fix(security): update dependencies to address several vulnerabilities

[jbocce]

Context

extract-zip allows arbitrary file writes through symlink archive entries

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

SVGO: removeScripts allows executable links through namespace and control-character bypasses

Changes & Results

Patch the various packages using overrides.

Testing

All automated checks and tests must pass.

Checklist

PR

• My Pull Request title is descriptive, accurate and follows the
  semantic-release format and guidelines.

Code

• My code has been well-documented (function documentation, inline comments,
  etc.)

Public Documentation Updates

• The documentation page has been updated as necessary for any public API
  additions or removals.

Summary by CodeRabbit

• Security

  • Updated package resolution rules to address a known security advisory and ensure supported patched versions are used.

• Maintenance

  • Refreshed version constraints for image processing, SVG optimization, and YAML parsing components to improve security and compatibility.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[netlify]

✅ Deploy Preview for ohif-dev ready!

Name	Link
🔨 Latest commit	7bf8fb4
🔍 Latest deploy log	https://app.netlify.com/projects/ohif-dev/deploys/6aa19eb7fce9960008a3eee1
😎 Deploy Preview	https://deploy-preview-6263--ohif-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 94b7b3a1-67bf-4e81-a07b-6e09e6dfc476

📥 Commits

Reviewing files that changed from the base of the PR and between 00f8ff7 and 7bf8fb4.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The workspace configuration adds a GHSA ignore entry and updates version overrides for svgo, sharp, and js-yaml.

Changes

Workspace dependency updates

Layer / File(s)	Summary
Audit and dependency override updates pnpm-workspace.yaml	Adds GHSA-7pqw-9j4j-h8q3 to the ignored advisories. Updates svgo, sharp, and js-yaml override ranges and pinned versions.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 7bf8f

This updates workspace dependency overrides to patched versions and adds an audit ignore entry. No current merge-blocking production, security, or compatibility risk is evidenced.

Suggested reviewers: wayfarer3130, sedghi

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: updating dependencies to address security vulnerabilities. It follows the semantic-release format.
Description check	✅ Passed	The description explains the vulnerabilities, identifies the affected packages, describes the dependency override changes, and includes testing information and checklist items. The required Tested Env…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}