256b8347e7
This is a fix to pnpm deployment which needs testing as the final part of origin/master release No functional changes * fix(docs): remove stray tool-call tags breaking the MDX build platform/docs/docs/migration-guide/3p12-to-3p13/build-tooling.md ended with two orphan closing tags (leftover tool-call serialization artifacts): </content> </invoke> Docusaurus compiles Markdown as MDX (JSX-aware), so the orphan closing tag failed the docs build: MDX compilation failed ... Unexpected closing slash in tag, expected an open tag first (build-tooling.md line 402) This was the remaining blocker for build-and-deploy-docs once the --no-frozen-lockfile change let the install step succeed. A scan of the docs tree found no other such artifacts. Verified locally: docusaurus build now generates static files with no MDX errors. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Update lockfile and avoid freshness check on every command * fix(release): keep workspace:* in the repo, concretize only at publish The release flow rewrote internal @ohif/* dependency specifiers to the concrete version and committed them, so pnpm-lock.yaml (which records workspace links) drifted from the manifests on every version bump. The resulting ERR_PNPM_OUTDATED_LOCKFILE broke every frozen install: Netlify (viewer-dev), the docs deploy, pnpm's pre-run deps check, and post-merge installs. Keep workspace:* everywhere in the committed repo and move the concrete-version substitution to publish time only: - publish-version.mjs: bump each package's own `version` field only; stop rewriting @ohif/* dependency/peerDependency specifiers. - publish-package.mjs: publish with `pnpm publish --no-git-checks` instead of `npm publish`. pnpm rewrites workspace:* to the exact version in the published tarball; npm would publish the literal "workspace:*", which npm/yarn consumers cannot resolve. - One-time: revert the 25 workspace manifests' @ohif/* specifiers to workspace:* (version fields untouched) and regenerate pnpm-lock.yaml to match. Because internal deps are workspace:* (links, not versions in the lockfile), version bumps no longer change pnpm-lock.yaml, so it stays in sync and frozen installs keep working. Verified: `pnpm install --frozen-lockfile` passes, and `pnpm pack` of @ohif/core emits a tarball whose @ohif/ui dependency is the exact version (3.13.0-beta.92), not workspace:*. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(ci): correct build-docs install comment for workspace:* release flow publish-version.mjs no longer rewrites @ohif/* deps to concrete versions, so the old comment was stale. Internal deps stay workspace:* and the lockfile stays consistent; pnpm publish concretizes only the published tarball. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(docs): use --frozen-lockfile now that the lockfile no longer drifts With internal deps as workspace:* the lockfile stays in sync across version bumps, so the docs deploy can install frozen -- failing fast on genuine lockfile drift instead of silently reconciling. The --no-frozen-lockfile workaround is no longer needed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci: use --frozen-lockfile in CI install steps now that the lockfile is stable Internal @ohif/* deps are workspace:* so pnpm-lock.yaml no longer drifts; the UNIT_TESTS/BUILD/NPM_PUBLISH installs can run frozen and fail fast on genuine drift. Kept --no-frozen-lockfile only where it is still required: the Dockerfile (platform/docs is excluded from the build context) and the playwright CS3D-version step (mutates @cornerstonejs versions before installing). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: stability of seg load mpr test * Better drag fix for crosshairs --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
88 lines
2.8 KiB
YAML
88 lines
2.8 KiB
YAML
packages:
|
|
- platform/*
|
|
- extensions/*
|
|
- modes/*
|
|
|
|
# Mirror the cornerstone3D pnpm setup (libs/@cornerstonejs) which is known-good.
|
|
nodeLinker: hoisted
|
|
strictPeerDependencies: false
|
|
linkWorkspacePackages: true
|
|
preferWorkspacePackages: true
|
|
minimumReleaseAge: 2880
|
|
# Exempt the cornerstone3D packages from the release-age check: they are pinned
|
|
# to an exact version (5.0.0) that may be newer than the cutoff. Mirrors the
|
|
# bunfig.toml `minimumReleaseAgeExcludes` list (pnpm supports glob patterns).
|
|
minimumReleaseAgeExclude:
|
|
- '@cornerstonejs/*'
|
|
frozenLockfile: true
|
|
|
|
# Skip the pre-`pnpm run` frozen deps-check; installs set freshness explicitly.
|
|
verifyDepsBeforeRun: false
|
|
|
|
# Equivalent of the bun `audit --ignore=...` flags. These GHSAs are accepted
|
|
# risk: minimatch/picomatch advisories reached only via build/CI tooling, never
|
|
# fed user-supplied expressions. Kept in sync with the .circleci SECURITY_AUDIT
|
|
# job and the root `audit` script.
|
|
auditConfig:
|
|
ignoreGhsas:
|
|
- GHSA-3ppc-4f35-3m26 # CVE-2026-26996 - minimatch (build/CI only, no CLI use)
|
|
- GHSA-7r86-cg39-jmmj # CVE-2026-27903 - minimatch (same)
|
|
- GHSA-23c5-xmqv-rm74 # CVE-2026-27904 - minimatch (same)
|
|
- GHSA-c2c7-rcm5-vvqj # CVE-2026-33671 - picomatch (build/CI only)
|
|
|
|
allowBuilds:
|
|
'@scarf/scarf': true
|
|
'@swc/core': true
|
|
core-js: true
|
|
core-js-pure: true
|
|
cypress: true
|
|
protobufjs: true
|
|
sharp: true
|
|
overrides:
|
|
# Synced from origin/master's package.json `resolutions` block during the
|
|
# merge. Keep this list aligned with master so security/version pins from
|
|
# upstream PRs land here too.
|
|
commander: 8.3.0
|
|
cross-env: 7.0.3
|
|
cross-spawn: 7.0.6
|
|
dcmjs: 0.49.4
|
|
path-to-regexp: 0.1.13
|
|
nth-check: 2.1.1
|
|
trim-newlines: 5.0.0
|
|
glob-parent: 6.0.2
|
|
trim: 1.0.1
|
|
package-json: 8.1.1
|
|
rollup: 2.80.0
|
|
body-parser: 1.20.3
|
|
axios: 1.17.0
|
|
core-js: 3.45.1
|
|
'@babel/runtime-corejs2': 7.26.10
|
|
tapable: 2.2.2
|
|
'@cornerstonejs/codec-openjpeg': 1.3.0
|
|
node-forge: 1.4.0
|
|
qs: 6.14.1
|
|
lodash: 4.18.1
|
|
lodash-es: 4.18.1
|
|
diff: 5.2.2
|
|
webpack: 5.105.0
|
|
tar: 7.5.11
|
|
serialize-javascript: 7.0.4
|
|
svgo: 3.3.3
|
|
flatted: 3.4.2
|
|
handlebars: 4.7.9
|
|
protobufjs: 7.5.7
|
|
tmp: 0.2.6
|
|
shell-quote: 1.8.4
|
|
# fast-uri <=3.1.1 reaches the tree only via platform/docs
|
|
# (@docusaurus/plugin-pwa > workbox-build > ajv). 3.1.2 patches both
|
|
# GHSA-q3j6-qgpj-74h6 (path traversal) and GHSA-v39h-62p7-jpjc (host confusion).
|
|
fast-uri: 3.1.2
|
|
'@babel/plugin-transform-modules-systemjs': 7.29.4
|
|
# pnpm-branch-only overrides (kept across merges from master).
|
|
sharp: 0.34.5
|
|
# Force a single modern tslib for the whole workspace. Without this, rxjs@6
|
|
# pulls in tslib@1, which gets hoisted to root node_modules and shadows the
|
|
# tslib@2 that modern packages (e.g. react-remove-scroll) need for
|
|
# __spreadArray.
|
|
tslib: ^2.8.1
|