From 1009c6091107d2db0768622120f916208a391343 Mon Sep 17 00:00:00 2001
From: Joe Boccanfuso <109477394+jbocce@users.noreply.github.com>
Date: Fri, 24 Oct 2025 16:48:35 -0400
Subject: [PATCH] fix(security): For bun, enforce frozen lockfile. For yarn,
 strongly suggest using frozen lockfile. (#5508)

* Updated docs for security information.
---
 .circleci/config.yml                          |  2 +-
 .netlify/build-deploy-preview.sh              |  2 +-
 README.md                                     | 11 +++++--
 bunfig.toml                                   |  2 ++
 bunfig.update-lockfile.toml                   |  2 ++
 package.json                                  |  5 ++-
 .../Nginx-Dcm4chee-Keycloak/dockerfile        |  2 +-
 .../app/.recipes/Nginx-Dcm4chee/dockerfile    |  2 +-
 .../Nginx-Orthanc-Keycloak/dockerfile         |  2 +-
 .../app/.recipes/Nginx-Orthanc/dockerfile     |  2 +-
 platform/app/README.md                        |  2 +-
 platform/cli/src/index.js                     |  4 +--
 platform/core/README.md                       |  2 +-
 platform/docs/README.md                       |  2 +-
 .../configuration/dataSources/dicom-json.md   |  2 +-
 .../configuration/dataSources/dicom-web.md    |  2 +-
 .../configuration/dataSources/static-files.md |  2 +-
 platform/docs/docs/deployment/azure.md        |  3 +-
 .../docs/deployment/build-for-production.md   |  2 +-
 .../deployment/google-cloud-healthcare.md     |  2 +-
 .../docs/docs/development/getting-started.md  | 33 ++++++++++++++++++-
 platform/docs/docs/development/testing.md     |  2 +-
 .../3p9-to-3p10/1-General/general-m.md        |  2 +-
 .../configuration/dataSources/dicom-web.md    |  2 +-
 24 files changed, 69 insertions(+), 25 deletions(-)
 create mode 100644 bunfig.toml
 create mode 100644 bunfig.update-lockfile.toml

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5df62e047..c631070a1 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -371,7 +371,7 @@ jobs:
           name: Export Display Variable
           command: export DISPLAY=:99
       - cypress/install:
-          install-command: yarn install --no-save
+          install-command: yarn install --frozen-lockfile --no-save
       - cypress/run-tests:
           cypress-command: |
             npx wait-on@latest http://localhost:3000 && cd platform/app && npx cypress run --record --parallel
diff --git a/.netlify/build-deploy-preview.sh b/.netlify/build-deploy-preview.sh
index 4aafd667f..84ab04ebc 100755
--- a/.netlify/build-deploy-preview.sh
+++ b/.netlify/build-deploy-preview.sh
@@ -19,7 +19,7 @@ echo 'Web application built and copied'
 
 # Build && Move Docusaurus Output (for the docs themselves)
 cd platform/docs
-yarn install
+yarn install --frozen-lockfile
 yarn run build
 cd ../..
 mkdir -p ./.netlify/www/docs
diff --git a/README.md b/README.md
index 8fb742793..8a6b82eca 100644
--- a/README.md
+++ b/README.md
@@ -147,7 +147,14 @@ Here is a schematic representation of our development workflow:
 3. Navigate to the cloned project's directory
 4. Add this repo as a `remote` named `upstream`
    - `git remote add upstream https://github.com/OHIF/Viewers.git`
-5. `yarn install` to restore dependencies and link projects
+5. `yarn install --frozen-lockfile` to restore dependencies and link projects
+
+:::danger
+In general run `yarn install` with the `--frozen-lockfile` flag to help avoid
+supply chain attacks by enforcing reproducible dependencies. That is, if the
+`yarn.lock` file is clean and does NOT reference compromised packages, then
+no compromised packages should land on your machine by using this flag.
+:::
 
 #### To Develop
 
@@ -158,7 +165,7 @@ _From this repository's root directory:_
 yarn config set workspaces-experimental true
 
 # Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 ```
 
 ## Commands
diff --git a/bunfig.toml b/bunfig.toml
new file mode 100644
index 000000000..3bfa86454
--- /dev/null
+++ b/bunfig.toml
@@ -0,0 +1,2 @@
+[install]
+frozenLockfile = true
diff --git a/bunfig.update-lockfile.toml b/bunfig.update-lockfile.toml
new file mode 100644
index 000000000..c4961dc06
--- /dev/null
+++ b/bunfig.update-lockfile.toml
@@ -0,0 +1,2 @@
+[install]
+frozenLockfile = false
diff --git a/package.json b/package.json
index b2abce6c5..6f49a4cdf 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,10 @@
     "dev:dcm4chee": "lerna run dev:dcm4chee --stream",
     "dev:static": "lerna run dev:static --stream",
     "orthanc:up": "docker compose -f platform/app/.recipes/Nginx-Orthanc/docker-compose.yml up",
-    "install:dev": "cp -f yarn.lock addOns/yarn.lock && cd addOns && yarn install --modules-folder ../node_modules",
+    "install:dev": "cp -f yarn.lock addOns/yarn.lock && cd addOns && yarn install --frozen-lockfile --modules-folder ../node_modules",
+    "install:update-lockfile": "yarn install && bun install --config=./bunfig.update-lockfile.toml",
+    "install:yarn:frozen-lockfile": "yarn install --frozen-lockfile",
+    "audit": "yarn audit || bun audit",
     "preinstall": "node preinstall.js",
     "start": "yarn run dev",
     "test": "yarn run test:unit",
diff --git a/platform/app/.recipes/Nginx-Dcm4chee-Keycloak/dockerfile b/platform/app/.recipes/Nginx-Dcm4chee-Keycloak/dockerfile
index 4182de82b..b37eac632 100644
--- a/platform/app/.recipes/Nginx-Dcm4chee-Keycloak/dockerfile
+++ b/platform/app/.recipes/Nginx-Dcm4chee-Keycloak/dockerfile
@@ -13,7 +13,7 @@ COPY ./ /usr/src/app/
 
 # Install node dependencies
 RUN yarn config set workspaces-experimental true
-RUN yarn install
+RUN yarn install --frozen-lockfile
 
 # Set the environment for the build
 ENV APP_CONFIG=config/docker-nginx-dcm4chee-keycloak.js
diff --git a/platform/app/.recipes/Nginx-Dcm4chee/dockerfile b/platform/app/.recipes/Nginx-Dcm4chee/dockerfile
index bbc6f89eb..1edd75c42 100644
--- a/platform/app/.recipes/Nginx-Dcm4chee/dockerfile
+++ b/platform/app/.recipes/Nginx-Dcm4chee/dockerfile
@@ -16,7 +16,7 @@ COPY ./ /usr/src/app/
 
 # Install node dependencies
 RUN yarn config set workspaces-experimental true
-RUN yarn install
+RUN yarn install --frozen-lockfile
 
 # Copy the rest of the application code
 
diff --git a/platform/app/.recipes/Nginx-Orthanc-Keycloak/dockerfile b/platform/app/.recipes/Nginx-Orthanc-Keycloak/dockerfile
index 7e8613529..f4cadb955 100644
--- a/platform/app/.recipes/Nginx-Orthanc-Keycloak/dockerfile
+++ b/platform/app/.recipes/Nginx-Orthanc-Keycloak/dockerfile
@@ -19,7 +19,7 @@ COPY ./ /usr/src/app/
 
 # Install node dependencies
 RUN yarn config set workspaces-experimental true
-RUN yarn install
+RUN yarn install --frozen-lockfile
 
 # Copy the rest of the application code
 
diff --git a/platform/app/.recipes/Nginx-Orthanc/dockerfile b/platform/app/.recipes/Nginx-Orthanc/dockerfile
index 846c74c31..9408701c5 100644
--- a/platform/app/.recipes/Nginx-Orthanc/dockerfile
+++ b/platform/app/.recipes/Nginx-Orthanc/dockerfile
@@ -16,7 +16,7 @@ COPY ./ /usr/src/app/
 
 # Install node dependencies
 RUN yarn config set workspaces-experimental true
-RUN yarn install
+RUN yarn install --frozen-lockfile
 
 # Copy the rest of the application code
 
diff --git a/platform/app/README.md b/platform/app/README.md
index f1e1dd135..9292d4953 100644
--- a/platform/app/README.md
+++ b/platform/app/README.md
@@ -80,7 +80,7 @@ In your cloned repository's root folder, run:
 
 ```js
 // Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 
 // Stands up local server to host Viewer.
 // Viewer connects to our public cloud PACS by default
diff --git a/platform/cli/src/index.js b/platform/cli/src/index.js
index d14445abb..ac53bdaea 100755
--- a/platform/cli/src/index.js
+++ b/platform/cli/src/index.js
@@ -156,7 +156,7 @@ program
     unlinkExtension(extensionName, { viewerDirectory });
     console.log(
       chalk.green(
-        `Successfully unlinked Extension ${extensionName} from the Viewer, don't forget to run yarn install --force`
+        `Successfully unlinked Extension ${extensionName} from the Viewer, don't forget to run yarn install --frozen-lockfile --force`
       )
     );
   });
@@ -179,7 +179,7 @@ program
     unlinkMode(modeName, { viewerDirectory });
     console.log(
       chalk.green(
-        `Successfully unlinked Mode ${modeName} from the Viewer, don't forget to run yarn install --force`
+        `Successfully unlinked Mode ${modeName} from the Viewer, don't forget to run yarn install --frozen-lockfile --force`
       )
     );
   });
diff --git a/platform/core/README.md b/platform/core/README.md
index ff8f55546..26ea61002 100644
--- a/platform/core/README.md
+++ b/platform/core/README.md
@@ -80,7 +80,7 @@ to program in isolation without a complex setup, and has the added benefit of
 producing well-tested business logic.
 
 1. Clone this repository
-2. Navigate to the project directory, and `yarn install`
+2. Navigate to the project directory, and `yarn install --frozen-lockfile`
 3. To begin making changes, `yarn run dev`
 4. To commit changes, run `yarn run cm`
 
diff --git a/platform/docs/README.md b/platform/docs/README.md
index 231a499c0..668b7eb0d 100644
--- a/platform/docs/README.md
+++ b/platform/docs/README.md
@@ -5,7 +5,7 @@ This website is built using [Docusaurus 2](https://docusaurus.io/), a modern sta
 ## Installation
 
 ```console
-yarn install
+yarn install --frozen-lockfile
 ```
 
 ## Local Development
diff --git a/platform/docs/docs/configuration/dataSources/dicom-json.md b/platform/docs/docs/configuration/dataSources/dicom-json.md
index a183c47d1..17dce2bed 100644
--- a/platform/docs/docs/configuration/dataSources/dicom-json.md
+++ b/platform/docs/docs/configuration/dataSources/dicom-json.md
@@ -156,7 +156,7 @@ inside your `public` folder. Since files are served from your local server the
 the dicom files will be
 `dicomweb:http://localhost:3000/LIDC-IDRI-0001/01-01-2000-30178/3000566.000000-03192/1-001.dcm`.
 
-After `yarn install` and running `yarn dev` and opening the browser at
+After `yarn install --frozen-lockfile` and running `yarn dev` and opening the browser at
 `http://localhost:3000/viewer/dicomjson?url=http://localhost:3000/LIDC-IDRI-0001.json`
 will display the viewer.
 
diff --git a/platform/docs/docs/configuration/dataSources/dicom-web.md b/platform/docs/docs/configuration/dataSources/dicom-web.md
index b04c11983..1f7fab230 100644
--- a/platform/docs/docs/configuration/dataSources/dicom-web.md
+++ b/platform/docs/docs/configuration/dataSources/dicom-web.md
@@ -88,7 +88,7 @@ this repository's root directory, and run:
 yarn config set workspaces-experimental true
 
 # Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 
 # Run our dev command, but with the local orthanc config
 yarn run dev:orthanc
diff --git a/platform/docs/docs/configuration/dataSources/static-files.md b/platform/docs/docs/configuration/dataSources/static-files.md
index 7746935bf..19d2274a7 100644
--- a/platform/docs/docs/configuration/dataSources/static-files.md
+++ b/platform/docs/docs/configuration/dataSources/static-files.md
@@ -37,7 +37,7 @@ This project contains two main components:
 2. **Install Dependencies:**
 
     ```bash
-    yarn install
+    yarn install --frozen-lockfile
     ```
 
 ## Generating Static DICOMweb Files
diff --git a/platform/docs/docs/deployment/azure.md b/platform/docs/docs/deployment/azure.md
index 983eafa4c..b88ced684 100644
--- a/platform/docs/docs/deployment/azure.md
+++ b/platform/docs/docs/deployment/azure.md
@@ -162,7 +162,7 @@ Update the data source configuration file with your Azure Healthcare APIs detail
 
    ```bash
    cd OHIFViewer
-   yarn install
+   yarn install --frozen-lockfile
    APP_CONFIG=config/azure.js yarn run dev
    ```
 
@@ -175,4 +175,3 @@ Update the data source configuration file with your Azure Healthcare APIs detail
 - The `qidoRoot`, `wadoUriRoot`, and `wadoRoot` should point to your Azure DICOM service URL. Replace `{your-dicom-instance}` with your actual instance name.
 
 This setup allows OHIF to interact seamlessly with Azure's Healthcare APIs, enabling robust DICOM management and visualization.
-
diff --git a/platform/docs/docs/deployment/build-for-production.md b/platform/docs/docs/deployment/build-for-production.md
index f4521327f..4d9e608b4 100644
--- a/platform/docs/docs/deployment/build-for-production.md
+++ b/platform/docs/docs/deployment/build-for-production.md
@@ -38,7 +38,7 @@ Next run these commands:
 yarn config set workspaces-experimental true
 
 # Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 
 # Build source code for production
 yarn run build
diff --git a/platform/docs/docs/deployment/google-cloud-healthcare.md b/platform/docs/docs/deployment/google-cloud-healthcare.md
index 6fef07c6a..bee2a0aea 100644
--- a/platform/docs/docs/deployment/google-cloud-healthcare.md
+++ b/platform/docs/docs/deployment/google-cloud-healthcare.md
@@ -127,7 +127,7 @@ Images can even be transcoded on the fly if this is desired.
 
 ```bash
 cd OHIFViewer
-yarn install
+yarn install --frozen-lockfile
 APP_CONFIG=config/google.js yarn run dev
 ```
 
diff --git a/platform/docs/docs/development/getting-started.md b/platform/docs/docs/development/getting-started.md
index c23bc9bcf..4b814b34e 100644
--- a/platform/docs/docs/development/getting-started.md
+++ b/platform/docs/docs/development/getting-started.md
@@ -80,11 +80,17 @@ following commands:
 
 ```bash
 # Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 
 # Start local development server
 yarn run dev
 ```
+:::danger
+In general run `yarn install` with the `--frozen-lockfile` flag to help avoid
+supply chain attacks by enforcing reproducible dependencies. That is, if the
+`yarn.lock` file is clean and does NOT reference compromised packages, then
+no compromised packages should land on your machine by using this flag.
+:::
 
 You should see the following output:
 
@@ -113,6 +119,31 @@ You should see the following output:
 yarn run build
 ```
 
+### Updating Dependencies
+In general you will typically not be updating the various `package.json` files.
+But for the case when you do, you will have to also update the various OHIF lock files
+and as such you will have to do both a `yarn` and `bun` `install` without
+the `--frozen-lockfile` flag.
+
+:::danger
+Updating the package.json must be done with care so as to avoid incorporating
+vulnerable, third-party packages and/or versions. Please research the added
+packages and/or versions for vulnerabilities.
+
+Here is what you should do when adding new packages and/or versions prior to
+committing and pushing your code:
+1. Do your due diligence researching the added packages and/or versions for vulnerabilities.
+2. Update the `package.json` files.
+3. Execute `yarn run install:update-lockfile`. This updates both the `yarn.lock` and
+the `bun.lock` files.
+4. Execute `yarn run audit` for a last security check. This runs both `yarn audit` and
+`bun audit`.
+6. Include both the `yarn.lock` and `bun.lock` files as part of your commit.
+
+If any of your research or auditing for vulnerabilities find HIGH risk vulnerabilities
+do NOT commit or push your changes! Low and moderate risk vulnerabilities are acceptable.
+:::
+
 ## Troubleshooting
 
 - If you receive a _"No Studies Found"_ message and do not see your studies, try
diff --git a/platform/docs/docs/development/testing.md b/platform/docs/docs/development/testing.md
index fb7322696..28b5ff8e9 100644
--- a/platform/docs/docs/development/testing.md
+++ b/platform/docs/docs/development/testing.md
@@ -20,7 +20,7 @@ To run the unit test:
 yarn run test:unit:ci
 ```
 
-Note: You should have already installed all the packages with `yarn install`.
+Note: You should have already installed all the packages with `yarn install --frozen-lockfile`.
 
 Running unit test will generate a report at the end showing the successful and
 unsuccessful tests with detailed explanations.
diff --git a/platform/docs/docs/migration-guide/3p9-to-3p10/1-General/general-m.md b/platform/docs/docs/migration-guide/3p9-to-3p10/1-General/general-m.md
index 6ff64c941..093244f39 100644
--- a/platform/docs/docs/migration-guide/3p9-to-3p10/1-General/general-m.md
+++ b/platform/docs/docs/migration-guide/3p9-to-3p10/1-General/general-m.md
@@ -57,7 +57,7 @@ yarn run dev
 
 After:
 ```bash
-yarn install
+yarn install --frozen-lockfile
 yarn run dev
 ```
 
diff --git a/platform/docs/versioned_docs/version-3.11/configuration/dataSources/dicom-web.md b/platform/docs/versioned_docs/version-3.11/configuration/dataSources/dicom-web.md
index b04c11983..1f7fab230 100644
--- a/platform/docs/versioned_docs/version-3.11/configuration/dataSources/dicom-web.md
+++ b/platform/docs/versioned_docs/version-3.11/configuration/dataSources/dicom-web.md
@@ -88,7 +88,7 @@ this repository's root directory, and run:
 yarn config set workspaces-experimental true
 
 # Restore dependencies
-yarn install
+yarn install --frozen-lockfile
 
 # Run our dev command, but with the local orthanc config
 yarn run dev:orthanc