This is a fix to pnpm deployment which needs testing as the final part of origin/master release
No functional changes
* fix(docs): remove stray tool-call tags breaking the MDX build
platform/docs/docs/migration-guide/3p12-to-3p13/build-tooling.md ended with
two orphan closing tags (leftover tool-call serialization artifacts):
</content>
</invoke>
Docusaurus compiles Markdown as MDX (JSX-aware), so the orphan closing tag
failed the docs build:
MDX compilation failed ... Unexpected closing slash in tag, expected an
open tag first (build-tooling.md line 402)
This was the remaining blocker for build-and-deploy-docs once the
--no-frozen-lockfile change let the install step succeed. A scan of the docs
tree found no other such artifacts. Verified locally: docusaurus build now
generates static files with no MDX errors.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Update lockfile and avoid freshness check on every command
* fix(release): keep workspace:* in the repo, concretize only at publish
The release flow rewrote internal @ohif/* dependency specifiers to the concrete
version and committed them, so pnpm-lock.yaml (which records workspace links)
drifted from the manifests on every version bump. The resulting
ERR_PNPM_OUTDATED_LOCKFILE broke every frozen install: Netlify (viewer-dev),
the docs deploy, pnpm's pre-run deps check, and post-merge installs.
Keep workspace:* everywhere in the committed repo and move the concrete-version
substitution to publish time only:
- publish-version.mjs: bump each package's own `version` field only; stop
rewriting @ohif/* dependency/peerDependency specifiers.
- publish-package.mjs: publish with `pnpm publish --no-git-checks` instead of
`npm publish`. pnpm rewrites workspace:* to the exact version in the published
tarball; npm would publish the literal "workspace:*", which npm/yarn consumers
cannot resolve.
- One-time: revert the 25 workspace manifests' @ohif/* specifiers to workspace:*
(version fields untouched) and regenerate pnpm-lock.yaml to match.
Because internal deps are workspace:* (links, not versions in the lockfile),
version bumps no longer change pnpm-lock.yaml, so it stays in sync and frozen
installs keep working.
Verified: `pnpm install --frozen-lockfile` passes, and `pnpm pack` of @ohif/core
emits a tarball whose @ohif/ui dependency is the exact version (3.13.0-beta.92),
not workspace:*.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(ci): correct build-docs install comment for workspace:* release flow
publish-version.mjs no longer rewrites @ohif/* deps to concrete versions, so
the old comment was stale. Internal deps stay workspace:* and the lockfile
stays consistent; pnpm publish concretizes only the published tarball.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci(docs): use --frozen-lockfile now that the lockfile no longer drifts
With internal deps as workspace:* the lockfile stays in sync across version
bumps, so the docs deploy can install frozen -- failing fast on genuine
lockfile drift instead of silently reconciling. The --no-frozen-lockfile
workaround is no longer needed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci: use --frozen-lockfile in CI install steps now that the lockfile is stable
Internal @ohif/* deps are workspace:* so pnpm-lock.yaml no longer drifts; the
UNIT_TESTS/BUILD/NPM_PUBLISH installs can run frozen and fail fast on genuine
drift. Kept --no-frozen-lockfile only where it is still required: the Dockerfile
(platform/docs is excluded from the build context) and the playwright CS3D-version
step (mutates @cornerstonejs versions before installing).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test: stability of seg load mpr test
* Better drag fix for crosshairs
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merging for testing since this can't be tested without a merge to master
fix(ci): use --no-frozen-lockfile for docs deploy (pnpm migration)
The Build and Deploy Docs workflow ran `pnpm install --frozen-lockfile` and
failed on every master push after the pnpm migration:
[ERR_PNPM_OUTDATED_LOCKFILE] pnpm-lock.yaml is not up to date with
platform/core/package.json
- @ohif/ui (lockfile: workspace:*, manifest: 3.13.0-beta.90)
publish-version.mjs rewrites @ohif/* workspace deps from "workspace:*" to the
concrete release version and commits that bump to master, so the committed
manifests intentionally drift from pnpm-lock.yaml. Every CircleCI job already
passes --no-frozen-lockfile for exactly this reason (pnpm-workspace.yaml sets
frozenLockfile:true as the default); the docs workflow was the lone job still
using frozen and so broke the docs deploy.
Switch the docs install to --no-frozen-lockfile to match the rest of CI.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@
* fix(ci): write npm auth token to ~/.npmrc so publishes authenticate
NPM_PUBLISH wrote the registry auth token to ~/repo/.npmrc (the repo root),
but publish-package.mjs does process.chdir(packageDirectory) and runs
`npm publish` from inside each package (platform/ui, extensions/*, ...). npm
reads the project .npmrc from that package dir and the user .npmrc from
$HOME -- it never walks up to ~/repo/.npmrc -- so every publish failed with
ENEEDAUTH ("need auth ... requires you to be logged in").
publish-package.mjs catches and swallows per-package publish errors, so
NPM_PUBLISH still exited 0 and reported green; the breakage was silent. As a
result no @ohif/* package newer than 3.13.0-beta.89 (the last publish before
the pnpm migration) reached npm -- beta.90 and beta.91 are missing and the
beta dist-tag is stuck at beta.89.
Write the token to ~/.npmrc (npm per-user config, read regardless of cwd)
instead. This also stops clobbering the committed workspace-config .npmrc
(node-linker=hoisted) at the repo root, which the in-job pnpm install/build
relies on. Applied to all three auth steps for consistency.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(docker): copy preinstall.js before pnpm install in builder stage
The builder stage copies only the package.json manifests, runs
`pnpm install --no-frozen-lockfile`, and copies the rest of the source
afterward (for layer caching). But the root package.json defines a
"preinstall" lifecycle script (node preinstall.js) that pnpm runs at the
start of install -- before the source copy -- so the script file was absent
and install aborted:
. preinstall$ node preinstall.js
Error: Cannot find module '/usr/src/app/preinstall.js' (MODULE_NOT_FOUND)
ERROR: process "pnpm install --no-frozen-lockfile" did not complete
This surfaced once the .npmrc COPY fix (#6076) let the build advance past
the earlier COPY failure. preinstall.js is self-contained (it no-ops without
GITHUB_TOKEN and guards the AGENTS.md/CLAUDE.md symlink with existsSync), so
copying just the script into the early manifest layer is sufficient.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(build): declare postcss plugins in platform/app for Docker build
The shared root postcss.config.js (which platform/app re-exports) loads
postcss-import, postcss-preset-env, and cssnano, but none were declared in
platform/app or the root. They only reached node_modules by being hoisted
from platform/docs (postcss-import, postcss-preset-env) and transitively
(cssnano). The Docker image excludes platform/docs via .dockerignore and
libs/@cornerstonejs is not a workspace member, so under pnpm's stricter
node-linker=hoisted the app build failed to resolve the plugins:
Loading PostCSS "postcss-preset-env" plugin failed:
Cannot find module 'postcss-preset-env'
(The accompanying "Can't resolve assets/woff2/latin.woff2" error was a
cascade from the broken PostCSS chain and clears with this fix.)
Declare the three plugins the config explicitly loads as devDependencies of
platform/app, pinned to the versions already resolved by working builds
(postcss-import@14.1.0, postcss-preset-env@7.8.3, cssnano@5.1.15), so the
build no longer depends on incidental hoisting from docs.
The lockfile was regenerated against a workspace:* baseline so the only
@ohif change is none -- the diff adds just the postcss plugin trees, keeping
specifiers at workspace:* per the repo's convention. Verified by building the
full Docker image locally: rspack compiles with 0 errors and the image
exports successfully.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@
fix(ci): restore committed .npmrc in Docker build jobs (pnpm migration)
The pnpm migration (#6031) made the Dockerfile COPY .npmrc into the
builder stage because pnpm needs the workspace config it carries
(node-linker=hoisted, link-workspace-packages). But the Docker jobs still
ran `rm -f ./.npmrc` immediately before `docker build` -- a leftover from
when .npmrc only held npm credentials. NPM_PUBLISH overwrites the tracked
.npmrc with a publish auth token and persists it to the workspace, so the
Docker jobs deleted the file the Dockerfile requires:
ERROR [builder 6/13] COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
failed to compute cache key: "/.npmrc": not found
DEPLOY_MASTER therefore failed at DOCKER_BETA_PUBLISH on every master
build after the migration (NPM_PUBLISH still pushed the version bump first,
so npm packages shipped but the latest-beta image never did -- leaving
viewer-dev.ohif.org stuck on the prior beta).
Replace `rm -f ./.npmrc` with `git checkout -- .npmrc` in the four Docker
*build* jobs so the committed, token-free workspace-config .npmrc is
restored before the build. The two manifest jobs keep `rm` since they do
not build from the Dockerfile.
@
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Initial pnpm change
* Install/update in pnpm sort of works
* Attempt to fix install
* fix pnpm
* Refactor build process to use RSPack instead of Webpack across multiple extensions and modes. Update package.json scripts for development and production builds, and adjust webpack configuration files to accommodate new plugin imports and settings.
* Update RSPack dependencies to version 2.0.0 across the project, enhancing compatibility and performance. Refactor webpack configuration in multiple extensions and modes to utilize the new library structure for UMD output. Adjust package.json scripts and settings for improved build processes.
* Implement migration guide for OHIF 3.13, detailing the transition from Webpack to Rspack v2, the shift to pnpm workspaces, and the increase in minimum Node.js version to 24. Include new build commands, plugin replacements, and updates to package configurations across the monorepo.
* Fix some dev:fast bugs
* Move netlify to top level and remove webpack builds
* Update version script to deal with lerna missing
* chore(tests): Update multiple screenshot test images for various specs
* feat(screenshot-reviewer): Add screenshot review tool and update package.json scripts
* fix(DICOMSRDisplayTool): Improve actor presence check in viewport
* chore(tests): Update multiple screenshot assets for various specs
* chore(tests): Integrate waitForPaintToSettle and waitForViewportsRendered in multiple specs for improved rendering stability
* chore(tests): Update screenshot assets for SEGHydration and SEGNoHydration specs
* test: update progressive loading screenshots
* jest 30 test fixes for compatibility with pnpm cs3d
* Use correct setDisplaySets instead of setDataId
* fix: Naming change for LegacyVolumeViewport3D
* Update to allow tolerance for contour tests
* update
* fix
* refactor: Replace instanceof checks with utility functions for viewport type validation
* fix: Update createSegmentationForViewport to handle undefined displaySetInstanceUID gracefully
* bun lock
* chore(pnpm): align workspace setup to cornerstone3D and address PR review
- .npmrc / pnpm-workspace.yaml: mirror cs3d (node-linker hoisted,
strict-peer-dependencies=false, link/prefer workspace packages,
minimumReleaseAge, frozenLockfile); sync axios 1.17.0 + tmp override
- root: packageManager pnpm@11.4.0, engines pnpm >=11, wire preinstall.js
- restore preinstall.js (token/private-repo + CLAUDE->AGENTS symlink)
- playwright.yml: keep base CS3D-integration workflow, switch only the
package manager (bun/yarn -> pnpm) and node 20 -> 24
- webpack.base.js: revert prod devtool to source-map (drop hidden-source-map)
- remove @percy/cypress; .netlify + cli templates engines pnpm >=11
- Dockerfile pin pnpm@11; document tests/globalSetup.ts warmup
- drop dicom-sr -> measurement-tracking edge (breaks pnpm cyclic dep)
* chore(pnpm): regenerate lockfile and restore cs3d:* dev scripts
- Regenerate pnpm-lock.yaml against the resolved workspace (cycle removed,
cs3d 4.22.10, workspace:* internal deps).
- Restore cs3d:checkout/check/build/watch/install/link/unlink helper scripts
(dropped when taking the PR's root scripts), converted yarn -> pnpm since
the local cornerstone3D checkout is now pnpm too.
* Merge base branch issues
* Link ohif app
* ci: pin pnpm to 11.4.0 in action-setup (was version: latest)
version: latest floats across runs and breaks reproducibility. Pin to the repo's packageManager version (pnpm@11.4.0) in both playwright and build-docs workflows.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: Accidental commit of .npmrc config
* Fix build issues
* build fix
* Dependency fixes
* fix: Dependency bug in app on extensions/modes
* Fix output configuration
* Replace percy screenshots with native cypress
* Remove percy screenshot entirely
* fix: Build issues
* force click to prevent canvas cover issues
* Enable swiftshader
* Update launch of electron
* fix: Broken size calculation
* Empty change to force a re-build
* fix(cypress): generate ui-next tailwind classes; drop unsupported electron arg
Tailwind only scanned @ohif/ui-next via ../../node_modules/@ohif/ui-next, which no longer resolves under the pnpm layout, so ui-next-unique classes (e.g. toolbar split-button sizing) were never generated. Those buttons' hit-boxes collapsed, producing Cypress 'covered by element' failures on toolbar interactions. Scan ui-next by direct filesystem path like ui/extensions/modes.
Also stop pushing --enable-unsafe-swiftshader into Electron's launchOptions.args (Electron ignores it and warns); it is supplied via ELECTRON_EXTRA_LAUNCH_ARGS in CI. The arg is still pushed for non-electron chromium (local chrome).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(e2e): disable dev-server overlay during coverage runs
The rspack dev-server client overlay injects an iframe (id=rspack-dev-server-client-overlay) that intercepts pointer events, causing Playwright/Cypress clicks on toolbar buttons to time out (e.g. MicroscopyPanel). Disable the overlay when COVERAGE=true (e2e/Playwright webServer) while keeping it for normal local dev.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(microscopy): provide dicom-microscopy-viewer runtime assets
The microscopy viewer is loaded at runtime via peerImport('dicom-microscopy-viewer'), which fetches the copied asset served at /dicom-microscopy-viewer/. Two issues prevented those assets from reaching dist, so the viewer never initialized and drawing produced no measurement row:
1) dicom-microscopy-viewer was declared in no workspace package.json (only under libs/@cornerstonejs), so it was not installed at root node_modules and the pluginConfig copy source did not exist. Declare it (0.48.6, matching libs) in the microscopy extension.
2) createCopyPluginToDist appended the public/dist folder name to entries that specify an explicit directory, breaking the dicom-microscopy-viewer public entry (looked for .../dynamic-import/public). Use an explicit directory as-is; only append the folder name for package-derived entries.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Update to pnpm 11.5.2 and cs3d 5.0.2
* Lock file
* fix: Update to newer versions of actions to try to fix hang
* Remove unnecessary version
* fix: Tests that are flaky
* PR comments
* Incorrect run name
* docs: Explain pluginConfig tooling
* Updated notes on pluginConfig and PR comments
* fix: resolve plugins in rsbuild build and fix directory-based asset copy
rsbuild.config.ts: merge getPluginResolveAliases() and an @ohif/app$ alias into resolve.alias, and add resolve.modules (root, platform/app, platform/ui node_modules) so extensions resolve their shared @ohif/* imports. Brings the rsbuild (dev:fast) path to parity with webpack.pwa.js / webpack.base.js.
writePluginImportsFile.js: treat a 'directory' on an extension/mode entry as the package root and copy its public/ and dist/ subdirs instead of the whole directory; public-section entries keep copying their directory verbatim via a new literalDirectory flag.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor: share resolve alias/modules between webpack and rsbuild configs
Extract the resolve.alias (@ohif/app, @, @components, ...) and the node_modules search paths into .webpack/resolveConfig.js, the single source of truth consumed by both webpack.base.js (and every per-package webpack.prod/.dev.js that merges it) and rsbuild.config.ts. getModules(srcDir) appends the building package's own source root, preserving the previous per-package behavior. Ends the drift where the rsbuild path kept missing aliases/module paths that webpack.base.js already had.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Add a timeout on git fetch and avoid all the unnecessary mirrros
* PR comments and tests
* Remove cache to prevent corrupting the cache key/setup.
* Fix stale/corrupted pnpm installer
---------
Co-authored-by: Alireza <ar.sedghi@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Add combined build
* Link script location update
* Security and validation fixes
* Allow specifying target path in PR description
* fix: Version match
* Fix build detection issue
* fix: Playwright deploy
* Separate out the branch merge guard
* Update docs and link info
* test: Update the layout change to wait for network idle
* Move audit late so the rest of the build can be worked on
* Add text with network check to ensure we see this change is updated
* Attempt to fix the mpr loading on ohif-downstream
* PR review comments
* Update docs
* Update to CS3D 4.20.0
* PR comments
* Add log on ohif-integration builds
* Update build test
* Removed unused space to kickoff build
* chore(security): Update circleci config to only run bun audit for lockfile changes.
* Switched to eslint 9.39.3 for compatibility with .eslintrc.json.
* Disabled all dependabot pull requests for bun and npm version updates.
fix(security): CVE-2026-27212 patched.
Various dependency updates as a result of CVE-2026-26996.
Ultimately CVE-2026-26996 was ignored because it is only exposed in itk-wasm via CLI and OHIF's other use of minimatch is limited to build/dev environments.
* fix(security): Bump tar to 7.5.9 and lerna to 9.0.4 to fix CVE-2026-26960.
Bump sharp to 0.34.5 to fix tar-fs vulnerabilities.
* Update node version to 20.19.0 in circleci config. Needed for lerna and cypress tests.
* Now installing bun for cypress tests in circleci config.
* Use node version 20.19.0 in netlify config.
