fix: shellquote issue in cs3d and update for old security highs

[wayfarer3130]

No functional change, but updates to the pins to release cleanly

OHIF_REF: feat/ohifpnpm2

Context

Changes & Results

Testing

Checklist

PR

• [] My Pull Request title is descriptive, accurate and follows the
  semantic-release format and guidelines.

Code

• [] My code has been well-documented (function documentation, inline comments,
  etc.)

Public Documentation Updates

• [] The documentation page has been updated as necessary for any public API
  additions or removals.

Tested Environment

• [] "OS:
• [] "Node version:
• [] "Browser:

Summary by CodeRabbit

• Chores
  • Updated CI/CD infrastructure dependencies to latest versions for improved compatibility and security.
  • Refreshed package management configuration with updated dependency constraints.
  • Adjusted security vulnerability tracking configurations.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates GitHub Actions dependencies across nine CI workflows and adjusts pnpm workspace configuration. All workflows are upgraded to use newer major versions of core setup actions (checkout v6.0.3, pnpm-action-setup v6.0.8, setup-node v6.4.0) and artifact uploads (v7.0.1), with explicit pnpm version pins removed. The pnpm workspace configuration adds dependency overrides and clears the security audit ignore list.

Changes

GitHub Actions and Dependency Configuration Updates

Layer / File(s)	Summary
Core setup action upgrades across workflows .github/workflows/build-docs.yml, .github/workflows/codeql.yml, .github/workflows/docusaurus-build.yml, .github/workflows/format-check.yml, .github/workflows/ohif-downstream.yml, .github/workflows/playwright.yml, .github/workflows/publish-codemod-registry.yml, .github/workflows/test.yml, .github/workflows/validate-codemod-registry.yml	checkout, pnpm-action-setup, and setup-node actions are bumped to v6.0.3, v6.0.8, and v6.4.0 respectively across all nine workflows. Explicit pnpm version configurations are removed from four workflows (build-docs, format-check, ohif-downstream, validate-codemod-registry).
Artifact upload action upgrades .github/workflows/docusaurus-build.yml, .github/workflows/ohif-downstream.yml, .github/workflows/playwright.yml, .github/workflows/test.yml	upload-artifact actions are upgraded from v4 to v7.0.1 in four workflows, with explicit with: configuration blocks introduced for coverage and test results uploads.
Dependency overrides and audit configuration pnpm-workspace.yaml	shell-quote is pinned to 1.8.4, minimatch override mappings are refined with version rules for <3.1.4 and >=10.0.0 <10.2.3 ranges, and auditConfig.ignoreGhsas is cleared from a populated list to an empty array.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• cornerstonejs/cornerstone3D#2760: Both PRs modify pnpm-action-setup step configurations by removing or changing explicit pnpm version pins across multiple GitHub Actions workflows.

Suggested reviewers

• sedghi

Poem

🐇 Hop along, CI's spring is here,
Actions upgraded, versions clear,
pnpm dances without a tether,
All workflows run together,
Audit lists now bare and bright! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description provides context and references an OHIF branch, but critical sections like detailed Changes & Results and Testing steps are incomplete with only template placeholders remaining.	Fill in the 'Changes & Results' section with specific dependency updates and their effects, and add concrete testing steps in the 'Testing' section.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main changes: fixing a shellquote issue and updating security-related dependency pins, which aligns with the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/audit-shellquote

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/codeql.yml (1)

58-58: ⚖️ Poor tradeoff

Consider pinning actions to commit hashes for stronger supply chain security.

All eight workflows (codeql.yml, docusaurus-build.yml, format-check.yml, ohif-downstream.yml, playwright.yml, publish-codemod-registry.yml, test.yml, validate-codemod-registry.yml) use semantic version tags (e.g., v6.0.3) rather than commit SHA hashes for GitHub Actions references. While semantic versioning provides better maintainability, commit hash pinning offers stronger protection against supply chain attacks where action repositories could be compromised to serve malicious code under existing version tags.

The trade-off: Hash pinning requires more maintenance (manual updates) but provides immutable references; semantic versions are easier to maintain but rely on tag integrity.

Given this is a security-focused PR, you may want to evaluate whether hash pinning aligns with your security posture, especially for workflows with elevated permissions (CodeQL has security-events: write, publish-codemod-registry has id-token: write).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codeql.yml at line 58, Replace the semantic version
reference "actions/checkout@v6.0.3" with a pinned commit SHA to harden the
workflow; specifically, update the actions/checkout invocation in this workflow
(and the same actions usage across the other seven workflows:
docusaurus-build.yml, format-check.yml, ohif-downstream.yml, playwright.yml,
publish-codemod-registry.yml, test.yml, validate-codemod-registry.yml) to use
the corresponding commit hash from the actions/checkout repository instead of
the v6 tag, and ensure you verify and record the chosen commit SHAs so they can
be updated intentionally in future maintenance.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/codeql.yml:
- Line 58: Replace the semantic version reference "actions/checkout@v6.0.3" with
a pinned commit SHA to harden the workflow; specifically, update the
actions/checkout invocation in this workflow (and the same actions usage across
the other seven workflows: docusaurus-build.yml, format-check.yml,
ohif-downstream.yml, playwright.yml, publish-codemod-registry.yml, test.yml,
validate-codemod-registry.yml) to use the corresponding commit hash from the
actions/checkout repository instead of the v6 tag, and ensure you verify and
record the chosen commit SHAs so they can be updated intentionally in future
maintenance.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bb70a9e1-d52f-48e9-b891-64705885e369

📥 Commits

Reviewing files that changed from the base of the PR and between e53a155 and 60889ea.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (10)

• .github/workflows/build-docs.yml
• .github/workflows/codeql.yml
• .github/workflows/docusaurus-build.yml
• .github/workflows/format-check.yml
• .github/workflows/ohif-downstream.yml
• .github/workflows/playwright.yml
• .github/workflows/publish-codemod-registry.yml
• .github/workflows/test.yml
• .github/workflows/validate-codemod-registry.yml
• pnpm-workspace.yaml

💤 Files with no reviewable changes (1)

• .github/workflows/build-docs.yml