Merge branch 'Project-MONAI:dev' into feature/issue-7334

Author: einsyang723

.github/workflows/pythonapp-min.yml

@@ -124,7 +124,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        pytorch-version: ['2.4.1', '2.5.1', '2.6.0', '2.7.1']
+        pytorch-version: ['2.5.1', '2.6.0', '2.7.1', '2.8.0']
     timeout-minutes: 40
     steps:
     - uses: actions/checkout@v4

.github/workflows/pythonapp.yml

@@ -94,7 +94,7 @@ jobs:
     - if: runner.os == 'windows'
       name: Install torch cpu from pytorch.org (Windows only)
       run: |
-        python -m pip install torch==2.4.1 torchvision==0.19.1+cpu --index-url https://download.pytorch.org/whl/cpu
+        python -m pip install torch==2.5.1 torchvision==0.20.1+cpu --index-url https://download.pytorch.org/whl/cpu
     - if: runner.os == 'Linux'
       name: Install itk pre-release (Linux only)
       run: |
@@ -103,7 +103,7 @@ jobs:
     - name: Install the dependencies
       run: |
         python -m pip install --user --upgrade pip wheel
-        python -m pip install torch==2.4.1 torchvision==0.19.1
+        python -m pip install torch==2.5.1 torchvision==0.20.1
         cat "requirements-dev.txt"
         python -m pip install -r requirements-dev.txt
         python -m pip list
@@ -155,7 +155,7 @@ jobs:
         # install the latest pytorch for testing
         # however, "pip install monai*.tar.gz" will build cpp/cuda with an isolated
         # fresh torch installation according to pyproject.toml
-        python -m pip install torch>=2.4.1 torchvision
+        python -m pip install torch>=2.5.1 torchvision
     - name: Check packages
       run: |
         pip uninstall monai

CONTRIBUTING.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+## Reporting a Vulnerability
+MONAI takes security seriously and appreciate your efforts to responsibly disclose vulnerabilities. If you discover a security issue, please report it as soon as possible.
+
+To report a security issue:
+* please use the GitHub Security Advisories tab to "[Open a draft security advisory](https://github.com/Project-MONAI/MONAI/security/advisories/new)".
+* Include a detailed description of the issue, steps to reproduce, potential impact, and any possible mitigations.
+* If applicable, please also attach proof-of-concept code or screenshots.
+* We aim to acknowledge your report within 72 hours and provide a status update as we investigate.
+* Please do not create public issues for security-related reports.
+
+## Disclosure Policy
+* We follow a coordinated disclosure approach.
+* We will not publicly disclose vulnerabilities until a fix has been developed and released.
+* Credit will be given to researchers who responsibly disclose vulnerabilities, if requested.
+## Acknowledgements
+We greatly appreciate contributions from the security community and strive to recognize all researchers who help keep MONAI safe.

SECURITY.md

@@ -40,6 +40,6 @@ onnx>=1.13.0
 onnxruntime; python_version <= '3.10'
 zarr
 huggingface_hub
-pyamg>=5.0.0
+pyamg>=5.0.0, <5.3.0
 packaging
 polygraphy

docs/requirements.txt

@@ -194,6 +194,15 @@ class AutoRunner:
             ├── segresnet2d_0       # network scripts/configs/checkpoints and pickle object of the algo
             └── swinunetr_0         # network scripts/configs/checkpoints and pickle object of the algo
 
+
+        The input config requires at least the following keys:
+            - ``modality``: the modality of the data, e.g. "ct", "mri", etc.
+            - ``datalist``: the path to the datalist file in JSON format.
+            - ``dataroot``: the root directory of the data files.
+
+        For the datalist file format, see the description under :py:func:`monai.data.load_decathlon_datalist`.
+        Note that the AutoRunner will use the "validation" key in the datalist file if it exists, otherwise
+        it will do cross-validation, by default with five folds (this is hardcoded).
     """
 
     analyze_params: dict | None

monai/apps/auto3dseg/auto_runner.py

@@ -457,7 +457,7 @@ def _compute_statistics(self, results_list: list[dict[int, dict[str, np.ndarray]
                 dt_ignores = np.concatenate([r["dtIgnore"][:, 0:max_det] for r in results], axis=1)[:, inds]
                 self.check_number_of_iou(dt_matches, dt_ignores)
                 gt_ignore = np.concatenate([r["gtIgnore"] for r in results])
-                num_gt = np.count_nonzero(gt_ignore == 0)  # number of ground truth boxes (non ignored)
+                num_gt = int(np.count_nonzero(gt_ignore == 0))  # number of ground truth boxes (non ignored)
                 if num_gt == 0:
                     logger.warning(f"WARNING, no gt found for coco metric for class {cls_i}")
                     continue
@@ -523,13 +523,12 @@ def _compute_stats_single_threshold(
         recall = 0
 
     # array where precision values nearest to given recall th are saved
-    precision = np.zeros((num_recall_th,))
+    precision = [0.0] * num_recall_th
     # save scores for corresponding recall value in here
     th_scores = np.zeros((num_recall_th,))
     # numpy is slow without cython optimization for accessing elements
     # use python array gets significant speed improvement
     pr = pr.tolist()
-    precision = precision.tolist()
 
     # smooth precision curve (create box shape)
     for i in range(len(tp) - 1, 0, -1):

monai/apps/detection/metrics/coco.py

@@ -357,7 +357,7 @@ def set_atss_matcher(self, num_candidates: int = 4, center_in_gt: bool = False)
             num_candidates: number of positions to select candidates from.
                 Smaller value will result in a higher matcher threshold and less matched candidates.
             center_in_gt: If False (default), matched anchor center points do not need
-                to lie withing the ground truth box. Recommend False for small objects.
+                to lie within the ground truth box. Recommend False for small objects.
                 If True, will result in a strict matcher and less matched candidates.
         """
         self.proposal_matcher = ATSSMatcher(num_candidates, self.box_overlap_metric, center_in_gt, debug=self.debug)
@@ -611,7 +611,7 @@ def _reshape_maps(self, result_maps: list[Tensor]) -> Tensor:
             elif self.spatial_dims == 3:
                 reshaped_result_map = reshaped_result_map.permute(0, 3, 4, 5, 1, 2)
             else:
-                ValueError("Images can only be 2D or 3D.")
+                raise ValueError("Images can only be 2D or 3D.")
 
             # reshaped_result_map will become (B, HWA, num_channel) or (B, HWDA, num_channel)
             reshaped_result_map = reshaped_result_map.reshape(batch_size, -1, num_channel)

monai/apps/detection/networks/retinanet_detector.py

@@ -210,7 +210,10 @@ def decode_single(self, rel_codes: Tensor, reference_boxes: Tensor) -> Tensor:
         offset = reference_boxes.shape[-1]
 
         pred_boxes = []
-        boxes_cccwhd = convert_box_mode(reference_boxes, src_mode=StandardMode, dst_mode=CenterSizeMode)
+        boxes_cccwhd: torch.Tensor = convert_box_mode(
+            reference_boxes, src_mode=StandardMode, dst_mode=CenterSizeMode
+        )  # type: ignore[assignment]
+
         for axis in range(self.spatial_dims):
             whd_axis = boxes_cccwhd[:, axis + self.spatial_dims]
             ctr_xyz_axis = boxes_cccwhd[:, axis]

monai/apps/detection/utils/box_coder.py

@@ -358,8 +358,9 @@ def _apply_down_blocks(self, h, emb, context, down_block_additional_residuals):
 
     def _apply_up_blocks(self, h, emb, context, down_block_res_samples):
         for upsample_block in self.up_blocks:
-            res_samples = down_block_res_samples[-len(upsample_block.resnets) :]
-            down_block_res_samples = down_block_res_samples[: -len(upsample_block.resnets)]
+            idx: int = -len(upsample_block.resnets)  # type: ignore
+            res_samples = down_block_res_samples[idx:]
+            down_block_res_samples = down_block_res_samples[:idx]
             h = upsample_block(hidden_states=h, res_hidden_states_list=res_samples, temb=emb, context=context)
 
         return h