Skip to content

deps(nuget): Bump the dotnet-minor-and-patch group with 7 updates - #10

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/core/DotnetNativeInterop.EdgeIndexPublisher/dotnet-minor-and-patch-65922870e5
Open

deps(nuget): Bump the dotnet-minor-and-patch group with 7 updates#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/core/DotnetNativeInterop.EdgeIndexPublisher/dotnet-minor-and-patch-65922870e5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown

Updated Microsoft.Data.Sqlite from 10.0.0 to 10.0.10.

Release notes

Sourced from Microsoft.Data.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.AI.Abstractions from 10.7.0 to 10.8.3.

Release notes

Sourced from Microsoft.Extensions.AI.Abstractions's releases.

10.8.3

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.3
Microsoft.Extensions.AI.Abstractions 10.8.3
Microsoft.Extensions.AI.OpenAI 10.8.3

Experimental API Changes

Experimental API behavior updates

  • Updated serialization behavior for experimental ToolApprovalRequestContent.RequiresConfirmation so it no longer leaks into consumer source-generated AIContent JSON metadata unless approval APIs are intentionally used (#​7659).

What's Changed

AI abstractions and serialization

  • Fixed MEAI001 leakage from RequiresConfirmation in source-generated AIContent contexts by using an internal JSON-included backing member while keeping the public experimental member ignored for source-generation metadata (#​7659).

Test Improvements

  • Added stabilization regression coverage to verify consumer source-generated List<AIContent> contexts compile and round-trip without requiring MEAI001 suppression (#​7659).

Full Changelog

10.8.2

This servicing release updates Microsoft.Extensions.VectorData.ConformanceTests to 10.8.2 and includes targeted test framework migration fixes.

Packages in this release

Package Version
Microsoft.Extensions.VectorData.ConformanceTests 10.8.2

What's Changed

AI

  • Move Microsoft.Extensions.VectorData.ConformanceTests to xUnit 3 #​7636 by @​adamsitnik (co-authored by @​Copilot)

Acknowledgements

  • @​roji reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.1...v10.8.2

10.8.1

This servicing release updates the Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI packages to 10.8.1 with two targeted fixes: correct tool-call/tool-result ordering when resuming approval-gated functions with service-managed chat history, and preservation of the OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning.

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.1
Microsoft.Extensions.AI.Abstractions 10.8.1
Microsoft.Extensions.AI.OpenAI 10.8.1

What's Changed

AI

  • Fix FICC tool_calls/tool ordering with approvals and service-managed chat history #​7617 by @​westey-m
  • Roundtrip OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning #​7629 by @​rogerbarreto (co-authored by @​tarekgh)

Acknowledgements

  • @​jozkee reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.0...v10.8.1

10.8.0

This release adds new experimental APIs to Microsoft.Extensions.AI.Abstractions and updates the OpenAI dependency to 2.12.0, alongside documentation, test, and repository maintenance.

Experimental API Changes

New Experimental APIs

  • New experimental API: AIFunctionNameAttribute and AIParameterNameAttribute #​7610 by @​jozkee (co-authored by @​jeffhandley @​Copilot)
  • New experimental API: ToolApprovalRequestContent.RequiresConfirmation (MEAI001) #​7549 by @​javiercn (co-authored by @​Copilot)

What's Changed

AI

  • Upgrade OpenAI dependency to 2.12.0 #​7608 by @​jozkee (co-authored by @​Copilot)
  • Auto-detect audio format in OpenAISpeechToTextClient #​7575 by @​jozkee (co-authored by @​Copilot)
  • Fix ImageGeneratingChatClient duplicating preceding content and dropping following content #​7624 by @​jozkee (co-authored by @​Copilot)

Vector Data

  • Make all test methods virtual in VectorData.ConformanceTests #​7606 by @​adamsitnik (co-authored by @​Copilot)

Documentation Updates

  • Remove links to ai-samples repo #​7574 by @​gewarren
  • Fix up docs with Copilot (MEVD) #​7597 by @​gewarren
  • Fix up docs with Copilot (M.E.ServiceDiscovery) #​7598 by @​gewarren (co-authored by @​Copilot)
  • Fix up docs with Copilot (MEAI) #​7600 by @​gewarren
  • Fix up docs with Copilot #​7601 by @​gewarren

Test Improvements

  • Fix flaky StampedeTests and harden related test waits #​7572 by @​jeffhandley (co-authored by @​Copilot)
  • Fix SQLitePCLRaw.lib.e_sqlite3 vulnerability by replacing SemanticKernel connectors with CommunityToolkit #​7579 by @​adamsitnik (co-authored by @​Copilot)
  • Removing SemanticKernel Connectors dependency and replacing it #​7584 by @​adamsitnik (co-authored by @​Copilot)
  • Migrate to xUnit v3 #​7607 by @​adamsitnik (co-authored by @​shyamnamboodiripad @​Copilot)

Repository Infrastructure Updates

  • Update OTel GenAI conventions skill for standalone semconv-genai repo #​7519 by @​jeffhandley (co-authored by @​Copilot)
  • Bump dotnet-coverage from 18.7.0 to 18.8.0 #​7552
  • [main] Update dependencies from dotnet/arcade #​7559
  • Fix transitive MessagePack vulnerability in AI template AppHost projects #​7561 by @​adamsitnik (co-authored by @​Copilot)
  • Bump esbuild, @​vitejs/plugin-react and vite in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7564
  • Bump tmp from 0.2.6 to 0.2.7 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7569
  • Bump js-yaml from 4.1.1 to 4.2.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7570
  • Bump PowerShell from 7.6.2 to 7.6.3 #​7576
  • Remove duplicate 'WebAPI' classification from template #​7577 by @​danroth27
  • [main] Update dependencies from dotnet/arcade #​7590
  • Eliminate redundant Correctness CI stage by merging into Build #​7594 by @​adamsitnik (co-authored by @​Copilot)
  • Update Agent Framework to 1.13.0 #​7613 by @​jeffhandley (co-authored by @​Copilot)
    ... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.0 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.ML.OnnxRuntime from 1.20.1 to 1.28.0.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#​29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
    • CUDA_QUANT_PREPROCESS is off by default (#​29687).
  • NPM packages are now published from the CUDA 13 pipeline (#​28773).
  • The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation

  • Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
  • Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
  • Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
  • Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
  • Validated Col2Im inputs to prevent heap over-read (#​28706)
  • Hardened CropAndResize against malformed crop_size tensors (#​28766)
  • Validated BeamSearch vocab_size against logits width (#​28774)
  • Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
  • Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
  • Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
  • Clamped 1D attention mask_index to valid bounds (#​29449)
  • Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
  • Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
  • Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
  • Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
  • Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
  • Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
  • Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
  • Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
  • Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)

Integer overflow & allocation size

  • Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
  • Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
  • Hardened QMoE against integer overflow and partial K tiles (#​29067)
  • Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
  • Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
  • Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
  • Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)

Supply chain & tooling

... (truncated)

1.27.1

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

  • [MLAS] Fixed an igemm regression in the KleidiAI path (#​28571)
  • Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#​29081)
  • Fixed a regression in graph-capture session initialization that rejected an empty graph (#​29457)
  • Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#​29574)

Performance

NVIDIA CUDA EP

  • Added a QMoE GEMV fast path for batch-1 decode (#​29038)

CI & Build Infrastructure

  • Fixed an incorrect identity for azcopy (#​29274)
  • Fixed a brew install applesimutils failure by trusting the wix/brew tap (#​29450)
  • Upgraded to Xcode 26 (#​29468)
  • Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#​29575)
  • Fixed the web e2e (npm/vite) and Python DML CI pipelines (#​29609)

Contributors

Thanks to our 8 contributors for this release!

@​tianleiwu, @​chilo-ms, @​edgchen1, @​adrastogi, @​damdoo01-arm, @​JonathanC-ARM, @​martin-klacer-arm, @​sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1

1.27.0

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28.
n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

  • CUDA 12 package files are now explicitly named as such.
  • CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

Security Fixes

  • Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#​28004)
  • Hardened OneHot input validation and output-size computation (#​28014)
  • Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#​28055)
  • Bounded total output allocation size in Tile kernel (#​28070)
  • Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#​28223)
  • Fixed BitShift UB for shift amounts greater than or equal to bit width (#​28272)
  • Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#​28277)
  • Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#​28279)
  • Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#​28386)
  • Fixed out-of-bounds read in CropBase scale handling (#​28399)
  • Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#​28400)
  • Added sparse tensor external file path validation and additional external-path hardening (#​28408, #​28709, #​28725)
  • Switched remaining torch.load() calls to weights_only=True (#​28421)
  • Added CPU cache-indirection beam-index validation (#​28486)
  • Added additional overflow/bounds checks and test coverage in runtime buffers (#​28713, #​28747)

New Features

Execution Provider Plugin API

  • Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#​28037)
  • Added OrtEp::OnSessionInitializationEnd() callback (#​28319)
  • Added plugin EP session-options getters (#​28377)
  • Added CUDA Plugin EP provider options for streams and external allocators (#​28603)

Core APIs & Runtime

  • Added support for ONNX overloaded functions (IR v10+) (#​28275)
  • Added FLOAT8E8M0 datatype support in ONNX Runtime (#​28381)
  • Added CPU Cast support for FLOAT8E8M0 (#​28435)
  • Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#​28282)

Quantization & Training Tooling

  • Added calibration cache support to quantize_static (#​28221)
  • Added ActivationRestrictedAsymmetric quantization option (#​28237)
    ... (truncated)

1.26.0

n.b. The following was generated via LLM from Git history. Only the contributor list has been verified.

ONNX Runtime Release 1.26.0

Announcement - Breaking Changes

  • Support for CUDA 12 will be removed in 1.27.0.
    • CUDA 13 will continue to be published as onnxruntime-<os>-<arch>-gpu_cuda13-<version>.<ext>
  • CUDA runtime will be moving soon to a dedicated Execution Provider (EP) instead of a published package from ORT core.

Highlights

  • Added optional memory mapping for .ort model loads (#​28164).
  • Added RISC-V Vector (RVV) support for CPU EP (#​28261).
  • OpenVINO EP upgraded for 1.26.0 development release (#​28297).
  • WebGPU gained GridSample support (#​28264) and Split-K improvements (#​28151).
  • CUDA plugin EP gained graph support (#​28002), profiling API (#​28216).

Security and Reliability Hardening

  • Replaced unrestricted Python setattr configuration with an allowlist (#​28083).
  • Hardened multiple OOB and overflow scenarios across ML and core ops:
  • Fixed session logger use-after-free during EP teardown under verbose logging (#​28274).

CUDA, Attention, and MLAS

  • Filled CUDA opset/operator gaps and extended support:
    • Transpose opset 23 -> 25 (#​27740).
    • QuantizeLinear/DequantizeLinear opset 25 (#​28046).
    • CUDA TopK INT8/INT16/UINT8 support (#​27862).
    • LabelEncoder CUDA support for numeric types (#​28045).
  • Attention/GQA improvements:
    • Fixed ONNX Attention min-bias alignment crash on SM<80 and masked-batch NaN behavior (#​27831).
    • Added FP32 QK accumulation path for unfused GQA attention (#​28198).
    • Added CUDART_VERSION reduction compatibility in GQA attention (#​28296).
    • Fixed CUDA 13 build error in GQA unfused attention (#​28309).
    • PagedAttention fallback for SM<80 fp16 (#​28200).
  • MLAS updates:
    • FP16 Gelu enablement (#​26815).
    • Arm64 BF16 fast-math conv kernels for NCHW/NCHWc paths (#​27878).

WebGPU, WebNN, and JavaScript

... (truncated)

1.25.1

n.b. This changelog is LLM generated. Only the contributor listing has been verified.

ONNX Runtime Release 1.25.1

📢 Announcements & Breaking Changes

ONNX Op Updates

  • Enhanced ONNX operator support with new opset versions: Reshape (opset 25), Transpose (opset 24) (#​27752)

✨ New Features

📊 New ONNX Ops & Model Support

  • LinearAttention and CausalConvState operators for Qwen3.5 model support (#​27907)
  • RotaryEmbedding (RotEMB) and RMSNorm operators added (#​27752)
  • Linear Attention signature support (#​27842)

🌐 Web & JavaScript

WebGPU EP

  • Qwen3.5 model support on WebGPU execution provider (#​27996)
  • QMoE 1-token decode path optimization — fused operations to reduce GPU dispatches for improved performance (#​27998)

🐛 Bug Fixes

Core Runtime Fixes

  • Improved filesystem error messages during Linux device discovery for better debugging experience (#​27289)
  • Fixed missing include for SetRawDataInTensorProto in NVIDIA TensorRT RTX tests (#​28065)

🙏 Contributors

Thanks to our 7 contributors for this release:
@​guschmue, @​sanaa-hamel-microsoft, @​apsonawane, @​eserscor, @​ishwar-raut1, @​qjia7, @​theHamsta

Full Changelog: microsoft/onnxruntime@v1.25.0...v1.25.1

1.25.0

📢 Announcements & Breaking Changes

Build & Platform

  • C++20 is now required to build ONNX Runtime from source. Minimum toolchains: MSVC 19.29+, GCC 10+, Clang 10+. Users of prebuilt packages are unaffected. (#​27178)
  • CUDA minimum version raised to 12.0 — CUDA 11.x is no longer supported. Users pinned to CUDA 11.x should stay on ORT 1.24.x or upgrade their CUDA toolkit/driver. (#​27570)
  • ONNX upgraded to 1.21.0 (#​27601)
  • sympy is now an optional dependency for Python builds. (#​27200)

Execution Provider Changes

  • ArmNN EP has been removed. Users should remove any --use_armnn build flags and migrate to the MLAS/KleidiAI-backed CPU EP or QNN EP for Qualcomm hardware. (#​27447)

API Version

🔒 Security Fixes

  • Fixed potential integer truncation leading to heap out-of-bounds read/write (#​27544)
  • Addressed Pad Reflect vulnerability (#​27652)
  • Security fix for transpose optimizer (#​27555)
  • Upgraded minimatch 3.1.2 → 3.1.4 for CVE-2026-27904 (#​27667)
  • Hardened shell command handling for constant strings (#​27840)
  • Added validation of onnx::TensorProto data size before allocation (#​27547)
  • Cleaned up external data path validation (#​27539)
  • Fixed misaligned address reads for tensor attributes from raw data buffers (#​27312)
  • Fixed CPU Attention overflow issue (#​27822)
  • Fixed CPU LRN integer overflow issues (#​27886)
  • Additional input validation hardening:

✨ New Features

🔌 Execution Provider Plugin API & CUDA Plugin EP

... (truncated)

1.24.4

This is a patch release for ONNX Runtime 1.24, containing bug fixes and execution provider updates.

Bug Fixes

  • Core: Added PCI bus fallback for Linux GPU device discovery in containerized environments (e.g., AKS/Kubernetes) where nvidia-drm is not loaded but GPU PCI devices are still exposed via sysfs. (#​27591)
  • Plugin EP: Fixed null pointer dereference when iterating output spans in GetOutputIndex. (#​27644)
  • Plugin EP: Fixed bug that incorrectly assigned duplicate MetaDef IDs to fused nodes in different GraphViews (e.g., then/else branches of an If node), causing session creation to fail with a conflicting kernel error. (#​27666)

Execution Provider Updates

  • QNN EP: Enabled offline x64 compilation with memhandle IO type by deferring rpcmem library loading to inference time. (#​27479)
  • QNN EP: Reverted QNN SDK logging verbosity changes that caused segmentation faults on backend destruction. (#​27650)

Build and Infrastructure

  • Python: Updated python_requires from >=3.10 to >=3.11 to reflect dropped Python 3.10 support. (#​27354)
  • Build: Replaced __builtin_ia32_tpause with the compiler-portable _tpause intrinsic to fix cross-compiler portability issues between GCC and LLVM. (#​27607)

Full Changelog: v1.24.3...v1.24.4

Contributors

@​derdeljan-msft, @​adrianlizarraga, @​apwojcik, @​baijumeswani, @​edgchen1, @​mocknen, @​tianleiwu, @​XXXXRT666

1.24.3

This is a patch release for ONNX Runtime 1.24, containing bug fixes, security improvements, performance enhancements, and execution provider updates.

Security Fixes

  • Core: Fixed GatherCopyData integer truncation leading to heap out-of-bounds read/write. (#​27444)
  • Core: Fixed RoiAlign heap out-of-bounds read via unchecked batch_indices. (#​27543)
  • Core: Prevent heap OOB from maliciously crafted Lora Adapters. (#​27518)
  • Core: Fixed out-of-bounds access for Resize operation. (#​27419)

Bug Fixes

  • Core: Fixed GatherND division by zero when batch dimensions mismatch. (#​27090)
  • Core: Fixed validation for external data paths for models loaded from bytes. (#​27430)
  • Core: Fixed SkipLayerNorm fusion incorrectly applied when gamma/beta are not 1D. (#​27459)
  • Core: Fixed double-free in TRT EP custom op domain Release functions. (#​27471)
  • Core: Fixed QMoE CPU Operator. (#​27360)
  • Core: Fixed MatmulNBits prepacking scales. (#​27412)
  • Python: Fixed refcount bug in map input conversion that caused shutdown segfault. (#​27413)
  • NuGet: Fixed DllImportResolver. (#​27397)
  • NuGet: Added OrtEnv.DisableDllImportResolver to prevent fatal error on resolver conflict. (#​27535)

Performance Improvements

  • Core: QMoE CPU performance update (up to 4x on 4-bit). (#​27364)
  • Core: Fixed O(n²) model load time for TreeEnsemble with categorical feature chains. (#​27391)

Execution Provider Updates

  • NvTensorRtRtx EP:
    • Avoid repetitive creation of fp4/fp8 native-custom-op domains. (#​27192)
    • Added missing override specifiers to suppress warnings. (#​27288)
    • DQ→MatMulNBits fusion transformer. (#​27466)
  • WebGPU:
    • Used embedded WASM module in Blob URL workers when wasmBinary is provided. (#​27318)
    • Fixed usage of wasmBinary together with a blob URL for .mjs. (#​27411)
    • Removed the unhelpful "Unknown CPU vendor" warning. (#​27399)
    • Allows new memory info name for WebGPU. (#​27475)
  • MLAS:
    • Added DynamicQGemm function pointers and ukernel interface. (#​27403)
    • Fixed error where bytes is not assigned for dynamic qgemm pack b size. (#​27421)
  • VitisAI EP: Removed s_kernel_registry_vitisaiep.reset() in deinitialize_vitisai_ep(). (#​27295)
  • Plugin EPs: Added "library_path" metadata entry to OrtEpDevice instances for plugin and provider bridge EPs. (#​27522)

Build and Infrastructure

  • Pipelines:
    • Build Windows ARM64X binaries as part of packaging pipeline. (#​27316)
    • Moved JAR testing pipelines to canonical pipeline template. (#​27480)
  • Python: Enabled Python 3.14 CI and upgraded dependencies. (#​27401)
  • Build: Suppressed spurious Array Out of Bounds warnings produced by GCC 14.2 compiler on Linux builds. (#​27454)
  • Build: Fixed -Warray-bounds build error in MLAS on clang 17+. (#​27499)
  • Telemetry: Added/Updated telemetry events. (#​27356)
  • Config: Increased kMaxValueLength to 8192. (#​27521)

... (truncated)

1.24.2

This is a patch release for ONNX Runtime 1.24, containing several bug fixes, security improvements, and execution provider updates.

Bug Fixes

  • NuGet: Fixed native library loading issues in the ONNX Runtime NuGet package on Linux and macOS. (#​27266)
  • macOS: Fixed Java support and Jar testing on macOS ARM64. (#​27271)
  • Core: Enable Robust Symlink Support for External Data for Huggingface Hub Cache. (#​27374)
  • Core: Added boundary checks for SparseTensorProtoToDenseTensorProto to improve robustness. (#​27323)
  • Security: Fixed an out-of-bounds read vulnerability in ArrayFeatureExtractor. (#​27275)

Execution Provider Updates

  • MLAS: Fixed flakiness and accuracy issues in Lut GEMM (MatMulNBitsLutGemm). (#​27216)
  • QNN: Enabled 64-bit UDMA mode for HTP target v81 or above. (#​26677)
  • WebGPU:
    • Used LazyRelease for prepack allocator. (#​27077)
    • Fixed ConvTranspose bias validation in both TypeScript and C++ implementations. (#​27213)
  • OpenVINO (OVEP): Patch to reduce resident memory by reusing weight files across shared contexts. (#​27238)
  • DNNL: Fixed DNNL build error by including missing files. (#​27334)

Build and Infrastructure

  • CUDA:
    • Added support for CUDA architecture family codes (suffix 'f') introduced in CUDA 12.9. (#​27278)
    • Fixed build errors and warnings for various CUDA versions (12.8, 13.0, 13.1.1). (#​27276)
    • Applied patches for Abseil CUDA warnings. (#​27096, #​27126)
  • Pipelines:
    • Fixed Python packaging pipeline for Windows ARM64 and release. (#​27339, #​27350, #​27299)
    • Fixed DirectML NuGet pipeline to correctly bundle x64 and ARM64 binaries for release. (#​27349)
    • Updated Microsoft.ML.OnnxRuntime.Foundry package for Windows ARM64 support and NuGet signing. (#​27294)
  • Testing: Updated BaseTester to support plugin EPs with both compiled nodes and registered kernels. (#​27176)
  • Telemetry: Added service name and framework name to telemetry events for better usage understanding on Windows. (#​27252, #​27256)

Full Changelog: v1.24.1...v1.24.2

Contributors

@​tianleiwu, @​hariharans29, @​edgchen1, @​xiaofeihan1, @​adrianlizarraga, @​angelser, @​angelserMS, @​ankitm3k, @​baijumeswani, @​bmehta001, @​ericcraw, @​eserscor, @​fs-eire, @​guschmue, @​mc-nv, @​qjia7, @​qti-monumeen, @​titaiwangms, @​yuslepukhin

1.24.1

📢 Announcements & Breaking Changes

Platform Support Changes

  • Python 3.10 wheels are no longer published — Please upgrade to Python 3.11+
  • Python 3.14 support added
  • Free-threaded Python (PEP 703) — Added support for Python 3.13t and 3.14t in Linux (#​26786)
  • x86_64 binaries for macOS/iOS are no longer provided and minimum macOS is raised to 14.0

API Version

✨ New Features

🤖 Execution Provider (EP) Plugin API

A major infrastructure enhancement enabling plugin-based EPs with dynamic loading:

  • Initial kernel-based EP support (#​26206)
  • Weight pre-packing support for plugin EPs (#​26754)
  • EP Context model support (#​25124)
  • Control flow kernel APIs (#​26927)
  • OrtKernelInfo APIs for kernel-based plugin EPs (#​26803)

🔧 Core APIs

  • OrtApi::CreateEnvWithOptions() and OrtEpApi::GetEnvConfigEntries() (#​26971)
  • EP Device Compatibility APIs (#​26922)
  • External Resource Importer API for D3D12 shared resources (#​26828)
  • Session config access from KernelInfo (#​26589)

📊 Dependencies & Integration

🖥️ Execution Provider Updates

NVIDIA

  • CUDA EP: Flash Attention updates, GQA kernel fusion, BF16 support for MoE/qMoE/MatMulNBits, CUDA 13.0 support
  • TensorRT EP: Upgraded to TensorRT 10.14, automatic plugin loading, NVFP4 custom ops
  • TensorRT RTX EP: RTX runtime caching, CUDA graph support, BFloat16, memory-mapped engines

Qualcomm QNN EP

  • QNN SDK upgraded to 2.42.0 with new ops (RMSNorm, ScatterElements, GatherND, STFT, RandomUniformLike)
  • Gelu pattern fusion, LPBQ quantization support, ARM64 wheel builds, v81 device support

Intel & AMD

  • OpenVINO EP: Upgraded to 2025.4.1
  • VitisAI EP: External EP loader, compiled model compatibility API
    ... (truncated)

1.23.2

1.23.1

What's Changed

  • Fix Attention GQA implementation on CPU (#​25966)
  • Address edge GetMemInfo edge cases (#​26021)
  • Implement new Python APIs (#​25999)
  • MemcpyFromHost and MemcpyToHost support for plugin EPs (#​26088)
  • [TRT RTX EP] Fix bug for generating the correct subgraph in GetCapability (#​26132)
  • add session_id_ to LogEvaluationStart/Stop, LogSessionCreationStart (#​25590)
  • [build] fix WebAssembly build on macOS/arm64 (#​25653)
  • [CPU] MoE Kernel (#​25958)
  • [CPU] Block-wise QMoE kernel for CPU (#​26009)
  • [C#] Implement missing APIs (#​26101)
  • Regenerate test model with ONNX IR < 12 (#​26149)
  • [CPU] Fix compilation errors because of unused variables (#​26147)
  • [EP ABI] Check if nodes specified in GetCapability() have already been assigned (#​26156)
  • [QNN EP] Add dynamic option to set HTP performance mode (#​26135)

Full Changelog: microsoft/onnxruntime@v1.23.0...v1.23.1

1.23.0

Announcements

  • This release introduces Execution Provider (EP) Plugin API, which is a new infrastructure for building plugin-based EPs. (#​24887 , #​25137, #​25124, #​25147, #​25127, #​25159, #​25191, #​2524)

  • This release introduces the ability to dynamically download and install execution providers. This feature is exclusively available in the WinML build and requires Windows 11 version 25H2 or later. To leverage this new capability, C/C++/C# users should use the builds distributed through the Windows App SDK, and Python users should install the onnxruntime-winml package(will be published soon). We encourage users who can upgrade to the latest Windows 11 to utilize the WinML build to take advantage of this enhancement.

Upcoming Changes

  • The next release will stop providing x86_64 binaries for macOS and iOS operating systems.
  • The next release will increase the minimum supported macOS version from 13.4 to 14.0.
  • The next release will stop providing python 3.10 wheels.

Execution & Core Optimizations

Shutdown logic on Windows is simplified

Now on Windows some global object will be not destroyed if we detect that the process is being shutting down(#​24891) . It will not cause memory leak as when a process ends all the memory will be returned to the operating system. This change can reduce the chance of having crashes on process exit.

AutoEP/Device Management

Now ONNX Runtime has the ability to automatically discovery computing devices and select the best EPs to download and register. The EP downloading feature currently only works on Windows 11 version 25H2 or later.

Execution Provider (EP) Updates

ROCM EP was removed from the source tree. Users are recommended to use Migraphx or Vitis AI EPs from AMD.
A new EP, Nvidia TensorRT RTX, was added.

Web

EMDSK is upgraded from 4.0.4 to 4.0.8

WebGPU EP

Added WGSL template support.

QNN EP

SDK Update: Added support for QNN SDK 2.37.

KleidiAI

Enhanced performance for SGEMM, IGEMM, and Dynamic Quantized MatMul operations, especially for Conv2D operators on hardware that supports SME2 (Scalable Matrix Extension v2).

Known Problems

  • There was a change in build.py that was related to KleidiAI that may cause build failures when doing cross-compiling (#​26175) .

Contributions

Contributors to ONNX Runtime include members across teams at Microsoft, along with our community members:

@​1duo, @​Akupadhye, @​amarin16, @​AndreyOrb, @​ankan-ban, @​ankitm3k, @​anujj, @​aparmp-quic, @​arnej27959, @​bachelor-dou, @​benjamin-hodgson, @​Bonoy0328, @​chenweng-quic, @​chuteng-quic, @​clementperon, @​co63oc, @​daijh, @​damdoo01-arm, @​danyue333, @​fanchenkong1, @​gedoensmax, @​genarks, @​gnedanur, @​Honry, @​huaychou, @​ianfhunter, @​ishwar-raut1, @​jing-bao, @​joeyearsley, @​johnpaultaken, @​jordanozang, @​JulienMaille, @​keshavv27, @​kevinch-nv, @​khoover, @​krahenbuhl, @​kuanyul-quic, @​mauriciocm9, @​mc-nv, @​minfhong-quic, @​mingyueliuh, @​MQ-mengqing, @​NingW101, @​notken12, @​omarhass47, @​peishenyan, @​pkubaj, @​qc-tbhardwa, @​qti-jkilpatrick, @​qti-yuduo, @​quic-ankus, @​quic-ashigarg, @​quic-ashwshan, @​quic-calvnguy, @​quic-hungjuiw, @​quic-tirupath, @​qwu16, @​ranjitshs, @​saurabhkale17, @​schuermans-slx, @​sfatimar, @​stefantalpalaru, @​sunnyshu-intel, @​TedThemistokleous, @​thevishalagarwal, @​toothache, @​umangb-09, @​vatlark, @​VishalX, @​wcy123, @​xhcao, @​xuke537, @​zhaoxul-qti

1.22.2

What's new?

This release adds an optimized CPU/MLAS implementation of DequantizeLinear (8 bit) and introduces the build option client_package_build, which enables default options that are more appropriate for client/on-device workloads (e.g., disable thread spinning by default).

Build System & Packages

  • Add –client_package_build option (#​25351) - @​jywu-msft
  • Remove the python installation steps from win-qnn-arm64-ci-pipeline.yml (#​25552) - @​snnn

CPU EP

  • Add multithreaded/vectorized implementation of DequantizeLinear for int8 and uint8 inputs (SSE2, NEON) (#​24818) - @​adrianlizarraga

QNN EP

  • Add support for the Upsample, Einsum, LSTM, and CumSum operators (#​24265, #​24616, #​24646, #​24820) - @​quic-zhaoxul, @​1duo, @​chenweng-quic, @​Akupadhye
  • Fuse scale into Softmax (#​24809) - @​qti-yuduo
  • Enable DSP queue polling when performance is set to “burst” mode (#​25361) - @​quic-calvnguy
  • Update QNN SDK to version 2.36.1 (#​25388) - @​qti-jkilpatrick
  • Include the license file from QNN SDK in the Microsoft.ML.OnnxRunitme.QNN NuGet package (#​25158) - @​HectorSVC

1.22.1

What's new?

This release replaces static linking of dxcore.lib with optional runtime loading, lowering the minimum supported version from Windows 10 22H2 (10.0.22621) to 20H1 (10.0.19041). This enables compatibility with Windows Server 2019 (10.0.17763), where dxcore.dll may be absent.

  • change dependency from gitlab eigen to github eigen-mirror #​24884 - @​prathikr
  • Weaken dxcore dependency #​24845 - @​skottmckay
  • [DML] Restore compatibility with Windows Sdk 10.0.17134.0 #​24950 - @​JulienMaille
  • Disable VCPKG's binary cache #​24889 - @​snnn

1.22

Announcements

  • This release introduces new API's for Model Editor, Auto EP infrastructure, and AOT Compile
  • OnnxRuntime GPU packages require CUDA 12.x , packages built for CUDA 11.x are no longer published.
  • The min supported Windows version is now 10.0.19041.

GenAI & Advanced Model Features

  • Constrained Decoding: Introduced new capabilities for constrained decoding, offering more control over generative AI model outputs.

Execution & Core Optimizations

Core

  • Auto EP Selection Infrastructure: Added foundational infrastructure to enable automatic selection of Execution Providers via selection policies, aiming to simplify configuration and optimize performance. (Pull Request #​24430)
  • Compile API: Introduced new APIs to support explicit compilation of ONNX models.
  • Model Editor API api's for creating or editing ONNX models

Execution Provider (EP) Updates

CPU EP/MLAS

  • KleidiAI Integration: Integrated KleidiAI into ONNX Runtime/MLAS for enhanced performance on Arm architectures.
  • MatMulNBits Support: Added support for MatMulNBits, enabling matrix multiplication with weights quantized to 8 bits.
  • GroupQueryAttention optimizations and enhancements

OpenVINO EP

  • Added support up to OpenVINO 2025.1
  • Introduced Intel compiler level optimizations for QDQ models.
  • Added support to select Intel devices based on LUID
  • Load_config feature improvement to support AUTO, HETERO and MULTI plugin.
  • misc bugfixes/optimizations
  • For detailed updates, refer to Pull Request #​24394: ONNXRuntime OpenVINO - Release 1.22

QNN EP

  • SDK Update: Added support for QNN SDK 2.33.2.
  • operator updates/support to Sum, Softmax, Upsample, Expand, ScatterND, Einsum
  • QNN EP can be built as shared or static library.
  • enable QnnGpu backend
  • For detailed updates refer to recent QNN tagged PR's

TensorRT EP

  • TensorRT Version: Added support for TensorRT 10.9.
    • Note for onnx-tensorrt open-source parser users: Please check here for specific requirements (Referencing 1.21 link as a placeholder, this should be updated for 1.22).
  • New Features:
    • EP option to enable TRT Preview Feature
    • Support to load TensorRT V3 plugin
  • Bug Fixes:
    • Resolved an issue related to multithreading scenarios.
      ... (truncated)

1.21.1

What's new?

  • Extend CMAKE_CUDA_FLAGS with all Blackwell compute capacity #​23928 - @​yf711
  • [ARM CPU] Fix fp16 const initialization on no-fp16 platform #​23978 - @​fajin-corp
  • [TensorRT EP] Call cudaSetDevice at compute function for handling multithreading scenario #​24010 - @​chilo-ms
  • Fix attention bias broadcast #​24017 - @​tianleiwu
  • Deleted the constant SKIP_CUDA_TEST_WITH_DML #​24113 - @​CodingSeaotter
  • [QNN EP] ARM64EC python package remove --vcpkg in build #​24174 - @​jywu-msft
  • [wasm] remove --vcpkg in wasm build #​24179 - @​fs-eire

1.21.0

Announcements

  • No large announcements of note this release! We've made a lot of small refinements to streamline your ONNX Runtime experience.

GenAI & Advanced Model Features

Enhanced Decoding & Pipeline Support

  • Added "chat mode" support for CPU, GPU, and WebGPU.
  • Provided support for decoder model pipelines.
  • Added support for Java API for MultiLoRA.

API & Compatibility Updates

Bug Fixes for Model Output

  • Fixed Phi series garbage output issues with long prompts.
  • Resolved gibberish issues with top_k on CPU.

Execution & Core Optimizations

Core Refinements

  • Reduced default logger usage for improved efficiency(#​23030).
  • Fixed a visibility issue in theadpool (#​23098).

Execution Provider (EP) Updates

General

  • Removed TVM EP from the source tree(#​22827).
  • Marked NNAPI EP for deprecation (following Google's deprecation of NNAPI).
  • Fixed a DLL delay loading issue that impacts WebGPU EP and DirectML EP's usability on Windows (#​23111, #​23227)

TensorRT EP Improvements

  • Added support for TensorRT 10.8.
  • Assigned DDS ops (NMS, RoiAlign, NonZero) to TensorRT by default.
  • Introduced option trt_op_types_to_exclude to exclude specific ops from TensorRT assignment.

CUDA EP Improvements

QNN EP Improvements

  • Introduced QNN shared memory support.
  • Improved performance for AI Hub models.
  • Added support for QAIRT/QNN SDK 2.31.
  • Added Python 3.13 package.
  • Miscellaneous bug fixes and enhancements.
  • QNN EP is now built as a shared library/DLL by default. To retain previous build behavior, use build option --use_qnn static_lib.

DirectML EP Support & Upgrades

  • Updated DirectML version from 1.15.2 to 1.15.4(#​22635).

... (truncated)

1.20.2

What's new?

Build System & Packages

  • Merge Windows machine pools for Web CI pipeline to reduce maintenance costs (#​23243) - @​snnn
  • Update boost URL for React Native CI pipeline (#​23281) - @​jchen351
  • Move ORT Training pipeline to GitHub actions and enable CodeQL scan for the source code (#​22543) - @​snnn
  • Move Linux GitHub actions to a dedicated machine pool (#​22566) - @​snnn
  • Update Apple deployment target to iOS 15.1 and macOS 13.3 (#​23308) - @​snnn
  • Deprecate macOS 12 in packaging pipeline (#​23017) - @​mszhanyi
  • Remove net8.0-android MAUI target from MAUI test project (#​23607) - @​carzh

CUDA EP

  • Fixes use of numeric_limits that causes a compiler error in Visual Studio 2022 v17.12 Preview 5 (#​22738, #​22868) - @​tianleiwu

QNN EP

  • Enable offloading graph input quantization and graph output dequantization to CPU by default. Improves inference latency by reducing the amount of I/O data copied between CPU and NPU. (#​23368) - @​adrianlizarraga

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 17.12.0 to 17.14.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

17.14.1

What's Changed

Full Changelog: microsoft/vstest@v17.14.0...v17.14.1

17.14.0

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

New Contributors

17.14.0-preview-25107-01

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

_Descrip...

Description has been truncated

@dependabot
deps(nuget): Bump the dotnet-minor-and-patch group with 7 updates
c172819 
Bumps Microsoft.Data.Sqlite from 10.0.0 to 10.0.10
Bumps Microsoft.Extensions.AI.Abstractions from 10.7.0 to 10.8.3
Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.0 to 10.0.10
Bumps Microsoft.ML.OnnxRuntime from 1.20.1 to 1.28.0
Bumps Microsoft.NET.Test.Sdk from 17.12.0 to 17.14.1
Bumps System.Numerics.Tensors from 10.0.0 to 10.0.10
Bumps xunit from 2.9.2 to 2.9.3

---
updated-dependencies:
- dependency-name: Microsoft.Data.Sqlite
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-and-patch
- dependency-name: Microsoft.Extensions.AI.Abstractions
  dependency-version: 10.8.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-and-patch
- dependency-name: Microsoft.Extensions.Logging.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-and-patch
- dependency-name: Microsoft.ML.OnnxRuntime
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 17.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-and-patch
- dependency-name: System.Numerics.Tensors
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-and-patch
- dependency-name: xunit
  dependency-version: 2.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, dotnet. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants