Repository navigation
Release 1.6 Checklist #8874
Description
This issue is to collect other issues and PRs that should be closed/merged for the upcoming 1.6. We first need to finalise the last PRs for the release. The we create a 1.6.0 branch, create release candidates through tagging, verify these work with tutorials/zoo/etc. and are present in PyPI.
Important PRs:
- Minor Fixes From Testing 1.6 #8897
- Release 1.6 Doc Updates #8882
- Further CICD Cleanup #8867
- fix: only instantiate CrossAttentionBlock when with_cross_attention=True #8848
Important issues/Advisories:
- GHSA-qxq5-qhx6-94qw Fixed by Update Auto3DSeg #8586
- GHSA-rghg-q7wp-9767 Fix For ghsa-rghg-q7wp-9767 #8885
- GHSA-wg9g-w2j2-8pgr Needs review -> Adding allow_pickle argument #8875
- GHSA-6hp3-vr39-rqw8 Need engagement from MONAILabel developers to help fix and verify this on their repository and here
Nice-to-have PRs/Issues
- feat(losses/metrics): implement ignore_index support across dice and … #8757 <- @garciadias
- Fix diffusion inferers to support diffusers-style schedulers #8870 <- @virginiafdez
- Improve Affine transform documentation and add compute_w_affine tests #8727
- Add explicit spatial_ndim tracking to MetaTensor #8765
- Vectorize DiceHelper.__call__() #8764
- CodeQL and GPU Actions Update #8883
- fix(losses): register buffers in GlobalMutualInformationLoss #8872
Checklist
Release a candidate version
- Tag and release PYPI version [X.Y.Z]rc[K] following the contributing guide, need trigger release pipeline on blossom.
- Make sure all CI pipelines pass.
Verify the new PyPI release
- Check the PyPI page
- Test
pip install monai==[X.Y.Z]rc[K]and run a few MONAI modules locally - Test all installation commands mentioned in the installation guide and the primary README.
Quality assurance for the relevant repos
The new PyPI release candidate should be checked against all the relevant repositories under Project-MONAI, for example, the tutorials repo:
- Run all Jupyter notebooks, replace
pip install monaiwithpip install monai==[X.Y.Z]rc[K]. - File new tickets and create new pull requests to address any technical issues.
- Release a new candidate after addressing all the issues.
- Testing related repositories
- MONAI unit and integration tests
- MONAI tutorial tests
- MONAILabel unit and integration tests
- MONAI model zoo tests
- QA regression tests
Prepare documentation
- Draft a release note on GitHub.
- Draft a release note with a pull request to modify the CHANGELOG. (Release 1.6 Doc Updates #8882)
- Create a pull request to highlight the features of the upcoming release, for example, in
docs/source/highlights.md. (Release 1.6 Doc Updates #8882) - Create a pull request to update the primary README.md. (Release 1.6 Doc Updates #8882)
- Update the
project-monai.github.iowebsite (https://github.com/Project-MONAI/project-monai.github.io). - Check all the URLs in
https://project-monai.github.io - Check all the URLs in
https://monai.readthedocs.io/en/stable/.
Release a milestone version
- Tag and release PyPI version [X.Y.Z] following the contributing guide.
- Check the dockerhub auto-build by running
docker pull projectmonai/monai:X.Y.Zanddocker run ... - Check jupyter lab/notebook in the docker container
- Check readme frontpage on dockerhub, pypi
- Update https://github.com/Project-MONAI/MONAI/blob/dev/CITATION.cff
- Publish the release note on GitHub.
- Update the weekly-preview tagging https://github.com/Project-MONAI/MONAI/blob/dev/.github/workflows/weekly-preview.yml#L72
- Release the corresponding conda-forge version https://github.com/conda-forge/monai-feedstock
Activity
Release 1.6 Doc Updates (#8882)
ericspod commentedon Jun 11, 2026
Contributing guide on publishing a release:
Release a new version
The
devbranch'sHEADalways corresponds to MONAI Docker image's latest tag:projectmonai/monai:latest. (Norelease is currently done for the slim MONAI image, this is built locally by users.)
The
mainbranch'sHEADalways corresponds to the latest MONAI milestone release.When major features are ready for a milestone, to prepare for a new release:
releasing/[version number]locally from thedevbranch and push to the codebase.git tag -a 0.1.0rc1 -m "release candidate 1 of version 0.1.0".git push origin 0.1.0rc1.This step will trigger package building and testing.
The resultant packages are automatically uploaded to
TestPyPI. The packages are also available for downloading as
repository's artifacts (e.g. the file at https://github.com/Project-MONAI/MONAI/actions/runs/66570977).
releasing/[version number].releasing/[version number]tomain, make sure all the test pipelines succeed.git push origin 0.1.0.The tag must be with the latest commit of
releasing/[version number].This could be done manually by
twine upload dist/*, given the artifacts are unzipped to the folderdist/.releasing/[version number]todev, this step must make sure that the tagging commit unchanged ondev.Note that the release should be tagged with a PEP440 compliant version number.
If any error occurs during the release process, first check out a new hotfix branch from the
releasing/[version number],then make PRs to the
releasing/[version number]to fix the bugs via the regular contribution procedure.If any error occurs after the release process, first check out a new hotfix branch from the
mainbranch,make a patch version release following the semantic versioning, for example,
releasing/0.1.1.Make sure the
releasing/0.1.1is merged back into bothdevandmainand all the test pipelines succeed.mingxin-zheng commentedon Jun 19, 2026
For the GHSA-qxq5-qhx6-94qw, if a user explicitly sets MONAI_ALLOW_PICKLE=1 and loads an untrusted .pkl, it's still exploitable. But the default-on attack surface is gone, which is what matters for the CVE. Will we request a correction to GHSA-89gg-p5r5-q6r4 (patched version should be 1.6.0, affected range < 1.6.0)?
ericspod commentedon Jun 19, 2026
Could you please request an improvement here and change the versions affected and patched as suggested? I don't know how the review process for this goes, ie. if it comes to me to review or what. Thanks!
ericspod commentedon Jun 23, 2026
The Dockerhub build also needs to be done manually, this was disabled with #7450 owing to resource constraints, combined with Blossom no longer being used.
mingxin-zheng commentedon Jun 26, 2026
I added the improvement here @ericspod
https://github.com/github/advisory-database/pull/8151/changes