Bump FluentAssertions and 11 others by dependabot[bot] · Pull Request #9 · dantte-lp/dc-research-mcp

Support for CUDA 12 will be removed in 1.27.0.
- CUDA 13 will continue to be published as onnxruntime-<os>-<arch>-gpu_cuda13-<version>.<ext>
CUDA runtime will be moving soon to a dedicated Execution Provider (EP) instead of a published package from ORT core.

Highlights

Added optional memory mapping for .ort model loads (#28164).
Added RISC-V Vector (RVV) support for CPU EP (#28261).
OpenVINO EP upgraded for 1.26.0 development release (#28297).
WebGPU gained GridSample support (#28264) and Split-K improvements (#28151).
CUDA plugin EP gained graph support (#28002), profiling API (#28216).

Security and Reliability Hardening

Replaced unrestricted Python setattr configuration with an allowlist (#28083).
Hardened multiple OOB and overflow scenarios across ML and core ops:
- Attention mask index OOB write (#27789).
- MaxPoolGrad indices bounds validation (#27903).
- SVM and TreeEnsemble bounds/security fixes (#27950, #27951, #27952, #27989).
- RNN sequence_lens OOB read and integer overflow handling (#28052, #28003).
- GroupQueryAttention seqlens_k bounds validation and compatibility follow-up (#28031, #28259).
- MatMulBnb4 and ML coefficient SafeInt checks (#27995, #28001).
- CUDA Gather int32 overflow fix (#28108).
- GridSample float->int64 cast hardening for NaN/Inf/out-of-range coords (#28302).
Fixed session logger use-after-free during EP teardown under verbose logging (#28274).

CUDA, Attention, and MLAS

Filled CUDA opset/operator gaps and extended support:
- Transpose opset 23 -> 25 (#27740).
- QuantizeLinear/DequantizeLinear opset 25 (#28046).
- CUDA TopK INT8/INT16/UINT8 support (#27862).
- LabelEncoder CUDA support for numeric types (#28045).
Attention/GQA improvements:
- Fixed ONNX Attention min-bias alignment crash on SM<80 and masked-batch NaN behavior (#27831).
- Added FP32 QK accumulation path for unfused GQA attention (#28198).
- Added CUDART_VERSION reduction compatibility in GQA attention (#28296).
- Fixed CUDA 13 build error in GQA unfused attention (#28309).
- PagedAttention fallback for SM<80 fp16 (#28200).
MLAS updates:
- FP16 Gelu enablement (#26815).
- Arm64 BF16 fast-math conv kernels for NCHW/NCHWc paths (#27878).

WebGPU, WebNN, and JavaScript

... (truncated)

1.25.1

n.b. This changelog is LLM generated. Only the contributor listing has been verified.

ONNX Runtime Release 1.25.1

📢 Announcements & Breaking Changes

ONNX Op Updates

Enhanced ONNX operator support with new opset versions: Reshape (opset 25), Transpose (opset 24) (#27752)

✨ New Features

📊 New ONNX Ops & Model Support

LinearAttention and CausalConvState operators for Qwen3.5 model support (#27907)
RotaryEmbedding (RotEMB) and RMSNorm operators added (#27752)
Linear Attention signature support (#27842)

🌐 Web & JavaScript

WebGPU EP

Qwen3.5 model support on WebGPU execution provider (#27996)
QMoE 1-token decode path optimization — fused operations to reduce GPU dispatches for improved performance (#27998)

🐛 Bug Fixes

Core Runtime Fixes

Improved filesystem error messages during Linux device discovery for better debugging experience (#27289)
Fixed missing include for SetRawDataInTensorProto in NVIDIA TensorRT RTX tests (#28065)

🙏 Contributors

Thanks to our 7 contributors for this release:
@guschmue, @sanaa-hamel-microsoft, @apsonawane, @eserscor, @ishwar-raut1, @qjia7, @theHamsta

Full Changelog: microsoft/onnxruntime@v1.25.0...v1.25.1

1.25.0 📢 Announcements & Breaking Changes

Build & Platform

C++20 is now required to build ONNX Runtime from source. Minimum toolchains: MSVC 19.29+, GCC 10+, Clang 10+. Users of prebuilt packages are unaffected. (#27178)
CUDA minimum version raised to 12.0 — CUDA 11.x is no longer supported. Users pinned to CUDA 11.x should stay on ORT 1.24.x or upgrade their CUDA toolkit/driver. (#27570)
ONNX upgraded to 1.21.0 (#27601)
sympy is now an optional dependency for Python builds. (#27200)

Execution Provider Changes

ArmNN EP has been removed. Users should remove any --use_armnn build flags and migrate to the MLAS/KleidiAI-backed CPU EP or QNN EP for Qualcomm hardware. (#27447)

API Version

ORT_API_VERSION updated to 25. (#27280)

🔒 Security Fixes

Fixed potential integer truncation leading to heap out-of-bounds read/write (#27544)
Addressed Pad Reflect vulnerability (#27652)
Security fix for transpose optimizer (#27555)
Upgraded minimatch 3.1.2 → 3.1.4 for CVE-2026-27904 (#27667)
Hardened shell command handling for constant strings (#27840)
Added validation of onnx::TensorProto data size before allocation (#27547)
Cleaned up external data path validation (#27539)
Fixed misaligned address reads for tensor attributes from raw data buffers (#27312)
Fixed CPU Attention overflow issue (#27822)
Fixed CPU LRN integer overflow issues (#27886)
Additional input validation hardening:
- Tile kernel dim overflow (#27566)
- Out-of-bounds read in cross entropy (#27568)
- TreeEnsembleClassifier attributes (#27571)
- AffineGrid (#27572)
- EmbedLayerNorm position_ids (#27573)
- RotaryEmbedding position_ids (#27597)
- RoiAlign batch_indices (#27603)
- MaxUnpool indices (#27432)
- QMoECPU swiglu OOB (#27748)
- SVMClassifier initializer (#27699)
- Col2Im SafeInt (#27625)

✨ New Features

🔌 Execution Provider Plugin API & CUDA Plugin EP

... (truncated)

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.4.0 to 18.5.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.5.1 What's Changed

Fix System.Collections.Immutable binding mismatch in Common.dll (rel/18.5) by @nohwnd in Fix System.Collections.Immutable binding mismatch in Common.dll (rel/18.5) microsoft/vstest#15720
Port verify-binding-redirects.ps1 to rel/18.5 by @nohwnd in Port verify-binding-redirects.ps1 to rel/18.5 microsoft/vstest#15719
Bump to 18.5.1 by @nohwnd in Bump to 18.5.1 microsoft/vstest#15721

Full Changelog: microsoft/vstest@v18.5.0...v18.5.1

18.5.0

⚠️ Unlisted on Nuget, because of #15718

What's Changed

Add runtime configs by @nohwnd in Add runtime configs microsoft/vstest#15377
Add net8.0 target for TranslationLayer by @nohwnd in Add net8.0 target for TranslationLayer microsoft/vstest#15375
Determine architecture of remote process on windows by @nohwnd in Determine architecture of remote process on windows microsoft/vstest#15396
Updating System.Collections.Immutable package reference to version 9.0.0 by @MSLukeWest in Updating System.Collections.Immutable package reference to version 9.0.0 microsoft/vstest#15392
Dump via netcore tool on windows by @nohwnd in Dump via netcore tool on windows microsoft/vstest#15397
Fix answer file splitting by @nohwnd in Fix answer file splitting microsoft/vstest#15381
Run tests against vsix runner by @nohwnd in Run tests against vsix runner microsoft/vstest#15419

Full Changelog: microsoft/vstest@v18.4.0...v18.5.0

Commits viewable in compare view.

Updated ModelContextProtocol from 1.2.0 to 1.3.0.

Release notes

Sourced from ModelContextProtocol's releases.

1.3.0

v1.3.0 focuses on improved transport diagnostics and security-focused documentation. The new public ClientTransportClosedException gives stdio and HTTP clients structured access to transport closure details (exit codes, process IDs, stderr tails, HTTP status codes) without parsing exception messages. Two reliability fixes harden the stdio process pipeline (preventing host crashes from user StandardErrorLines callbacks) and correct the stateless HTTP transport's capability advertisement. New conceptual documentation covers role/identity propagation in tool execution, allowed-hosts and CORS guidance for HTTP servers, and aligns the docs information architecture with the MCP specification structure.

What's Changed

Make ClientTransportClosedException public and unify transport exception handling #1467 by @stephentoub (co-authored by @halter73 @Copilot)
- As part of this unification, SSE/HTTP client connection failures from McpClient.CreateAsync(...) now surface as IOException (the new ClientTransportClosedException derives from IOException) rather than InvalidOperationException. Caller-triggered OperationCanceledException is also no longer wrapped, matching standard async cancellation semantics.
Fix process crash when testing Stderr #1449 by @ericstj (co-authored by @Copilot)
Fix stateless HTTP transport advertising listChanged capability #1509 by @jayaraman-venkatesan

Documentation Updates

docs: align docs IA with MCP specification structure #1481 by @jeffhandley (co-authored by @mikekistler @Copilot)
Document recommended pattern for role/identity propagation in MCP tool execution #1497 by @jeffhandley (co-authored by @halter73 @mikekistler @Copilot)
Document and demonstrate allowed hosts and CORS policy guidance #1554 by @jeffhandley (co-authored by @halter73 @mikekistler @Copilot)

Test Improvements

Fix flaky OutgoingFilter_MultipleFilters_ExecuteInOrder test #1488 by @ericstj (co-authored by @Copilot)

Repository Infrastructure Updates

Bump the opentelemetry-testing group with 5 updates #1478
Bump actions/deploy-pages from 4.0.5 to 5.0.0 #1477
Bump actions/download-artifact from 8.0.0 to 8.0.1 #1437
Bump actions/setup-dotnet from 5.1.0 to 5.2.0 #1418
Bump actions/setup-node from 6.2.0 to 6.3.0 #1419
Bump the testing-frameworks group with 1 update #1459
Bump the npm_and_yarn group across 1 directory with 2 updates #1410
Switch to custom CodeQL workflow #1489 by @jeffhandley
Block Release Publishing workflow from automatically running on forks #1450 by @jeffhandley (co-authored by @Copilot)
Bump actions/checkout from 4 to 6 #1504
Add testing guidelines, update copilot instructions for tests #1507 by @ericstj
Bump OpenTelemetry and 3 others #1514
Bump the opentelemetry-testing group with 6 updates #1533
Bump actions/setup-node from 6.3.0 to 6.4.0 #1522
Bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 #1511
Bump the npm_and_yarn group across 1 directory with 5 updates #1500
Bump Anthropic from 12.9.0 to 12.11.0 #1506
Bump actions/upload-artifact from 7.0.0 to 7.0.1 #1512
Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.4 to 5.5.5 #1521
Bump the testing-frameworks group with 2 updates #1523
Bump the other-testing group with 2 updates #1534
Bump Microsoft.Extensions.AI from 10.4.1 to 10.5.0 #1525
Remove extraneous labels from dependabot.yml #1535 by @mikekistler
Bump Anthropic from 12.11.0 to 12.17.0 #1544
Fix dev container configuration to work in codespaces #1555 by @mikekistler
Bump Microsoft.NET.Test.Sdk from 18.4.0 to 18.5.1 #1543
Bump the npm_and_yarn group across 1 directory with 3 updates #1565
Bump Microsoft.Extensions.AI.Abstractions from 10.5.0 to 10.5.2 #1561

... (truncated)

Commits viewable in compare view.

Updated SonarAnalyzer.CSharp from 10.23.0.137933 to 10.25.0.139117.

Release notes

Sourced from SonarAnalyzer.CSharp's releases.

10.25

?

Feature

NET-3613 - Support Cobertura coverage file format
- Cobertura report paths can be passed via the sonar.cs.cobertura.reportsPaths parameter
NET-3665 - Update RSPEC before 10.25 release

False Positive

NET-3640 - Fix S3400 FP: Don't report function with conditional compilation body

10.24

This release brings a batch of false negative fixes and analyzer crash fixes.

Bug Fixes

NET-3596 - Fix S1144 AD0001: Index out of range exception with type named Nullable
NET-3522 - Fix S1215 AD0001: ArgumentOutOfRangeException
NET-3521 - Fix S2053 AD0001: NRE
NET-3520 - Fix S3267 AD0001: NRE

False Positives

NET-2276 - Fix S1192 FP: EF migration classes

False Negatives

NET-3569 - Fix T0008 and T0009 FN: Support extension blocks
NET-2875 - Fix S2092 FN: Null Conditional Assignment
NET-2857 - Fix S3330 FN: Null Conditional Assignment
NET-2719 - Fix S4136 FN: Extension methods
NET-2688 - Fix S4433 FN: Null-conditional assignment in tracker
NET-2675 - Fix S6418 FN: Field keyword
NET-2667 - Fix S2934 FN: Null-conditional assignment and field keyword
NET-2658 - Fix S127 FN: BitShiftCompound

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps FluentAssertions from 8.9.0 to 8.10.0 Bumps Meziantou.Analyzer from 3.0.50 to 3.0.84 Bumps Microsoft.EntityFrameworkCore from 9.0.15 to 9.0.16 Bumps Microsoft.EntityFrameworkCore.Design from 9.0.15 to 9.0.16 Bumps Microsoft.Extensions.Configuration from 10.0.6 to 10.0.8 Bumps Microsoft.Extensions.Configuration.Binder from 10.0.6 to 10.0.8 Bumps Microsoft.Extensions.Configuration.EnvironmentVariables from 10.0.6 to 10.0.8 Bumps Microsoft.Extensions.Configuration.Json from 10.0.6 to 10.0.8 Bumps Microsoft.ML.OnnxRuntime from 1.24.4 to 1.26.0 Bumps Microsoft.NET.Test.Sdk from 18.4.0 to 18.5.1 Bumps ModelContextProtocol from 1.2.0 to 1.3.0 Bumps SonarAnalyzer.CSharp from 10.23.0.137933 to 10.25.0.139117 --- updated-dependencies: - dependency-name: FluentAssertions dependency-version: 8.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Meziantou.Analyzer dependency-version: 3.0.84 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.EntityFrameworkCore dependency-version: 9.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.EntityFrameworkCore.Design dependency-version: 9.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.Extensions.Configuration dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.Extensions.Configuration.Binder dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.Extensions.Configuration.EnvironmentVariables dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.Extensions.Configuration.Json dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.ML.OnnxRuntime dependency-version: 1.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: ModelContextProtocol dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: SonarAnalyzer.CSharp dependency-version: 10.25.0.139117 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-05-13T16:58:54Z

Labels

The following labels could not be found: deps, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot Bot mentioned this pull request May 13, 2026

Bump Microsoft.EntityFrameworkCore from 9.0.15 to 10.0.8 #8

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump FluentAssertions and 11 others#9

Bump FluentAssertions and 11 others#9
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/minor-and-patch-497aa50d70

dependabot Bot commented on behalf of github May 13, 2026

Uh oh!

dependabot Bot commented on behalf of github May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 13, 2026

8.10.0

What's Changed

Improvements

Documentation

Others

3.0.84

What's Changed

3.0.83

What's Changed

3.0.82

What's Changed

3.0.81

What's Changed

3.0.80

3.0.79

What's Changed

3.0.78

What's Changed

3.0.77

What's Changed

3.0.76

What's Changed

3.0.75

What's Changed

3.0.74

What's Changed

3.0.73

What's Changed

3.0.72

What's Changed

3.0.71

What's Changed

3.0.70

What's Changed

3.0.69

What's Changed

3.0.68

What's Changed

3.0.67

What's Changed

3.0.66

What's Changed

3.0.65

What's Changed

3.0.64

What's Changed

3.0.63

What's Changed

3.0.62

What's Changed

3.0.61

What's Changed

3.0.60

What's Changed

3.0.59

What's Changed

3.0.58

What's Changed

3.0.57

What's Changed

3.0.56

What's Changed

3.0.55

What's Changed

3.0.54

What's Changed

3.0.53

What's Changed

3.0.52

What's Changed

3.0.51

What's Changed

9.0.16

What's Changed

9.0.16

What's Changed

1.26.0

ONNX Runtime Release 1.26.0