fix(security): update dependencies to fix security vulnerabilities OHIF-2682

[jbocce]

Context

GHSA-2p49-hgcm-8545

GHSA-v2hh-gcrm-f6hx

GHSA-4c8g-83qw-93j6

GHSA-p63j-vcc4-9vmv

GHSA-v245-v573-v5vm

Changes & Results

Update dependencies

Testing

automated tests must pass

Checklist

PR

• My Pull Request title is descriptive, accurate and follows the
  semantic-release format and guidelines.

Code

• My code has been well-documented (function documentation, inline comments,
  etc.)

Public Documentation Updates

• The documentation page has been updated as necessary for any public API
  additions or removals.

Summary by CodeRabbit

• Chores
  • Updated internal tooling and package version overrides to newer compatible releases.
  • Improved project maintenance and dependency consistency without changing the application’s user-facing behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

Updates the Vitest browser Playwright dependency and adjusts workspace overrides for svgo, fast-uri, and linkify-it to use scoped version rules.

Changes

Dependency maintenance

Layer / File(s)	Summary
Browser Playwright dependency update package.json	Updates @vitest/browser-playwright from 4.1.8 to 4.1.10.
Workspace override rules pnpm-workspace.yaml	Replaces unscoped svgo and fast-uri pins with scoped semver overrides and changes linkify-it to a scoped <=5.0.1 override targeting 5.0.2.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• cornerstonejs/cornerstone3D#2764: Updates dependency override and resolution entries in pnpm-workspace.yaml.
• cornerstonejs/cornerstone3D#2776: Modifies the linkify-it override in the same workspace configuration.

Suggested reviewers: wayfarer3130

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the dependency security update and matches the PR's main change.
Description check	✅ Passed	The description follows the template and includes context, changes, testing, and a completed checklist.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 96: Align the package.json vitest dependency with
`@vitest/browser-playwright` at version 4.1.10, then regenerate pnpm-lock.yaml so
all Vitest packages resolve to the same patch version.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c057e9df-9837-408f-987b-36aa958aced2

📥 Commits

Reviewing files that changed from the base of the PR and between 0b601d8 and 7a8353e.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• package.json
• pnpm-workspace.yaml

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package.json relevant lines =="
sed -n '85,102p;160,172p' package.json

echo
echo "== lockfile vitest entries (sample) =="
awk '
  "/node_modules/vitest@/ || /node_modules\/@vitest\/browser-playwright@/ {p=1}
   p && /^  [^ ]/ {exit}
   p {print NR": "$0}
' pnpm-lock.yaml | sed -n '1,120p'

echo
echo "== search exact peer deps for `@vitest/browser-playwright` =="
python3 - <<'PY'
import json, re, pathlib
pkg=json.loads(pathlib.Path('package.json').read_text())
for sec in ('dependencies','devDependencies','optionalDependencies','peerDependencies'):
    print(sec, pkg.get(sec,{}).get('`@vitest/browser-playwright`'), pkg.get(sec,{}).get('vitest'))
PY

echo
echo "== fetch official package manifests =="
python3 - <<'PY'
import json, urllib.request
for name, ver in [('vitest','4.1.8'),('`@vitest/browser-playwright`','4.1.10'),('`@vitest/browser-playwright`','4.1.9')]:
    url=f'https://registry.npmjs.org/{name}/-/'+name+'-'+ver+'.tgz'
    try:
        data=urllib.request.urlopen(url, timeout=20).read()
        import tarfile, io
        with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as tf:
            pm=tf.extractfile(tf.getnames()[0][:-9]+'package.json')
            pkg=json.load(pm)
        print(name+' @'+ver)
        for k in ('version','files','dependencies','devDependencies','peerDependencies','peerDependenciesMeta'):
            v=pkg.get(k)
            if isinstance(v, (dict,str,list)) and v and k != 'files':
                print(f'  {k}: {json.dumps(v, ensure_ascii=False, indent=2)[:800]}')
    except Exception as e:
        print(name+' @'+ver + ': ERROR ' + str(e))
PY

Repository: cornerstonejs/cornerstone3D

Length of output: 1333

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package.json relevant lines =="
sed -n '85,102p;160,172p' package.json

echo
echo "== lockfile vitest entries (sample) =="
awk '
  "/node_modules/vitest@/ || /node_modules\/@vitest\/browser-playwright@/ {p=1}
   p && /^  [^ ]/ {exit}
   p {print NR": "$0}
' pnpm-lock.yaml | sed -n '1,120p'

echo
echo "== search exact peer deps for `@vitest/browser-playwright` =="
python3 - <<'PY'
import json, re, pathlib
pkg=json.loads(pathlib.Path('package.json').read_text())
for sec in ('dependencies','devDependencies','optionalDependencies','peerDependencies'):
    print(sec, (pkg.get(sec,{}).get('`@vitest/browser-playwright`'), pkg.get(sec,{}).get('vitest')))
PY

echo
echo "== fetch official package manifests =="
python3 - <<'PY'
import json, urllib.request
for name, ver in [('vitest','4.1.8'),('`@vitest/browser-playwright`','4.1.10'),('`@vitest/browser-playwright`','4.1.9')]:
    url=f'https://registry.npmjs.org/{name}/-/'+name+'-'+ver+'.tgz'
    try:
        data=urllib.request.urlopen(url, timeout=20).read()
        import tarfile, io
        with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as tf:
            pm=tf.extractfile(tf.getnames()[0][:-9]+'package.json')
            pkg=json.load(pm)
        print(name+' @'+ver)
        for k in ('version','dependencies','devDependencies','peerDependencies','peerDependenciesMeta'):
            v=pkg.get(k)
            if isinstance(v, (dict,str,list)) and v and k != 'files':
                print(f'  {k}: {json.dumps(v, ensure_ascii=False)[:1200]}')
    except Exception as e:
        print(name+' @'+ver + ': ERROR ' + str(e))
PY

Repository: cornerstonejs/cornerstone3D

Length of output: 1333

---

Keep the Vitest packages on the same patch version.

vitest is still 4.1.8 while @vitest/browser-playwright is 4.1.10; align vitest to 4.1.10 and regenerate pnpm-lock.yaml so browser tests do not run with mixed Vitest package versions.

Proposed fix

-    "vitest": "4.1.8",
+    "vitest": "4.1.10",

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 96, Align the package.json vitest dependency with
`@vitest/browser-playwright` at version 4.1.10, then regenerate pnpm-lock.yaml so
all Vitest packages resolve to the same patch version.