Bump Microsoft.ML.OnnxRuntime from 1.24.4 to 1.25.1

[dependabot]

Updated Microsoft.ML.OnnxRuntime from 1.24.4 to 1.25.1.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.25.1

ONNX Runtime Release 1.25.1

📢 Announcements & Breaking Changes

ONNX Op Updates

• Enhanced ONNX operator support with new opset versions: Reshape (opset 25), Transpose (opset 24) (#​27752)

---

✨ New Features

📊 New ONNX Ops & Model Support

• LinearAttention and CausalConvState operators for Qwen3.5 model support (#​27907)
• RotaryEmbedding (RotEMB) and RMSNorm operators added (#​27752)
• Linear Attention signature support (#​27842)

---

🌐 Web & JavaScript

WebGPU EP

• Qwen3.5 model support on WebGPU execution provider (#​27996)
• QMoE 1-token decode path optimization — fused operations to reduce GPU dispatches for improved performance (#​27998)

---

🐛 Bug Fixes

Core Runtime Fixes

• Improved filesystem error messages during Linux device discovery for better debugging experience (#​27289)
• Fixed missing include for SetRawDataInTensorProto in NVIDIA TensorRT RTX tests (#​28065)

---

🙏 Contributors

Thanks to our 7 contributors for this release:
@​guschmue, @​sanaa-hamel-microsoft, @​apsonawane, @​eserscor, @​ishwar-raut1, @​qjia7, @​theHamsta

Full Changelog: microsoft/onnxruntime@v1.25.0...v1.25.1

1.25.0

📢 Announcements & Breaking Changes

Build & Platform

• C++20 is now required to build ONNX Runtime from source. Minimum toolchains: MSVC 19.29+, GCC 10+, Clang 10+. Users of prebuilt packages are unaffected. (#​27178)
• CUDA minimum version raised to 12.0 — CUDA 11.x is no longer supported. Users pinned to CUDA 11.x should stay on ORT 1.24.x or upgrade their CUDA toolkit/driver. (#​27570)
• ONNX upgraded to 1.21.0 (#​27601)
• sympy is now an optional dependency for Python builds. (#​27200)

Execution Provider Changes

• ArmNN EP has been removed. Users should remove any --use_armnn build flags and migrate to the MLAS/KleidiAI-backed CPU EP or QNN EP for Qualcomm hardware. (#​27447)

API Version

• ORT_API_VERSION updated to 25. (#​27280)

---

🔒 Security Fixes

• Fixed potential integer truncation leading to heap out-of-bounds read/write (#​27544)
• Addressed Pad Reflect vulnerability (#​27652)
• Security fix for transpose optimizer (#​27555)
• Upgraded minimatch 3.1.2 → 3.1.4 for CVE-2026-27904 (#​27667)
• Hardened shell command handling for constant strings (#​27840)
• Added validation of onnx::TensorProto data size before allocation (#​27547)
• Cleaned up external data path validation (#​27539)
• Fixed misaligned address reads for tensor attributes from raw data buffers (#​27312)
• Fixed CPU Attention overflow issue (#​27822)
• Fixed CPU LRN integer overflow issues (#​27886)
• Additional input validation hardening:
  • Tile kernel dim overflow (#​27566)
  • Out-of-bounds read in cross entropy (#​27568)
  • TreeEnsembleClassifier attributes (#​27571)
  • AffineGrid (#​27572)
  • EmbedLayerNorm position_ids (#​27573)
  • RotaryEmbedding position_ids (#​27597)
  • RoiAlign batch_indices (#​27603)
  • MaxUnpool indices (#​27432)
  • QMoECPU swiglu OOB (#​27748)
  • SVMClassifier initializer (#​27699)
  • Col2Im SafeInt (#​27625)

---

✨ New Features

🔌 Execution Provider Plugin API & CUDA Plugin EP

... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, dotnet. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like Microsoft.ML.OnnxRuntime is no longer a dependency, so this is no longer needed.