Repository navigation
Release 1.6 Checklist #8874
Description
Activity
- pinned this issue
on May 30, 2026 - added a commit that references this issue
on Jun 8, 2026 Contributing guide on publishing a release:
Release a new version
The
devbranch'sHEADalways corresponds to MONAI Docker image's latest tag:projectmonai/monai:latest. (No
release is currently done for the slim MONAI image, this is built locally by users.)
Themainbranch'sHEADalways corresponds to the latest MONAI milestone release.When major features are ready for a milestone, to prepare for a new release:
- Prepare a release note and release checklist.
- Check out or cherry-pick a new branch
releasing/[version number]locally from thedevbranch and push to the codebase. - Create a release candidate tag, for example,
git tag -a 0.1.0rc1 -m "release candidate 1 of version 0.1.0". - Push the tag to the codebase, for example,
git push origin 0.1.0rc1.
This step will trigger package building and testing.
The resultant packages are automatically uploaded to
TestPyPI. The packages are also available for downloading as
repository's artifacts (e.g. the file at https://github.com/Project-MONAI/MONAI/actions/runs/66570977). - Check the release test at TestPyPI, download the artifacts when the CI finishes.
- Optionally run the cron testing jobs on
releasing/[version number]. - Rebase
releasing/[version number]tomain, make sure all the test pipelines succeed. - Once the release candidate is verified, tag and push a milestone, for example,
git push origin 0.1.0.
The tag must be with the latest commit ofreleasing/[version number]. - Upload the packages to PyPI.
This could be done manually bytwine upload dist/*, given the artifacts are unzipped to the folderdist/. - Merge
releasing/[version number]todev, this step must make sure that the tagging commit unchanged ondev. - Publish the release note.
Note that the release should be tagged with a PEP440 compliant version number.
If any error occurs during the release process, first check out a new hotfix branch from the
releasing/[version number],
then make PRs to thereleasing/[version number]to fix the bugs via the regular contribution procedure.If any error occurs after the release process, first check out a new hotfix branch from the
mainbranch,
make a patch version release following the semantic versioning, for example,releasing/0.1.1.
Make sure thereleasing/0.1.1is merged back into bothdevandmainand all the test pipelines succeed.For the GHSA-qxq5-qhx6-94qw, if a user explicitly sets MONAI_ALLOW_PICKLE=1 and loads an untrusted .pkl, it's still exploitable. But the default-on attack surface is gone, which is what matters for the CVE. Will we request a correction to GHSA-89gg-p5r5-q6r4 (patched version should be 1.6.0, affected range < 1.6.0)?
For the GHSA-qxq5-qhx6-94qw, if a user explicitly sets MONAI_ALLOW_PICKLE=1 and loads an untrusted .pkl, it's still exploitable. But the default-on attack surface is gone, which is what matters for the CVE. Will we request a correction to GHSA-89gg-p5r5-q6r4 (patched version should be 1.6.0, affected range < 1.6.0)?
Could you please request an improvement here and change the versions affected and patched as suggested? I don't know how the review process for this goes, ie. if it comes to me to review or what. Thanks!
I added the improvement here @ericspod
https://github.com/github/advisory-database/pull/8151/changes- unpinned this issue
on Sep 17, 2026
This issue is to collect other issues and PRs that should be closed/merged for the upcoming 1.6. We first need to finalise the last PRs for the release. The we create a 1.6.0 branch, create release candidates through tagging, verify these work with tutorials/zoo/etc. and are present in PyPI.
Important PRs:
Important issues/Advisories:
Nice-to-have PRs/Issues
Checklist
Release a candidate version
Verify the new PyPI release
pip install monai==[X.Y.Z]rc[K]and run a few MONAI modules locallyQuality assurance for the relevant repos
The new PyPI release candidate should be checked against all the relevant repositories under
Project-MONAI, for example, the tutorials repo:pip install monaiwithpip install monai==[X.Y.Z]rc[K].Prepare documentation
docs/source/highlights.md. (Release 1.6 Doc Updates #8882)project-monai.github.iowebsite (https://github.com/Project-MONAI/project-monai.github.io).https://project-monai.github.iohttps://monai.readthedocs.io/en/stable/.Release a milestone version
docker pull projectmonai/monai:X.Y.Zanddocker run ...