ohif/extension-dicom-video": "3.12.2",
+    "@ohif/extension-measurement-tracking": "3.12.2",
+    "@ohif/mode-basic": "3.12.2"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "i18next": "17.3.1"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   }
 }

modes/microscopy/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-microscopy
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-microscopy
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-microscopy

modes/microscopy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-microscopy",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "OHIF mode for DICOM microscopy",
   "author": "OHIF",
   "license": "MIT",
@@ -35,8 +35,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-dicom-microscopy": "3.12.0-beta.135"
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-dicom-microscopy": "3.12.2"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",

modes/preclinical-4d/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-preclinical-4d
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-preclinical-4d
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-preclinical-4d

modes/preclinical-4d/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-preclinical-4d",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "4D Workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -33,18 +33,18 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-seg": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dynamic-volume": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-tmtv": "3.12.0-beta.135"
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-seg": "3.12.2",
+    "@ohif/extension-cornerstone-dynamic-volume": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/extension-tmtv": "3.12.2"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   }
 }

modes/segmentation/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+
+### Bug Fixes
+
+* **security:** Update various dependencies to fix security vulnerabilities. Release 3.12.2 ([#6024](https://github.com/OHIF/Viewers/issues/6024)) ([75a24a3](https://github.com/OHIF/Viewers/commit/75a24a33935bda8779da30ef9b725b387d80723d))
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-segmentation
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-segmentation

modes/segmentation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-segmentation",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "OHIF segmentation mode which enables labelmap segmentation read/edit/export",
   "author": "@ohif",
   "license": "MIT",
@@ -35,15 +35,15 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-rt": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-seg": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135",
-    "@ohif/mode-basic": "3.12.0-beta.135"
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-rt": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-seg": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/extension-dicom-pdf": "3.12.2",
+    "@ohif/extension-dicom-video": "3.12.2",
+    "@ohif/mode-basic": "3.12.2"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
@@ -51,7 +51,6 @@
   },
   "devDependencies": {
     "@babel/core": "7.28.0",
-    "@babel/eslint-parser": "7.28.0",
     "@babel/plugin-syntax-dynamic-import": "7.8.3",
     "@babel/plugin-transform-arrow-functions": "7.27.1",
     "@babel/plugin-transform-class-properties": "7.27.1",
@@ -60,7 +59,7 @@
     "@babel/plugin-transform-regenerator": "7.28.1",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1",
     "@svgr/webpack": "8.1.0",
@@ -69,9 +68,7 @@
     "copy-webpack-plugin": "9.1.0",
     "cross-env": "7.0.3",
     "dotenv": "8.6.0",
-    "eslint": "8.57.1",
-    "eslint-loader": "2.2.1",
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-cli": "5.1.4",
     "webpack-merge": "5.10.0"
   }

modes/tmtv/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-tmtv
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-tmtv
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-tmtv

modes/tmtv/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-tmtv",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "Total Metabolic Tumor Volume Workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -34,20 +34,20 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135",
-    "@ohif/extension-measurement-tracking": "3.12.0-beta.135"
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/extension-dicom-pdf": "3.12.2",
+    "@ohif/extension-dicom-video": "3.12.2",
+    "@ohif/extension-measurement-tracking": "3.12.2"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "i18next": "17.3.1"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   }
 }

modes/usAnnotation/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+
+### Bug Fixes
+
+* **security:** Update various dependencies to fix security vulnerabilities. Release 3.12.2 ([#6024](https://github.com/OHIF/Viewers/issues/6024)) ([75a24a3](https://github.com/OHIF/Viewers/commit/75a24a33935bda8779da30ef9b725b387d80723d))
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-ultrasound-pleura-bline
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-ultrasound-pleura-bline

modes/usAnnotation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-ultrasound-pleura-bline",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "Allows users to annotate ultrasound images with pleura B-line annotations.",
   "author": "OHIF",
   "license": "MIT",
@@ -36,14 +36,13 @@
     "@babel/runtime": "7.28.2",
     "@cornerstonejs/core": "4.15.29",
     "@cornerstonejs/tools": "4.15.29",
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-ultrasound-pleura-bline": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.2",
+    "@ohif/extension-ultrasound-pleura-bline": "3.12.2",
     "i18next": "17.3.1"
   },
   "devDependencies": {
     "@babel/core": "7.28.0",
-    "@babel/eslint-parser": "7.28.0",
     "@babel/plugin-syntax-dynamic-import": "7.8.3",
     "@babel/plugin-transform-arrow-functions": "7.27.1",
     "@babel/plugin-transform-class-properties": "7.27.1",
@@ -52,7 +51,7 @@
     "@babel/plugin-transform-regenerator": "7.28.1",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1",
     "@svgr/webpack": "8.1.0",
@@ -61,9 +60,7 @@
     "copy-webpack-plugin": "9.1.0",
     "cross-env": "7.0.3",
     "dotenv": "8.6.0",
-    "eslint": "8.57.1",
-    "eslint-loader": "2.2.1",
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-cli": "5.1.4",
     "webpack-merge": "5.10.0"
   }

package.json

@@ -49,7 +49,7 @@
     "install:update-lockfile": "yarn install && bun install --config=./bunfig.update-lockfile.toml",
     "install:yarn:frozen-lockfile": "echo Deprecated - use install:frozen && yarn install --frozen-lockfile",
     "install:frozen": "yarn install --frozen-lockfile",
-    "audit": "bun audit --ignore=GHSA-5j98-mcp5-4vw2",
+    "audit": "bun audit --ignore=GHSA-3ppc-4f35-3m26 --ignore=GHSA-7r86-cg39-jmmj --ignore=GHSA-23c5-xmqv-rm74 --ignore=GHSA-c2c7-rcm5-vvqj",
     "preinstall": "node preinstall.js",
     "start": "yarn run dev",
     "test": "yarn run test:unit",
@@ -97,22 +97,20 @@
     "@babel/plugin-transform-regenerator": "7.28.1",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1",
     "@istanbuljs/nyc-config-typescript": "1.0.2",
     "@pmmmwh/react-refresh-webpack-plugin": "0.5.17",
     "babel-loader": "8.4.1",
-    "babel-plugin-istanbul": "7.0.0",
+    "babel-plugin-istanbul": "7.0.1",
     "babel-plugin-transform-import-meta": "2.3.3",
     "cross-env": "7.0.3",
     "css-loader": "6.11.0",
     "cypress": "14.5.2",
     "cypress-file-upload": "5.0.8",
     "file-loader": "6.2.0",
-    "istanbul": "0.4.5",
     "nyc": "17.1.0",
-    "patch-package": "8.0.0",
     "playwright-test-coverage": "1.2.12",
     "postcss-loader": "6.2.1",
     "prettier": "3.6.2",
@@ -140,21 +138,32 @@
     "cross-env": "7.0.3",
     "cross-spawn": "7.0.6",
     "dcmjs": "0.49.4",
-    "path-to-regexp": "0.1.12",
+    "path-to-regexp": "0.1.13",
     "nth-check": "2.1.1",
     "trim-newlines": "5.0.0",
     "glob-parent": "6.0.2",
     "trim": "1.0.1",
     "package-json": "8.1.1",
-    "rollup": "2.79.2",
+    "rollup": "2.80.0",
     "body-parser": "1.20.3",
-    "axios": "1.12.0",
+    "axios": "1.15.2",
     "core-js": "3.45.1",
     "@babel/runtime-corejs2": "7.26.10",
     "tapable": "2.2.2",
     "@cornerstonejs/codec-openjpeg": "1.3.0",
-    "node-forge": "1.3.2",
-    "qs": "6.14.1"
+    "node-forge": "1.4.0",
+    "qs": "6.14.1",
+    "lodash": "4.18.1",
+    "lodash-es": "4.18.1",
+    "diff": "5.2.2",
+    "webpack": "5.105.0",
+    "tar": "7.5.11",
+    "serialize-javascript": "7.0.4",
+    "svgo": "3.3.3",
+    "flatted": "3.4.2",
+    "handlebars": "4.7.9",
+    "protobufjs": "7.5.7",
+    "@babel/plugin-transform-modules-systemjs": "7.29.4"
   },
   "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
 }

platform/app/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/app
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/app
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/app

platform/app/netlify.toml

@@ -19,7 +19,7 @@
 [build.environment]
   # If 'production', `yarn install` does not install devDependencies
   NODE_ENV = "development"
-  NODE_VERSION = "20.18.1"
+  NODE_VERSION = "20.19.0"
   YARN_VERSION = "1.22.5"
   RUBY_VERSION = "2.6.2"
   YARN_FLAGS = "--no-ignore-optional --pure-lockfile"

platform/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/app",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "productVersion": "3.4.0",
   "description": "OHIF Viewer",
   "author": "OHIF Contributors",
@@ -55,25 +55,25 @@
     "@cornerstonejs/codec-openjph": "2.4.7",
     "@cornerstonejs/dicom-image-loader": "4.15.29",
     "@emotion/serialize": "1.3.3",
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-rt": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-seg": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-microscopy": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135",
-    "@ohif/extension-test": "3.12.0-beta.135",
-    "@ohif/extension-ultrasound-pleura-bline": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
-    "@ohif/mode-basic-dev-mode": "3.12.0-beta.135",
-    "@ohif/mode-longitudinal": "3.12.0-beta.135",
-    "@ohif/mode-microscopy": "3.12.0-beta.135",
-    "@ohif/mode-test": "3.12.0-beta.135",
-    "@ohif/mode-ultrasound-pleura-bline": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
-    "@ohif/ui-next": "3.12.0-beta.135",
+    "@ohif/core": "3.12.2",
+    "@ohif/extension-cornerstone": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-rt": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-seg": "3.12.2",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.2",
+    "@ohif/extension-default": "3.12.2",
+    "@ohif/extension-dicom-microscopy": "3.12.2",
+    "@ohif/extension-dicom-pdf": "3.12.2",
+    "@ohif/extension-dicom-video": "3.12.2",
+    "@ohif/extension-test": "3.12.2",
+    "@ohif/extension-ultrasound-pleura-bline": "3.12.2",
+    "@ohif/i18n": "3.12.2",
+    "@ohif/mode-basic-dev-mode": "3.12.2",
+    "@ohif/mode-longitudinal": "3.12.2",
+    "@ohif/mode-microscopy": "3.12.2",
+    "@ohif/mode-test": "3.12.2",
+    "@ohif/mode-ultrasound-pleura-bline": "3.12.2",
+    "@ohif/ui": "3.12.2",
+    "@ohif/ui-next": "3.12.2",
     "@svgr/webpack": "8.1.0",
     "@types/react": "18.3.23",
     "classnames": "2.5.1",

platform/app/public/config/default.js

@@ -251,6 +251,12 @@ window.config = {
       configuration: {
         friendlyName: 'dicomweb delegating proxy',
         name: 'dicomwebproxy',
+        // Security controls for runtime ?url=... datasource loading:
+        // In authenticated environments, runtime ?url origins must be allowlisted:
+        // dangerouslyAllowedOriginsForAuthenticatedEnvironments: [
+        //   'https://config.example.com',
+        //   'http://localhost:5000',
+        // ],
       },
     },
     {
@@ -259,6 +265,12 @@ window.config = {
       configuration: {
         friendlyName: 'dicom json',
         name: 'json',
+        // Security controls for runtime ?url=... datasource loading:
+        // In authenticated environments, runtime ?url origins must be allowlisted:
+        // dangerouslyAllowedOriginsForAuthenticatedEnvironments: [
+        //   'https://config.example.com',
+        //   'http://localhost:5000',
+        // ],
       },
     },
     {

platform/cli/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+
+### Bug Fixes
+
+* **security:** Update various dependencies to fix security vulnerabilities. Release 3.12.2 ([#6024](https://github.com/OHIF/Viewers/issues/6024)) ([75a24a3](https://github.com/OHIF/Viewers/commit/75a24a33935bda8779da30ef9b725b387d80723d))
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/cli
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/cli

platform/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/cli",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "A CLI to bootstrap new OHIF extension or mode",
   "type": "module",
   "main": "src/index.js",
@@ -21,7 +21,7 @@
   "license": "MIT",
   "dependencies": {
     "@babel/core": "7.28.0",
-    "axios": "1.12.0",
+    "axios": "1.13.5",
     "chalk": "5.4.1",
     "execa": "8.0.1",
     "gitignore": "0.7.0",

platform/cli/templates/extension/dependencies.json

@@ -41,20 +41,16 @@
     "@babel/plugin-transform-regenerator": "^7.16.7",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "^7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "^7.27.1",
     "@babel/preset-typescript": "^7.27.1",
     "@babel/plugin-transform-private-property-in-object": "^7.27.1",
-    "@babel/eslint-parser": "7.28.0",
     "babel-loader": "^8.2.4",
     "@svgr/webpack": "^8.1.0",
-    "babel-plugin-module-resolver": "^5.0.0",
     "clean-webpack-plugin": "^4.0.0",
     "copy-webpack-plugin": "^10.2.0",
     "cross-env": "^7.0.3",
     "dotenv": "^14.1.0",
-    "eslint": "^8.39.0",
-    "eslint-loader": "^2.0.0",
     "webpack": "5.89.0",
     "webpack-merge": "^5.7.3",
     "webpack-cli": "^5.0.2"

platform/cli/templates/mode/dependencies.json

@@ -32,18 +32,15 @@
     "@babel/plugin-transform-regenerator": "^7.16.7",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "^7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "^7.27.1",
     "@babel/preset-typescript": "^7.27.1",
-    "@babel/eslint-parser": "7.28.0",
     "babel-loader": "^8.0.0-beta.4",
     "@svgr/webpack": "^8.1.0",
     "clean-webpack-plugin": "^4.0.0",
     "copy-webpack-plugin": "^10.2.0",
     "cross-env": "^7.0.3",
     "dotenv": "^14.1.0",
-    "eslint": "^8.39.0",
-    "eslint-loader": "^2.0.0",
     "webpack": "5.89.0",
     "webpack-merge": "^5.7.3",
     "webpack-cli": "^5.0.2"

platform/core/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/core
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/core
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/core

platform/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/core",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "Generic business logic for web-based medical imaging applications",
   "author": "OHIF Core Team",
   "license": "MIT",
@@ -39,8 +39,8 @@
     "@cornerstonejs/codec-openjph": "2.4.7",
     "@cornerstonejs/core": "4.15.29",
     "@cornerstonejs/dicom-image-loader": "4.15.29",
-    "@ohif/ui": "3.12.0-beta.135",
-    "cornerstone-math": "0.1.9",
+    "@ohif/ui": "3.12.2",
+    "cornerstone-math": "0.1.10",
     "dicom-parser": "1.8.21"
   },
   "dependencies": {

platform/docs/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package ohif-docs
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package ohif-docs
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package ohif-docs

platform/docs/docs/configuration/configurationFiles.md

@@ -312,6 +312,18 @@ reasons:
 However, if you would like to get compressed data in a specific transfer syntax, you can modify the `acceptHeader` configuration or
 `requestTransferSyntaxUID` configuration.
 
+### Data Source: stackRetrieveOptions
+At the data source configuration level, you can set `stackRetrieveOptions` to customize Cornerstone stack image retrieval. Merged with defaults; only specify overrides. For example, set `streaming: false` when the data source returns uncompressed DICOM (e.g. `application/octet-stream` only) to avoid black image on load:
+
+```js
+configuration: {
+  acceptHeader: ['application/octet-stream'],
+  stackRetrieveOptions: {
+    retrieveOptions: { single: { streaming: false } },
+  },
+}
+```
+
 ## Environment Variables
 
 We use environment variables at build and dev time to change the Viewer's

platform/docs/docs/deployment/authorization.md

@@ -66,6 +66,56 @@ http://localhost:3000/viewer?StudyInstanceUIDs=1.2.3.4.5.6.6.7&token=e123125jsdf
 
 
 
+## Securing dynamic datasource URLs
+When using `dicomwebproxy` or `dicomjson` data sources with a runtime `?url=...` query parameter,
+configure explicit trust boundaries to prevent credential exfiltration.
+
+Use these datasource configuration options:
+
+- `dangerouslyAllowedOriginsForAuthenticatedEnvironments`: Origin allowlist used only when the viewer is running in an authenticated environment. Entries may use `http://` or `https://` and can include localhost origins.
+
+Allowed entry format for `dangerouslyAllowedOriginsForAuthenticatedEnvironments`:
+
+- Must be a bare origin only: `scheme://host[:port]`
+- `http://` and `https://` are both allowed
+- Localhost is allowed when explicitly listed (for example, `http://localhost:5000`)
+- Must not include username/password, path, query string, or hash
+- Invalid entries are ignored and logged as misconfigured
+
+Policy summary:
+
+- In unauthenticated environments, any HTTP(S) `?url=` origin is allowed.
+- In authenticated environments, same-origin `?url=` values are allowed by default.
+- In authenticated environments, cross-origin `?url=` values must be present in `dangerouslyAllowedOriginsForAuthenticatedEnvironments`, otherwise loading fails closed.
+- In unauthenticated environments, cross-origin config URLs are fetched with:
+  - `method: 'GET'`
+  - `mode: 'cors'`
+  - `credentials: 'omit'`
+  - `redirect: 'error'`
+  - `referrerPolicy: 'no-referrer'`
+- In unauthenticated environments, same-origin config URLs use a plain `fetch()` call (browser default `credentials: 'same-origin'`).
+- Same-origin config URLs are fetched using simple fetch behavior (so same-origin session/cookie auth is preserved).
+- In authenticated environments, allowlisted cross-origin config URLs are fetched using simple fetch behavior.
+- Returned datasource configuration payloads are consumed as-is (no additional URL/config scrubbing).
+
+Example:
+
+```js
+dataSources: [
+  {
+    namespace: '@ohif/extension-default.dataSourcesModule.dicomwebproxy',
+    sourceName: 'dicomwebproxy',
+    configuration: {
+      name: 'dicomwebproxy',
+      dangerouslyAllowedOriginsForAuthenticatedEnvironments: [
+        'https://config.example.com',
+        'http://localhost:5000',
+      ],
+    },
+  },
+]
+```
+
 ## Implicit Flow vs Authorization Code Flow
 
 The Viewer supports both the Implicit Flow and the Authorization Code Flow. The Implicit Flow is the default currently, as it is easier to set up and use. However, you can opt for better security by using the Authorization Code Flow. To do so, add `useAuthorizationCodeFlow` to the configuration and change the `response_type` from `id_token token` to `code`.

platform/docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ohif-docs",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "private": true,
   "scripts": {
     "docusaurus": "docusaurus",
@@ -97,6 +97,12 @@
     "url-loader": "4.1.1"
   },
   "resolutions": {
-    "qs": "6.14.1"
+    "qs": "6.14.1",
+    "lodash": "4.17.23",
+    "webpack": "5.105.0",
+    "sharp": "0.34.5",
+    "serialize-javascript": "7.0.4",
+    "rollup": "2.80.0",
+    "svgo": "3.3.3"
   }
 }

platform/i18n/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/i18n
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/i18n
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/i18n

platform/i18n/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/i18n",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "Internationalization library for The OHIF Viewer",
   "author": "OHIF",
   "license": "MIT",

platform/ui-next/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/ui-next
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/ui-next
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/ui-next

platform/ui-next/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/ui-next",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "Next version of OHIF Viewers UI, more customizable using shadcn/ui",
   "main": "dist/ohif-ui-next.umd.js",
   "module": "src/index.ts",

platform/ui/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/ui
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/ui
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/ui

platform/ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/ui",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.2",
   "description": "A set of React components for Medical Imaging Viewers",
   "author": "OHIF Contributors",
   "license": "MIT",
@@ -58,8 +58,7 @@
     "react-test-renderer": "18.3.1",
     "react-window": "1.8.11",
     "react-with-direction": "1.4.0",
-    "swiper": "8.4.7",
-    "webpack": "5.95.0"
+    "webpack": "5.105.0"
   },
   "devDependencies": {
     "@babel/core": "7.28.0",

publish-version.mjs

@@ -62,27 +62,40 @@ async function run() {
 
   console.log('Committing and pushing changes...');
   await execa('git', ['add', '-A']);
-  await execa('git', ['commit', '-m', 'chore(version): version.json [skip ci]']);
-  await execa('git', ['push', 'origin', branchName]);
+
+  // On re-runs after a partial release the peer-dep updates above are no-ops,
+  // leaving nothing staged. Skip the commit/push so the script stays idempotent.
+  const { stdout: stagedFiles } = await execa('git', ['diff', '--cached', '--name-only']);
+  if (stagedFiles.trim()) {
+    await execa('git', ['commit', '-m', 'chore(version): version.json [skip ci]']);
+    await execa('git', ['push', 'origin', branchName]);
+  } else {
+    console.log('No peer-dependency changes to commit, skipping');
+  }
 
   console.log('Setting the version using lerna...');
 
-  // add a message to the commit to indicate that the version was set using lerna
-  await execa('npx', [
-    'lerna',
-    'version',
-    nextVersion,
-    '--yes',
-    '--exact',
-    '--force-publish',
-    '--message',
-    'chore(version): Update package versions [skip ci]',
-    '--conventional-commits',
-    '--create-release',
-    'github',
-  ]);
+  // Skip lerna version if package versions already match the target (e.g. a
+  // previous release run finished the version bump but failed before publish).
+  if (lernaJson.version !== nextVersion.trim()) {
+    await execa('npx', [
+      'lerna',
+      'version',
+      nextVersion,
+      '--yes',
+      '--exact',
+      '--force-publish',
+      '--message',
+      'chore(version): Update package versions [skip ci]',
+      '--conventional-commits',
+      '--create-release',
+      'github',
+    ]);
 
-  console.log('Version set using lerna');
+    console.log('Version set using lerna');
+  } else {
+    console.log(`Already at target version ${nextVersion.trim()}, skipping lerna version`);
+  }
 }
 
 run().catch(err => {

version.json

@@ -1,4 +1,4 @@
 {
-  "version": "3.12.0-beta.135",
-  "commit": "45739b31a2c72cb646c733929f733a8e180a616c"
+  "version": "3.12.2",
+  "commit": "75a24a33935bda8779da30ef9b725b387d80723d"
 }

version.txt

@@ -1 +1 @@
-3.12.0-beta.135
+3.12.2