Bump the microsoft group with 4 updates

[dependabot]

Updated Microsoft.Extensions.Logging from 10.0.8 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Logging's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options from 10.0.8 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Options's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.ML.OnnxRuntime.Gpu from 1.26.0 to 1.28.0.

Release notes

Sourced from Microsoft.ML.OnnxRuntime.Gpu's releases.

1.28.0

Announcements & Breaking Changes

• Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
• cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
• An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
• Deprecated / removed:
  • SkipLayerNorm strict mode is deprecated (#​29388).
  • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
  • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
  • CUDA_QUANT_PREPROCESS is off by default (#​29687).
• NPM packages are now published from the CUDA 13 pipeline (#​28773).
• The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation

• Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
• Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
• Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
• Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
• Validated Col2Im inputs to prevent heap over-read (#​28706)
• Hardened CropAndResize against malformed crop_size tensors (#​28766)
• Validated BeamSearch vocab_size against logits width (#​28774)
• Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
• Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
• Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
• Clamped 1D attention mask_index to valid bounds (#​29449)
• Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
• Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
• Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
• Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
• Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
• Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
• Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
• Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
• Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)

Integer overflow & allocation size

• Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
• Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
• Hardened QMoE against integer overflow and partial K tiles (#​29067)
• Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
• Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
• Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
• Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)

Supply chain & tooling

... (truncated)

1.27.1

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

• [MLAS] Fixed an igemm regression in the KleidiAI path (#​28571)
• Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#​29081)
• Fixed a regression in graph-capture session initialization that rejected an empty graph (#​29457)
• Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#​29574)

Performance

NVIDIA CUDA EP

• Added a QMoE GEMV fast path for batch-1 decode (#​29038)

CI & Build Infrastructure

• Fixed an incorrect identity for azcopy (#​29274)
• Fixed a brew install applesimutils failure by trusting the wix/brew tap (#​29450)
• Upgraded to Xcode 26 (#​29468)
• Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#​29575)
• Fixed the web e2e (npm/vite) and Python DML CI pipelines (#​29609)

Contributors

Thanks to our 8 contributors for this release!

@​tianleiwu, @​chilo-ms, @​edgchen1, @​adrastogi, @​damdoo01-arm, @​JonathanC-ARM, @​martin-klacer-arm, @​sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1

1.27.0

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28.
n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

• CUDA 12 package files are now explicitly named as such.
• CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

---

Security Fixes

• Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#​28004)
• Hardened OneHot input validation and output-size computation (#​28014)
• Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#​28055)
• Bounded total output allocation size in Tile kernel (#​28070)
• Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#​28223)
• Fixed BitShift UB for shift amounts greater than or equal to bit width (#​28272)
• Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#​28277)
• Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#​28279)
• Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#​28386)
• Fixed out-of-bounds read in CropBase scale handling (#​28399)
• Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#​28400)
• Added sparse tensor external file path validation and additional external-path hardening (#​28408, #​28709, #​28725)
• Switched remaining torch.load() calls to weights_only=True (#​28421)
• Added CPU cache-indirection beam-index validation (#​28486)
• Added additional overflow/bounds checks and test coverage in runtime buffers (#​28713, #​28747)

---

New Features

Execution Provider Plugin API

• Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#​28037)
• Added OrtEp::OnSessionInitializationEnd() callback (#​28319)
• Added plugin EP session-options getters (#​28377)
• Added CUDA Plugin EP provider options for streams and external allocators (#​28603)

Core APIs & Runtime

• Added support for ONNX overloaded functions (IR v10+) (#​28275)
• Added FLOAT8E8M0 datatype support in ONNX Runtime (#​28381)
• Added CPU Cast support for FLOAT8E8M0 (#​28435)
• Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#​28282)

Quantization & Training Tooling

• Added calibration cache support to quantize_static (#​28221)
• Added ActivationRestrictedAsymmetric quantization option (#​28237)
  ... (truncated)

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.6.0 to 18.8.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.8.1

What's Changed

• Fix protocol negotiation timeout when STJ reflection is disabled (18.8.1) by @​nohwnd in Fix protocol negotiation timeout when STJ reflection is disabled (18.8.1) microsoft/vstest#16281

Full Changelog: microsoft/vstest@v18.8.0...v18.8.1

18.8.0

What's Changed

• Migrate from Newtonsoft.Json to System.Text.Json / Jsonite (merge to main) by @​nohwnd in feat: migrate from Newtonsoft.Json to System.Text.Json / Jsonite (merge to main) microsoft/vstest#15687
  • For more detail refer to https://devblogs.microsoft.com/dotnet/vs-test-is-removing-its-newtonsoft-json-dependency/
• Create source-only filter package by @​Youssef1313 in Create source-only filter package microsoft/vstest#15638
• Add ARM64 msdia140.dll support to test platform packages by @​nohwnd in Cherry-pick: Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15692
• Fix mutex cleanup crash on macOS/Linux by @​nohwnd in Fix mutex cleanup crash on macOS/Linux microsoft/vstest#15684
• Restrict artifact temp directory permissions on Unix by @​nohwnd in Restrict artifact temp directory permissions on Unix microsoft/vstest#15729
• Add support for filtering uncategorized tests with TestCategory=None by @​Evangelink in Add support for filtering uncategorized tests with TestCategory=None microsoft/vstest#15727
• Fix SCI binding failure in DTA hosts (main) by @​nohwnd in Fix SCI binding failure in DTA hosts (main) microsoft/vstest#15724
• Fix HTML logger parallel file collision by @​nohwnd in [fix] Fix HTML logger parallel file collision microsoft/vstest#15435
• Improve error message when testhost cannot be found by @​nohwnd in [fix] Improve error message when testhost cannot be found microsoft/vstest#16053
• Fix HTML logger exception on invalid XML chars in test display names by @​nohwnd in [fix] Fix HTML logger exception on invalid XML chars in test display names microsoft/vstest#16051

Full Changelog: microsoft/vstest@v18.7.0...v18.8.0

18.7.0

What's Changed

• Add ARM64 msdia140.dll support to test platform packages by @​jamesmcroft in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689
• Update System.Memory from 4.5.5 to 4.6.3 by @​nohwnd in Update System.Memory from 4.5.5 to 4.6.3 microsoft/vstest#15706

New Contributors

• @​jamesmcroft made their first contribution in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	microsoft.extensions.logging@​10.0.8 ⏵ 10.0.10
	microsoft.extensions.options@​10.0.8 ⏵ 10.0.10
	microsoft.ml.onnxruntime.gpu@​1.26.0 ⏵ 1.28.0
	microsoft.net.test.sdk@​18.6.0 ⏵ 18.8.1

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud