Bump FluentAssertions and 15 others by dependabot[bot] · Pull Request #41 · dantte-lp/dc-research-mcp

Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#28754, #29606, #28967). Graph optimizer opset version checks were updated accordingly (#28966).
cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#29252, #29808, #29705, #29620).
An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#28746, #29142, #28990).
Deprecated / removed:
- SkipLayerNorm strict mode is deprecated (#29388).
- The TensorRT fused causal attention kernels were removed from the CUDA EP (#29143).
- The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#29141, #28355).
- CUDA_QUANT_PREPROCESS is off by default (#29687).
NPM packages are now published from the CUDA 13 pipeline (#28773).
The CUDA 12.8 package architecture list was refreshed for this release (#29711).

Security Fixes

Memory safety & input validation

Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#28186, #29068)
Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#28839)
Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#28973)
Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#28991, #29011, #29012, #29014)
Validated Col2Im inputs to prevent heap over-read (#28706)
Hardened CropAndResize against malformed crop_size tensors (#28766)
Validated BeamSearch vocab_size against logits width (#28774)
Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#29239)
Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#29015, #29242)
Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#29240, #29447)
Clamped 1D attention mask_index to valid bounds (#29449)
Validated MaxpoolWithMask kernel rank against input spatial rank (#29253)
Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#29264)
Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#29268, #29448)
Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#29293, #29060)
Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#29462)
Handled non-trivially-copyable types in Loop/Scan output concatenation (#29397)
Normalized bool tensor raw_data to {0, 1} on unpack (#29238)
Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#28779, #28780, #28801)
Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#29251)

Integer overflow & allocation size

Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#29444, #29446)
Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#29443)
Hardened QMoE against integer overflow and partial K tiles (#29067)
Validated B/scales/zero-points shape in MatMulNBits::PrePack (#29445)
Pre-checked ConstantOfShape output size against the input initializer before constant folding (#28751)
Fixed integer overflow in RKNPU implicit bias allocation (#29249)
Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#28721, #28704, #28718)

Supply chain & tooling

... (truncated)

1.27.1

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

[MLAS] Fixed an igemm regression in the KleidiAI path (#28571)
Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#29081)
Fixed a regression in graph-capture session initialization that rejected an empty graph (#29457)
Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#29574)

Performance

NVIDIA CUDA EP

Added a QMoE GEMV fast path for batch-1 decode (#29038)

CI & Build Infrastructure

Fixed an incorrect identity for azcopy (#29274)
Fixed a brew install applesimutils failure by trusting the wix/brew tap (#29450)
Upgraded to Xcode 26 (#29468)
Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#29575)
Fixed the web e2e (npm/vite) and Python DML CI pipelines (#29609)

Contributors

Thanks to our 8 contributors for this release!

@tianleiwu, @chilo-ms, @edgchen1, @adrastogi, @damdoo01-arm, @JonathanC-ARM, @martin-klacer-arm, @sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1

1.27.0

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28.
n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

CUDA 12 package files are now explicitly named as such.
CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

Security Fixes

Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#28004)
Hardened OneHot input validation and output-size computation (#28014)
Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#28055)
Bounded total output allocation size in Tile kernel (#28070)
Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#28223)
Fixed BitShift UB for shift amounts greater than or equal to bit width (#28272)
Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#28277)
Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#28279)
Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#28386)
Fixed out-of-bounds read in CropBase scale handling (#28399)
Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#28400)
Added sparse tensor external file path validation and additional external-path hardening (#28408, #28709, #28725)
Switched remaining torch.load() calls to weights_only=True (#28421)
Added CPU cache-indirection beam-index validation (#28486)
Added additional overflow/bounds checks and test coverage in runtime buffers (#28713, #28747)

New Features

Execution Provider Plugin API

Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#28037)
Added OrtEp::OnSessionInitializationEnd() callback (#28319)
Added plugin EP session-options getters (#28377)
Added CUDA Plugin EP provider options for streams and external allocators (#28603)

Core APIs & Runtime

Added support for ONNX overloaded functions (IR v10+) (#28275)
Added FLOAT8E8M0 datatype support in ONNX Runtime (#28381)
Added CPU Cast support for FLOAT8E8M0 (#28435)
Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#28282)

Quantization & Training Tooling

Added calibration cache support to quantize_static (#28221)
Added ActivationRestrictedAsymmetric quantization option (#28237)
... (truncated)

1.26.0

n.b. The following was generated via LLM from Git history. Only the contributor list has been verified.

ONNX Runtime Release 1.26.0

Announcement - Breaking Changes

Support for CUDA 12 will be removed in 1.27.0.
- CUDA 13 will continue to be published as onnxruntime-<os>-<arch>-gpu_cuda13-<version>.<ext>
CUDA runtime will be moving soon to a dedicated Execution Provider (EP) instead of a published package from ORT core.

Highlights

Added optional memory mapping for .ort model loads (#28164).
Added RISC-V Vector (RVV) support for CPU EP (#28261).
OpenVINO EP upgraded for 1.26.0 development release (#28297).
WebGPU gained GridSample support (#28264) and Split-K improvements (#28151).
CUDA plugin EP gained graph support (#28002), profiling API (#28216).

Security and Reliability Hardening

Replaced unrestricted Python setattr configuration with an allowlist (#28083).
Hardened multiple OOB and overflow scenarios across ML and core ops:
- Attention mask index OOB write (#27789).
- MaxPoolGrad indices bounds validation (#27903).
- SVM and TreeEnsemble bounds/security fixes (#27950, #27951, #27952, #27989).
- RNN sequence_lens OOB read and integer overflow handling (#28052, #28003).
- GroupQueryAttention seqlens_k bounds validation and compatibility follow-up (#28031, #28259).
- MatMulBnb4 and ML coefficient SafeInt checks (#27995, #28001).
- CUDA Gather int32 overflow fix (#28108).
- GridSample float->int64 cast hardening for NaN/Inf/out-of-range coords (#28302).
Fixed session logger use-after-free during EP teardown under verbose logging (#28274).

CUDA, Attention, and MLAS

Filled CUDA opset/operator gaps and extended support:
- Transpose opset 23 -> 25 (#27740).
- QuantizeLinear/DequantizeLinear opset 25 (#28046).
- CUDA TopK INT8/INT16/UINT8 support (#27862).
- LabelEncoder CUDA support for numeric types (#28045).
Attention/GQA improvements:
- Fixed ONNX Attention min-bias alignment crash on SM<80 and masked-batch NaN behavior (#27831).
- Added FP32 QK accumulation path for unfused GQA attention (#28198).
- Added CUDART_VERSION reduction compatibility in GQA attention (#28296).
- Fixed CUDA 13 build error in GQA unfused attention (#28309).
- PagedAttention fallback for SM<80 fp16 (#28200).
MLAS updates:
- FP16 Gelu enablement (#26815).
- Arm64 BF16 fast-math conv kernels for NCHW/NCHWc paths (#27878).

WebGPU, WebNN, and JavaScript

... (truncated)

1.25.1

n.b. This changelog is LLM generated. Only the contributor listing has been verified.

ONNX Runtime Release 1.25.1

📢 Announcements & Breaking Changes

ONNX Op Updates

Enhanced ONNX operator support with new opset versions: Reshape (opset 25), Transpose (opset 24) (#27752)

✨ New Features

📊 New ONNX Ops & Model Support

LinearAttention and CausalConvState operators for Qwen3.5 model support (#27907)
RotaryEmbedding (RotEMB) and RMSNorm operators added (#27752)
Linear Attention signature support (#27842)

🌐 Web & JavaScript

WebGPU EP

Qwen3.5 model support on WebGPU execution provider (#27996)
QMoE 1-token decode path optimization — fused operations to reduce GPU dispatches for improved performance ([#27998](Transpose Utility Layer microsoft/onnxruntime#2799......

Description has been truncated

Bumps FluentAssertions from 8.9.0 to 8.10.0 Bumps Meziantou.Analyzer from 3.0.50 to 3.0.141 Bumps Microsoft.EntityFrameworkCore from 9.0.15 to 9.0.18 Bumps Microsoft.EntityFrameworkCore.Design from 9.0.15 to 9.0.18 Bumps Microsoft.Extensions.Configuration from 10.0.6 to 10.0.10 Bumps Microsoft.Extensions.Configuration.Binder from 10.0.6 to 10.0.10 Bumps Microsoft.Extensions.Configuration.CommandLine from 10.0.6 to 10.0.10 Bumps Microsoft.Extensions.Configuration.EnvironmentVariables from 10.0.6 to 10.0.10 Bumps Microsoft.Extensions.Configuration.Json from 10.0.6 to 10.0.10 Bumps Microsoft.ML.OnnxRuntime from 1.24.4 to 1.28.0 Bumps Microsoft.NET.Test.Sdk from 18.4.0 to 18.8.1 Bumps ModelContextProtocol from 1.2.0 to 1.4.1 Bumps SonarAnalyzer.CSharp from 10.23.0.137933 to 10.31.0.145097 Bumps Spectre.Console from 0.55.2 to 0.57.2 Bumps System.CommandLine from 2.0.6 to 2.0.10 Bumps Testcontainers.PostgreSql from 4.11.0 to 4.13.0 --- updated-dependencies: - dependency-name: FluentAssertions dependency-version: 8.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Meziantou.Analyzer dependency-version: 3.0.141 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.EntityFrameworkCore dependency-version: 9.0.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.EntityFrameworkCore.Design dependency-version: 9.0.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.Extensions.Configuration dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.Extensions.Configuration.Binder dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.Extensions.Configuration.CommandLine dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.Extensions.Configuration.EnvironmentVariables dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.Extensions.Configuration.Json dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.ML.OnnxRuntime dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: ModelContextProtocol dependency-version: 1.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: SonarAnalyzer.CSharp dependency-version: 10.31.0.145097 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Spectre.Console dependency-version: 0.57.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: System.CommandLine dependency-version: 2.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Testcontainers.PostgreSql dependency-version: 4.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-10T03:25:12Z

Labels

The following labels could not be found: deps, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot Bot mentioned this pull request Aug 10, 2026

Bump ModelContextProtocol from 1.2.0 to 2.0.0 #40

Closed

Navigation Menu

Bump FluentAssertions and 15 others - #41

Bump FluentAssertions and 15 others#41
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/minor-and-patch-abd99d0164

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 10, 2026

8.10.0

What's Changed

Improvements

Documentation

Others

3.0.141

What's Changed

3.0.140

What's Changed

3.0.139

What's Changed

3.0.138

What's Changed

3.0.137

What's Changed

3.0.136

What's Changed

3.0.135

What's Changed

3.0.134

What's Changed

3.0.133

What's Changed

3.0.132

What's Changed

3.0.131

What's Changed

3.0.130

What's Changed

3.0.129

What's Changed

3.0.128

What's Changed

3.0.127

What's Changed

3.0.126

What's Changed

3.0.125

What's Changed

3.0.124

What's Changed

3.0.123

What's Changed

3.0.122

What's Changed

3.0.121

What's Changed

3.0.120

What's Changed

3.0.119

What's Changed

3.0.118

What's Changed

3.0.117

What's Changed

3.0.116

What's Changed

3.0.115

What's Changed

3.0.114

What's Changed

3.0.113

What's Changed

3.0.112

3.0.111

What's Changed

3.0.110

What's Changed

3.0.109

What's Changed

3.0.108

What's Changed

3.0.107

What's Changed

3.0.106

What's Changed

3.0.105

What's Changed