chore(deps): Bump the routine-updates group with 9 updates by dependabot[bot] · Pull Request #22 · rhamenator/ApplicationFoundry

ONNX Runtime 1.31.0 stabilizes model-package and EPContext data APIs, improves CPU model loading and quantized MoE inference, expands device-based execution-provider selection, and strengthens model-loading and runtime reliability. These notes cover changes since ONNX Runtime 1.30.0. CUDA and WebGPU kernel updates are summarized here; detailed provider notes are covered by their separate plugin EP releases.

Highlights

Promoted the model-package API and EPContext data callbacks to stable C and C++ APIs, with EPContext callback support added across language bindings (#33166, #32265).
Reduced CPU session-initialization overhead by parallelizing eligible weight prepacking, and accelerated block-wise INT4/INT8 QMoE experts with MLAS QNBit kernels and grouped expert dispatch (#31691, #32644, #32668).
Added x86 FP16 LayerNorm/RMSNorm acceleration, Arm KleidiAI SVE2.1 FP16 GEMM support, and additional RISC-V vector kernels (#32715, #32670, #32710).
Enabled CoreML participation in device-based EP selection, including Apple Neural Engine selection through PREFER_NPU (#31975).
Added workspace-memory accounting and verification for constrained-memory graph partitioning, alongside broader model, graph, and tensor validation (#31962, #32189).

Announcements & Compatibility

CUDA Plugin EP v0.3.0 and WebGPU Plugin EP v0.5.0 are matched with ONNX Runtime 1.31.0. For contrib-op compatibility, core and the plugin must use the same contributed-operator schemas; building both from the same ONNX Runtime revision is recommended. Schema mismatches can cause incorrect execution or crashes and may not be detected during plugin registration.
GatherBlockQuantized behavior change: out-of-range indices now produce zero output slices across CPU, CUDA, and WebGPU for both integer and floating-point quantized formats. This deliberately differs from ONNX Gather error semantics (#32480).
Experimental API migration: model-package consumers should use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table. EPContext callback registration now uses stable APIs; the corresponding experimental lookup entries were removed. The stable native callback contract carries callback/state pointers, with payload limits enforced by application callbacks, bindings, or EPs rather than a native read-options policy (#33166, #32265).
ACL EP is deprecated and will be removed in a future release. Source builds using --use_acl now receive a deprecation warning (#32564).
The ONNX dependency remains at 1.22.0. The initial ONNX 1.23 integration was reverted pending upstream fixes; this release does not ship that integration's new opset or FLOAT6 support (#33073).
Supported native builds now default to 1DS telemetry. Windows TraceLogging remains selectable with --use_windows_telemetry or onnxruntime_USE_WINDOWS_TELEMETRY=ON; telemetry can be disabled with --no_telemetry (#32384).

New Features

Core APIs & Runtime

Stabilized the model-package C and C++ APIs for loading packages, selecting compatible model variants, and creating sessions (#33166).
Stabilized named EPContext data read/write callbacks for application-managed storage. Added EP support negotiation so registered callbacks do not silently fall back to filesystem I/O (#32265).
Extended the Compile API to write external initializers and EP context data to buffers, enabling in-memory compilation workflows for models larger than 2 GB (#31347).
Added workspace-memory accounting, source reporting, and post-partition reservation verification. Set session.strict_workspace_verification=1 to fail initialization on workspace declaration overruns or nonzero orphaned reservations; strict verification is not supported for ORT-format model loads (#31962, #32189).
Added the opt-in source-build option onnxruntime_DISABLE_DEVICE_DISCOVERY=ON to skip platform accelerator probing and report only the CPU device (#32592).

Shared Contrib Operators

These updates affect core operator schemas and cross-provider behavior, not only the separately released GPU plugins.

Extended EngramGate and NGramHashMapping for Qwen4-Exp, and added VarlenNGramHashMapping for packed DeepSeek Engram batching with request-local history. Packed hashing also supports Qwen4-Exp head offsets, EOS resets, and segment boundaries (#32285, #32358, #32467).
Added the activation attribute to GatedRMSNorm for SiLU, its Swish alias, and Sigmoid gating across CPU, CUDA, and WebGPU. SiLU remains the default (#32512).
Added weightless hyper-connection operators BranchwiseRMSNorm, ScaledSiLU, HyperConnectionPreMix, and HyperConnectionPostMix, with CPU, CUDA, and WebGPU implementations (#32687).
Extended GatherBlockQuantized to FP8/FP4 data, full-axis blocks, and scale broadcasting, and improved CPU UINT8 dequantization. See the out-of-range-index behavior change above (#32480, #32621).

Plugin Execution Provider Infrastructure

Added support for statically linked plugin EPs, with a static WebGPU plugin build configuration (#32395).
Preserved caller streams in single-tensor plugin data transfers and handled null plugin allocator returns (#32666, #32683).
Deduplicated AutoEP custom-op domains and corrected EP assignment reporting after NHWC layout transformation (#32711, #33184).
Added reference guidance for compiled-model compatibility validation, including multi-device scenarios (#29168).

Execution Provider Updates

CUDA EP

CUDA updates include sparse attention and packed continuous batching, expanded paged speculative decoding, INT2 and mixed-width QMoE execution, opt-in MatMul auto-tuning, improved MXFP4 support on Blackwell consumer GPUs, and reliability fixes.
... (truncated)

1.30.0

ONNX Runtime 1.30.0 expands generative AI inference, improves CPU and GPU performance, adds Go bindings, and strengthens runtime reliability. These notes cover changes since ONNX Runtime 1.29.1.

Highlights

Expanded CUDA inference support with variable-length causal convolution for continuous batching, speculative decoding in paged XQA, and INT4 paged KV caches with per-channel scales (#32168, #32340, #32515).
Improved WebGPU PagedAttention, added GPT-OSS support and INT8 KV-cache block quantization, and extended convolution optimizations (#31727, #32277, #32284, #32420).
Added fused CPU LinearAttention kernels for AVX-512, Arm64 NEON, and SVE, plus AVX2 LayerNorm/RMSNorm acceleration (#31674, #31973, #32178, #32356).
Added Go bindings for the ONNX Runtime C API and DeepSeek Engram contrib operators (#29615, #32268).

Announcements & Compatibility

FP4 QMoE kernels are now enabled by default in CUDA builds, with Windows build support added in this release. Source builds can opt out with -Donnxruntime_USE_FP4_QMOE=OFF (#32096, #32163).
CUDA fpA-intB builds now default to a compact kernel set for FP16 activations, INT4/INT8 weights, scale-only quantization, and block_size=32. Set -Donnxruntime_USE_FPA_INTB_GEMM_FULL=ON when building from source to retain the full kernel set, including BF16, zero-point, bias, larger-block-size, and native Hopper variants (#32324).
CPU FP16 Gemm and MatMul execution is gated on hardware acceleration. CPU-assigned FP16 nodes without a matching kernel now fall back to FP32 (#32301, #32197).
WebGPU plugin EP packaging now supports Linux AArch64. Plugin versions were advanced to WebGPU 0.4.0 and CUDA 0.2 (#32287, #31960, #31970).

Security & Reliability

Model Loading, Memory, and Input Validation

Limited nested model-graph depth and canonicalized external-data locations to harden model loading (#32344, #32135).
Added checked rounding for BFC arena allocations and fixed prepacked-weight reference lifetimes (#32010, #32040).
Strengthened shape, rank, and parameter validation for Split, Scan, GatherND, ScatterND, SpaceToDepth/DepthToSpace, Crop, Conv, Normalizer, and pooling (#29461, #31668, #32034, #32039, #32076, #32157, #32160, #32161, #32345, #32349).
Hardened generation and attention input handling, including attention-attribute narrowing, BifurcationDetector inputs, generation subgraph shapes, and QEmbed segment inputs. BeamSearch buffer expansion now uses dynamic shape storage (#31648, #31701, #32009, #32078, #32144).
Validated TreeEnsemble node references and bounded subtree comparison, rejected non-finite CPU RoiAlign coordinates, and required ImageScaler bias to match the channel count (#32031, #32043, #32011, #32002).
Added an allowlist of safe LoRA adapter parameter data types, validated MatMulFpQ4 shape inputs, and checked MLAS blockwise quantization/dequantization index ranges (#31682, #32032, #32007).

GPU Bounds and Resource Lifetimes

Hardened CUDA indexing and buffer-size arithmetic in MatMulNBits, RemovePadding, RotaryEmbedding, SparseAttention, Whisper beam search, NMS, QDQ, and GatherElements (#31643, #31994, #31995, #31996, #31998, #32014, #32029, #32030).
Fixed overflow in CUDA reduction scans and Softmax offset arithmetic, and handled zero-sized outputs in CUDA random-generator kernels (#32137, #32330, #31997).
Fixed CUDA MultiHeadAttention shared-cache scratch lifetimes and kept CudaAsyncBuffer staging storage alive across CUDA graph replay (#31968, #32121).
Fixed WebGPU out-of-bounds subgroup-matrix loads for partial tiles, zero-initialized writable device-allocator buffers, and rejected foreign GPU handles in built-in data transfers (#32364, #32063, #32317).

Dependencies and Tooling

Upgraded Protobuf to 33.6 and refreshed Python documentation dependencies, including an ONNX security-related update (#29906, #32190, #32424).
Updated JavaScript dependencies including js-yaml, joi, fast-uri, and the Next.js end-to-end fixture (#32397, #32486, #32488, #32505, #32508).
Pinned GitHub Actions to full-length commit SHAs and strengthened packaging infrastructure with authenticated package feeds and NPM network isolation (#32176, #32005, #32440).

New Features

Core APIs & Runtime

Added Go bindings for the ONNX Runtime C API (#29615).
Extended memory importing with host-pointer support and added access to preallocated outputs through KernelContext::GetPreallocatedOutput (#29726, #32089).
Added packed-attention workspace recipes and estimates, and made workspace input-shape handling aware of optional inputs (#32283, #32321, #32312).
Added DeepSeek Engram contrib operators, EngramGate and NGramHashMapping, and expanded kernel coverage for Qwen-3.5 operators (#32268, #32106).

Plugin Execution Providers

... (truncated)

1.29.1

This is a patch release on top of v1.29.0, containing GroupQueryAttention capability and KV-cache layout improvements, plugin Execution Provider performance tooling updates, and targeted graph and optimizer fixes.

GroupQueryAttention

Added bidirectional GroupQueryAttention support on CPU and CUDA through a backward-compatible causal attribute, with explicit handling for unsupported execution paths (#31704)
Added a session option and Execution Provider metadata contract for using the BNHS Value KV-cache layout, with graph transformations that preserve compatibility with the existing BNSH operator schema (#32139)
Added CPU support for attention_bias with a sliding-window KV cache, including explicit position IDs and post-eviction bias indexing (#32302)

Runtime and Performance Tools

Fixed Compile API model serialization when output-model and custom initializer-location callbacks are used together, preventing duplicate graph fields in emitted models (#32303)
Updated onnxruntime_perf_test to use plugin Execution Provider device allocators for generated inputs, loaded test data, and pre-allocated outputs, avoiding unnecessary per-run host/device copies (#32244)

Bug Fixes and Documentation

Hardened FastGelu fusion to skip malformed Mul and Pow patterns (#32016)
Added validation for in-memory external initializer references, rejecting unregistered or mismatched data before graph transformation (#32042)
Restored the C API documentation workflow by switching the pinned Doxygen download to the official GitHub release asset (#32210)

Contributors

Thanks to our 7 contributors for this release!

@adrastogi, @apsonawane, @edgchen1, @javier-intel, @jnagi-intel, @tianleiwu, @Wayne-Ch

_{Release highlights were drafted with AI assistance and are subject to release-team review.}

Full Changelog: v1.29.0...v1.29.1

1.29.0 Announcements & Breaking Changes

onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

Added NVFP4 QMoE, including native FP4xFP4 prefill on SM120, faster decode GEMV, fused routing/finalization paths, and reduced activation and weight-dequantization overhead (#29697, #29824, #29887, #29919, #31156, #31159, #31349, #31479).
... (truncated)

1.28.3

This is a patch release on top of v1.28.2, containing memory-safety and model-validation fixes, a plugin execution fix, and packaging infrastructure updates.

Highlights

Bug Fixes

Fixed an out-of-bounds read in EmbedLayerNormalization shape inference when beta is a scalar (#32610).
Fixed a heap buffer overflow when reusing a packed sub-byte buffer for a full-byte tensor (#32611).
Fixed an out-of-bounds read when a Loop or Scan body input is also an initializer (#32609).
Hardened shape inference for applicable contrib operators, including GroupQueryAttention, SparseAttention, and CausalConvWithState (#32607).
Fixed out-of-bounds reads in ConvTransposeWithDynamicPads and InferenceContextImpl::getInputData (#32679, #32681).
Rejected invalid graph structures: inputs to a zero-input operator schema and subgraphs on non-control-flow nodes (#32633, #32641).
Preserved streams during single-tensor data transfers in the plugin EP (#32666).

Build and Test Reliability

Unblocked packaging with Linux image prerequisites and an authenticated ARM64 pip index, mirrored Dawn checkouts, authenticated Android pip and Gradle feeds, and authenticated NuGet feeds for mobile workloads (#31724, #29743, #32400, #32005).
Installed uuid-dev for the Linux minimal CoreML build and removed the Hugging Face download dependency from a quantization test (#32491, #32443).

Contributors

Thanks to our 10 contributors for this release!

@wangw-1991, @bbernhar, @shiyi9801, @tianleiwu, @adrastogi, @eserscor, @jiafatom, @miaobin, @sanaa-hamel-microsoft, @xiaofeihan1

Full Changelog: v1.28.2...v1.28.3

These release notes were drafted with assistance from GitHub Copilot.

1.28.2

This is a patch release on top of v1.28.1, containing a targeted fix for Compile API model serialization.

Highlights

Bug Fixes

Fixed Compile API callback serialization to prevent duplicate graph nodes, inputs, outputs, and value information in emitted optimized models, including models with embedded or external initializers (#32303)

Contributors

Thanks to our contributor for this release!

@adrastogi

Full Changelog: v1.28.1...v1.28.2

These release notes were drafted with assistance from GitHub Copilot.

1.28.1

This is a patch release on top of v1.28.0, containing support for device-free WebGPU compilation, improved compatibility with sandboxed Windows processes, and targeted graph-validation fixes.

WebGPU EP

Added support for device-free compile-only sessions, enabling offline graph transformation and optimized-model serialization without access to GPU hardware (#29681)

Bug Fixes

Prevented an access violation in Windows processes under Win32k lockdown by skipping DXGI device discovery (#29755)
Allowed zero-input EPContext nodes, aligning their schema with support for compiling zero-input models (#29799)
Hardened FastGelu fusion to skip malformed Mul and Pow patterns (#32016)
Added validation for in-memory external initializer references, rejecting unregistered or mismatched data before graph transformation (#32042)

Contributors

Thanks to our 4 contributors for this release!

@apsonawane, @shiyi9801, @adrastogi, @mingmingtasd

Full Changelog: v1.28.0...v1.28.1

Commits viewable in compare view.

Updated SQLitePCLRaw.lib.e_sqlite3 from 2.1.12 to 2.1.14.

Release notes

Sourced from SQLitePCLRaw.lib.e_sqlite3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated xunit.runner.visualstudio from 3.1.4 to 3.1.5.

Release notes

Sourced from xunit.runner.visualstudio's releases.

3.1.5

Release notes: https://xunit.net/releases/visualstudio/3.1.5

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore from 10.0.10 to 10.0.13 Bumps Microsoft.AspNetCore.Identity.EntityFrameworkCore from 10.0.10 to 10.0.13 Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.10 to 10.0.13 Bumps Microsoft.EntityFrameworkCore.Design from 10.0.10 to 10.0.13 Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.10 to 10.0.13 Bumps Microsoft.EntityFrameworkCore.Tools from 10.0.10 to 10.0.13 Bumps Microsoft.ML.OnnxRuntime from 1.28.0 to 1.31.0 Bumps SQLitePCLRaw.lib.e_sqlite3 from 2.1.12 to 2.1.14 Bumps xunit.runner.visualstudio from 3.1.4 to 3.1.5 --- updated-dependencies: - dependency-name: Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.AspNetCore.Identity.EntityFrameworkCore dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.AspNetCore.Mvc.Testing dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.EntityFrameworkCore.Design dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.EntityFrameworkCore.Sqlite dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.EntityFrameworkCore.Tools dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.ML.OnnxRuntime dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: routine-updates - dependency-name: SQLitePCLRaw.lib.e_sqlite3 dependency-version: 2.1.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: xunit.runner.visualstudio dependency-version: 3.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.AspNetCore.Identity.EntityFrameworkCore dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.EntityFrameworkCore.Design dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.EntityFrameworkCore.Sqlite dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.EntityFrameworkCore.Tools dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.ML.OnnxRuntime dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: routine-updates - dependency-name: SQLitePCLRaw.lib.e_sqlite3 dependency-version: 2.1.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.AspNetCore.Identity.EntityFrameworkCore dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.AspNetCore.Mvc.Testing dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.EntityFrameworkCore.Design dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.EntityFrameworkCore.Sqlite dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.EntityFrameworkCore.Tools dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: Microsoft.ML.OnnxRuntime dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: routine-updates - dependency-name: SQLitePCLRaw.lib.e_sqlite3 dependency-version: 2.1.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates - dependency-name: xunit.runner.visualstudio dependency-version: 3.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-updates ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-10-14T20:17:52Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	License
	microsoft.extensions.logging.abstractions@10.0.10 ⏵ 10.0.13
	microsoft.extensions.logging@10.0.10 ⏵ 10.0.13
	microsoft.extensions.dependencyinjection@10.0.10 ⏵ 10.0.13
	microsoft.extensions.dependencyinjection.abstractions@10.0.10 ⏵ 10.0.13
	microsoft.extensions.options@10.0.10 ⏵ 10.0.13
	microsoft.extensions.primitives@10.0.10 ⏵ 10.0.13
	microsoft.extensions.dependencymodel@10.0.10 ⏵ 10.0.13
	microsoft.ml.onnxruntime@1.28.0 ⏵ 1.31.0	^-30
	microsoft.ml.onnxruntime.managed@1.28.0 ⏵ 1.31.0	^-30
	microsoft.extensions.diagnostics@10.0.10 ⏵ 10.0.13
	microsoft.extensions.configuration@10.0.10 ⏵ 10.0.13
	microsoft.extensions.configuration.abstractions@10.0.10 ⏵ 10.0.13
	microsoft.extensions.diagnostics.abstractions@10.0.10 ⏵ 10.0.13
	microsoft.extensions.options.configurationextensions@10.0.10 ⏵ 10.0.13
	microsoft.extensions.configuration.binder@10.0.10 ⏵ 10.0.13
	microsoft.extensions.caching.abstractions@10.0.10 ⏵ 10.0.13
	microsoft.extensions.caching.memory@10.0.10 ⏵ 10.0.13
	microsoft.extensions.configuration.commandline@10.0.10 ⏵ 10.0.13
	microsoft.extensions.configuration.environmentvariables@10.0.10 ⏵ 10.0.13
	microsoft.extensions.configuration.fileextensions@10.0.10 ⏵ 10.0.13
	microsoft.extensions.configuration.json@10.0.10 ⏵ 10.0.13
	microsoft.extensions.configuration.usersecrets@10.0.10 ⏵ 10.0.13
	microsoft.extensions.fileproviders.abstractions@10.0.10 ⏵ 10.0.13
	microsoft.extensions.fileproviders.physical@10.0.10 ⏵ 10.0.13
	microsoft.extensions.filesystemglobbing@10.0.10 ⏵ 10.0.13
	microsoft.extensions.hosting@10.0.10 ⏵ 10.0.13
	microsoft.extensions.hosting.abstractions@10.0.10 ⏵ 10.0.13
	microsoft.extensions.logging.configuration@10.0.10 ⏵ 10.0.13
	microsoft.extensions.logging.console@10.0.10 ⏵ 10.0.13
	microsoft.extensions.logging.debug@10.0.10 ⏵ 10.0.13
	microsoft.extensions.logging.eventlog@10.0.10 ⏵ 10.0.13
See 25 more rows in the dashboard

View full report

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Oct 14, 2026

Navigation Menu

Repository navigation

chore(deps): Bump the routine-updates group with 9 updates - #22

chore(deps): Bump the routine-updates group with 9 updates#22
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/ApplicationFoundry/routine-updates-85f7cb6d95

dependabot Bot commented on behalf of github Oct 14, 2026

Uh oh!

socket-security Bot commented Oct 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026

1.31.0

Highlights

Announcements & Compatibility

New Features

Core APIs & Runtime

Shared Contrib Operators

Plugin Execution Provider Infrastructure

Execution Provider Updates

CUDA EP

1.30.0

Highlights

Announcements & Compatibility

Security & Reliability

Model Loading, Memory, and Input Validation

GPU Bounds and Resource Lifetimes

Dependencies and Tooling

New Features

Core APIs & Runtime

Plugin Execution Providers

1.29.1

GroupQueryAttention

Runtime and Performance Tools

Bug Fixes and Documentation

Contributors

1.29.0

Announcements & Breaking Changes

Security Fixes

Path, bounds, and input validation

Supply chain and tooling

New Features

Core APIs & Runtime

Execution Provider ABI & Plugin EPs

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

MoE and quantized GEMM

1.28.3

Highlights

Bug Fixes

Build and Test Reliability

Contributors

1.28.2

Highlights

Bug Fixes

Contributors

1.28.1

WebGPU EP

Bug Fixes

Contributors

3.1.5

Uh oh!

socket-security Bot commented Oct 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants