othmane/ohif-viewer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): CVE-2026-27212 patched. Various dependency updates as a result of CVE-2026-26996. (#5830)

Browse Source 
fix(security):  CVE-2026-27212 patched.
Various dependency updates as a result of CVE-2026-26996.
Ultimately CVE-2026-26996 was ignored because it is only exposed in itk-wasm via CLI and OHIF's other use of minimatch is limited to build/dev environments.
This commit is contained in:
Joe Boccanfuso 2026-02-20 17:25:06 -05:00 committed by GitHub
parent 83e687fb02
commit 27229609cd
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
11 changed files with 2229 additions and 1173 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.circleci/config.yml
View File

@ -121,6 +121,8 @@ jobs:
# Define ignored vulnerabilities with comments
IGNORED_VULNS=(
"GHSA-3ppc-4f35-3m26" # CVE-2026-26996 - OHIF's use of minimatch via glob is safe because it does NOT use the CLI
# CVE-2026-26996 - OHIF's other uses of minimatch are strictly for building and CI/CD purposes
)
# Build ignore flags

18
addOns/externals/devDependencies/package.json vendored
View File

@ -20,7 +20,6 @@
"react-dom": "18.3.1"
},
"devDependencies": {
"@babel/eslint-parser": "7.28.0",
"@pmmmwh/react-refresh-webpack-plugin": "0.5.17",
"@rsbuild/core": "1.5.1",
"@rsbuild/plugin-node-polyfill": "1.4.2",
@ -28,30 +27,27 @@
"@svgr/webpack": "8.1.0",
"@swc/helpers": "0.5.17",
"@types/jest": "27.5.2",
"@typescript-eslint/eslint-plugin": "6.21.0",
"@typescript-eslint/parser": "6.21.0",
"@typescript-eslint/eslint-plugin": "8.56.0",
"@typescript-eslint/parser": "8.56.0",
"autoprefixer": "10.4.21",
"babel-loader": "8.4.1",
"babel-plugin-module-resolver": "5.0.2",
"clean-webpack-plugin": "3.0.0",
"copy-webpack-plugin": "9.1.0",
"cross-env": "7.0.3",
"css-loader": "6.11.0",
"dotenv": "8.6.0",
"eslint": "8.57.1",
"eslint": "10.0.1",
"eslint-config-prettier": "7.2.0",
"eslint-config-react-app": "6.0.0",
"eslint-config-react-app": "7.0.1",
"eslint-plugin-cypress": "2.15.2",
"eslint-plugin-flowtype": "7.0.0",
"eslint-plugin-import": "2.32.0",
"eslint-plugin-jsx-a11y": "6.10.2",
"eslint-plugin-node": "11.1.0",
"eslint-plugin-prettier": "5.5.1",
"eslint-plugin-promise": "5.2.0",
"eslint-plugin-promise": "7.2.1",
"eslint-plugin-react": "7.37.5",
"eslint-plugin-react-hooks": "4.6.2",
"eslint-plugin-react-hooks": "7.0.1",
"eslint-plugin-tsdoc": "0.2.17",
"eslint-webpack-plugin": "2.7.0",
"execa": "8.0.1",
"extract-css-chunks-webpack-plugin": "4.10.0",
"html-webpack-plugin": "5.6.3",
@ -72,7 +68,7 @@
"prettier-plugin-tailwindcss": "0.6.9",
"react-refresh": "0.14.2",
"semver": "7.7.2",
"serve": "14.2.4",
"serve": "14.2.5",
"shader-loader": "1.3.1",
"shx": "0.3.4",
"source-map-loader": "4.0.2",

1449
bun.lock
View File

File diff suppressed because it is too large Load Diff

4
extensions/usAnnotation/package.json
View File

@ -52,7 +52,6 @@
},
"devDependencies": {
"@babel/core": "7.28.0",
"@babel/eslint-parser": "7.28.0",
"@babel/plugin-syntax-dynamic-import": "7.8.3",
"@babel/plugin-transform-arrow-functions": "7.27.1",
"@babel/plugin-transform-class-properties": "7.27.1",
@ -67,13 +66,10 @@
"@babel/preset-typescript": "7.27.1",
"@svgr/webpack": "8.1.0",
"babel-loader": "8.4.1",
"babel-plugin-module-resolver": "5.0.2",
"clean-webpack-plugin": "3.0.0",
"copy-webpack-plugin": "9.1.0",
"cross-env": "7.0.3",
"dotenv": "8.6.0",
"eslint": "8.57.1",
"eslint-loader": "2.2.1",
"webpack": "5.105.0",
"webpack-cli": "5.1.4",
"webpack-merge": "5.10.0"

3
modes/segmentation/package.json
View File

@ -51,7 +51,6 @@
},
"devDependencies": {
"@babel/core": "7.28.0",
"@babel/eslint-parser": "7.28.0",
"@babel/plugin-syntax-dynamic-import": "7.8.3",
"@babel/plugin-transform-arrow-functions": "7.27.1",
"@babel/plugin-transform-class-properties": "7.27.1",
@ -69,8 +68,6 @@
"copy-webpack-plugin": "9.1.0",
"cross-env": "7.0.3",
"dotenv": "8.6.0",
"eslint": "8.57.1",
"eslint-loader": "2.2.1",
"webpack": "5.105.0",
"webpack-cli": "5.1.4",
"webpack-merge": "5.10.0"

3
modes/usAnnotation/package.json
View File

@ -43,7 +43,6 @@
},
"devDependencies": {
"@babel/core": "7.28.0",
"@babel/eslint-parser": "7.28.0",
"@babel/plugin-syntax-dynamic-import": "7.8.3",
"@babel/plugin-transform-arrow-functions": "7.27.1",
"@babel/plugin-transform-class-properties": "7.27.1",
@ -61,8 +60,6 @@
"copy-webpack-plugin": "9.1.0",
"cross-env": "7.0.3",
"dotenv": "8.6.0",
"eslint": "8.57.1",
"eslint-loader": "2.2.1",
"webpack": "5.105.0",
"webpack-cli": "5.1.4",
"webpack-merge": "5.10.0"

4
package.json
View File

@ -103,16 +103,14 @@
"@istanbuljs/nyc-config-typescript": "1.0.2",
"@pmmmwh/react-refresh-webpack-plugin": "0.5.17",
"babel-loader": "8.4.1",
"babel-plugin-istanbul": "7.0.0",
"babel-plugin-istanbul": "7.0.1",
"babel-plugin-transform-import-meta": "2.3.3",
"cross-env": "7.0.3",
"css-loader": "6.11.0",
"cypress": "14.5.2",
"cypress-file-upload": "5.0.8",
"file-loader": "6.2.0",
"istanbul": "0.4.5",
"nyc": "17.1.0",
"patch-package": "8.0.0",
"playwright-test-coverage": "1.2.12",
"postcss-loader": "6.2.1",
"prettier": "3.6.2",

4
platform/cli/templates/extension/dependencies.json
View File

@ -45,16 +45,12 @@
"@babel/preset-react": "^7.27.1",
"@babel/preset-typescript": "^7.27.1",
"@babel/plugin-transform-private-property-in-object": "^7.27.1",
"@babel/eslint-parser": "7.28.0",
"babel-loader": "^8.2.4",
"@svgr/webpack": "^8.1.0",
"babel-plugin-module-resolver": "^5.0.0",
"clean-webpack-plugin": "^4.0.0",
"copy-webpack-plugin": "^10.2.0",
"cross-env": "^7.0.3",
"dotenv": "^14.1.0",
"eslint": "^8.39.0",
"eslint-loader": "^2.0.0",
"webpack": "5.89.0",
"webpack-merge": "^5.7.3",
"webpack-cli": "^5.0.2"

3
platform/cli/templates/mode/dependencies.json
View File

@ -35,15 +35,12 @@
"@babel/preset-env": "7.28.0",
"@babel/preset-react": "^7.27.1",
"@babel/preset-typescript": "^7.27.1",
"@babel/eslint-parser": "7.28.0",
"babel-loader": "^8.0.0-beta.4",
"@svgr/webpack": "^8.1.0",
"clean-webpack-plugin": "^4.0.0",
"copy-webpack-plugin": "^10.2.0",
"cross-env": "^7.0.3",
"dotenv": "^14.1.0",
"eslint": "^8.39.0",
"eslint-loader": "^2.0.0",
"webpack": "5.89.0",
"webpack-merge": "^5.7.3",
"webpack-cli": "^5.0.2"

1
platform/ui/package.json
View File

@ -58,7 +58,6 @@
"react-test-renderer": "18.3.1",
"react-window": "1.8.11",
"react-with-direction": "1.4.0",
"swiper": "8.4.7",
"webpack": "5.105.0"
},
"devDependencies": {

1911
yarn.lock
View File

File diff suppressed because it is too large Load Diff