monai-weekly 1.7.dev2633__tar.gz → 1.7.dev2637__tar.gz

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2637}/MANIFEST.in

@@ -1,5 +1,6 @@
 include versioneer.py
 include monai/_version.py
+include monai/config/check_env.py
 
 include README.md
 include LICENSE

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2637}/PKG-INFO

@@ -1,15 +1,13 @@
 Metadata-Version: 2.4
 Name: monai-weekly
-Version: 1.7.dev2633
+Version: 1.7.dev2637
 Summary: AI Toolkit for Healthcare Imaging
-Home-page: https://project-monai.github.io/
-Author: MONAI Consortium
-Author-email: monai.contact@gmail.com
+Author-email: MONAI Consortium <monai.contact@gmail.com>
 License: Apache License 2.0
+Project-URL: Homepage, https://project-monai.github.io/
 Project-URL: Documentation, https://monai.readthedocs.io/
 Project-URL: Bug Tracker, https://github.com/Project-MONAI/MONAI/issues
 Project-URL: Source Code, https://github.com/Project-MONAI/MONAI
-Platform: OS Independent
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Education
 Classifier: Intended Audience :: Science/Research
@@ -28,140 +26,170 @@ Classifier: Topic :: Software Development
 Classifier: Topic :: Software Development :: Libraries
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
-Description-Content-Type: text/markdown; charset=UTF-8
+Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: torch>=2.8.0
 Requires-Dist: numpy<3.0,>=1.24
 Provides-Extra: all
-Requires-Dist: nibabel; extra == "all"
-Requires-Dist: ninja; extra == "all"
-Requires-Dist: scikit-image>=0.14.2; extra == "all"
-Requires-Dist: scipy>=1.12.0; extra == "all"
-Requires-Dist: pillow; extra == "all"
-Requires-Dist: tensorboard; extra == "all"
-Requires-Dist: gdown>=4.7.3; extra == "all"
-Requires-Dist: pytorch-ignite==0.4.11; extra == "all"
-Requires-Dist: torchio; extra == "all"
-Requires-Dist: torchvision; extra == "all"
-Requires-Dist: itk>=5.2; extra == "all"
-Requires-Dist: tqdm>=4.47.0; extra == "all"
-Requires-Dist: lmdb; extra == "all"
-Requires-Dist: psutil; extra == "all"
+Requires-Dist: clearml>=1.10.0rc0; extra == "all"
 Requires-Dist: cucim-cu12; (platform_system == "Linux" and python_version <= "3.10") and extra == "all"
 Requires-Dist: cucim-cu13; (platform_system == "Linux" and python_version >= "3.11") and extra == "all"
-Requires-Dist: openslide-python; extra == "all"
-Requires-Dist: openslide-bin; extra == "all"
-Requires-Dist: tifffile; (platform_system == "Linux" or platform_system == "Darwin") and extra == "all"
-Requires-Dist: imagecodecs; (platform_system == "Linux" or platform_system == "Darwin") and extra == "all"
-Requires-Dist: pandas; extra == "all"
 Requires-Dist: einops; extra == "all"
-Requires-Dist: transformers>=4.53.0; extra == "all"
-Requires-Dist: mlflow<3.13,>=2.12.2; extra == "all"
-Requires-Dist: clearml>=1.10.0rc0; extra == "all"
-Requires-Dist: matplotlib>=3.6.3; extra == "all"
-Requires-Dist: tensorboardX; extra == "all"
-Requires-Dist: pyyaml; extra == "all"
+Requires-Dist: filelock<3.12.0; extra == "all"
 Requires-Dist: fire; extra == "all"
-Requires-Dist: jsonschema; extra == "all"
-Requires-Dist: pynrrd; extra == "all"
-Requires-Dist: pydicom; extra == "all"
+Requires-Dist: gdown>=4.7.3; extra == "all"
 Requires-Dist: h5py; extra == "all"
-Requires-Dist: nni; (platform_system == "Linux" and "arm" not in platform_machine and "aarch" not in platform_machine) and extra == "all"
-Requires-Dist: optuna; extra == "all"
-Requires-Dist: onnx>=1.13.0; extra == "all"
-Requires-Dist: onnxruntime; extra == "all"
-Requires-Dist: zarr; extra == "all"
+Requires-Dist: huggingface_hub; extra == "all"
+Requires-Dist: imagecodecs; (platform_system == "Linux" or platform_system == "Darwin") and extra == "all"
+Requires-Dist: itk>=5.2; extra == "all"
+Requires-Dist: jsonschema; extra == "all"
+Requires-Dist: lmdb; extra == "all"
 Requires-Dist: lpips==0.1.4; extra == "all"
+Requires-Dist: matplotlib>=3.6.3; extra == "all"
+Requires-Dist: mlflow>=3.15.2; extra == "all"
+Requires-Dist: nibabel; extra == "all"
+Requires-Dist: ninja; extra == "all"
+Requires-Dist: nni; (platform_system == "Linux" and "arm" not in platform_machine and "aarch" not in platform_machine) and extra == "all"
 Requires-Dist: nvidia-ml-py; extra == "all"
-Requires-Dist: huggingface_hub; extra == "all"
+Requires-Dist: onnx_graphsurgeon; extra == "all"
+Requires-Dist: onnx>=1.13.0; extra == "all"
+Requires-Dist: onnxruntime; python_version <= "3.10" and extra == "all"
+Requires-Dist: onnxscript; extra == "all"
+Requires-Dist: openslide-bin; extra == "all"
+Requires-Dist: openslide-python; extra == "all"
+Requires-Dist: optuna; extra == "all"
+Requires-Dist: pandas; extra == "all"
+Requires-Dist: pillow!=8.3.0; extra == "all"
+Requires-Dist: polygraphy; extra == "all"
+Requires-Dist: psutil; extra == "all"
 Requires-Dist: pyamg<5.3.0,>=5.0.0; extra == "all"
-Provides-Extra: nibabel
-Requires-Dist: nibabel; extra == "nibabel"
-Provides-Extra: ninja
-Requires-Dist: ninja; extra == "ninja"
-Provides-Extra: skimage
-Requires-Dist: scikit-image>=0.14.2; extra == "skimage"
-Provides-Extra: scipy
-Requires-Dist: scipy>=1.12.0; extra == "scipy"
-Provides-Extra: pillow
-Requires-Dist: pillow!=8.3.0; extra == "pillow"
-Provides-Extra: tensorboard
-Requires-Dist: tensorboard; extra == "tensorboard"
-Provides-Extra: gdown
-Requires-Dist: gdown>=4.7.3; extra == "gdown"
-Provides-Extra: ignite
-Requires-Dist: pytorch-ignite==0.4.11; extra == "ignite"
-Provides-Extra: torchio
-Requires-Dist: torchio; extra == "torchio"
-Provides-Extra: torchvision
-Requires-Dist: torchvision; extra == "torchvision"
-Provides-Extra: itk
-Requires-Dist: itk>=5.2; extra == "itk"
-Provides-Extra: tqdm
-Requires-Dist: tqdm>=4.47.0; extra == "tqdm"
-Provides-Extra: lmdb
-Requires-Dist: lmdb; extra == "lmdb"
-Provides-Extra: psutil
-Requires-Dist: psutil; extra == "psutil"
+Requires-Dist: pybind11; extra == "all"
+Requires-Dist: pydicom; extra == "all"
+Requires-Dist: pynrrd; extra == "all"
+Requires-Dist: pytorch-ignite; extra == "all"
+Requires-Dist: pyyaml; extra == "all"
+Requires-Dist: requests; extra == "all"
+Requires-Dist: scikit-image>=0.19.0; extra == "all"
+Requires-Dist: scipy>=1.12.0; extra == "all"
+Requires-Dist: tensorboard>=2.12.0; extra == "all"
+Requires-Dist: tensorboardX; extra == "all"
+Requires-Dist: tifffile; (platform_system == "Linux" or platform_system == "Darwin") and extra == "all"
+Requires-Dist: torchio; extra == "all"
+Requires-Dist: torchvision; extra == "all"
+Requires-Dist: tqdm>=4.47.0; extra == "all"
+Requires-Dist: transformers>=5.5.0; extra == "all"
+Requires-Dist: zarr; extra == "all"
+Provides-Extra: clearml
+Requires-Dist: clearml>=1.10.0rc0; extra == "clearml"
 Provides-Extra: cucim
 Requires-Dist: cucim-cu12; (platform_system == "Linux" and python_version <= "3.10") and extra == "cucim"
 Requires-Dist: cucim-cu13; (platform_system == "Linux" and python_version >= "3.11") and extra == "cucim"
-Provides-Extra: openslide
-Requires-Dist: openslide-python; extra == "openslide"
-Requires-Dist: openslide-bin; extra == "openslide"
-Provides-Extra: tifffile
-Requires-Dist: tifffile; (platform_system == "Linux" or platform_system == "Darwin") and extra == "tifffile"
-Provides-Extra: imagecodecs
-Requires-Dist: imagecodecs; (platform_system == "Linux" or platform_system == "Darwin") and extra == "imagecodecs"
-Provides-Extra: pandas
-Requires-Dist: pandas; extra == "pandas"
+Provides-Extra: cupy
+Requires-Dist: cupy-cuda13x!=14.1.0; extra == "cupy"
 Provides-Extra: einops
 Requires-Dist: einops; extra == "einops"
-Provides-Extra: hyena
-Requires-Dist: nvsubquadratic>=0.1.1; extra == "hyena"
-Provides-Extra: transformers
-Requires-Dist: transformers<4.41.0,>=4.36.0; python_version <= "3.10" and extra == "transformers"
-Provides-Extra: mlflow
-Requires-Dist: mlflow<3.13,>=2.12.2; extra == "mlflow"
-Provides-Extra: matplotlib
-Requires-Dist: matplotlib>=3.6.3; extra == "matplotlib"
-Provides-Extra: clearml
-Requires-Dist: clearml; extra == "clearml"
-Provides-Extra: tensorboardx
-Requires-Dist: tensorboardX; extra == "tensorboardx"
-Provides-Extra: pyyaml
-Requires-Dist: pyyaml; extra == "pyyaml"
 Provides-Extra: fire
 Requires-Dist: fire; extra == "fire"
-Provides-Extra: packaging
-Requires-Dist: packaging; extra == "packaging"
-Provides-Extra: jsonschema
-Requires-Dist: jsonschema; extra == "jsonschema"
-Provides-Extra: pynrrd
-Requires-Dist: pynrrd; extra == "pynrrd"
-Provides-Extra: pydicom
-Requires-Dist: pydicom; extra == "pydicom"
+Provides-Extra: gdown
+Requires-Dist: gdown>=4.7.3; extra == "gdown"
 Provides-Extra: h5py
 Requires-Dist: h5py; extra == "h5py"
+Provides-Extra: huggingface-hub
+Requires-Dist: huggingface_hub; extra == "huggingface-hub"
+Provides-Extra: hyena
+Requires-Dist: nvsubquadratic>=0.1.1; extra == "hyena"
+Requires-Dist: omegaconf; extra == "hyena"
+Requires-Dist: einops; extra == "hyena"
+Provides-Extra: ignite
+Requires-Dist: pytorch-ignite; extra == "ignite"
+Provides-Extra: imagecodecs
+Requires-Dist: imagecodecs; (platform_system == "Linux" or platform_system == "Darwin") and extra == "imagecodecs"
+Provides-Extra: itk
+Requires-Dist: itk>=5.2; extra == "itk"
+Provides-Extra: jsonschema
+Requires-Dist: jsonschema; extra == "jsonschema"
+Provides-Extra: lmdb
+Requires-Dist: lmdb; extra == "lmdb"
+Provides-Extra: lpips
+Requires-Dist: lpips==0.1.4; extra == "lpips"
+Provides-Extra: matplotlib
+Requires-Dist: matplotlib>=3.6.3; extra == "matplotlib"
+Provides-Extra: mlflow
+Requires-Dist: mlflow>=3.15.2; extra == "mlflow"
+Provides-Extra: nibabel
+Requires-Dist: nibabel; extra == "nibabel"
 Provides-Extra: nni
 Requires-Dist: nni; (platform_system == "Linux" and "arm" not in platform_machine and "aarch" not in platform_machine) and extra == "nni"
-Provides-Extra: optuna
-Requires-Dist: optuna; extra == "optuna"
+Requires-Dist: filelock<3.12.0; extra == "nni"
+Requires-Dist: typeguard<3; extra == "nni"
 Provides-Extra: onnx
 Requires-Dist: onnx>=1.13.0; extra == "onnx"
 Requires-Dist: onnxruntime; python_version <= "3.10" and extra == "onnx"
-Provides-Extra: zarr
-Requires-Dist: zarr; extra == "zarr"
-Provides-Extra: lpips
-Requires-Dist: lpips==0.1.4; extra == "lpips"
-Provides-Extra: pynvml
-Requires-Dist: nvidia-ml-py; extra == "pynvml"
+Requires-Dist: onnx_graphsurgeon; extra == "onnx"
+Requires-Dist: onnxscript; extra == "onnx"
+Provides-Extra: openslide
+Requires-Dist: openslide-python; extra == "openslide"
+Requires-Dist: openslide-bin; extra == "openslide"
+Provides-Extra: optuna
+Requires-Dist: optuna; extra == "optuna"
+Provides-Extra: pandas
+Requires-Dist: pandas; extra == "pandas"
+Provides-Extra: pillow
+Requires-Dist: pillow!=8.3.0; extra == "pillow"
 Provides-Extra: polygraphy
 Requires-Dist: polygraphy; extra == "polygraphy"
-Provides-Extra: huggingface-hub
-Requires-Dist: huggingface_hub; extra == "huggingface-hub"
+Provides-Extra: psutil
+Requires-Dist: psutil; extra == "psutil"
 Provides-Extra: pyamg
 Requires-Dist: pyamg<5.3.0,>=5.0.0; extra == "pyamg"
+Provides-Extra: pybind11
+Requires-Dist: pybind11; extra == "pybind11"
+Provides-Extra: pydicom
+Requires-Dist: pydicom; extra == "pydicom"
+Provides-Extra: pynrrd
+Requires-Dist: pynrrd; extra == "pynrrd"
+Provides-Extra: pynvml
+Requires-Dist: nvidia-ml-py; extra == "pynvml"
+Provides-Extra: pyyaml
+Requires-Dist: pyyaml; extra == "pyyaml"
+Provides-Extra: requests
+Requires-Dist: requests; extra == "requests"
+Provides-Extra: scipy
+Requires-Dist: scipy>=1.12.0; extra == "scipy"
+Provides-Extra: skimage
+Requires-Dist: scikit-image>=0.19.0; extra == "skimage"
+Provides-Extra: tensorboard
+Requires-Dist: tensorboard>=2.12.0; extra == "tensorboard"
+Provides-Extra: tensorboardx
+Requires-Dist: tensorboardX; extra == "tensorboardx"
+Provides-Extra: tifffile
+Requires-Dist: tifffile; (platform_system == "Linux" or platform_system == "Darwin") and extra == "tifffile"
+Provides-Extra: torchio
+Requires-Dist: torchio; extra == "torchio"
+Provides-Extra: torchvision
+Requires-Dist: torchvision; extra == "torchvision"
+Provides-Extra: tqdm
+Requires-Dist: tqdm>=4.47.0; extra == "tqdm"
+Provides-Extra: transformers
+Requires-Dist: transformers>=5.5.0; extra == "transformers"
+Provides-Extra: zarr
+Requires-Dist: zarr; extra == "zarr"
+Provides-Extra: testing
+Requires-Dist: black>=26.5.1; extra == "testing"
+Requires-Dist: coverage>=5.5; extra == "testing"
+Requires-Dist: isort>9.0.0; extra == "testing"
+Requires-Dist: mccabe; extra == "testing"
+Requires-Dist: packaging; extra == "testing"
+Requires-Dist: parameterized; extra == "testing"
+Requires-Dist: pep8-naming; extra == "testing"
+Requires-Dist: pre-commit; extra == "testing"
+Requires-Dist: pycodestyle; extra == "testing"
+Requires-Dist: pyflakes; extra == "testing"
+Requires-Dist: pyrefly>=1.0.0; extra == "testing"
+Requires-Dist: ruff>=0.16.5; extra == "testing"
+Requires-Dist: tomli; extra == "testing"
+Requires-Dist: types-PyYAML; extra == "testing"
+Requires-Dist: types-setuptools; extra == "testing"
 Dynamic: license-file
 
 <p align="center">
@@ -207,7 +235,7 @@ MONAI works with the [currently supported versions of Python](https://devguide.p
 * Major releases of MONAI will have dependency versions stated for them. The current state of the `dev` branch in this repository is the unreleased development version of MONAI which typically will support current versions of dependencies and include updates and bug fixes to do so.
 * PyTorch support covers [the current version](https://github.com/pytorch/pytorch/releases) plus three previous minor versions. If compatibility issues with a PyTorch version and other dependencies arise, support for a version may be delayed until a major release.
 * Our support policy for other dependencies adheres for the most part to [SPEC0](https://scientific-python.org/specs/spec-0000), where dependency versions are supported where possible for up to two years. Discovered vulnerabilities or defects may require certain versions to be explicitly not supported.
-* See the `requirements*.txt` files for dependency version information.
+* See the `pyproject.toml` file for dependency version information.
 
 ## Installation
 

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2637}/README.md

@@ -41,7 +41,7 @@ MONAI works with the [currently supported versions of Python](https://devguide.p
 * Major releases of MONAI will have dependency versions stated for them. The current state of the `dev` branch in this repository is the unreleased development version of MONAI which typically will support current versions of dependencies and include updates and bug fixes to do so.
 * PyTorch support covers [the current version](https://github.com/pytorch/pytorch/releases) plus three previous minor versions. If compatibility issues with a PyTorch version and other dependencies arise, support for a version may be delayed until a major release.
 * Our support policy for other dependencies adheres for the most part to [SPEC0](https://scientific-python.org/specs/spec-0000), where dependency versions are supported where possible for up to two years. Discovered vulnerabilities or defects may require certain versions to be explicitly not supported.
-* See the `requirements*.txt` files for dependency version information.
+* See the `pyproject.toml` file for dependency version information.
 
 ## Installation
 

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2637}/monai/__init__.py

@@ -62,8 +62,8 @@ PY_REQUIRED_MAJOR = 3
 PY_REQUIRED_MINOR = 9
 
 version_dict = get_versions()
-__version__: str = version_dict.get("version", "0+unknown")
-__revision_id__: str = version_dict.get("full-revisionid")
+__version__: str = str(version_dict.get("version", "0+unknown"))
+__revision_id__: str = str(version_dict.get("full-revisionid") or "")
 del get_versions, version_dict
 
 __copyright__ = "(c) MONAI Consortium"
@@ -136,4 +136,4 @@ except Exception:
 
     if MONAIEnvVars.debug():
         raise
-__commit_id__ = "7f6bf2db52387d14ef867a79b888e7cc1b81c700"
+__commit_id__ = "3103fe7c3bed7952685ff05956fb85f112389a4f"

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2637}/monai/_version.py

@@ -1,5 +1,5 @@
 
-# This file was generated by 'versioneer.py' (0.23) from
+# This file was generated by 'versioneer.py' (0.29) from
 # revision-control system data, or from the parent directory name of an
 # unpacked source archive. Distribution tarballs contain a pre-generated copy
 # of this file.
@@ -8,11 +8,11 @@ import json
 
 version_json = '''
 {
- "date": "2026-08-16T02:28:27+0000",
+ "date": "2026-09-13T02:14:44+0000",
  "dirty": false,
  "error": null,
- "full-revisionid": "17ff85f5808a658c19beac995edd5c28f1ee72a3",
- "version": "1.7.dev2633"
+ "full-revisionid": "d127996ee583969c8495840104c3c3326c0614ff",
+ "version": "1.7.dev2637"
 }
 '''  # END VERSION_JSON
 

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2637}/monai/apps/auto3dseg/auto_runner.py

@@ -202,7 +202,7 @@ class AutoRunner:
 
         For the datalist file format, see the description under :py:func:`monai.data.load_decathlon_datalist`.
         Note that the AutoRunner will use the "validation" key in the datalist file if it exists, otherwise
-        it will do cross-validation, by default with five folds (this is hardcoded).
+        It will do cross-validation with the configured `num_fold` number of folds (default 5).
     """
 
     analyze_params: dict | None
@@ -398,8 +398,15 @@ class AutoRunner:
         Args:
             datalist_filename: path to the datalist file.
 
+        Returns:
+            Number of existing or generated folds, or 1 when using a validation list.
+
+        Raises:
+            ValueError: If training data is missing, fold IDs are not continuous from zero,
+                or the automatic fold count is outside [2, number of training items].
+
         Notes:
-            If the fold key is not provided, it auto generates 5 folds assignments in the training key list.
+            If the fold key is not provided, it generates the configured num_fold assignments (default 5).
             If validation key list is available, then it assumes a single fold validation.
         """
 
@@ -440,7 +447,12 @@ class AutoRunner:
             num_fold = 1
 
         else:
-            num_fold = 5
+            num_fold = int(self.data_src_cfg.get("num_fold", 5))
+            if not 2 <= num_fold <= len(datalist["training"]):
+                raise ValueError(
+                    "num_fold must be at least 2 and no greater than the number of training items "
+                    "when AutoRunner generates folds."
+                )
 
             warnings.warn(
                 f"Datalist has no folds specified {datalist_filename}..."

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2637}/monai/apps/detection/networks/retinanet_detector.py

@@ -41,7 +41,7 @@ from __future__ import annotations
 
 import warnings
 from collections.abc import Callable, Sequence
-from typing import Any
+from typing import TYPE_CHECKING, Any
 
 import torch
 from torch import Tensor, nn
@@ -59,10 +59,13 @@ from monai.inferers import SlidingWindowInferer
 from monai.networks.nets import resnet
 from monai.utils import BlendMode, PytorchPadMode, ensure_tuple_rep, optional_import
 
-BalancedPositiveNegativeSampler, _ = optional_import(
-    "torchvision.models.detection._utils", name="BalancedPositiveNegativeSampler"
-)
-Matcher, _ = optional_import("torchvision.models.detection._utils", name="Matcher")
+if TYPE_CHECKING:
+    from torchvision.models.detection._utils import BalancedPositiveNegativeSampler, Matcher
+else:
+    BalancedPositiveNegativeSampler, _ = optional_import(
+        "torchvision.models.detection._utils", name="BalancedPositiveNegativeSampler"
+    )
+    Matcher, _ = optional_import("torchvision.models.detection._utils", name="Matcher")
 
 
 class RetinaNetDetector(nn.Module):
@@ -769,10 +772,11 @@ class RetinaNetDetector(nn.Module):
             # BELOW_LOW_THRESHOLD = -1, BETWEEN_THRESHOLDS = -2
             if isinstance(self.proposal_matcher, Matcher):
                 # if torchvision matcher
+                matcher: Matcher = self.proposal_matcher
                 match_quality_matrix = self.box_overlap_metric(
                     targets_per_image[self.target_box_key].to(anchors_per_image.device), anchors_per_image
                 )
-                matched_idxs_per_image = self.proposal_matcher(match_quality_matrix)
+                matched_idxs_per_image = matcher(match_quality_matrix)
             elif isinstance(self.proposal_matcher, ATSSMatcher):
                 # if monai ATSS matcher
                 match_quality_matrix, matched_idxs_per_image = self.proposal_matcher(

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2637}/monai/apps/nnunet/nnunetv2_runner.py

@@ -17,6 +17,8 @@ import os
 import re
 import shlex
 import subprocess
+import warnings
+from concurrent.futures import ThreadPoolExecutor
 from typing import Any
 
 import monai
@@ -710,7 +712,11 @@ class nnUNetV2Runner:  # noqa: N801
         **kwargs: Any,
     ) -> None:
         """
-        Create the line command for subprocess call for parallel training.
+        Launch subprocesses for parallel training.
+
+        The commands for each GPU run sequentially on that device, while different devices run in
+        parallel. Each stage waits for all of its devices to finish before the next stage starts.
+
         Note: to set the number of GPUs to use, use ``gpu_id_for_all`` instead of the `CUDA_VISIBLE_DEVICES`
         environment variable.
 
@@ -741,17 +747,19 @@ class nnUNetV2Runner:  # noqa: N801
                     f"log '.txt' inside '{os.path.join(self.nnunet_results, self.dataset_name)}'"
                 )
         for stage in all_cmds:
-            processes = []
-            for device_id in stage:
-                if not stage[device_id]:
-                    continue
-                cmd_str = "; ".join(shlex.join(cmd) for cmd, _ in stage[device_id])
-                env = stage[device_id][0][1]
-                logger.info(f"Current running command on GPU device {device_id}:\n{cmd_str}\n")
-                processes.append(subprocess.Popen(cmd_str, shell=True, env=env, stdout=subprocess.DEVNULL))
-            # finish this stage first
-            for p in processes:
-                p.wait()
+            device_cmds = [(device_id, gpu_cmds) for device_id, gpu_cmds in stage.items() if gpu_cmds]
+            if not device_cmds:
+                continue
+
+            def _run_device_commands(item):
+                device_id, gpu_cmds = item
+                for cmd, env in gpu_cmds:
+                    cmd_str = shlex.join(cmd)
+                    logger.info(f"Current running command on GPU device {device_id}:\n{cmd_str}\n")
+                    subprocess.Popen(cmd, shell=False, env=env, stdout=subprocess.DEVNULL).wait()
+
+            with ThreadPoolExecutor(max_workers=len(device_cmds)) as executor:
+                list(executor.map(_run_device_commands, device_cmds))
 
     def validate_single_model(self, config: str, fold: int, **kwargs: Any) -> None:
         """
@@ -996,7 +1004,16 @@ class nnUNetV2Runner:  # noqa: N801
 
         # apply postprocessing
         if run_postprocessing:
-            pp_fns, pp_fn_kwargs = load_pickle(self.best_configuration["best_model_or_ensemble"]["postprocessing_file"])
+            postprocessing_file = self.best_configuration["best_model_or_ensemble"]["postprocessing_file"]
+            warnings.warn(
+                f"unpickling postprocessing_file {postprocessing_file}: this path is read from "
+                "inference_information.json and is loaded with Python pickle without any allow list, "
+                "which gives whoever controls that file arbitrary code execution. Only proceed if the "
+                "inference_information.json is from a source you trust "
+                "(see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-8f32-8649-rv87).",
+                stacklevel=2,
+            )
+            pp_fns, pp_fn_kwargs = load_pickle(postprocessing_file)
             apply_postprocessing_to_folder(
                 folder_for_pp,
                 join(target_dir_base, "ensemble_predictions_postprocessed"),

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2637}/monai/apps/utils.py

@@ -166,20 +166,20 @@ def safe_extract_member(member, extract_to):
     return full_path
 
 
-def check_hash(filepath: PathLike, val: str | None = None, hash_type: str = "md5") -> bool:
+def check_hash(filepath: PathLike, val: str | None = None, hash_type: str = "sha256") -> bool:
     """
     Verify hash signature of specified file.
 
     Args:
         filepath: path of source file to verify hash value.
         val: expected hash value of the file.
-        hash_type: type of hash algorithm to use, default is `"md5"`.
+        hash_type: type of hash algorithm to use, default is `"sha256"`.
             The supported hash types are `"md5"`, `"sha1"`, `"sha256"`, `"sha512"`.
             See also: :py:data:`monai.apps.utils.SUPPORTED_HASH_TYPES`.
 
     """
     if val is None:
-        logger.info(f"Expected {hash_type} is None, skip {hash_type} check for file {filepath}.")
+        warnings.warn(f"No hash value provided for {filepath}; file integrity is NOT verified.", stacklevel=2)
         return True
     actual_hash_func = look_up_option(hash_type.lower(), SUPPORTED_HASH_TYPES)
 
@@ -204,7 +204,7 @@ def download_url(
     url: str,
     filepath: PathLike = "",
     hash_val: str | None = None,
-    hash_type: str = "md5",
+    hash_type: str = "sha256",
     progress: bool = True,
     **gdown_kwargs: Any,
 ) -> None:
@@ -217,7 +217,8 @@ def download_url(
             If undefined, `os.path.basename(url)` will be used.
         hash_val: expected hash value to validate the downloaded file.
             if None, skip hash validation.
-        hash_type: 'md5' or 'sha1', defaults to 'md5'.
+        hash_type: type of hash algorithm to use, default is `"sha256"`.
+            The supported hash types are `"md5"`, `"sha1"`, `"sha256"`, `"sha512"`.
         progress: whether to display a progress bar.
         gdown_kwargs: other args for `gdown` except for the `url`, `output` and `quiet`.
             these args will only be used if download from google drive.
@@ -315,7 +316,7 @@ def extractall(
     filepath: PathLike,
     output_dir: PathLike = ".",
     hash_val: str | None = None,
-    hash_type: str = "md5",
+    hash_type: str = "sha256",
     file_type: str = "",
     has_base: bool = True,
 ) -> None:
@@ -328,7 +329,7 @@ def extractall(
         output_dir: target directory to save extracted files.
         hash_val: expected hash value to validate the compressed file.
             if None, skip hash validation.
-        hash_type: 'md5' or 'sha1', defaults to 'md5'.
+        hash_type: type of hash algorithm to use, default is `"sha256"`.
         file_type: string of file type for decompressing. Leave it empty to infer the type from the filepath basename.
         has_base: whether the extracted files have a base folder. This flag is used when checking if the existing
             folder is a result of `extractall`, if it is, the extraction is skipped. For example, if A.zip is unzipped
@@ -377,7 +378,7 @@ def get_filename_from_url(data_url: str) -> str:
             filename = re.findall('filename="?([^";]+)"?', content_disposition)
             if filename:
                 return str(filename[0])
-        if "drive.google.com" in data_url:
+        if urlparse(data_url).netloc == "drive.google.com":
             response = requests.get(data_url)
             if "text/html" in response.headers.get("Content-Type", ""):
                 soup = BeautifulSoup(response.text, "html.parser")
@@ -394,7 +395,7 @@ def download_and_extract(
     filepath: PathLike = "",
     output_dir: PathLike = ".",
     hash_val: str | None = None,
-    hash_type: str = "md5",
+    hash_type: str = "sha256",
     file_type: str = "",
     has_base: bool = True,
     progress: bool = True,
@@ -410,7 +411,7 @@ def download_and_extract(
             default is the current directory.
         hash_val: expected hash value to validate the downloaded file.
             if None, skip hash validation.
-        hash_type: 'md5' or 'sha1', defaults to 'md5'.
+        hash_type: type of hash algorithm to use, default is `"sha256"`.
         file_type: string of file type for decompressing. Leave it empty to infer the type from url's base file name.
         has_base: whether the extracted files have a base folder. This flag is used when checking if the existing
             folder is a result of `extractall`, if it is, the extraction is skipped. For example, if A.zip is unzipped

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2637}/monai/auto3dseg/utils.py

@@ -493,6 +493,14 @@ def algo_from_json(filename: str, template_path: PathLike | None = None, **kwarg
             if state_template_path:
                 algo_config["template_path"] = state_template_path
 
+            warnings.warn(
+                f"Loading {filename}: the file's `_target_` value is resolved to an imported callable and "
+                "invoked, and template directories from the file may be added to `sys.path`; only load "
+                "algo_object.json files from a source you trust "
+                "(see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-2wx3-8x3w-r8qv).",
+                stacklevel=2,
+            )
+
             parser = ConfigParser(algo_config)
             algo = parser.get_parsed_content()
             used_template_path = path

{monai_weekly-1.7.dev2633 → monai_weekly-1.7.dev2637}/monai/bundle/config_parser.py

@@ -162,7 +162,14 @@ class _ConfigProxy:
         try:
             return self._chain(key)
         except KeyError:
-            return getattr(self._value, key)
+            pass
+        if isinstance(self._value, dict) and key in self._value:
+            # the chained id is absent from the resolver (for example when this proxy is
+            # backed by a `$@ref`, whose children have no ids of their own), but the key
+            # does exist in the container: resolve it like `__getitem__` does, so dot- and
+            # bracket-notation agree and config keys keep precedence over dict methods.
+            return self._value[key]
+        return getattr(self._value, key)
 
     def __getitem__(self, key: str | int) -> Any:
         try: