Sonador 0.4.1: Advanced 3D Imaging, Resilient Review, and Operational Trust
The Sonador Open Source Team is excited to announce Sonador 0.4.1. Sonador 0.4 built a capable foundation with a new Studylist, collaborative worklists, and a zero-trust access control framework. This release turns Sonador into an adoptable platform, with consistent, incremental progress on three fronts.
Multiplanar reconstruction, volume rendering, segmentation, and 3D interaction from a single Cornerstone3D-based subsystem, plus a preview of the Sonador Seg-Editor.
Studies can be saved for offline access, downloaded as archives, and tracked while background transfers run — without leaving the review.
Connected applications such as Airflow and MLflow reuse Sonador identity and ACL policy through OpenID Connect, and an opt-in HIPAA Access Log records access decisions as FHIR R4B audit events.
Reviewers: richer 3D imaging and uninterrupted review, on or offline.
Operators: an opt-in access log that records access decisions as standards-based FHIR R4B audit events — evidence for privacy protection and compliance.
Developers: OpenID Connect-based Data Services and ACL-checked APIs that reuse platform identity.
Advanced 3D Imaging, One Workspace
The Sonador 0.4.1 viewer integrates Cornerstone3D, VTK.js, and Three.js so that image volume, segmentation state, and surface representation live within a single 3D system. A shared surface cache can be consumed from the Cornerstone3D-provided VTK viewports or from a new Three.js viewport. Users can inspect slice-based edits across anatomic planes while the resulting geometry stays visible in the same task-focused workspace.
- One workflow for DICOM-SEG, M3D/CAD, and volume review. Upgraded MPR, volume rendering and cropping, load-state feedback, and corrected orientation.
- VTK.js volume and surface rendering. Cornerstone3D-provided VTK viewports consume the shared surface cache.
- Three.js 3D viewport. A new viewport for surface geometry and advanced 3D interaction, fed by the same cache.
- Seg-Editor (Preview). Built on Cornerstone3D and integrated with the new Three.js viewport, the Sonador Seg-Editor will provide an integrated workbench for editing 3D pixel and surface data.
Resilient Review, On or Offline
- Download Manager. Active, in-progress, and completed archive downloads are visible from the download manager.
- Unified notifications. Informational and success messages keep background work discoverable without interrupting review. Archive and offline jobs report queue, progress, completion, cancellation, and failure through the same feedback path.
- Quick access everywhere. Downloads and Offline Storage are available from every page of the Studylist, and the viewer shows what is cached and how much storage it uses.
- Settings that follow you. Viewer panels, hotkeys, metadata overlays, and study-list settings hydrate from versioned server preferences. An offline write queue coalesces changes and replays them safely after reconnect.
Operational Confidence, Built In
Two additions in 0.4.1 answer the questions operators and integrators ask first: how do connected applications sign in, and how do we know who accessed what? Data Services answer the first. The HIPAA Access Log answers the second.
Data Services and Unified Single Sign-On
Data Services provide a security boundary for systems that use medical information. AI models, data orchestration tools, and integrated applications reuse Sonador users, groups, and ACL policies to ensure secure and compliant access to sensitive data.
A Data Service registers a trusted application, its approved return locations, and who may enter. The application then reuses Sonador identity and credential-validation tools while owning its own session and business logic. Once the entry decision is made, Sonador steps out of the request path; after entry, every data request is governed by Resource ACL policies.
What Data Services Enable
- Shared user and group model across the platform
- OpenID Connect single sign-on
- Explicit service policy and application traceability
- Reusable protection for interfaces and APIs
- Application-owned sessions and business logic
Data services provide a named entry point into Sonador allowing for external services to manage access, and to restrict who is able to retrieve data stored in the platform by groups and role. It further allows for enabling an OpenID client and for authentication/authorization to proceed via a specific authorization server.
Access Log: Observable Accountability
Sonador 0.4.1 adds an opt-in HIPAA Access Log. Selected sign-in, resource-access, ACL, and credential events — including denied attempts — can be recorded as FHIR R4B AuditEvent records and delivered over Kafka to the systems an organization already trusts. Each record answers the questions an auditor asks: who acted, what was affected, when, and the outcome.
HIPAA's Security Rule (45 CFR 164.312(b)) calls for mechanisms to record and examine activity in systems that contain or use protected health information. Because FHIR R4B is a widely supported standard, healthcare-aware tools can interpret the stream without a Sonador-only format.
Sonador delivers well-formed records; the organization owns storage, review, alerts, and retention. Events can travel encrypted and authenticated: the Orthanc plugin now supports TLS and SASL for Kafka, file-backed credentials, startup configuration checks, secret redaction, and safe retries. Existing PLAINTEXT deployments are unchanged when the security block is omitted.
Sonador's Access Log protects the privacy of users and patients.
- Record the minimum necessary. Who, which resources, what was asked (parameter names, not contents), and what was decided. Secrets, search text, and deployment hostnames are not captured or exported.
- Never prevent access to patient data. Logging runs outside the clinical request path; if event creation or Kafka delivery fails, Sonador continues serving patient data.
Also in 0.4.1
Beyond the headlines, 0.4.1 carries twenty-three release note items across security, viewer, platform, and web application improvements. Highlights include:
- Access-control hardening. Worklist browse queries can no longer return studies from other groups, ACL policy routes now require a dedicated
aclpermission, and comment viewing and editing are authorized as distinct actions across Sonador and Orthanc. - Review requests carry clinical intent. The Request Review dialog now captures a reason and requested procedure, which surface in the Rapid Review Toolbar so the reviewer's rationale stays visible in context. Worklists record every status transition for a complete review history.
- Bulk sharing. The Share Access dialog can apply the same user or group permissions across multiple studies in a single confirmed batch — coordinating access for cross-discipline review in one action.
- Refreshed foundations. Sonador and Orthanc service images move to Ubuntu 26.04, and the web application upgrades to Django 5.2 LTS.
- Reliable sign-out. Logout now terminates the Sonador session, revokes cached provider tokens, and validates return origins, with a shared account menu in both the viewer and study list. Refer to the release notes below for the complete list.
Ready When You Are
Everything in Sonador 0.4.1 is available in the open-source platform today. It provides reviewers continuity, operators visibility, and developers reusable integration boundaries. Wherever you are — deciding if Sonador fits, preparing to run it, or building on top of it — the next step is a short one.
Comments
Loading
No results found