Skip to content

deps: Bump Microsoft.ML.OnnxRuntime from 1.26.0 to 1.27.0#1658

Merged
ooples merged 1 commit into
masterfrom
dependabot/nuget/Microsoft.ML.OnnxRuntime-1.27.0
Jun 22, 2026
Merged

deps: Bump Microsoft.ML.OnnxRuntime from 1.26.0 to 1.27.0#1658
ooples merged 1 commit into
masterfrom
dependabot/nuget/Microsoft.ML.OnnxRuntime-1.27.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Contributor

Updated Microsoft.ML.OnnxRuntime from 1.26.0 to 1.27.0.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.27.0

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28.
n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

  • CUDA 12 package files are now explicitly named as such.
  • CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

Security Fixes

  • Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#​28004)
  • Hardened OneHot input validation and output-size computation (#​28014)
  • Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#​28055)
  • Bounded total output allocation size in Tile kernel (#​28070)
  • Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#​28223)
  • Fixed BitShift UB for shift amounts greater than or equal to bit width (#​28272)
  • Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#​28277)
  • Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#​28279)
  • Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#​28386)
  • Fixed out-of-bounds read in CropBase scale handling (#​28399)
  • Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#​28400)
  • Added sparse tensor external file path validation and additional external-path hardening (#​28408, #​28709, #​28725)
  • Switched remaining torch.load() calls to weights_only=True (#​28421)
  • Added CPU cache-indirection beam-index validation (#​28486)
  • Added additional overflow/bounds checks and test coverage in runtime buffers (#​28713, #​28747)

New Features

Execution Provider Plugin API

  • Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#​28037)
  • Added OrtEp::OnSessionInitializationEnd() callback (#​28319)
  • Added plugin EP session-options getters (#​28377)
  • Added CUDA Plugin EP provider options for streams and external allocators (#​28603)

Core APIs & Runtime

  • Added support for ONNX overloaded functions (IR v10+) (#​28275)
  • Added FLOAT8E8M0 datatype support in ONNX Runtime (#​28381)
  • Added CPU Cast support for FLOAT8E8M0 (#​28435)
  • Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#​28282)

Quantization & Training Tooling

  • Added calibration cache support to quantize_static (#​28221)
  • Added ActivationRestrictedAsymmetric quantization option (#​28237)
    ... (truncated)

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: Microsoft.ML.OnnxRuntime
  dependency-version: 1.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 22, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: nuget. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot requested a review from ooples as a code owner June 22, 2026 09:15
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 22, 2026
@vercel

vercel Bot commented Jun 22, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
aidotnet_website Ready Ready Preview, Comment Jun 22, 2026 9:16am
aidotnet-playground-api Ready Ready Preview, Comment Jun 22, 2026 9:16am

@ooples ooples merged commit bc6aacf into master Jun 22, 2026
28 of 75 checks passed
@ooples ooples deleted the dependabot/nuget/Microsoft.ML.OnnxRuntime-1.27.0 branch June 22, 2026 11:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant