Skip to content

Upgrading FL4Health Libraries#558

Merged
emersodb merged 21 commits into
mainfrom
dbe/upgrade_libraries
May 14, 2026
Merged

Upgrading FL4Health Libraries#558
emersodb merged 21 commits into
mainfrom
dbe/upgrade_libraries

Conversation

@emersodb

@emersodb emersodb commented May 13, 2026

Copy link
Copy Markdown
Collaborator

PR Type

Other

Short Description

Updating the libraries in the FL4Health library. In particular, this updates many of the libraries with vulnerabilities, but also finally upgrading Torch and Tensorflow with the HPC upgrades.

Note: This required a few small workarounds. One of them is a monkey patch for nnunet, of which both Marcelo and I aren't huge fans, but it seems as though they are not planning to move to newer torch implementations soon. So it felt like the least invasive approach at the moment.

Tests Added

None added but made sure the unit and smoke tests all pass locally and on the cluster.

dependabot Bot and others added 6 commits March 30, 2026 23:16
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5 to 6.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v5...v6)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.13.0 to 1.14.0.
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@ed0c539...cef2210)

---
updated-dependencies:
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 7.6.0 to 8.1.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@v7.6.0...v8.1.0)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
updates:
- [github.com/astral-sh/uv-pre-commit: 0.10.12 → 0.11.13](astral-sh/uv-pre-commit@0.10.12...0.11.13)
- [github.com/astral-sh/ruff-pre-commit: v0.15.7 → v0.15.12](astral-sh/ruff-pre-commit@v0.15.7...v0.15.12)
- [github.com/pre-commit/mirrors-mypy: v1.19.1 → v2.0.0](pre-commit/mirrors-mypy@v1.19.1...v2.0.0)
@emersodb emersodb requested review from fatemetkl and lotif May 13, 2026 19:36
super().__init__(optimizer, -1, False)
super().__init__(optimizer, -1)

# mypy incorrectly infers get_lr returns a float

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This has been fixed 🙂

self.num_windows = ceil(max_steps / self.steps_per_lr)
self._step_count: int
super().__init__(optimizer, -1, False)
super().__init__(optimizer, -1)

@emersodb emersodb May 13, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Torch no longer supports the verbose argument for schedulers (this is similar to the issue that was plaguing the nnunet schedulers).

@codecov

codecov Bot commented May 13, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.71%. Comparing base (b51ab34) to head (8bc82ee).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #558      +/-   ##
==========================================
+ Coverage   79.65%   79.71%   +0.05%     
==========================================
  Files         166      166              
  Lines       10554    10573      +19     
==========================================
+ Hits         8407     8428      +21     
+ Misses       2147     2145       -2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

GHSA-rf74-v2fm-23pw
CVE-2026-33230
CVE-2026-33231
CVE-2026-34073

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's good to see! 👏

@lotif lotif left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving with a couple of minor comments :)

Comment thread fl4health/mixins/personalized/ditto.py Outdated
# of the class signature) into the param groups called "decoupled_weight_decay" which cases an error in the
# kwargs below. See: https://github.com/pytorch/pytorch/blob/v2.11.0/torch/optim/adamw.py#L57
if optim_class == torch.optim.AdamW:
optimizer_kwargs.pop("decoupled_weight_decay")

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Weird that we need a workaround for their workaround. What is the case where this happens?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Basically, they got rid of this in the constructor, but if you follow the link, you'll see they "inject" it into the dictionary. To make this mixin work, Andrei was reconstructing the optimizer arguments to create a new one from the old one. The injection means that there is a key corresponding to the argument that used to be called decoupled_weight_decay. So it gets into the kwargs which are passed to the constructor which no longer wants decoupled_weight_decay.

The way Andrei was doing this is fairly brittle, but I don't want to mess with it much in this PR.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, sounds a little hacky, but I agree with you about not messing with it here.

Comment thread pyproject.toml
"flwr>=1.18.0,<1.19.0",
"opacus>=1.3.0,<2.0.0",
"torch==2.6.0",
"torch>=2.6.0",

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice 👏

@emersodb emersodb merged commit ce141b9 into main May 14, 2026
18 checks passed
@emersodb emersodb deleted the dbe/upgrade_libraries branch May 14, 2026 21:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants