monai-weekly 1.7.dev2633__tar.gz → 1.7.dev2636__tar.gz

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2636}/PKG-INFO

@@ -1,15 +1,13 @@
 Metadata-Version: 2.4
 Name: monai-weekly
-Version: 1.7.dev2633
+Version: 1.7.dev2636
 Summary: AI Toolkit for Healthcare Imaging
-Home-page: https://project-monai.github.io/
-Author: MONAI Consortium
-Author-email: monai.contact@gmail.com
+Author-email: MONAI Consortium <monai.contact@gmail.com>
 License: Apache License 2.0
+Project-URL: Homepage, https://project-monai.github.io/
 Project-URL: Documentation, https://monai.readthedocs.io/
 Project-URL: Bug Tracker, https://github.com/Project-MONAI/MONAI/issues
 Project-URL: Source Code, https://github.com/Project-MONAI/MONAI
-Platform: OS Independent
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Education
 Classifier: Intended Audience :: Science/Research
@@ -28,140 +26,170 @@ Classifier: Topic :: Software Development
 Classifier: Topic :: Software Development :: Libraries
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
-Description-Content-Type: text/markdown; charset=UTF-8
+Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: torch>=2.8.0
 Requires-Dist: numpy<3.0,>=1.24
 Provides-Extra: all
-Requires-Dist: nibabel; extra == "all"
-Requires-Dist: ninja; extra == "all"
-Requires-Dist: scikit-image>=0.14.2; extra == "all"
-Requires-Dist: scipy>=1.12.0; extra == "all"
-Requires-Dist: pillow; extra == "all"
-Requires-Dist: tensorboard; extra == "all"
-Requires-Dist: gdown>=4.7.3; extra == "all"
-Requires-Dist: pytorch-ignite==0.4.11; extra == "all"
-Requires-Dist: torchio; extra == "all"
-Requires-Dist: torchvision; extra == "all"
-Requires-Dist: itk>=5.2; extra == "all"
-Requires-Dist: tqdm>=4.47.0; extra == "all"
-Requires-Dist: lmdb; extra == "all"
-Requires-Dist: psutil; extra == "all"
+Requires-Dist: clearml>=1.10.0rc0; extra == "all"
 Requires-Dist: cucim-cu12; (platform_system == "Linux" and python_version <= "3.10") and extra == "all"
 Requires-Dist: cucim-cu13; (platform_system == "Linux" and python_version >= "3.11") and extra == "all"
-Requires-Dist: openslide-python; extra == "all"
-Requires-Dist: openslide-bin; extra == "all"
-Requires-Dist: tifffile; (platform_system == "Linux" or platform_system == "Darwin") and extra == "all"
-Requires-Dist: imagecodecs; (platform_system == "Linux" or platform_system == "Darwin") and extra == "all"
-Requires-Dist: pandas; extra == "all"
 Requires-Dist: einops; extra == "all"
-Requires-Dist: transformers>=4.53.0; extra == "all"
-Requires-Dist: mlflow<3.13,>=2.12.2; extra == "all"
-Requires-Dist: clearml>=1.10.0rc0; extra == "all"
-Requires-Dist: matplotlib>=3.6.3; extra == "all"
-Requires-Dist: tensorboardX; extra == "all"
-Requires-Dist: pyyaml; extra == "all"
+Requires-Dist: filelock<3.12.0; extra == "all"
 Requires-Dist: fire; extra == "all"
-Requires-Dist: jsonschema; extra == "all"
-Requires-Dist: pynrrd; extra == "all"
-Requires-Dist: pydicom; extra == "all"
+Requires-Dist: gdown>=4.7.3; extra == "all"
 Requires-Dist: h5py; extra == "all"
-Requires-Dist: nni; (platform_system == "Linux" and "arm" not in platform_machine and "aarch" not in platform_machine) and extra == "all"
-Requires-Dist: optuna; extra == "all"
-Requires-Dist: onnx>=1.13.0; extra == "all"
-Requires-Dist: onnxruntime; extra == "all"
-Requires-Dist: zarr; extra == "all"
+Requires-Dist: huggingface_hub; extra == "all"
+Requires-Dist: imagecodecs; (platform_system == "Linux" or platform_system == "Darwin") and extra == "all"
+Requires-Dist: itk>=5.2; extra == "all"
+Requires-Dist: jsonschema; extra == "all"
+Requires-Dist: lmdb; extra == "all"
 Requires-Dist: lpips==0.1.4; extra == "all"
+Requires-Dist: matplotlib>=3.6.3; extra == "all"
+Requires-Dist: mlflow>=3.15.2; extra == "all"
+Requires-Dist: nibabel; extra == "all"
+Requires-Dist: ninja; extra == "all"
+Requires-Dist: nni; (platform_system == "Linux" and "arm" not in platform_machine and "aarch" not in platform_machine) and extra == "all"
 Requires-Dist: nvidia-ml-py; extra == "all"
-Requires-Dist: huggingface_hub; extra == "all"
+Requires-Dist: onnx_graphsurgeon; extra == "all"
+Requires-Dist: onnx>=1.13.0; extra == "all"
+Requires-Dist: onnxruntime; python_version <= "3.10" and extra == "all"
+Requires-Dist: onnxscript; extra == "all"
+Requires-Dist: openslide-bin; extra == "all"
+Requires-Dist: openslide-python; extra == "all"
+Requires-Dist: optuna; extra == "all"
+Requires-Dist: pandas; extra == "all"
+Requires-Dist: pillow!=8.3.0; extra == "all"
+Requires-Dist: polygraphy; extra == "all"
+Requires-Dist: psutil; extra == "all"
 Requires-Dist: pyamg<5.3.0,>=5.0.0; extra == "all"
-Provides-Extra: nibabel
-Requires-Dist: nibabel; extra == "nibabel"
-Provides-Extra: ninja
-Requires-Dist: ninja; extra == "ninja"
-Provides-Extra: skimage
-Requires-Dist: scikit-image>=0.14.2; extra == "skimage"
-Provides-Extra: scipy
-Requires-Dist: scipy>=1.12.0; extra == "scipy"
-Provides-Extra: pillow
-Requires-Dist: pillow!=8.3.0; extra == "pillow"
-Provides-Extra: tensorboard
-Requires-Dist: tensorboard; extra == "tensorboard"
-Provides-Extra: gdown
-Requires-Dist: gdown>=4.7.3; extra == "gdown"
-Provides-Extra: ignite
-Requires-Dist: pytorch-ignite==0.4.11; extra == "ignite"
-Provides-Extra: torchio
-Requires-Dist: torchio; extra == "torchio"
-Provides-Extra: torchvision
-Requires-Dist: torchvision; extra == "torchvision"
-Provides-Extra: itk
-Requires-Dist: itk>=5.2; extra == "itk"
-Provides-Extra: tqdm
-Requires-Dist: tqdm>=4.47.0; extra == "tqdm"
-Provides-Extra: lmdb
-Requires-Dist: lmdb; extra == "lmdb"
-Provides-Extra: psutil
-Requires-Dist: psutil; extra == "psutil"
+Requires-Dist: pybind11; extra == "all"
+Requires-Dist: pydicom; extra == "all"
+Requires-Dist: pynrrd; extra == "all"
+Requires-Dist: pytorch-ignite; extra == "all"
+Requires-Dist: pyyaml; extra == "all"
+Requires-Dist: requests; extra == "all"
+Requires-Dist: scikit-image>=0.19.0; extra == "all"
+Requires-Dist: scipy>=1.12.0; extra == "all"
+Requires-Dist: tensorboard>=2.12.0; extra == "all"
+Requires-Dist: tensorboardX; extra == "all"
+Requires-Dist: tifffile; (platform_system == "Linux" or platform_system == "Darwin") and extra == "all"
+Requires-Dist: torchio; extra == "all"
+Requires-Dist: torchvision; extra == "all"
+Requires-Dist: tqdm>=4.47.0; extra == "all"
+Requires-Dist: transformers>=5.5.0; extra == "all"
+Requires-Dist: zarr; extra == "all"
+Provides-Extra: clearml
+Requires-Dist: clearml>=1.10.0rc0; extra == "clearml"
 Provides-Extra: cucim
 Requires-Dist: cucim-cu12; (platform_system == "Linux" and python_version <= "3.10") and extra == "cucim"
 Requires-Dist: cucim-cu13; (platform_system == "Linux" and python_version >= "3.11") and extra == "cucim"
-Provides-Extra: openslide
-Requires-Dist: openslide-python; extra == "openslide"
-Requires-Dist: openslide-bin; extra == "openslide"
-Provides-Extra: tifffile
-Requires-Dist: tifffile; (platform_system == "Linux" or platform_system == "Darwin") and extra == "tifffile"
-Provides-Extra: imagecodecs
-Requires-Dist: imagecodecs; (platform_system == "Linux" or platform_system == "Darwin") and extra == "imagecodecs"
-Provides-Extra: pandas
-Requires-Dist: pandas; extra == "pandas"
+Provides-Extra: cupy
+Requires-Dist: cupy-cuda13x!=14.1.0; extra == "cupy"
 Provides-Extra: einops
 Requires-Dist: einops; extra == "einops"
-Provides-Extra: hyena
-Requires-Dist: nvsubquadratic>=0.1.1; extra == "hyena"
-Provides-Extra: transformers
-Requires-Dist: transformers<4.41.0,>=4.36.0; python_version <= "3.10" and extra == "transformers"
-Provides-Extra: mlflow
-Requires-Dist: mlflow<3.13,>=2.12.2; extra == "mlflow"
-Provides-Extra: matplotlib
-Requires-Dist: matplotlib>=3.6.3; extra == "matplotlib"
-Provides-Extra: clearml
-Requires-Dist: clearml; extra == "clearml"
-Provides-Extra: tensorboardx
-Requires-Dist: tensorboardX; extra == "tensorboardx"
-Provides-Extra: pyyaml
-Requires-Dist: pyyaml; extra == "pyyaml"
 Provides-Extra: fire
 Requires-Dist: fire; extra == "fire"
-Provides-Extra: packaging
-Requires-Dist: packaging; extra == "packaging"
-Provides-Extra: jsonschema
-Requires-Dist: jsonschema; extra == "jsonschema"
-Provides-Extra: pynrrd
-Requires-Dist: pynrrd; extra == "pynrrd"
-Provides-Extra: pydicom
-Requires-Dist: pydicom; extra == "pydicom"
+Provides-Extra: gdown
+Requires-Dist: gdown>=4.7.3; extra == "gdown"
 Provides-Extra: h5py
 Requires-Dist: h5py; extra == "h5py"
+Provides-Extra: huggingface-hub
+Requires-Dist: huggingface_hub; extra == "huggingface-hub"
+Provides-Extra: hyena
+Requires-Dist: nvsubquadratic>=0.1.1; extra == "hyena"
+Requires-Dist: omegaconf; extra == "hyena"
+Requires-Dist: einops; extra == "hyena"
+Provides-Extra: ignite
+Requires-Dist: pytorch-ignite; extra == "ignite"
+Provides-Extra: imagecodecs
+Requires-Dist: imagecodecs; (platform_system == "Linux" or platform_system == "Darwin") and extra == "imagecodecs"
+Provides-Extra: itk
+Requires-Dist: itk>=5.2; extra == "itk"
+Provides-Extra: jsonschema
+Requires-Dist: jsonschema; extra == "jsonschema"
+Provides-Extra: lmdb
+Requires-Dist: lmdb; extra == "lmdb"
+Provides-Extra: lpips
+Requires-Dist: lpips==0.1.4; extra == "lpips"
+Provides-Extra: matplotlib
+Requires-Dist: matplotlib>=3.6.3; extra == "matplotlib"
+Provides-Extra: mlflow
+Requires-Dist: mlflow>=3.15.2; extra == "mlflow"
+Provides-Extra: nibabel
+Requires-Dist: nibabel; extra == "nibabel"
 Provides-Extra: nni
 Requires-Dist: nni; (platform_system == "Linux" and "arm" not in platform_machine and "aarch" not in platform_machine) and extra == "nni"
-Provides-Extra: optuna
-Requires-Dist: optuna; extra == "optuna"
+Requires-Dist: filelock<3.12.0; extra == "nni"
+Requires-Dist: typeguard<3; extra == "nni"
 Provides-Extra: onnx
 Requires-Dist: onnx>=1.13.0; extra == "onnx"
 Requires-Dist: onnxruntime; python_version <= "3.10" and extra == "onnx"
-Provides-Extra: zarr
-Requires-Dist: zarr; extra == "zarr"
-Provides-Extra: lpips
-Requires-Dist: lpips==0.1.4; extra == "lpips"
-Provides-Extra: pynvml
-Requires-Dist: nvidia-ml-py; extra == "pynvml"
+Requires-Dist: onnx_graphsurgeon; extra == "onnx"
+Requires-Dist: onnxscript; extra == "onnx"
+Provides-Extra: openslide
+Requires-Dist: openslide-python; extra == "openslide"
+Requires-Dist: openslide-bin; extra == "openslide"
+Provides-Extra: optuna
+Requires-Dist: optuna; extra == "optuna"
+Provides-Extra: pandas
+Requires-Dist: pandas; extra == "pandas"
+Provides-Extra: pillow
+Requires-Dist: pillow!=8.3.0; extra == "pillow"
 Provides-Extra: polygraphy
 Requires-Dist: polygraphy; extra == "polygraphy"
-Provides-Extra: huggingface-hub
-Requires-Dist: huggingface_hub; extra == "huggingface-hub"
+Provides-Extra: psutil
+Requires-Dist: psutil; extra == "psutil"
 Provides-Extra: pyamg
 Requires-Dist: pyamg<5.3.0,>=5.0.0; extra == "pyamg"
+Provides-Extra: pybind11
+Requires-Dist: pybind11; extra == "pybind11"
+Provides-Extra: pydicom
+Requires-Dist: pydicom; extra == "pydicom"
+Provides-Extra: pynrrd
+Requires-Dist: pynrrd; extra == "pynrrd"
+Provides-Extra: pynvml
+Requires-Dist: nvidia-ml-py; extra == "pynvml"
+Provides-Extra: pyyaml
+Requires-Dist: pyyaml; extra == "pyyaml"
+Provides-Extra: requests
+Requires-Dist: requests; extra == "requests"
+Provides-Extra: scipy
+Requires-Dist: scipy>=1.12.0; extra == "scipy"
+Provides-Extra: skimage
+Requires-Dist: scikit-image>=0.19.0; extra == "skimage"
+Provides-Extra: tensorboard
+Requires-Dist: tensorboard>=2.12.0; extra == "tensorboard"
+Provides-Extra: tensorboardx
+Requires-Dist: tensorboardX; extra == "tensorboardx"
+Provides-Extra: tifffile
+Requires-Dist: tifffile; (platform_system == "Linux" or platform_system == "Darwin") and extra == "tifffile"
+Provides-Extra: torchio
+Requires-Dist: torchio; extra == "torchio"
+Provides-Extra: torchvision
+Requires-Dist: torchvision; extra == "torchvision"
+Provides-Extra: tqdm
+Requires-Dist: tqdm>=4.47.0; extra == "tqdm"
+Provides-Extra: transformers
+Requires-Dist: transformers>=5.5.0; extra == "transformers"
+Provides-Extra: zarr
+Requires-Dist: zarr; extra == "zarr"
+Provides-Extra: testing
+Requires-Dist: black>=26.5.1; extra == "testing"
+Requires-Dist: coverage>=5.5; extra == "testing"
+Requires-Dist: isort>9.0.0; extra == "testing"
+Requires-Dist: mccabe; extra == "testing"
+Requires-Dist: packaging; extra == "testing"
+Requires-Dist: parameterized; extra == "testing"
+Requires-Dist: pep8-naming; extra == "testing"
+Requires-Dist: pre-commit; extra == "testing"
+Requires-Dist: pycodestyle; extra == "testing"
+Requires-Dist: pyflakes; extra == "testing"
+Requires-Dist: pyrefly>=1.0.0; extra == "testing"
+Requires-Dist: ruff>=0.16.5; extra == "testing"
+Requires-Dist: tomli; extra == "testing"
+Requires-Dist: types-PyYAML; extra == "testing"
+Requires-Dist: types-setuptools; extra == "testing"
 Dynamic: license-file
 
 <p align="center">
@@ -207,7 +235,7 @@ MONAI works with the [currently supported versions of Python](https://devguide.p
 * Major releases of MONAI will have dependency versions stated for them. The current state of the `dev` branch in this repository is the unreleased development version of MONAI which typically will support current versions of dependencies and include updates and bug fixes to do so.
 * PyTorch support covers [the current version](https://github.com/pytorch/pytorch/releases) plus three previous minor versions. If compatibility issues with a PyTorch version and other dependencies arise, support for a version may be delayed until a major release.
 * Our support policy for other dependencies adheres for the most part to [SPEC0](https://scientific-python.org/specs/spec-0000), where dependency versions are supported where possible for up to two years. Discovered vulnerabilities or defects may require certain versions to be explicitly not supported.
-* See the `requirements*.txt` files for dependency version information.
+* See the `pyproject.toml` file for dependency version information.
 
 ## Installation
 

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2636}/README.md

@@ -41,7 +41,7 @@ MONAI works with the [currently supported versions of Python](https://devguide.p
 * Major releases of MONAI will have dependency versions stated for them. The current state of the `dev` branch in this repository is the unreleased development version of MONAI which typically will support current versions of dependencies and include updates and bug fixes to do so.
 * PyTorch support covers [the current version](https://github.com/pytorch/pytorch/releases) plus three previous minor versions. If compatibility issues with a PyTorch version and other dependencies arise, support for a version may be delayed until a major release.
 * Our support policy for other dependencies adheres for the most part to [SPEC0](https://scientific-python.org/specs/spec-0000), where dependency versions are supported where possible for up to two years. Discovered vulnerabilities or defects may require certain versions to be explicitly not supported.
-* See the `requirements*.txt` files for dependency version information.
+* See the `pyproject.toml` file for dependency version information.
 
 ## Installation
 

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2636}/monai/__init__.py

@@ -62,8 +62,8 @@ PY_REQUIRED_MAJOR = 3
 PY_REQUIRED_MINOR = 9
 
 version_dict = get_versions()
-__version__: str = version_dict.get("version", "0+unknown")
-__revision_id__: str = version_dict.get("full-revisionid")
+__version__: str = str(version_dict.get("version", "0+unknown"))
+__revision_id__: str = str(version_dict.get("full-revisionid") or "")
 del get_versions, version_dict
 
 __copyright__ = "(c) MONAI Consortium"
@@ -136,4 +136,4 @@ except Exception:
 
     if MONAIEnvVars.debug():
         raise
-__commit_id__ = "7f6bf2db52387d14ef867a79b888e7cc1b81c700"
+__commit_id__ = "d1306f6d1996cffeb9d10984dd1c056b7fe2ed1d"

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2636}/monai/_version.py

@@ -1,5 +1,5 @@
 
-# This file was generated by 'versioneer.py' (0.23) from
+# This file was generated by 'versioneer.py' (0.29) from
 # revision-control system data, or from the parent directory name of an
 # unpacked source archive. Distribution tarballs contain a pre-generated copy
 # of this file.
@@ -8,11 +8,11 @@ import json
 
 version_json = '''
 {
- "date": "2026-08-16T02:28:27+0000",
+ "date": "2026-09-06T02:14:40+0000",
  "dirty": false,
  "error": null,
- "full-revisionid": "17ff85f5808a658c19beac995edd5c28f1ee72a3",
- "version": "1.7.dev2633"
+ "full-revisionid": "917231cf0496c0a06cc1fe4c78822d570f8a2899",
+ "version": "1.7.dev2636"
 }
 '''  # END VERSION_JSON
 

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2636}/monai/apps/nnunet/nnunetv2_runner.py

@@ -17,6 +17,8 @@ import os
 import re
 import shlex
 import subprocess
+import warnings
+from concurrent.futures import ThreadPoolExecutor
 from typing import Any
 
 import monai
@@ -710,7 +712,11 @@ class nnUNetV2Runner:  # noqa: N801
         **kwargs: Any,
     ) -> None:
         """
-        Create the line command for subprocess call for parallel training.
+        Launch subprocesses for parallel training.
+
+        The commands for each GPU run sequentially on that device, while different devices run in
+        parallel. Each stage waits for all of its devices to finish before the next stage starts.
+
         Note: to set the number of GPUs to use, use ``gpu_id_for_all`` instead of the `CUDA_VISIBLE_DEVICES`
         environment variable.
 
@@ -741,17 +747,19 @@ class nnUNetV2Runner:  # noqa: N801
                     f"log '.txt' inside '{os.path.join(self.nnunet_results, self.dataset_name)}'"
                 )
         for stage in all_cmds:
-            processes = []
-            for device_id in stage:
-                if not stage[device_id]:
-                    continue
-                cmd_str = "; ".join(shlex.join(cmd) for cmd, _ in stage[device_id])
-                env = stage[device_id][0][1]
-                logger.info(f"Current running command on GPU device {device_id}:\n{cmd_str}\n")
-                processes.append(subprocess.Popen(cmd_str, shell=True, env=env, stdout=subprocess.DEVNULL))
-            # finish this stage first
-            for p in processes:
-                p.wait()
+            device_cmds = [(device_id, gpu_cmds) for device_id, gpu_cmds in stage.items() if gpu_cmds]
+            if not device_cmds:
+                continue
+
+            def _run_device_commands(item):
+                device_id, gpu_cmds = item
+                for cmd, env in gpu_cmds:
+                    cmd_str = shlex.join(cmd)
+                    logger.info(f"Current running command on GPU device {device_id}:\n{cmd_str}\n")
+                    subprocess.Popen(cmd, shell=False, env=env, stdout=subprocess.DEVNULL).wait()
+
+            with ThreadPoolExecutor(max_workers=len(device_cmds)) as executor:
+                list(executor.map(_run_device_commands, device_cmds))
 
     def validate_single_model(self, config: str, fold: int, **kwargs: Any) -> None:
         """
@@ -996,7 +1004,16 @@ class nnUNetV2Runner:  # noqa: N801
 
         # apply postprocessing
         if run_postprocessing:
-            pp_fns, pp_fn_kwargs = load_pickle(self.best_configuration["best_model_or_ensemble"]["postprocessing_file"])
+            postprocessing_file = self.best_configuration["best_model_or_ensemble"]["postprocessing_file"]
+            warnings.warn(
+                f"unpickling postprocessing_file {postprocessing_file}: this path is read from "
+                "inference_information.json and is loaded with Python pickle without any allow list, "
+                "which gives whoever controls that file arbitrary code execution. Only proceed if the "
+                "inference_information.json is from a source you trust "
+                "(see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-8f32-8649-rv87).",
+                stacklevel=2,
+            )
+            pp_fns, pp_fn_kwargs = load_pickle(postprocessing_file)
             apply_postprocessing_to_folder(
                 folder_for_pp,
                 join(target_dir_base, "ensemble_predictions_postprocessed"),

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2636}/monai/apps/utils.py

@@ -166,20 +166,20 @@ def safe_extract_member(member, extract_to):
     return full_path
 
 
-def check_hash(filepath: PathLike, val: str | None = None, hash_type: str = "md5") -> bool:
+def check_hash(filepath: PathLike, val: str | None = None, hash_type: str = "sha256") -> bool:
     """
     Verify hash signature of specified file.
 
     Args:
         filepath: path of source file to verify hash value.
         val: expected hash value of the file.
-        hash_type: type of hash algorithm to use, default is `"md5"`.
+        hash_type: type of hash algorithm to use, default is `"sha256"`.
             The supported hash types are `"md5"`, `"sha1"`, `"sha256"`, `"sha512"`.
             See also: :py:data:`monai.apps.utils.SUPPORTED_HASH_TYPES`.
 
     """
     if val is None:
-        logger.info(f"Expected {hash_type} is None, skip {hash_type} check for file {filepath}.")
+        warnings.warn(f"No hash value provided for {filepath}; file integrity is NOT verified.", stacklevel=2)
         return True
     actual_hash_func = look_up_option(hash_type.lower(), SUPPORTED_HASH_TYPES)
 
@@ -204,7 +204,7 @@ def download_url(
     url: str,
     filepath: PathLike = "",
     hash_val: str | None = None,
-    hash_type: str = "md5",
+    hash_type: str = "sha256",
     progress: bool = True,
     **gdown_kwargs: Any,
 ) -> None:
@@ -217,7 +217,8 @@ def download_url(
             If undefined, `os.path.basename(url)` will be used.
         hash_val: expected hash value to validate the downloaded file.
             if None, skip hash validation.
-        hash_type: 'md5' or 'sha1', defaults to 'md5'.
+        hash_type: type of hash algorithm to use, default is `"sha256"`.
+            The supported hash types are `"md5"`, `"sha1"`, `"sha256"`, `"sha512"`.
         progress: whether to display a progress bar.
         gdown_kwargs: other args for `gdown` except for the `url`, `output` and `quiet`.
             these args will only be used if download from google drive.
@@ -315,7 +316,7 @@ def extractall(
     filepath: PathLike,
     output_dir: PathLike = ".",
     hash_val: str | None = None,
-    hash_type: str = "md5",
+    hash_type: str = "sha256",
     file_type: str = "",
     has_base: bool = True,
 ) -> None:
@@ -328,7 +329,7 @@ def extractall(
         output_dir: target directory to save extracted files.
         hash_val: expected hash value to validate the compressed file.
             if None, skip hash validation.
-        hash_type: 'md5' or 'sha1', defaults to 'md5'.
+        hash_type: type of hash algorithm to use, default is `"sha256"`.
         file_type: string of file type for decompressing. Leave it empty to infer the type from the filepath basename.
         has_base: whether the extracted files have a base folder. This flag is used when checking if the existing
             folder is a result of `extractall`, if it is, the extraction is skipped. For example, if A.zip is unzipped
@@ -394,7 +395,7 @@ def download_and_extract(
     filepath: PathLike = "",
     output_dir: PathLike = ".",
     hash_val: str | None = None,
-    hash_type: str = "md5",
+    hash_type: str = "sha256",
     file_type: str = "",
     has_base: bool = True,
     progress: bool = True,
@@ -410,7 +411,7 @@ def download_and_extract(
             default is the current directory.
         hash_val: expected hash value to validate the downloaded file.
             if None, skip hash validation.
-        hash_type: 'md5' or 'sha1', defaults to 'md5'.
+        hash_type: type of hash algorithm to use, default is `"sha256"`.
         file_type: string of file type for decompressing. Leave it empty to infer the type from url's base file name.
         has_base: whether the extracted files have a base folder. This flag is used when checking if the existing
             folder is a result of `extractall`, if it is, the extraction is skipped. For example, if A.zip is unzipped

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2636}/monai/auto3dseg/utils.py

@@ -493,6 +493,14 @@ def algo_from_json(filename: str, template_path: PathLike | None = None, **kwarg
             if state_template_path:
                 algo_config["template_path"] = state_template_path
 
+            warnings.warn(
+                f"Loading {filename}: the file's `_target_` value is resolved to an imported callable and "
+                "invoked, and template directories from the file may be added to `sys.path`; only load "
+                "algo_object.json files from a source you trust "
+                "(see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-2wx3-8x3w-r8qv).",
+                stacklevel=2,
+            )
+
             parser = ConfigParser(algo_config)
             algo = parser.get_parsed_content()
             used_template_path = path

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2636}/monai/bundle/config_parser.py

@@ -162,7 +162,14 @@ class _ConfigProxy:
         try:
             return self._chain(key)
         except KeyError:
-            return getattr(self._value, key)
+            pass
+        if isinstance(self._value, dict) and key in self._value:
+            # the chained id is absent from the resolver (for example when this proxy is
+            # backed by a `$@ref`, whose children have no ids of their own), but the key
+            # does exist in the container: resolve it like `__getitem__` does, so dot- and
+            # bracket-notation agree and config keys keep precedence over dict methods.
+            return self._value[key]
+        return getattr(self._value, key)
 
     def __getitem__(self, key: str | int) -> Any:
         try: