fix(security): update dependencies to patch CVEs

[jbocce]

Context

Patches the following CVEs:

GHSA-23hp-3jrh-7fpw

GHSA-xcpc-8h2w-3j85

GHSA-3jxr-9vmj-r5cp

GHSA-52cp-r559-cp3m

GHSA-8x88-c5mf-7j5w

GHSA-395f-4hp3-45gv

GHSA-gcfj-64vw-6mp9

Changes & Results

Applied resolutions for patching.

Testing

Automated tests should all pass.

Checklist

PR

• My Pull Request title is descriptive, accurate and follows the
  semantic-release format and guidelines.

Code

• My code has been well-documented (function documentation, inline comments,
  etc.)

Public Documentation Updates

• The documentation page has been updated as necessary for any public API
  additions or removals.

Summary by CodeRabbit

• Chores
  • Updated pinned dependency versions (including axios, tar, and shell-quote) and adjusted the override set to include adm-zip.
  • Added version-range override updates for brace-expansion and js-yaml to better address vulnerable ranges.
  • Improves security posture and maintenance without changing the visible app experience.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ee518560-af0c-4a7b-ba59-6bb2992aefc1

📥 Commits

Reviewing files that changed from the base of the PR and between f8602fb and f1b5ee4.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

The workspace dependency override map updates pins for axios, tar, and shell-quote, adds adm-zip, and expands brace-expansion and js-yaml version-range overrides.

Changes

Dependency override updates

Layer / File(s)	Summary
Update workspace dependency pins pnpm-workspace.yaml	Updates axios, tar, and shell-quote pins, adds adm-zip, and adds or adjusts brace-expansion and js-yaml version-range overrides.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• cornerstonejs/cornerstone3D#2761: Updates related pnpm-workspace.yaml dependency overrides, including shell-quote.
• cornerstonejs/cornerstone3D#2776: Updates dependency overrides in pnpm-workspace.yaml.
• cornerstonejs/cornerstone3D#2813: Adds another dependency override in pnpm-workspace.yaml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise, semantic-release formatted, and accurately summarizes the dependency security update.
Description check	✅ Passed	The description follows the template and covers context, changes, testing, and checklist, with only minor detail gaps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pnpm-workspace.yaml`:
- Line 67: Update the brace-expansion override in pnpm-workspace.yaml from 1.1.6
to 1.1.16, preserving the existing 1.x version-range key and override structure.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9e5699b9-2b5b-4d98-88e1-5d987767f894

📥 Commits

Reviewing files that changed from the base of the PR and between fe3a8e9 and 36e3804.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml