Integrate ONNX 1.23.0 base plumbing

[Justin Chu (justinchuby)]

Summary

• pin ONNX Runtime to ONNX c78026fa617f273fe5c685c74f9de3e6e96504ed (1.23.0, opset 28 development)
• raise the base, CoreML, NNAPI, VSINPU, and WebNN opset ceilings to 28
• add the mechanically required Float6 public element-type mappings and exhaustive conversion coverage
• materialize the removed ONNX node-test corpus at build time, with version and minimum-case tripwires in the materializer, C++ runner, and Python harness
• add opset-28 Mod and signed BitShift support, including coordinated CPU/CUDA Mod registration boundaries
• update provider compatibility, backend-test filters, and tolerances for the ONNX 1.23 test corpus

CI follow-up fixes

• correct the ONNX v1.23.0 vcpkg archive SHA512 to the mirrored artifact
• avoid installing ONNX under free-threaded CPython, where ONNX's stable-ABI development requirements are unavailable
• restore the backend-filter category required by both the Python and Node.js test harnesses
• exclude OpenVINO from opset-28 floating-point floor Mod and signed BitShift cases it does not currently support correctly
• update CUDA kernel registration for the opset-28 Mod version split

Scope

This stack establishes ONNX 1.23/opset-28 base plumbing and implements the Mod and signed BitShift changes needed by the updated schema. Other per-operator opset-28 registrations and kernel implementations remain follow-up work and should be coordinated across every registering EP. The materialized CPU runner keeps the existing Python ReduceMax empty-bool exclusion in parity.

Validation

• verified target archive hashes and onnx.patch / binskim.patch byte identity and application
• verified the corrected vcpkg artifact is available from the Microsoft mirror
• source-built exact onnx==1.23.0 wheel
• materialized 1,884 node cases; direct tensor/map/sequence/optional fixture serialization smoke test passed
• --minimal_build extended build passed
• regular full build passed
• onnx_test_node_materialized CTest passed: 1,762 CPU cases, 0 failures, with ALLOW_RELEASED_ONNX_OPSET_ONLY=0
• validated packaging-script shell syntax and the shared backend-filter JSON contract

[Copilot]

🟡 Changes recommended

Opset-28 dispatch can mis-handle valid models, and the iOS build and formatting paths contain concrete regressions.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates ONNX Runtime’s dependency and infrastructure for ONNX 1.23.0 and development opset 28.

Changes:

• Pins ONNX sources and CI dependencies to the 1.23 release line.
• Adds Float6 public type mappings and opset-28 ceilings.
• Materializes and validates the removed ONNX node-test corpus.

File summaries

File	Description
.github/workflows/linux_ci.yml	Updates materialization dependency documentation.
cmake/deps.txt	Pins the ONNX source archive.
cmake/external/onnx	Advances the ONNX submodule.
cmake/onnxruntime_unittests.cmake	Updates materialization version parsing and dependencies.
cmake/patches/onnx/onnx.patch	Rebases ONNX build and iOS patches.
cmake/vcpkg-ports/onnx/binskim.patch	Mirrors the rebased ONNX patch.
cmake/vcpkg-ports/onnx/fix-dependency-protobuf.patch	Rebases protobuf patch context.
cmake/vcpkg-ports/onnx/portfile.cmake	Updates vcpkg source reference and hash.
cmake/vcpkg-ports/onnx/vcpkg.json	Sets ONNX vcpkg version metadata.
include/onnxruntime/core/graph/schema_registry.h	Matches the updated ONNX registry signature.
include/onnxruntime/core/session/onnxruntime_c_api.h	Exposes Float6 element types.
js/web/docs/webgl-operators.md	Regenerates opset documentation.
onnxruntime/core/framework/onnxruntime_map_type_info.h	Extends element-type mapping validation.
onnxruntime/core/framework/tensor_type_and_shape.cc	Maps Float6 types to public enums.
onnxruntime/core/framework/tensorprotoutils.h	Adds Float6 logical element sizes.
onnxruntime/core/optimizer/embed_layer_norm_fusion.cc	Recognizes updated opset versions.
onnxruntime/core/optimizer/transpose_optimization/optimizer_api.h	Enables opset-28 optimization.
onnxruntime/core/providers/coreml/builders/impl/base_op_builder.h	Raises the CoreML ceiling.
onnxruntime/core/providers/nnapi/nnapi_builtin/builders/impl/base_op_builder.h	Raises the NNAPI ceiling.
onnxruntime/core/providers/vsinpu/builders/impl/base_op_builder.h	Raises the VSINPU ceiling.
onnxruntime/core/providers/webnn/builders/impl/base_op_builder.h	Raises the WebNN ceiling.
onnxruntime/test/framework/tensorutils_test.cc	Covers Float6 element sizes.
onnxruntime/test/framework/type_info_test.cc	Covers Float6 type conversion.
onnxruntime/test/onnx/TestCase.cc	Mirrors the ReduceMax exclusion.
onnxruntime/test/optimizer/layout_transformation_potentially_added_ops_test.cc	Temporarily exempts opset-28 Q/DQ.
onnxruntime/test/providers/cpu/controlflow/scan_test.cc	Updates expected ONNX diagnostics.
onnxruntime/test/python/onnx_node_test_equivalence_test.py	Reads commit-pin version metadata.
onnxruntime/test/python/requirements.txt	Pins the ONNX RC wheel.
onnxruntime/test/testdata/onnx_backend_test_series_filters.jsonc	Defers unsupported opset-28 cases.
onnxruntime/test/unittest_util/op_tester.cc	Adds a released ONNX import for custom-domain tests.
requirements-materialize-onnx-node-tests.txt	Updates the materializer ONNX pin.
tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/scripts/requirements.txt	Updates the AArch64 ONNX pin.
tools/ci_build/github/linux/docker/scripts/lort/requirements.txt	Updates the LORT ONNX pin.
tools/ci_build/github/linux/docker/scripts/manylinux/requirements.txt	Updates the manylinux ONNX pin.
tools/ci_build/github/linux/docker/scripts/requirements.txt	Updates the Linux image ONNX pin.
tools/ci_build/github/linux/python/requirements.txt	Updates the Linux CI ONNX pin.
tools/ci_build/github/windows/python/requirements.txt	Updates the Windows CI ONNX pin.
tools/python/materialize_onnx_node_tests.py	Enforces exact dataset arity.

Review details

Suppressed comments (1)

onnxruntime/test/testdata/onnx_backend_test_series_filters.jsonc:118

• These skips hide a runtime correctness regression: the existing CPU/CUDA Mod registration starting at opset 13 is open-ended, so it binds opset-28 nodes, but its floating implementation rejects fmod=0, which opset 28 now defines as floor-mod. Version-cap the legacy registrations at 27 or include the opset-28 implementation before enabling this schema; otherwise valid models throw during execution.

        // TODO(#32369): Remove these exact skips when the opset-28 Mod kernels land.
        "^test_mod_broadcast(_(cpu|cuda))?$",
        "^test_mod_float16_mixed_sign_fmod_0(_(cpu|cuda))?$",
        "^test_mod_float32_mixed_sign_fmod_0(_(cpu|cuda))?$",
        "^test_mod_float64_mixed_sign_fmod_0(_(cpu|cuda))?$",

• Files reviewed: 38/38 changed files
• Comments generated: 6
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The source/wheel mismatch, incomplete Float6 conversion, and missing Cast-28 matcher updates can cause test drift, incorrect API type reporting, and optimizer regressions.

Review details

Suppressed comments (3)

Previously missed (3) — in code that hasn't changed since the last review.

cmake/deps.txt:39

• The source and wheel pins are not actually in lockstep. The pinned c78026f source includes the newer LRN node-test generator ([1,5,5,5] input), while the 1.23.0rc1 release branch still generates [5,5,5,5]; the release-base-only checks accept both as 1.23.0. As a result, CI materializes and runs a corpus from different ONNX code than ORT compiles, and the post-#7959 tree has no disk oracle to catch that drift. Pin a wheel built from the exact source revision (or pin the source to rc1) and enforce revision/exact-version parity.
  onnxruntime/core/framework/tensor_type_and_shape.cc:195
• These cases update only one Proto-to-C-API conversion path. utils::CApiElementTypeFromProtoType still falls through to UNDEFINED for both Float6 values (tensorprotoutils.cc:2023-2059), and that helper feeds custom-op shape inference at custom_ops.cc:86. Thus a custom shape-inference callback sees UNDEFINED instead of either newly public enum. Add both cases there (and in its standalone test-runner counterpart) with coverage.
  onnxruntime/core/optimizer/embed_layer_norm_fusion.cc:250
• Cast now has schema version 28, but this is the only fusion matcher updated. Other Cast-sensitive optimizers still stop at 25—for example layer_norm_fusion.cc:148, fast_gelu_fusion.cc:178, isinf_reducesum_fusion.cc:48, and pad_fusion.cc:135—so equivalent opset-28 graphs silently lose those fusions. Audit all Cast version lists and extend the compatible matchers/tests together.

• Files reviewed: 45/45 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[G. Ramalingam (gramalingam)]

[Medium] Restrict the BitShift version cap to the internal DirectML kernel

File: onnxruntime/core/providers/dml/DmlExecutionProvider/src/AbiCustomRegistry.cpp:394-398

The new BitShift special case matches only the operator name and minimum
opset version. AbiCustomRegistry is also used by the public WinML custom
operator registration path, which accepts CPU kernels and arbitrary domains.
As a result, a custom kernel named BitShift with
minimumOperatorSetVersion == 11 is silently capped at opset 27 even when it
is not the built-in DirectML ONNX kernel.

For a custom-domain BitShift whose schema advances to version 28, an
opset-28 model will fail kernel resolution. For an ONNX-domain CPU override,
ORT may execute its built-in CPU kernel instead of the registered custom
kernel.

Restrict the cap to the internal DirectML registration, such as by checking
the ONNX domain together with MLOperatorExecutionType::D3D12 and/or
isInternalOperator, rather than matching only the operator name and minimum
version.

The added BitShift tests exercise ORT's built-in CPU implementation.
Existing DML tests exclude out-of-range shifts, and no test registers a CPU
or custom-domain BitShift through IMLOperatorRegistry.