chore(version): Update package versions [skip ci]

* Update playwright config to output html report and always include video.

* Output playwright html report to results zip.

* Fix MeasurementPanel.spec.ts to use new measurement row locator.

.circleci/config.yml

@@ -6,7 +6,7 @@ orbs:
 
 defaults: &defaults
   docker:
-    - image: cimg/node:20.18.1
+    - image: cimg/node:20.19.0
       environment:
         TERM: xterm
         QUICK_BUILD: true
@@ -112,19 +112,32 @@ jobs:
       - checkout
       - attach_workspace:
           at: ~/repo
-      # SECURITY AUDIT
+      # SECURITY AUDIT - only when bun.lock has changed
       - run:
           name: 'Security Audit - High Risk Vulnerabilities'
           command: |
-            echo "🔍 Running bun audit for security vulnerabilities..."
+            git fetch origin master 2>/dev/null || true
+            BASE_REF=$(git merge-base HEAD origin/master 2>/dev/null)
+            if [[ -z "$BASE_REF" ]]; then
+              echo "Could not determine base ref (e.g. shallow clone or no origin/master), skipping security audit."
+              exit 0
+            fi
+            CHANGED_FILES=$(git diff --name-only origin/master...HEAD 2>/dev/null || echo "")
+            if ! echo "$CHANGED_FILES" | grep -qx 'bun.lock'; then
+              echo "⏭️ bun.lock unchanged - skipping security audit."
+              exit 0
+            fi
+            echo "🔍 bun.lock changed - running bun audit for security vulnerabilities..."
             echo "Checking for HIGH-RISK vulnerabilities..."
 
             # Define ignored vulnerabilities with comments
             IGNORED_VULNS=(
-              "GHSA-5j98-mcp5-4vw2"  # CVE-2025-64756 - glob is not used on the command line
-              "GHSA-8qq5-rm4j-mr97"  # CVE-2026-23745 - limited to build/dev environments
-              "GHSA-r6q2-hw4h-h46w"  # CVE-2026-23950 - limited to build/dev environments
-              "GHSA-34x7-hfp2-rc4v"  # CVE-2026-24842 - limited to build/dev environments
+              "GHSA-3ppc-4f35-3m26"  # CVE-2026-26996 - minimatch via itk-wasm and glob is safe because it does NOT use the CLI
+                                     # CVE-2026-26996 - minimatch via other packages are strictly for building and CI/CD purposes; no user supplied expressions are passed to minimatch
+              "GHSA-7r86-cg39-jmmj"  # CVE-2026-27903 - minimatch same as above
+              "GHSA-23c5-xmqv-rm74"  # CVE-2026-27904 - minimatch same as above
+              "GHSA-c2c7-rcm5-vvqj"  # CVE-2026-33671 - picomatch is generally used for development and CI/CD purposes
+              "GHSA-mp2f-45pm-3cg9"  # CVE-2026-53486 - decompress is called only ever decompresses a hash-pinned, hardcoded archive in a dev-only CLI
             )
 
             # Build ignore flags
@@ -374,6 +387,7 @@ jobs:
     resource_class: large
     parallelism: 8
     steps:
+      - install_bun
       - run:
           name: Install System Dependencies
           command: |

.github/.dependabot.yaml

@@ -2,6 +2,8 @@ version: 2
 enable-beta-ecosystems: true
 updates:
   - package-ecosystem: 'bun'
+    # Disable all pull requests for bun version updates.
+    open-pull-requests-limit: 0
     directory: '/'
     schedule:
       interval: 'daily'
@@ -10,6 +12,8 @@ updates:
       prefix: 'chore'
       include: 'scope'
   - package-ecosystem: 'npm'
+    # Disable all pull requests for npm version updates.
+    open-pull-requests-limit: 0
     directory: '/'
     schedule:
       interval: 'daily'

.github/workflows/playwright.yml

@@ -9,8 +9,8 @@ concurrency:
 
 jobs:
   playwright-tests:
-    timeout-minutes: 60
-    runs-on: self-hosted
+    timeout-minutes: 120
+    runs-on: [self-hosted, nashua]
     strategy:
       fail-fast: false
       matrix:
@@ -28,17 +28,22 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Install Playwright browsers
-        run: npx playwright install
+        # Only chromium is used (firefox/webkit projects are commented out in
+        # playwright.config.ts). Scoping the install to chromium avoids
+        # downloading + dep-validating browsers we never launch (the WebKit
+        # validation is what surfaces "missing libwoff1/libflite1/..." on hosts
+        # without those libs).
+        run: npx playwright install chromium
       - name: Run Playwright tests
         run: |
           export NODE_OPTIONS="--max_old_space_size=10192"
-          bun run test:e2e:coverage
+          bash .scripts/ci/with-nashua-lock.sh bun run test:e2e:coverage
       - name: Create directory of test results
         if: ${{ !cancelled() }}
         run: |
           mkdir -p packaged-test-results
           cp -r ./tests/test-results packaged-test-results/ || true
-          cp ./tests/playwright-report.json packaged-test-results/ || true
+          cp -r ./tests/playwright-report packaged-test-results/ || true
       - name: Upload directory of test results artifact
         if: ${{ !cancelled() }}
         uses: actions/upload-artifact@v4

.scripts/ci/with-nashua-lock.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+#
+# Run a command while holding the nashua Playwright mutex.
+#
+# Only one Playwright run may execute at a time on the shared nashua self-hosted
+# runner — across THIS repo (OHIF) AND the cornerstone3D repo. GitHub's
+# `concurrency:` is scoped per-repository and cannot coordinate across the two
+# orgs, so the mutex lives on the box's filesystem.
+#
+# This is OHIF's own copy (the script can't be shared across separate repos). It
+# MUST use the SAME lock path as cornerstone3D's copy (NASHUA_LOCK_FILE default
+# below) — if the paths differ, the mutex silently does nothing.
+#
+# flock holds the lock via fd 9 and it releases automatically when the wrapped
+# command exits — including on job cancel / timeout / SIGKILL — so there are no
+# stale locks to clean up.
+#
+# Usage: .scripts/ci/with-nashua-lock.sh <command> [args...]
+
+# Strict mode: -e abort on any unhandled command failure, -u treat use of an
+# unset variable as an error, -o pipefail make a pipeline fail if ANY stage
+# fails (not just the last). Catches mistakes early instead of pressing on.
+set -euo pipefail
+
+LOCK="${NASHUA_LOCK_FILE:-/var/tmp/nashua-playwright.lock}"   # MUST match cornerstone3D's copy
+LOCK_WAIT="${NASHUA_LOCK_WAIT:-5400}"                          # max seconds to wait
+
+# Guard: a command to wrap is required. With no arguments there is nothing to
+# run, so print usage and exit instead of silently grabbing and releasing the
+# lock for no reason (which would mask a mis-wired workflow step).
+if [ "$#" -eq 0 ]; then
+  echo "usage: $0 <command> [args...]" >&2
+  exit 2
+fi
+
+# Open the lock file on fd 9 (read-write, create if missing, never truncate).
+exec 9<>"$LOCK" || { echo "::error::cannot open lock file $LOCK"; exit 1; }
+
+# Try instantly; if busy, report who holds it, then block up to LOCK_WAIT.
+if ! flock -n 9; then
+  echo "nashua Playwright runner busy — held by: $(cat "${LOCK}.info" 2>/dev/null || echo unknown). Waiting up to ${LOCK_WAIT}s…"
+  if ! flock -w "$LOCK_WAIT" 9; then
+    echo "::error::Timed out after ${LOCK_WAIT}s waiting for the nashua Playwright lock"
+    exit 1
+  fi
+fi
+
+# Record the current holder for other jobs' "held by" message (best-effort).
+echo "${GITHUB_REPOSITORY:-local}#${GITHUB_RUN_ID:-0} @ $(date -u +%FT%TZ 2>/dev/null || true)" > "${LOCK}.info" 2>/dev/null || true
+echo "✅ Acquired nashua Playwright lock ($LOCK); running: $*"
+
+# Replace the shell with the command. fd 9 is inherited (not close-on-exec), so
+# the lock is held for the whole command and released when it exits.
+exec "$@"

CHANGELOG.md

@@ -3,6 +3,67 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package ohif-monorepo-root
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+
+### Bug Fixes
+
+* **security:** Update dependencies to fix security vulnerabilities. Release 3.12.5 ([#6086](https://github.com/OHIF/Viewers/issues/6086)) ([f5f086c](https://github.com/OHIF/Viewers/commit/f5f086cd953bfcb783276fbb8d687e05fa118725))
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+
+### Bug Fixes
+
+* **security:** Update axios to fix security vulnerabilities. Release 3.12.4 ([#6064](https://github.com/OHIF/Viewers/issues/6064)) ([62917c2](https://github.com/OHIF/Viewers/commit/62917c214246233b7b76aa8926fdfd645a2385a7))
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+
+### Bug Fixes
+
+* **security:** Add tmp as a resolution to fix security vulnerability. Trigger release 3.12.3. ([#6045](https://github.com/OHIF/Viewers/issues/6045)) ([fb4441b](https://github.com/OHIF/Viewers/commit/fb4441ba71ec95dd494d120152a61df9261024cb))
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+
+### Bug Fixes
+
+* **release:** make publish-version.mjs idempotent for re-runs ([647fd02](https://github.com/OHIF/Viewers/commit/647fd025cf7212acc03b66807974f5d0f8ba0708))
+* **security:** Update various dependencies to fix security vulnerabilities. Release 3.12.2 ([#6024](https://github.com/OHIF/Viewers/issues/6024)) ([75a24a3](https://github.com/OHIF/Viewers/commit/75a24a33935bda8779da30ef9b725b387d80723d))
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package ohif-monorepo-root
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 

addOns/externals/devDependencies/CHANGELOG.md

@@ -3,6 +3,57 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @externals/devDependencies
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+
+### Bug Fixes
+
+* **security:** Update dependencies to fix security vulnerabilities. Release 3.12.5 ([#6086](https://github.com/OHIF/Viewers/issues/6086)) ([f5f086c](https://github.com/OHIF/Viewers/commit/f5f086cd953bfcb783276fbb8d687e05fa118725))
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @externals/devDependencies
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @externals/devDependencies
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @externals/devDependencies
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @externals/devDependencies
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @externals/devDependencies

addOns/externals/devDependencies/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@externals/devDependencies",
   "description": "External dev dependencies - put dev build dependencies here",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "license": "MIT",
   "private": true,
   "engines": {
@@ -20,7 +20,6 @@
     "react-dom": "18.3.1"
   },
   "devDependencies": {
-    "@babel/eslint-parser": "7.28.0",
     "@pmmmwh/react-refresh-webpack-plugin": "0.5.17",
     "@rsbuild/core": "1.5.1",
     "@rsbuild/plugin-node-polyfill": "1.4.2",
@@ -28,30 +27,27 @@
     "@svgr/webpack": "8.1.0",
     "@swc/helpers": "0.5.17",
     "@types/jest": "27.5.2",
-    "@typescript-eslint/eslint-plugin": "6.21.0",
-    "@typescript-eslint/parser": "6.21.0",
+    "@typescript-eslint/eslint-plugin": "8.56.0",
+    "@typescript-eslint/parser": "8.56.0",
     "autoprefixer": "10.4.21",
     "babel-loader": "8.4.1",
-    "babel-plugin-module-resolver": "5.0.2",
     "clean-webpack-plugin": "3.0.0",
     "copy-webpack-plugin": "9.1.0",
     "cross-env": "7.0.3",
     "css-loader": "6.11.0",
     "dotenv": "8.6.0",
-    "eslint": "8.57.1",
+    "eslint": "9.39.3",
     "eslint-config-prettier": "7.2.0",
-    "eslint-config-react-app": "6.0.0",
+    "eslint-config-react-app": "7.0.1",
     "eslint-plugin-cypress": "2.15.2",
-    "eslint-plugin-flowtype": "7.0.0",
     "eslint-plugin-import": "2.32.0",
     "eslint-plugin-jsx-a11y": "6.10.2",
     "eslint-plugin-node": "11.1.0",
     "eslint-plugin-prettier": "5.5.1",
-    "eslint-plugin-promise": "5.2.0",
+    "eslint-plugin-promise": "7.2.1",
     "eslint-plugin-react": "7.37.5",
-    "eslint-plugin-react-hooks": "4.6.2",
+    "eslint-plugin-react-hooks": "7.0.1",
     "eslint-plugin-tsdoc": "0.2.17",
-    "eslint-webpack-plugin": "2.7.0",
     "execa": "8.0.1",
     "extract-css-chunks-webpack-plugin": "4.10.0",
     "html-webpack-plugin": "5.6.3",
@@ -60,7 +56,7 @@
     "jest-canvas-mock": "2.5.2",
     "jest-environment-jsdom": "29.7.0",
     "jest-junit": "6.4.0",
-    "lerna": "7.4.2",
+    "lerna": "9.0.4",
     "lint-staged": "9.5.0",
     "mini-css-extract-plugin": "2.9.2",
     "optimize-css-assets-webpack-plugin": "6.0.1",
@@ -72,7 +68,7 @@
     "prettier-plugin-tailwindcss": "0.6.9",
     "react-refresh": "0.14.2",
     "semver": "7.7.2",
-    "serve": "14.2.4",
+    "serve": "14.2.5",
     "shader-loader": "1.3.1",
     "shx": "0.3.4",
     "source-map-loader": "4.0.2",
@@ -80,8 +76,8 @@
     "terser-webpack-plugin": "5.3.14",
     "typescript": "5.5.4",
     "unused-webpack-plugin": "2.4.0",
-    "webpack": "5.95.0",
-    "webpack-bundle-analyzer": "4.10.2",
+    "webpack": "5.105.0",
+    "webpack-bundle-analyzer": "5.3.0",
     "webpack-cli": "5.1.4",
     "webpack-dev-server": "5.2.2",
     "webpack-hot-middleware": "2.26.1",

addOns/externals/dicom-microscopy-viewer/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @externals/dicom-microscopy-viewer
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @externals/dicom-microscopy-viewer
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @externals/dicom-microscopy-viewer
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @externals/dicom-microscopy-viewer
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @externals/dicom-microscopy-viewer
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @externals/dicom-microscopy-viewer
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @externals/dicom-microscopy-viewer

addOns/externals/dicom-microscopy-viewer/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@externals/dicom-microscopy-viewer",
   "description": "External reference to dicom-microscopy-viewer",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "license": "MIT",
   "dependencies": {
     "dicom-microscopy-viewer": "0.48.17"

addOns/package.json

@@ -31,7 +31,7 @@
     "@babel/plugin-transform-regenerator": "7.28.1",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1"
   },

commit.txt

@@ -1 +1 @@
-45739b31a2c72cb646c733929f733a8e180a616c
+646dd583a2a6e7a3c2d370c6312f23967f96471e

extensions/cornerstone-dicom-pmap/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-pmap
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-pmap
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-pmap
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-pmap
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-pmap
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-pmap
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-cornerstone-dicom-pmap

extensions/cornerstone-dicom-pmap/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone-dicom-pmap",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "DICOM Parametric Map read workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -33,10 +33,10 @@
     "start": "yarn run dev"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/i18n": "3.12.6",
     "prop-types": "15.8.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
@@ -48,7 +48,6 @@
     "@babel/runtime": "7.28.2",
     "@cornerstonejs/adapters": "4.15.29",
     "@cornerstonejs/core": "4.15.29",
-    "@kitware/vtk.js": "34.15.1",
-    "react-color": "2.19.3"
+    "@kitware/vtk.js": "34.15.1"
   }
 }

extensions/cornerstone-dicom-rt/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-rt
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-rt
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-rt
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-rt
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-rt
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-rt
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-cornerstone-dicom-rt

extensions/cornerstone-dicom-rt/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone-dicom-rt",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "DICOM RT read workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -33,10 +33,10 @@
     "start": "yarn run dev"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/i18n": "3.12.6",
     "prop-types": "15.8.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
@@ -45,7 +45,6 @@
     "react-router-dom": "6.30.3"
   },
   "dependencies": {
-    "@babel/runtime": "7.28.2",
-    "react-color": "2.19.3"
+    "@babel/runtime": "7.28.2"
   }
 }

extensions/cornerstone-dicom-seg/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-seg
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-seg
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-seg
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-seg
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-seg
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-seg
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-cornerstone-dicom-seg

extensions/cornerstone-dicom-seg/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone-dicom-seg",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "DICOM SEG read workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -33,10 +33,10 @@
     "start": "yarn run dev"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/i18n": "3.12.6",
     "prop-types": "15.8.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
@@ -48,7 +48,6 @@
     "@babel/runtime": "7.28.2",
     "@cornerstonejs/adapters": "4.15.29",
     "@cornerstonejs/core": "4.15.29",
-    "@kitware/vtk.js": "34.15.1",
-    "react-color": "2.19.3"
+    "@kitware/vtk.js": "34.15.1"
   }
 }

extensions/cornerstone-dicom-sr/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-sr
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-sr
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-sr
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-sr
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-sr
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dicom-sr
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-cornerstone-dicom-sr

extensions/cornerstone-dicom-sr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone-dicom-sr",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "OHIF extension for an SR Cornerstone Viewport",
   "author": "OHIF",
   "license": "MIT",
@@ -34,10 +34,10 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-measurement-tracking": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-measurement-tracking": "3.12.6",
+    "@ohif/ui": "3.12.6",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/cornerstone-dynamic-volume/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dynamic-volume
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dynamic-volume
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dynamic-volume
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dynamic-volume
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dynamic-volume
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone-dynamic-volume
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-cornerstone-dynamic-volume

extensions/cornerstone-dynamic-volume/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone-dynamic-volume",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "OHIF extension for 4D volumes data",
   "author": "OHIF",
   "license": "MIT",
@@ -29,11 +29,11 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/i18n": "3.12.6",
+    "@ohif/ui": "3.12.6",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/cornerstone/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-cornerstone
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 

extensions/cornerstone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-cornerstone",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "OHIF extension for Cornerstone",
   "author": "OHIF",
   "license": "MIT",
@@ -41,8 +41,8 @@
     "@cornerstonejs/codec-openjpeg": "1.3.0",
     "@cornerstonejs/codec-openjph": "2.4.7",
     "@cornerstonejs/dicom-image-loader": "4.15.29",
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/ui": "3.12.6",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",
@@ -63,10 +63,10 @@
     "@itk-wasm/morphological-contour-interpolation": "1.1.0",
     "@kitware/vtk.js": "34.15.1",
     "html2canvas": "1.4.1",
+    "immutability-helper": "3.1.1",
     "lodash.compact": "3.0.1",
     "lodash.debounce": "4.0.8",
     "lodash.flatten": "4.4.0",
-    "lodash.merge": "4.6.2",
     "lodash.zip": "4.2.0",
     "shader-loader": "1.3.1",
     "worker-loader": "3.0.8"

extensions/cornerstone/src/index.tsx

@@ -59,6 +59,7 @@ import utils from './utils';
 import { useMeasurementTracking } from './hooks/useMeasurementTracking';
 import { setUpSegmentationEventHandlers } from './utils/setUpSegmentationEventHandlers';
 import { setUpAnnotationEventHandlers } from './utils/setUpAnnotationEventHandlers';
+import update from 'immutability-helper';
 export * from './components';
 
 const { imageRetrieveMetadataProvider } = cornerstone.utilities;
@@ -75,7 +76,7 @@ const OHIFCornerstoneViewport = props => {
   );
 };
 
-const stackRetrieveOptions = {
+const DEFAULT_STACK_RETRIEVE_OPTIONS = {
   retrieveOptions: {
     single: {
       streaming: true,
@@ -84,6 +85,12 @@ const stackRetrieveOptions = {
   },
 };
 
+/** Normalize to immutability-helper spec: plain object → $merge, otherwise use as-is. */
+const toUpdateSpec = (obj: object) =>
+  obj != null && typeof obj === 'object' && Object.keys(obj).some(k => k.startsWith('$'))
+    ? obj
+    : { $merge: (obj ?? {}) as object };
+
 const unsubscriptions = [];
 /**
  *
@@ -94,7 +101,11 @@ const cornerstoneExtension: Types.Extensions.Extension = {
    */
   id,
 
-  onModeEnter: ({ servicesManager, commandsManager }: withAppTypes): void => {
+  onModeEnter: ({
+    servicesManager,
+    commandsManager,
+    extensionManager,
+  }: withAppTypes): void => {
     const { cornerstoneViewportService, toolbarService, segmentationService } =
       servicesManager.services;
 
@@ -131,10 +142,17 @@ const cornerstoneExtension: Types.Extensions.Extension = {
       'volume',
       cornerstone.ProgressiveRetrieveImages.interleavedRetrieveStages
     );
-    // The default stack loading option is to progressive load HTJ2K images
-    // There are other possible options, but these need more thought about
-    // how to define them.
-    imageRetrieveMetadataProvider.add('stack', stackRetrieveOptions);
+
+    /**
+     * Stack retrieve options: read from active data source configuration.
+     * Pass an immutability-helper spec (e.g. { $merge: {...} } or { $set: {...} }) in
+     * stackRetrieveOptions to customize. Plain object is treated as $merge for backward compat.
+     * Set streaming: false for uncompressed DICOM that requires full file before decode.
+     */
+    const sourceConfig = extensionManager?.getActiveDataSource?.()?.[0]?.getConfig?.() ?? {};
+    const config = sourceConfig.stackRetrieveOptions ?? {};
+    const stackOptions = update(DEFAULT_STACK_RETRIEVE_OPTIONS, toUpdateSpec(config)) as typeof DEFAULT_STACK_RETRIEVE_OPTIONS;
+    imageRetrieveMetadataProvider.add('stack', stackOptions);
   },
   getPanelModule,
   onModeExit: ({ servicesManager }: withAppTypes): void => {

extensions/default/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-default
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-default
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-default
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-default
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-default
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-default
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-default

extensions/default/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-default",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "Common/default features and functionality for basic image viewing",
   "author": "OHIF Core Team",
   "license": "MIT",
@@ -34,8 +34,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/i18n": "3.12.6",
     "dcmjs": "0.49.4",
     "dicomweb-client": "0.10.4",
     "prop-types": "15.8.1",
@@ -43,13 +43,14 @@
     "react-dom": "18.3.1",
     "react-i18next": "12.3.1",
     "react-window": "1.8.11",
-    "webpack": "5.89.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "@cornerstonejs/calculate-suv": "1.1.0",
     "lodash.get": "4.4.2",
-    "lodash.uniqby": "4.7.0"
+    "lodash.uniqby": "4.7.0",
+    "react-color": "2.19.3"
   }
 }

extensions/default/src/DicomJSONDataSource/index.js

@@ -4,6 +4,7 @@ import qs from 'query-string';
 
 import getImageId from '../DicomWebDataSource/utils/getImageId';
 import getDirectURL from '../utils/getDirectURL';
+import { resolveConfigFetchPolicy, fetchConfigJson } from '../utils/secureConfigFetch';
 
 const metadataProvider = OHIF.classes.MetadataProvider;
 
@@ -59,13 +60,18 @@ const findStudies = (key, value) => {
   return studies;
 };
 
-function createDicomJSONApi(dicomJsonConfig) {
+function createDicomJSONApi(dicomJsonConfig, servicesManager) {
+  const { userAuthenticationService } = servicesManager.services;
   const implementation = {
     initialize: async ({ query, url }) => {
       if (!url) {
         url = query.get('url');
       }
-      let metaData = getMetaDataByURL(url);
+      const evaluatedUrl = resolveConfigFetchPolicy(url, {
+        allowedOrigins: dicomJsonConfig.dangerouslyAllowedOriginsForAuthenticatedEnvironments,
+        userAuthenticationService,
+      });
+      let metaData = getMetaDataByURL(evaluatedUrl.normalizedUrl);
 
       // if we have already cached the data from this specific url
       // We are only handling one StudyInstanceUID to run; however,
@@ -76,8 +82,7 @@ function createDicomJSONApi(dicomJsonConfig) {
         });
       }
 
-      const response = await fetch(url);
-      const data = await response.json();
+      const data = await fetchConfigJson(evaluatedUrl);
 
       let StudyInstanceUID;
       let SeriesInstanceUID;
@@ -105,11 +110,11 @@ function createDicomJSONApi(dicomJsonConfig) {
       });
 
       _store.urls.push({
-        url,
+        url: evaluatedUrl.normalizedUrl,
         studies: [...data.studies],
       });
       _store.studyInstanceUIDMap.set(
-        url,
+        evaluatedUrl.normalizedUrl,
         data.studies.map(study => study.StudyInstanceUID)
       );
     },
@@ -252,6 +257,8 @@ function createDicomJSONApi(dicomJsonConfig) {
         console.warn(' DICOMJson store dicom not implemented');
       },
     },
+    reject: {},
+    deleteStudyMetadataPromise: () => {},
     getImageIdsForDisplaySet(displaySet) {
       const images = displaySet.images;
       const imageIds = [];
@@ -297,8 +304,21 @@ function createDicomJSONApi(dicomJsonConfig) {
     },
     getStudyInstanceUIDs: ({ params, query }) => {
       const url = query.get('url');
-      return _store.studyInstanceUIDMap.get(url);
+      if (!url) {
+        return;
+      }
+
+      try {
+        const evaluatedUrl = resolveConfigFetchPolicy(url, {
+          allowedOrigins: dicomJsonConfig.dangerouslyAllowedOriginsForAuthenticatedEnvironments,
+          userAuthenticationService,
+        });
+        return _store.studyInstanceUIDMap.get(evaluatedUrl.normalizedUrl);
+      } catch {
+        return;
+      }
     },
+    getConfig: () => dicomJsonConfig,
   };
   return IWebApiDataSource.create(implementation);
 }

extensions/default/src/DicomWebProxyDataSource/index.ts

@@ -1,5 +1,6 @@
 import { IWebApiDataSource } from '@ohif/core';
 import { createDicomWebApi } from '../DicomWebDataSource/index';
+import { resolveConfigFetchPolicy, fetchConfigJson } from '../utils/secureConfigFetch';
 
 /**
  * This datasource is initialized with a url that returns a JSON object with a
@@ -11,6 +12,7 @@ import { createDicomWebApi } from '../DicomWebDataSource/index';
  */
 function createDicomWebProxyApi(dicomWebProxyConfig, servicesManager: AppTypes.ServicesManager) {
   const { name } = dicomWebProxyConfig;
+  const { userAuthenticationService } = servicesManager.services;
   let dicomWebDelegate = undefined;
 
   const implementation = {
@@ -20,12 +22,14 @@ function createDicomWebProxyApi(dicomWebProxyConfig, servicesManager: AppTypes.S
       if (!url) {
         throw new Error(`No url for '${name}'`);
       } else {
-        const response = await fetch(url);
-        const data = await response.json();
+        const evaluatedUrl = resolveConfigFetchPolicy(url, {
+          allowedOrigins: dicomWebProxyConfig.dangerouslyAllowedOriginsForAuthenticatedEnvironments,
+          userAuthenticationService,
+        });
+        const data = await fetchConfigJson(evaluatedUrl);
         if (!data.servers?.dicomWeb?.[0]) {
           throw new Error('Invalid configuration returned by url');
         }
-
         dicomWebDelegate = createDicomWebApi(
           data.servers.dicomWeb[0].configuration || data.servers.dicomWeb[0],
           servicesManager
@@ -54,9 +58,16 @@ function createDicomWebProxyApi(dicomWebProxyConfig, servicesManager: AppTypes.S
     store: {
       dicom: (...args) => dicomWebDelegate.store.dicom(...args),
     },
-    deleteStudyMetadataPromise: (...args) => dicomWebDelegate.deleteStudyMetadataPromise(...args),
-    getImageIdsForDisplaySet: (...args) => dicomWebDelegate.getImageIdsForDisplaySet(...args),
-    getImageIdsForInstance: (...args) => dicomWebDelegate.getImageIdsForInstance(...args),
+    reject: {
+      series: (...args) => dicomWebDelegate?.reject?.series?.(...args),
+    },
+    deleteStudyMetadataPromise: (...args) => dicomWebDelegate?.deleteStudyMetadataPromise?.(...args),
+    getImageIdsForDisplaySet: (...args) => dicomWebDelegate?.getImageIdsForDisplaySet?.(...args),
+    getImageIdsForInstance: (...args) => dicomWebDelegate?.getImageIdsForInstance?.(...args),
+    getConfig: (...args) =>
+      dicomWebDelegate?.getConfig?.(...args) ?? {
+        dicomUploadEnabled: false,
+      },
     getStudyInstanceUIDs({ params, query }) {
       let studyInstanceUIDs = [];
 

extensions/default/src/utils/secureConfigFetch.js

@@ -0,0 +1,115 @@
+// @ts-nocheck
+
+function normalizeAllowedOrigins(allowedOrigins = []) {
+  if (!Array.isArray(allowedOrigins)) {
+    return [];
+  }
+
+  const configuredOrigins = allowedOrigins
+    .filter(origin => typeof origin === 'string')
+    .map(origin => origin.trim())
+    .filter(Boolean);
+
+  return configuredOrigins
+    .map(origin => {
+      try {
+        const parsedOrigin = new URL(origin);
+        if (!['http:', 'https:'].includes(parsedOrigin.protocol)) {
+          console.error(
+            `[secureConfigFetch] Ignoring misconfigured allowed origin "${origin}". ` +
+              'Entries must use http:// or https://.'
+          );
+          return null;
+        }
+        if (
+          parsedOrigin.username ||
+          parsedOrigin.password ||
+          parsedOrigin.pathname !== '/' ||
+          parsedOrigin.search ||
+          parsedOrigin.hash
+        ) {
+          console.error(
+            `[secureConfigFetch] Ignoring misconfigured allowed origin "${origin}". ` +
+              'Entries must be bare origins only (scheme + host + optional port), with no username/password, path, query, or hash.'
+          );
+          return null;
+        }
+        return parsedOrigin.origin;
+      } catch {
+        console.error(
+          `[secureConfigFetch] Ignoring misconfigured allowed origin "${origin}". Entry is not a valid URL.`
+        );
+        return null;
+      }
+    })
+    .filter(Boolean);
+}
+
+function resolveConfigUrl(rawUrl) {
+  if (!rawUrl || typeof rawUrl !== 'string') {
+    throw new Error('Missing required "url" query parameter');
+  }
+
+  try {
+    return new URL(rawUrl, window.location.href);
+  } catch {
+    throw new Error('Invalid URL in "url" query parameter');
+  }
+}
+
+function resolveConfigFetchPolicy(rawUrl, policy = {}) {
+  const { allowedOrigins = [], userAuthenticationService } = policy;
+  const parsedUrl = resolveConfigUrl(rawUrl);
+  const protocol = parsedUrl.protocol.toLowerCase();
+  const isSameOrigin = parsedUrl.origin === window.location.origin;
+
+  if (!['http:', 'https:'].includes(protocol)) {
+    throw new Error('Only HTTP(S) URLs are allowed for dynamic datasource configuration');
+  }
+
+  if (parsedUrl.hash) {
+    throw new Error('URL fragments are not allowed for dynamic datasource configuration');
+  }
+
+  if (parsedUrl.username || parsedUrl.password) {
+    throw new Error('URL userinfo is not allowed for dynamic datasource configuration');
+  }
+
+  const isAuthenticated = Boolean(
+    userAuthenticationService?.getAuthorizationHeader?.()?.Authorization
+  );
+
+  if (isAuthenticated && !isSameOrigin) {
+    const normalizedAllowedOrigins = normalizeAllowedOrigins(allowedOrigins);
+    if (!normalizedAllowedOrigins.length || !normalizedAllowedOrigins.includes(parsedUrl.origin)) {
+      throw new Error(
+        `Blocked remote configuration origin "${parsedUrl.origin}" in authenticated environment`
+      );
+    }
+  }
+
+  return {
+    parsedUrl,
+    normalizedUrl: parsedUrl.toString(),
+    isAuthenticated,
+    isSameOrigin,
+  };
+}
+
+async function fetchConfigJson(normalizedPolicy) {
+  const { normalizedUrl } = normalizedPolicy;
+  const response = await fetch(normalizedUrl, {
+    method: 'GET',
+    mode: 'cors',
+    credentials: 'same-origin',
+    redirect: 'error',
+    referrerPolicy: 'no-referrer',
+  });
+
+  if (!response.ok) {
+    throw new Error(`Failed to fetch dynamic datasource configuration (${response.status})`);
+  }
+
+  return response.json();
+}
+export { resolveConfigFetchPolicy, fetchConfigJson };

extensions/default/src/utils/secureConfigFetch.test.js

@@ -0,0 +1,163 @@
+// @ts-nocheck
+import { resolveConfigFetchPolicy, fetchConfigJson } from './secureConfigFetch';
+
+describe('secureConfigFetch', () => {
+  describe('resolveConfigFetchPolicy', () => {
+    it('allows arbitrary origin in unauthenticated environments', () => {
+      const result = resolveConfigFetchPolicy('https://untrusted.example.com/config.json', {
+        userAuthenticationService: {
+          getAuthorizationHeader: () => ({}),
+        },
+      });
+
+      expect(result.normalizedUrl).toBe('https://untrusted.example.com/config.json');
+      expect(result.isAuthenticated).toBe(false);
+      expect(result.isSameOrigin).toBe(false);
+    });
+
+    it('blocks non-allowlisted origins in authenticated environments', () => {
+      expect(() =>
+        resolveConfigFetchPolicy('https://untrusted.example.com/config.json', {
+          allowedOrigins: ['https://trusted.example.com'],
+          userAuthenticationService: {
+            getAuthorizationHeader: () => ({ Authorization: 'Bearer token123' }),
+          },
+        })
+      ).toThrow('Blocked remote configuration origin');
+    });
+
+    it('allows allowlisted origin in authenticated environments', () => {
+      const result = resolveConfigFetchPolicy('http://localhost:5000/config.json', {
+        allowedOrigins: ['http://localhost:5000', 'https://trusted.example.com'],
+        userAuthenticationService: {
+          getAuthorizationHeader: () => ({ Authorization: 'Bearer token123' }),
+        },
+      });
+
+      expect(result.normalizedUrl).toBe('http://localhost:5000/config.json');
+      expect(result.isAuthenticated).toBe(true);
+      expect(result.isSameOrigin).toBe(false);
+    });
+
+    it('blocks authenticated fetch when allowlist is missing', () => {
+      expect(() =>
+        resolveConfigFetchPolicy('https://noTrustList.example.com/config.json', {
+          userAuthenticationService: {
+            getAuthorizationHeader: () => ({ Authorization: 'Bearer token123' }),
+          },
+        })
+      ).toThrow('Blocked remote configuration origin');
+    });
+
+    it('allows same-origin in authenticated environments without allowlist', () => {
+      const result = resolveConfigFetchPolicy('/protected/config.json', {
+        userAuthenticationService: {
+          getAuthorizationHeader: () => ({ Authorization: 'Bearer token123' }),
+        },
+      });
+
+      expect(result.normalizedUrl).toBe(`${window.location.origin}/protected/config.json`);
+      expect(result.isAuthenticated).toBe(true);
+      expect(result.isSameOrigin).toBe(true);
+    });
+
+    it('rejects embedded userinfo in config URLs', () => {
+      expect(() =>
+        resolveConfigFetchPolicy('https://user:pass@trusted.example.com/config.json', {
+          allowedOrigins: ['https://trusted.example.com'],
+          userAuthenticationService: {
+            getAuthorizationHeader: () => ({ Authorization: 'Bearer token123' }),
+          },
+        })
+      ).toThrow('URL userinfo is not allowed for dynamic datasource configuration');
+    });
+  });
+
+  describe('fetchConfigJson', () => {
+    const originalFetch = global.fetch;
+
+    beforeEach(() => {
+      global.fetch = jest.fn();
+    });
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+      global.fetch = originalFetch;
+    });
+
+    it('uses hardened fetch options for unauthenticated cross-origin requests', async () => {
+      global.fetch.mockResolvedValue({
+        status: 200,
+        ok: true,
+        json: async () => ({ ok: true }),
+      });
+
+      await fetchConfigJson({
+        normalizedUrl: 'https://example.com/config.json',
+        isAuthenticated: false,
+        isSameOrigin: false,
+      });
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        'https://example.com/config.json',
+        expect.objectContaining({
+          method: 'GET',
+          mode: 'cors',
+          credentials: 'same-origin',
+          redirect: 'error',
+          referrerPolicy: 'no-referrer',
+        })
+      );
+    });
+
+    it('uses hardened fetch options for unauthenticated same-origin requests', async () => {
+      global.fetch.mockResolvedValue({
+        status: 200,
+        ok: true,
+        json: async () => ({ ok: true }),
+      });
+
+      await fetchConfigJson({
+        normalizedUrl: `${window.location.origin}/protected/config.json`,
+        isAuthenticated: false,
+        isSameOrigin: true,
+      });
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        `${window.location.origin}/protected/config.json`,
+        expect.objectContaining({
+          method: 'GET',
+          mode: 'cors',
+          credentials: 'same-origin',
+          redirect: 'error',
+          referrerPolicy: 'no-referrer',
+        })
+      );
+    });
+
+    it('uses hardened fetch options in authenticated environments', async () => {
+      global.fetch.mockResolvedValue({
+        status: 200,
+        ok: true,
+        json: async () => ({ ok: true }),
+      });
+
+      await fetchConfigJson({
+        normalizedUrl: 'https://trusted.example.com/config.json',
+        isAuthenticated: true,
+        isSameOrigin: false,
+      });
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        'https://trusted.example.com/config.json',
+        expect.objectContaining({
+          method: 'GET',
+          mode: 'cors',
+          credentials: 'same-origin',
+          redirect: 'error',
+          referrerPolicy: 'no-referrer',
+        })
+      );
+    });
+  });
+});

extensions/dicom-microscopy/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-dicom-microscopy
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-dicom-microscopy
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-dicom-microscopy
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-dicom-microscopy
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-dicom-microscopy
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-dicom-microscopy
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-dicom-microscopy

extensions/dicom-microscopy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-dicom-microscopy",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "OHIF extension for DICOM microscopy",
   "author": "Bill Wallace, md-prog",
   "license": "MIT",
@@ -30,10 +30,10 @@
     "start": "yarn run dev"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/i18n": "3.12.6",
+    "@ohif/ui": "3.12.6",
     "prop-types": "15.8.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",

extensions/dicom-pdf/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-dicom-pdf
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-dicom-pdf
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-dicom-pdf
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-dicom-pdf
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-dicom-pdf
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-dicom-pdf
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-dicom-pdf

extensions/dicom-pdf/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-dicom-pdf",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "OHIF extension for PDF display",
   "author": "OHIF",
   "license": "MIT",
@@ -30,8 +30,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/ui": "3.12.6",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/dicom-video/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-dicom-video
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-dicom-video
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-dicom-video
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-dicom-video
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-dicom-video
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-dicom-video
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-dicom-video

extensions/dicom-video/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-dicom-video",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "OHIF extension for video display",
   "author": "OHIF",
   "license": "MIT",
@@ -30,8 +30,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/ui": "3.12.6",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/measurement-tracking/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-measurement-tracking
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-measurement-tracking
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-measurement-tracking
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-measurement-tracking
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-measurement-tracking
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-measurement-tracking
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-measurement-tracking

extensions/measurement-tracking/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-measurement-tracking",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "Tracking features and functionality for basic image viewing",
   "author": "OHIF Core Team",
   "license": "MIT",
@@ -34,22 +34,22 @@
   "peerDependencies": {
     "@cornerstonejs/core": "4.15.29",
     "@cornerstonejs/tools": "4.15.29",
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/ui": "3.12.6",
     "classnames": "2.5.1",
     "dcmjs": "0.49.4",
     "lodash.debounce": "4.0.8",
     "prop-types": "15.8.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
-    "webpack": "5.89.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/ui": "3.12.6",
     "@xstate/react": "3.2.2",
     "xstate": "4.38.3"
   }

extensions/test-extension/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-test
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-test
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-test
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-test
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-test
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-test
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-test

extensions/test-extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-test",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "OHIF extension used inside e2e testing",
   "author": "OHIF",
   "license": "MIT",
@@ -30,8 +30,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/ui": "3.12.6",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/tmtv/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-tmtv
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-tmtv
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-tmtv
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-tmtv
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/extension-tmtv
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-tmtv
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-tmtv

extensions/tmtv/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-tmtv",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "OHIF extension for Total Metabolic Tumor Volume",
   "author": "OHIF",
   "license": "MIT",
@@ -30,8 +30,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/ui": "3.12.6",
     "dcmjs": "0.49.4",
     "dicom-parser": "1.8.21",
     "hammerjs": "2.0.8",

extensions/usAnnotation/CHANGELOG.md

@@ -3,6 +3,57 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/extension-ultrasound-pleura-bline
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/extension-ultrasound-pleura-bline
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/extension-ultrasound-pleura-bline
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/extension-ultrasound-pleura-bline
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+
+### Bug Fixes
+
+* **security:** Update various dependencies to fix security vulnerabilities. Release 3.12.2 ([#6024](https://github.com/OHIF/Viewers/issues/6024)) ([75a24a3](https://github.com/OHIF/Viewers/commit/75a24a33935bda8779da30ef9b725b387d80723d))
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/extension-ultrasound-pleura-bline
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/extension-ultrasound-pleura-bline

extensions/usAnnotation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/extension-ultrasound-pleura-bline",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "",
   "author": "Rodrigo Basilio",
   "license": "MIT",
@@ -37,22 +37,21 @@
     "react-i18next": "12.3.1",
     "react-router": "6.30.3",
     "react-router-dom": "6.30.3",
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "@cornerstonejs/core": "4.15.29",
     "@cornerstonejs/tools": "4.15.29",
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
-    "@ohif/ui-next": "3.12.0-beta.135"
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/i18n": "3.12.6",
+    "@ohif/ui-next": "3.12.6"
   },
   "devDependencies": {
     "@babel/core": "7.28.0",
-    "@babel/eslint-parser": "7.28.0",
     "@babel/plugin-syntax-dynamic-import": "7.8.3",
     "@babel/plugin-transform-arrow-functions": "7.27.1",
     "@babel/plugin-transform-class-properties": "7.27.1",
@@ -62,19 +61,16 @@
     "@babel/plugin-transform-regenerator": "7.28.1",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1",
     "@svgr/webpack": "8.1.0",
     "babel-loader": "8.4.1",
-    "babel-plugin-module-resolver": "5.0.2",
     "clean-webpack-plugin": "3.0.0",
     "copy-webpack-plugin": "9.1.0",
     "cross-env": "7.0.3",
     "dotenv": "8.6.0",
-    "eslint": "8.57.1",
-    "eslint-loader": "2.2.1",
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-cli": "5.1.4",
     "webpack-merge": "5.10.0"
   }

lerna.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "packages": ["extensions/*", "platform/*", "modes/*", "addOns/externals/*"],
   "npmClient": "yarn"
 }

modes/basic-dev-mode/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/mode-basic-dev-mode
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/mode-basic-dev-mode
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/mode-basic-dev-mode
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/mode-basic-dev-mode
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-basic-dev-mode
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-basic-dev-mode
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-basic-dev-mode

modes/basic-dev-mode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-basic-dev-mode",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "Basic OHIF Viewer Using Cornerstone",
   "author": "OHIF",
   "license": "MIT",
@@ -31,19 +31,19 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135"
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/extension-dicom-pdf": "3.12.6",
+    "@ohif/extension-dicom-video": "3.12.6"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "i18next": "17.3.1"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   }
 }

modes/basic-test-mode/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/mode-test
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/mode-test
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/mode-test
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/mode-test
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-test
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-test
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-test

modes/basic-test-mode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-test",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "Basic mode for testing",
   "author": "OHIF",
   "license": "MIT",
@@ -34,21 +34,21 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135",
-    "@ohif/extension-measurement-tracking": "3.12.0-beta.135",
-    "@ohif/extension-test": "3.12.0-beta.135"
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/extension-dicom-pdf": "3.12.6",
+    "@ohif/extension-dicom-video": "3.12.6",
+    "@ohif/extension-measurement-tracking": "3.12.6",
+    "@ohif/extension-test": "3.12.6"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "i18next": "17.3.1"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   }
 }

modes/basic/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/mode-basic
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/mode-basic
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/mode-basic
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/mode-basic
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-basic
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-basic
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-basic

modes/basic/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-basic",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "A basic mode used to build other modes on top of",
   "author": "OHIF Contributors",
   "license": "MIT",
@@ -21,20 +21,20 @@
     "yarn": ">=1.16.0"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-rt": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-seg": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135"
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-rt": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-seg": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/extension-dicom-pdf": "3.12.6",
+    "@ohif/extension-dicom-video": "3.12.6"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   },
   "scripts": {

modes/longitudinal/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/mode-longitudinal
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/mode-longitudinal
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/mode-longitudinal
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/mode-longitudinal
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-longitudinal
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-longitudinal
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-longitudinal

modes/longitudinal/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-longitudinal",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "Longitudinal Workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -34,23 +34,23 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-rt": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-seg": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135",
-    "@ohif/extension-measurement-tracking": "3.12.0-beta.135",
-    "@ohif/mode-basic": "3.12.0-beta.135"
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-rt": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-seg": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/extension-dicom-pdf": "3.12.6",
+    "@ohif/extension-dicom-video": "3.12.6",
+    "@ohif/extension-measurement-tracking": "3.12.6",
+    "@ohif/mode-basic": "3.12.6"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "i18next": "17.3.1"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   }
 }

modes/microscopy/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/mode-microscopy
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/mode-microscopy
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/mode-microscopy
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/mode-microscopy
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-microscopy
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-microscopy
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-microscopy

modes/microscopy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-microscopy",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "OHIF mode for DICOM microscopy",
   "author": "OHIF",
   "license": "MIT",
@@ -35,8 +35,8 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-dicom-microscopy": "3.12.0-beta.135"
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-dicom-microscopy": "3.12.6"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",

modes/preclinical-4d/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/mode-preclinical-4d
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/mode-preclinical-4d
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/mode-preclinical-4d
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/mode-preclinical-4d
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-preclinical-4d
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-preclinical-4d
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-preclinical-4d

modes/preclinical-4d/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-preclinical-4d",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "4D Workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -33,18 +33,18 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-seg": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dynamic-volume": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-tmtv": "3.12.0-beta.135"
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-seg": "3.12.6",
+    "@ohif/extension-cornerstone-dynamic-volume": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/extension-tmtv": "3.12.6"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   }
 }

modes/segmentation/CHANGELOG.md

@@ -3,6 +3,57 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/mode-segmentation
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/mode-segmentation
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/mode-segmentation
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/mode-segmentation
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+
+### Bug Fixes
+
+* **security:** Update various dependencies to fix security vulnerabilities. Release 3.12.2 ([#6024](https://github.com/OHIF/Viewers/issues/6024)) ([75a24a3](https://github.com/OHIF/Viewers/commit/75a24a33935bda8779da30ef9b725b387d80723d))
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-segmentation
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-segmentation

modes/segmentation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-segmentation",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "OHIF segmentation mode which enables labelmap segmentation read/edit/export",
   "author": "@ohif",
   "license": "MIT",
@@ -35,15 +35,15 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-rt": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-seg": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135",
-    "@ohif/mode-basic": "3.12.0-beta.135"
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-rt": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-seg": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/extension-dicom-pdf": "3.12.6",
+    "@ohif/extension-dicom-video": "3.12.6",
+    "@ohif/mode-basic": "3.12.6"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
@@ -51,7 +51,6 @@
   },
   "devDependencies": {
     "@babel/core": "7.28.0",
-    "@babel/eslint-parser": "7.28.0",
     "@babel/plugin-syntax-dynamic-import": "7.8.3",
     "@babel/plugin-transform-arrow-functions": "7.27.1",
     "@babel/plugin-transform-class-properties": "7.27.1",
@@ -60,7 +59,7 @@
     "@babel/plugin-transform-regenerator": "7.28.1",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1",
     "@svgr/webpack": "8.1.0",
@@ -69,9 +68,7 @@
     "copy-webpack-plugin": "9.1.0",
     "cross-env": "7.0.3",
     "dotenv": "8.6.0",
-    "eslint": "8.57.1",
-    "eslint-loader": "2.2.1",
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-cli": "5.1.4",
     "webpack-merge": "5.10.0"
   }

modes/tmtv/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/mode-tmtv
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/mode-tmtv
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/mode-tmtv
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/mode-tmtv
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/mode-tmtv
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-tmtv
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-tmtv

modes/tmtv/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-tmtv",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "Total Metabolic Tumor Volume Workflow",
   "author": "OHIF",
   "license": "MIT",
@@ -34,20 +34,20 @@
     "test:unit:ci": "jest --ci --runInBand --collectCoverage --passWithNoTests"
   },
   "peerDependencies": {
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135",
-    "@ohif/extension-measurement-tracking": "3.12.0-beta.135"
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/extension-dicom-pdf": "3.12.6",
+    "@ohif/extension-dicom-video": "3.12.6",
+    "@ohif/extension-measurement-tracking": "3.12.6"
   },
   "dependencies": {
     "@babel/runtime": "7.28.2",
     "i18next": "17.3.1"
   },
   "devDependencies": {
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-merge": "5.10.0"
   }
 }

modes/usAnnotation/CHANGELOG.md

@@ -3,6 +3,57 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/mode-ultrasound-pleura-bline
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/mode-ultrasound-pleura-bline
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/mode-ultrasound-pleura-bline
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/mode-ultrasound-pleura-bline
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+
+### Bug Fixes
+
+* **security:** Update various dependencies to fix security vulnerabilities. Release 3.12.2 ([#6024](https://github.com/OHIF/Viewers/issues/6024)) ([75a24a3](https://github.com/OHIF/Viewers/commit/75a24a33935bda8779da30ef9b725b387d80723d))
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/mode-ultrasound-pleura-bline
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/mode-ultrasound-pleura-bline

modes/usAnnotation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/mode-ultrasound-pleura-bline",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "Allows users to annotate ultrasound images with pleura B-line annotations.",
   "author": "OHIF",
   "license": "MIT",
@@ -36,14 +36,13 @@
     "@babel/runtime": "7.28.2",
     "@cornerstonejs/core": "4.15.29",
     "@cornerstonejs/tools": "4.15.29",
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-ultrasound-pleura-bline": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.6",
+    "@ohif/extension-ultrasound-pleura-bline": "3.12.6",
     "i18next": "17.3.1"
   },
   "devDependencies": {
     "@babel/core": "7.28.0",
-    "@babel/eslint-parser": "7.28.0",
     "@babel/plugin-syntax-dynamic-import": "7.8.3",
     "@babel/plugin-transform-arrow-functions": "7.27.1",
     "@babel/plugin-transform-class-properties": "7.27.1",
@@ -52,7 +51,7 @@
     "@babel/plugin-transform-regenerator": "7.28.1",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1",
     "@svgr/webpack": "8.1.0",
@@ -61,9 +60,7 @@
     "copy-webpack-plugin": "9.1.0",
     "cross-env": "7.0.3",
     "dotenv": "8.6.0",
-    "eslint": "8.57.1",
-    "eslint-loader": "2.2.1",
-    "webpack": "5.95.0",
+    "webpack": "5.105.0",
     "webpack-cli": "5.1.4",
     "webpack-merge": "5.10.0"
   }

package.json

@@ -49,7 +49,7 @@
     "install:update-lockfile": "yarn install && bun install --config=./bunfig.update-lockfile.toml",
     "install:yarn:frozen-lockfile": "echo Deprecated - use install:frozen && yarn install --frozen-lockfile",
     "install:frozen": "yarn install --frozen-lockfile",
-    "audit": "bun audit --ignore=GHSA-5j98-mcp5-4vw2",
+    "audit": "bun audit --ignore=GHSA-3ppc-4f35-3m26 --ignore=GHSA-7r86-cg39-jmmj --ignore=GHSA-23c5-xmqv-rm74 --ignore=GHSA-c2c7-rcm5-vvqj --ignore=GHSA-mp2f-45pm-3cg9",
     "preinstall": "node preinstall.js",
     "start": "yarn run dev",
     "test": "yarn run test:unit",
@@ -97,22 +97,20 @@
     "@babel/plugin-transform-regenerator": "7.28.1",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1",
     "@istanbuljs/nyc-config-typescript": "1.0.2",
     "@pmmmwh/react-refresh-webpack-plugin": "0.5.17",
     "babel-loader": "8.4.1",
-    "babel-plugin-istanbul": "7.0.0",
+    "babel-plugin-istanbul": "7.0.1",
     "babel-plugin-transform-import-meta": "2.3.3",
     "cross-env": "7.0.3",
     "css-loader": "6.11.0",
     "cypress": "14.5.2",
     "cypress-file-upload": "5.0.8",
     "file-loader": "6.2.0",
-    "istanbul": "0.4.5",
     "nyc": "17.1.0",
-    "patch-package": "8.0.0",
     "playwright-test-coverage": "1.2.12",
     "postcss-loader": "6.2.1",
     "prettier": "3.6.2",
@@ -140,21 +138,37 @@
     "cross-env": "7.0.3",
     "cross-spawn": "7.0.6",
     "dcmjs": "0.49.4",
-    "path-to-regexp": "0.1.12",
+    "path-to-regexp": "0.1.13",
     "nth-check": "2.1.1",
     "trim-newlines": "5.0.0",
     "glob-parent": "6.0.2",
     "trim": "1.0.1",
     "package-json": "8.1.1",
-    "rollup": "2.79.2",
+    "rollup": "2.80.0",
     "body-parser": "1.20.3",
-    "axios": "1.12.0",
+    "axios": "1.17.0",
     "core-js": "3.45.1",
     "@babel/runtime-corejs2": "7.26.10",
     "tapable": "2.2.2",
     "@cornerstonejs/codec-openjpeg": "1.3.0",
-    "node-forge": "1.3.2",
-    "qs": "6.14.1"
+    "node-forge": "1.4.0",
+    "qs": "6.14.1",
+    "lodash": "4.18.1",
+    "lodash-es": "4.18.1",
+    "diff": "5.2.2",
+    "webpack": "5.105.0",
+    "tar": "7.5.11",
+    "serialize-javascript": "7.0.4",
+    "svgo": "3.3.3",
+    "flatted": "3.4.2",
+    "handlebars": "4.7.9",
+    "protobufjs": "7.6.1",
+    "@babel/plugin-transform-modules-systemjs": "7.29.4",
+    "tmp": "0.2.7",
+    "form-data": "4.0.6",
+    "ws": "8.21.0",
+    "shell-quote": "1.8.4",
+    "sigstore": "4.1.1"
   },
   "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
 }

platform/app/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/app
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/app
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/app
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/app
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/app
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/app
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/app

platform/app/netlify.toml

@@ -19,7 +19,7 @@
 [build.environment]
   # If 'production', `yarn install` does not install devDependencies
   NODE_ENV = "development"
-  NODE_VERSION = "20.18.1"
+  NODE_VERSION = "20.19.0"
   YARN_VERSION = "1.22.5"
   RUBY_VERSION = "2.6.2"
   YARN_FLAGS = "--no-ignore-optional --pure-lockfile"

platform/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/app",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "productVersion": "3.4.0",
   "description": "OHIF Viewer",
   "author": "OHIF Contributors",
@@ -55,25 +55,25 @@
     "@cornerstonejs/codec-openjph": "2.4.7",
     "@cornerstonejs/dicom-image-loader": "4.15.29",
     "@emotion/serialize": "1.3.3",
-    "@ohif/core": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-rt": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-seg": "3.12.0-beta.135",
-    "@ohif/extension-cornerstone-dicom-sr": "3.12.0-beta.135",
-    "@ohif/extension-default": "3.12.0-beta.135",
-    "@ohif/extension-dicom-microscopy": "3.12.0-beta.135",
-    "@ohif/extension-dicom-pdf": "3.12.0-beta.135",
-    "@ohif/extension-dicom-video": "3.12.0-beta.135",
-    "@ohif/extension-test": "3.12.0-beta.135",
-    "@ohif/extension-ultrasound-pleura-bline": "3.12.0-beta.135",
-    "@ohif/i18n": "3.12.0-beta.135",
-    "@ohif/mode-basic-dev-mode": "3.12.0-beta.135",
-    "@ohif/mode-longitudinal": "3.12.0-beta.135",
-    "@ohif/mode-microscopy": "3.12.0-beta.135",
-    "@ohif/mode-test": "3.12.0-beta.135",
-    "@ohif/mode-ultrasound-pleura-bline": "3.12.0-beta.135",
-    "@ohif/ui": "3.12.0-beta.135",
-    "@ohif/ui-next": "3.12.0-beta.135",
+    "@ohif/core": "3.12.6",
+    "@ohif/extension-cornerstone": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-rt": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-seg": "3.12.6",
+    "@ohif/extension-cornerstone-dicom-sr": "3.12.6",
+    "@ohif/extension-default": "3.12.6",
+    "@ohif/extension-dicom-microscopy": "3.12.6",
+    "@ohif/extension-dicom-pdf": "3.12.6",
+    "@ohif/extension-dicom-video": "3.12.6",
+    "@ohif/extension-test": "3.12.6",
+    "@ohif/extension-ultrasound-pleura-bline": "3.12.6",
+    "@ohif/i18n": "3.12.6",
+    "@ohif/mode-basic-dev-mode": "3.12.6",
+    "@ohif/mode-longitudinal": "3.12.6",
+    "@ohif/mode-microscopy": "3.12.6",
+    "@ohif/mode-test": "3.12.6",
+    "@ohif/mode-ultrasound-pleura-bline": "3.12.6",
+    "@ohif/ui": "3.12.6",
+    "@ohif/ui-next": "3.12.6",
     "@svgr/webpack": "8.1.0",
     "@types/react": "18.3.23",
     "classnames": "2.5.1",

platform/app/public/config/default.js

@@ -251,6 +251,12 @@ window.config = {
       configuration: {
         friendlyName: 'dicomweb delegating proxy',
         name: 'dicomwebproxy',
+        // Security controls for runtime ?url=... datasource loading:
+        // In authenticated environments, runtime ?url origins must be allowlisted:
+        // dangerouslyAllowedOriginsForAuthenticatedEnvironments: [
+        //   'https://config.example.com',
+        //   'http://localhost:5000',
+        // ],
       },
     },
     {
@@ -259,6 +265,12 @@ window.config = {
       configuration: {
         friendlyName: 'dicom json',
         name: 'json',
+        // Security controls for runtime ?url=... datasource loading:
+        // In authenticated environments, runtime ?url origins must be allowlisted:
+        // dangerouslyAllowedOriginsForAuthenticatedEnvironments: [
+        //   'https://config.example.com',
+        //   'http://localhost:5000',
+        // ],
       },
     },
     {

platform/cli/CHANGELOG.md

@@ -3,6 +3,57 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/cli
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/cli
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/cli
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/cli
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+
+### Bug Fixes
+
+* **security:** Update various dependencies to fix security vulnerabilities. Release 3.12.2 ([#6024](https://github.com/OHIF/Viewers/issues/6024)) ([75a24a3](https://github.com/OHIF/Viewers/commit/75a24a33935bda8779da30ef9b725b387d80723d))
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/cli
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/cli

platform/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/cli",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "A CLI to bootstrap new OHIF extension or mode",
   "type": "module",
   "main": "src/index.js",
@@ -21,7 +21,7 @@
   "license": "MIT",
   "dependencies": {
     "@babel/core": "7.28.0",
-    "axios": "1.12.0",
+    "axios": "1.13.5",
     "chalk": "5.4.1",
     "execa": "8.0.1",
     "gitignore": "0.7.0",

platform/cli/templates/extension/dependencies.json

@@ -41,20 +41,16 @@
     "@babel/plugin-transform-regenerator": "^7.16.7",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "^7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "^7.27.1",
     "@babel/preset-typescript": "^7.27.1",
     "@babel/plugin-transform-private-property-in-object": "^7.27.1",
-    "@babel/eslint-parser": "7.28.0",
     "babel-loader": "^8.2.4",
     "@svgr/webpack": "^8.1.0",
-    "babel-plugin-module-resolver": "^5.0.0",
     "clean-webpack-plugin": "^4.0.0",
     "copy-webpack-plugin": "^10.2.0",
     "cross-env": "^7.0.3",
     "dotenv": "^14.1.0",
-    "eslint": "^8.39.0",
-    "eslint-loader": "^2.0.0",
     "webpack": "5.89.0",
     "webpack-merge": "^5.7.3",
     "webpack-cli": "^5.0.2"

platform/cli/templates/mode/dependencies.json

@@ -32,18 +32,15 @@
     "@babel/plugin-transform-regenerator": "^7.16.7",
     "@babel/plugin-transform-runtime": "7.28.0",
     "@babel/plugin-transform-typescript": "^7.28.0",
-    "@babel/preset-env": "7.28.0",
+    "@babel/preset-env": "7.29.5",
     "@babel/preset-react": "^7.27.1",
     "@babel/preset-typescript": "^7.27.1",
-    "@babel/eslint-parser": "7.28.0",
     "babel-loader": "^8.0.0-beta.4",
     "@svgr/webpack": "^8.1.0",
     "clean-webpack-plugin": "^4.0.0",
     "copy-webpack-plugin": "^10.2.0",
     "cross-env": "^7.0.3",
     "dotenv": "^14.1.0",
-    "eslint": "^8.39.0",
-    "eslint-loader": "^2.0.0",
     "webpack": "5.89.0",
     "webpack-merge": "^5.7.3",
     "webpack-cli": "^5.0.2"

platform/core/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/core
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/core
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/core
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/core
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/core
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/core
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/core

platform/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/core",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "Generic business logic for web-based medical imaging applications",
   "author": "OHIF Core Team",
   "license": "MIT",
@@ -39,8 +39,8 @@
     "@cornerstonejs/codec-openjph": "2.4.7",
     "@cornerstonejs/core": "4.15.29",
     "@cornerstonejs/dicom-image-loader": "4.15.29",
-    "@ohif/ui": "3.12.0-beta.135",
-    "cornerstone-math": "0.1.9",
+    "@ohif/ui": "3.12.6",
+    "cornerstone-math": "0.1.10",
     "dicom-parser": "1.8.21"
   },
   "dependencies": {

platform/docs/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package ohif-docs
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package ohif-docs
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package ohif-docs
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package ohif-docs
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package ohif-docs
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package ohif-docs
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package ohif-docs

platform/docs/docs/configuration/configurationFiles.md

@@ -312,6 +312,18 @@ reasons:
 However, if you would like to get compressed data in a specific transfer syntax, you can modify the `acceptHeader` configuration or
 `requestTransferSyntaxUID` configuration.
 
+### Data Source: stackRetrieveOptions
+At the data source configuration level, you can set `stackRetrieveOptions` to customize Cornerstone stack image retrieval. Merged with defaults; only specify overrides. For example, set `streaming: false` when the data source returns uncompressed DICOM (e.g. `application/octet-stream` only) to avoid black image on load:
+
+```js
+configuration: {
+  acceptHeader: ['application/octet-stream'],
+  stackRetrieveOptions: {
+    retrieveOptions: { single: { streaming: false } },
+  },
+}
+```
+
 ## Environment Variables
 
 We use environment variables at build and dev time to change the Viewer's

platform/docs/docs/deployment/authorization.md

@@ -66,6 +66,56 @@ http://localhost:3000/viewer?StudyInstanceUIDs=1.2.3.4.5.6.6.7&token=e123125jsdf
 
 
 
+## Securing dynamic datasource URLs
+When using `dicomwebproxy` or `dicomjson` data sources with a runtime `?url=...` query parameter,
+configure explicit trust boundaries to prevent credential exfiltration.
+
+Use these datasource configuration options:
+
+- `dangerouslyAllowedOriginsForAuthenticatedEnvironments`: Origin allowlist used only when the viewer is running in an authenticated environment. Entries may use `http://` or `https://` and can include localhost origins.
+
+Allowed entry format for `dangerouslyAllowedOriginsForAuthenticatedEnvironments`:
+
+- Must be a bare origin only: `scheme://host[:port]`
+- `http://` and `https://` are both allowed
+- Localhost is allowed when explicitly listed (for example, `http://localhost:5000`)
+- Must not include username/password, path, query string, or hash
+- Invalid entries are ignored and logged as misconfigured
+
+Policy summary:
+
+- In unauthenticated environments, any HTTP(S) `?url=` origin is allowed.
+- In authenticated environments, same-origin `?url=` values are allowed by default.
+- In authenticated environments, cross-origin `?url=` values must be present in `dangerouslyAllowedOriginsForAuthenticatedEnvironments`, otherwise loading fails closed.
+- In unauthenticated environments, cross-origin config URLs are fetched with:
+  - `method: 'GET'`
+  - `mode: 'cors'`
+  - `credentials: 'omit'`
+  - `redirect: 'error'`
+  - `referrerPolicy: 'no-referrer'`
+- In unauthenticated environments, same-origin config URLs use a plain `fetch()` call (browser default `credentials: 'same-origin'`).
+- Same-origin config URLs are fetched using simple fetch behavior (so same-origin session/cookie auth is preserved).
+- In authenticated environments, allowlisted cross-origin config URLs are fetched using simple fetch behavior.
+- Returned datasource configuration payloads are consumed as-is (no additional URL/config scrubbing).
+
+Example:
+
+```js
+dataSources: [
+  {
+    namespace: '@ohif/extension-default.dataSourcesModule.dicomwebproxy',
+    sourceName: 'dicomwebproxy',
+    configuration: {
+      name: 'dicomwebproxy',
+      dangerouslyAllowedOriginsForAuthenticatedEnvironments: [
+        'https://config.example.com',
+        'http://localhost:5000',
+      ],
+    },
+  },
+]
+```
+
 ## Implicit Flow vs Authorization Code Flow
 
 The Viewer supports both the Implicit Flow and the Authorization Code Flow. The Implicit Flow is the default currently, as it is easier to set up and use. However, you can opt for better security by using the Authorization Code Flow. To do so, add `useAuthorizationCodeFlow` to the configuration and change the `response_type` from `id_token token` to `code`.

platform/docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ohif-docs",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "private": true,
   "scripts": {
     "docusaurus": "docusaurus",
@@ -97,6 +97,12 @@
     "url-loader": "4.1.1"
   },
   "resolutions": {
-    "qs": "6.14.1"
+    "qs": "6.14.1",
+    "lodash": "4.17.23",
+    "webpack": "5.105.0",
+    "sharp": "0.34.5",
+    "serialize-javascript": "7.0.4",
+    "rollup": "2.80.0",
+    "svgo": "3.3.3"
   }
 }

platform/i18n/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/i18n
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/i18n
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/i18n
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/i18n
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/i18n
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/i18n
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/i18n

platform/i18n/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/i18n",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "Internationalization library for The OHIF Viewer",
   "author": "OHIF",
   "license": "MIT",

platform/ui-next/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/ui-next
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/ui-next
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/ui-next
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/ui-next
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/ui-next
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/ui-next
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/ui-next

platform/ui-next/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/ui-next",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "Next version of OHIF Viewers UI, more customizable using shadcn/ui",
   "main": "dist/ohif-ui-next.umd.js",
   "module": "src/index.ts",

platform/ui/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.12.6](https://github.com/OHIF/Viewers/compare/v3.12.5...v3.12.6) (2026-07-07)
+
+**Note:** Version bump only for package @ohif/ui
+
+
+
+
+
+## [3.12.5](https://github.com/OHIF/Viewers/compare/v3.12.4...v3.12.5) (2026-06-17)
+
+**Note:** Version bump only for package @ohif/ui
+
+
+
+
+
+## [3.12.4](https://github.com/OHIF/Viewers/compare/v3.12.3...v3.12.4) (2026-06-05)
+
+**Note:** Version bump only for package @ohif/ui
+
+
+
+
+
+## [3.12.3](https://github.com/OHIF/Viewers/compare/v3.12.2...v3.12.3) (2026-05-27)
+
+**Note:** Version bump only for package @ohif/ui
+
+
+
+
+
+## [3.12.2](https://github.com/OHIF/Viewers/compare/v3.12.1...v3.12.2) (2026-05-18)
+
+**Note:** Version bump only for package @ohif/ui
+
+
+
+
+
+# [3.12.0](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.135...v3.12.0) (2026-02-06)
+
+**Note:** Version bump only for package @ohif/ui
+
+
+
+
+
 # [3.12.0-beta.135](https://github.com/OHIF/Viewers/compare/v3.12.0-beta.134...v3.12.0-beta.135) (2026-02-05)
 
 **Note:** Version bump only for package @ohif/ui

platform/ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohif/ui",
-  "version": "3.12.0-beta.135",
+  "version": "3.12.6",
   "description": "A set of React components for Medical Imaging Viewers",
   "author": "OHIF Contributors",
   "license": "MIT",
@@ -58,8 +58,7 @@
     "react-test-renderer": "18.3.1",
     "react-window": "1.8.11",
     "react-with-direction": "1.4.0",
-    "swiper": "8.4.7",
-    "webpack": "5.95.0"
+    "webpack": "5.105.0"
   },
   "devDependencies": {
     "@babel/core": "7.28.0",

playwright.config.ts

@@ -2,31 +2,30 @@ import { defineConfig, devices } from '@playwright/test';
 
 export default defineConfig({
   testDir: './tests',
+  globalSetup: './tests/globalSetup.ts',
   fullyParallel: !!process.env.CI,
   forbidOnly: !!process.env.CI,
-  retries: process.env.CI ? 3 : 0,
+  retries: process.env.CI ? 1 : 0,
+  maxFailures: process.env.CI ? 10 : undefined,
   workers: process.env.CI ? 6 : undefined,
   snapshotPathTemplate: './tests/screenshots{/projectName}/{testFilePath}/{arg}{ext}',
   outputDir: './tests/test-results',
-  reporter: [
-    [
-      process.env.CI ? 'json' : 'html',
-      process.env.CI
-        ? { outputFile: './tests/playwright-report.json' }
-        : { outputFolder: './tests/playwright-report' },
-    ],
-  ],
+  reporter: [['html', { outputFolder: './tests/playwright-report' }]],
   globalTimeout: 800_000,
   timeout: 800_000,
   use: {
     baseURL: 'http://localhost:3335',
     trace: 'on-first-retry',
-    video: 'on-first-retry',
+    video: 'retain-on-failure',
     testIdAttribute: 'data-cy',
     actionTimeout: 10_000,
     launchOptions: {
       // do not hide the scrollbars so that we can assert their look-and-feel
       ignoreDefaultArgs: ['--hide-scrollbars'],
+      // Use the runner's EGL GPU stack for WebGL. Without this, Chromium falls
+      // back to software GL on the self-hosted (nashua) runner and cornerstone
+      // rendering produces wrong/blank frames, failing every screenshot test.
+      args: ['--use-gl=egl'],
     },
   },
 
@@ -49,7 +48,8 @@ export default defineConfig({
     //},
   ],
   webServer: {
-    command: 'cross-env APP_CONFIG=config/e2e.js COVERAGE=true OHIF_PORT=3335 nyc yarn start',
+    command:
+      'cross-env APP_CONFIG=config/e2e.js COVERAGE=true OHIF_PORT=3335 OHIF_OPEN=false nyc yarn start',
     url: 'http://localhost:3335',
     reuseExistingServer: !process.env.CI,
     timeout: 360_000,

publish-version.mjs

@@ -62,27 +62,40 @@ async function run() {
 
   console.log('Committing and pushing changes...');
   await execa('git', ['add', '-A']);
-  await execa('git', ['commit', '-m', 'chore(version): version.json [skip ci]']);
-  await execa('git', ['push', 'origin', branchName]);
+
+  // On re-runs after a partial release the peer-dep updates above are no-ops,
+  // leaving nothing staged. Skip the commit/push so the script stays idempotent.
+  const { stdout: stagedFiles } = await execa('git', ['diff', '--cached', '--name-only']);
+  if (stagedFiles.trim()) {
+    await execa('git', ['commit', '-m', 'chore(version): version.json [skip ci]']);
+    await execa('git', ['push', 'origin', branchName]);
+  } else {
+    console.log('No peer-dependency changes to commit, skipping');
+  }
 
   console.log('Setting the version using lerna...');
 
-  // add a message to the commit to indicate that the version was set using lerna
-  await execa('npx', [
-    'lerna',
-    'version',
-    nextVersion,
-    '--yes',
-    '--exact',
-    '--force-publish',
-    '--message',
-    'chore(version): Update package versions [skip ci]',
-    '--conventional-commits',
-    '--create-release',
-    'github',
-  ]);
+  // Skip lerna version if package versions already match the target (e.g. a
+  // previous release run finished the version bump but failed before publish).
+  if (lernaJson.version !== nextVersion.trim()) {
+    await execa('npx', [
+      'lerna',
+      'version',
+      nextVersion,
+      '--yes',
+      '--exact',
+      '--force-publish',
+      '--message',
+      'chore(version): Update package versions [skip ci]',
+      '--conventional-commits',
+      '--create-release',
+      'github',
+    ]);
 
-  console.log('Version set using lerna');
+    console.log('Version set using lerna');
+  } else {
+    console.log(`Already at target version ${nextVersion.trim()}, skipping lerna version`);
+  }
 }
 
 run().catch(err => {

tests/ArrowAnnotate.spec.ts

@@ -32,7 +32,7 @@ test('should display the arrow tool and allow free-form text to be entered', asy
 
   await checkForScreenshot({
     page,
-    maxDiffPixelRatio: 0.0075,
+    locator: page.getByTestId('viewport-grid'),
     screenshotPath: screenShotPaths.arrowAnnotate.arrowAnnotateDisplayedCorrectly0,
   });
 
@@ -46,7 +46,7 @@ test('should display the arrow tool and allow free-form text to be entered', asy
 
   await checkForScreenshot({
     page,
-    maxDiffPixelRatio: 0.0075,
+    locator: page.getByTestId('viewport-grid'),
     screenshotPath: screenShotPaths.arrowAnnotate.arrowAnnotateDisplayedCorrectly1,
   });
 
@@ -60,7 +60,7 @@ test('should display the arrow tool and allow free-form text to be entered', asy
 
   await checkForScreenshot({
     page,
-    maxDiffPixelRatio: 0.0075,
+    locator: page.getByTestId('viewport-grid'),
     screenshotPath: screenShotPaths.arrowAnnotate.arrowAnnotateDisplayedCorrectly2,
   });
 });

tests/MPRThenSEGOverlayNoHydration.spec.ts

@@ -19,11 +19,11 @@ test('should launch MPR with unhydrated SEG chosen from the data overlay menu',
 
   await page.waitForTimeout(5000);
 
-  await checkForScreenshot(
+  await checkForScreenshot({
     page,
-    page,
-    screenShotPaths.mprThenSEGOverlayNoHydration.mprPreSEGOverlayNoHydration
-  );
+    locator: page.getByTestId('viewport-grid'),
+    screenshotPath: screenShotPaths.mprThenSEGOverlayNoHydration.mprPreSEGOverlayNoHydration,
+  });
 
   // Hover over the middle/sagittal viewport so that the data overlay menu is available.
   await viewportPageObject.getById('mpr-axial').pane.hover();
@@ -39,9 +39,9 @@ test('should launch MPR with unhydrated SEG chosen from the data overlay menu',
 
   await page.waitForTimeout(5000);
 
-  await checkForScreenshot(
+  await checkForScreenshot({
     page,
-    page,
-    screenShotPaths.mprThenSEGOverlayNoHydration.mprPostSEGOverlayNoHydration
-  );
+    locator: page.getByTestId('viewport-grid'),
+    screenshotPath: screenShotPaths.mprThenSEGOverlayNoHydration.mprPostSEGOverlayNoHydration,
+  });
 });

tests/MeasurementPanel.spec.ts

@@ -158,14 +158,13 @@ test('checks if measurement item can be deleted under Measurements panel', async
 
   // Open measurement panel, confirm 3 measurements
   await rightPanelPageObject.measurementsPanel.select();
-  expect(await rightPanelPageObject.measurementsPanel.panel.getMeasurementCount()).toBe(3);
+  expect(rightPanelPageObject.measurementsPanel.panel.getMeasurementRows()).toHaveCount(3);
 
   // Delete from measurement
   await rightPanelPageObject.measurementsPanel.panel.nthMeasurement(0).actions.delete();
-  await page.waitForTimeout(200);
 
   // Confirm one measurement is gone
-  expect(await rightPanelPageObject.measurementsPanel.panel.getMeasurementCount()).toBe(2);
+  expect(rightPanelPageObject.measurementsPanel.panel.getMeasurementRows()).toHaveCount(2);
 
   // Delete all measurements via main Measurement Panel delete button and untrack
   await rightPanelPageObject.measurementsPanel.panel.deleteAll();
@@ -179,7 +178,7 @@ test('checks if measurement item can be deleted under Measurements panel', async
 
   // Check dialog closed and measurements gone
   await expect(DOMOverlayPageObject.dialog.title).toBeHidden();
-  expect(await rightPanelPageObject.measurementsPanel.panel.getMeasurementCount()).toBe(0);
+  expect(rightPanelPageObject.measurementsPanel.panel.getMeasurementRows()).toHaveCount(0);
 
   const measurementsPanel = rightPanelPageObject.measurementsPanel.panel.locator;
   await expect(measurementsPanel).toContainText('No tracked measurements');

tests/RTHydration.spec.ts

@@ -15,13 +15,25 @@ test('should hydrate RT reports correctly', async ({
   await rightPanelPageObject.toggle();
   await leftPanelPageObject.loadSeriesByModality('RTSTRUCT');
   await page.waitForTimeout(5000);
-  await checkForScreenshot(page, page, screenShotPaths.rtHydration.rtPreHydration);
+  await checkForScreenshot({
+    page,
+    locator: page.getByTestId('viewport-grid'),
+    screenshotPath: screenShotPaths.rtHydration.rtPreHydration,
+  });
 
   await DOMOverlayPageObject.viewport.segmentationHydration.yes.click();
   await page.waitForTimeout(5000);
-  await checkForScreenshot(page, page, screenShotPaths.rtHydration.rtPostHydration);
+  await checkForScreenshot({
+    page,
+    locator: page.getByTestId('viewport-grid'),
+    screenshotPath: screenShotPaths.rtHydration.rtPostHydration,
+  });
 
   await rightPanelPageObject.labelMapSegmentationPanel.panel.segmentByText('Small Sphere').click();
   await page.waitForTimeout(5000);
-  await checkForScreenshot(page, page, screenShotPaths.rtHydration.rtJumpToStructure);
+  await checkForScreenshot({
+    page,
+    locator: page.getByTestId('viewport-grid'),
+    screenshotPath: screenShotPaths.rtHydration.rtJumpToStructure,
+  });
 });

tests/RTHydration2.spec.ts

@@ -15,7 +15,11 @@ test('should hydrate RT reports correctly', async ({
   await rightPanelPageObject.toggle();
   await leftPanelPageObject.loadSeriesByModality('RTSTRUCT');
 
-  await checkForScreenshot(page, page, screenShotPaths.rtHydration2.rtPreHydration);
+  await checkForScreenshot({
+    page,
+    locator: page.getByTestId('viewport-grid'),
+    screenshotPath: screenShotPaths.rtHydration2.rtPreHydration,
+  });
   // wait for 3 seconds
   await page.evaluate(() => {
     // Access cornerstone directly from the window object
@@ -40,5 +44,9 @@ test('should hydrate RT reports correctly', async ({
 
   // should preserve zoom and pan and scroll position after hydration
   await DOMOverlayPageObject.viewport.segmentationHydration.yes.click();
-  await checkForScreenshot(page, page, screenShotPaths.rtHydration.rtPostHydration);
+  await checkForScreenshot({
+    page,
+    locator: page.getByTestId('viewport-grid'),
+    screenshotPath: screenShotPaths.rtHydration2.rtPostHydration,
+  });
 });

tests/SEGDataOverlayNoHydrationThenMPR.spec.ts

@@ -27,21 +27,23 @@ test('should launch MPR with unhydrated SEG chosen from the data overlay menu',
 
   await page.waitForTimeout(5000);
 
-  await checkForScreenshot(
+  await checkForScreenshot({
     page,
-    page,
-    screenShotPaths.segDataOverlayNoHydrationThenMPR.segDataOverlayNoHydrationPreMPR
-  );
+    locator: page.getByTestId('viewport-grid'),
+    screenshotPath:
+      screenShotPaths.segDataOverlayNoHydrationThenMPR.segDataOverlayNoHydrationPreMPR,
+  });
 
   await mainToolbarPageObject.layoutSelection.MPR.click();
 
   await page.waitForTimeout(5000);
 
-  await checkForScreenshot(
+  await checkForScreenshot({
     page,
-    page,
-    screenShotPaths.segDataOverlayNoHydrationThenMPR.segDataOverlayNoHydrationPostMPR
-  );
+    locator: page.getByTestId('viewport-grid'),
+    screenshotPath:
+      screenShotPaths.segDataOverlayNoHydrationThenMPR.segDataOverlayNoHydrationPostMPR,
+  });
 
   // Adding an overlay should not show the LOAD button.
   assertNumberOfModalityLoadBadges({ page, expectedCount: 0 });

tests/Worklist.spec.ts

@@ -35,10 +35,12 @@ test('should render scroll bars with the correct look-and-feel', async ({ page }
   // Additional wait to ensure scrollbar rendering is stable
   await page.waitForTimeout(1000);
 
+  expandedStudyRow.scrollIntoViewIfNeeded();
+
   await checkForScreenshot({
     page,
     locator: expandedStudyRow,
-    normalizedClip: { x: 0.97, y: 0.35, width: 0.03, height: 0.65 },
+    normalizedClip: { x: 0.97, y: 0.35, width: 0.028, height: 0.65 },
     screenshotPath: screenShotPaths.workList.scrollBarRenderedProperly,
   });
 });

tests/globalSetup.ts

@@ -0,0 +1,36 @@
+/**
+ * Playwright global setup (wired via `globalSetup` in playwright.config.ts).
+ *
+ * Before the test suite runs, open the viewer once against a known study to
+ * "warm up" the dev server: trigger the first (slow) lazy webpack compilation,
+ * prime the browser/codec caches, and fetch the study metadata. Without this,
+ * the first real spec frequently times out waiting on a cold server compile.
+ * This run only loads the page and waits for a viewport pane to render; it makes
+ * no assertions.
+ */
+import { chromium, type FullConfig } from '@playwright/test';
+
+const warmupStudyInstanceUID = '1.3.6.1.4.1.14519.5.2.1.1706.8374.643249677828306008300337414785';
+const warmupTimeout = 180_000;
+
+export default async function globalSetup(config: FullConfig) {
+  const baseURL = String(config.projects[0]?.use?.baseURL || 'http://localhost:3335');
+  const warmupURL = new URL(
+    `/viewer/ohif?StudyInstanceUIDs=${warmupStudyInstanceUID}`,
+    baseURL
+  ).toString();
+  const browser = await chromium.launch();
+  const page = await browser.newPage();
+
+  try {
+    page.setDefaultTimeout(warmupTimeout);
+    await page.goto(warmupURL, { waitUntil: 'domcontentloaded', timeout: warmupTimeout });
+    await page.waitForLoadState('networkidle', { timeout: warmupTimeout }).catch(() => {});
+    await page
+      .locator('[data-cy="viewport-pane"]')
+      .first()
+      .waitFor({ state: 'visible', timeout: warmupTimeout });
+  } finally {
+    await browser.close();
+  }
+}

tests/pages/RightPanelPageObject.ts

@@ -11,6 +11,10 @@ export class RightPanelPageObject {
     this.DOMOverlayPageObject = new DOMOverlayPageObject(page);
   }
 
+  private getPanelRows() {
+    return this.page.getByTestId('data-row');
+  }
+
   private getActionsMenu(row: Locator) {
     const actionsButton = row.getByTestId('actionsMenuTrigger');
 
@@ -57,12 +61,12 @@ export class RightPanelPageObject {
   }
 
   private getPanelRowByIdx(index: number) {
-    const row = this.page.getByTestId('data-row').nth(index);
+    const row = this.getPanelRows().nth(index);
     return this.getPanelRowDataObject(row);
   }
 
   private getPanelRowByText(text: string) {
-    const row = this.page.getByTestId('data-row').filter({ hasText: text });
+    const row = this.getPanelRows().filter({ hasText: text });
     return this.getPanelRowDataObject(row);
   }
 
@@ -83,7 +87,10 @@ export class RightPanelPageObject {
           await page.getByRole('button', { name: 'Delete' }).click();
         },
         getMeasurementCount: async () => {
-          return await page.getByTestId('data-row').count();
+          return await this.getPanelRows().count();
+        },
+        getMeasurementRows: () => {
+          return this.getPanelRows();
         },
         locator: page.getByTestId('trackedMeasurements-panel').last(),
         nthMeasurement(index: number) {
@@ -116,7 +123,7 @@ export class RightPanelPageObject {
 
     return {
       getSegmentCount: async () => {
-        return await page.getByTestId('data-row').count();
+        return await this.getPanelRows().count();
       },
       // No data-cy exists in this panel, using Segmentation header button
       locator: page.getByRole('button', { name: 'Segmentations' }),