* Add customization URL parameter
* fix: Preserve should be customizeable
* Update customizations docs
* fix: Overlay items on patient name
* Add customization test
* Fix resolve to absolute path
* fix: Warn on no data in load
* Remove unused customization stuff
* fix: PR comments
* Update stored parameters to only use an array for mulitples
* Remove requires ohif.* special call out
* Remove strict mode
* PR comments
* Document segmentation examples
* Add three examples as requested
* PR comments
* lock
* Remove old customizatoin export
* fix: Ordering issues on customization loads
* fix: Use correct default for dev builds app config
* Fixes for conflicts
* chore: restore pnpm-lock.yaml to match master
The lockfile diff was incidental peer-descriptor churn and carried no
functional dependency change. It tripped the CircleCI security-audit gate
(which only runs when pnpm-lock.yaml is in the PR diff), surfacing a
pre-existing critical `decompress` transitive vuln that also exists on
master. Restoring master's lockfile removes the audit trigger.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ci): restore json5 lockfile entry; ignore unfixable decompress GHSA
The previous commit restored pnpm-lock.yaml from master, which dropped the
json5@2.2.3 entry that platform/core legitimately depends on (JSONC parsing
for the customization feature). That broke `--frozen-lockfile` install
(ERR_PNPM_OUTDATED_LOCKFILE). This restores the correct lockfile.
Because the lockfile must change (json5), the CircleCI security-audit gate
runs and previously failed on a critical `decompress` <=4.2.1 zip-slip
advisory. This is a pre-existing transitive vuln (present on master too) with
no published patch — decompress's latest release is 4.2.1, so no version
bump/override can resolve it. It reaches the tree only via @itk-wasm/dam, a
build/data-asset extraction tool under @cornerstonejs/labelmap-interpolation.
Add GHSA-mp2f-45pm-3cg9 to the existing pnpm-workspace.yaml auditConfig
ignoreGhsas accepted-risk list, matching how the repo already exempts other
build-tooling advisories. `pnpm audit --audit-level high` now passes locally
(1 critical ignored, 0 high).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test(e2e): fix visitStudy URL encoding that broke mpr2 study load
The visitStudy rewrite (added for the ?customization= option) built the URL
with new URLSearchParams({ StudyInstanceUIDs: studyInstanceUID }), which
percent-encodes the value. mpr2.spec.ts embeds an extra param in the UID
string ('<uid>&hangingprotocolid=mpr'), so the & and = were encoded and the
whole thing collapsed into one invalid StudyInstanceUIDs value -> the study
could not be found ('studies are not available'), the viewer never rendered,
and the side-panel-header-right click timed out.
Restore master's raw concatenation for StudyInstanceUIDs (so embedded params
survive as separate query params) while still appending the customization
option separately. Only mpr2 embeds & in the UID, matching the single failure.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* PR comments
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- move authenticated rendered media loading into the datasource\n- route DICOM video display sets through Cornerstone video viewports\n- add a 3.12 to 3.13 migration note for the removed DICOM-video viewport namespace
* Fix: Segmentation "Hide All" fails when switching from 2D to 3D four-up viewport
* Update based on the review comment on segmentation load in 3d fourup
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* fix: simplify the conditional logic
* fix: playwright test
* fix: playwright test
* fix: render timeout in test
---------
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: Belbin-GK <150322972+Belbin-GK@users.noreply.github.com>
Co-authored-by: Devu Jayalekshmi <devu.jayalekshmi@trenser.com>
Co-authored-by: Bill Wallace <wayfarer3130@gmail.com>
Testing this needs a release and there are no functional changes, only pnpm migration issues, so merging early for test.
* fix: pnpm related dependency bugs - nothing funcitonal
* Undo peer dependency due to non-pnpm integration issues
This is a fix to pnpm deployment which needs testing as the final part of origin/master release
No functional changes
* fix(docs): remove stray tool-call tags breaking the MDX build
platform/docs/docs/migration-guide/3p12-to-3p13/build-tooling.md ended with
two orphan closing tags (leftover tool-call serialization artifacts):
</content>
</invoke>
Docusaurus compiles Markdown as MDX (JSX-aware), so the orphan closing tag
failed the docs build:
MDX compilation failed ... Unexpected closing slash in tag, expected an
open tag first (build-tooling.md line 402)
This was the remaining blocker for build-and-deploy-docs once the
--no-frozen-lockfile change let the install step succeed. A scan of the docs
tree found no other such artifacts. Verified locally: docusaurus build now
generates static files with no MDX errors.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Update lockfile and avoid freshness check on every command
* fix(release): keep workspace:* in the repo, concretize only at publish
The release flow rewrote internal @ohif/* dependency specifiers to the concrete
version and committed them, so pnpm-lock.yaml (which records workspace links)
drifted from the manifests on every version bump. The resulting
ERR_PNPM_OUTDATED_LOCKFILE broke every frozen install: Netlify (viewer-dev),
the docs deploy, pnpm's pre-run deps check, and post-merge installs.
Keep workspace:* everywhere in the committed repo and move the concrete-version
substitution to publish time only:
- publish-version.mjs: bump each package's own `version` field only; stop
rewriting @ohif/* dependency/peerDependency specifiers.
- publish-package.mjs: publish with `pnpm publish --no-git-checks` instead of
`npm publish`. pnpm rewrites workspace:* to the exact version in the published
tarball; npm would publish the literal "workspace:*", which npm/yarn consumers
cannot resolve.
- One-time: revert the 25 workspace manifests' @ohif/* specifiers to workspace:*
(version fields untouched) and regenerate pnpm-lock.yaml to match.
Because internal deps are workspace:* (links, not versions in the lockfile),
version bumps no longer change pnpm-lock.yaml, so it stays in sync and frozen
installs keep working.
Verified: `pnpm install --frozen-lockfile` passes, and `pnpm pack` of @ohif/core
emits a tarball whose @ohif/ui dependency is the exact version (3.13.0-beta.92),
not workspace:*.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(ci): correct build-docs install comment for workspace:* release flow
publish-version.mjs no longer rewrites @ohif/* deps to concrete versions, so
the old comment was stale. Internal deps stay workspace:* and the lockfile
stays consistent; pnpm publish concretizes only the published tarball.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci(docs): use --frozen-lockfile now that the lockfile no longer drifts
With internal deps as workspace:* the lockfile stays in sync across version
bumps, so the docs deploy can install frozen -- failing fast on genuine
lockfile drift instead of silently reconciling. The --no-frozen-lockfile
workaround is no longer needed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci: use --frozen-lockfile in CI install steps now that the lockfile is stable
Internal @ohif/* deps are workspace:* so pnpm-lock.yaml no longer drifts; the
UNIT_TESTS/BUILD/NPM_PUBLISH installs can run frozen and fail fast on genuine
drift. Kept --no-frozen-lockfile only where it is still required: the Dockerfile
(platform/docs is excluded from the build context) and the playwright CS3D-version
step (mutates @cornerstonejs versions before installing).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test: stability of seg load mpr test
* Better drag fix for crosshairs
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merging for testing since this can't be tested without a merge to master
fix(ci): use --no-frozen-lockfile for docs deploy (pnpm migration)
The Build and Deploy Docs workflow ran `pnpm install --frozen-lockfile` and
failed on every master push after the pnpm migration:
[ERR_PNPM_OUTDATED_LOCKFILE] pnpm-lock.yaml is not up to date with
platform/core/package.json
- @ohif/ui (lockfile: workspace:*, manifest: 3.13.0-beta.90)
publish-version.mjs rewrites @ohif/* workspace deps from "workspace:*" to the
concrete release version and commits that bump to master, so the committed
manifests intentionally drift from pnpm-lock.yaml. Every CircleCI job already
passes --no-frozen-lockfile for exactly this reason (pnpm-workspace.yaml sets
frozenLockfile:true as the default); the docs workflow was the lone job still
using frozen and so broke the docs deploy.
Switch the docs install to --no-frozen-lockfile to match the rest of CI.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@
* fix(ci): write npm auth token to ~/.npmrc so publishes authenticate
NPM_PUBLISH wrote the registry auth token to ~/repo/.npmrc (the repo root),
but publish-package.mjs does process.chdir(packageDirectory) and runs
`npm publish` from inside each package (platform/ui, extensions/*, ...). npm
reads the project .npmrc from that package dir and the user .npmrc from
$HOME -- it never walks up to ~/repo/.npmrc -- so every publish failed with
ENEEDAUTH ("need auth ... requires you to be logged in").
publish-package.mjs catches and swallows per-package publish errors, so
NPM_PUBLISH still exited 0 and reported green; the breakage was silent. As a
result no @ohif/* package newer than 3.13.0-beta.89 (the last publish before
the pnpm migration) reached npm -- beta.90 and beta.91 are missing and the
beta dist-tag is stuck at beta.89.
Write the token to ~/.npmrc (npm per-user config, read regardless of cwd)
instead. This also stops clobbering the committed workspace-config .npmrc
(node-linker=hoisted) at the repo root, which the in-job pnpm install/build
relies on. Applied to all three auth steps for consistency.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(docker): copy preinstall.js before pnpm install in builder stage
The builder stage copies only the package.json manifests, runs
`pnpm install --no-frozen-lockfile`, and copies the rest of the source
afterward (for layer caching). But the root package.json defines a
"preinstall" lifecycle script (node preinstall.js) that pnpm runs at the
start of install -- before the source copy -- so the script file was absent
and install aborted:
. preinstall$ node preinstall.js
Error: Cannot find module '/usr/src/app/preinstall.js' (MODULE_NOT_FOUND)
ERROR: process "pnpm install --no-frozen-lockfile" did not complete
This surfaced once the .npmrc COPY fix (#6076) let the build advance past
the earlier COPY failure. preinstall.js is self-contained (it no-ops without
GITHUB_TOKEN and guards the AGENTS.md/CLAUDE.md symlink with existsSync), so
copying just the script into the early manifest layer is sufficient.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(build): declare postcss plugins in platform/app for Docker build
The shared root postcss.config.js (which platform/app re-exports) loads
postcss-import, postcss-preset-env, and cssnano, but none were declared in
platform/app or the root. They only reached node_modules by being hoisted
from platform/docs (postcss-import, postcss-preset-env) and transitively
(cssnano). The Docker image excludes platform/docs via .dockerignore and
libs/@cornerstonejs is not a workspace member, so under pnpm's stricter
node-linker=hoisted the app build failed to resolve the plugins:
Loading PostCSS "postcss-preset-env" plugin failed:
Cannot find module 'postcss-preset-env'
(The accompanying "Can't resolve assets/woff2/latin.woff2" error was a
cascade from the broken PostCSS chain and clears with this fix.)
Declare the three plugins the config explicitly loads as devDependencies of
platform/app, pinned to the versions already resolved by working builds
(postcss-import@14.1.0, postcss-preset-env@7.8.3, cssnano@5.1.15), so the
build no longer depends on incidental hoisting from docs.
The lockfile was regenerated against a workspace:* baseline so the only
@ohif change is none -- the diff adds just the postcss plugin trees, keeping
specifiers at workspace:* per the repo's convention. Verified by building the
full Docker image locally: rspack compiles with 0 errors and the image
exports successfully.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@
fix(ci): restore committed .npmrc in Docker build jobs (pnpm migration)
The pnpm migration (#6031) made the Dockerfile COPY .npmrc into the
builder stage because pnpm needs the workspace config it carries
(node-linker=hoisted, link-workspace-packages). But the Docker jobs still
ran `rm -f ./.npmrc` immediately before `docker build` -- a leftover from
when .npmrc only held npm credentials. NPM_PUBLISH overwrites the tracked
.npmrc with a publish auth token and persists it to the workspace, so the
Docker jobs deleted the file the Dockerfile requires:
ERROR [builder 6/13] COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
failed to compute cache key: "/.npmrc": not found
DEPLOY_MASTER therefore failed at DOCKER_BETA_PUBLISH on every master
build after the migration (NPM_PUBLISH still pushed the version bump first,
so npm packages shipped but the latest-beta image never did -- leaving
viewer-dev.ohif.org stuck on the prior beta).
Replace `rm -f ./.npmrc` with `git checkout -- .npmrc` in the four Docker
*build* jobs so the committed, token-free workspace-config .npmrc is
restored before the build. The two manifest jobs keep `rm` since they do
not build from the Dockerfile.
@
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
