deps(nuget): Bump the nuget-all group with 12 updates

[dependabot]

Updated coverlet.msbuild from 8.0.0 to 10.0.1.

Release notes

Sourced from coverlet.msbuild's releases.

10.0.1

Improvements

• Coverlet with MTP 2 doesn't show test coverage statistic in console #​1907
• Avoid unnecessary testhost restarts #​1912 by https://github.com/mawosoft

Fixed

• Fix inconsistent paths in cobertura reports #​1723
• Fix when using "is" with "and" in pattern matching, branch coverage is lower than normal #​1313
• Fix Coverlet flagging a branch for an async functions finally block where none exists #​1337
• Fix Coverlet Tracker Missing CompilerGeneratedAttribute #​1828

Maintenance

• Add architecture docs and diagrams for all integrations #​1927
• Update NuGet packages and .NET SDK versions #​1933

Diff between 10.0.0 and 10.0.1

10.0.0

Improvements

• Unique Report Filenames (coverlet.MTP and AzDO) #​1866
• Add --coverlet-file-prefix option for unique report files #​1869
• Introduce .NET 10 support #​1823

Fixed

• Fix [BUG] Wrong branch rate on IAsyncEnumerable for generic type #​1836
• Fix [BUG] Missing Coverage after moving to MTP #​1843
• Fix [BUG] No coverage reported when targeting .NET Framework with 8.0.1 #​1842
• Fix [BUG] Behavior changes between MTP and Legacy (msbuild) #​1878
• Fix [BUG] Coverlet.MTP - Unable to load coverlet.mtp.appsettings.json #​1880
• Fix [BUG] Coverlet.Collector produces empty report when Mediator.SourceGenerator is referenced #​1718 by https://github.com/yusyd
• Fix [BUG] Crash during instrumentation (Methods using LibraryImport/DllImport have no body) #​1762

Maintenance

• Add comprehensive async method tests and documentation for issue #​1864
• Replace Tmds.ExecFunction Package in coverlet.core.coverage.tests #​1833
• Add net9.0 and net10.0 targets #​1822

Diff between 8.0.1 and 10.0.0

8.0.1

Fixed

• Fix [BUG] TypeInitializationException when targeting .NET Framework #​1818
• Fix [BUG] coverlet.MTP build fails with CS0400 due to developmentDependency=true #​1827

Improvements

• Additional improvements needed for .NET Framework instrumentation type import #​1825

Diff between 8.0.0 and 8.0.1

Commits viewable in compare view.

Updated Markdig from 0.44.0 to 1.3.2.

Release notes

Sourced from Markdig's releases.

1.3.2

Changes

🐛 Bug Fixes

• Fix emoji table alignment regression (#​943) (fc705234)

Full Changelog: 1.3.1...1.3.2

_{Published with dotnet-releaser}

1.3.1

Changes

🐛 Bug Fixes

• Fix LinkHelper non-ASCII urilize (#​942) (50061841)
• Fix plus superscript parsing (#​791) (25506f20)

Full Changelog: 1.3.0...1.3.1

_{Published with dotnet-releaser}

1.3.0

Changes

🐛 Bug Fixes

• Fix CJK emphasis after HTML entity newlines (#​941) (fcbf8170)
• Fix pipe table cells with unmatched subscript (#​932) (0f98267a)
• Fix roundtrip autolink URLs (#​919) (b8364135)
• Fix configurable nesting depth limit (#​892) (d7f13b03)
• Fix NormalizeRenderer auto identifiers output (#​930) (9dffce52)
• Fix blockquote ordered list parsing (#​887) (bc4e3990)

📚 Documentation

• add InferColumnWidthsFromSeparator docs (PR #​939) by @​SimonCropp

🧰 Misc

• Update readme with Alert extension details (PR #​940) by @​AndrewTriesToCode
• Update AGENTS.md (5dca4149)

Full Changelog: 1.2.0...1.3.0

_{Published with dotnet-releaser}

1.2.0

Changes

🚀 Enhancements

• Add opt-in support for nested alert blocks (PR #​938) by @​kapsiR

🧰 Misc

• Remove old changelog.md (be4da8b4)

Full Changelog: 1.1.3...1.2.0

_{Published with dotnet-releaser}

1.1.3

Changes

🐛 Bug Fixes

• Fix AbbreviationExtension corrupting emphasis/bold/italic resolution (#​935) (PR #​936) by @​Kryptos-FR

🚀 Enhancements

• Attribute with StringSyntax (PR #​937) by @​SimonCropp

Full Changelog: 1.1.2...1.1.3

_{Published with dotnet-releaser}

1.1.2

Changes

🐛 Bug Fixes

• Fix to calculate LinkReferenceDefinition span positions from StringLineGroup.Lines (PR #​931) by @​prozolic

Full Changelog: 1.1.1...1.1.2

_{Published with dotnet-releaser}

1.1.1

Changes

🐛 Bug Fixes

• Fix emoji not rendering in table cells (PR #​928) by @​prozolic

Full Changelog: 1.1.0...1.1.1

_{Published with dotnet-releaser}

1.1.0

Changes

🚀 Enhancements

• Add CJK-friendly Emphasis Extension (PR #​921) by @​tats-u

🧰 Misc

• docs(site): document CJK friendly emphasis extension (bddaa55d)

Full Changelog: 1.0.1...1.1.0

_{Published with dotnet-releaser}

1.0.1

Changes

✨ New Features

• Add mermaid and katex (682a30c1)
• Add missing markdown example (3167f8ef)

🧰 Maintenance

• Fix ci (361231dc)

🧰 Misc

• Update readme (391e03b8)
• Reject pipe-only rows as pipe table separators (Fixes #​927) (7959e3b9)

Full Changelog: 1.0.0...1.0.1

_{Published with dotnet-releaser}

1.0.0

Changes

✨ New Features

• Add namespace API docs for Markdig (5de7e42a)

🚀 Enhancements

• Remove obsolete APIs (PR #​926) by @​MihaZupan
• Markdig 1.0 (PR #​925)

🧰 Misc

• Update banner (b370c5cc)
• Improve site documentation accuracy and structure (f735314a)

Full Changelog: 1.0.0-preview.1...1.0.0

_{Published with dotnet-releaser}

1.0.0-preview.1

Changes

✨ New Features

• Add instructions (3f7c09c4)
• Add api authoring 1.0 (1a96adde)
• Add parser authoring helper APIs and tests (ab6204cf)
• Add AST mutation helpers for block and inline trees (2c9a9a30)
• Add typed markdown object data key helpers (58e8217d)
• Add span validation/update APIs and tests (148fd08b)
• Add XML docs for public Markdig API (0cc463b6)
• Add DotSettings (020a8490)
• Add comprehensive documentation site (74f429c4)
• Add GitHub action for site (94cb00d1)
• Add playground to frontpage (d1ce1886)

🐛 Bug Fixes

• Fix top level readme about documentation (999ccbc7)

🧰 Misc

• Move from net9.0 to net10.0 (e5c88eff)
• Update deps NuGet (e9d582a1)
• Expose parser parity APIs for extension authors (5e5112cc)
• Document parser authoring contracts and migration risks (c488a274)
• Move doc to site (310f084c)

Full Changelog: 0.45.0...1.0.0-preview.1

_{Published with dotnet-releaser}

0.45.0

Changes

🚀 Enhancements

• Recognize supplementary characters (PR #​913) by @​tats-u
• Use Dictionary.TryAdd instead of ContainsKey and indexer by reducing lookups. (PR #​917) by @​prozolic
• Replace null checks with IsEmpty property for ReadOnlySpan (PR #​916) by @​prozolic
• Optimize PipeTable parsing: O(n²) → O(n) for 3.7x–85x speedup, enables 10K+ row tables (PR #​922) by @​Mpdreamz

Full Changelog: 0.44.0...0.45.0

_{Published with dotnet-releaser}

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.NetAnalyzers from 10.0.102 to 10.0.301.

Release notes

Sourced from Microsoft.CodeAnalysis.NetAnalyzers's releases.

10.0.301

You can build .NET 10.0 from the repository by cloning the release tag v10.0.301 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.300

You can build .NET 10.0 from the repository by cloning the release tag v10.0.300 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.204

You can build .NET 10.0 from the repository by cloning the release tag v10.0.204 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.203

You can build .NET 10.0 from the repository by cloning the release tag v10.0.203 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.202

You can build .NET 10.0 from the repository by cloning the release tag v10.0.202 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.201

You can build .NET 10.0 from the repository by cloning the release tag v10.0.201 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.200

You can build .NET 10.0 from the repository by cloning the release tag v10.0.200 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.109

You can build .NET 10.0 from the repository by cloning the release tag v10.0.109 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.108

You can build .NET 10.0 from the repository by cloning the release tag v10.0.108 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.107

You can build .NET 10.0 from the repository by cloning the release tag v10.0.107 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.106

You can build .NET 10.0 from the repository by cloning the release tag v10.0.106 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.105

You can build .NET 10.0 from the repository by cloning the release tag v10.0.105 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.104

You can build .NET 10.0 from the repository by cloning the release tag v10.0.104 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.103

You can build .NET 10.0 from the repository by cloning the release tag v10.0.103 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached is the PGP signature for the GitHub generated tarball. You can find the public key at https://dot.net/release-key-2023

Commits viewable in compare view.

Updated Microsoft.Data.Sqlite from 10.0.2 to 10.0.9.

Release notes

Sourced from Microsoft.Data.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting from 10.0.2 to 10.0.9.

Release notes

Sourced from Microsoft.Extensions.Hosting's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.ML.OnnxRuntime from 1.23.2 to 1.27.0.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.27.0

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28.
n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

• CUDA 12 package files are now explicitly named as such.
• CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

---

Security Fixes

• Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#​28004)
• Hardened OneHot input validation and output-size computation (#​28014)
• Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#​28055)
• Bounded total output allocation size in Tile kernel (#​28070)
• Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#​28223)
• Fixed BitShift UB for shift amounts greater than or equal to bit width (#​28272)
• Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#​28277)
• Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#​28279)
• Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#​28386)
• Fixed out-of-bounds read in CropBase scale handling (#​28399)
• Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#​28400)
• Added sparse tensor external file path validation and additional external-path hardening (#​28408, #​28709, #​28725)
• Switched remaining torch.load() calls to weights_only=True (#​28421)
• Added CPU cache-indirection beam-index validation (#​28486)
• Added additional overflow/bounds checks and test coverage in runtime buffers (#​28713, #​28747)

---

New Features

Execution Provider Plugin API

• Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#​28037)
• Added OrtEp::OnSessionInitializationEnd() callback (#​28319)
• Added plugin EP session-options getters (#​28377)
• Added CUDA Plugin EP provider options for streams and external allocators (#​28603)

Core APIs & Runtime

• Added support for ONNX overloaded functions (IR v10+) (#​28275)
• Added FLOAT8E8M0 datatype support in ONNX Runtime (#​28381)
• Added CPU Cast support for FLOAT8E8M0 (#​28435)
• Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#​28282)

Quantization & Training Tooling

• Added calibration cache support to quantize_static (#​28221)
• Added ActivationRestrictedAsymmetric quantization option (#​28237)
  ... (truncated)

1.26.0

n.b. The following was generated via LLM from Git history. Only the contributor list has been verified.

ONNX Runtime Release 1.26.0

Announcement - Breaking Changes

• Support for CUDA 12 will be removed in 1.27.0.
  • CUDA 13 will continue to be published as onnxruntime-<os>-<arch>-gpu_cuda13-<version>.<ext>
• CUDA runtime will be moving soon to a dedicated Execution Provider (EP) instead of a published package from ORT core.

Highlights

• Added optional memory mapping for .ort model loads (#​28164).
• Added RISC-V Vector (RVV) support for CPU EP (#​28261).
• OpenVINO EP upgraded for 1.26.0 development release (#​28297).
• WebGPU gained GridSample support (#​28264) and Split-K improvements (#​28151).
• CUDA plugin EP gained graph support (#​28002), profiling API (#​28216).

Security and Reliability Hardening

• Replaced unrestricted Python setattr configuration with an allowlist (#​28083).
• Hardened multiple OOB and overflow scenarios across ML and core ops:
  • Attention mask index OOB write (#​27789).
  • MaxPoolGrad indices bounds validation (#​27903).
  • SVM and TreeEnsemble bounds/security fixes (#​27950, #​27951, #​27952, #​27989).
  • RNN sequence_lens OOB read and integer overflow handling (#​28052, #​28003).
  • GroupQueryAttention seqlens_k bounds validation and compatibility follow-up (#​28031, #​28259).
  • MatMulBnb4 and ML coefficient SafeInt checks (#​27995, #​28001).
  • CUDA Gather int32 overflow fix (#​28108).
  • GridSample float->int64 cast hardening for NaN/Inf/out-of-range coords (#​28302).
• Fixed session logger use-after-free during EP teardown under verbose logging (#​28274).

CUDA, Attention, and MLAS

• Filled CUDA opset/operator gaps and extended support:
  • Transpose opset 23 -> 25 (#​27740).
  • QuantizeLinear/DequantizeLinear opset 25 (#​28046).
  • CUDA TopK INT8/INT16/UINT8 support (#​27862).
  • LabelEncoder CUDA support for numeric types (#​28045).
• Attention/GQA improvements:
  • Fixed ONNX Attention min-bias alignment crash on SM<80 and masked-batch NaN behavior (#​27831).
  • Added FP32 QK accumulation path for unfused GQA attention (#​28198).
  • Added CUDART_VERSION reduction compatibility in GQA attention (#​28296).
  • Fixed CUDA 13 build error in GQA unfused attention (#​28309).
  • PagedAttention fallback for SM<80 fp16 (#​28200).
• MLAS updates:
  • FP16 Gelu enablement (#​26815).
  • Arm64 BF16 fast-math conv kernels for NCHW/NCHWc paths (#​27878).

WebGPU, WebNN, and JavaScript

... (truncated)

1.25.1

n.b. This changelog is LLM generated. Only the contributor listing has been verified.

ONNX Runtime Release 1.25.1

📢 Announcements & Breaking Changes

ONNX Op Updates

• Enhanced ONNX operator support with new opset versions: Reshape (opset 25), Transpose (opset 24) (#​27752)

---

✨ New Features

📊 New ONNX Ops & Model Support

• LinearAttention and CausalConvState operators for Qwen3.5 model support (#​27907)
• RotaryEmbedding (RotEMB) and RMSNorm operators added (#​27752)
• Linear Attention signature support (#​27842)

---

🌐 Web & JavaScript

WebGPU EP

• Qwen3.5 model support on WebGPU execution provider (#​27996)
• QMoE 1-token decode path optimization — fused operations to reduce GPU dispatches for improved performance (#​27998)

---

🐛 Bug Fixes

Core Runtime Fixes

• Improved filesystem error messages during Linux device discovery for better debugging experience (#​27289)
• Fixed missing include for SetRawDataInTensorProto in NVIDIA TensorRT RTX tests (#​28065)

---

🙏 Contributors

Thanks to our 7 contributors for this release:
@​guschmue, @​sanaa-hamel-microsoft, @​apsonawane, @​eserscor, @​ishwar-raut1, @​qjia7, @​theHamsta

Full Changelog: microsoft/onnxruntime@v1.25.0...v1.25.1

1.25.0

📢 Announcements & Breaking Changes

Build & Platform

• C++20 is now required to build ONNX Runtime from source. Minimum toolchains: MSVC 19.29+, GCC 10+, Clang 10+. Users of prebuilt packages are unaffected. (#​27178)
• CUDA minimum version raised to 12.0 — CUDA 11.x is no longer supported. Users pinned to CUDA 11.x should stay on ORT 1.24.x or upgrade their CUDA toolkit/driver. (#​27570)
• ONNX upgraded to 1.21.0 (#​27601)
• sympy is now an optional dependency for Python builds. (#​27200)

Execution Provider Changes

• ArmNN EP has been removed. Users should remove any --use_armnn build flags and migrate to the MLAS/KleidiAI-backed CPU EP or QNN EP for Qualcomm hardware. (#​27447)

API Version

• ORT_API_VERSION updated to 25. (#​27280)

---

🔒 Security Fixes

• Fixed potential integer truncation leading to heap out-of-bounds read/write (#​27544)
• Addressed Pad Reflect vulnerability (#​27652)
• Security fix for transpose optimizer (#​27555)
• Upgraded minimatch 3.1.2 → 3.1.4 for CVE-2026-27904 (#​27667)
• Hardened shell command handling for constant strings (#​27840)
• Added validation of onnx::TensorProto data size before allocation (#​27547)
• Cleaned up external data path validation (#​27539)
• Fixed misaligned address reads for tensor attributes from raw data buffers (#​27312)
• Fixed CPU Attention overflow issue (#​27822)
• Fixed CPU LRN integer overflow issues (#​27886)
• Additional input validation hardening:
  • Tile kernel dim overflow (#​27566)
  • Out-of-bounds read in cross entropy (#​27568)
  • TreeEnsembleClassifier attributes (#​27571)
  • AffineGrid (#​27572)
  • EmbedLayerNorm position_ids (#​27573)
  • RotaryEmbedding position_ids (#​27597)
  • RoiAlign batch_indices (#​27603)
  • MaxUnpool indices (#​27432)
  • QMoECPU swiglu OOB (#​27748)
  • SVMClassifier initializer (#​27699)
  • Col2Im SafeInt (#​27625)

---

✨ New Features

🔌 Execution Provider Plugin API & CUDA Plugin EP

... (truncated)

1.24.4

This is a patch release for ONNX Runtime 1.24, containing bug fixes and execution provider updates.

Bug Fixes

• Core: Added PCI bus fallback for Linux GPU device discovery in containerized environments (e.g., AKS/Kubernetes) where nvidia-drm is not loaded but GPU PCI devices are still exposed via sysfs. (#​27591)
• Plugin EP: Fixed null pointer dereference when iterating output spans in GetOutputIndex. (#​27644)
• Plugin EP: Fixed bug that incorrectly assigned duplicate MetaDef IDs to fused nodes in different GraphViews (e.g., then/else branches of an If node), causing session creation to fail with a conflicting kernel error. (#​27666)

Execution Provider Updates

• QNN EP: Enabled offline x64 compilation with memhandle IO type by deferring rpcmem library loading to inference time. (#​27479)
• QNN EP: Reverted QNN SDK logging verbosity changes that caused segmentation faults on backend destruction. (#​27650)

Build and Infrastructure

• Python: Updated python_requires from >=3.10 to >=3.11 to reflect dropped Python 3.10 support. (#​27354)
• Build: Replaced __builtin_ia32_tpause with the compiler-portable _tpause intrinsic to fix cross-compiler portability issues between GCC and LLVM. (#​27607)

Full Changelog: v1.24.3...v1.24.4

Contributors

@​derdeljan-msft, @​adrianlizarraga, @​apwojcik, @​baijumeswani, @​edgchen1, @​mocknen, @​tianleiwu, @​XXXXRT666

1.24.3

This is a patch release for ONNX Runtime 1.24, containing bug fixes, security improvements, performance enhancements, and execution provider updates.

Security Fixes

• Core: Fixed GatherCopyData integer truncation leading to heap out-of-bounds read/write. (#​27444)
• Core: Fixed RoiAlign heap out-of-bounds read via unchecked batch_indices. (#​27543)
• Core: Prevent heap OOB from maliciously crafted Lora Adapters. (#​27518)
• Core: Fixed out-of-bounds access for Resize operation. (#​27419)

Bug Fixes

• Core: Fixed GatherND division by zero when batch dimensions mismatch. (#​27090)
• Core: Fixed validation for external data paths for models loaded from bytes. (#​27430)
• Core: Fixed SkipLayerNorm fusion incorrectly applied when gamma/beta are not 1D. (#​27459)
• Core: Fixed double-free in TRT EP custom op domain Release functions. (#​27471)
• Core: Fixed QMoE CPU Operator. (#​27360)
• Core: Fixed MatmulNBits prepacking scales. (#​27412)
• Python: Fixed refcount bug in map input conversion that caused shutdown segfault. (#​27413)
• NuGet: Fixed DllImportResolver. (#​27397)
• NuGet: Added OrtEnv.DisableDllImportResolver to prevent fatal error on resolver conflict. (#​27535)

Performance Improvements

• Core: QMoE CPU performance update (up to 4x on 4-bit). (#​27364)
• Core: Fixed O(n²) model load time for TreeEnsemble with categorical feature chains. (#​27391)

Execution Provider Updates

• NvTensorRtRtx EP:
  • Avoid repetitive creation of fp4/fp8 native-custom-op domains. (#​27192)
  • Added missing override specifiers to suppress warnings. (#​27288)
  • DQ→MatMulNBits fusion transformer. (#​27466)
• WebGPU:
  • Used embedded WASM module in Blob URL workers when wasmBinary is provided. (#​27318)
  • Fixed usage of wasmBinary together with a blob URL for .mjs. (#​27411)
  • Removed the unhelpful "Unknown CPU vendor" warning. (#​27399)
  • Allows new memory info name for WebGPU. (#​27475)
• MLAS:
  • Added DynamicQGemm function pointers and ukernel interface. (#​27403)
  • Fixed error where bytes is not assigned for dynamic qgemm pack b size. (#​27421)
• VitisAI EP: Removed s_kernel_registry_vitisaiep.reset() in deinitialize_vitisai_ep(). (#​27295)
• Plugin EPs: Added "library_path" metadata entry to OrtEpDevice instances for plugin and provider bridge EPs. (#​27522)

Build and Infrastructure

• Pipelines:
  • Build Windows ARM64X binaries as part of packaging pipeline. (#​27316)
  • Moved JAR testing pipelines to canonical pipeline template. (#​27480)
• Python: Enabled Python 3.14 CI and upgraded dependencies. (#​27401)
• Build: Suppressed spurious Array Out of Bounds warnings produced by GCC 14.2 compiler on Linux builds. (#​27454)
• Build: Fixed -Warray-bounds build error in MLAS on clang 17+. (#​27499)
• Telemetry: Added/Updated telemetry events. (#​27356)
• Config: Increased kMaxValueLength to 8192. (#​27521)

... (truncated)

1.24.2

This is a patch release for ONNX Runtime 1.24, containing several bug fixes, security improvements, and execution provider updates.

Bug Fixes

• NuGet: Fixed native library loading issues in the ONNX Runtime NuGet package on Linux and macOS. (#​27266)
• macOS: Fixed Java support and Jar testing on macOS ARM64. (#​27271)
• Core: Enable Robust Symlink Support for External Data for Huggingface Hub Cache. (#​27374)
• Core: Added boundary checks for SparseTensorProtoToDenseTensorProto to improve robustness. (#​27323)
• Security: Fixed an out-of-bounds read vulnerability in ArrayFeatureExtractor. (#​27275)

Execution Provider Updates

• MLAS: Fixed flakiness and accuracy issues in Lut GEMM (MatMulNBitsLutGemm). (#​27216)
• QNN: Enabled 64-bit UDMA mode for HTP target v81 or above. (#​26677)
• WebGPU:
  • Used LazyRelease for prepack allocator. (#​27077)
  • Fixed ConvTranspose bias validation in both TypeScript and C++ implementations. (#​27213)
• OpenVINO (OVEP): Patch to reduce resident memory by reusing weight files across shared contexts. (#​27238)
• DNNL: Fixed DNNL build error by including missing files. (#​27334)

Build and Infrastructure

• CUDA:
  • Added support for CUDA architecture family codes (suffix 'f') introduced in CUDA 12.9. (#​27278)
  • Fixed build errors and warnings for various CUDA versions (12.8, 13.0, 13.1.1). (#​27276)
  • Applied patches for Abseil CUDA warnings. (#​27096, #​27126)
• Pipelines:
  • Fixed Python packaging pipeline for Windows ARM64 and release. (#​27339, #​27350, #​27299)
  • Fixed DirectML NuGet pipeline to correctly bundle x64 and ARM64 binaries for release. (#​27349)
  • Updated Microsoft.ML.OnnxRuntime.Foundry package for Windows ARM64 support and NuGet signing. (#​27294)
• Testing: Updated BaseTester to support plugin EPs with both compiled nodes and registered kernels. (#​27176)
• Telemetry: Added service name and framework name to telemetry events for better usage understanding on Windows. (#​27252, #​27256)

Full Changelog: v1.24.1...v1.24.2

Contributors

@​tianleiwu, @​hariharans29, @​edgchen1, @​xiaofeihan1, @​adrianlizarraga, @​angelser, @​angelserMS, @​ankitm3k, @​baijumeswani, @​bmehta001, @​ericcraw, @​eserscor, @​fs-eire, @​guschmue, @​mc-nv, @​qjia7, @​qti-monumeen, @​titaiwangms, @​yuslepukhin

1.24.1

📢 Announcements & Breaking Changes

Platform Support Changes

• Python 3.10 wheels are no longer published — Please upgrade to Python 3.11+
• Python 3.14 support added
• Free-threaded Python (PEP 703) — Added support for Python 3.13t and 3.14t in Linux (#​26786)
• x86_64 binaries for macOS/iOS are no longer provided and minimum macOS is raised to 14.0

API Version

• ORT_API_VERSION updated to 24 (#​26418)

---

✨ New Features

🤖 Execution Provider (EP) Plugin API

A major infrastructure enhancement enabling plugin-based EPs with dynamic loading:

• Initial kernel-based EP support (#​26206)
• Weight pre-packing support for plugin EPs (#​26754)
• EP Context model support (#​25124)
• Control flow kernel APIs (#​26927)
• OrtKernelInfo APIs for kernel-based plugin EPs (#​26803)

🔧 Core APIs

• OrtApi::CreateEnvWithOptions() and OrtEpApi::GetEnvConfigEntries() (#​26971)
• EP Device Compatibility APIs (#​26922)
• External Resource Importer API for D3D12 shared resources (#​26828)
• Session config access from KernelInfo (#​26589)

📊 Dependencies & Integration

• ONNX upgraded to 1.20.1 (#​26579)
• Protobuf updated from 3.20.3 → 4.25.8 (#​26910)
• CUDA Graph enabled by default (#​26929)

---

🖥️ Execution Provider Updates

NVIDIA

• CUDA EP: Flash Attention updates, GQA kernel fusion, BF16 support for MoE/qMoE/MatMulNBits, CUDA 13.0 support
• TensorRT EP: Upgraded to TensorRT 10.14, automatic plugin loading, NVFP4 custom ops
• TensorRT RTX EP: RTX runtime caching, CUDA graph support, BFloat16, memory-mapped engines

Qualcomm QNN EP

• QNN SDK upgraded to 2.42.0 with new ops (RMSNorm, ScatterElements, GatherND, STFT, RandomUniformLike)
• Gelu pattern fusion, LPBQ quantization support, ARM64 wheel builds, v81 device support

Intel & AMD

• OpenVINO EP: Upgraded to 2025.4.1
• VitisAI EP: External EP loader, compiled model compatibility API
  ... (truncated)

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.0.1 to 18.7.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.7.0

What's Changed

• Add ARM64 msdia140.dll support to test platform packages by @​jamesmcroft in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689
• Update System.Memory from 4.5.5 to 4.6.3 by @​nohwnd in Update System.Memory from 4.5.5 to 4.6.3 microsoft/vstest#15706

New Contributors

• @​jamesmcroft made their first contribution in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

18.6.0

What's Changed

• Revert removal of Video Recorder by @​nohwnd in Revert removal of Video Recorder microsoft/vstest#15336
• Speed up blame by filtering non-.NET processes from dump collection by @​nohwnd in Speed up blame tests by filtering non-.NET processes from dump collection microsoft/vstest#15518
• Add README.md to NuGet packages by @​nohwnd in Add README.md to NuGet packages microsoft/vstest#15550
• Report child process info on connection timeout by @​nohwnd in Report child process info on connection timeout microsoft/vstest#15603

Changes to tests and infra

• Brand as 18.6 by @​nohwnd in Brand as 18.6 microsoft/vstest#15423
• Upgrading code coverage version to 18.5.1, by @​fhnaseer in Upgrading code coverage version to 18.5.1, microsoft/vstest#15422
• Updating System.Collections.Immutable to 9.0.11 by @​MSLukeWest in Updating System.Collections.Immutable to 9.0.11 microsoft/vstest#15425
• Fix attachVS when used for debugging integration tests by @​nohwnd in Fix attachVS when used for debugging integration tests microsoft/vstest#15451
• Replace dotnet.config, with global.json by @​nohwnd in Replace dotnet.config, with global.json microsoft/vstest#15449
• Document debugging integration tests with AttachVS by @​Copilot in Document debugging integration tests with AttachVS microsoft/vstest#15452
• Fix stack overflow tests by @​nohwnd in Fix stack overflow tests microsoft/vstest#15461
• Make TestAssets.sln buildable locally by @​Youssef1313 in Make TestAssets.sln buildable locally microsoft/vstest#15466
• Try filtering out tests by @​nohwnd in Try filtering out tests microsoft/vstest#15463
• Build just once when tfms run in parallel by @​nohwnd in Build just once when tfms run in parallel microsoft/vstest#15465
• Review simplify compatibility sources, deduplicate tests by @​nohwnd in Review simplify compatibility sources, deduplicate tests microsoft/vstest#15472
• Cleanup dead TRX code by @​Youssef1313 in Cleanup dead TRX code microsoft/vstest#15474
• Update .NET runtimes to 8.0.25, 9.0.14, and 10.0.4 by @​nohwnd in Update .NET runtimes to 8.0.25, 9.0.14, and 10.0.4 microsoft/vstest#15481
• Compat matrix checker by @​nohwnd in Compat matrix checker microsoft/vstest#15480
• Add trx analysis skill by @​nohwnd in Add trx analysis skill microsoft/vstest#15486
• Split integration tests to single tfm and multi tfm project by @​nohwnd in Split integration tests to single tfm and multi tfm project microsoft/vstest#15484
• Update matrix by @​nohwnd in Update matrix microsoft/vstest#15477
• Break infinite restore loop in VS by @​nohwnd in Break infinite restore loop in VS microsoft/vstest#15503
• Use global package cache for build, and local for running integration tests by @​nohwnd in Use global package cache for build, and local for running integration tests microsoft/vstest#15500
• Update contributing by @​nohwnd in Update contributing microsoft/vstest#15505
• Reduce test wall-clock time by increasing minThreads by @​drognanar in Reduce test wall-clock time by increasing minThreads microsoft/vstest#15502
• Indicator flakiness by @​nohwnd in Indicator flakiness microsoft/vstest#15513
• Fix ci build by @​nohwnd in Fix ci build microsoft/vstest#15515
• Fix thread safety issues by @​Evangelink in Fix thread safety issues microsoft/vstest#15512
• Optimize DotnetSDKSimulation_PostProcessing test (163s → 61s) by @​nohwnd in Optimize DotnetSDKSimulation_PostProcessing test (163s → 61s) microsoft/vstest#15516
• Build isolated test assets for single TFM instead of 7 by @​nohwnd in Build isolated test assets for single TFM instead of 7 microsoft/vstest#15517
• Remove unused dependencies from Library.IntegrationTests by @​nohwnd in Remove unused dependencies from Library.IntegrationTests microsoft/vstest#15527
• Remove printing _attachments content to console by @​nohwnd in Remove printing _attachments content to console microsoft/vstest#15520
• Add Linux/macOS test filtering guide to CONTRIBUTING.md by @​nohwnd in Add Linux/macOS test filtering guide to CONTRIBUTING.md microsoft/vstest#15521
• Change integration test parallelization from ClassLevel to MethodLevel by @​nohwnd in Change integration test parallelization from ClassLevel to MethodLevel microsoft/vstest#15526
• Unify target framework checks with IsNetFrameworkTarget/IsNetTarget by @​nohwnd in Unify target framework checks with IsNetFrameworkTarget/IsNetTarget microsoft/vstest#15523
• Add unattended work instructions to copilot-instructions.md by @​nohwnd in Add unattended work instructions to copilot-instructions.md microsoft/vstest#15531
• Reduce code style rule severity from warning to suggestion by @​nohwnd in Reduce code style rule severity from warning to suggestion microsoft/vstest#15522
• Remove Debug/Release line number branching from tests by @​nohwnd in Remove Debug/Release line number branching from tests microsoft/vstest#15519
• Revise unattended work instructions in copilot-instructions.md by @​nohwnd in Revise unattended work instructions in copilot-instructions.md microsoft/vstest#15532
• Improve CompatibilityRowsBuilder error message with diagnostic details by @​nohwnd in Improve CompatibilityRowsBuilder error message with diagnostic details microsoft/vstest#15529
• docs: add git worktree and upstream sync workflow to copilot-instructions.md by @​nohwnd in docs: add git worktree and upstream sync workflow to copilot-instructions.md microsoft/vstest#15538
• Add VSIX runner to smoke tests by @​nohwnd in Add VSIX runner to smoke tests microsoft/vstest#15541
• Remove deprecated WebTest and TMI test methods by @​nohwnd in Remove deprecated WebTest and TMI test methods microsoft/vstest#15525
• Fix compatibility test failures for legacy vstest.console and MSTest adapter by @​nohwnd in Fix compatibility test failures for legacy vstest.console and MSTest adapter microsoft/vstest#15534
• Convert TestPlatform.sln to slnx format by @​nohwnd in Convert TestPlatform.sln to slnx format microsoft/vstest#15551
• Convert test/TestAssets .sln files to .slnx format by @​nohwnd in Convert test/TestAssets .sln files to .slnx format microsoft/vstest#15557
  ... (truncated)

18.5.1

What's Changed

• Fix System.Collections.Immutable binding mismatch in Common.dll (rel/18.5) by @​nohwnd in Fix System.Collections.Immutable binding mismatch in Common.dll (rel/18.5) microsoft/vstest#15720
• Port verify-binding-redirects.ps1 to rel/18.5 by @​nohwnd in Port verify-binding-redirects.ps1 to rel/18.5 microsoft/vstest#15719
• Bump to 18.5.1 by @​nohwnd in Bump to 18.5.1 microsoft/vstest#15721

Full Changelog: microsoft/vstest@v18.5.0...v18.5.1

18.5.0

⚠️ Unlisted on Nuget, because of #​15718

What's Changed

• Add runtime configs by @​nohwnd in Add runtime configs microsoft/vstest#15377
• Add net8.0 target for TranslationLayer by @​nohwnd in Add net8.0 target for TranslationLayer microsoft/vstest#15375
• Determine architecture of remote process on windows by @​nohwnd in Determine architecture of remote process on windows microsoft/vstest#15396
• Updating System.Collections.Immutable package reference to version 9.0.0 by @​MSLukeWest in Updating System.Collections.Immutable package reference to version 9.0.0 microsoft/vstest#15392
• Dump via netcore tool on windows by @​nohwnd in Dump via netcore tool on windows microsoft/vstest#15397
• Fix answer file splitting by @​nohwnd in Fix answer file splitting microsoft/vstest#15381
• Run tests against vsix runner by @​nohwnd in Run tests against vsix runner microsoft/vstest#15419

Full Changelog: microsoft/vstest@v18.4.0...v18.5.0

18.4.0

What's Changed

• Add LoongArch64 support by @​stdmnpkg in Add LoongArch64 support microsoft/vstest#15359

• Refactor Condition evaluation by @​Youssef1313 in Refactor Condition evaluation microsoft/vstest#15357

• Adding info on extensions points part 1 by @​nohwnd in Adding info on extensions points part 1 microsoft/vstest#15360

• Add option to ask for uploading code QL before the standard window ends by @​nohwnd in Add option to ask for uploading code QL before the standard window ends microsoft/vstest#15373

• Update runtime versions by @​nohwnd in Update runtime versions microsoft/vstest#15372

• Fix .NET 10 regression for traits by @​Youssef1313 in Fix .NET 10 regression for traits microsoft/vstest#15370

• Update target frameworks to net10.0 and net11.0 by @​dotnet-maestro[bot] in Update target frameworks to net10.0 and net11.0 microsoft/vstest#15349

• Fix names in pipeline matrix so we don't have to align them by @​nohwnd in Fix names in pipeline matrix so we don't have to align them microsoft/vstest#15365

• Update SECURITY.md by @​Youssef1313 in Update SECURITY.md microsoft/vstest#15342

New Contributors

• @​stdmnpkg made their first contribution in Add LoongArch64 support microsoft/vstest#15359

Full Changelog: microsoft/vstest@v18.3.0...v18.4.0

18.3.0

What's Changed

• Fix answer file splitting by @​nohwnd in Fix answer file splitting microsoft/vstest#15306

Internal fixes and updates

• Bump branding to 18.1 by @​nohwnd in Bump branding to 18.1 microsoft/vstest#15286
• Remove stale copy of S.ComponentModel.Composition from testplatform packages by @​ViktorHofer in Remove stale copy of S.ComponentModel.Composition from testplatform packages microsoft/vstest#15287
• Update codeflow metadata to fix backflow by @​premun in Update codeflow metadata to fix backflow microsoft/vstest#15291
• [main] Update dependencies from devdiv/DevDiv/vs-code-coverage by @​dotnet-maestro[bot] in [main] Update dependencies from devdiv/DevDiv/vs-code-coverage microsoft/vstest#15283
• Update Microsoft.Build.Utilities.Core by @​Youssef1313 in Update Microsoft.Build.Utilities.Core microsoft/vstest#15300
• Disable DynamicNative instrumentation by default by @​nohwnd in Disable DynamicNative instrumentation by default microsoft/vstest#15299
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in [main] Source code updates from dotnet/dotnet microsoft/vstest#15293
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in [main] Source code updates from dotnet/dotnet microsoft/vstest#15302
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in [main] Source code updates from dotnet/dotnet microsoft/vstest#15314
• Delete sha1 custom implementation we are not using for a long time by @​nohwnd in Delete sha1 custom implementation we are not using for a long time microsoft/vstest#15313
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in [main] Source code updates from dotnet/dotnet microsoft/vstest#15315
• Update branding to 18.3.0 by @​nohwnd in Update branding to 18.3.0 microsoft/vstest#15321
• [main] Update dependencies from devdiv/DevDiv/vs-code-coverage by @​dotnet-maestro[bot] in [main] Update dependencies from devdiv/DevDiv/vs-code-coverage microsoft/vstest#15325
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [main] Update dependencies from dotnet/arcade microsoft/vstest#15264
• Revert adding dotnet_host_path workaround by @​nohwnd in Revert adding dotnet_host_path workaround microsoft/vstest#15328
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [main] Update dependencies from dotnet/arcade microsoft/vstest#15338
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in [main] Source code updates from dotnet/dotnet microsoft/vstest#15322
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [main] Update dependencies from dotnet/arcade microsoft/vstest#15343
• Change PreReleaseVersionLabel from 'preview' to 'release' by @​nohwnd in Change PreReleaseVersionLabel from 'preview' to 'release' microsoft/vstest#15352
• [rel/18.3] Update dependencies from devdiv/DevDiv/vs-code-coverage by @​dotnet-maestro[bot] in [rel/18.3] Update dependencies from devdiv/DevDiv/vs-code-coverage microsoft/vstest#15354
• [rel/18.3] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [rel/18.3] Update dependencies from dotnet/arcade microsoft/vstest#15389
• [rel/18.3] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [rel/18.3] Update dependencies from dotnet/arcade microsoft/vstest#15400
• Update build tools to 17.11.48 to be source buildable by @​nohwnd in Update build tools to 17.11.48 to be source buildable microsoft/vstest#15310
• Disable publishing on RTM by @​nohwnd in Disable publishing on RTM microsoft/vstest#15296
• Don't access nuget.org for package feeds by @​nohwnd in Don't access nuget.org for package feeds microsoft/vstest#15316
• No nuget access fix tests by @​nohwnd in No nuget access fix tests microsoft/vstest#15317
• Disable Dependabot updates in dependabot.yml by @​mmitche in Disable Dependabot updates in dependabot.yml microsoft/vstest#15324

New Contributors

• @​premun made their first contribution in Update codeflow metadata to fix backflow microsoft/vstest#15291

Commits viewable in compare view.

Updated ModelContextProtocol from 0.8.0-preview.1 to 1.4.0.

Release notes

Sourced from ModelContextProtocol's releases.

1.4.0

v1.4.0 introduces support for the Identity Assertion Authorization Grant (ID-JAG) flow via the new IdentityAssertionGrantProvider, enabling enterprise SSO scenarios where users authenticate once via their enterprise Identity Provider and access MCP servers without per-server authorization prompts. The release also adds a new InheritEnvironmentVariables option on StdioClientTransportOptions for controlling the child server's environment, alongside two security hardening fixes: the stdio client transport no longer enumerates child-process environment variables in Trace logs, and DELETE on a Streamable HTTP session now requires the same authenticated user that initiated the session.

What's Changed

• Stop logging stdio transport environment variables #​1538 by @​halter73 (co-authored by @​Copilot)
• Add InheritEnvironmentVariables to StdioClientTransportOptions #​1563 by @​halter73 (co-authored by @​Copilot)
• Validate user on Streamable HTTP session DELETE #​1604 by @​halter73 (co-authored by @​Copilot)
  • HandleDeleteRequestAsync now mirrors the HasSameUserId check already enforced on GET and POST. A DELETE with a valid Mcp-Session-Id but a different authenticated user now returns 403 Forbidden instead of terminating the session — defense-in-depth against a leaked session ID being used to DoS the original owner.
• Add Enterprise Managed Authorization (SEP-990) support #​1305 by @​aniket-okta (backported in #​1625)
  • Adds IdentityAssertionGrantProvider and supporting option/response types in ModelContextProtocol.Authentication implementing the Identity Assertion Authorization Grant flow: RFC 8693 token exchange at the enterprise IdP (ID Token → JWT Authorization Grant) followed by RFC 7523 JWT bearer grant at the MCP authorization server (JAG → access token). See the new Cross-Application Access section in the transport docs for full usage details.

Documentation Updates

• Fix broken links to MCP Tasks specification #​1594 by @​tarekgh

Repository Infrastructure Updates

• Update release processes to support release servicing branches #​1620 by @​jeffhandley (co-authored by @​Copilot)

Acknowledgements

• @​aniket-okta made their first contribution in #​1305
• @​felixweinberger submitted issue #​949 (resolved by #​1305)
• @​eiriktsarpalis @​ericstj @​PranavSenthilnathan reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v1.3.0...v1.4.0

1.3.0

v1.3.0 focuses on improved transport diagnostics and security-focused documentation. The new public ClientTransportClosedException gives stdio and HTTP clients structured access to transport closure details (exit codes, process IDs, stderr tails, HTTP status codes) without parsing exception messages. Two reliability fixes harden the stdio process pipeline (preventing host crashes from user StandardErrorLines callbacks) and correct the stateless HTTP transport's capability advertisement. New conceptual documentation covers role/identity propagation in tool execution, allowed-hosts and CORS guidance for HTTP servers, and aligns the docs information architecture with the MCP specification structure.

What's Changed

• Make ClientTransportClosedException public and unify transport exception handling #​1467 by @​stephentoub (co-authored by @​halter73 @​Copilot)
  • As part of this unification, SSE/HTTP client connection failures from McpClient.CreateAsync(...) now surface as IOException (the new ClientTransportClosedException derives from IOException) rather than InvalidOperationException. Caller-triggered OperationCanceledException is also no longer wrapped, matching standard async cancellation semantics.
• Fix process crash when testing Stderr #​1449 by @​ericstj (co-authored by @​Copilot)
• Fix stateless HTTP transport advertising listChanged capability #​1509 by @​jayaraman-venkatesan

Documentation Updates

• docs: align docs IA with MCP specification structure #​1481 by @​jeffhandley (co-authored by @​mikekistler @​Copilot)
• Document recommended pattern for role/identity propagation in MCP tool execution #​1497 by @​jeffhandley (co-authored by @​halter73 @​mikekistler @​Copilot)
• Document and demonstrate allowed hosts and CORS policy guidance #​1554 by @​jeffhandley (co-authored by @​halter73 @​mikekistler @​Copilot)

Test Improvements

• Fix flaky OutgoingFilter_MultipleFilters_ExecuteInOrder test #​1488 by @​ericstj (co-authored by @​Copilot)

Repository Infrastructure Updates

• Bump the opentelemetry-testing group with 5 updates #​1478
• Bump actions/deploy-pages from 4.0.5 to 5.0.0 #​1477
• Bump action...

_Description has been trunca...

Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.