Bump Microsoft.ML.OnnxRuntime from 1.26.0 to 1.29.0

[dependabot]

Updated Microsoft.ML.OnnxRuntime from 1.26.0 to 1.29.0.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.29.0

Announcements & Breaking Changes

• onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#​29716, #​31683).
• POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#​27379, #​29872).
• The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#​29395).

Security Fixes

Path, bounds, and input validation

• Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#​29396).
• Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#​29907, #​29916).
• Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#​29254, #​29255, #​29265, #​29579, #​29595, #​29605, #​29871, #​31636, #​31671, #​31675, #​31676, #​31684).
• Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#​29581, #​29631, #​29638, #​31640, #​31642, #​31644, #​31645, #​31647, #​31650).
• Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#​29157, #​31665).

Supply chain and tooling

• Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#​29827, #​29926, #​31192).

New Features

Core APIs & Runtime

• Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#​29688).
• Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#​29607, #​29799, #​31613).
• Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#​29261, #​31728).
• Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#​29555, #​29558, #​29569, #​29571).

Execution Provider ABI & Plugin EPs

• WebGPU now supports device-free compile-only sessions for offline graph transformation (#​29681).
• Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#​31635, #​31722, #​31992).
• Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#​29634, #​29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

• Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#​29912).
• Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#​29900, #​29904, #​31480).
• Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#​29715, #​29717).
• Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#​29525, #​31157).
• Fixed LinearAttention on GPUs with limited shared memory (#​31982).

MoE and quantized GEMM

• Added NVFP4 QMoE, including native FP4xFP4 prefill on SM120, faster decode GEMV, fused routing/finalization paths, and reduced activation and weight-dequantization overhead (#​29697, #​29824, #​29887, #​29919, #​31156, #​31159, #​31349, #​31479).
  ... (truncated)

1.28.0

Announcements & Breaking Changes

• Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
• cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
• An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
• Deprecated / removed:
  • SkipLayerNorm strict mode is deprecated (#​29388).
  • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
  • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
  • CUDA_QUANT_PREPROCESS is off by default (#​29687).
• NPM packages are now published from the CUDA 13 pipeline (#​28773).
• The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation

• Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
• Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
• Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
• Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
• Validated Col2Im inputs to prevent heap over-read (#​28706)
• Hardened CropAndResize against malformed crop_size tensors (#​28766)
• Validated BeamSearch vocab_size against logits width (#​28774)
• Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
• Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
• Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
• Clamped 1D attention mask_index to valid bounds (#​29449)
• Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
• Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
• Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
• Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
• Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
• Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
• Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
• Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
• Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)

Integer overflow & allocation size

• Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
• Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
• Hardened QMoE against integer overflow and partial K tiles (#​29067)
• Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
• Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
• Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
• Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)

Supply chain & tooling

... (truncated)

1.27.1

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

• [MLAS] Fixed an igemm regression in the KleidiAI path (#​28571)
• Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#​29081)
• Fixed a regression in graph-capture session initialization that rejected an empty graph (#​29457)
• Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#​29574)

Performance

NVIDIA CUDA EP

• Added a QMoE GEMV fast path for batch-1 decode (#​29038)

CI & Build Infrastructure

• Fixed an incorrect identity for azcopy (#​29274)
• Fixed a brew install applesimutils failure by trusting the wix/brew tap (#​29450)
• Upgraded to Xcode 26 (#​29468)
• Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#​29575)
• Fixed the web e2e (npm/vite) and Python DML CI pipelines (#​29609)

Contributors

Thanks to our 8 contributors for this release!

@​tianleiwu, @​chilo-ms, @​edgchen1, @​adrastogi, @​damdoo01-arm, @​JonathanC-ARM, @​martin-klacer-arm, @​sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1

1.27.0

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28.
n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

• CUDA 12 package files are now explicitly named as such.
• CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

---

Security Fixes

• Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#​28004)
• Hardened OneHot input validation and output-size computation (#​28014)
• Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#​28055)
• Bounded total output allocation size in Tile kernel (#​28070)
• Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#​28223)
• Fixed BitShift UB for shift amounts greater than or equal to bit width (#​28272)
• Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#​28277)
• Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#​28279)
• Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#​28386)
• Fixed out-of-bounds read in CropBase scale handling (#​28399)
• Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#​28400)
• Added sparse tensor external file path validation and additional external-path hardening (#​28408, #​28709, #​28725)
• Switched remaining torch.load() calls to weights_only=True (#​28421)
• Added CPU cache-indirection beam-index validation (#​28486)
• Added additional overflow/bounds checks and test coverage in runtime buffers (#​28713, #​28747)

---

New Features

Execution Provider Plugin API

• Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#​28037)
• Added OrtEp::OnSessionInitializationEnd() callback (#​28319)
• Added plugin EP session-options getters (#​28377)
• Added CUDA Plugin EP provider options for streams and external allocators (#​28603)

Core APIs & Runtime

• Added support for ONNX overloaded functions (IR v10+) (#​28275)
• Added FLOAT8E8M0 datatype support in ONNX Runtime (#​28381)
• Added CPU Cast support for FLOAT8E8M0 (#​28435)
• Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#​28282)

Quantization & Training Tooling

• Added calibration cache support to quantize_static (#​28221)
• Added ActivationRestrictedAsymmetric quantization option (#​28237)
  ... (truncated)

Commits viewable in compare view.

[jeremydixon22]

Superseded by #87, which applies this reviewed update with the related lifecycle-fixture reliability correction and fresh full validation.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.