fix(security): For bun, enforce frozen lockfile. For yarn, strongly suggest using frozen lockfile. (#5508)

* Updated docs for security information.

.circleci/config.yml

@@ -371,7 +371,7 @@ jobs:
           name: Export Display Variable
           command: export DISPLAY=:99
       - cypress/install:
-          install-command: yarn install --no-save
+          install-command: yarn install --frozen-lockfile --no-save
       - cypress/run-tests:
           cypress-command: |
             npx wait-on@latest http://localhost:3000 && cd platform/app && npx cypress run --record --parallel

.netlify/build-deploy-preview.sh

@@ -19,7 +19,7 @@ echo 'Web application built and copied'
 
 # Build && Move Docusaurus Output (for the docs themselves)
 cd platform/docs
-yarn install
+yarn install --frozen-lockfile
 yarn run build
 cd ../..
 mkdir -p ./.netlify/www/docs

README.md

@@ -147,7 +147,14 @@ Here is a schematic representation of our development workflow:
 3. Navigate to the cloned project's directory
 4. Add this repo as a `remote` named `upstream`
    - `git remote add upstream https://github.com/OHIF/Viewers.git`
-5. `yarn install` to restore dependencies and link projects
+5. `yarn install --frozen-lockfile` to restore dependencies and link projects
+
+:::danger
+In general run `yarn install` with the `--frozen-lockfile` flag to help avoid
+supply chain attacks by enforcing reproducible dependencies. That is, if the
+`yarn.lock` file is clean and does NOT reference compromised packages, then
+no compromised packages should land on your machine by using this flag.
+:::
 
 #### To Develop
 
@@ -158,7 +165,7 @@ _From this repository's root directory:_
 yarn config set workspaces-experimental true
 
 # Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 ```
 
 ## Commands

bunfig.toml

@@ -0,0 +1,2 @@
+[install]
+frozenLockfile = true

bunfig.update-lockfile.toml

@@ -0,0 +1,2 @@
+[install]
+frozenLockfile = false

package.json

@@ -45,7 +45,10 @@
     "dev:dcm4chee": "lerna run dev:dcm4chee --stream",
     "dev:static": "lerna run dev:static --stream",
     "orthanc:up": "docker compose -f platform/app/.recipes/Nginx-Orthanc/docker-compose.yml up",
-    "install:dev": "cp -f yarn.lock addOns/yarn.lock && cd addOns && yarn install --modules-folder ../node_modules",
+    "install:dev": "cp -f yarn.lock addOns/yarn.lock && cd addOns && yarn install --frozen-lockfile --modules-folder ../node_modules",
+    "install:update-lockfile": "yarn install && bun install --config=./bunfig.update-lockfile.toml",
+    "install:yarn:frozen-lockfile": "yarn install --frozen-lockfile",
+    "audit": "yarn audit || bun audit",
     "preinstall": "node preinstall.js",
     "start": "yarn run dev",
     "test": "yarn run test:unit",

platform/app/.recipes/Nginx-Dcm4chee-Keycloak/dockerfile

@@ -13,7 +13,7 @@ COPY ./ /usr/src/app/
 
 # Install node dependencies
 RUN yarn config set workspaces-experimental true
-RUN yarn install
+RUN yarn install --frozen-lockfile
 
 # Set the environment for the build
 ENV APP_CONFIG=config/docker-nginx-dcm4chee-keycloak.js

platform/app/.recipes/Nginx-Dcm4chee/dockerfile

@@ -16,7 +16,7 @@ COPY ./ /usr/src/app/
 
 # Install node dependencies
 RUN yarn config set workspaces-experimental true
-RUN yarn install
+RUN yarn install --frozen-lockfile
 
 # Copy the rest of the application code
 

platform/app/.recipes/Nginx-Orthanc-Keycloak/dockerfile

@@ -19,7 +19,7 @@ COPY ./ /usr/src/app/
 
 # Install node dependencies
 RUN yarn config set workspaces-experimental true
-RUN yarn install
+RUN yarn install --frozen-lockfile
 
 # Copy the rest of the application code
 

platform/app/.recipes/Nginx-Orthanc/dockerfile

@@ -16,7 +16,7 @@ COPY ./ /usr/src/app/
 
 # Install node dependencies
 RUN yarn config set workspaces-experimental true
-RUN yarn install
+RUN yarn install --frozen-lockfile
 
 # Copy the rest of the application code
 

platform/app/README.md

@@ -80,7 +80,7 @@ In your cloned repository's root folder, run:
 
 ```js
 // Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 
 // Stands up local server to host Viewer.
 // Viewer connects to our public cloud PACS by default

platform/cli/src/index.js

@@ -156,7 +156,7 @@ program
     unlinkExtension(extensionName, { viewerDirectory });
     console.log(
       chalk.green(
-        `Successfully unlinked Extension ${extensionName} from the Viewer, don't forget to run yarn install --force`
+        `Successfully unlinked Extension ${extensionName} from the Viewer, don't forget to run yarn install --frozen-lockfile --force`
       )
     );
   });
@@ -179,7 +179,7 @@ program
     unlinkMode(modeName, { viewerDirectory });
     console.log(
       chalk.green(
-        `Successfully unlinked Mode ${modeName} from the Viewer, don't forget to run yarn install --force`
+        `Successfully unlinked Mode ${modeName} from the Viewer, don't forget to run yarn install --frozen-lockfile --force`
       )
     );
   });

platform/core/README.md

@@ -80,7 +80,7 @@ to program in isolation without a complex setup, and has the added benefit of
 producing well-tested business logic.
 
 1. Clone this repository
-2. Navigate to the project directory, and `yarn install`
+2. Navigate to the project directory, and `yarn install --frozen-lockfile`
 3. To begin making changes, `yarn run dev`
 4. To commit changes, run `yarn run cm`
 

platform/docs/README.md

@@ -5,7 +5,7 @@ This website is built using [Docusaurus 2](https://docusaurus.io/), a modern sta
 ## Installation
 
 ```console
-yarn install
+yarn install --frozen-lockfile
 ```
 
 ## Local Development

platform/docs/docs/configuration/dataSources/dicom-json.md

@@ -156,7 +156,7 @@ inside your `public` folder. Since files are served from your local server the
 the dicom files will be
 `dicomweb:http://localhost:3000/LIDC-IDRI-0001/01-01-2000-30178/3000566.000000-03192/1-001.dcm`.
 
-After `yarn install` and running `yarn dev` and opening the browser at
+After `yarn install --frozen-lockfile` and running `yarn dev` and opening the browser at
 `http://localhost:3000/viewer/dicomjson?url=http://localhost:3000/LIDC-IDRI-0001.json`
 will display the viewer.
 

platform/docs/docs/configuration/dataSources/dicom-web.md

@@ -88,7 +88,7 @@ this repository's root directory, and run:
 yarn config set workspaces-experimental true
 
 # Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 
 # Run our dev command, but with the local orthanc config
 yarn run dev:orthanc

platform/docs/docs/configuration/dataSources/static-files.md

@@ -37,7 +37,7 @@ This project contains two main components:
 2. **Install Dependencies:**
 
     ```bash
-    yarn install
+    yarn install --frozen-lockfile
     ```
 
 ## Generating Static DICOMweb Files

platform/docs/docs/deployment/azure.md

@@ -162,7 +162,7 @@ Update the data source configuration file with your Azure Healthcare APIs detail
 
    ```bash
    cd OHIFViewer
-   yarn install
+   yarn install --frozen-lockfile
    APP_CONFIG=config/azure.js yarn run dev
    ```
 
@@ -175,4 +175,3 @@ Update the data source configuration file with your Azure Healthcare APIs detail
 - The `qidoRoot`, `wadoUriRoot`, and `wadoRoot` should point to your Azure DICOM service URL. Replace `{your-dicom-instance}` with your actual instance name.
 
 This setup allows OHIF to interact seamlessly with Azure's Healthcare APIs, enabling robust DICOM management and visualization.
-

platform/docs/docs/deployment/build-for-production.md

@@ -38,7 +38,7 @@ Next run these commands:
 yarn config set workspaces-experimental true
 
 # Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 
 # Build source code for production
 yarn run build

platform/docs/docs/deployment/google-cloud-healthcare.md

@@ -127,7 +127,7 @@ Images can even be transcoded on the fly if this is desired.
 
 ```bash
 cd OHIFViewer
-yarn install
+yarn install --frozen-lockfile
 APP_CONFIG=config/google.js yarn run dev
 ```
 

platform/docs/docs/development/getting-started.md

@@ -80,11 +80,17 @@ following commands:
 
 ```bash
 # Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 
 # Start local development server
 yarn run dev
 ```
+:::danger
+In general run `yarn install` with the `--frozen-lockfile` flag to help avoid
+supply chain attacks by enforcing reproducible dependencies. That is, if the
+`yarn.lock` file is clean and does NOT reference compromised packages, then
+no compromised packages should land on your machine by using this flag.
+:::
 
 You should see the following output:
 
@@ -113,6 +119,31 @@ You should see the following output:
 yarn run build
 ```
 
+### Updating Dependencies
+In general you will typically not be updating the various `package.json` files.
+But for the case when you do, you will have to also update the various OHIF lock files
+and as such you will have to do both a `yarn` and `bun` `install` without
+the `--frozen-lockfile` flag.
+
+:::danger
+Updating the package.json must be done with care so as to avoid incorporating
+vulnerable, third-party packages and/or versions. Please research the added
+packages and/or versions for vulnerabilities.
+
+Here is what you should do when adding new packages and/or versions prior to
+committing and pushing your code:
+1. Do your due diligence researching the added packages and/or versions for vulnerabilities.
+2. Update the `package.json` files.
+3. Execute `yarn run install:update-lockfile`. This updates both the `yarn.lock` and
+the `bun.lock` files.
+4. Execute `yarn run audit` for a last security check. This runs both `yarn audit` and
+`bun audit`.
+6. Include both the `yarn.lock` and `bun.lock` files as part of your commit.
+
+If any of your research or auditing for vulnerabilities find HIGH risk vulnerabilities
+do NOT commit or push your changes! Low and moderate risk vulnerabilities are acceptable.
+:::
+
 ## Troubleshooting
 
 - If you receive a _"No Studies Found"_ message and do not see your studies, try

platform/docs/docs/development/testing.md

@@ -20,7 +20,7 @@ To run the unit test:
 yarn run test:unit:ci
 ```
 
-Note: You should have already installed all the packages with `yarn install`.
+Note: You should have already installed all the packages with `yarn install --frozen-lockfile`.
 
 Running unit test will generate a report at the end showing the successful and
 unsuccessful tests with detailed explanations.

platform/docs/docs/migration-guide/3p9-to-3p10/1-General/general-m.md

@@ -57,7 +57,7 @@ yarn run dev
 
 After:
 ```bash
-yarn install
+yarn install --frozen-lockfile
 yarn run dev
 ```
 

platform/docs/versioned_docs/version-3.11/configuration/dataSources/dicom-web.md

@@ -88,7 +88,7 @@ this repository's root directory, and run:
 yarn config set workspaces-experimental true
 
 # Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 
 # Run our dev command, but with the local orthanc config
 yarn run dev:orthanc