Merge branch 'dev' into perf/swinunetr-flash-attention

Author: ericspod

.github/workflows/weekly-preview.yml

@@ -6,9 +6,18 @@ permissions:
 on:
   schedule:
   - cron: "0 2 * * 0"  # 02:00 of every Sunday
+  pull_request:
+    branches:
+      - dev
+
+env:
+  PYTHON_VER: '3.10'
+  PYTORCH_VER: '2.8.0'
+  PIP_EXTRA_INDEX_URL: "https://download.pytorch.org/whl/cpu"  # forces CPU PyTorch installation, should be faster
 
 jobs:
   static-checks:
+    if: github.event_name == 'schedule'  # only check on cron run, these checks are redundant in a PR
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -25,10 +34,10 @@ jobs:
     - uses: actions/checkout@v7
       with:
         persist-credentials: false
-    - name: Set up Python 3.10
+    - name: Set up Python ${{ env.PYTHON_VER }}
       uses: actions/setup-python@v6
       with:
-        python-version: '3.10'
+        python-version: ${{ env.PYTHON_VER }}
         cache: 'pip'
     - name: Install dependencies
       run: |
@@ -40,22 +49,24 @@ jobs:
         $(pwd)/runtests.sh --build --clean
         $(pwd)/runtests.sh --build --${{ matrix.opt }}
 
-  packaging:
+  publish:
     if: github.repository == 'Project-MONAI/MONAI'
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
       with:
-        ref: dev
+        # get the ref for the PR branch or dev if this is a cron job
+        ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'dev' }}
         fetch-depth: 0
         persist-credentials: false
-    - name: Set up Python 3.10
+    - name: Set up Python ${{ env.PYTHON_VER }}
       uses: actions/setup-python@v6
       with:
-        python-version: '3.10'
-    - name: Install setuptools
+        python-version: ${{ env.PYTHON_VER }}
+        cache: 'pip'
+    - name: Install tools
       run: |
-        python -m pip install --user --upgrade setuptools wheel packaging
+        python -m pip install -U pip build
     - name: Build distribution
       run: |
         export HEAD_COMMIT_ID=$(git rev-parse HEAD)
@@ -72,9 +83,15 @@ jobs:
         git tag "1.7.dev${YEAR_WEEK}"
         git log -1
         git tag --list
-        python setup.py sdist bdist_wheel
-
+        python -m build
+        ls -lh dist
+    - name: Test Installation
+      run: |
+        pip install dist/*.whl
+        pip list
+        (cd "$(mktemp -d)" && python -c 'import monai; print(monai.__version__)')
     - name: Publish to PyPI
+      if: github.event_name == 'schedule'  # only publish on cron run
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
         user: __token__

docs/requirements.txt

@@ -20,8 +20,8 @@ sphinxcontrib-serializinghtml
 sphinx-autodoc-typehints==1.11.1
 pandas
 einops
-transformers>=4.53.0
-mlflow>=2.12.2,<3.13
+transformers>=5.5.0
+mlflow>=3.15.2
 clearml>=1.10.0rc0
 tensorboardX
 imagecodecs; platform_system == "Linux" or platform_system == "Darwin"

monai/bundle/config_parser.py

@@ -162,7 +162,14 @@ def __getattr__(self, key: str) -> Any:
         try:
             return self._chain(key)
         except KeyError:
-            return getattr(self._value, key)
+            pass
+        if isinstance(self._value, dict) and key in self._value:
+            # the chained id is absent from the resolver (for example when this proxy is
+            # backed by a `$@ref`, whose children have no ids of their own), but the key
+            # does exist in the container: resolve it like `__getitem__` does, so dot- and
+            # bracket-notation agree and config keys keep precedence over dict methods.
+            return self._value[key]
+        return getattr(self._value, key)
 
     def __getitem__(self, key: str | int) -> Any:
         try:

monai/bundle/scripts.py

@@ -59,7 +59,6 @@
 ValidationError, _ = optional_import("jsonschema.exceptions", name="ValidationError")
 Checkpoint, has_ignite = optional_import("ignite.handlers", IgniteInfo.OPT_IMPORT_VERSION, min_version, "Checkpoint")
 requests, has_requests = optional_import("requests")
-onnx, _ = optional_import("onnx")
 huggingface_hub, _ = optional_import("huggingface_hub")
 
 logger = get_logger(module_name=__name__)
@@ -998,7 +997,8 @@ def run(
             common parameters shown below will be added and can be passed through the `override` parameter of this method.
 
             - ``"output_dir"``: the path to save mlflow tracking outputs locally, default to "<bundle root>/eval".
-            - ``"tracking_uri"``: uri to save mlflow tracking outputs, default to "/output_dir/mlruns".
+            - ``"tracking_uri"``: uri to save mlflow tracking outputs, default to a local SQLite database
+              at "<output_dir>/mlruns.db" with run artifacts kept under "<output_dir>/mlruns".
             - ``"experiment_name"``: experiment name for this run, default to "monai_experiment".
             - ``"run_name"``: the name of current run.
             - ``"save_execute_config"``: whether to save the executed config files. It can be `False`, `/path/to/artifacts`
@@ -1437,6 +1437,7 @@ def onnx_export(
     converter_kwargs_.update({"inputs": inputs_, "use_trace": use_trace_})
 
     def save_onnx(onnx_obj: Any, filename_prefix_or_stream: str, **kwargs: Any) -> None:
+        onnx, _ = optional_import("onnx")
         onnx.save(onnx_obj, filename_prefix_or_stream)
 
     _export(

monai/bundle/utils.py

@@ -116,8 +116,10 @@
     "configs": {
         # if no "output_dir" in the bundle config, default to "<bundle root>/eval"
         "output_dir": "$@bundle_root + '/eval'",
-        # use URI to support linux, mac and windows os
-        "tracking_uri": "$monai.utils.path_to_uri(@output_dir) + '/mlruns'",
+        # MLflow 3.13+ rejects the filesystem (file store) tracking backend, so default tracking
+        # to a local SQLite database. The handler keeps run artifacts under "<output_dir>/mlruns"
+        # (next to the db). A URI is used so the path is valid on linux, mac and windows os.
+        "tracking_uri": "$monai.utils.path_to_sqlite_uri(@output_dir + '/mlruns.db')",
         "experiment_name": "monai_experiment",
         "run_name": None,
         # may fill it at runtime

monai/bundle/workflows.py

@@ -15,6 +15,7 @@
 import os
 import sys
 import time
+import warnings
 from abc import ABC, abstractmethod
 from collections.abc import Sequence
 from copy import copy
@@ -34,6 +35,23 @@
 logger = get_logger(module_name=__name__)
 
 
+def _warn_logging_file_execution(logging_file: str) -> None:
+    """
+    Warn that ``logging_file`` is about to be executed by `logging.config.fileConfig`.
+
+    Called immediately before every `fileConfig` invocation in this module, so the warning is only
+    raised when the file is really executed -- not when it is missing or logging is disabled.
+    """
+    warnings.warn(
+        f"applying logging config {logging_file}: `logging.config.fileConfig` passes the `class=` and "
+        "`args=` fields of the INI's handler and formatter sections to Python `eval()`, so this file "
+        "runs as code. A bundle ships its own `configs/logging.conf` and it is applied by default, "
+        "before any of the bundle's config is parsed. Only proceed if this file is from a source you "
+        "trust (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3).",
+        stacklevel=3,
+    )
+
+
 class BundleWorkflow(ABC):
     """
     Base class for the workflow specification in bundle, it can be a training, evaluation or inference workflow.
@@ -55,6 +73,10 @@ class BundleWorkflow(ABC):
         meta_file: filepath of the metadata file, if this is a list of file paths, their contents will be merged in order.
         logging_file: config file for `logging` module in the program. for more details:
             https://docs.python.org/3/library/logging.config.html#logging.config.fileConfig.
+            Security note: `fileConfig` passes the INI's `class=` and `args=` fields to Python
+            `eval()`, so this file runs as code and applying it raises a warning -- once per call
+            site, as Python's default warning filter suppresses repeats
+            (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3).
 
     """
 
@@ -72,6 +94,7 @@ def __init__(
             if not os.path.isfile(logging_file):
                 raise FileNotFoundError(f"Cannot find the logging config file: {logging_file}.")
             logger.info(f"Setting logging properties based on config: {logging_file}.")
+            _warn_logging_file_execution(logging_file)
             fileConfig(logging_file, disable_existing_loggers=False)
 
         if meta_file is not None:
@@ -273,6 +296,10 @@ class PythonicWorkflow(BundleWorkflow):
         meta_file: filepath of the metadata file, if this is a list of file paths, their contents will be merged in order.
         logging_file: config file for `logging` module in the program. for more details:
             https://docs.python.org/3/library/logging.config.html#logging.config.fileConfig.
+            Security note: `fileConfig` passes the INI's `class=` and `args=` fields to Python
+            `eval()`, so this file runs as code and applying it raises a warning -- once per call
+            site, as Python's default warning filter suppresses repeats
+            (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3).
 
     """
 
@@ -375,6 +402,10 @@ class ConfigWorkflow(BundleWorkflow):
             https://docs.python.org/3/library/logging.config.html#logging.config.fileConfig.
             If None, default to "configs/logging.conf", which is commonly used for bundles in MONAI model zoo.
             If False, the logging logic for the bundle will not be modified.
+            Security note: `fileConfig` passes the INI's `class=` and `args=` fields to Python
+            `eval()`, so this file runs as code and applying it raises a warning -- once per call
+            site, as Python's default warning filter suppresses repeats
+            (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3).
         init_id: ID name of the expected config expression to initialize before running, default to "initialize".
             allow a config to have no `initialize` logic and the ID.
         run_id: ID name of the expected config expression to run, default to "run".
@@ -444,6 +475,7 @@ def __init__(
                 else:
                     raise FileNotFoundError(f"Cannot find the logging config file: {logging_file}.")
             else:
+                _warn_logging_file_execution(str(logging_file))
                 fileConfig(str(logging_file), disable_existing_loggers=False)
                 logger.info(f"Setting logging properties based on config: {logging_file}.")
 

monai/fl/client/monai_algo.py

@@ -13,6 +13,7 @@
 
 import os
 import time
+import warnings
 from collections.abc import Mapping, MutableMapping
 from typing import Any, cast
 
@@ -34,6 +35,26 @@
 logger = get_logger(__name__)
 
 
+def _warn_provisioned_config_execution(bundle_root: str) -> None:
+    """
+    Warn that the bundle under ``bundle_root`` is about to be executed.
+
+    In federated learning the whole app directory -- configs included -- is provisioned by the FL
+    system, and the aggregation server dispatches `initialize`/`train` tasks that the client runs
+    on its own, so there is no per-round human interaction to catch a poisoned config.
+    """
+    warnings.warn(
+        f"executing the bundle config under {bundle_root}, which is provisioned by the FL system: "
+        'any `"_target_"` value in it is resolved to an importable callable and invoked with no '
+        'allow list, and any `"$"`-prefixed value is passed to Python `eval()`. A malicious or '
+        "compromised aggregation server therefore gets code execution on this client, without any "
+        "per-round human interaction. Only join a federation whose server and app-provisioning "
+        "channel you trust (see "
+        "https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-x6pr-233j-x5cw).",
+        stacklevel=3,
+    )
+
+
 def convert_global_weights(global_weights: Mapping, local_var_dict: MutableMapping) -> tuple[MutableMapping, int]:
     """Helper function to convert global weights to local weights format"""
     # Before loading weights, tensors might need to be reshaped to support HE for secure aggregation.
@@ -86,6 +107,15 @@ class MonaiAlgoStats(ClientAlgoStats):
     """
     Implementation of ``ClientAlgoStats`` to allow federated learning with MONAI bundle configurations.
 
+    Security note: the bundle under `bundle_root` is provisioned by the FL system -- `initialize()`
+    resolves it against `extra[ExtraItems.APP_ROOT]`, which the aggregation server supplies -- and
+    executing it runs whatever its config contains: any `"_target_"` value is resolved to an
+    importable callable and invoked with no allow list, and any `"$"`-prefixed value is passed to
+    Python `eval()`. A malicious or compromised server therefore gets code execution on this client,
+    with no per-round human interaction. Executing a config raises a warning -- once per call site,
+    as Python's default warning filter suppresses repeats
+    (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-x6pr-233j-x5cw).
+
     Args:
         bundle_root: directory path of the bundle.
         config_train_filename: bundle training config path relative to bundle_root. Can be a list of files;
@@ -135,18 +165,29 @@ def initialize(self, extra=None):
         Args:
             extra: Dict with additional information that should be provided by FL system,
                 i.e., `ExtraItems.CLIENT_NAME`, `ExtraItems.APP_ROOT` and `ExtraItems.LOGGING_FILE`.
-                You can diable the logging logic in the monai bundle by setting {ExtraItems.LOGGING_FILE} to False.
+                `{ExtraItems.LOGGING_FILE}` defaults to False here, and an explicit `None` is
+                treated the same way, so the bundle's own "configs/logging.conf" is not applied:
+                it is provisioned by the FL system and `logging.config.fileConfig` runs the INI's
+                `class=`/`args=` fields through `eval()`
+                (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3).
+                Set it to a logging config file path to opt back in to configuring logging.
 
         """
         if extra is None:
             extra = {}
         self.client_name = extra.get(ExtraItems.CLIENT_NAME, "noname")
-        logging_file = extra.get(ExtraItems.LOGGING_FILE, None)
+        logging_file = extra.get(ExtraItems.LOGGING_FILE, False)
+        if logging_file is None:
+            # `ConfigWorkflow` reads `None` as "fall back to the bundle's own configs/logging.conf",
+            # the FL-provisioned file this default exists to keep away from `fileConfig`. Passing the
+            # key explicitly as `None` has to mean the same as leaving it out.
+            logging_file = False
         self.logger.info(f"Initializing {self.client_name} ...")
 
         # FL platform needs to provide filepath to configuration files
         self.app_root = extra.get(ExtraItems.APP_ROOT, "")
         self.bundle_root = os.path.join(self.app_root, self.bundle_root)
+        _warn_provisioned_config_execution(self.bundle_root)
 
         if self.workflow is None:
             config_train_files = self._add_config_files(self.config_train_filename)
@@ -313,6 +354,15 @@ class MonaiAlgo(ClientAlgo, MonaiAlgoStats):
     """
     Implementation of ``ClientAlgo`` to allow federated learning with MONAI bundle configurations.
 
+    Security note: the bundle under `bundle_root` is provisioned by the FL system -- `initialize()`
+    resolves it against `extra[ExtraItems.APP_ROOT]`, which the aggregation server supplies -- and
+    executing it runs whatever its config contains: any `"_target_"` value is resolved to an
+    importable callable and invoked with no allow list, and any `"$"`-prefixed value is passed to
+    Python `eval()`. A malicious or compromised server therefore gets code execution on this client,
+    with no per-round human interaction. Executing a config raises a warning -- once per call site,
+    as Python's default warning filter suppresses repeats
+    (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-x6pr-233j-x5cw).
+
     Args:
         bundle_root: directory path of the bundle.
         local_epochs: number of local epochs to execute during each round of local training; defaults to 1.
@@ -416,19 +466,30 @@ def initialize(self, extra=None):
         Args:
             extra: Dict with additional information that should be provided by FL system,
                 i.e., `ExtraItems.CLIENT_NAME`, `ExtraItems.APP_ROOT` and `ExtraItems.LOGGING_FILE`.
-                You can diable the logging logic in the monai bundle by setting {ExtraItems.LOGGING_FILE} to False.
+                `{ExtraItems.LOGGING_FILE}` defaults to False here, and an explicit `None` is
+                treated the same way, so the bundle's own "configs/logging.conf" is not applied:
+                it is provisioned by the FL system and `logging.config.fileConfig` runs the INI's
+                `class=`/`args=` fields through `eval()`
+                (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3).
+                Set it to a logging config file path to opt back in to configuring logging.
 
         """
         self._set_cuda_device()
         if extra is None:
             extra = {}
         self.client_name = extra.get(ExtraItems.CLIENT_NAME, "noname")
-        logging_file = extra.get(ExtraItems.LOGGING_FILE, None)
+        logging_file = extra.get(ExtraItems.LOGGING_FILE, False)
+        if logging_file is None:
+            # `ConfigWorkflow` reads `None` as "fall back to the bundle's own configs/logging.conf",
+            # the FL-provisioned file this default exists to keep away from `fileConfig`. Passing the
+            # key explicitly as `None` has to mean the same as leaving it out.
+            logging_file = False
         timestamp = time.strftime("%Y%m%d_%H%M%S")
         self.logger.info(f"Initializing {self.client_name} ...")
         # FL platform needs to provide filepath to configuration files
         self.app_root = extra.get(ExtraItems.APP_ROOT, "")
         self.bundle_root = os.path.join(self.app_root, self.bundle_root)
+        _warn_provisioned_config_execution(self.bundle_root)
 
         if self.train_workflow is None and self.config_train_filename is not None:
             config_train_files = self._add_config_files(self.config_train_filename)