fix: Update to use pnpm and remove bun/yarn usage by wayfarer3130 · Pull Request #2635 · cornerstonejs/cornerstone3D

wayfarer3130 · 2026-02-25T21:31:13Z

OHIF_REF: ohifohifupdateplaywightimgaes

Context

Switch to remove yarn/bun and use pnpm

Changes & Results

Testing

Checklist

PR

[] My Pull Request title is descriptive, accurate and follows the
semantic-release format and guidelines.

Code

[] My code has been well-documented (function documentation, inline comments,
etc.)

Public Documentation Updates

[] The documentation page has been updated as necessary for any public API
additions or removals.

Tested Environment

[] "OS:
[] "Node version:
[] "Browser:

wayfarer3130 · 2026-02-25T21:40:35Z

Basically all I did was ask to remove lerna and switch to pnpm/node 24 for CS3D - this is more a straw man to talk about than a final version. Certainly all the tests/setup need to still be fixed

sedghi · 2026-02-25T21:47:46Z

@wayfarer3130 great start, could you do a sample with OHIF too
I'd like to make sure linking also works fine bw cs3d and ohif

wayfarer3130 · 2026-02-26T03:56:32Z

@sedghi - passes the tests now and has nx removed

sedghi · 2026-02-26T05:47:45Z

Looks good i tested this. Can you do the same on OHIF so that we can merge together? Also don't see how we are versioning now

wayfarer3130 · 2026-03-11T02:11:15Z

Can't figure out how to get this working.

coderabbitai · 2026-05-27T19:55:14Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b249bcd5-7030-45a8-bfdb-814562e6dfaa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/pnpm

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

# Conflicts: # .github/workflows/playwright.yml # .husky/pre-commit # package.json # packages/core/package.json

wayfarer3130 · 2026-05-27T21:44:47Z

OHIF_REF: ohifohifupdateplaywightimgaes

playwright.yml's matrix had regressed to Node 20 during the beta merge, but pnpm 11 requires Node >=22.13 (uses node:sqlite), so installs crashed with ERR_UNKNOWN_BUILTIN_MODULE. Restore Node 24 everywhere and move pnpm 11.1.1 -> 11.4.0 across all workflows and packageManager. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The packageManager: pnpm@11.4.0 pin forced pnpm's precise-version auto-switch, which broke commits for anyone whose local pnpm couldn't fetch that exact build. engines.pnpm ">=11" is sufficient; CI still pins 11.4.0 via pnpm/action-setup. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CS3D lives inside the OHIF repo, whose package.json pins packageManager: yarn. With corepack enabled, dropping CS3D's own packageManager field makes corepack walk up and resolve yarn for CS3D, breaking the pnpm-based husky hook. Pin pnpm here so corepack uses (and auto-fetches) pnpm for this workspace. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

OHIF is a bun/yarn project checked out inside this pnpm workspace. Installing it with pnpm walks up to this repo's pnpm-workspace.yaml (node-linker: hoisted) and produces a mixed node_modules where OHIF's jest and CS3D's jest copies get tangled, so jest-runner resolves to a different instance than @jest/core -> "Cannot read properties of undefined (reading 'leakDetector')". Install/run the OHIF side with bun (its native package manager) so it gets a self-contained node_modules. Adds a Set up Bun step; CS3D's own install/build stay on pnpm. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

wayfarer3130 · 2026-05-28T02:24:47Z

@sedghi - this PR now passes with the same OHIF downstream tests which were failing previously. Should we merge the pnpm side of this and then finish up the OHIF fixes?

sedghi · 2026-05-28T11:20:42Z

Sure lets do it

jbocce

I am excited about this change - definitely tightens things up security wise especially for developers. That said, there are a couple of security items to consider. Thanks.

…ne3D into fix/pnpm

Issues applied.

* bump version * bump beta (#2638) * bump beta [BUMP BETA MAJOR] (#2639) * bump version * bump version [BUMP BETA MAJOR] * chore(version): Update package versions to 5.0.0-beta.1 [skip ci] * Update to use feat/use-beta-5.0-cs3d for downstream test * Revert to earlier bun/node * fix: Dependencies * feat: Add metadata module to single-source metadata (#2625) * feat: Add metadata module to single-source metadata * Revert some of hte changes to dicom image loader in favour of deprecation * Undo change * Move unit tests to metadata package * Revert changes to adapters * Revert unneeded changes * Update metadata module to use AsyncDicomListener format * fix: Add unit test * Add metadata provider and init for the new metadata function * Split module lists * update metadata versoin * Move audit to end so build steps are viewable * fix: Audit last * fix lock file mismatch * fix: metadata reference * fix: Link to metadata * fix: Move audit to a single build to allow overall PR status Previously the audit happened early and multiple times, causing issues when the audit failures were unrelated to other changes. * fix: Unused components, add ecg module * Remove subdirectory import * fix: ecg module * Remove unused lower camel case reader * Switch new/old flag to be useLegacyMetadataProvider * Add metadata module for github builds * useLegacyMetadataProvider for the karma tests needing it * Add legacy module name * PR comments * fix: Wado URI test * Update version * Missing PR rename issue * Fix init/register options to allow registering new provider This explains the differences between the legacy/default metadata provider and the data loaders themselves, which still need registering. * Add rebuild:canvas command to fix missing canvas * fix: Update way that loadImage functions with naturalized data * Cleaner listener design/setup and pas (more) tests * fix: loadImage with metadata module * fix: Transfer syntax return as string * fix: Wrong load image was getting used * Update the register to clear data * Store worker log to loglevel * fix: Various karma tests * fix: Remaining karma issues * fix: Scaling data unit tests weren't running correctly * Use fixed page size to make tests run consistently. * Set size for consistency * docusaurus build issues * Build fixes * Version fix * Update to include metadata module * Include metadata module in circleci config * fix: Build when linked * fix: workspace dependency to allow yarn 1.x * Update package module for adapters build * Try to fix adapters build issue * Export suv scaling factor * Update bun version to push an update * Link suv module specifically * fix: Merge issues * bun lock * Make node directory if it doesn't exist * fix: Add migration guide and remove prebuild:esm * Rename natural to naturalizedMetadata * More renames natural => naturalized * PR review comments * Push test versoin * Run against master instead of beta * Rerun tests * fix: Allow lower ohif_ref for reference * Invalid image position for PT and some positions with parent position * Kick updated build * PR comments to use a separate pipeline for the add handling * fix: Aspect ratio - merge had gone bad and undo missed changes * fix: Unintended merge * Only remove imageId prefix if there are at least two schemes * PR review comment fixes * Create @corenrstonejs/utils package with initial contents * fix: install * Use load local instead of upload * Fix karma tests * fix: Build issues * fix: Types on toNumber * fix: ohif-downstream to use build:esm * toNumber * Force retest * Change to allow 120 minutes for CS3D playwright tests * Update retries to match OHIF * Upload playwright results on failure * fix: Add utils path * Rename addPart10Instance * Remove cache warm up in utils * Fix function rename * PR comments - use enum values instead of literals. * fix: Resolutions so that beta installs again * Remove bom * lock * Fix docusaurus and docs build warnings/errors * tmp vuln * cornerstone3d redo viewports (#2666) * feat: Update to use pnpm and remove bun/yarn usage (#2635) * feat: pnpm 11 build/install for cs3d * Format check runs at root level rather than in each package * Enable corepack detection of pnpm version * Fix audit issue * ohif-downstream build issue * Update to beta.3 for pnpm * Update beta 3 in pnpm lock * Re-run test on updated OHIF * Fix pnpm build based on merge commit * Fix link/unlik * Fixes for linking * fix cs3d link with ohif * ci: pin Node 24 and bump pnpm to 11.4.0 playwright.yml's matrix had regressed to Node 20 during the beta merge, but pnpm 11 requires Node >=22.13 (uses node:sqlite), so installs crashed with ERR_UNKNOWN_BUILTIN_MODULE. Restore Node 24 everywhere and move pnpm 11.1.1 -> 11.4.0 across all workflows and packageManager. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: drop exact packageManager pin, rely on engines pnpm>=11 The packageManager: pnpm@11.4.0 pin forced pnpm's precise-version auto-switch, which broke commits for anyone whose local pnpm couldn't fetch that exact build. engines.pnpm ">=11" is sufficient; CI still pins 11.4.0 via pnpm/action-setup. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: restore packageManager pnpm pin for nested-repo corepack CS3D lives inside the OHIF repo, whose package.json pins packageManager: yarn. With corepack enabled, dropping CS3D's own packageManager field makes corepack walk up and resolve yarn for CS3D, breaking the pnpm-based husky hook. Pin pnpm here so corepack uses (and auto-fetches) pnpm for this workspace. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(ohif-downstream): install OHIF with bun, not pnpm OHIF is a bun/yarn project checked out inside this pnpm workspace. Installing it with pnpm walks up to this repo's pnpm-workspace.yaml (node-linker: hoisted) and produces a mixed node_modules where OHIF's jest and CS3D's jest copies get tangled, so jest-runner resolves to a different instance than @jest/core -> "Cannot read properties of undefined (reading 'leakDetector')". Install/run the OHIF side with bun (its native package manager) so it gets a self-contained node_modules. Adds a Set up Bun step; CS3D's own install/build stay on pnpm. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Update bun lock * frozen workfiles * Move frozen lockfile flag to pnpm-workspace.yaml * lock * Rerun build, resetting ohif-downstream to default * fix: unit test run * Fix chrome headless run for karma tests * Update tmp 0.2.6 to resolve the high severity issue --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com> * fix tests beta (#2749) * feat: Preserve originally-requested viewport type in rendering engines (#2751) * feat: Migrate to pnpm and update workflows for codemods package (#2752) * fix: resolve CI failures from audit and CodeQL alerts Bump vitest and @vitest/browser-playwright to 4.1.8 to clear the critical GHSA-2h32-95rg-cppp advisory blocking the CircleCI checkout job's security audit. Also address CodeQL findings introduced by the viewport refactor diff: switch example RNGs to crypto APIs, guard the annotation manager against prototype-polluting keys, and run rspack via spawnSync with an args array instead of a shell-interpolated string. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci: add manual approval gate before npm publish Insert a HOLD_FOR_APPROVAL job between BUILD and NPM_PUBLISH in the TEST_AND_RELEASE workflow so the computed version can be reviewed and approved in the CircleCI UI before any release is published. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Rebuild to check overall build status --------- Co-authored-by: Alireza <ar.sedghi@gmail.com> Co-authored-by: ohif-bot <contact@ohif.org> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com>

* bump version * bump beta (#2638) * bump beta [BUMP BETA MAJOR] (#2639) * bump version * bump version [BUMP BETA MAJOR] * chore(version): Update package versions to 5.0.0-beta.1 [skip ci] * Update to use feat/use-beta-5.0-cs3d for downstream test * Revert to earlier bun/node * fix: Dependencies * feat: Add metadata module to single-source metadata (#2625) * feat: Add metadata module to single-source metadata * Revert some of hte changes to dicom image loader in favour of deprecation * Undo change * Move unit tests to metadata package * Revert changes to adapters * Revert unneeded changes * Update metadata module to use AsyncDicomListener format * fix: Add unit test * Add metadata provider and init for the new metadata function * Split module lists * update metadata versoin * Move audit to end so build steps are viewable * fix: Audit last * fix lock file mismatch * fix: metadata reference * fix: Link to metadata * fix: Move audit to a single build to allow overall PR status Previously the audit happened early and multiple times, causing issues when the audit failures were unrelated to other changes. * fix: Unused components, add ecg module * Remove subdirectory import * fix: ecg module * Remove unused lower camel case reader * Switch new/old flag to be useLegacyMetadataProvider * Add metadata module for github builds * useLegacyMetadataProvider for the karma tests needing it * Add legacy module name * PR comments * fix: Wado URI test * Update version * Missing PR rename issue * Fix init/register options to allow registering new provider This explains the differences between the legacy/default metadata provider and the data loaders themselves, which still need registering. * Add rebuild:canvas command to fix missing canvas * fix: Update way that loadImage functions with naturalized data * Cleaner listener design/setup and pas (more) tests * fix: loadImage with metadata module * fix: Transfer syntax return as string * fix: Wrong load image was getting used * Update the register to clear data * Store worker log to loglevel * fix: Various karma tests * fix: Remaining karma issues * fix: Scaling data unit tests weren't running correctly * Use fixed page size to make tests run consistently. * Set size for consistency * docusaurus build issues * Build fixes * Version fix * Update to include metadata module * Include metadata module in circleci config * fix: Build when linked * fix: workspace dependency to allow yarn 1.x * Update package module for adapters build * Try to fix adapters build issue * Export suv scaling factor * Update bun version to push an update * Link suv module specifically * fix: Merge issues * bun lock * Make node directory if it doesn't exist * fix: Add migration guide and remove prebuild:esm * Rename natural to naturalizedMetadata * More renames natural => naturalized * PR review comments * Push test versoin * Run against master instead of beta * Rerun tests * fix: Allow lower ohif_ref for reference * Invalid image position for PT and some positions with parent position * Kick updated build * PR comments to use a separate pipeline for the add handling * fix: Aspect ratio - merge had gone bad and undo missed changes * fix: Unintended merge * Only remove imageId prefix if there are at least two schemes * PR review comment fixes * Create @corenrstonejs/utils package with initial contents * fix: install * Use load local instead of upload * Fix karma tests * fix: Build issues * fix: Types on toNumber * fix: ohif-downstream to use build:esm * toNumber * Force retest * Change to allow 120 minutes for CS3D playwright tests * Update retries to match OHIF * Upload playwright results on failure * fix: Add utils path * Rename addPart10Instance * Remove cache warm up in utils * Fix function rename * PR comments - use enum values instead of literals. * fix: Resolutions so that beta installs again * Remove bom * lock * Fix docusaurus and docs build warnings/errors * tmp vuln * cornerstone3d redo viewports (#2666) * feat: Use new extensible model for registering viewports * feat: Update to use pnpm and remove bun/yarn usage (#2635) * feat: pnpm 11 build/install for cs3d * Format check runs at root level rather than in each package * Enable corepack detection of pnpm version * Fix audit issue * ohif-downstream build issue * Update to beta.3 for pnpm * Update beta 3 in pnpm lock * Re-run test on updated OHIF * Fix pnpm build based on merge commit * Fix link/unlik * Fixes for linking * fix cs3d link with ohif * ci: pin Node 24 and bump pnpm to 11.4.0 playwright.yml's matrix had regressed to Node 20 during the beta merge, but pnpm 11 requires Node >=22.13 (uses node:sqlite), so installs crashed with ERR_UNKNOWN_BUILTIN_MODULE. Restore Node 24 everywhere and move pnpm 11.1.1 -> 11.4.0 across all workflows and packageManager. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: drop exact packageManager pin, rely on engines pnpm>=11 The packageManager: pnpm@11.4.0 pin forced pnpm's precise-version auto-switch, which broke commits for anyone whose local pnpm couldn't fetch that exact build. engines.pnpm ">=11" is sufficient; CI still pins 11.4.0 via pnpm/action-setup. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: restore packageManager pnpm pin for nested-repo corepack CS3D lives inside the OHIF repo, whose package.json pins packageManager: yarn. With corepack enabled, dropping CS3D's own packageManager field makes corepack walk up and resolve yarn for CS3D, breaking the pnpm-based husky hook. Pin pnpm here so corepack uses (and auto-fetches) pnpm for this workspace. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(ohif-downstream): install OHIF with bun, not pnpm OHIF is a bun/yarn project checked out inside this pnpm workspace. Installing it with pnpm walks up to this repo's pnpm-workspace.yaml (node-linker: hoisted) and produces a mixed node_modules where OHIF's jest and CS3D's jest copies get tangled, so jest-runner resolves to a different instance than @jest/core -> "Cannot read properties of undefined (reading 'leakDetector')". Install/run the OHIF side with bun (its native package manager) so it gets a self-contained node_modules. Adds a Set up Bun step; CS3D's own install/build stay on pnpm. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Update bun lock * frozen workfiles * Move frozen lockfile flag to pnpm-workspace.yaml * lock * Rerun build, resetting ohif-downstream to default * fix: unit test run * Fix chrome headless run for karma tests * Update tmp 0.2.6 to resolve the high severity issue --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com> * Remove bun/yarn locks * high vuln axios issue * fix tests beta (#2749) * feat: Preserve originally-requested viewport type in rendering engines (#2751) * feat: Migrate to pnpm and update workflows for codemods package (#2752) * fix: resolve CI failures from audit and CodeQL alerts Bump vitest and @vitest/browser-playwright to 4.1.8 to clear the critical GHSA-2h32-95rg-cppp advisory blocking the CircleCI checkout job's security audit. Also address CodeQL findings introduced by the viewport refactor diff: switch example RNGs to crypto APIs, guard the annotation manager against prototype-polluting keys, and run rspack via spawnSync with an args array instead of a shell-interpolated string. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci: add manual approval gate before npm publish Insert a HOLD_FOR_APPROVAL job between BUILD and NPM_PUBLISH in the TEST_AND_RELEASE workflow so the computed version can be reviewed and approved in the CircleCI UI before any release is published. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: Use better example of extension viewport - contour3d * Rebuild to check overall build status --------- Co-authored-by: Alireza <ar.sedghi@gmail.com> Co-authored-by: ohif-bot <contact@ohif.org> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Joe Boccanfuso <joe.boccanfuso@radicalimaging.com>

wayfarer3130 requested review from jbocce and sedghi February 25, 2026 21:39

wayfarer3130 changed the base branch from main to beta February 27, 2026 18:58

wayfarer3130 closed this Mar 11, 2026

wayfarer3130 reopened this May 20, 2026

feat: pnpm 11 build/install for cs3d

40bc785

wayfarer3130 force-pushed the fix/pnpm branch from 956dfcd to 40bc785 Compare May 20, 2026 13:34

wayfarer3130 added 11 commits May 20, 2026 09:44

Format check runs at root level rather than in each package

612e1b2

Enable corepack detection of pnpm version

e20e7d7

Fix audit issue

9a040e5

ohif-downstream build issue

777ff00

Update to beta.3 for pnpm

031b3c1

Update beta 3 in pnpm lock

8595ed6

Re-run test on updated OHIF

11df946

Merge remote-tracking branch 'origin/beta' into fix/pnpm

f007c66

Fix pnpm build based on merge commit

3054999

Fix link/unlik

1578ca3

Fixes for linking

8b97548

Merge remote-tracking branch 'origin/beta' into fix/pnpm

360f412

# Conflicts: # .github/workflows/playwright.yml # .husky/pre-commit # package.json # packages/core/package.json

wayfarer3130 and others added 4 commits May 27, 2026 20:14

fix cs3d link with ohif

3c8f12e

Update bun lock

33adf31

sedghi approved these changes May 28, 2026

View reviewed changes

jbocce reviewed May 28, 2026

View reviewed changes

Comment thread .circleci/config.yml

jbocce reviewed May 28, 2026

View reviewed changes

Comment thread .circleci/config.yml

jbocce reviewed May 28, 2026

View reviewed changes

Comment thread .npmrc

jbocce reviewed May 28, 2026

View reviewed changes

Comment thread package.json Outdated

jbocce reviewed May 28, 2026

View reviewed changes

Comment thread package.json Outdated

jbocce previously requested changes May 28, 2026

View reviewed changes

wayfarer3130 and others added 4 commits May 28, 2026 08:31

frozen workfiles

290ad2c

Move frozen lockfile flag to pnpm-workspace.yaml

8884910

lock

8a56af6

Merge branch 'fix/pnpm' of https://github.com/cornerstonejs/cornersto…

94833f3

…ne3D into fix/pnpm

jbocce reviewed May 28, 2026

View reviewed changes

Comment thread packages/docs/package.json

wayfarer3130 added 4 commits May 28, 2026 16:08

Rerun build, resetting ohif-downstream to default

a42aeb4

fix: unit test run

53cc122

Fix chrome headless run for karma tests

038aa5f

Update tmp 0.2.6 to resolve the high severity issue

d53b023

wayfarer3130 merged commit f848c34 into beta May 29, 2026
9 of 10 checks passed

wayfarer3130 deleted the fix/pnpm branch May 29, 2026 17:44

sedghi mentioned this pull request Jun 4, 2026

feat: Cornerstone3D 5.0 #2748

Merged

3 tasks

Conversation

wayfarer3130 commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Changes & Results

Testing

Checklist

PR

Code

Public Documentation Updates

Tested Environment

Uh oh!

wayfarer3130 commented Feb 25, 2026

Uh oh!

sedghi commented Feb 25, 2026

Uh oh!

wayfarer3130 commented Feb 26, 2026

Uh oh!

sedghi commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wayfarer3130 commented Mar 11, 2026

Uh oh!

coderabbitai Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

wayfarer3130 commented May 27, 2026

Uh oh!

wayfarer3130 commented May 28, 2026

Uh oh!

sedghi commented May 28, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jbocce left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

wayfarer3130 commented Feb 25, 2026 •

edited

Loading

sedghi commented Feb 26, 2026 •

edited

Loading

coderabbitai Bot commented May 27, 2026 •

edited

Loading