Bump CsvHelper and 7 others by dependabot[bot] · Pull Request #4 · SALEM501jo/phishing-email-analyser

Forwarded Headers Middleware: Ignore X-Forwarded-Headers from Unknown Proxy (#61623)
The Forwarded Headers Middleware now ignores X-Forwarded-Headers sent from unknown proxies. This change improves security by ensuring that only trusted proxies can influence the forwarded headers, preventing potential spoofing or misrouting of requests.

Dependency Updates

Update dependencies from dotnet/arcade (#61832)
This update brings in the latest changes from the dotnet/arcade repository, ensuring that ASP.NET Core benefits from recent improvements, bug fixes, and security patches in the shared build infrastructure.
Bump src/submodules/googletest from 52204f7 to 04ee1b4 (#61761)
The GoogleTest submodule has been updated to a newer commit, providing the latest testing features, bug fixes, and performance improvements for the project's C++ test components.

Miscellaneous

Update branding to 8.0.17 (#61830)
The project version branding has been updated to reflect the new 8.0.17 release, ensuring consistency across build outputs and documentation.
Merging internal commits for release/8.0 (#61924)
This change merges various internal commits into the release/8.0 branch, incorporating minor fixes, documentation updates, and other non-user-facing improvements to keep the release branch up to date.

This summary is generated and may contain inaccuracies. For complete details, please review the linked pull requests.

Full Changelog: dotnet/aspnetcore@v8.0.16...v8.0.17

8.0.16

Release

What's Changed

Update branding to 8.0.16 by @vseanreesermsft in Update branding to 8.0.16 dotnet/aspnetcore#61283
[release/8.0] (deps): Bump src/submodules/googletest from 24a9e94 to 52204f7 by @dependabot in [release/8.0] (deps): Bump src/submodules/googletest from 24a9e94 to 52204f7 dotnet/aspnetcore#61260
[release/8.0] Update dependencies from dotnet/source-build-externals by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/source-build-externals dotnet/aspnetcore#61281
[release/8.0] Upgrade to Ubuntu 22 by @wtgodbe in [release/8.0] Upgrade to Ubuntu 22 dotnet/aspnetcore#61216
[release/8.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#60901
[release/8.0] Update dependencies from dotnet/source-build-reference-packages by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/source-build-reference-packages dotnet/aspnetcore#60926
[release/8.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#61404
Merging internal commits for release/8.0 by @vseanreesermsft in Merging internal commits for release/8.0 dotnet/aspnetcore#61398
[release/8.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#61411
Revert "Revert "[release/8.0] Update remnants of azureedge.net"" by @wtgodbe in Revert "Revert "[release/8.0] Update remnants of azureedge.net"" dotnet/aspnetcore#60352
[release/8.0] Fix preserving messages for stateful reconnect with backplane by @BrennanConroy in [release/8.0] Fix preserving messages for stateful reconnect with backplane dotnet/aspnetcore#61375
[release/8.0] Update dependencies from dotnet/source-build-reference-packages by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/source-build-reference-packages dotnet/aspnetcore#61442
fetch TLS client hello message from HTTP.SYS by @BrennanConroy in fetch TLS client hello message from HTTP.SYS dotnet/aspnetcore#61494

Full Changelog: dotnet/aspnetcore@v8.0.15...v8.0.16

8.0.15

Release

What's Changed

[release/8.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#60355
Update branding to 8.0.15 by @vseanreesermsft in Update branding to 8.0.15 dotnet/aspnetcore#60784
Add partitioned to cookie for SignalR browser testing by @BrennanConroy in Add partitioned to cookie for SignalR browser testing dotnet/aspnetcore#60728
[release/8.0] (deps): Bump src/submodules/googletest from e235eb3 to 24a9e94 by @dependabot in [release/8.0] (deps): Bump src/submodules/googletest from e235eb3 to 24a9e94 dotnet/aspnetcore#60677
Merging internal commits for release/8.0 by @vseanreesermsft in Merging internal commits for release/8.0 dotnet/aspnetcore#60879

Full Changelog: dotnet/aspnetcore@v8.0.14...v8.0.15

8.0.14

Release

What's Changed

Update branding to 8.0.14 by @vseanreesermsft in Update branding to 8.0.14 dotnet/aspnetcore#60197
[release/8.0] (deps): Bump src/submodules/googletest from 7d76a23 to e235eb3 by @dependabot in [release/8.0] (deps): Bump src/submodules/googletest from 7d76a23 to e235eb3 dotnet/aspnetcore#60150
[release/8.0] Fix java discovery in IdentityModel pipeline by @wtgodbe in [release/8.0] Fix java discovery in IdentityModel pipeline dotnet/aspnetcore#60075
[release/8.0] Update dependencies from dotnet/source-build-externals by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/source-build-externals dotnet/aspnetcore#60199
[release/8.0] Update dependencies from dotnet/source-build-reference-packages by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/source-build-reference-packages dotnet/aspnetcore#59922
[release/8.0] Readd DiagnosticSource to KestrelServerImpl by @github-actions in [release/8.0] Readd DiagnosticSource to KestrelServerImpl dotnet/aspnetcore#60203
[release/8.0] Update to MacOS 15 in Helix by @github-actions in [release/8.0] Update to MacOS 15 in Helix dotnet/aspnetcore#60239
[release/8.0] Use the latest available JDK by @wtgodbe in [release/8.0] Use the latest available JDK dotnet/aspnetcore#60233
[release/8.0] Fix skip condition for java tests by @github-actions in [release/8.0] Fix skip condition for java tests dotnet/aspnetcore#60243
[release/8.0] Update list of helix queues to skip by @wtgodbe in [release/8.0] Update list of helix queues to skip dotnet/aspnetcore#60231
[release/8.0] [Blazor] Allow cascading value subscribers to get added and removed during change notification by @github-actions in [release/8.0] [Blazor] Allow cascading value subscribers to get added and removed during change notification dotnet/aspnetcore#57288
[release/8.0] Update remnants of azureedge.net by @sebastienros in [release/8.0] Update remnants of azureedge.net dotnet/aspnetcore#60264
[release/8.0] Centralize on one docker container by @wtgodbe in [release/8.0] Centralize on one docker container dotnet/aspnetcore#60299
Revert "[release/8.0] Update remnants of azureedge.net" by @wtgodbe in Revert "[release/8.0] Update remnants of azureedge.net" dotnet/aspnetcore#60324
Merging internal commits for release/8.0 by @vseanreesermsft in Merging internal commits for release/8.0 dotnet/aspnetcore#60316

Full Changelog: dotnet/aspnetcore@v8.0.13...v8.0.14

8.0.13

Release

What's Changed

[release/8.0] Update dotnetbuilds CDN to new endpoint by @mmitche in [release/8.0] Update dotnetbuilds CDN to new endpoint dotnet/aspnetcore#59575
Update branding to 8.0.13 by @vseanreesermsft in Update branding to 8.0.13 dotnet/aspnetcore#59756
[release/8.0] Skip MVC template tests on HelixQueueArmDebian12 by @wtgodbe in [release/8.0] Skip MVC template tests on HelixQueueArmDebian12 dotnet/aspnetcore#59295
[release/8.0] Update OSX helix queue by @github-actions in [release/8.0] Update OSX helix queue dotnet/aspnetcore#59742
[release/8.0] (deps): Bump src/submodules/googletest from d144031 to 7d76a23 by @dependabot in [release/8.0] (deps): Bump src/submodules/googletest from d144031 to 7d76a23 dotnet/aspnetcore#59678
[release/8.0] Skip tests on internal queues too by @github-actions in [release/8.0] Skip tests on internal queues too dotnet/aspnetcore#59579
[release/8.0] Fix Kestrel host header mismatch handling when port in Url by @BrennanConroy in [release/8.0] Fix Kestrel host header mismatch handling when port in Url dotnet/aspnetcore#59403
Migrate off of Debian 11 by @v-firzha in Migrate off of Debian 11 dotnet/aspnetcore#59584
[release/8.0] Pin to S.T.J 8.0.5 in Analyzers by @wtgodbe in [release/8.0] Pin to S.T.J 8.0.5 in Analyzers dotnet/aspnetcore#59777
[release/8.0] [Blazor WASM standalone] Avoid caching index.html during development by @github-actions in [release/8.0] [Blazor WASM standalone] Avoid caching index.html during development dotnet/aspnetcore#59349
Update to Fedora 41 by @BrennanConroy in Update to Fedora 41 dotnet/aspnetcore#59817
[release/8.0] Update dependencies from dotnet/source-build-externals by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/source-build-externals dotnet/aspnetcore#59811
[release/8.0] Update dependencies from dotnet/source-build-reference-packages by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/source-build-reference-packages dotnet/aspnetcore#59825
[release/8.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#59864
[release/8.0] Fix/update docker tags by @wtgodbe in [release/8.0] Fix/update docker tags dotnet/aspnetcore#59867
Merging internal commits for release/8.0 by @vseanreesermsft in Merging internal commits for release/8.0 dotnet/aspnetcore#59872

Full Changelog: dotnet/aspnetcore@v8.0.12...v8.0.13

8.0.12

Release

What's Changed

Update branding to 8.0.12 by @vseanreesermsft in Update branding to 8.0.12 dotnet/aspnetcore#58800
[release/8.0] (deps): Bump src/submodules/googletest from 6dae7eb to 1204d63 by @dependabot in [release/8.0] (deps): Bump src/submodules/googletest from 6dae7eb to 1204d63 dotnet/aspnetcore#58741
Add scope for internal npm packages by @BrennanConroy in Add scope for internal npm packages dotnet/aspnetcore#58512
[release/8.0] Update dependencies from dotnet/source-build-externals by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/source-build-externals dotnet/aspnetcore#58477
[release/8.0] Upgrade serialize-javascript transient dependency by @MackinnonBuck in [release/8.0] Upgrade serialize-javascript transient dependency dotnet/aspnetcore#58466
[release/8.0] Update Messagepack dependency by @wtgodbe in [release/8.0] Update Messagepack dependency dotnet/aspnetcore#58676
Merging internal commits for release/8.0 by @vseanreesermsft in Merging internal commits for release/8.0 dotnet/aspnetcore#58898
[release/8.0] Use MacOS-13 in CI by @wtgodbe in [release/8.0] Use MacOS-13 in CI dotnet/aspnetcore#58549
[release/8.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/8.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#59065
[release/8.0] Fix java discovery in helix-matrix by @wtgodbe in [release/8.0] Fix java discovery in helix-matrix dotnet/aspnetcore#59181
[release/8.0] Update dependencies from dotnet/roslyn by @wtgodbe in [release/8.0] Update dependencies from dotnet/roslyn dotnet/aspnetcore#59184
[release/8.0] (deps): Bump src/submodules/googletest from 1204d63 to d144031 by @dependabot in [release/8.0] (deps): Bump src/submodules/googletest from 1204d63 to d144031 dotnet/aspnetcore#59033

Full Changelog: dotnet/aspnetcore@v8.0.11...v8.0.12

Commits viewable in compare view.

Pinned Microsoft.ML at 4.0.3.

Release notes

Sourced from Microsoft.ML's releases.

4.0.3

ML.NET 4.0.3

Bug Fixes

[release/4.0] Improve unique directory generation for temp files (#7528)
- Compatibility note: This change resolves a performance problem where past versions of ML.NET would leave behind folders with the pattern ml_dotnet\d+ in the temp directory, which would cause model opening performance to degrade. This fixes the problem. You may also wish to delete these empty folders once after updating.
  
  Using powershell:
```
Get-ChildItem "$env:TEMP" -Directory -Filter "ml_dotnet*" | Remove-Item -Recurse -Force
```
  Using Bash:
```
find "$TEMP" -type d -name "ml_dotnet*" -exec rm -rf {} +
```

Build / Test updates

[release/4.0] Update dependencies from dotnet/arcade (#7470)
[release/4.0] Use arcade script for installing MacOS dependencies (#7534)

Commits viewable in compare view.

Pinned Microsoft.ML.OnnxRuntime at 1.30.0.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.30.0

ONNX Runtime 1.30.0 expands generative AI inference, improves CPU and GPU performance, adds Go bindings, and strengthens runtime reliability. These notes cover changes since ONNX Runtime 1.29.1.

Highlights

Expanded CUDA inference support with variable-length causal convolution for continuous batching, speculative decoding in paged XQA, and INT4 paged KV caches with per-channel scales (#32168, #32340, #32515).
Improved WebGPU PagedAttention, added GPT-OSS support and INT8 KV-cache block quantization, and extended convolution optimizations (#31727, #32277, #32284, #32420).
Added fused CPU LinearAttention kernels for AVX-512, Arm64 NEON, and SVE, plus AVX2 LayerNorm/RMSNorm acceleration (#31674, #31973, #32178, #32356).
Added Go bindings for the ONNX Runtime C API and DeepSeek Engram contrib operators (#29615, #32268).

Announcements & Compatibility

FP4 QMoE kernels are now enabled by default in CUDA builds, with Windows build support added in this release. Source builds can opt out with -Donnxruntime_USE_FP4_QMOE=OFF (#32096, #32163).
CUDA fpA-intB builds now default to a compact kernel set for FP16 activations, INT4/INT8 weights, scale-only quantization, and block_size=32. Set -Donnxruntime_USE_FPA_INTB_GEMM_FULL=ON when building from source to retain the full kernel set, including BF16, zero-point, bias, larger-block-size, and native Hopper variants (#32324).
CPU FP16 Gemm and MatMul execution is gated on hardware acceleration. CPU-assigned FP16 nodes without a matching kernel now fall back to FP32 (#32301, #32197).
WebGPU plugin EP packaging now supports Linux AArch64. Plugin versions were advanced to WebGPU 0.4.0 and CUDA 0.2 (#32287, #31960, #31970).

Security & Reliability

Model Loading, Memory, and Input Validation

Limited nested model-graph depth and canonicalized external-data locations to harden model loading (#32344, #32135).
Added checked rounding for BFC arena allocations and fixed prepacked-weight reference lifetimes (#32010, #32040).
Strengthened shape, rank, and parameter validation for Split, Scan, GatherND, ScatterND, SpaceToDepth/DepthToSpace, Crop, Conv, Normalizer, and pooling (#29461, #31668, #32034, #32039, #32076, #32157, #32160, #32161, #32345, #32349).
Hardened generation and attention input handling, including attention-attribute narrowing, BifurcationDetector inputs, generation subgraph shapes, and QEmbed segment inputs. BeamSearch buffer expansion now uses dynamic shape storage (#31648, #31701, #32009, #32078, #32144).
Validated TreeEnsemble node references and bounded subtree comparison, rejected non-finite CPU RoiAlign coordinates, and required ImageScaler bias to match the channel count (#32031, #32043, #32011, #32002).
Added an allowlist of safe LoRA adapter parameter data types, validated MatMulFpQ4 shape inputs, and checked MLAS blockwise quantization/dequantization index ranges (#31682, #32032, #32007).

GPU Bounds and Resource Lifetimes

Hardened CUDA indexing and buffer-size arithmetic in MatMulNBits, RemovePadding, RotaryEmbedding, SparseAttention, Whisper beam search, NMS, QDQ, and GatherElements (#31643, #31994, #31995, #31996, #31998, #32014, #32029, #32030).
Fixed overflow in CUDA reduction scans and Softmax offset arithmetic, and handled zero-sized outputs in CUDA random-generator kernels (#32137, #32330, #31997).
Fixed CUDA MultiHeadAttention shared-cache scratch lifetimes and kept CudaAsyncBuffer staging storage alive across CUDA graph replay (#31968, #32121).
Fixed WebGPU out-of-bounds subgroup-matrix loads for partial tiles, zero-initialized writable device-allocator buffers, and rejected foreign GPU handles in built-in data transfers (#32364, #32063, #32317).

Dependencies and Tooling

Upgraded Protobuf to 33.6 and refreshed Python documentation dependencies, including an ONNX security-related update (#29906, #32190, #32424).
Updated JavaScript dependencies including js-yaml, joi, fast-uri, and the Next.js end-to-end fixture (#32397, #32486, #32488, #32505, #32508).
Pinned GitHub Actions to full-length commit SHAs and strengthened packaging infrastructure with authenticated package feeds and NPM network isolation (#32176, #32005, #32440).

New Features

Core APIs & Runtime

Added Go bindings for the ONNX Runtime C API (#29615).
Extended memory importing with host-pointer support and added access to preallocated outputs through KernelContext::GetPreallocatedOutput (#29726, #32089).
Added packed-attention workspace recipes and estimates, and made workspace input-shape handling aware of optional inputs (#32283, #32321, #32312).
Added DeepSeek Engram contrib operators, EngramGate and NGramHashMapping, and expanded kernel coverage for Qwen-3.5 operators (#32268, #32106).

Plugin Execution Providers

... (truncated)

1.29.1

This is a patch release on top of v1.29.0, containing GroupQueryAttention capability and KV-cache layout improvements, plugin Execution Provider performance tooling updates, and targeted graph and optimizer fixes.

GroupQueryAttention

Added bidirectional GroupQueryAttention support on CPU and CUDA through a backward-compatible causal attribute, with explicit handling for unsupported execution paths (#31704)
Added a session option and Execution Provider metadata contract for using the BNHS Value KV-cache layout, with graph transformations that preserve compatibility with the existing BNSH operator schema (#32139)
Added CPU support for attention_bias with a sliding-window KV cache, including explicit position IDs and post-eviction bias indexing (#32302)

Runtime and Performance Tools

Fixed Compile API model serialization when output-model and custom initializer-location callbacks are used together, preventing duplicate graph fields in emitted models (#32303)
Updated onnxruntime_perf_test to use plugin Execution Provider device allocators for generated inputs, loaded test data, and pre-allocated outputs, avoiding unnecessary per-run host/device copies (#32244)

Bug Fixes and Documentation

Hardened FastGelu fusion to skip malformed Mul and Pow patterns (#32016)
Added validation for in-memory external initializer references, rejecting unregistered or mismatched data before graph transformation (#32042)
Restored the C API documentation workflow by switching the pinned Doxygen download to the official GitHub release asset (#32210)

Contributors

Thanks to our 7 contributors for this release!

@adrastogi, @apsonawane, @edgchen1, @javier-intel, @jnagi-intel, @tianleiwu, @Wayne-Ch

_{Release highlights were drafted with AI assistance and are subject to release-team review.}

Full Changelog: v1.29.0...v1.29.1

1.29.0 Announcements & Breaking Changes

onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

Added NVFP4 QMoE, including native FP4xFP4 prefill on SM120, faster decode GEMV, fused routing/finalization paths, and reduced activation and weight-dequantization overhead (#29697, #29824, #29887, #29919, #31156, #31159, #31349, #31479).
... (truncated)

1.28.3

This is a patch release on top of v1.28.2, containing memory-safety and model-validation fixes, a plugin execution fix, and packaging infrastructure updates.

Highlights

Bug Fixes

Fixed an out-of-bounds read in EmbedLayerNormalization shape inference when beta is a scalar (#32610).
Fixed a heap buffer overflow when reusing a packed sub-byte buffer for a full-byte tensor (#32611).
Fixed an out-of-bounds read when a Loop or Scan body input is also an initializer (#32609).
Hardened shape inference for applicable contrib operators, including GroupQueryAttention, SparseAttention, and CausalConvWithState (#32607).
Fixed out-of-bounds reads in ConvTransposeWithDynamicPads and InferenceContextImpl::getInputData (#32679, #32681).
Rejected invalid graph structures: inputs to a zero-input operator schema and subgraphs on non-control-flow nodes (#32633, #32641).
Preserved streams during single-tensor data transfers in the plugin EP (#32666).

Build and Test Reliability

Unblocked packaging with Linux image prerequisites and an authenticated ARM64 pip index, mirrored Dawn checkouts, authenticated Android pip and Gradle feeds, and authenticated NuGet feeds for mobile workloads (#31724, #29743, #32400, #32005).
Installed uuid-dev for the Linux minimal CoreML build and removed the Hugging Face download dependency from a quantization test (#32491, #32443).

Contributors

Thanks to our 10 contributors for this release!

@wangw-1991, @bbernhar, @shiyi9801, @tianleiwu, @adrastogi, @eserscor, @jiafatom, @miaobin, @sanaa-hamel-microsoft, @xiaofeihan1

Full Changelog: v1.28.2...v1.28.3

These release notes were drafted with assistance from GitHub Copilot.

1.28.2

This is a patch release on top of v1.28.1, containing a targeted fix for Compile API model serialization.

Highlights

Bug Fixes

Fixed Compile API callback serialization to prevent duplicate graph nodes, inputs, outputs, and value information in emitted optimized models, including models with embedded or external initializers (#32303)

Contributors

Thanks to our contributor for this release!

@adrastogi

Full Changelog: v1.28.1...v1.28.2

These release notes were drafted with assistance from GitHub Copilot.

1.28.1

This is a patch release on top of v1.28.0, containing support for device-free WebGPU compilation, improved compatibility with sandboxed Windows processes, and targeted graph-validation fixes.

WebGPU EP

Added support for device-free compile-only sessions, enabling offline graph transformation and optimized-model serialization without access to GPU hardware (#29681)

Bug Fixes

Prevented an access violation in Windows processes under Win32k lockdown by skipping DXGI device discovery (#29755)
Allowed zero-input EPContext nodes, aligning their schema with support for compiling zero-input models (#29799)
Hardened FastGelu fusion to skip malformed Mul and Pow patterns (#32016)
Added validation for in-memory external initializer references, rejecting unregistered or mismatched data before graph transformation (#32042)

Contributors

Thanks to our 4 contributors for this release!

@apsonawane, @shiyi9801, @adrastogi, @mingmingtasd

Full Changelog: v1.28.0...v1.28.1

1.28.0 Announcements & Breaking Changes

Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#28754, #29606, #28967). Graph optimizer opset version checks were updated accordingly (#28966).
cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#29252, #29808, #29705, #29620).
An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#28746, #29142, #28990).
Deprecated / removed:
- SkipLayerNorm strict mode is deprecated (#29388).
- The TensorRT fused causal attention kernels were removed from the CUDA EP (#29143).
- The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#29141, #28355).
- CUDA_QUANT_PREPROCESS is off by default (#29687).
NPM packages are now published from the CUDA 13 pipeline (#28773).
The CUDA 12.8 package architecture list was refreshed for this release (#29711).

Security Fixes

Memory safety & input validation

Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#28186, #29068)
Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#28839)
Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#28973)
Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#28991, #29011, #29012, #29014)
Validated Col2Im inputs to prevent heap over-read (#28706)
Hardened CropAndResize against malformed crop_size tensors (#28766)
Validated BeamSearch vocab_size against logits width (#28774)
Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#29239)
Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#29015, #29242)
Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#29240, #29447)
Clamped 1D attention mask_index to valid bounds (#29449)
Validated MaxpoolWithMask kernel rank against input spatial rank (#29253)
Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#29264)
Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#29268, #29448)
Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#29293, #29060)
Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#29462)
Handled non-trivially-copyable types in Loop/Scan output concatenation (#29397)
Normalized bool tensor raw_data to {0, 1} on unpack (#29238)
Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#28779, #28780, #28801)
Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#29251)

Integer overflow & allocation size

Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#29444, #29446)
Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#29443)
Hardened QMoE against integer overflow and partial K tiles (#29067)
Validated B/scales/zero-points shape in MatMulNBits::PrePack (#29445)
Pre-checked ConstantOfShape output size against the input initializer before constant folding (#28751)
Fixed integer overflow in RKNPU implicit bias allocation (#29249)
Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#28721, #28704, #28718)

Supply chain & tooling

... (truncated)

1.27.1

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

[MLAS] Fixed an igemm regression in the KleidiAI path (#28571)
Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#29081)
Fixed a regression in graph-capture session initialization that rejected an empty graph (#29457)
Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#29574)

Performance

NVIDIA CUDA EP

Added a QMoE GEMV fast path for batch-1 decode (#29038)

CI & Build Infrastructure

Fixed an incorrect identity for azcopy (#29274)
Fixed a brew install applesimutils failure by trusting the wix/brew tap (#29450)
Upgraded to Xcode 26 (#29468)
Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#29575)
Fixed the web e2e (npm/vite) and Python DML CI pipelines (#29609)

Contributors

Thanks to our 8 contributors for this release!

@tianleiwu, @chilo-ms, @edgchen1, @adrastogi, @damdoo01-arm, @JonathanC-ARM, @martin-klacer-arm, @sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1

1.27.0

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28.
n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

CUDA 12 package files are now explicitly named as such.
CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

Security Fixes

Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#28004)
Hardened OneHot input validation and output-size computation (#28014)
Added SafeInt overflow protection in Expand and cappe...

Description has been truncated

Bumps CsvHelper from 33.0.1 to 33.1.0 Bumps Microsoft.AspNetCore.Mvc.Testing from 8.0.11 to 8.0.31 Bumps Microsoft.ML from 4.0.2 to 4.0.3 Bumps Microsoft.ML.OnnxRuntime from 1.20.1 to 1.30.0 Bumps Microsoft.NET.Test.Sdk from 17.11.1 to 17.14.1 Bumps Swashbuckle.AspNetCore from 6.9.0 to 10.2.3 Bumps xunit from 2.9.2 to 2.9.3 Bumps xunit.runner.visualstudio from 2.8.2 to 4.0.0 --- updated-dependencies: - dependency-name: CsvHelper dependency-version: 33.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Microsoft.AspNetCore.Mvc.Testing dependency-version: 8.0.31 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget - dependency-name: Microsoft.ML dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget - dependency-name: Microsoft.ML.OnnxRuntime dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 17.14.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Swashbuckle.AspNetCore dependency-version: 10.2.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: xunit dependency-version: 2.9.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-12T16:07:26Z

Superseded by #7.

dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Sep 30, 2026

dependabot Bot changed the title ~~Bump the nuget group with 8 updates~~ Bump CsvHelper and 7 others Oct 5, 2026

dependabot Bot force-pushed the dependabot/nuget/src/PhishingAnalyser.Api/nuget-85465b9275 branch from 87abf95 to 2b29839 Compare October 5, 2026 05:26

dependabot Bot closed this Oct 12, 2026

dependabot Bot deleted the dependabot/nuget/src/PhishingAnalyser.Api/nuget-85465b9275 branch October 12, 2026 16:07

Navigation Menu

Repository navigation

Bump CsvHelper and 7 others - #4

Bump CsvHelper and 7 others#4
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/PhishingAnalyser.Api/nuget-85465b9275

dependabot Bot commented on behalf of github Sep 30, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

8.0.31

What's Changed

8.0.30

What's Changed

New Contributors

8.0.29

What's Changed

8.0.28

What's Changed

8.0.27

What's Changed

8.0.26

What's Changed

8.0.25

What's Changed

8.0.24

8.0.23

What's Changed

8.0.22

What's Changed

8.0.21

What's Changed

8.0.20

What's Changed

8.0.18

What's Changed

8.0.17

Bug Fixes

Dependency Updates

Miscellaneous

8.0.16

What's Changed

8.0.15

What's Changed

8.0.14

What's Changed

8.0.13

What's Changed

8.0.12

What's Changed

4.0.3

ML.NET 4.0.3

Bug Fixes

Build / Test updates

1.30.0

Highlights

Announcements & Compatibility

Security & Reliability

Model Loading, Memory, and Input Validation

GPU Bounds and Resource Lifetimes

Dependencies and Tooling

New Features

Core APIs & Runtime

Plugin Execution Providers

1.29.1

GroupQueryAttention

Runtime and Performance Tools

Bug Fixes and Documentation

Contributors

1.29.0

Announcements & Breaking Changes

Security Fixes

Path, bounds, and input validation

Supply chain and tooling

New Features

Core APIs & Runtime

Execution Provider ABI & Plugin EPs

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

MoE and quantized GEMM

1.28.3

Highlights

Bug Fixes

Build and Test Reliability

Contributors

1.28.2

dependabot Bot commented on behalf of github Sep 30, 2026 •

edited

Loading