From 182385330d626e611f848a3bffa4c17f2d8b58eb Mon Sep 17 00:00:00 2001 From: Eric Kerfoot <17726042+ericspod@users.noreply.github.com> Date: Tue, 22 Sep 2026 18:08:48 +0100 Subject: [PATCH 1/4] Adding Deprecation Warning For hash_type Signed-off-by: Eric Kerfoot <17726042+ericspod@users.noreply.github.com> --- monai/apps/utils.py | 45 +++++++++++++++++++++---- tests/apps/test_download_and_extract.py | 8 +++++ 2 files changed, 47 insertions(+), 6 deletions(-) diff --git a/monai/apps/utils.py b/monai/apps/utils.py index b15b0c1969..d1e6ce17b7 100644 --- a/monai/apps/utils.py +++ b/monai/apps/utils.py @@ -30,6 +30,7 @@ from monai.config.type_definitions import PathLike from monai.utils import look_up_option, min_version, optional_import +from monai.utils.deprecate_utils import warn_deprecated requests, has_requests = optional_import("requests") gdown, has_gdown = optional_import("gdown", "4.7.3") @@ -177,6 +178,9 @@ def check_hash(filepath: PathLike, val: str | None = None, hash_type: str = "sha The supported hash types are `"md5"`, `"sha1"`, `"sha256"`, `"sha512"`. See also: :py:data:`monai.apps.utils.SUPPORTED_HASH_TYPES`. + .. versionchanged:: 1.6.1 + The default `hash_type` changed from "md5" to "sha256" for stronger integrity verification. + Pass `hash_type="md5"` explicitly to verify against MD5 hashes. """ if val is None: warnings.warn(f"No hash value provided for {filepath}; file integrity is NOT verified.", stacklevel=2) @@ -204,7 +208,7 @@ def download_url( url: str, filepath: PathLike = "", hash_val: str | None = None, - hash_type: str = "sha256", + hash_type: str | None = None, progress: bool = True, **gdown_kwargs: Any, ) -> None: @@ -217,7 +221,7 @@ def download_url( If undefined, `os.path.basename(url)` will be used. hash_val: expected hash value to validate the downloaded file. if None, skip hash validation. - hash_type: type of hash algorithm to use, default is `"sha256"`. + hash_type: type of hash algorithm to use, default is None which will select `"sha256"`. The supported hash types are `"md5"`, `"sha1"`, `"sha256"`, `"sha512"`. progress: whether to display a progress bar. gdown_kwargs: other args for `gdown` except for the `url`, `output` and `quiet`. @@ -234,7 +238,22 @@ def download_url( ContentTooShortError: See urllib.request.urlretrieve. IOError: See urllib.request.urlretrieve. HashCheckError: When the hash validation of the ``url`` downloaded file fails. + + .. versionchanged:: 1.6.1 + The default `hash_type` changed from "md5" to None for stronger integrity verification. If this is left None + when a `hash_val` value is provided, this will warn to explicitly set `hash_type` then choose sha256 hashing. + Pass `hash_type="md5"` explicitly to verify against MD5 hashes and suppress the warning. In MONAI 1.8 the + default will be set to "sha256". """ + if hash_val is not None and hash_type is None: + warn_deprecated( + "monai.apps.utils.download_url", + 'Default `hash_type` value changed to `None` from "md5" in MONAI 1.6.1, ' + "set to explicit value to suppress this warning. Defaulting to md5 checking. In MONAI 1.8 the" \ + "default will be set to \"sha256\"." + ) + hash_type = "sha256" + if not filepath: filepath = Path(".", _basename(url)).resolve() logger.info(f"Default downloading to '{filepath}'") @@ -316,7 +335,7 @@ def extractall( filepath: PathLike, output_dir: PathLike = ".", hash_val: str | None = None, - hash_type: str = "sha256", + hash_type: str | None = None, file_type: str = "", has_base: bool = True, ) -> None: @@ -329,7 +348,7 @@ def extractall( output_dir: target directory to save extracted files. hash_val: expected hash value to validate the compressed file. if None, skip hash validation. - hash_type: type of hash algorithm to use, default is `"sha256"`. + hash_type: type of hash algorithm to use, default is None which will select `"sha256"`. file_type: string of file type for decompressing. Leave it empty to infer the type from the filepath basename. has_base: whether the extracted files have a base folder. This flag is used when checking if the existing folder is a result of `extractall`, if it is, the extraction is skipped. For example, if A.zip is unzipped @@ -340,7 +359,21 @@ def extractall( HashCheckError: When the hash validation of the ``filepath`` compressed file fails. NotImplementedError: When the ``filepath`` file extension is not one of [zip", "tar.gz", "tar"]. + .. versionchanged:: 1.6.1 + The default `hash_type` changed from "md5" to None for stronger integrity verification. If this is left None + when a `hash_val` value is provided, this will warn to explicitly set `hash_type` then choose sha256 hashing. + Pass `hash_type="md5"` explicitly to verify against MD5 hashes and suppress the warning. In MONAI 1.8 the + default will be set to "sha256". """ + if hash_val is not None and hash_type is None: + warn_deprecated( + "monai.apps.utils.extractall", + 'Default `hash_type` value changed to `None` from "md5" in MONAI 1.6.1, ' + "set to an explicit value to suppress this warning. Defaulting to md5 checking. In MONAI 1.8 the" \ + "default will be set to \"sha256\"." + ) + hash_type = "sha256" + filepath = Path(filepath) if hash_val and not check_hash(filepath, hash_val, hash_type): raise HashCheckError( @@ -395,7 +428,7 @@ def download_and_extract( filepath: PathLike = "", output_dir: PathLike = ".", hash_val: str | None = None, - hash_type: str = "sha256", + hash_type: str | None = None, file_type: str = "", has_base: bool = True, progress: bool = True, @@ -411,7 +444,7 @@ def download_and_extract( default is the current directory. hash_val: expected hash value to validate the downloaded file. if None, skip hash validation. - hash_type: type of hash algorithm to use, default is `"sha256"`. + hash_type: type of hash algorithm to use, default is None which will select `"sha256"`. file_type: string of file type for decompressing. Leave it empty to infer the type from url's base file name. has_base: whether the extracted files have a base folder. This flag is used when checking if the existing folder is a result of `extractall`, if it is, the extraction is skipped. For example, if A.zip is unzipped diff --git a/tests/apps/test_download_and_extract.py b/tests/apps/test_download_and_extract.py index 71a810983f..6a79432469 100644 --- a/tests/apps/test_download_and_extract.py +++ b/tests/apps/test_download_and_extract.py @@ -58,6 +58,10 @@ def test_download_url_hash_mismatch(self): with self.assertRaises(HashCheckError): download_url(self.url, filepath, hash_val="0" * len(self.hash_val), hash_type=self.hash_type) + # test the warning is raised if no hash_type is given + with self.assertWarns(FutureWarning): + download_url(self.url, filepath, hash_val=self.hash_val) + @skip_if_quick def test_extractall_hash_mismatch(self): """extractall should raise HashCheckError when hash is incorrect.""" @@ -70,6 +74,10 @@ def test_extractall_hash_mismatch(self): with self.assertRaises(HashCheckError): extractall(filepath, output_dir, hash_val="0" * len(self.hash_val), hash_type=self.hash_type) + # test the warning is raised if no hash_type is given + with self.assertWarns(FutureWarning): + extractall(filepath, output_dir, hash_val=self.hash_val) + @skip_if_quick @parameterized.expand([("icon", "tar"), ("favicon", "zip")]) def test_download_and_extract_various_formats(self, key, file_type): From 89e359b714c8df50c1a796db5880a816fd8a4392 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Tue, 22 Sep 2026 17:12:43 +0000 Subject: [PATCH 2/4] [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --- monai/apps/utils.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/monai/apps/utils.py b/monai/apps/utils.py index d1e6ce17b7..0e3f2adea9 100644 --- a/monai/apps/utils.py +++ b/monai/apps/utils.py @@ -249,8 +249,8 @@ def download_url( warn_deprecated( "monai.apps.utils.download_url", 'Default `hash_type` value changed to `None` from "md5" in MONAI 1.6.1, ' - "set to explicit value to suppress this warning. Defaulting to md5 checking. In MONAI 1.8 the" \ - "default will be set to \"sha256\"." + "set to explicit value to suppress this warning. Defaulting to md5 checking. In MONAI 1.8 the" + 'default will be set to "sha256".', ) hash_type = "sha256" @@ -369,8 +369,8 @@ def extractall( warn_deprecated( "monai.apps.utils.extractall", 'Default `hash_type` value changed to `None` from "md5" in MONAI 1.6.1, ' - "set to an explicit value to suppress this warning. Defaulting to md5 checking. In MONAI 1.8 the" \ - "default will be set to \"sha256\"." + "set to an explicit value to suppress this warning. Defaulting to md5 checking. In MONAI 1.8 the" + 'default will be set to "sha256".', ) hash_type = "sha256" From 3c7bb90facf0f333adab66d533f77d95bde4cfcb Mon Sep 17 00:00:00 2001 From: Eric Kerfoot <17726042+ericspod@users.noreply.github.com> Date: Tue, 22 Sep 2026 18:22:12 +0100 Subject: [PATCH 3/4] Set correct default Signed-off-by: Eric Kerfoot <17726042+ericspod@users.noreply.github.com> --- monai/apps/utils.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/monai/apps/utils.py b/monai/apps/utils.py index d1e6ce17b7..35147e99b4 100644 --- a/monai/apps/utils.py +++ b/monai/apps/utils.py @@ -249,7 +249,7 @@ def download_url( warn_deprecated( "monai.apps.utils.download_url", 'Default `hash_type` value changed to `None` from "md5" in MONAI 1.6.1, ' - "set to explicit value to suppress this warning. Defaulting to md5 checking. In MONAI 1.8 the" \ + "set to explicit value to suppress this warning. Defaulting to sha256 checking. In MONAI 1.8 the" \ "default will be set to \"sha256\"." ) hash_type = "sha256" @@ -369,7 +369,7 @@ def extractall( warn_deprecated( "monai.apps.utils.extractall", 'Default `hash_type` value changed to `None` from "md5" in MONAI 1.6.1, ' - "set to an explicit value to suppress this warning. Defaulting to md5 checking. In MONAI 1.8 the" \ + "set to an explicit value to suppress this warning. Defaulting to sha256 checking. In MONAI 1.8 the" \ "default will be set to \"sha256\"." ) hash_type = "sha256" From bffc33a514551cb13c73e9ff8e4391414af0493c Mon Sep 17 00:00:00 2001 From: Eric Kerfoot <17726042+ericspod@users.noreply.github.com> Date: Tue, 22 Sep 2026 18:23:50 +0100 Subject: [PATCH 4/4] Fix again Signed-off-by: Eric Kerfoot <17726042+ericspod@users.noreply.github.com> --- monai/apps/utils.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/monai/apps/utils.py b/monai/apps/utils.py index 0e3f2adea9..ae62722236 100644 --- a/monai/apps/utils.py +++ b/monai/apps/utils.py @@ -249,7 +249,7 @@ def download_url( warn_deprecated( "monai.apps.utils.download_url", 'Default `hash_type` value changed to `None` from "md5" in MONAI 1.6.1, ' - "set to explicit value to suppress this warning. Defaulting to md5 checking. In MONAI 1.8 the" + "set to explicit value to suppress this warning. Defaulting to sha256 checking. In MONAI 1.8 the" 'default will be set to "sha256".', ) hash_type = "sha256" @@ -369,7 +369,7 @@ def extractall( warn_deprecated( "monai.apps.utils.extractall", 'Default `hash_type` value changed to `None` from "md5" in MONAI 1.6.1, ' - "set to an explicit value to suppress this warning. Defaulting to md5 checking. In MONAI 1.8 the" + "set to an explicit value to suppress this warning. Defaulting to sha256 checking. In MONAI 1.8 the" 'default will be set to "sha256".', ) hash_type = "sha256"