Skip to content

Bump the minor-and-patch group with 17 updates#30

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/minor-and-patch-46cb106098
Open

Bump the minor-and-patch group with 17 updates#30
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/minor-and-patch-46cb106098

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown

Updated FluentAssertions from 8.9.0 to 8.10.0.

Release notes

Sourced from FluentAssertions's releases.

8.10.0

What's Changed

Improvements

Documentation

Others

Full Changelog: fluentassertions/fluentassertions@8.9.0...8.10.0

Commits viewable in compare view.

Updated Meziantou.Analyzer from 3.0.50 to 3.0.122.

Release notes

Sourced from Meziantou.Analyzer's releases.

3.0.122

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.122

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.121...3.0.122

3.0.121

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.121

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.120...3.0.121

3.0.120

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.120

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.119...3.0.120

3.0.119

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.119

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.118...3.0.119

3.0.118

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.118

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.117...3.0.118

3.0.117

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.117

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.116...3.0.117

3.0.116

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.116

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.115...3.0.116

3.0.115

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.115

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.114...3.0.115

3.0.114

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.114

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.113...3.0.114

3.0.113

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.113

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.112...3.0.113

3.0.112

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.112

Full Changelog: meziantou/Meziantou.Analyzer@3.0.111...3.0.112

3.0.111

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.111

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.110...3.0.111

3.0.110

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.110

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.109...3.0.110

3.0.109

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.109

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.108...3.0.109

3.0.108

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.108

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.107...3.0.108

3.0.107

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.107

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.106...3.0.107

3.0.106

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.106

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.105...3.0.106

3.0.105

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.105

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.104...3.0.105

3.0.104

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.104

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.103...3.0.104

3.0.103

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.103

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.102...3.0.103

3.0.102

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.102

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.101...3.0.102

3.0.101

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.101

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.100...3.0.101

3.0.100

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.100

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.99...3.0.100

3.0.99

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.99

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.98...3.0.99

3.0.98

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.98

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.97...3.0.98

3.0.97

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.97

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.96...3.0.97

3.0.96

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.96

Full Changelog: meziantou/Meziantou.Analyzer@3.0.95...3.0.96

3.0.95

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.95

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.94...3.0.95

3.0.94

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.94

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.93...3.0.94

3.0.93

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.93

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.92...3.0.93

3.0.92

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.92

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.91...3.0.92

3.0.91

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.91

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.90...3.0.91

3.0.90

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.90

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.89...3.0.90

3.0.89

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.89

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.88...3.0.89

3.0.88

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.88

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.87...3.0.88

3.0.87

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.87

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.86...3.0.87

3.0.86

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.86

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.85...3.0.86

3.0.85

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.85

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.84...3.0.85

3.0.84

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.84

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.83...3.0.84

3.0.83

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.83

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.82...3.0.83

3.0.82

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.82

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.81...3.0.82

3.0.81

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.81

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.80...3.0.81

3.0.80

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.80

Full Changelog: meziantou/Meziantou.Analyzer@3.0.79...3.0.80

3.0.79

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.79

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.78...3.0.79

3.0.78

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.78

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.77...3.0.78

3.0.77

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.77

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.76...3.0.77

3.0.76

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.76

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.75...3.0.76

3.0.75

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.75

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.74...3.0.75

3.0.74

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.74

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.73...3.0.74

3.0.73

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.73

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.72...3.0.73

3.0.72

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.72

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.71...3.0.72

3.0.71

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.71

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.70...3.0.71

3.0.70

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.70

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.69...3.0.70

3.0.69

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.69

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.68...3.0.69

3.0.68

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.68

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.67...3.0.68

3.0.67

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.67

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.66...3.0.67

3.0.66

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.66

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.65...3.0.66

3.0.65

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.65

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.64...3.0.65

3.0.64

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.64

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.63...3.0.64

3.0.63

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.63

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.62...3.0.63

3.0.62

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.62

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.61...3.0.62

3.0.61

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.61

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.60...3.0.61

3.0.60

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.60

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.59...3.0.60

3.0.59

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.59

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.58...3.0.59

3.0.58

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.58

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.57...3.0.58

3.0.57

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.57

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.56...3.0.57

3.0.56

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.56

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.55...3.0.56

3.0.55

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.55

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.54...3.0.55

3.0.54

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.54

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.53...3.0.54

3.0.53

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.53

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.52...3.0.53

3.0.52

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.52

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.51...3.0.52

3.0.51

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.51

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.50...3.0.51

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore from 9.0.15 to 9.0.17.

Release notes

Sourced from Microsoft.EntityFrameworkCore's releases.

9.0.17

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.16...v9.0.17

9.0.16

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.15...v9.0.16

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Design from 9.0.15 to 9.0.17.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Design's releases.

9.0.17

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.16...v9.0.17

9.0.16

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.15...v9.0.16

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Relational from 9.0.15 to 9.0.17.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Relational's releases.

9.0.17

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.16...v9.0.17

9.0.16

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.15...v9.0.16

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration from 10.0.6 to 10.0.9.

Release notes

Sourced from Microsoft.Extensions.Configuration's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Binder from 10.0.6 to 10.0.9.

Release notes

Sourced from Microsoft.Extensions.Configuration.Binder's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.CommandLine from 10.0.6 to 10.0.9.

Release notes

Sourced from Microsoft.Extensions.Configuration.CommandLine's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.EnvironmentVariables from 10.0.6 to 10.0.9.

Release notes

Sourced from Microsoft.Extensions.Configuration.EnvironmentVariables's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Json from 10.0.6 to 10.0.9.

Release notes

Sourced from Microsoft.Extensions.Configuration.Json's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.ML.OnnxRuntime from 1.24.4 to 1.27.1.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.27.1

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

  • [MLAS] Fixed an igemm regression in the KleidiAI path (#​28571)
  • Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#​29081)
  • Fixed a regression in graph-capture session initialization that rejected an empty graph (#​29457)
  • Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#​29574)

Performance

NVIDIA CUDA EP

  • Added a QMoE GEMV fast path for batch-1 decode (#​29038)

CI & Build Infrastructure

  • Fixed an incorrect identity for azcopy (#​29274)
  • Fixed a brew install applesimutils failure by trusting the wix/brew tap (#​29450)
  • Upgraded to Xcode 26 (#​29468)
  • Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#​29575)
  • Fixed the web e2e (npm/vite) and Python DML CI pipelines (#​29609)

Contributors

Thanks to our 8 contributors for this release!

@​tianleiwu, @​chilo-ms, @​edgchen1, @​adrastogi, @​damdoo01-arm, @​JonathanC-ARM, @​martin-klacer-arm, @​sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1

1.27.0

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28.
n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

  • CUDA 12 package files are now explicitly named as such.
  • CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

Security Fixes

  • Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#​28004)
  • Hardened OneHot input validation and output-size computation (#​28014)
  • Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#​28055)
  • Bounded total output allocation size in Tile kernel (#​28070)
  • Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#​28223)
  • Fixed BitShift UB for shift amounts greater than or equal to bit width (#​28272)
  • Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#​28277)
  • Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#​28279)
  • Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#​28386)
  • Fixed out-of-bounds read in CropBase scale handling (#​28399)
  • Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#​28400)
  • Added sparse tensor external file path validation and additional external-path hardening (#​28408, #​28709, #​28725)
  • Switched remaining torch.load() calls to weights_only=True (#​28421)
  • Added CPU cache-indirection beam-index validation (#​28486)
  • Added additional overflow/bounds checks and test coverage in runtime buffers (#​28713, #​28747)

New Features

Execution Provider Plugin API

  • Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#​28037)
  • Added OrtEp::OnSessionInitializationEnd() callback (#​28319)
  • Added plugin EP session-options getters (#​28377)
  • Added CUDA Plugin EP provider options for streams and external allocators (#​28603)

Core APIs & Runtime

  • Added support for ONNX overloaded functions (IR v10+) (#​28275)
  • Added FLOAT8E8M0 datatype support in ONNX Runtime (#​28381)
  • Added CPU Cast support for FLOAT8E8M0 (#​28435)
  • Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#​28282)

Quantization & Training Tooling

  • Added calibration cache support to quantize_static (#​28221)
  • Added ActivationRestrictedAsymmetric quantization option (#​28237)
    ... (truncated)

1.26.0

n.b. The following was generated via LLM from Git history. Only the contributor list has been verified.

ONNX Runtime Release 1.26.0

Announcement - Breaking Changes

  • Support for CUDA 12 will be removed in 1.27.0.
    • CUDA 13 will continue to be published as onnxruntime-<os>-<arch>-gpu_cuda13-<version>.<ext>
  • CUDA runtime will be moving soon to a dedicated Execution Provider (EP) instead of a published package from ORT core.

Highlights

  • Added optional memory mapping for .ort model loads (#​28164).
  • Added RISC-V Vector (RVV) support for CPU EP (#​28261).
  • OpenVINO EP upgraded for 1.26.0 development release (#​28297).
  • WebGPU gained GridSample support (#​28264) and Split-K improvements (#​28151).
  • CUDA plugin EP gained graph support (#​28002), profiling API (#​28216).

Security and Reliability Hardening

  • Replaced unrestricted Python setattr configuration with an allowlist (#​28083).
  • Hardened multiple OOB and overflow scenarios across ML and core ops:
  • Fixed session logger use-after-free during EP teardown under verbose logging (#​28274).

CUDA, Attention, and MLAS

  • Filled CUDA opset/operator gaps and extended support:
    • Transpose opset 23 -> 25 (#​27740).
    • QuantizeLinear/DequantizeLinear opset 25 (#​28046).
    • CUDA TopK INT8/INT16/UINT8 support (#​27862).
    • LabelEncoder CUDA support for numeric types (#​28045).
  • Attention/GQA improvements:
    • Fixed ONNX Attention min-bias alignment crash on SM<80 and masked-batch NaN behavior (#​27831).
    • Added FP32 QK accumulation path for unfused GQA attention (#​28198).
    • Added CUDART_VERSION reduction compatibility in GQA attention (#​28296).
    • Fixed CUDA 13 build error in GQA unfused attention (#​28309).
    • PagedAttention fallback for SM<80 fp16 (#​28200).
  • MLAS updates:
    • FP16 Gelu enablement (#​26815).
    • Arm64 BF16 fast-math conv kernels for NCHW/NCHWc paths (#​27878).

WebGPU, WebNN, and JavaScript

... (truncated)

1.25.1

n.b. This changelog is LLM generated. Only the contributor listing has been verified.

ONNX Runtime Release 1.25.1

📢 Announcements & Breaking Changes

ONNX Op Updates

  • Enhanced ONNX operator support with new opset versions: Reshape (opset 25), Transpose (opset 24) (#​27752)

✨ New Features

📊 New ONNX Ops & Model Support

  • LinearAttention and CausalConvState operators for Qwen3.5 model support (#​27907)
  • RotaryEmbedding (RotEMB) and RMSNorm operators added (#​27752)
  • Linear Attention signature support (#​27842)

🌐 Web & JavaScript

WebGPU EP

  • Qwen3.5 model support on WebGPU execution provider (#​27996)
  • QMoE 1-token decode path optimization — fused operations to reduce GPU dispatches for improved performance (#​27998)

🐛 Bug Fixes

Core Runtime Fixes

  • Improved filesystem error messages during Linux device discovery for better debugging experience (#​27289)
  • Fixed missing include for SetRawDataInTensorProto in NVIDIA TensorRT RTX tests (#​28065)

🙏 Contributors

Thanks to our 7 contributors for this release:
@​guschmue, @​sanaa-hamel-microsoft, @​apsonawane, @​eserscor, @​ishwar-raut1, @​qjia7, @​theHamsta

Full Changelog: microsoft/onnxruntime@v1.25.0...v1.25.1

1.25.0

📢 Announcements & Breaking Changes

Build & Platform

  • C++20 is now required to build ONNX Runtime from source. Minimum toolchains: MSVC 19.29+, GCC 10+, Clang 10+. Users of prebuilt packages are unaffected. (#​27178)
  • CUDA minimum version raised to 12.0 — CUDA 11.x is no longer supported. Users pinned to CUDA 11.x should stay on ORT 1.24.x or upgrade their CUDA toolkit/driver. (#​27570)
  • ONNX upgraded to 1.21.0 (#​27601)
  • sympy is now an optional dependency for Python builds. (#​27200)

Execution Provider Changes

  • ArmNN EP has been removed. Users should remove any --use_armnn build flags and migrate to the MLAS/KleidiAI-backed CPU EP or QNN EP for Qualcomm hardware. (#​27447)

API Version


🔒 Security Fixes

  • Fixed potential integer truncation leading to heap out-of-bounds read/write (#​27544)
  • Addressed Pad Reflect vulnerability (#​27652)
  • Security fix for transpose optimizer (#​27555)
  • Upgraded minimatch 3.1.2 → 3.1.4 for CVE-2026-27904 (#​27667)
  • Hardened shell command handling for constant strings (#​27840)
  • Added validation of onnx::TensorProto data size before allocation (#​27547)
  • Cleaned up external data path validation (#​27539)
  • Fixed misaligned address reads for tensor attributes from raw data buffers (#​27312)
  • Fixed CPU Attention overflow issue (#​27822)
  • Fixed CPU LRN integer overflow issues (#​27886)
  • Additional input validation hardening:

✨ New Features

🔌 Execution Provider Plugin API & CUDA Plugin EP

... (truncated)

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.4.0 to 18.7.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.7.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

18.6.0

What's Changed

Changes to tests and infra

18.5.1

What's Changed

Full Changelog: microsoft/vstest@v18.5.0...v18.5.1

18.5.0

⚠️ Unlisted on Nuget, because of #​15718

What's Changed

Full Changelog: microsoft/vstest@v18.4.0...v18.5.0

Commits viewable in compare view.

Updated ModelContextProtocol from 1.2.0 to 1.4.1.

Release notes

Sourced from ModelContextProtocol's releases.

1.4.1

This release backports a memory-leak fix for HTTP/SSE-based MCP servers. StreamableHttpServerTransport now releases its Server-Sent Events response stream reference as soon as a GET request ends, instead of holding it until the session is disposed via explicit DELETE or idle timeout. Long-lived SSE clients that disconnect without sending DELETE no longer pin the underlying Kestrel connection and its associated memory-pool buffers (~20 MiB per session), preventing the sustained memory growth that could accumulate under connect/disconnect churn.

What's Changed

  • Release SSE response stream reference when GET request ends #​1628 by @​halter73 (co-authored by @​joelmforsyth @​Copilot)

Acknowledgements

  • @​slomangino123 submitted issue #​766 (resolved by #​1628)

Full Changelog: modelcontextprotocol/csharp-sdk@v1.4.0...v1.4.1

1.4.0

v1.4.0 introduces support for the Identity Assertion Authorization Grant (ID-JAG) flow via the new IdentityAssertionGrantProvider, enabling enterprise SSO scenarios where users authenticate once via their enterprise Identity Provider and access MCP servers without per-server authorization prompts. The release also adds a new InheritEnvironmentVariables option on StdioClientTransportOptions for controlling the child server's environment, alongside two security hardening fixes: the stdio client transport no longer enumerates child-process environment variables in Trace logs, and DELETE on a Streamable HTTP session now requires the same authenticated user that initiated the session.

What's Changed

  • Stop logging stdio transport environment variables #​1538 by @​halter73 (co-authored by @​Copilot)
  • Add InheritEnvironmentVariables to StdioClientTransportOptions #​1563 by @​halter73 (co-authored by @​Copilot)
  • Validate user on Streamable HTTP session DELETE #​1604 by @​halter73 (co-authored by @​Copilot)
    • HandleDeleteRequestAsync now mirrors the HasSameUserId check already enforced on GET and POST. A DELETE with a valid Mcp-Session-Id but a different authenticated user now returns 403 Forbidden instead of terminating the session — defense-in-depth against a leaked session ID being used to DoS the original owner.
  • Add Enterprise Managed Authorization (SEP-990) support #​1305 by @​aniket-okta (backported in #​1625)
    • Adds IdentityAssertionGrantProvider and supporting option/response types in ModelContextProtocol.Authentication implementing the Identity Assertion Autho...

_De...

Description has been truncated

Bumps FluentAssertions from 8.9.0 to 8.10.0
Bumps Meziantou.Analyzer from 3.0.50 to 3.0.122
Bumps Microsoft.EntityFrameworkCore from 9.0.15 to 9.0.17
Bumps Microsoft.EntityFrameworkCore.Design from 9.0.15 to 9.0.17
Bumps Microsoft.EntityFrameworkCore.Relational from 9.0.15 to 9.0.17
Bumps Microsoft.Extensions.Configuration from 10.0.6 to 10.0.9
Bumps Microsoft.Extensions.Configuration.Binder from 10.0.6 to 10.0.9
Bumps Microsoft.Extensions.Configuration.CommandLine from 10.0.6 to 10.0.9
Bumps Microsoft.Extensions.Configuration.EnvironmentVariables from 10.0.6 to 10.0.9
Bumps Microsoft.Extensions.Configuration.Json from 10.0.6 to 10.0.9
Bumps Microsoft.ML.OnnxRuntime from 1.24.4 to 1.27.1
Bumps Microsoft.NET.Test.Sdk from 18.4.0 to 18.7.0
Bumps ModelContextProtocol from 1.2.0 to 1.4.1
Bumps SonarAnalyzer.CSharp from 10.23.0.137933 to 10.29.0.143774
Bumps Spectre.Console from 0.55.2 to 0.57.2
Bumps System.CommandLine from 2.0.6 to 2.0.9
Bumps Testcontainers.PostgreSql from 4.11.0 to 4.13.0

---
updated-dependencies:
- dependency-name: FluentAssertions
  dependency-version: 8.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Meziantou.Analyzer
  dependency-version: 3.0.122
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore
  dependency-version: 9.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.Design
  dependency-version: 9.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.Relational
  dependency-version: 9.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Configuration
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Configuration.Binder
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Configuration.CommandLine
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Configuration.EnvironmentVariables
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Configuration.Json
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.ML.OnnxRuntime
  dependency-version: 1.27.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ModelContextProtocol
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.29.0.143774
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Spectre.Console
  dependency-version: 0.57.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: System.CommandLine
  dependency-version: 2.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Testcontainers.PostgreSql
  dependency-version: 4.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: deps, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants