Update all non-major dependencies - #4842

Merged
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies
Sep 2, 2026
Merged

Update all non-major dependencies#4842
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies

Conversation

@solrbot

Copy link
Copy Markdown
Collaborator

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageTypeUpdateChangePending
org.threeten:threetenbp (source)dependenciespatch1.7.31.7.4
io.swagger.core.v3.swagger-gradle-pluginpluginpatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-jaxrs2-jakartadependenciespatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-annotations-jakartadependenciespatch2.2.522.2.542.2.55
com.github.spotbugs:spotbugs-annotations (source)dependenciespatch4.10.24.10.4
org.openapi.generatorpluginminor7.23.07.25.0
com.microsoft.onnxruntime:onnxruntime (source)dependenciesminor1.26.01.29.0
io.nlopez.compose.rules:ktlintdependenciespatch0.6.20.6.4
no.nav.security:mock-oauth2-serverdependenciespatch5.0.15.0.2
net.ltgt.errorpronepluginpatch5.1.05.1.1
dev.logchangepluginpatch1.19.151.19.16
nl.littlerobots.version-catalog-updatepluginpatch1.1.01.1.1
dev.langchain4j:langchain4j-bom (source)dependenciesminor1.17.01.19.0
joda-time:joda-time (source)dependenciespatch2.14.22.14.3
org.jctools:jctools-core (source)dependenciespatch4.0.64.0.7
com.google.guava:guavadependenciesminor33.6.0-jre33.7.1-jre
org.eclipse.jgit:org.eclipse.jgitdependenciespatch7.7.0.202606012155-r7.7.1.202607240634-r
com.diffplug.spotlesspluginminor8.7.08.10.08.10.1
com.nvidia.cuvs:cuvs-java (source)dependenciesminor26.06.026.08.1
commons-codec:commons-codec (source)dependenciespatch1.22.01.22.1
org.checkerframework:checker-qual (source)dependenciespatch4.2.04.2.2
com.carrotsearch:hppcdependenciesminor0.10.00.11.1
org.bouncycastle:bcprov-jdk18on (source)dependenciesminor1.841.85.2
org.bouncycastle:bcpkix-jdk18on (source)dependenciesminor1.841.85
com.github.ben-manes.versionspluginminor0.54.00.61.0
org.apache.tika:tika-core (source)dependenciespatch3.3.13.3.2
org.apache.opennlp:opennlp-tools (source)dependenciespatch2.5.102.5.11
org.apache.opennlp:opennlp-dl (source)dependenciespatch2.5.102.5.11
org.apache.commons:commons-collections4 (source)dependenciesminor4.5.04.6.0
com.adobe.testing:s3mock-testcontainersdependenciesminor5.1.05.2.0

Release Notes

ThreeTen/threetenbp (org.threeten:threetenbp)

v1.7.4

See the change notes for more information.

swagger-api/swagger-core (io.swagger.core.v3:swagger-jaxrs2-jakarta)

v2.2.54

Fixed
  • Java 8 date/time types (OffsetTime, Duration, LocalTime) now map by default
    to the correct OpenAPI Formats Registry strings ("time", "duration", "time-local")
    instead of an unusable expanded object. (#​5172)
  • LocalDateTime deserialization from an existing OpenAPI spec now correctly
    round-trips through the new TimeSchema/DurationSchema/DateTimeLocalSchema/
    TimeLocalSchema classes instead of falling back to a generic StringSchema.
Added
  • PrimitiveType.enableJava8Formats() — opt-in to map LocalDateTime to the
    registry-compliant "date-time-local" format (default remains "date-time"
    for backward compatibility).
Deprecated
  • PrimitiveType.enablePartialTime() — prefer the new default "time-local"
    mapping for LocalTime; kept for callers who specifically need the
    non-registry "partial-time" format.

v2.2.53: Swagger-core 2.2.53 released!

  • chore: update Jackson to 2.22.1 (#​5258)
  • refactor: replace writer(new DefaultPrettyPrinter()) with writerWithDefaultPrettyPrinter() (#​5252)
  • fix: Stabilize CI Maven and Gradle builds (#​5238)
  • test: remove system.out.println from tests (#​5236)
  • chore: bump dependencies (#​5229)
  • refactor: simplify type handling in ModelDeserializer (#​5227)
  • Revert "hotfix: temporarily allow Release workflow to skip mvn deploy to recover 2.2.52 (#​5220)" (#​5223)
  • chore(deps-dev): bump org.codehaus.groovy:groovy from 3.0.23 to 3.0.25 (#​5216)
  • chore(deps): bump commons-cli:commons-cli from 1.9.0 to 1.11.0 (#​5209)
  • chore(deps-dev): bump commons-codec:commons-codec from 1.17.2 to 1.22.0 (#​5208)
  • fix: emit $ref for array items when cycle guard suppresses implementation processing (#​5205)
  • Restore inner property name from map key in handleUnwrapped (#​5193)
  • Honor PropertyNamingStrategy for get/is-prefixed property names (#​5192)
  • fix: let explicit @​Schema(format) override type-derived format (#​5185) (#​5186)
  • docs: update format of javadoc to produce a functional link (#​5182)
  • fix: exclude overridable annotation values when parsing composed annotations (#​5179)
  • fix: negative and positive validation annotations uses relevant OAS 3.1 syntax ( #​5170) (#​5171)
spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)

v4.10.4

Compare Source

Fixed
  • Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#​3884)
  • Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#​3483)
  • Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#​4201)
  • Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#​4237)
  • Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#​4244)
  • Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#​4246)
  • Stop publishing global dependency-management constraints to consumer POMs. (#​4223)

v4.10.3

Compare Source

Fixed
  • Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix message for UNS_UNSAFE_CALL bug pattern
  • Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#​4191)
  • Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#​4034)
  • Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#​4059)
Changed
  • Ant FindBugsViewerTask: use default look and feel by default. (#​4165)
Refactor
  • Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#​4165)
microsoft/onnxruntime (com.microsoft.onnxruntime:onnxruntime)

v1.29.0: ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#​29716, #​31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#​27379, #​29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#​29395).

Security Fixes

Path, bounds, and input validation
Supply chain and tooling
  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#​29827, #​29926, #​31192).

New Features

Core APIs & Runtime
  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#​29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#​29607, #​29799, #​31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#​29261, #​31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#​29555, #​29558, #​29569, #​29571).
Execution Provider ABI & Plugin EPs
  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#​29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#​31635, #​31722, #​31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#​29634, #​29770).

Execution Provider Updates

NVIDIA CUDA EP
Attention and decoding
  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#​29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#​29900, #​29904, #​31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#​29715, #​29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#​29525, #​31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#​31982).
MoE and quantized GEMM
Operators and collectives
  • Added LinearAttentionGate, GatedRMSNorm, and GatedAdd contrib operators (#​31158, #​31835).
  • Added bfloat16 support to AllReduce, AllGather, and AllToAll (#​31571).
  • Fixed the default zero point in CUDA GatherBlockQuantized (#​31693).
WebGPU EP
WebNN EP
  • Added uint8-packed 4-bit GatherBlockQuantized and LpNormalization, reused the shared WASM loader for Blob-backed external data, and fixed per-axis QDQ and MatMulNBits edge cases (#​29475, #​29801, #​31151, #​31152, #​31197).
OpenVINO / QNN / DML / XNNPACK / TensorRT
  • OpenVINO fixed float16 constant-output corruption and output-name routing, added dot-separated KV-cache names to the stateful transform, and corrected raw-data-backed float initializer handling (#​29729, #​29882, #​29895, #​31138).
  • QNN added a reshape handler for split-axis reshapes (#​29660).
  • DML fixed wide-string handling and made fused graph kernels own their model paths (#​31656, #​31664).
  • XNNPACK now reads dynamic Gemm M from the input tensor at compute time (#​31189).
  • TensorRT deduplicated context-path handling and added a build option for fused-attention cubins (#​29640, #​31632).

CPU & Core Optimizations

MLAS
  • Added Arm64 half-precision GEMM and convolution support through KleidiAI, including FP16 MatMul/Gemm/Conv paths and asymmetric Q4 and SME2 MatMulNBits kernels (#​28786, #​29654, #​29709, #​29898).
  • Added a RISC-V RVV QNBitGemm backend, an Arm64 NEON fp32 RoPE kernel, portable SVE elementwise kernels with FEXPA exp, and Arm64 UDOT routing for S8U8 QGEMM (#​29537, #​29787, #​29836, #​31145).
  • Added AVX2/VNNI 2-bit weight kernels and vectorized 2-bit dequantization, and improved fp16 MatMulNBits paths by avoiding fp32 temporaries and writing fp16 output directly across 2-, 4-, and 8-bit paths (#​29619, #​29766, #​29791, #​29842, #​29864, #​29901).
CPU Attention & Kernels
  • Improved masked Attention performance, enabled CPU FlashAttention on Linux Arm64 through L2-cache detection, and added FP16 GQA with quantized KV cache (#​29621, #​29719, #​29825).
  • Added double support to CPU Cos and int32 support to CPU Trilu, and fixed int8 QLinearSoftmax saturation and AvgPool ceil_mode/count_include_pad behavior (#​28975, #​29476, #​29629, #​29728).
  • Fixed TfIdfVectorizer weight indexing and skipped MinLength logits-processor construction when eos_token_id is negative (#​29604, #​31649).
  • Tightened K/V and cache-indirection shape contracts in CPU Attention and MultiHeadAttention, and fixed LinearAttention output shape inference for grouped-query attention (#​29892, #​31190, #​31634).
Graph, Optimizer, and Runtime
  • Extended reshape fusion, fixed double recursion in subgraph type/shape inference, and made constant-folding output deterministic (#​29027, #​29617, #​29789).
  • Fixed in-memory external initializer loading, memory-pattern allocation stream selection, and a leak in GetOverridableInitializerNames() (#​29349, #​29589, #​29616).
  • Reduced small MatMul batch allocations and redundant LUT initialization (#​29085, #​29690).
  • Fixed static-initialization-order crashes when importing ONNX Runtime and reduced eager runtime initialization (#​29880, #​31964).
  • Negative CPU Split axes now produce an error instead of being accepted (#​31149).

Web & JavaScript

  • Added on-demand loading of Blob-backed external data in JSPI builds (#​29477).
  • Fixed JSEP pooling output shape for ceil_mode, allowed DFT to ignore excess input data, and fixed a webpack/Terser release-build crash (#​29627, #​29680, #​31652).

Build, Packaging & CI

  • CUDA package architecture selections are now aligned across plugin EP, Python, C API, TensorRT, and Node.js pipelines. Windows arm64 is only available in CUDA plugin EP (#​31992):

    OSCUDACUDA architectures (all in -real form)
    Linux x6412.860;70;75;80;86;89;90a;120a
    Linux x6413.x75;80;86;89;90a;120a
    Linux aarch6413.x89;90a;120a;121a
    Windows x6412.861;75;86;89;120a
    Windows x6413.x75;80;86;89;120a
    Windows arm6413.x120a;121a
  • Reduced CUDA compilation time and memory usage by splitting generated SM80 MoE, fpA_intB, and MatMulNBits translation units and adding two-level workspace estimation (#​29614, #​29699, #​29811, #​31834, #​31837).

  • Fixed CUDA 13 plugin and packaging builds on Windows, Linux, and Windows ARM64, including MSVC/TMA compatibility and CI memory limits (#​31608, #​31609, #​31615, #​31616, #​31617, #​31622, #​31729, #​31748).

  • Fixed MLAS AVX2 builds on toolchains without AVX-VNNI assembler support, GCC 15 -Werror builds, and an MSVC C1001 issue in the W2 AVX-512-VNNI dispatch path (#​28767, #​29679, #​29885).

  • Improved Windows compatibility by skipping DXGI discovery when Win32k system calls are unavailable and delay-loading shell32 (#​29755, #​30889).

  • Fixed Dawn parallel-build races, and GPU discovery in build/test environments (#​29858, #​29866).

Contributors

Thanks to our 63 contributors for this release!

@​adrastogi, @​ahsan-ca, @​AngelGalindo7, @​ankitm3k, @​apsonawane, @​blazingphoenix7, @​bmehta001, @​chilo-ms, @​claude, @​daijh, @​ducviet00, @​edgchen1, @​elwhyjay, @​eserscor, @​GopalakrishnanN, @​guptaishaan, @​hariharans29, @​Honry, @​huningxin, @​jchen10, @​jiafatom, @​jiangzhuo, @​Jiawei-Shao, @​JonathanC-ARM, @​justinchuby, @​kjg0724, @​kunal-vaishnavi, @​kylo5aby, @​Laan33, @​martin-klacer-arm, @​mastryukov1990, @​mcollinswisc, @​miaobin, @​mingmingtasd, @​mirounga, @​mustjab, @​n1harika, @​namgyu-youn, @​neilmsft, @​nenad1002, @​nicholascelestin, @​OscarFree, @​prathikr, @​qjia7, @​quic-muchhsu, @​Sammy-Dabbas, @​sanaa-hamel-microsoft, @​shiyi9801, @​skottmckay, @​tairenpiao, @​TedThemistokleous, @​the0cp, @​tianleiwu, @​titaiwangms, @​velonica0, @​wangw-1991, @​wuisabel-gif, @​xadupre, @​xhcao, @​xiaofeihan1, @​xiaoyu-work, @​yen-shi, @​zlma7001

Full Changelog: v1.28.0...v1.29.0

v1.28.0: ONNX Runtime v1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#​29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
    • CUDA_QUANT_PREPROCESS is off by default (#​29687).
  • NPM packages are now published from the CUDA 13 pipeline (#​28773).
  • The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation
  • Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
  • Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
  • Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
  • Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
  • Validated Col2Im inputs to prevent heap over-read (#​28706)
  • Hardened CropAndResize against malformed crop_size tensors (#​28766)
  • Validated BeamSearchvocab_size against logits width (#​28774)
  • Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
  • Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
  • Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
  • Clamped 1D attention mask_index to valid bounds (#​29449)
  • Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
  • Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
  • Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
  • Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
  • Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
  • Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
  • Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
  • Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
  • Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)
Integer overflow & allocation size
  • Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
  • Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
  • Hardened QMoE against integer overflow and partial K tiles (#​29067)
  • Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
  • Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
  • Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
  • Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)
Supply chain & tooling

New Features

Execution Provider ABI & Plugin EPs
  • Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#​28271, #​28989, #​29501)
  • Added an API to select the best compiled-model compatibility info from candidate strings (#​28387)
  • Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#​28624)
  • Implemented name-based partitioning with accompanying documentation (#​28903)
  • Added Linux NPU discovery through sysfs accel devices (#​28703)
  • Relaxed CompileModel validation to accept zero-input OrtModel graphs (#​28771)
  • CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#​29221, #​29244, #​28896, #​28789)
  • WebGPU plugin EP version bumped to 0.3.0 (#​29056)
Core APIs & Runtime
  • Added OrtErrorCode documentation, single-sourced the values so StatusCode stays in sync, and added OrtErrorCode::ORT_DEVICE_RESET (#​29018, #​29065, #​29748)
  • Added memory statistics to profiling output (#​29058)
  • Added EP version logging on inference failure, in the EpDeviceUsage event, and ORT version logging (#​28794)
  • User-supplied external initializers are now used in place when already on the planned device (#​29013)
  • model_external_initializers_file_folder_path is now honored for file-path model loads (#​29459)
  • Added a Python API for HOST_ACCESSIBLEOrtValue allocation (#​28038)
Quantization Tooling
  • Added CudaQuantizer to onnxruntime.quantization (#​29509)
  • Registered Flatten as a Direct8Bit op in the Python QDQ static quantizer (#​28340)
  • Skipped MaxPool during FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#​28488, #​29350)
  • Added Float16/BFloat16/Float8 support in the TensorArray custom op (#​28335)
  • Clarified CPU parameter recommendations in the quantization docs (#​28415)

Execution Provider Updates

NVIDIA CUDA EP

Attention & LLM decode

  • Enabled XQA by default for FP16/BF16 GroupQueryAttention, and extended XQA decode with attention sink, sliding window, and QK-Norm support (#​29046, #​29162, #​29177, #​29186)
  • Upgraded cudnn_frontend to 1.24 and enabled cuDNN SDPA for MHA/GQA (#​28849)
  • Added decode-optimized LinearAttention (GatedDeltaNet) kernels (#​28985)
  • Optimized FlashDecode split planning for local-window GQA and fixed Flash/Lean attention split heuristics (#​29161, #​29554)
  • Updated the GroupQueryAttention contrib op documentation (#​29173)

MoE & quantized GEMM

  • Prepacked int4/int8 QMoE expert weights in the PrePack hook, symmetric with MatMulNBits, and fix

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 9am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot

@solrbot

Copy link
Copy Markdown
CollaboratorAuthor

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

@solrbot
solrbotforce-pushed the renovate/all-non-major-dependencies branch from 44a0e97 to 7fa382aCompareSeptember 1, 2026 08:28
@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

It must be the first day of the month! Look at all these lovely updates grouped together.. Adn the tests pass!

@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

I think a refinement would be to integrae the dangling licenses clean up logic. There are ten licenses that no longer are needed... I'll manually remove them and commit. But maybe we can tuen the job to do it as well?

So this is a real gap, not a Renovate misconfiguration — nothing in the pipeline (Renovate's postUpgradeTasks, or the Gradle build itself) is designed to catch this automatically; it only surfaces when someone runs check (or checkDanglingLicenseFiles) by hand, as you just did. If you want to close the gap, the cheapest fix is adding ./gradlew checkDanglingLicenseFiles to postUpgradeTasks.commands so Renovate's branch build fails loudly (forcing manual attention) instead of silently opening a red-CI PR — actually auto-deleting would need a new Gradle task, which is more invasive for something this infrequent.

@epugh
epugh requested a review from janhoySeptember 1, 2026 10:53
@@ -0,0 +1,7 @@
title: Update all non-major dependencies

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These auto generated changelog files are not very precise for grouped updates.

So either skip changelog for this, or edit the title with a comma separated list of all deps upgraded.

And realistically we will already have changelog files in unreleased folder touching many of the same libs, so there will be duplicates. Perhaps there is no avoiding the RM having to de-duplicate by hand (or LLM) before a release, so that each dependency bump is mentioned only once and with the actual latest version.

And David wants no dependency_update entries at all, while I believe they are important, although perhaps noisy and a bit annoying to keep up to date. Will need to discuss this more elsewhere...

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. I can't imagine that a meaningful useful changelog can be made either a editorial step. I am hoping we get to a point that these rote Solr bot prs do not require human intervention unless the tests fail.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I sent a follow up to my email asking how we want to handle thise: https://lists.apache.org/thread/gp56nzp4hl2v757q0j54pzd7dnywy21n

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, just skip the changelog for this PR, leave it to RM to clean up

@epugh

epugh commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

I am inclined to just remove the changelog, until we get more agreement... so that I can get this merged.... Or do you think ishould wait?

@epugh
epugh merged commit 100431c into apache:mainSep 2, 2026
7 of 8 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@solrbot@epugh@janhoy
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Skip to content

Update all non-major dependencies - #4842

Merged
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies
Sep 2, 2026
Merged

Update all non-major dependencies#4842
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies

Conversation

@solrbot

Copy link
Copy Markdown
Collaborator

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageTypeUpdateChangePending
org.threeten:threetenbp (source)dependenciespatch1.7.31.7.4
io.swagger.core.v3.swagger-gradle-pluginpluginpatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-jaxrs2-jakartadependenciespatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-annotations-jakartadependenciespatch2.2.522.2.542.2.55
com.github.spotbugs:spotbugs-annotations (source)dependenciespatch4.10.24.10.4
org.openapi.generatorpluginminor7.23.07.25.0
com.microsoft.onnxruntime:onnxruntime (source)dependenciesminor1.26.01.29.0
io.nlopez.compose.rules:ktlintdependenciespatch0.6.20.6.4
no.nav.security:mock-oauth2-serverdependenciespatch5.0.15.0.2
net.ltgt.errorpronepluginpatch5.1.05.1.1
dev.logchangepluginpatch1.19.151.19.16
nl.littlerobots.version-catalog-updatepluginpatch1.1.01.1.1
dev.langchain4j:langchain4j-bom (source)dependenciesminor1.17.01.19.0
joda-time:joda-time (source)dependenciespatch2.14.22.14.3
org.jctools:jctools-core (source)dependenciespatch4.0.64.0.7
com.google.guava:guavadependenciesminor33.6.0-jre33.7.1-jre
org.eclipse.jgit:org.eclipse.jgitdependenciespatch7.7.0.202606012155-r7.7.1.202607240634-r
com.diffplug.spotlesspluginminor8.7.08.10.08.10.1
com.nvidia.cuvs:cuvs-java (source)dependenciesminor26.06.026.08.1
commons-codec:commons-codec (source)dependenciespatch1.22.01.22.1
org.checkerframework:checker-qual (source)dependenciespatch4.2.04.2.2
com.carrotsearch:hppcdependenciesminor0.10.00.11.1
org.bouncycastle:bcprov-jdk18on (source)dependenciesminor1.841.85.2
org.bouncycastle:bcpkix-jdk18on (source)dependenciesminor1.841.85
com.github.ben-manes.versionspluginminor0.54.00.61.0
org.apache.tika:tika-core (source)dependenciespatch3.3.13.3.2
org.apache.opennlp:opennlp-tools (source)dependenciespatch2.5.102.5.11
org.apache.opennlp:opennlp-dl (source)dependenciespatch2.5.102.5.11
org.apache.commons:commons-collections4 (source)dependenciesminor4.5.04.6.0
com.adobe.testing:s3mock-testcontainersdependenciesminor5.1.05.2.0

Release Notes

ThreeTen/threetenbp (org.threeten:threetenbp)

v1.7.4

See the change notes for more information.

swagger-api/swagger-core (io.swagger.core.v3:swagger-jaxrs2-jakarta)

v2.2.54

Fixed
  • Java 8 date/time types (OffsetTime, Duration, LocalTime) now map by default
    to the correct OpenAPI Formats Registry strings ("time", "duration", "time-local")
    instead of an unusable expanded object. (#​5172)
  • LocalDateTime deserialization from an existing OpenAPI spec now correctly
    round-trips through the new TimeSchema/DurationSchema/DateTimeLocalSchema/
    TimeLocalSchema classes instead of falling back to a generic StringSchema.
Added
  • PrimitiveType.enableJava8Formats() — opt-in to map LocalDateTime to the
    registry-compliant "date-time-local" format (default remains "date-time"
    for backward compatibility).
Deprecated
  • PrimitiveType.enablePartialTime() — prefer the new default "time-local"
    mapping for LocalTime; kept for callers who specifically need the
    non-registry "partial-time" format.

v2.2.53: Swagger-core 2.2.53 released!

  • chore: update Jackson to 2.22.1 (#​5258)
  • refactor: replace writer(new DefaultPrettyPrinter()) with writerWithDefaultPrettyPrinter() (#​5252)
  • fix: Stabilize CI Maven and Gradle builds (#​5238)
  • test: remove system.out.println from tests (#​5236)
  • chore: bump dependencies (#​5229)
  • refactor: simplify type handling in ModelDeserializer (#​5227)
  • Revert "hotfix: temporarily allow Release workflow to skip mvn deploy to recover 2.2.52 (#​5220)" (#​5223)
  • chore(deps-dev): bump org.codehaus.groovy:groovy from 3.0.23 to 3.0.25 (#​5216)
  • chore(deps): bump commons-cli:commons-cli from 1.9.0 to 1.11.0 (#​5209)
  • chore(deps-dev): bump commons-codec:commons-codec from 1.17.2 to 1.22.0 (#​5208)
  • fix: emit $ref for array items when cycle guard suppresses implementation processing (#​5205)
  • Restore inner property name from map key in handleUnwrapped (#​5193)
  • Honor PropertyNamingStrategy for get/is-prefixed property names (#​5192)
  • fix: let explicit @​Schema(format) override type-derived format (#​5185) (#​5186)
  • docs: update format of javadoc to produce a functional link (#​5182)
  • fix: exclude overridable annotation values when parsing composed annotations (#​5179)
  • fix: negative and positive validation annotations uses relevant OAS 3.1 syntax ( #​5170) (#​5171)
spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)

v4.10.4

Compare Source

Fixed
  • Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#​3884)
  • Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#​3483)
  • Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#​4201)
  • Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#​4237)
  • Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#​4244)
  • Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#​4246)
  • Stop publishing global dependency-management constraints to consumer POMs. (#​4223)

v4.10.3

Compare Source

Fixed
  • Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix message for UNS_UNSAFE_CALL bug pattern
  • Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#​4191)
  • Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#​4034)
  • Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#​4059)
Changed
  • Ant FindBugsViewerTask: use default look and feel by default. (#​4165)
Refactor
  • Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#​4165)
microsoft/onnxruntime (com.microsoft.onnxruntime:onnxruntime)

v1.29.0: ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#​29716, #​31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#​27379, #​29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#​29395).

Security Fixes

Path, bounds, and input validation
Supply chain and tooling
  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#​29827, #​29926, #​31192).

New Features

Core APIs & Runtime
  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#​29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#​29607, #​29799, #​31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#​29261, #​31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#​29555, #​29558, #​29569, #​29571).
Execution Provider ABI & Plugin EPs
  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#​29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#​31635, #​31722, #​31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#​29634, #​29770).

Execution Provider Updates

NVIDIA CUDA EP
Attention and decoding
  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#​29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#​29900, #​29904, #​31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#​29715, #​29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#​29525, #​31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#​31982).
MoE and quantized GEMM
Operators and collectives
  • Added LinearAttentionGate, GatedRMSNorm, and GatedAdd contrib operators (#​31158, #​31835).
  • Added bfloat16 support to AllReduce, AllGather, and AllToAll (#​31571).
  • Fixed the default zero point in CUDA GatherBlockQuantized (#​31693).
WebGPU EP
WebNN EP
  • Added uint8-packed 4-bit GatherBlockQuantized and LpNormalization, reused the shared WASM loader for Blob-backed external data, and fixed per-axis QDQ and MatMulNBits edge cases (#​29475, #​29801, #​31151, #​31152, #​31197).
OpenVINO / QNN / DML / XNNPACK / TensorRT
  • OpenVINO fixed float16 constant-output corruption and output-name routing, added dot-separated KV-cache names to the stateful transform, and corrected raw-data-backed float initializer handling (#​29729, #​29882, #​29895, #​31138).
  • QNN added a reshape handler for split-axis reshapes (#​29660).
  • DML fixed wide-string handling and made fused graph kernels own their model paths (#​31656, #​31664).
  • XNNPACK now reads dynamic Gemm M from the input tensor at compute time (#​31189).
  • TensorRT deduplicated context-path handling and added a build option for fused-attention cubins (#​29640, #​31632).

CPU & Core Optimizations

MLAS
  • Added Arm64 half-precision GEMM and convolution support through KleidiAI, including FP16 MatMul/Gemm/Conv paths and asymmetric Q4 and SME2 MatMulNBits kernels (#​28786, #​29654, #​29709, #​29898).
  • Added a RISC-V RVV QNBitGemm backend, an Arm64 NEON fp32 RoPE kernel, portable SVE elementwise kernels with FEXPA exp, and Arm64 UDOT routing for S8U8 QGEMM (#​29537, #​29787, #​29836, #​31145).
  • Added AVX2/VNNI 2-bit weight kernels and vectorized 2-bit dequantization, and improved fp16 MatMulNBits paths by avoiding fp32 temporaries and writing fp16 output directly across 2-, 4-, and 8-bit paths (#​29619, #​29766, #​29791, #​29842, #​29864, #​29901).
CPU Attention & Kernels
  • Improved masked Attention performance, enabled CPU FlashAttention on Linux Arm64 through L2-cache detection, and added FP16 GQA with quantized KV cache (#​29621, #​29719, #​29825).
  • Added double support to CPU Cos and int32 support to CPU Trilu, and fixed int8 QLinearSoftmax saturation and AvgPool ceil_mode/count_include_pad behavior (#​28975, #​29476, #​29629, #​29728).
  • Fixed TfIdfVectorizer weight indexing and skipped MinLength logits-processor construction when eos_token_id is negative (#​29604, #​31649).
  • Tightened K/V and cache-indirection shape contracts in CPU Attention and MultiHeadAttention, and fixed LinearAttention output shape inference for grouped-query attention (#​29892, #​31190, #​31634).
Graph, Optimizer, and Runtime
  • Extended reshape fusion, fixed double recursion in subgraph type/shape inference, and made constant-folding output deterministic (#​29027, #​29617, #​29789).
  • Fixed in-memory external initializer loading, memory-pattern allocation stream selection, and a leak in GetOverridableInitializerNames() (#​29349, #​29589, #​29616).
  • Reduced small MatMul batch allocations and redundant LUT initialization (#​29085, #​29690).
  • Fixed static-initialization-order crashes when importing ONNX Runtime and reduced eager runtime initialization (#​29880, #​31964).
  • Negative CPU Split axes now produce an error instead of being accepted (#​31149).

Web & JavaScript

  • Added on-demand loading of Blob-backed external data in JSPI builds (#​29477).
  • Fixed JSEP pooling output shape for ceil_mode, allowed DFT to ignore excess input data, and fixed a webpack/Terser release-build crash (#​29627, #​29680, #​31652).

Build, Packaging & CI

  • CUDA package architecture selections are now aligned across plugin EP, Python, C API, TensorRT, and Node.js pipelines. Windows arm64 is only available in CUDA plugin EP (#​31992):

    OSCUDACUDA architectures (all in -real form)
    Linux x6412.860;70;75;80;86;89;90a;120a
    Linux x6413.x75;80;86;89;90a;120a
    Linux aarch6413.x89;90a;120a;121a
    Windows x6412.861;75;86;89;120a
    Windows x6413.x75;80;86;89;120a
    Windows arm6413.x120a;121a
  • Reduced CUDA compilation time and memory usage by splitting generated SM80 MoE, fpA_intB, and MatMulNBits translation units and adding two-level workspace estimation (#​29614, #​29699, #​29811, #​31834, #​31837).

  • Fixed CUDA 13 plugin and packaging builds on Windows, Linux, and Windows ARM64, including MSVC/TMA compatibility and CI memory limits (#​31608, #​31609, #​31615, #​31616, #​31617, #​31622, #​31729, #​31748).

  • Fixed MLAS AVX2 builds on toolchains without AVX-VNNI assembler support, GCC 15 -Werror builds, and an MSVC C1001 issue in the W2 AVX-512-VNNI dispatch path (#​28767, #​29679, #​29885).

  • Improved Windows compatibility by skipping DXGI discovery when Win32k system calls are unavailable and delay-loading shell32 (#​29755, #​30889).

  • Fixed Dawn parallel-build races, and GPU discovery in build/test environments (#​29858, #​29866).

Contributors

Thanks to our 63 contributors for this release!

@​adrastogi, @​ahsan-ca, @​AngelGalindo7, @​ankitm3k, @​apsonawane, @​blazingphoenix7, @​bmehta001, @​chilo-ms, @​claude, @​daijh, @​ducviet00, @​edgchen1, @​elwhyjay, @​eserscor, @​GopalakrishnanN, @​guptaishaan, @​hariharans29, @​Honry, @​huningxin, @​jchen10, @​jiafatom, @​jiangzhuo, @​Jiawei-Shao, @​JonathanC-ARM, @​justinchuby, @​kjg0724, @​kunal-vaishnavi, @​kylo5aby, @​Laan33, @​martin-klacer-arm, @​mastryukov1990, @​mcollinswisc, @​miaobin, @​mingmingtasd, @​mirounga, @​mustjab, @​n1harika, @​namgyu-youn, @​neilmsft, @​nenad1002, @​nicholascelestin, @​OscarFree, @​prathikr, @​qjia7, @​quic-muchhsu, @​Sammy-Dabbas, @​sanaa-hamel-microsoft, @​shiyi9801, @​skottmckay, @​tairenpiao, @​TedThemistokleous, @​the0cp, @​tianleiwu, @​titaiwangms, @​velonica0, @​wangw-1991, @​wuisabel-gif, @​xadupre, @​xhcao, @​xiaofeihan1, @​xiaoyu-work, @​yen-shi, @​zlma7001

Full Changelog: v1.28.0...v1.29.0

v1.28.0: ONNX Runtime v1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#​29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
    • CUDA_QUANT_PREPROCESS is off by default (#​29687).
  • NPM packages are now published from the CUDA 13 pipeline (#​28773).
  • The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation
  • Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
  • Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
  • Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
  • Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
  • Validated Col2Im inputs to prevent heap over-read (#​28706)
  • Hardened CropAndResize against malformed crop_size tensors (#​28766)
  • Validated BeamSearchvocab_size against logits width (#​28774)
  • Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
  • Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
  • Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
  • Clamped 1D attention mask_index to valid bounds (#​29449)
  • Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
  • Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
  • Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
  • Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
  • Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
  • Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
  • Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
  • Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
  • Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)
Integer overflow & allocation size
  • Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
  • Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
  • Hardened QMoE against integer overflow and partial K tiles (#​29067)
  • Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
  • Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
  • Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
  • Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)
Supply chain & tooling

New Features

Execution Provider ABI & Plugin EPs
  • Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#​28271, #​28989, #​29501)
  • Added an API to select the best compiled-model compatibility info from candidate strings (#​28387)
  • Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#​28624)
  • Implemented name-based partitioning with accompanying documentation (#​28903)
  • Added Linux NPU discovery through sysfs accel devices (#​28703)
  • Relaxed CompileModel validation to accept zero-input OrtModel graphs (#​28771)
  • CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#​29221, #​29244, #​28896, #​28789)
  • WebGPU plugin EP version bumped to 0.3.0 (#​29056)
Core APIs & Runtime
  • Added OrtErrorCode documentation, single-sourced the values so StatusCode stays in sync, and added OrtErrorCode::ORT_DEVICE_RESET (#​29018, #​29065, #​29748)
  • Added memory statistics to profiling output (#​29058)
  • Added EP version logging on inference failure, in the EpDeviceUsage event, and ORT version logging (#​28794)
  • User-supplied external initializers are now used in place when already on the planned device (#​29013)
  • model_external_initializers_file_folder_path is now honored for file-path model loads (#​29459)
  • Added a Python API for HOST_ACCESSIBLEOrtValue allocation (#​28038)
Quantization Tooling
  • Added CudaQuantizer to onnxruntime.quantization (#​29509)
  • Registered Flatten as a Direct8Bit op in the Python QDQ static quantizer (#​28340)
  • Skipped MaxPool during FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#​28488, #​29350)
  • Added Float16/BFloat16/Float8 support in the TensorArray custom op (#​28335)
  • Clarified CPU parameter recommendations in the quantization docs (#​28415)

Execution Provider Updates

NVIDIA CUDA EP

Attention & LLM decode

  • Enabled XQA by default for FP16/BF16 GroupQueryAttention, and extended XQA decode with attention sink, sliding window, and QK-Norm support (#​29046, #​29162, #​29177, #​29186)
  • Upgraded cudnn_frontend to 1.24 and enabled cuDNN SDPA for MHA/GQA (#​28849)
  • Added decode-optimized LinearAttention (GatedDeltaNet) kernels (#​28985)
  • Optimized FlashDecode split planning for local-window GQA and fixed Flash/Lean attention split heuristics (#​29161, #​29554)
  • Updated the GroupQueryAttention contrib op documentation (#​29173)

MoE & quantized GEMM

  • Prepacked int4/int8 QMoE expert weights in the PrePack hook, symmetric with MatMulNBits, and fix

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 9am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot

@solrbot

Copy link
Copy Markdown
CollaboratorAuthor

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

@solrbot
solrbotforce-pushed the renovate/all-non-major-dependencies branch from 44a0e97 to 7fa382aCompareSeptember 1, 2026 08:28
@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

It must be the first day of the month! Look at all these lovely updates grouped together.. Adn the tests pass!

@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

I think a refinement would be to integrae the dangling licenses clean up logic. There are ten licenses that no longer are needed... I'll manually remove them and commit. But maybe we can tuen the job to do it as well?

So this is a real gap, not a Renovate misconfiguration — nothing in the pipeline (Renovate's postUpgradeTasks, or the Gradle build itself) is designed to catch this automatically; it only surfaces when someone runs check (or checkDanglingLicenseFiles) by hand, as you just did. If you want to close the gap, the cheapest fix is adding ./gradlew checkDanglingLicenseFiles to postUpgradeTasks.commands so Renovate's branch build fails loudly (forcing manual attention) instead of silently opening a red-CI PR — actually auto-deleting would need a new Gradle task, which is more invasive for something this infrequent.

@epugh
epugh requested a review from janhoySeptember 1, 2026 10:53
@@ -0,0 +1,7 @@
title: Update all non-major dependencies

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These auto generated changelog files are not very precise for grouped updates.

So either skip changelog for this, or edit the title with a comma separated list of all deps upgraded.

And realistically we will already have changelog files in unreleased folder touching many of the same libs, so there will be duplicates. Perhaps there is no avoiding the RM having to de-duplicate by hand (or LLM) before a release, so that each dependency bump is mentioned only once and with the actual latest version.

And David wants no dependency_update entries at all, while I believe they are important, although perhaps noisy and a bit annoying to keep up to date. Will need to discuss this more elsewhere...

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. I can't imagine that a meaningful useful changelog can be made either a editorial step. I am hoping we get to a point that these rote Solr bot prs do not require human intervention unless the tests fail.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I sent a follow up to my email asking how we want to handle thise: https://lists.apache.org/thread/gp56nzp4hl2v757q0j54pzd7dnywy21n

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, just skip the changelog for this PR, leave it to RM to clean up

@epugh

epugh commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

I am inclined to just remove the changelog, until we get more agreement... so that I can get this merged.... Or do you think ishould wait?

@epugh
epugh merged commit 100431c into apache:mainSep 2, 2026
7 of 8 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@solrbot@epugh@janhoy
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Update all non-major dependencies - #4842

Merged
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies
Sep 2, 2026
Merged

Update all non-major dependencies#4842
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies

Conversation

@solrbot

Copy link
Copy Markdown
Collaborator

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageTypeUpdateChangePending
org.threeten:threetenbp (source)dependenciespatch1.7.31.7.4
io.swagger.core.v3.swagger-gradle-pluginpluginpatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-jaxrs2-jakartadependenciespatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-annotations-jakartadependenciespatch2.2.522.2.542.2.55
com.github.spotbugs:spotbugs-annotations (source)dependenciespatch4.10.24.10.4
org.openapi.generatorpluginminor7.23.07.25.0
com.microsoft.onnxruntime:onnxruntime (source)dependenciesminor1.26.01.29.0
io.nlopez.compose.rules:ktlintdependenciespatch0.6.20.6.4
no.nav.security:mock-oauth2-serverdependenciespatch5.0.15.0.2
net.ltgt.errorpronepluginpatch5.1.05.1.1
dev.logchangepluginpatch1.19.151.19.16
nl.littlerobots.version-catalog-updatepluginpatch1.1.01.1.1
dev.langchain4j:langchain4j-bom (source)dependenciesminor1.17.01.19.0
joda-time:joda-time (source)dependenciespatch2.14.22.14.3
org.jctools:jctools-core (source)dependenciespatch4.0.64.0.7
com.google.guava:guavadependenciesminor33.6.0-jre33.7.1-jre
org.eclipse.jgit:org.eclipse.jgitdependenciespatch7.7.0.202606012155-r7.7.1.202607240634-r
com.diffplug.spotlesspluginminor8.7.08.10.08.10.1
com.nvidia.cuvs:cuvs-java (source)dependenciesminor26.06.026.08.1
commons-codec:commons-codec (source)dependenciespatch1.22.01.22.1
org.checkerframework:checker-qual (source)dependenciespatch4.2.04.2.2
com.carrotsearch:hppcdependenciesminor0.10.00.11.1
org.bouncycastle:bcprov-jdk18on (source)dependenciesminor1.841.85.2
org.bouncycastle:bcpkix-jdk18on (source)dependenciesminor1.841.85
com.github.ben-manes.versionspluginminor0.54.00.61.0
org.apache.tika:tika-core (source)dependenciespatch3.3.13.3.2
org.apache.opennlp:opennlp-tools (source)dependenciespatch2.5.102.5.11
org.apache.opennlp:opennlp-dl (source)dependenciespatch2.5.102.5.11
org.apache.commons:commons-collections4 (source)dependenciesminor4.5.04.6.0
com.adobe.testing:s3mock-testcontainersdependenciesminor5.1.05.2.0

Release Notes

ThreeTen/threetenbp (org.threeten:threetenbp)

v1.7.4

See the change notes for more information.

swagger-api/swagger-core (io.swagger.core.v3:swagger-jaxrs2-jakarta)

v2.2.54

Fixed
  • Java 8 date/time types (OffsetTime, Duration, LocalTime) now map by default
    to the correct OpenAPI Formats Registry strings ("time", "duration", "time-local")
    instead of an unusable expanded object. (#​5172)
  • LocalDateTime deserialization from an existing OpenAPI spec now correctly
    round-trips through the new TimeSchema/DurationSchema/DateTimeLocalSchema/
    TimeLocalSchema classes instead of falling back to a generic StringSchema.
Added
  • PrimitiveType.enableJava8Formats() — opt-in to map LocalDateTime to the
    registry-compliant "date-time-local" format (default remains "date-time"
    for backward compatibility).
Deprecated
  • PrimitiveType.enablePartialTime() — prefer the new default "time-local"
    mapping for LocalTime; kept for callers who specifically need the
    non-registry "partial-time" format.

v2.2.53: Swagger-core 2.2.53 released!

  • chore: update Jackson to 2.22.1 (#​5258)
  • refactor: replace writer(new DefaultPrettyPrinter()) with writerWithDefaultPrettyPrinter() (#​5252)
  • fix: Stabilize CI Maven and Gradle builds (#​5238)
  • test: remove system.out.println from tests (#​5236)
  • chore: bump dependencies (#​5229)
  • refactor: simplify type handling in ModelDeserializer (#​5227)
  • Revert "hotfix: temporarily allow Release workflow to skip mvn deploy to recover 2.2.52 (#​5220)" (#​5223)
  • chore(deps-dev): bump org.codehaus.groovy:groovy from 3.0.23 to 3.0.25 (#​5216)
  • chore(deps): bump commons-cli:commons-cli from 1.9.0 to 1.11.0 (#​5209)
  • chore(deps-dev): bump commons-codec:commons-codec from 1.17.2 to 1.22.0 (#​5208)
  • fix: emit $ref for array items when cycle guard suppresses implementation processing (#​5205)
  • Restore inner property name from map key in handleUnwrapped (#​5193)
  • Honor PropertyNamingStrategy for get/is-prefixed property names (#​5192)
  • fix: let explicit @​Schema(format) override type-derived format (#​5185) (#​5186)
  • docs: update format of javadoc to produce a functional link (#​5182)
  • fix: exclude overridable annotation values when parsing composed annotations (#​5179)
  • fix: negative and positive validation annotations uses relevant OAS 3.1 syntax ( #​5170) (#​5171)
spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)

v4.10.4

Compare Source

Fixed
  • Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#​3884)
  • Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#​3483)
  • Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#​4201)
  • Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#​4237)
  • Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#​4244)
  • Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#​4246)
  • Stop publishing global dependency-management constraints to consumer POMs. (#​4223)

v4.10.3

Compare Source

Fixed
  • Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix message for UNS_UNSAFE_CALL bug pattern
  • Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#​4191)
  • Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#​4034)
  • Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#​4059)
Changed
  • Ant FindBugsViewerTask: use default look and feel by default. (#​4165)
Refactor
  • Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#​4165)
microsoft/onnxruntime (com.microsoft.onnxruntime:onnxruntime)

v1.29.0: ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#​29716, #​31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#​27379, #​29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#​29395).

Security Fixes

Path, bounds, and input validation
Supply chain and tooling
  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#​29827, #​29926, #​31192).

New Features

Core APIs & Runtime
  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#​29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#​29607, #​29799, #​31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#​29261, #​31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#​29555, #​29558, #​29569, #​29571).
Execution Provider ABI & Plugin EPs
  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#​29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#​31635, #​31722, #​31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#​29634, #​29770).

Execution Provider Updates

NVIDIA CUDA EP
Attention and decoding
  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#​29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#​29900, #​29904, #​31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#​29715, #​29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#​29525, #​31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#​31982).
MoE and quantized GEMM
Operators and collectives
  • Added LinearAttentionGate, GatedRMSNorm, and GatedAdd contrib operators (#​31158, #​31835).
  • Added bfloat16 support to AllReduce, AllGather, and AllToAll (#​31571).
  • Fixed the default zero point in CUDA GatherBlockQuantized (#​31693).
WebGPU EP
WebNN EP
  • Added uint8-packed 4-bit GatherBlockQuantized and LpNormalization, reused the shared WASM loader for Blob-backed external data, and fixed per-axis QDQ and MatMulNBits edge cases (#​29475, #​29801, #​31151, #​31152, #​31197).
OpenVINO / QNN / DML / XNNPACK / TensorRT
  • OpenVINO fixed float16 constant-output corruption and output-name routing, added dot-separated KV-cache names to the stateful transform, and corrected raw-data-backed float initializer handling (#​29729, #​29882, #​29895, #​31138).
  • QNN added a reshape handler for split-axis reshapes (#​29660).
  • DML fixed wide-string handling and made fused graph kernels own their model paths (#​31656, #​31664).
  • XNNPACK now reads dynamic Gemm M from the input tensor at compute time (#​31189).
  • TensorRT deduplicated context-path handling and added a build option for fused-attention cubins (#​29640, #​31632).

CPU & Core Optimizations

MLAS
  • Added Arm64 half-precision GEMM and convolution support through KleidiAI, including FP16 MatMul/Gemm/Conv paths and asymmetric Q4 and SME2 MatMulNBits kernels (#​28786, #​29654, #​29709, #​29898).
  • Added a RISC-V RVV QNBitGemm backend, an Arm64 NEON fp32 RoPE kernel, portable SVE elementwise kernels with FEXPA exp, and Arm64 UDOT routing for S8U8 QGEMM (#​29537, #​29787, #​29836, #​31145).
  • Added AVX2/VNNI 2-bit weight kernels and vectorized 2-bit dequantization, and improved fp16 MatMulNBits paths by avoiding fp32 temporaries and writing fp16 output directly across 2-, 4-, and 8-bit paths (#​29619, #​29766, #​29791, #​29842, #​29864, #​29901).
CPU Attention & Kernels
  • Improved masked Attention performance, enabled CPU FlashAttention on Linux Arm64 through L2-cache detection, and added FP16 GQA with quantized KV cache (#​29621, #​29719, #​29825).
  • Added double support to CPU Cos and int32 support to CPU Trilu, and fixed int8 QLinearSoftmax saturation and AvgPool ceil_mode/count_include_pad behavior (#​28975, #​29476, #​29629, #​29728).
  • Fixed TfIdfVectorizer weight indexing and skipped MinLength logits-processor construction when eos_token_id is negative (#​29604, #​31649).
  • Tightened K/V and cache-indirection shape contracts in CPU Attention and MultiHeadAttention, and fixed LinearAttention output shape inference for grouped-query attention (#​29892, #​31190, #​31634).
Graph, Optimizer, and Runtime
  • Extended reshape fusion, fixed double recursion in subgraph type/shape inference, and made constant-folding output deterministic (#​29027, #​29617, #​29789).
  • Fixed in-memory external initializer loading, memory-pattern allocation stream selection, and a leak in GetOverridableInitializerNames() (#​29349, #​29589, #​29616).
  • Reduced small MatMul batch allocations and redundant LUT initialization (#​29085, #​29690).
  • Fixed static-initialization-order crashes when importing ONNX Runtime and reduced eager runtime initialization (#​29880, #​31964).
  • Negative CPU Split axes now produce an error instead of being accepted (#​31149).

Web & JavaScript

  • Added on-demand loading of Blob-backed external data in JSPI builds (#​29477).
  • Fixed JSEP pooling output shape for ceil_mode, allowed DFT to ignore excess input data, and fixed a webpack/Terser release-build crash (#​29627, #​29680, #​31652).

Build, Packaging & CI

  • CUDA package architecture selections are now aligned across plugin EP, Python, C API, TensorRT, and Node.js pipelines. Windows arm64 is only available in CUDA plugin EP (#​31992):

    OSCUDACUDA architectures (all in -real form)
    Linux x6412.860;70;75;80;86;89;90a;120a
    Linux x6413.x75;80;86;89;90a;120a
    Linux aarch6413.x89;90a;120a;121a
    Windows x6412.861;75;86;89;120a
    Windows x6413.x75;80;86;89;120a
    Windows arm6413.x120a;121a
  • Reduced CUDA compilation time and memory usage by splitting generated SM80 MoE, fpA_intB, and MatMulNBits translation units and adding two-level workspace estimation (#​29614, #​29699, #​29811, #​31834, #​31837).

  • Fixed CUDA 13 plugin and packaging builds on Windows, Linux, and Windows ARM64, including MSVC/TMA compatibility and CI memory limits (#​31608, #​31609, #​31615, #​31616, #​31617, #​31622, #​31729, #​31748).

  • Fixed MLAS AVX2 builds on toolchains without AVX-VNNI assembler support, GCC 15 -Werror builds, and an MSVC C1001 issue in the W2 AVX-512-VNNI dispatch path (#​28767, #​29679, #​29885).

  • Improved Windows compatibility by skipping DXGI discovery when Win32k system calls are unavailable and delay-loading shell32 (#​29755, #​30889).

  • Fixed Dawn parallel-build races, and GPU discovery in build/test environments (#​29858, #​29866).

Contributors

Thanks to our 63 contributors for this release!

@​adrastogi, @​ahsan-ca, @​AngelGalindo7, @​ankitm3k, @​apsonawane, @​blazingphoenix7, @​bmehta001, @​chilo-ms, @​claude, @​daijh, @​ducviet00, @​edgchen1, @​elwhyjay, @​eserscor, @​GopalakrishnanN, @​guptaishaan, @​hariharans29, @​Honry, @​huningxin, @​jchen10, @​jiafatom, @​jiangzhuo, @​Jiawei-Shao, @​JonathanC-ARM, @​justinchuby, @​kjg0724, @​kunal-vaishnavi, @​kylo5aby, @​Laan33, @​martin-klacer-arm, @​mastryukov1990, @​mcollinswisc, @​miaobin, @​mingmingtasd, @​mirounga, @​mustjab, @​n1harika, @​namgyu-youn, @​neilmsft, @​nenad1002, @​nicholascelestin, @​OscarFree, @​prathikr, @​qjia7, @​quic-muchhsu, @​Sammy-Dabbas, @​sanaa-hamel-microsoft, @​shiyi9801, @​skottmckay, @​tairenpiao, @​TedThemistokleous, @​the0cp, @​tianleiwu, @​titaiwangms, @​velonica0, @​wangw-1991, @​wuisabel-gif, @​xadupre, @​xhcao, @​xiaofeihan1, @​xiaoyu-work, @​yen-shi, @​zlma7001

Full Changelog: v1.28.0...v1.29.0

v1.28.0: ONNX Runtime v1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#​29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
    • CUDA_QUANT_PREPROCESS is off by default (#​29687).
  • NPM packages are now published from the CUDA 13 pipeline (#​28773).
  • The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation
  • Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
  • Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
  • Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
  • Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
  • Validated Col2Im inputs to prevent heap over-read (#​28706)
  • Hardened CropAndResize against malformed crop_size tensors (#​28766)
  • Validated BeamSearchvocab_size against logits width (#​28774)
  • Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
  • Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
  • Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
  • Clamped 1D attention mask_index to valid bounds (#​29449)
  • Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
  • Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
  • Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
  • Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
  • Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
  • Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
  • Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
  • Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
  • Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)
Integer overflow & allocation size
  • Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
  • Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
  • Hardened QMoE against integer overflow and partial K tiles (#​29067)
  • Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
  • Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
  • Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
  • Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)
Supply chain & tooling

New Features

Execution Provider ABI & Plugin EPs
  • Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#​28271, #​28989, #​29501)
  • Added an API to select the best compiled-model compatibility info from candidate strings (#​28387)
  • Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#​28624)
  • Implemented name-based partitioning with accompanying documentation (#​28903)
  • Added Linux NPU discovery through sysfs accel devices (#​28703)
  • Relaxed CompileModel validation to accept zero-input OrtModel graphs (#​28771)
  • CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#​29221, #​29244, #​28896, #​28789)
  • WebGPU plugin EP version bumped to 0.3.0 (#​29056)
Core APIs & Runtime
  • Added OrtErrorCode documentation, single-sourced the values so StatusCode stays in sync, and added OrtErrorCode::ORT_DEVICE_RESET (#​29018, #​29065, #​29748)
  • Added memory statistics to profiling output (#​29058)
  • Added EP version logging on inference failure, in the EpDeviceUsage event, and ORT version logging (#​28794)
  • User-supplied external initializers are now used in place when already on the planned device (#​29013)
  • model_external_initializers_file_folder_path is now honored for file-path model loads (#​29459)
  • Added a Python API for HOST_ACCESSIBLEOrtValue allocation (#​28038)
Quantization Tooling
  • Added CudaQuantizer to onnxruntime.quantization (#​29509)
  • Registered Flatten as a Direct8Bit op in the Python QDQ static quantizer (#​28340)
  • Skipped MaxPool during FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#​28488, #​29350)
  • Added Float16/BFloat16/Float8 support in the TensorArray custom op (#​28335)
  • Clarified CPU parameter recommendations in the quantization docs (#​28415)

Execution Provider Updates

NVIDIA CUDA EP

Attention & LLM decode

  • Enabled XQA by default for FP16/BF16 GroupQueryAttention, and extended XQA decode with attention sink, sliding window, and QK-Norm support (#​29046, #​29162, #​29177, #​29186)
  • Upgraded cudnn_frontend to 1.24 and enabled cuDNN SDPA for MHA/GQA (#​28849)
  • Added decode-optimized LinearAttention (GatedDeltaNet) kernels (#​28985)
  • Optimized FlashDecode split planning for local-window GQA and fixed Flash/Lean attention split heuristics (#​29161, #​29554)
  • Updated the GroupQueryAttention contrib op documentation (#​29173)

MoE & quantized GEMM

  • Prepacked int4/int8 QMoE expert weights in the PrePack hook, symmetric with MatMulNBits, and fix

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 9am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot

@solrbot

Copy link
Copy Markdown
CollaboratorAuthor

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

@solrbot
solrbotforce-pushed the renovate/all-non-major-dependencies branch from 44a0e97 to 7fa382aCompareSeptember 1, 2026 08:28
@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

It must be the first day of the month! Look at all these lovely updates grouped together.. Adn the tests pass!

@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

I think a refinement would be to integrae the dangling licenses clean up logic. There are ten licenses that no longer are needed... I'll manually remove them and commit. But maybe we can tuen the job to do it as well?

So this is a real gap, not a Renovate misconfiguration — nothing in the pipeline (Renovate's postUpgradeTasks, or the Gradle build itself) is designed to catch this automatically; it only surfaces when someone runs check (or checkDanglingLicenseFiles) by hand, as you just did. If you want to close the gap, the cheapest fix is adding ./gradlew checkDanglingLicenseFiles to postUpgradeTasks.commands so Renovate's branch build fails loudly (forcing manual attention) instead of silently opening a red-CI PR — actually auto-deleting would need a new Gradle task, which is more invasive for something this infrequent.

@epugh
epugh requested a review from janhoySeptember 1, 2026 10:53
@@ -0,0 +1,7 @@
title: Update all non-major dependencies

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These auto generated changelog files are not very precise for grouped updates.

So either skip changelog for this, or edit the title with a comma separated list of all deps upgraded.

And realistically we will already have changelog files in unreleased folder touching many of the same libs, so there will be duplicates. Perhaps there is no avoiding the RM having to de-duplicate by hand (or LLM) before a release, so that each dependency bump is mentioned only once and with the actual latest version.

And David wants no dependency_update entries at all, while I believe they are important, although perhaps noisy and a bit annoying to keep up to date. Will need to discuss this more elsewhere...

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. I can't imagine that a meaningful useful changelog can be made either a editorial step. I am hoping we get to a point that these rote Solr bot prs do not require human intervention unless the tests fail.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I sent a follow up to my email asking how we want to handle thise: https://lists.apache.org/thread/gp56nzp4hl2v757q0j54pzd7dnywy21n

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, just skip the changelog for this PR, leave it to RM to clean up

@epugh

epugh commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

I am inclined to just remove the changelog, until we get more agreement... so that I can get this merged.... Or do you think ishould wait?

@epugh
epugh merged commit 100431c into apache:mainSep 2, 2026
7 of 8 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@solrbot@epugh@janhoy
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Update all non-major dependencies - #4842

Merged
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies
Sep 2, 2026
Merged

Update all non-major dependencies#4842
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies

Conversation

@solrbot

Copy link
Copy Markdown
Collaborator

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageTypeUpdateChangePending
org.threeten:threetenbp (source)dependenciespatch1.7.31.7.4
io.swagger.core.v3.swagger-gradle-pluginpluginpatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-jaxrs2-jakartadependenciespatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-annotations-jakartadependenciespatch2.2.522.2.542.2.55
com.github.spotbugs:spotbugs-annotations (source)dependenciespatch4.10.24.10.4
org.openapi.generatorpluginminor7.23.07.25.0
com.microsoft.onnxruntime:onnxruntime (source)dependenciesminor1.26.01.29.0
io.nlopez.compose.rules:ktlintdependenciespatch0.6.20.6.4
no.nav.security:mock-oauth2-serverdependenciespatch5.0.15.0.2
net.ltgt.errorpronepluginpatch5.1.05.1.1
dev.logchangepluginpatch1.19.151.19.16
nl.littlerobots.version-catalog-updatepluginpatch1.1.01.1.1
dev.langchain4j:langchain4j-bom (source)dependenciesminor1.17.01.19.0
joda-time:joda-time (source)dependenciespatch2.14.22.14.3
org.jctools:jctools-core (source)dependenciespatch4.0.64.0.7
com.google.guava:guavadependenciesminor33.6.0-jre33.7.1-jre
org.eclipse.jgit:org.eclipse.jgitdependenciespatch7.7.0.202606012155-r7.7.1.202607240634-r
com.diffplug.spotlesspluginminor8.7.08.10.08.10.1
com.nvidia.cuvs:cuvs-java (source)dependenciesminor26.06.026.08.1
commons-codec:commons-codec (source)dependenciespatch1.22.01.22.1
org.checkerframework:checker-qual (source)dependenciespatch4.2.04.2.2
com.carrotsearch:hppcdependenciesminor0.10.00.11.1
org.bouncycastle:bcprov-jdk18on (source)dependenciesminor1.841.85.2
org.bouncycastle:bcpkix-jdk18on (source)dependenciesminor1.841.85
com.github.ben-manes.versionspluginminor0.54.00.61.0
org.apache.tika:tika-core (source)dependenciespatch3.3.13.3.2
org.apache.opennlp:opennlp-tools (source)dependenciespatch2.5.102.5.11
org.apache.opennlp:opennlp-dl (source)dependenciespatch2.5.102.5.11
org.apache.commons:commons-collections4 (source)dependenciesminor4.5.04.6.0
com.adobe.testing:s3mock-testcontainersdependenciesminor5.1.05.2.0

Release Notes

ThreeTen/threetenbp (org.threeten:threetenbp)

v1.7.4

See the change notes for more information.

swagger-api/swagger-core (io.swagger.core.v3:swagger-jaxrs2-jakarta)

v2.2.54

Fixed
  • Java 8 date/time types (OffsetTime, Duration, LocalTime) now map by default
    to the correct OpenAPI Formats Registry strings ("time", "duration", "time-local")
    instead of an unusable expanded object. (#​5172)
  • LocalDateTime deserialization from an existing OpenAPI spec now correctly
    round-trips through the new TimeSchema/DurationSchema/DateTimeLocalSchema/
    TimeLocalSchema classes instead of falling back to a generic StringSchema.
Added
  • PrimitiveType.enableJava8Formats() — opt-in to map LocalDateTime to the
    registry-compliant "date-time-local" format (default remains "date-time"
    for backward compatibility).
Deprecated
  • PrimitiveType.enablePartialTime() — prefer the new default "time-local"
    mapping for LocalTime; kept for callers who specifically need the
    non-registry "partial-time" format.

v2.2.53: Swagger-core 2.2.53 released!

  • chore: update Jackson to 2.22.1 (#​5258)
  • refactor: replace writer(new DefaultPrettyPrinter()) with writerWithDefaultPrettyPrinter() (#​5252)
  • fix: Stabilize CI Maven and Gradle builds (#​5238)
  • test: remove system.out.println from tests (#​5236)
  • chore: bump dependencies (#​5229)
  • refactor: simplify type handling in ModelDeserializer (#​5227)
  • Revert "hotfix: temporarily allow Release workflow to skip mvn deploy to recover 2.2.52 (#​5220)" (#​5223)
  • chore(deps-dev): bump org.codehaus.groovy:groovy from 3.0.23 to 3.0.25 (#​5216)
  • chore(deps): bump commons-cli:commons-cli from 1.9.0 to 1.11.0 (#​5209)
  • chore(deps-dev): bump commons-codec:commons-codec from 1.17.2 to 1.22.0 (#​5208)
  • fix: emit $ref for array items when cycle guard suppresses implementation processing (#​5205)
  • Restore inner property name from map key in handleUnwrapped (#​5193)
  • Honor PropertyNamingStrategy for get/is-prefixed property names (#​5192)
  • fix: let explicit @​Schema(format) override type-derived format (#​5185) (#​5186)
  • docs: update format of javadoc to produce a functional link (#​5182)
  • fix: exclude overridable annotation values when parsing composed annotations (#​5179)
  • fix: negative and positive validation annotations uses relevant OAS 3.1 syntax ( #​5170) (#​5171)
spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)

v4.10.4

Compare Source

Fixed
  • Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#​3884)
  • Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#​3483)
  • Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#​4201)
  • Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#​4237)
  • Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#​4244)
  • Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#​4246)
  • Stop publishing global dependency-management constraints to consumer POMs. (#​4223)

v4.10.3

Compare Source

Fixed
  • Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix message for UNS_UNSAFE_CALL bug pattern
  • Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#​4191)
  • Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#​4034)
  • Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#​4059)
Changed
  • Ant FindBugsViewerTask: use default look and feel by default. (#​4165)
Refactor
  • Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#​4165)
microsoft/onnxruntime (com.microsoft.onnxruntime:onnxruntime)

v1.29.0: ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#​29716, #​31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#​27379, #​29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#​29395).

Security Fixes

Path, bounds, and input validation
Supply chain and tooling
  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#​29827, #​29926, #​31192).

New Features

Core APIs & Runtime
  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#​29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#​29607, #​29799, #​31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#​29261, #​31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#​29555, #​29558, #​29569, #​29571).
Execution Provider ABI & Plugin EPs
  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#​29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#​31635, #​31722, #​31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#​29634, #​29770).

Execution Provider Updates

NVIDIA CUDA EP
Attention and decoding
  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#​29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#​29900, #​29904, #​31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#​29715, #​29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#​29525, #​31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#​31982).
MoE and quantized GEMM
Operators and collectives
  • Added LinearAttentionGate, GatedRMSNorm, and GatedAdd contrib operators (#​31158, #​31835).
  • Added bfloat16 support to AllReduce, AllGather, and AllToAll (#​31571).
  • Fixed the default zero point in CUDA GatherBlockQuantized (#​31693).
WebGPU EP
WebNN EP
  • Added uint8-packed 4-bit GatherBlockQuantized and LpNormalization, reused the shared WASM loader for Blob-backed external data, and fixed per-axis QDQ and MatMulNBits edge cases (#​29475, #​29801, #​31151, #​31152, #​31197).
OpenVINO / QNN / DML / XNNPACK / TensorRT
  • OpenVINO fixed float16 constant-output corruption and output-name routing, added dot-separated KV-cache names to the stateful transform, and corrected raw-data-backed float initializer handling (#​29729, #​29882, #​29895, #​31138).
  • QNN added a reshape handler for split-axis reshapes (#​29660).
  • DML fixed wide-string handling and made fused graph kernels own their model paths (#​31656, #​31664).
  • XNNPACK now reads dynamic Gemm M from the input tensor at compute time (#​31189).
  • TensorRT deduplicated context-path handling and added a build option for fused-attention cubins (#​29640, #​31632).

CPU & Core Optimizations

MLAS
  • Added Arm64 half-precision GEMM and convolution support through KleidiAI, including FP16 MatMul/Gemm/Conv paths and asymmetric Q4 and SME2 MatMulNBits kernels (#​28786, #​29654, #​29709, #​29898).
  • Added a RISC-V RVV QNBitGemm backend, an Arm64 NEON fp32 RoPE kernel, portable SVE elementwise kernels with FEXPA exp, and Arm64 UDOT routing for S8U8 QGEMM (#​29537, #​29787, #​29836, #​31145).
  • Added AVX2/VNNI 2-bit weight kernels and vectorized 2-bit dequantization, and improved fp16 MatMulNBits paths by avoiding fp32 temporaries and writing fp16 output directly across 2-, 4-, and 8-bit paths (#​29619, #​29766, #​29791, #​29842, #​29864, #​29901).
CPU Attention & Kernels
  • Improved masked Attention performance, enabled CPU FlashAttention on Linux Arm64 through L2-cache detection, and added FP16 GQA with quantized KV cache (#​29621, #​29719, #​29825).
  • Added double support to CPU Cos and int32 support to CPU Trilu, and fixed int8 QLinearSoftmax saturation and AvgPool ceil_mode/count_include_pad behavior (#​28975, #​29476, #​29629, #​29728).
  • Fixed TfIdfVectorizer weight indexing and skipped MinLength logits-processor construction when eos_token_id is negative (#​29604, #​31649).
  • Tightened K/V and cache-indirection shape contracts in CPU Attention and MultiHeadAttention, and fixed LinearAttention output shape inference for grouped-query attention (#​29892, #​31190, #​31634).
Graph, Optimizer, and Runtime
  • Extended reshape fusion, fixed double recursion in subgraph type/shape inference, and made constant-folding output deterministic (#​29027, #​29617, #​29789).
  • Fixed in-memory external initializer loading, memory-pattern allocation stream selection, and a leak in GetOverridableInitializerNames() (#​29349, #​29589, #​29616).
  • Reduced small MatMul batch allocations and redundant LUT initialization (#​29085, #​29690).
  • Fixed static-initialization-order crashes when importing ONNX Runtime and reduced eager runtime initialization (#​29880, #​31964).
  • Negative CPU Split axes now produce an error instead of being accepted (#​31149).

Web & JavaScript

  • Added on-demand loading of Blob-backed external data in JSPI builds (#​29477).
  • Fixed JSEP pooling output shape for ceil_mode, allowed DFT to ignore excess input data, and fixed a webpack/Terser release-build crash (#​29627, #​29680, #​31652).

Build, Packaging & CI

  • CUDA package architecture selections are now aligned across plugin EP, Python, C API, TensorRT, and Node.js pipelines. Windows arm64 is only available in CUDA plugin EP (#​31992):

    OSCUDACUDA architectures (all in -real form)
    Linux x6412.860;70;75;80;86;89;90a;120a
    Linux x6413.x75;80;86;89;90a;120a
    Linux aarch6413.x89;90a;120a;121a
    Windows x6412.861;75;86;89;120a
    Windows x6413.x75;80;86;89;120a
    Windows arm6413.x120a;121a
  • Reduced CUDA compilation time and memory usage by splitting generated SM80 MoE, fpA_intB, and MatMulNBits translation units and adding two-level workspace estimation (#​29614, #​29699, #​29811, #​31834, #​31837).

  • Fixed CUDA 13 plugin and packaging builds on Windows, Linux, and Windows ARM64, including MSVC/TMA compatibility and CI memory limits (#​31608, #​31609, #​31615, #​31616, #​31617, #​31622, #​31729, #​31748).

  • Fixed MLAS AVX2 builds on toolchains without AVX-VNNI assembler support, GCC 15 -Werror builds, and an MSVC C1001 issue in the W2 AVX-512-VNNI dispatch path (#​28767, #​29679, #​29885).

  • Improved Windows compatibility by skipping DXGI discovery when Win32k system calls are unavailable and delay-loading shell32 (#​29755, #​30889).

  • Fixed Dawn parallel-build races, and GPU discovery in build/test environments (#​29858, #​29866).

Contributors

Thanks to our 63 contributors for this release!

@​adrastogi, @​ahsan-ca, @​AngelGalindo7, @​ankitm3k, @​apsonawane, @​blazingphoenix7, @​bmehta001, @​chilo-ms, @​claude, @​daijh, @​ducviet00, @​edgchen1, @​elwhyjay, @​eserscor, @​GopalakrishnanN, @​guptaishaan, @​hariharans29, @​Honry, @​huningxin, @​jchen10, @​jiafatom, @​jiangzhuo, @​Jiawei-Shao, @​JonathanC-ARM, @​justinchuby, @​kjg0724, @​kunal-vaishnavi, @​kylo5aby, @​Laan33, @​martin-klacer-arm, @​mastryukov1990, @​mcollinswisc, @​miaobin, @​mingmingtasd, @​mirounga, @​mustjab, @​n1harika, @​namgyu-youn, @​neilmsft, @​nenad1002, @​nicholascelestin, @​OscarFree, @​prathikr, @​qjia7, @​quic-muchhsu, @​Sammy-Dabbas, @​sanaa-hamel-microsoft, @​shiyi9801, @​skottmckay, @​tairenpiao, @​TedThemistokleous, @​the0cp, @​tianleiwu, @​titaiwangms, @​velonica0, @​wangw-1991, @​wuisabel-gif, @​xadupre, @​xhcao, @​xiaofeihan1, @​xiaoyu-work, @​yen-shi, @​zlma7001

Full Changelog: v1.28.0...v1.29.0

v1.28.0: ONNX Runtime v1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#​29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
    • CUDA_QUANT_PREPROCESS is off by default (#​29687).
  • NPM packages are now published from the CUDA 13 pipeline (#​28773).
  • The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation
  • Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
  • Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
  • Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
  • Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
  • Validated Col2Im inputs to prevent heap over-read (#​28706)
  • Hardened CropAndResize against malformed crop_size tensors (#​28766)
  • Validated BeamSearchvocab_size against logits width (#​28774)
  • Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
  • Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
  • Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
  • Clamped 1D attention mask_index to valid bounds (#​29449)
  • Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
  • Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
  • Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
  • Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
  • Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
  • Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
  • Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
  • Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
  • Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)
Integer overflow & allocation size
  • Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
  • Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
  • Hardened QMoE against integer overflow and partial K tiles (#​29067)
  • Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
  • Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
  • Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
  • Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)
Supply chain & tooling

New Features

Execution Provider ABI & Plugin EPs
  • Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#​28271, #​28989, #​29501)
  • Added an API to select the best compiled-model compatibility info from candidate strings (#​28387)
  • Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#​28624)
  • Implemented name-based partitioning with accompanying documentation (#​28903)
  • Added Linux NPU discovery through sysfs accel devices (#​28703)
  • Relaxed CompileModel validation to accept zero-input OrtModel graphs (#​28771)
  • CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#​29221, #​29244, #​28896, #​28789)
  • WebGPU plugin EP version bumped to 0.3.0 (#​29056)
Core APIs & Runtime
  • Added OrtErrorCode documentation, single-sourced the values so StatusCode stays in sync, and added OrtErrorCode::ORT_DEVICE_RESET (#​29018, #​29065, #​29748)
  • Added memory statistics to profiling output (#​29058)
  • Added EP version logging on inference failure, in the EpDeviceUsage event, and ORT version logging (#​28794)
  • User-supplied external initializers are now used in place when already on the planned device (#​29013)
  • model_external_initializers_file_folder_path is now honored for file-path model loads (#​29459)
  • Added a Python API for HOST_ACCESSIBLEOrtValue allocation (#​28038)
Quantization Tooling
  • Added CudaQuantizer to onnxruntime.quantization (#​29509)
  • Registered Flatten as a Direct8Bit op in the Python QDQ static quantizer (#​28340)
  • Skipped MaxPool during FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#​28488, #​29350)
  • Added Float16/BFloat16/Float8 support in the TensorArray custom op (#​28335)
  • Clarified CPU parameter recommendations in the quantization docs (#​28415)

Execution Provider Updates

NVIDIA CUDA EP

Attention & LLM decode

  • Enabled XQA by default for FP16/BF16 GroupQueryAttention, and extended XQA decode with attention sink, sliding window, and QK-Norm support (#​29046, #​29162, #​29177, #​29186)
  • Upgraded cudnn_frontend to 1.24 and enabled cuDNN SDPA for MHA/GQA (#​28849)
  • Added decode-optimized LinearAttention (GatedDeltaNet) kernels (#​28985)
  • Optimized FlashDecode split planning for local-window GQA and fixed Flash/Lean attention split heuristics (#​29161, #​29554)
  • Updated the GroupQueryAttention contrib op documentation (#​29173)

MoE & quantized GEMM

  • Prepacked int4/int8 QMoE expert weights in the PrePack hook, symmetric with MatMulNBits, and fix

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 9am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot

@solrbot

Copy link
Copy Markdown
CollaboratorAuthor

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

@solrbot
solrbotforce-pushed the renovate/all-non-major-dependencies branch from 44a0e97 to 7fa382aCompareSeptember 1, 2026 08:28
@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

It must be the first day of the month! Look at all these lovely updates grouped together.. Adn the tests pass!

@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

I think a refinement would be to integrae the dangling licenses clean up logic. There are ten licenses that no longer are needed... I'll manually remove them and commit. But maybe we can tuen the job to do it as well?

So this is a real gap, not a Renovate misconfiguration — nothing in the pipeline (Renovate's postUpgradeTasks, or the Gradle build itself) is designed to catch this automatically; it only surfaces when someone runs check (or checkDanglingLicenseFiles) by hand, as you just did. If you want to close the gap, the cheapest fix is adding ./gradlew checkDanglingLicenseFiles to postUpgradeTasks.commands so Renovate's branch build fails loudly (forcing manual attention) instead of silently opening a red-CI PR — actually auto-deleting would need a new Gradle task, which is more invasive for something this infrequent.

@epugh
epugh requested a review from janhoySeptember 1, 2026 10:53
@@ -0,0 +1,7 @@
title: Update all non-major dependencies

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These auto generated changelog files are not very precise for grouped updates.

So either skip changelog for this, or edit the title with a comma separated list of all deps upgraded.

And realistically we will already have changelog files in unreleased folder touching many of the same libs, so there will be duplicates. Perhaps there is no avoiding the RM having to de-duplicate by hand (or LLM) before a release, so that each dependency bump is mentioned only once and with the actual latest version.

And David wants no dependency_update entries at all, while I believe they are important, although perhaps noisy and a bit annoying to keep up to date. Will need to discuss this more elsewhere...

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. I can't imagine that a meaningful useful changelog can be made either a editorial step. I am hoping we get to a point that these rote Solr bot prs do not require human intervention unless the tests fail.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I sent a follow up to my email asking how we want to handle thise: https://lists.apache.org/thread/gp56nzp4hl2v757q0j54pzd7dnywy21n

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, just skip the changelog for this PR, leave it to RM to clean up

@epugh

epugh commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

I am inclined to just remove the changelog, until we get more agreement... so that I can get this merged.... Or do you think ishould wait?

@epugh
epugh merged commit 100431c into apache:mainSep 2, 2026
7 of 8 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@solrbot@epugh@janhoy
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

Update all non-major dependencies - #4842

Merged
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies
Sep 2, 2026
Merged

Update all non-major dependencies#4842
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies

Conversation

@solrbot

Copy link
Copy Markdown
Collaborator

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageTypeUpdateChangePending
org.threeten:threetenbp (source)dependenciespatch1.7.31.7.4
io.swagger.core.v3.swagger-gradle-pluginpluginpatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-jaxrs2-jakartadependenciespatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-annotations-jakartadependenciespatch2.2.522.2.542.2.55
com.github.spotbugs:spotbugs-annotations (source)dependenciespatch4.10.24.10.4
org.openapi.generatorpluginminor7.23.07.25.0
com.microsoft.onnxruntime:onnxruntime (source)dependenciesminor1.26.01.29.0
io.nlopez.compose.rules:ktlintdependenciespatch0.6.20.6.4
no.nav.security:mock-oauth2-serverdependenciespatch5.0.15.0.2
net.ltgt.errorpronepluginpatch5.1.05.1.1
dev.logchangepluginpatch1.19.151.19.16
nl.littlerobots.version-catalog-updatepluginpatch1.1.01.1.1
dev.langchain4j:langchain4j-bom (source)dependenciesminor1.17.01.19.0
joda-time:joda-time (source)dependenciespatch2.14.22.14.3
org.jctools:jctools-core (source)dependenciespatch4.0.64.0.7
com.google.guava:guavadependenciesminor33.6.0-jre33.7.1-jre
org.eclipse.jgit:org.eclipse.jgitdependenciespatch7.7.0.202606012155-r7.7.1.202607240634-r
com.diffplug.spotlesspluginminor8.7.08.10.08.10.1
com.nvidia.cuvs:cuvs-java (source)dependenciesminor26.06.026.08.1
commons-codec:commons-codec (source)dependenciespatch1.22.01.22.1
org.checkerframework:checker-qual (source)dependenciespatch4.2.04.2.2
com.carrotsearch:hppcdependenciesminor0.10.00.11.1
org.bouncycastle:bcprov-jdk18on (source)dependenciesminor1.841.85.2
org.bouncycastle:bcpkix-jdk18on (source)dependenciesminor1.841.85
com.github.ben-manes.versionspluginminor0.54.00.61.0
org.apache.tika:tika-core (source)dependenciespatch3.3.13.3.2
org.apache.opennlp:opennlp-tools (source)dependenciespatch2.5.102.5.11
org.apache.opennlp:opennlp-dl (source)dependenciespatch2.5.102.5.11
org.apache.commons:commons-collections4 (source)dependenciesminor4.5.04.6.0
com.adobe.testing:s3mock-testcontainersdependenciesminor5.1.05.2.0

Release Notes

ThreeTen/threetenbp (org.threeten:threetenbp)

v1.7.4

See the change notes for more information.

swagger-api/swagger-core (io.swagger.core.v3:swagger-jaxrs2-jakarta)

v2.2.54

Fixed
  • Java 8 date/time types (OffsetTime, Duration, LocalTime) now map by default
    to the correct OpenAPI Formats Registry strings ("time", "duration", "time-local")
    instead of an unusable expanded object. (#​5172)
  • LocalDateTime deserialization from an existing OpenAPI spec now correctly
    round-trips through the new TimeSchema/DurationSchema/DateTimeLocalSchema/
    TimeLocalSchema classes instead of falling back to a generic StringSchema.
Added
  • PrimitiveType.enableJava8Formats() — opt-in to map LocalDateTime to the
    registry-compliant "date-time-local" format (default remains "date-time"
    for backward compatibility).
Deprecated
  • PrimitiveType.enablePartialTime() — prefer the new default "time-local"
    mapping for LocalTime; kept for callers who specifically need the
    non-registry "partial-time" format.

v2.2.53: Swagger-core 2.2.53 released!

  • chore: update Jackson to 2.22.1 (#​5258)
  • refactor: replace writer(new DefaultPrettyPrinter()) with writerWithDefaultPrettyPrinter() (#​5252)
  • fix: Stabilize CI Maven and Gradle builds (#​5238)
  • test: remove system.out.println from tests (#​5236)
  • chore: bump dependencies (#​5229)
  • refactor: simplify type handling in ModelDeserializer (#​5227)
  • Revert "hotfix: temporarily allow Release workflow to skip mvn deploy to recover 2.2.52 (#​5220)" (#​5223)
  • chore(deps-dev): bump org.codehaus.groovy:groovy from 3.0.23 to 3.0.25 (#​5216)
  • chore(deps): bump commons-cli:commons-cli from 1.9.0 to 1.11.0 (#​5209)
  • chore(deps-dev): bump commons-codec:commons-codec from 1.17.2 to 1.22.0 (#​5208)
  • fix: emit $ref for array items when cycle guard suppresses implementation processing (#​5205)
  • Restore inner property name from map key in handleUnwrapped (#​5193)
  • Honor PropertyNamingStrategy for get/is-prefixed property names (#​5192)
  • fix: let explicit @​Schema(format) override type-derived format (#​5185) (#​5186)
  • docs: update format of javadoc to produce a functional link (#​5182)
  • fix: exclude overridable annotation values when parsing composed annotations (#​5179)
  • fix: negative and positive validation annotations uses relevant OAS 3.1 syntax ( #​5170) (#​5171)
spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)

v4.10.4

Compare Source

Fixed
  • Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#​3884)
  • Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#​3483)
  • Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#​4201)
  • Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#​4237)
  • Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#​4244)
  • Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#​4246)
  • Stop publishing global dependency-management constraints to consumer POMs. (#​4223)

v4.10.3

Compare Source

Fixed
  • Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix message for UNS_UNSAFE_CALL bug pattern
  • Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#​4191)
  • Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#​4034)
  • Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#​4059)
Changed
  • Ant FindBugsViewerTask: use default look and feel by default. (#​4165)
Refactor
  • Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#​4165)
microsoft/onnxruntime (com.microsoft.onnxruntime:onnxruntime)

v1.29.0: ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#​29716, #​31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#​27379, #​29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#​29395).

Security Fixes

Path, bounds, and input validation
Supply chain and tooling
  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#​29827, #​29926, #​31192).

New Features

Core APIs & Runtime
  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#​29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#​29607, #​29799, #​31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#​29261, #​31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#​29555, #​29558, #​29569, #​29571).
Execution Provider ABI & Plugin EPs
  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#​29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#​31635, #​31722, #​31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#​29634, #​29770).

Execution Provider Updates

NVIDIA CUDA EP
Attention and decoding
  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#​29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#​29900, #​29904, #​31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#​29715, #​29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#​29525, #​31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#​31982).
MoE and quantized GEMM
Operators and collectives
  • Added LinearAttentionGate, GatedRMSNorm, and GatedAdd contrib operators (#​31158, #​31835).
  • Added bfloat16 support to AllReduce, AllGather, and AllToAll (#​31571).
  • Fixed the default zero point in CUDA GatherBlockQuantized (#​31693).
WebGPU EP
WebNN EP
  • Added uint8-packed 4-bit GatherBlockQuantized and LpNormalization, reused the shared WASM loader for Blob-backed external data, and fixed per-axis QDQ and MatMulNBits edge cases (#​29475, #​29801, #​31151, #​31152, #​31197).
OpenVINO / QNN / DML / XNNPACK / TensorRT
  • OpenVINO fixed float16 constant-output corruption and output-name routing, added dot-separated KV-cache names to the stateful transform, and corrected raw-data-backed float initializer handling (#​29729, #​29882, #​29895, #​31138).
  • QNN added a reshape handler for split-axis reshapes (#​29660).
  • DML fixed wide-string handling and made fused graph kernels own their model paths (#​31656, #​31664).
  • XNNPACK now reads dynamic Gemm M from the input tensor at compute time (#​31189).
  • TensorRT deduplicated context-path handling and added a build option for fused-attention cubins (#​29640, #​31632).

CPU & Core Optimizations

MLAS
  • Added Arm64 half-precision GEMM and convolution support through KleidiAI, including FP16 MatMul/Gemm/Conv paths and asymmetric Q4 and SME2 MatMulNBits kernels (#​28786, #​29654, #​29709, #​29898).
  • Added a RISC-V RVV QNBitGemm backend, an Arm64 NEON fp32 RoPE kernel, portable SVE elementwise kernels with FEXPA exp, and Arm64 UDOT routing for S8U8 QGEMM (#​29537, #​29787, #​29836, #​31145).
  • Added AVX2/VNNI 2-bit weight kernels and vectorized 2-bit dequantization, and improved fp16 MatMulNBits paths by avoiding fp32 temporaries and writing fp16 output directly across 2-, 4-, and 8-bit paths (#​29619, #​29766, #​29791, #​29842, #​29864, #​29901).
CPU Attention & Kernels
  • Improved masked Attention performance, enabled CPU FlashAttention on Linux Arm64 through L2-cache detection, and added FP16 GQA with quantized KV cache (#​29621, #​29719, #​29825).
  • Added double support to CPU Cos and int32 support to CPU Trilu, and fixed int8 QLinearSoftmax saturation and AvgPool ceil_mode/count_include_pad behavior (#​28975, #​29476, #​29629, #​29728).
  • Fixed TfIdfVectorizer weight indexing and skipped MinLength logits-processor construction when eos_token_id is negative (#​29604, #​31649).
  • Tightened K/V and cache-indirection shape contracts in CPU Attention and MultiHeadAttention, and fixed LinearAttention output shape inference for grouped-query attention (#​29892, #​31190, #​31634).
Graph, Optimizer, and Runtime
  • Extended reshape fusion, fixed double recursion in subgraph type/shape inference, and made constant-folding output deterministic (#​29027, #​29617, #​29789).
  • Fixed in-memory external initializer loading, memory-pattern allocation stream selection, and a leak in GetOverridableInitializerNames() (#​29349, #​29589, #​29616).
  • Reduced small MatMul batch allocations and redundant LUT initialization (#​29085, #​29690).
  • Fixed static-initialization-order crashes when importing ONNX Runtime and reduced eager runtime initialization (#​29880, #​31964).
  • Negative CPU Split axes now produce an error instead of being accepted (#​31149).

Web & JavaScript

  • Added on-demand loading of Blob-backed external data in JSPI builds (#​29477).
  • Fixed JSEP pooling output shape for ceil_mode, allowed DFT to ignore excess input data, and fixed a webpack/Terser release-build crash (#​29627, #​29680, #​31652).

Build, Packaging & CI

  • CUDA package architecture selections are now aligned across plugin EP, Python, C API, TensorRT, and Node.js pipelines. Windows arm64 is only available in CUDA plugin EP (#​31992):

    OSCUDACUDA architectures (all in -real form)
    Linux x6412.860;70;75;80;86;89;90a;120a
    Linux x6413.x75;80;86;89;90a;120a
    Linux aarch6413.x89;90a;120a;121a
    Windows x6412.861;75;86;89;120a
    Windows x6413.x75;80;86;89;120a
    Windows arm6413.x120a;121a
  • Reduced CUDA compilation time and memory usage by splitting generated SM80 MoE, fpA_intB, and MatMulNBits translation units and adding two-level workspace estimation (#​29614, #​29699, #​29811, #​31834, #​31837).

  • Fixed CUDA 13 plugin and packaging builds on Windows, Linux, and Windows ARM64, including MSVC/TMA compatibility and CI memory limits (#​31608, #​31609, #​31615, #​31616, #​31617, #​31622, #​31729, #​31748).

  • Fixed MLAS AVX2 builds on toolchains without AVX-VNNI assembler support, GCC 15 -Werror builds, and an MSVC C1001 issue in the W2 AVX-512-VNNI dispatch path (#​28767, #​29679, #​29885).

  • Improved Windows compatibility by skipping DXGI discovery when Win32k system calls are unavailable and delay-loading shell32 (#​29755, #​30889).

  • Fixed Dawn parallel-build races, and GPU discovery in build/test environments (#​29858, #​29866).

Contributors

Thanks to our 63 contributors for this release!

@​adrastogi, @​ahsan-ca, @​AngelGalindo7, @​ankitm3k, @​apsonawane, @​blazingphoenix7, @​bmehta001, @​chilo-ms, @​claude, @​daijh, @​ducviet00, @​edgchen1, @​elwhyjay, @​eserscor, @​GopalakrishnanN, @​guptaishaan, @​hariharans29, @​Honry, @​huningxin, @​jchen10, @​jiafatom, @​jiangzhuo, @​Jiawei-Shao, @​JonathanC-ARM, @​justinchuby, @​kjg0724, @​kunal-vaishnavi, @​kylo5aby, @​Laan33, @​martin-klacer-arm, @​mastryukov1990, @​mcollinswisc, @​miaobin, @​mingmingtasd, @​mirounga, @​mustjab, @​n1harika, @​namgyu-youn, @​neilmsft, @​nenad1002, @​nicholascelestin, @​OscarFree, @​prathikr, @​qjia7, @​quic-muchhsu, @​Sammy-Dabbas, @​sanaa-hamel-microsoft, @​shiyi9801, @​skottmckay, @​tairenpiao, @​TedThemistokleous, @​the0cp, @​tianleiwu, @​titaiwangms, @​velonica0, @​wangw-1991, @​wuisabel-gif, @​xadupre, @​xhcao, @​xiaofeihan1, @​xiaoyu-work, @​yen-shi, @​zlma7001

Full Changelog: v1.28.0...v1.29.0

v1.28.0: ONNX Runtime v1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#​29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
    • CUDA_QUANT_PREPROCESS is off by default (#​29687).
  • NPM packages are now published from the CUDA 13 pipeline (#​28773).
  • The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation
  • Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
  • Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
  • Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
  • Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
  • Validated Col2Im inputs to prevent heap over-read (#​28706)
  • Hardened CropAndResize against malformed crop_size tensors (#​28766)
  • Validated BeamSearchvocab_size against logits width (#​28774)
  • Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
  • Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
  • Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
  • Clamped 1D attention mask_index to valid bounds (#​29449)
  • Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
  • Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
  • Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
  • Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
  • Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
  • Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
  • Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
  • Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
  • Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)
Integer overflow & allocation size
  • Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
  • Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
  • Hardened QMoE against integer overflow and partial K tiles (#​29067)
  • Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
  • Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
  • Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
  • Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)
Supply chain & tooling

New Features

Execution Provider ABI & Plugin EPs
  • Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#​28271, #​28989, #​29501)
  • Added an API to select the best compiled-model compatibility info from candidate strings (#​28387)
  • Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#​28624)
  • Implemented name-based partitioning with accompanying documentation (#​28903)
  • Added Linux NPU discovery through sysfs accel devices (#​28703)
  • Relaxed CompileModel validation to accept zero-input OrtModel graphs (#​28771)
  • CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#​29221, #​29244, #​28896, #​28789)
  • WebGPU plugin EP version bumped to 0.3.0 (#​29056)
Core APIs & Runtime
  • Added OrtErrorCode documentation, single-sourced the values so StatusCode stays in sync, and added OrtErrorCode::ORT_DEVICE_RESET (#​29018, #​29065, #​29748)
  • Added memory statistics to profiling output (#​29058)
  • Added EP version logging on inference failure, in the EpDeviceUsage event, and ORT version logging (#​28794)
  • User-supplied external initializers are now used in place when already on the planned device (#​29013)
  • model_external_initializers_file_folder_path is now honored for file-path model loads (#​29459)
  • Added a Python API for HOST_ACCESSIBLEOrtValue allocation (#​28038)
Quantization Tooling
  • Added CudaQuantizer to onnxruntime.quantization (#​29509)
  • Registered Flatten as a Direct8Bit op in the Python QDQ static quantizer (#​28340)
  • Skipped MaxPool during FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#​28488, #​29350)
  • Added Float16/BFloat16/Float8 support in the TensorArray custom op (#​28335)
  • Clarified CPU parameter recommendations in the quantization docs (#​28415)

Execution Provider Updates

NVIDIA CUDA EP

Attention & LLM decode

  • Enabled XQA by default for FP16/BF16 GroupQueryAttention, and extended XQA decode with attention sink, sliding window, and QK-Norm support (#​29046, #​29162, #​29177, #​29186)
  • Upgraded cudnn_frontend to 1.24 and enabled cuDNN SDPA for MHA/GQA (#​28849)
  • Added decode-optimized LinearAttention (GatedDeltaNet) kernels (#​28985)
  • Optimized FlashDecode split planning for local-window GQA and fixed Flash/Lean attention split heuristics (#​29161, #​29554)
  • Updated the GroupQueryAttention contrib op documentation (#​29173)

MoE & quantized GEMM

  • Prepacked int4/int8 QMoE expert weights in the PrePack hook, symmetric with MatMulNBits, and fix

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 9am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot

@solrbot

Copy link
Copy Markdown
CollaboratorAuthor

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

@solrbot
solrbotforce-pushed the renovate/all-non-major-dependencies branch from 44a0e97 to 7fa382aCompareSeptember 1, 2026 08:28
@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

It must be the first day of the month! Look at all these lovely updates grouped together.. Adn the tests pass!

@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

I think a refinement would be to integrae the dangling licenses clean up logic. There are ten licenses that no longer are needed... I'll manually remove them and commit. But maybe we can tuen the job to do it as well?

So this is a real gap, not a Renovate misconfiguration — nothing in the pipeline (Renovate's postUpgradeTasks, or the Gradle build itself) is designed to catch this automatically; it only surfaces when someone runs check (or checkDanglingLicenseFiles) by hand, as you just did. If you want to close the gap, the cheapest fix is adding ./gradlew checkDanglingLicenseFiles to postUpgradeTasks.commands so Renovate's branch build fails loudly (forcing manual attention) instead of silently opening a red-CI PR — actually auto-deleting would need a new Gradle task, which is more invasive for something this infrequent.

@epugh
epugh requested a review from janhoySeptember 1, 2026 10:53
@@ -0,0 +1,7 @@
title: Update all non-major dependencies

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These auto generated changelog files are not very precise for grouped updates.

So either skip changelog for this, or edit the title with a comma separated list of all deps upgraded.

And realistically we will already have changelog files in unreleased folder touching many of the same libs, so there will be duplicates. Perhaps there is no avoiding the RM having to de-duplicate by hand (or LLM) before a release, so that each dependency bump is mentioned only once and with the actual latest version.

And David wants no dependency_update entries at all, while I believe they are important, although perhaps noisy and a bit annoying to keep up to date. Will need to discuss this more elsewhere...

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. I can't imagine that a meaningful useful changelog can be made either a editorial step. I am hoping we get to a point that these rote Solr bot prs do not require human intervention unless the tests fail.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I sent a follow up to my email asking how we want to handle thise: https://lists.apache.org/thread/gp56nzp4hl2v757q0j54pzd7dnywy21n

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, just skip the changelog for this PR, leave it to RM to clean up

@epugh

epugh commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

I am inclined to just remove the changelog, until we get more agreement... so that I can get this merged.... Or do you think ishould wait?

@epugh
epugh merged commit 100431c into apache:mainSep 2, 2026
7 of 8 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@solrbot@epugh@janhoy
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Update all non-major dependencies - #4842

Merged
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies
Sep 2, 2026
Merged

Update all non-major dependencies#4842
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies

Conversation

@solrbot

Copy link
Copy Markdown
Collaborator

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageTypeUpdateChangePending
org.threeten:threetenbp (source)dependenciespatch1.7.31.7.4
io.swagger.core.v3.swagger-gradle-pluginpluginpatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-jaxrs2-jakartadependenciespatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-annotations-jakartadependenciespatch2.2.522.2.542.2.55
com.github.spotbugs:spotbugs-annotations (source)dependenciespatch4.10.24.10.4
org.openapi.generatorpluginminor7.23.07.25.0
com.microsoft.onnxruntime:onnxruntime (source)dependenciesminor1.26.01.29.0
io.nlopez.compose.rules:ktlintdependenciespatch0.6.20.6.4
no.nav.security:mock-oauth2-serverdependenciespatch5.0.15.0.2
net.ltgt.errorpronepluginpatch5.1.05.1.1
dev.logchangepluginpatch1.19.151.19.16
nl.littlerobots.version-catalog-updatepluginpatch1.1.01.1.1
dev.langchain4j:langchain4j-bom (source)dependenciesminor1.17.01.19.0
joda-time:joda-time (source)dependenciespatch2.14.22.14.3
org.jctools:jctools-core (source)dependenciespatch4.0.64.0.7
com.google.guava:guavadependenciesminor33.6.0-jre33.7.1-jre
org.eclipse.jgit:org.eclipse.jgitdependenciespatch7.7.0.202606012155-r7.7.1.202607240634-r
com.diffplug.spotlesspluginminor8.7.08.10.08.10.1
com.nvidia.cuvs:cuvs-java (source)dependenciesminor26.06.026.08.1
commons-codec:commons-codec (source)dependenciespatch1.22.01.22.1
org.checkerframework:checker-qual (source)dependenciespatch4.2.04.2.2
com.carrotsearch:hppcdependenciesminor0.10.00.11.1
org.bouncycastle:bcprov-jdk18on (source)dependenciesminor1.841.85.2
org.bouncycastle:bcpkix-jdk18on (source)dependenciesminor1.841.85
com.github.ben-manes.versionspluginminor0.54.00.61.0
org.apache.tika:tika-core (source)dependenciespatch3.3.13.3.2
org.apache.opennlp:opennlp-tools (source)dependenciespatch2.5.102.5.11
org.apache.opennlp:opennlp-dl (source)dependenciespatch2.5.102.5.11
org.apache.commons:commons-collections4 (source)dependenciesminor4.5.04.6.0
com.adobe.testing:s3mock-testcontainersdependenciesminor5.1.05.2.0

Release Notes

ThreeTen/threetenbp (org.threeten:threetenbp)

v1.7.4

See the change notes for more information.

swagger-api/swagger-core (io.swagger.core.v3:swagger-jaxrs2-jakarta)

v2.2.54

Fixed
  • Java 8 date/time types (OffsetTime, Duration, LocalTime) now map by default
    to the correct OpenAPI Formats Registry strings ("time", "duration", "time-local")
    instead of an unusable expanded object. (#​5172)
  • LocalDateTime deserialization from an existing OpenAPI spec now correctly
    round-trips through the new TimeSchema/DurationSchema/DateTimeLocalSchema/
    TimeLocalSchema classes instead of falling back to a generic StringSchema.
Added
  • PrimitiveType.enableJava8Formats() — opt-in to map LocalDateTime to the
    registry-compliant "date-time-local" format (default remains "date-time"
    for backward compatibility).
Deprecated
  • PrimitiveType.enablePartialTime() — prefer the new default "time-local"
    mapping for LocalTime; kept for callers who specifically need the
    non-registry "partial-time" format.

v2.2.53: Swagger-core 2.2.53 released!

  • chore: update Jackson to 2.22.1 (#​5258)
  • refactor: replace writer(new DefaultPrettyPrinter()) with writerWithDefaultPrettyPrinter() (#​5252)
  • fix: Stabilize CI Maven and Gradle builds (#​5238)
  • test: remove system.out.println from tests (#​5236)
  • chore: bump dependencies (#​5229)
  • refactor: simplify type handling in ModelDeserializer (#​5227)
  • Revert "hotfix: temporarily allow Release workflow to skip mvn deploy to recover 2.2.52 (#​5220)" (#​5223)
  • chore(deps-dev): bump org.codehaus.groovy:groovy from 3.0.23 to 3.0.25 (#​5216)
  • chore(deps): bump commons-cli:commons-cli from 1.9.0 to 1.11.0 (#​5209)
  • chore(deps-dev): bump commons-codec:commons-codec from 1.17.2 to 1.22.0 (#​5208)
  • fix: emit $ref for array items when cycle guard suppresses implementation processing (#​5205)
  • Restore inner property name from map key in handleUnwrapped (#​5193)
  • Honor PropertyNamingStrategy for get/is-prefixed property names (#​5192)
  • fix: let explicit @​Schema(format) override type-derived format (#​5185) (#​5186)
  • docs: update format of javadoc to produce a functional link (#​5182)
  • fix: exclude overridable annotation values when parsing composed annotations (#​5179)
  • fix: negative and positive validation annotations uses relevant OAS 3.1 syntax ( #​5170) (#​5171)
spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)

v4.10.4

Compare Source

Fixed
  • Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#​3884)
  • Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#​3483)
  • Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#​4201)
  • Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#​4237)
  • Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#​4244)
  • Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#​4246)
  • Stop publishing global dependency-management constraints to consumer POMs. (#​4223)

v4.10.3

Compare Source

Fixed
  • Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix message for UNS_UNSAFE_CALL bug pattern
  • Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#​4191)
  • Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#​4034)
  • Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#​4059)
Changed
  • Ant FindBugsViewerTask: use default look and feel by default. (#​4165)
Refactor
  • Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#​4165)
microsoft/onnxruntime (com.microsoft.onnxruntime:onnxruntime)

v1.29.0: ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#​29716, #​31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#​27379, #​29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#​29395).

Security Fixes

Path, bounds, and input validation
Supply chain and tooling
  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#​29827, #​29926, #​31192).

New Features

Core APIs & Runtime
  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#​29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#​29607, #​29799, #​31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#​29261, #​31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#​29555, #​29558, #​29569, #​29571).
Execution Provider ABI & Plugin EPs
  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#​29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#​31635, #​31722, #​31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#​29634, #​29770).

Execution Provider Updates

NVIDIA CUDA EP
Attention and decoding
  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#​29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#​29900, #​29904, #​31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#​29715, #​29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#​29525, #​31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#​31982).
MoE and quantized GEMM
Operators and collectives
  • Added LinearAttentionGate, GatedRMSNorm, and GatedAdd contrib operators (#​31158, #​31835).
  • Added bfloat16 support to AllReduce, AllGather, and AllToAll (#​31571).
  • Fixed the default zero point in CUDA GatherBlockQuantized (#​31693).
WebGPU EP
WebNN EP
  • Added uint8-packed 4-bit GatherBlockQuantized and LpNormalization, reused the shared WASM loader for Blob-backed external data, and fixed per-axis QDQ and MatMulNBits edge cases (#​29475, #​29801, #​31151, #​31152, #​31197).
OpenVINO / QNN / DML / XNNPACK / TensorRT
  • OpenVINO fixed float16 constant-output corruption and output-name routing, added dot-separated KV-cache names to the stateful transform, and corrected raw-data-backed float initializer handling (#​29729, #​29882, #​29895, #​31138).
  • QNN added a reshape handler for split-axis reshapes (#​29660).
  • DML fixed wide-string handling and made fused graph kernels own their model paths (#​31656, #​31664).
  • XNNPACK now reads dynamic Gemm M from the input tensor at compute time (#​31189).
  • TensorRT deduplicated context-path handling and added a build option for fused-attention cubins (#​29640, #​31632).

CPU & Core Optimizations

MLAS
  • Added Arm64 half-precision GEMM and convolution support through KleidiAI, including FP16 MatMul/Gemm/Conv paths and asymmetric Q4 and SME2 MatMulNBits kernels (#​28786, #​29654, #​29709, #​29898).
  • Added a RISC-V RVV QNBitGemm backend, an Arm64 NEON fp32 RoPE kernel, portable SVE elementwise kernels with FEXPA exp, and Arm64 UDOT routing for S8U8 QGEMM (#​29537, #​29787, #​29836, #​31145).
  • Added AVX2/VNNI 2-bit weight kernels and vectorized 2-bit dequantization, and improved fp16 MatMulNBits paths by avoiding fp32 temporaries and writing fp16 output directly across 2-, 4-, and 8-bit paths (#​29619, #​29766, #​29791, #​29842, #​29864, #​29901).
CPU Attention & Kernels
  • Improved masked Attention performance, enabled CPU FlashAttention on Linux Arm64 through L2-cache detection, and added FP16 GQA with quantized KV cache (#​29621, #​29719, #​29825).
  • Added double support to CPU Cos and int32 support to CPU Trilu, and fixed int8 QLinearSoftmax saturation and AvgPool ceil_mode/count_include_pad behavior (#​28975, #​29476, #​29629, #​29728).
  • Fixed TfIdfVectorizer weight indexing and skipped MinLength logits-processor construction when eos_token_id is negative (#​29604, #​31649).
  • Tightened K/V and cache-indirection shape contracts in CPU Attention and MultiHeadAttention, and fixed LinearAttention output shape inference for grouped-query attention (#​29892, #​31190, #​31634).
Graph, Optimizer, and Runtime
  • Extended reshape fusion, fixed double recursion in subgraph type/shape inference, and made constant-folding output deterministic (#​29027, #​29617, #​29789).
  • Fixed in-memory external initializer loading, memory-pattern allocation stream selection, and a leak in GetOverridableInitializerNames() (#​29349, #​29589, #​29616).
  • Reduced small MatMul batch allocations and redundant LUT initialization (#​29085, #​29690).
  • Fixed static-initialization-order crashes when importing ONNX Runtime and reduced eager runtime initialization (#​29880, #​31964).
  • Negative CPU Split axes now produce an error instead of being accepted (#​31149).

Web & JavaScript

  • Added on-demand loading of Blob-backed external data in JSPI builds (#​29477).
  • Fixed JSEP pooling output shape for ceil_mode, allowed DFT to ignore excess input data, and fixed a webpack/Terser release-build crash (#​29627, #​29680, #​31652).

Build, Packaging & CI

  • CUDA package architecture selections are now aligned across plugin EP, Python, C API, TensorRT, and Node.js pipelines. Windows arm64 is only available in CUDA plugin EP (#​31992):

    OSCUDACUDA architectures (all in -real form)
    Linux x6412.860;70;75;80;86;89;90a;120a
    Linux x6413.x75;80;86;89;90a;120a
    Linux aarch6413.x89;90a;120a;121a
    Windows x6412.861;75;86;89;120a
    Windows x6413.x75;80;86;89;120a
    Windows arm6413.x120a;121a
  • Reduced CUDA compilation time and memory usage by splitting generated SM80 MoE, fpA_intB, and MatMulNBits translation units and adding two-level workspace estimation (#​29614, #​29699, #​29811, #​31834, #​31837).

  • Fixed CUDA 13 plugin and packaging builds on Windows, Linux, and Windows ARM64, including MSVC/TMA compatibility and CI memory limits (#​31608, #​31609, #​31615, #​31616, #​31617, #​31622, #​31729, #​31748).

  • Fixed MLAS AVX2 builds on toolchains without AVX-VNNI assembler support, GCC 15 -Werror builds, and an MSVC C1001 issue in the W2 AVX-512-VNNI dispatch path (#​28767, #​29679, #​29885).

  • Improved Windows compatibility by skipping DXGI discovery when Win32k system calls are unavailable and delay-loading shell32 (#​29755, #​30889).

  • Fixed Dawn parallel-build races, and GPU discovery in build/test environments (#​29858, #​29866).

Contributors

Thanks to our 63 contributors for this release!

@​adrastogi, @​ahsan-ca, @​AngelGalindo7, @​ankitm3k, @​apsonawane, @​blazingphoenix7, @​bmehta001, @​chilo-ms, @​claude, @​daijh, @​ducviet00, @​edgchen1, @​elwhyjay, @​eserscor, @​GopalakrishnanN, @​guptaishaan, @​hariharans29, @​Honry, @​huningxin, @​jchen10, @​jiafatom, @​jiangzhuo, @​Jiawei-Shao, @​JonathanC-ARM, @​justinchuby, @​kjg0724, @​kunal-vaishnavi, @​kylo5aby, @​Laan33, @​martin-klacer-arm, @​mastryukov1990, @​mcollinswisc, @​miaobin, @​mingmingtasd, @​mirounga, @​mustjab, @​n1harika, @​namgyu-youn, @​neilmsft, @​nenad1002, @​nicholascelestin, @​OscarFree, @​prathikr, @​qjia7, @​quic-muchhsu, @​Sammy-Dabbas, @​sanaa-hamel-microsoft, @​shiyi9801, @​skottmckay, @​tairenpiao, @​TedThemistokleous, @​the0cp, @​tianleiwu, @​titaiwangms, @​velonica0, @​wangw-1991, @​wuisabel-gif, @​xadupre, @​xhcao, @​xiaofeihan1, @​xiaoyu-work, @​yen-shi, @​zlma7001

Full Changelog: v1.28.0...v1.29.0

v1.28.0: ONNX Runtime v1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#​29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
    • CUDA_QUANT_PREPROCESS is off by default (#​29687).
  • NPM packages are now published from the CUDA 13 pipeline (#​28773).
  • The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation
  • Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
  • Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
  • Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
  • Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
  • Validated Col2Im inputs to prevent heap over-read (#​28706)
  • Hardened CropAndResize against malformed crop_size tensors (#​28766)
  • Validated BeamSearchvocab_size against logits width (#​28774)
  • Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
  • Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
  • Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
  • Clamped 1D attention mask_index to valid bounds (#​29449)
  • Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
  • Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
  • Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
  • Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
  • Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
  • Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
  • Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
  • Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
  • Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)
Integer overflow & allocation size
  • Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
  • Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
  • Hardened QMoE against integer overflow and partial K tiles (#​29067)
  • Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
  • Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
  • Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
  • Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)
Supply chain & tooling

New Features

Execution Provider ABI & Plugin EPs
  • Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#​28271, #​28989, #​29501)
  • Added an API to select the best compiled-model compatibility info from candidate strings (#​28387)
  • Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#​28624)
  • Implemented name-based partitioning with accompanying documentation (#​28903)
  • Added Linux NPU discovery through sysfs accel devices (#​28703)
  • Relaxed CompileModel validation to accept zero-input OrtModel graphs (#​28771)
  • CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#​29221, #​29244, #​28896, #​28789)
  • WebGPU plugin EP version bumped to 0.3.0 (#​29056)
Core APIs & Runtime
  • Added OrtErrorCode documentation, single-sourced the values so StatusCode stays in sync, and added OrtErrorCode::ORT_DEVICE_RESET (#​29018, #​29065, #​29748)
  • Added memory statistics to profiling output (#​29058)
  • Added EP version logging on inference failure, in the EpDeviceUsage event, and ORT version logging (#​28794)
  • User-supplied external initializers are now used in place when already on the planned device (#​29013)
  • model_external_initializers_file_folder_path is now honored for file-path model loads (#​29459)
  • Added a Python API for HOST_ACCESSIBLEOrtValue allocation (#​28038)
Quantization Tooling
  • Added CudaQuantizer to onnxruntime.quantization (#​29509)
  • Registered Flatten as a Direct8Bit op in the Python QDQ static quantizer (#​28340)
  • Skipped MaxPool during FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#​28488, #​29350)
  • Added Float16/BFloat16/Float8 support in the TensorArray custom op (#​28335)
  • Clarified CPU parameter recommendations in the quantization docs (#​28415)

Execution Provider Updates

NVIDIA CUDA EP

Attention & LLM decode

  • Enabled XQA by default for FP16/BF16 GroupQueryAttention, and extended XQA decode with attention sink, sliding window, and QK-Norm support (#​29046, #​29162, #​29177, #​29186)
  • Upgraded cudnn_frontend to 1.24 and enabled cuDNN SDPA for MHA/GQA (#​28849)
  • Added decode-optimized LinearAttention (GatedDeltaNet) kernels (#​28985)
  • Optimized FlashDecode split planning for local-window GQA and fixed Flash/Lean attention split heuristics (#​29161, #​29554)
  • Updated the GroupQueryAttention contrib op documentation (#​29173)

MoE & quantized GEMM

  • Prepacked int4/int8 QMoE expert weights in the PrePack hook, symmetric with MatMulNBits, and fix

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 9am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot

@solrbot

Copy link
Copy Markdown
CollaboratorAuthor

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

@solrbot
solrbotforce-pushed the renovate/all-non-major-dependencies branch from 44a0e97 to 7fa382aCompareSeptember 1, 2026 08:28
@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

It must be the first day of the month! Look at all these lovely updates grouped together.. Adn the tests pass!

@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

I think a refinement would be to integrae the dangling licenses clean up logic. There are ten licenses that no longer are needed... I'll manually remove them and commit. But maybe we can tuen the job to do it as well?

So this is a real gap, not a Renovate misconfiguration — nothing in the pipeline (Renovate's postUpgradeTasks, or the Gradle build itself) is designed to catch this automatically; it only surfaces when someone runs check (or checkDanglingLicenseFiles) by hand, as you just did. If you want to close the gap, the cheapest fix is adding ./gradlew checkDanglingLicenseFiles to postUpgradeTasks.commands so Renovate's branch build fails loudly (forcing manual attention) instead of silently opening a red-CI PR — actually auto-deleting would need a new Gradle task, which is more invasive for something this infrequent.

@epugh
epugh requested a review from janhoySeptember 1, 2026 10:53
@@ -0,0 +1,7 @@
title: Update all non-major dependencies

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These auto generated changelog files are not very precise for grouped updates.

So either skip changelog for this, or edit the title with a comma separated list of all deps upgraded.

And realistically we will already have changelog files in unreleased folder touching many of the same libs, so there will be duplicates. Perhaps there is no avoiding the RM having to de-duplicate by hand (or LLM) before a release, so that each dependency bump is mentioned only once and with the actual latest version.

And David wants no dependency_update entries at all, while I believe they are important, although perhaps noisy and a bit annoying to keep up to date. Will need to discuss this more elsewhere...

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. I can't imagine that a meaningful useful changelog can be made either a editorial step. I am hoping we get to a point that these rote Solr bot prs do not require human intervention unless the tests fail.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I sent a follow up to my email asking how we want to handle thise: https://lists.apache.org/thread/gp56nzp4hl2v757q0j54pzd7dnywy21n

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, just skip the changelog for this PR, leave it to RM to clean up

@epugh

epugh commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

I am inclined to just remove the changelog, until we get more agreement... so that I can get this merged.... Or do you think ishould wait?

@epugh
epugh merged commit 100431c into apache:mainSep 2, 2026
7 of 8 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@solrbot@epugh@janhoy
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Update all non-major dependencies - #4842

Merged
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies
Sep 2, 2026
Merged

Update all non-major dependencies#4842
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies

Conversation

@solrbot

Copy link
Copy Markdown
Collaborator

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageTypeUpdateChangePending
org.threeten:threetenbp (source)dependenciespatch1.7.31.7.4
io.swagger.core.v3.swagger-gradle-pluginpluginpatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-jaxrs2-jakartadependenciespatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-annotations-jakartadependenciespatch2.2.522.2.542.2.55
com.github.spotbugs:spotbugs-annotations (source)dependenciespatch4.10.24.10.4
org.openapi.generatorpluginminor7.23.07.25.0
com.microsoft.onnxruntime:onnxruntime (source)dependenciesminor1.26.01.29.0
io.nlopez.compose.rules:ktlintdependenciespatch0.6.20.6.4
no.nav.security:mock-oauth2-serverdependenciespatch5.0.15.0.2
net.ltgt.errorpronepluginpatch5.1.05.1.1
dev.logchangepluginpatch1.19.151.19.16
nl.littlerobots.version-catalog-updatepluginpatch1.1.01.1.1
dev.langchain4j:langchain4j-bom (source)dependenciesminor1.17.01.19.0
joda-time:joda-time (source)dependenciespatch2.14.22.14.3
org.jctools:jctools-core (source)dependenciespatch4.0.64.0.7
com.google.guava:guavadependenciesminor33.6.0-jre33.7.1-jre
org.eclipse.jgit:org.eclipse.jgitdependenciespatch7.7.0.202606012155-r7.7.1.202607240634-r
com.diffplug.spotlesspluginminor8.7.08.10.08.10.1
com.nvidia.cuvs:cuvs-java (source)dependenciesminor26.06.026.08.1
commons-codec:commons-codec (source)dependenciespatch1.22.01.22.1
org.checkerframework:checker-qual (source)dependenciespatch4.2.04.2.2
com.carrotsearch:hppcdependenciesminor0.10.00.11.1
org.bouncycastle:bcprov-jdk18on (source)dependenciesminor1.841.85.2
org.bouncycastle:bcpkix-jdk18on (source)dependenciesminor1.841.85
com.github.ben-manes.versionspluginminor0.54.00.61.0
org.apache.tika:tika-core (source)dependenciespatch3.3.13.3.2
org.apache.opennlp:opennlp-tools (source)dependenciespatch2.5.102.5.11
org.apache.opennlp:opennlp-dl (source)dependenciespatch2.5.102.5.11
org.apache.commons:commons-collections4 (source)dependenciesminor4.5.04.6.0
com.adobe.testing:s3mock-testcontainersdependenciesminor5.1.05.2.0

Release Notes

ThreeTen/threetenbp (org.threeten:threetenbp)

v1.7.4

See the change notes for more information.

swagger-api/swagger-core (io.swagger.core.v3:swagger-jaxrs2-jakarta)

v2.2.54

Fixed
  • Java 8 date/time types (OffsetTime, Duration, LocalTime) now map by default
    to the correct OpenAPI Formats Registry strings ("time", "duration", "time-local")
    instead of an unusable expanded object. (#​5172)
  • LocalDateTime deserialization from an existing OpenAPI spec now correctly
    round-trips through the new TimeSchema/DurationSchema/DateTimeLocalSchema/
    TimeLocalSchema classes instead of falling back to a generic StringSchema.
Added
  • PrimitiveType.enableJava8Formats() — opt-in to map LocalDateTime to the
    registry-compliant "date-time-local" format (default remains "date-time"
    for backward compatibility).
Deprecated
  • PrimitiveType.enablePartialTime() — prefer the new default "time-local"
    mapping for LocalTime; kept for callers who specifically need the
    non-registry "partial-time" format.

v2.2.53: Swagger-core 2.2.53 released!

  • chore: update Jackson to 2.22.1 (#​5258)
  • refactor: replace writer(new DefaultPrettyPrinter()) with writerWithDefaultPrettyPrinter() (#​5252)
  • fix: Stabilize CI Maven and Gradle builds (#​5238)
  • test: remove system.out.println from tests (#​5236)
  • chore: bump dependencies (#​5229)
  • refactor: simplify type handling in ModelDeserializer (#​5227)
  • Revert "hotfix: temporarily allow Release workflow to skip mvn deploy to recover 2.2.52 (#​5220)" (#​5223)
  • chore(deps-dev): bump org.codehaus.groovy:groovy from 3.0.23 to 3.0.25 (#​5216)
  • chore(deps): bump commons-cli:commons-cli from 1.9.0 to 1.11.0 (#​5209)
  • chore(deps-dev): bump commons-codec:commons-codec from 1.17.2 to 1.22.0 (#​5208)
  • fix: emit $ref for array items when cycle guard suppresses implementation processing (#​5205)
  • Restore inner property name from map key in handleUnwrapped (#​5193)
  • Honor PropertyNamingStrategy for get/is-prefixed property names (#​5192)
  • fix: let explicit @​Schema(format) override type-derived format (#​5185) (#​5186)
  • docs: update format of javadoc to produce a functional link (#​5182)
  • fix: exclude overridable annotation values when parsing composed annotations (#​5179)
  • fix: negative and positive validation annotations uses relevant OAS 3.1 syntax ( #​5170) (#​5171)
spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)

v4.10.4

Compare Source

Fixed
  • Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#​3884)
  • Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#​3483)
  • Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#​4201)
  • Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#​4237)
  • Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#​4244)
  • Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#​4246)
  • Stop publishing global dependency-management constraints to consumer POMs. (#​4223)

v4.10.3

Compare Source

Fixed
  • Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix message for UNS_UNSAFE_CALL bug pattern
  • Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#​4191)
  • Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#​4034)
  • Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#​4059)
Changed
  • Ant FindBugsViewerTask: use default look and feel by default. (#​4165)
Refactor
  • Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#​4165)
microsoft/onnxruntime (com.microsoft.onnxruntime:onnxruntime)

v1.29.0: ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#​29716, #​31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#​27379, #​29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#​29395).

Security Fixes

Path, bounds, and input validation
Supply chain and tooling
  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#​29827, #​29926, #​31192).

New Features

Core APIs & Runtime
  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#​29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#​29607, #​29799, #​31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#​29261, #​31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#​29555, #​29558, #​29569, #​29571).
Execution Provider ABI & Plugin EPs
  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#​29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#​31635, #​31722, #​31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#​29634, #​29770).

Execution Provider Updates

NVIDIA CUDA EP
Attention and decoding
  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#​29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#​29900, #​29904, #​31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#​29715, #​29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#​29525, #​31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#​31982).
MoE and quantized GEMM
Operators and collectives
  • Added LinearAttentionGate, GatedRMSNorm, and GatedAdd contrib operators (#​31158, #​31835).
  • Added bfloat16 support to AllReduce, AllGather, and AllToAll (#​31571).
  • Fixed the default zero point in CUDA GatherBlockQuantized (#​31693).
WebGPU EP
WebNN EP
  • Added uint8-packed 4-bit GatherBlockQuantized and LpNormalization, reused the shared WASM loader for Blob-backed external data, and fixed per-axis QDQ and MatMulNBits edge cases (#​29475, #​29801, #​31151, #​31152, #​31197).
OpenVINO / QNN / DML / XNNPACK / TensorRT
  • OpenVINO fixed float16 constant-output corruption and output-name routing, added dot-separated KV-cache names to the stateful transform, and corrected raw-data-backed float initializer handling (#​29729, #​29882, #​29895, #​31138).
  • QNN added a reshape handler for split-axis reshapes (#​29660).
  • DML fixed wide-string handling and made fused graph kernels own their model paths (#​31656, #​31664).
  • XNNPACK now reads dynamic Gemm M from the input tensor at compute time (#​31189).
  • TensorRT deduplicated context-path handling and added a build option for fused-attention cubins (#​29640, #​31632).

CPU & Core Optimizations

MLAS
  • Added Arm64 half-precision GEMM and convolution support through KleidiAI, including FP16 MatMul/Gemm/Conv paths and asymmetric Q4 and SME2 MatMulNBits kernels (#​28786, #​29654, #​29709, #​29898).
  • Added a RISC-V RVV QNBitGemm backend, an Arm64 NEON fp32 RoPE kernel, portable SVE elementwise kernels with FEXPA exp, and Arm64 UDOT routing for S8U8 QGEMM (#​29537, #​29787, #​29836, #​31145).
  • Added AVX2/VNNI 2-bit weight kernels and vectorized 2-bit dequantization, and improved fp16 MatMulNBits paths by avoiding fp32 temporaries and writing fp16 output directly across 2-, 4-, and 8-bit paths (#​29619, #​29766, #​29791, #​29842, #​29864, #​29901).
CPU Attention & Kernels
  • Improved masked Attention performance, enabled CPU FlashAttention on Linux Arm64 through L2-cache detection, and added FP16 GQA with quantized KV cache (#​29621, #​29719, #​29825).
  • Added double support to CPU Cos and int32 support to CPU Trilu, and fixed int8 QLinearSoftmax saturation and AvgPool ceil_mode/count_include_pad behavior (#​28975, #​29476, #​29629, #​29728).
  • Fixed TfIdfVectorizer weight indexing and skipped MinLength logits-processor construction when eos_token_id is negative (#​29604, #​31649).
  • Tightened K/V and cache-indirection shape contracts in CPU Attention and MultiHeadAttention, and fixed LinearAttention output shape inference for grouped-query attention (#​29892, #​31190, #​31634).
Graph, Optimizer, and Runtime
  • Extended reshape fusion, fixed double recursion in subgraph type/shape inference, and made constant-folding output deterministic (#​29027, #​29617, #​29789).
  • Fixed in-memory external initializer loading, memory-pattern allocation stream selection, and a leak in GetOverridableInitializerNames() (#​29349, #​29589, #​29616).
  • Reduced small MatMul batch allocations and redundant LUT initialization (#​29085, #​29690).
  • Fixed static-initialization-order crashes when importing ONNX Runtime and reduced eager runtime initialization (#​29880, #​31964).
  • Negative CPU Split axes now produce an error instead of being accepted (#​31149).

Web & JavaScript

  • Added on-demand loading of Blob-backed external data in JSPI builds (#​29477).
  • Fixed JSEP pooling output shape for ceil_mode, allowed DFT to ignore excess input data, and fixed a webpack/Terser release-build crash (#​29627, #​29680, #​31652).

Build, Packaging & CI

  • CUDA package architecture selections are now aligned across plugin EP, Python, C API, TensorRT, and Node.js pipelines. Windows arm64 is only available in CUDA plugin EP (#​31992):

    OSCUDACUDA architectures (all in -real form)
    Linux x6412.860;70;75;80;86;89;90a;120a
    Linux x6413.x75;80;86;89;90a;120a
    Linux aarch6413.x89;90a;120a;121a
    Windows x6412.861;75;86;89;120a
    Windows x6413.x75;80;86;89;120a
    Windows arm6413.x120a;121a
  • Reduced CUDA compilation time and memory usage by splitting generated SM80 MoE, fpA_intB, and MatMulNBits translation units and adding two-level workspace estimation (#​29614, #​29699, #​29811, #​31834, #​31837).

  • Fixed CUDA 13 plugin and packaging builds on Windows, Linux, and Windows ARM64, including MSVC/TMA compatibility and CI memory limits (#​31608, #​31609, #​31615, #​31616, #​31617, #​31622, #​31729, #​31748).

  • Fixed MLAS AVX2 builds on toolchains without AVX-VNNI assembler support, GCC 15 -Werror builds, and an MSVC C1001 issue in the W2 AVX-512-VNNI dispatch path (#​28767, #​29679, #​29885).

  • Improved Windows compatibility by skipping DXGI discovery when Win32k system calls are unavailable and delay-loading shell32 (#​29755, #​30889).

  • Fixed Dawn parallel-build races, and GPU discovery in build/test environments (#​29858, #​29866).

Contributors

Thanks to our 63 contributors for this release!

@​adrastogi, @​ahsan-ca, @​AngelGalindo7, @​ankitm3k, @​apsonawane, @​blazingphoenix7, @​bmehta001, @​chilo-ms, @​claude, @​daijh, @​ducviet00, @​edgchen1, @​elwhyjay, @​eserscor, @​GopalakrishnanN, @​guptaishaan, @​hariharans29, @​Honry, @​huningxin, @​jchen10, @​jiafatom, @​jiangzhuo, @​Jiawei-Shao, @​JonathanC-ARM, @​justinchuby, @​kjg0724, @​kunal-vaishnavi, @​kylo5aby, @​Laan33, @​martin-klacer-arm, @​mastryukov1990, @​mcollinswisc, @​miaobin, @​mingmingtasd, @​mirounga, @​mustjab, @​n1harika, @​namgyu-youn, @​neilmsft, @​nenad1002, @​nicholascelestin, @​OscarFree, @​prathikr, @​qjia7, @​quic-muchhsu, @​Sammy-Dabbas, @​sanaa-hamel-microsoft, @​shiyi9801, @​skottmckay, @​tairenpiao, @​TedThemistokleous, @​the0cp, @​tianleiwu, @​titaiwangms, @​velonica0, @​wangw-1991, @​wuisabel-gif, @​xadupre, @​xhcao, @​xiaofeihan1, @​xiaoyu-work, @​yen-shi, @​zlma7001

Full Changelog: v1.28.0...v1.29.0

v1.28.0: ONNX Runtime v1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#​29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
    • CUDA_QUANT_PREPROCESS is off by default (#​29687).
  • NPM packages are now published from the CUDA 13 pipeline (#​28773).
  • The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation
  • Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
  • Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
  • Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
  • Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
  • Validated Col2Im inputs to prevent heap over-read (#​28706)
  • Hardened CropAndResize against malformed crop_size tensors (#​28766)
  • Validated BeamSearchvocab_size against logits width (#​28774)
  • Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
  • Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
  • Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
  • Clamped 1D attention mask_index to valid bounds (#​29449)
  • Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
  • Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
  • Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
  • Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
  • Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
  • Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
  • Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
  • Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
  • Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)
Integer overflow & allocation size
  • Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
  • Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
  • Hardened QMoE against integer overflow and partial K tiles (#​29067)
  • Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
  • Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
  • Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
  • Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)
Supply chain & tooling

New Features

Execution Provider ABI & Plugin EPs
  • Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#​28271, #​28989, #​29501)
  • Added an API to select the best compiled-model compatibility info from candidate strings (#​28387)
  • Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#​28624)
  • Implemented name-based partitioning with accompanying documentation (#​28903)
  • Added Linux NPU discovery through sysfs accel devices (#​28703)
  • Relaxed CompileModel validation to accept zero-input OrtModel graphs (#​28771)
  • CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#​29221, #​29244, #​28896, #​28789)
  • WebGPU plugin EP version bumped to 0.3.0 (#​29056)
Core APIs & Runtime
  • Added OrtErrorCode documentation, single-sourced the values so StatusCode stays in sync, and added OrtErrorCode::ORT_DEVICE_RESET (#​29018, #​29065, #​29748)
  • Added memory statistics to profiling output (#​29058)
  • Added EP version logging on inference failure, in the EpDeviceUsage event, and ORT version logging (#​28794)
  • User-supplied external initializers are now used in place when already on the planned device (#​29013)
  • model_external_initializers_file_folder_path is now honored for file-path model loads (#​29459)
  • Added a Python API for HOST_ACCESSIBLEOrtValue allocation (#​28038)
Quantization Tooling
  • Added CudaQuantizer to onnxruntime.quantization (#​29509)
  • Registered Flatten as a Direct8Bit op in the Python QDQ static quantizer (#​28340)
  • Skipped MaxPool during FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#​28488, #​29350)
  • Added Float16/BFloat16/Float8 support in the TensorArray custom op (#​28335)
  • Clarified CPU parameter recommendations in the quantization docs (#​28415)

Execution Provider Updates

NVIDIA CUDA EP

Attention & LLM decode

  • Enabled XQA by default for FP16/BF16 GroupQueryAttention, and extended XQA decode with attention sink, sliding window, and QK-Norm support (#​29046, #​29162, #​29177, #​29186)
  • Upgraded cudnn_frontend to 1.24 and enabled cuDNN SDPA for MHA/GQA (#​28849)
  • Added decode-optimized LinearAttention (GatedDeltaNet) kernels (#​28985)
  • Optimized FlashDecode split planning for local-window GQA and fixed Flash/Lean attention split heuristics (#​29161, #​29554)
  • Updated the GroupQueryAttention contrib op documentation (#​29173)

MoE & quantized GEMM

  • Prepacked int4/int8 QMoE expert weights in the PrePack hook, symmetric with MatMulNBits, and fix

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 9am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot

@solrbot

Copy link
Copy Markdown
CollaboratorAuthor

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

@solrbot
solrbotforce-pushed the renovate/all-non-major-dependencies branch from 44a0e97 to 7fa382aCompareSeptember 1, 2026 08:28
@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

It must be the first day of the month! Look at all these lovely updates grouped together.. Adn the tests pass!

@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

I think a refinement would be to integrae the dangling licenses clean up logic. There are ten licenses that no longer are needed... I'll manually remove them and commit. But maybe we can tuen the job to do it as well?

So this is a real gap, not a Renovate misconfiguration — nothing in the pipeline (Renovate's postUpgradeTasks, or the Gradle build itself) is designed to catch this automatically; it only surfaces when someone runs check (or checkDanglingLicenseFiles) by hand, as you just did. If you want to close the gap, the cheapest fix is adding ./gradlew checkDanglingLicenseFiles to postUpgradeTasks.commands so Renovate's branch build fails loudly (forcing manual attention) instead of silently opening a red-CI PR — actually auto-deleting would need a new Gradle task, which is more invasive for something this infrequent.

@epugh
epugh requested a review from janhoySeptember 1, 2026 10:53
@@ -0,0 +1,7 @@
title: Update all non-major dependencies

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These auto generated changelog files are not very precise for grouped updates.

So either skip changelog for this, or edit the title with a comma separated list of all deps upgraded.

And realistically we will already have changelog files in unreleased folder touching many of the same libs, so there will be duplicates. Perhaps there is no avoiding the RM having to de-duplicate by hand (or LLM) before a release, so that each dependency bump is mentioned only once and with the actual latest version.

And David wants no dependency_update entries at all, while I believe they are important, although perhaps noisy and a bit annoying to keep up to date. Will need to discuss this more elsewhere...

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. I can't imagine that a meaningful useful changelog can be made either a editorial step. I am hoping we get to a point that these rote Solr bot prs do not require human intervention unless the tests fail.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I sent a follow up to my email asking how we want to handle thise: https://lists.apache.org/thread/gp56nzp4hl2v757q0j54pzd7dnywy21n

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, just skip the changelog for this PR, leave it to RM to clean up

@epugh

epugh commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

I am inclined to just remove the changelog, until we get more agreement... so that I can get this merged.... Or do you think ishould wait?

@epugh
epugh merged commit 100431c into apache:mainSep 2, 2026
7 of 8 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@solrbot@epugh@janhoy
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

Update all non-major dependencies - #4842

Merged
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies
Sep 2, 2026
Merged

Update all non-major dependencies#4842
epugh merged 4 commits into
apache:mainfrom
solrbot:renovate/all-non-major-dependencies

Conversation

@solrbot

Copy link
Copy Markdown
Collaborator

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageTypeUpdateChangePending
org.threeten:threetenbp (source)dependenciespatch1.7.31.7.4
io.swagger.core.v3.swagger-gradle-pluginpluginpatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-jaxrs2-jakartadependenciespatch2.2.522.2.542.2.55
io.swagger.core.v3:swagger-annotations-jakartadependenciespatch2.2.522.2.542.2.55
com.github.spotbugs:spotbugs-annotations (source)dependenciespatch4.10.24.10.4
org.openapi.generatorpluginminor7.23.07.25.0
com.microsoft.onnxruntime:onnxruntime (source)dependenciesminor1.26.01.29.0
io.nlopez.compose.rules:ktlintdependenciespatch0.6.20.6.4
no.nav.security:mock-oauth2-serverdependenciespatch5.0.15.0.2
net.ltgt.errorpronepluginpatch5.1.05.1.1
dev.logchangepluginpatch1.19.151.19.16
nl.littlerobots.version-catalog-updatepluginpatch1.1.01.1.1
dev.langchain4j:langchain4j-bom (source)dependenciesminor1.17.01.19.0
joda-time:joda-time (source)dependenciespatch2.14.22.14.3
org.jctools:jctools-core (source)dependenciespatch4.0.64.0.7
com.google.guava:guavadependenciesminor33.6.0-jre33.7.1-jre
org.eclipse.jgit:org.eclipse.jgitdependenciespatch7.7.0.202606012155-r7.7.1.202607240634-r
com.diffplug.spotlesspluginminor8.7.08.10.08.10.1
com.nvidia.cuvs:cuvs-java (source)dependenciesminor26.06.026.08.1
commons-codec:commons-codec (source)dependenciespatch1.22.01.22.1
org.checkerframework:checker-qual (source)dependenciespatch4.2.04.2.2
com.carrotsearch:hppcdependenciesminor0.10.00.11.1
org.bouncycastle:bcprov-jdk18on (source)dependenciesminor1.841.85.2
org.bouncycastle:bcpkix-jdk18on (source)dependenciesminor1.841.85
com.github.ben-manes.versionspluginminor0.54.00.61.0
org.apache.tika:tika-core (source)dependenciespatch3.3.13.3.2
org.apache.opennlp:opennlp-tools (source)dependenciespatch2.5.102.5.11
org.apache.opennlp:opennlp-dl (source)dependenciespatch2.5.102.5.11
org.apache.commons:commons-collections4 (source)dependenciesminor4.5.04.6.0
com.adobe.testing:s3mock-testcontainersdependenciesminor5.1.05.2.0

Release Notes

ThreeTen/threetenbp (org.threeten:threetenbp)

v1.7.4

See the change notes for more information.

swagger-api/swagger-core (io.swagger.core.v3:swagger-jaxrs2-jakarta)

v2.2.54

Fixed
  • Java 8 date/time types (OffsetTime, Duration, LocalTime) now map by default
    to the correct OpenAPI Formats Registry strings ("time", "duration", "time-local")
    instead of an unusable expanded object. (#​5172)
  • LocalDateTime deserialization from an existing OpenAPI spec now correctly
    round-trips through the new TimeSchema/DurationSchema/DateTimeLocalSchema/
    TimeLocalSchema classes instead of falling back to a generic StringSchema.
Added
  • PrimitiveType.enableJava8Formats() — opt-in to map LocalDateTime to the
    registry-compliant "date-time-local" format (default remains "date-time"
    for backward compatibility).
Deprecated
  • PrimitiveType.enablePartialTime() — prefer the new default "time-local"
    mapping for LocalTime; kept for callers who specifically need the
    non-registry "partial-time" format.

v2.2.53: Swagger-core 2.2.53 released!

  • chore: update Jackson to 2.22.1 (#​5258)
  • refactor: replace writer(new DefaultPrettyPrinter()) with writerWithDefaultPrettyPrinter() (#​5252)
  • fix: Stabilize CI Maven and Gradle builds (#​5238)
  • test: remove system.out.println from tests (#​5236)
  • chore: bump dependencies (#​5229)
  • refactor: simplify type handling in ModelDeserializer (#​5227)
  • Revert "hotfix: temporarily allow Release workflow to skip mvn deploy to recover 2.2.52 (#​5220)" (#​5223)
  • chore(deps-dev): bump org.codehaus.groovy:groovy from 3.0.23 to 3.0.25 (#​5216)
  • chore(deps): bump commons-cli:commons-cli from 1.9.0 to 1.11.0 (#​5209)
  • chore(deps-dev): bump commons-codec:commons-codec from 1.17.2 to 1.22.0 (#​5208)
  • fix: emit $ref for array items when cycle guard suppresses implementation processing (#​5205)
  • Restore inner property name from map key in handleUnwrapped (#​5193)
  • Honor PropertyNamingStrategy for get/is-prefixed property names (#​5192)
  • fix: let explicit @​Schema(format) override type-derived format (#​5185) (#​5186)
  • docs: update format of javadoc to produce a functional link (#​5182)
  • fix: exclude overridable annotation values when parsing composed annotations (#​5179)
  • fix: negative and positive validation annotations uses relevant OAS 3.1 syntax ( #​5170) (#​5171)
spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)

v4.10.4

Compare Source

Fixed
  • Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#​3884)
  • Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#​3483)
  • Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#​4201)
  • Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#​4237)
  • Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#​4244)
  • Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#​4246)
  • Stop publishing global dependency-management constraints to consumer POMs. (#​4223)

v4.10.3

Compare Source

Fixed
  • Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#​4144)
  • Fix message for UNS_UNSAFE_CALL bug pattern
  • Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#​4191)
  • Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#​4034)
  • Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#​4059)
Changed
  • Ant FindBugsViewerTask: use default look and feel by default. (#​4165)
Refactor
  • Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#​4165)
microsoft/onnxruntime (com.microsoft.onnxruntime:onnxruntime)

v1.29.0: ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#​29716, #​31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#​27379, #​29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#​29395).

Security Fixes

Path, bounds, and input validation
Supply chain and tooling
  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#​29827, #​29926, #​31192).

New Features

Core APIs & Runtime
  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#​29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#​29607, #​29799, #​31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#​29261, #​31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#​29555, #​29558, #​29569, #​29571).
Execution Provider ABI & Plugin EPs
  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#​29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#​31635, #​31722, #​31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#​29634, #​29770).

Execution Provider Updates

NVIDIA CUDA EP
Attention and decoding
  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#​29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#​29900, #​29904, #​31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#​29715, #​29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#​29525, #​31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#​31982).
MoE and quantized GEMM
Operators and collectives
  • Added LinearAttentionGate, GatedRMSNorm, and GatedAdd contrib operators (#​31158, #​31835).
  • Added bfloat16 support to AllReduce, AllGather, and AllToAll (#​31571).
  • Fixed the default zero point in CUDA GatherBlockQuantized (#​31693).
WebGPU EP
WebNN EP
  • Added uint8-packed 4-bit GatherBlockQuantized and LpNormalization, reused the shared WASM loader for Blob-backed external data, and fixed per-axis QDQ and MatMulNBits edge cases (#​29475, #​29801, #​31151, #​31152, #​31197).
OpenVINO / QNN / DML / XNNPACK / TensorRT
  • OpenVINO fixed float16 constant-output corruption and output-name routing, added dot-separated KV-cache names to the stateful transform, and corrected raw-data-backed float initializer handling (#​29729, #​29882, #​29895, #​31138).
  • QNN added a reshape handler for split-axis reshapes (#​29660).
  • DML fixed wide-string handling and made fused graph kernels own their model paths (#​31656, #​31664).
  • XNNPACK now reads dynamic Gemm M from the input tensor at compute time (#​31189).
  • TensorRT deduplicated context-path handling and added a build option for fused-attention cubins (#​29640, #​31632).

CPU & Core Optimizations

MLAS
  • Added Arm64 half-precision GEMM and convolution support through KleidiAI, including FP16 MatMul/Gemm/Conv paths and asymmetric Q4 and SME2 MatMulNBits kernels (#​28786, #​29654, #​29709, #​29898).
  • Added a RISC-V RVV QNBitGemm backend, an Arm64 NEON fp32 RoPE kernel, portable SVE elementwise kernels with FEXPA exp, and Arm64 UDOT routing for S8U8 QGEMM (#​29537, #​29787, #​29836, #​31145).
  • Added AVX2/VNNI 2-bit weight kernels and vectorized 2-bit dequantization, and improved fp16 MatMulNBits paths by avoiding fp32 temporaries and writing fp16 output directly across 2-, 4-, and 8-bit paths (#​29619, #​29766, #​29791, #​29842, #​29864, #​29901).
CPU Attention & Kernels
  • Improved masked Attention performance, enabled CPU FlashAttention on Linux Arm64 through L2-cache detection, and added FP16 GQA with quantized KV cache (#​29621, #​29719, #​29825).
  • Added double support to CPU Cos and int32 support to CPU Trilu, and fixed int8 QLinearSoftmax saturation and AvgPool ceil_mode/count_include_pad behavior (#​28975, #​29476, #​29629, #​29728).
  • Fixed TfIdfVectorizer weight indexing and skipped MinLength logits-processor construction when eos_token_id is negative (#​29604, #​31649).
  • Tightened K/V and cache-indirection shape contracts in CPU Attention and MultiHeadAttention, and fixed LinearAttention output shape inference for grouped-query attention (#​29892, #​31190, #​31634).
Graph, Optimizer, and Runtime
  • Extended reshape fusion, fixed double recursion in subgraph type/shape inference, and made constant-folding output deterministic (#​29027, #​29617, #​29789).
  • Fixed in-memory external initializer loading, memory-pattern allocation stream selection, and a leak in GetOverridableInitializerNames() (#​29349, #​29589, #​29616).
  • Reduced small MatMul batch allocations and redundant LUT initialization (#​29085, #​29690).
  • Fixed static-initialization-order crashes when importing ONNX Runtime and reduced eager runtime initialization (#​29880, #​31964).
  • Negative CPU Split axes now produce an error instead of being accepted (#​31149).

Web & JavaScript

  • Added on-demand loading of Blob-backed external data in JSPI builds (#​29477).
  • Fixed JSEP pooling output shape for ceil_mode, allowed DFT to ignore excess input data, and fixed a webpack/Terser release-build crash (#​29627, #​29680, #​31652).

Build, Packaging & CI

  • CUDA package architecture selections are now aligned across plugin EP, Python, C API, TensorRT, and Node.js pipelines. Windows arm64 is only available in CUDA plugin EP (#​31992):

    OSCUDACUDA architectures (all in -real form)
    Linux x6412.860;70;75;80;86;89;90a;120a
    Linux x6413.x75;80;86;89;90a;120a
    Linux aarch6413.x89;90a;120a;121a
    Windows x6412.861;75;86;89;120a
    Windows x6413.x75;80;86;89;120a
    Windows arm6413.x120a;121a
  • Reduced CUDA compilation time and memory usage by splitting generated SM80 MoE, fpA_intB, and MatMulNBits translation units and adding two-level workspace estimation (#​29614, #​29699, #​29811, #​31834, #​31837).

  • Fixed CUDA 13 plugin and packaging builds on Windows, Linux, and Windows ARM64, including MSVC/TMA compatibility and CI memory limits (#​31608, #​31609, #​31615, #​31616, #​31617, #​31622, #​31729, #​31748).

  • Fixed MLAS AVX2 builds on toolchains without AVX-VNNI assembler support, GCC 15 -Werror builds, and an MSVC C1001 issue in the W2 AVX-512-VNNI dispatch path (#​28767, #​29679, #​29885).

  • Improved Windows compatibility by skipping DXGI discovery when Win32k system calls are unavailable and delay-loading shell32 (#​29755, #​30889).

  • Fixed Dawn parallel-build races, and GPU discovery in build/test environments (#​29858, #​29866).

Contributors

Thanks to our 63 contributors for this release!

@​adrastogi, @​ahsan-ca, @​AngelGalindo7, @​ankitm3k, @​apsonawane, @​blazingphoenix7, @​bmehta001, @​chilo-ms, @​claude, @​daijh, @​ducviet00, @​edgchen1, @​elwhyjay, @​eserscor, @​GopalakrishnanN, @​guptaishaan, @​hariharans29, @​Honry, @​huningxin, @​jchen10, @​jiafatom, @​jiangzhuo, @​Jiawei-Shao, @​JonathanC-ARM, @​justinchuby, @​kjg0724, @​kunal-vaishnavi, @​kylo5aby, @​Laan33, @​martin-klacer-arm, @​mastryukov1990, @​mcollinswisc, @​miaobin, @​mingmingtasd, @​mirounga, @​mustjab, @​n1harika, @​namgyu-youn, @​neilmsft, @​nenad1002, @​nicholascelestin, @​OscarFree, @​prathikr, @​qjia7, @​quic-muchhsu, @​Sammy-Dabbas, @​sanaa-hamel-microsoft, @​shiyi9801, @​skottmckay, @​tairenpiao, @​TedThemistokleous, @​the0cp, @​tianleiwu, @​titaiwangms, @​velonica0, @​wangw-1991, @​wuisabel-gif, @​xadupre, @​xhcao, @​xiaofeihan1, @​xiaoyu-work, @​yen-shi, @​zlma7001

Full Changelog: v1.28.0...v1.29.0

v1.28.0: ONNX Runtime v1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#​29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
    • CUDA_QUANT_PREPROCESS is off by default (#​29687).
  • NPM packages are now published from the CUDA 13 pipeline (#​28773).
  • The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation
  • Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
  • Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
  • Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
  • Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
  • Validated Col2Im inputs to prevent heap over-read (#​28706)
  • Hardened CropAndResize against malformed crop_size tensors (#​28766)
  • Validated BeamSearchvocab_size against logits width (#​28774)
  • Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
  • Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
  • Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
  • Clamped 1D attention mask_index to valid bounds (#​29449)
  • Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
  • Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
  • Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
  • Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
  • Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
  • Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
  • Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
  • Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
  • Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)
Integer overflow & allocation size
  • Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
  • Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
  • Hardened QMoE against integer overflow and partial K tiles (#​29067)
  • Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
  • Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
  • Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
  • Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)
Supply chain & tooling

New Features

Execution Provider ABI & Plugin EPs
  • Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#​28271, #​28989, #​29501)
  • Added an API to select the best compiled-model compatibility info from candidate strings (#​28387)
  • Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#​28624)
  • Implemented name-based partitioning with accompanying documentation (#​28903)
  • Added Linux NPU discovery through sysfs accel devices (#​28703)
  • Relaxed CompileModel validation to accept zero-input OrtModel graphs (#​28771)
  • CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#​29221, #​29244, #​28896, #​28789)
  • WebGPU plugin EP version bumped to 0.3.0 (#​29056)
Core APIs & Runtime
  • Added OrtErrorCode documentation, single-sourced the values so StatusCode stays in sync, and added OrtErrorCode::ORT_DEVICE_RESET (#​29018, #​29065, #​29748)
  • Added memory statistics to profiling output (#​29058)
  • Added EP version logging on inference failure, in the EpDeviceUsage event, and ORT version logging (#​28794)
  • User-supplied external initializers are now used in place when already on the planned device (#​29013)
  • model_external_initializers_file_folder_path is now honored for file-path model loads (#​29459)
  • Added a Python API for HOST_ACCESSIBLEOrtValue allocation (#​28038)
Quantization Tooling
  • Added CudaQuantizer to onnxruntime.quantization (#​29509)
  • Registered Flatten as a Direct8Bit op in the Python QDQ static quantizer (#​28340)
  • Skipped MaxPool during FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#​28488, #​29350)
  • Added Float16/BFloat16/Float8 support in the TensorArray custom op (#​28335)
  • Clarified CPU parameter recommendations in the quantization docs (#​28415)

Execution Provider Updates

NVIDIA CUDA EP

Attention & LLM decode

  • Enabled XQA by default for FP16/BF16 GroupQueryAttention, and extended XQA decode with attention sink, sliding window, and QK-Norm support (#​29046, #​29162, #​29177, #​29186)
  • Upgraded cudnn_frontend to 1.24 and enabled cuDNN SDPA for MHA/GQA (#​28849)
  • Added decode-optimized LinearAttention (GatedDeltaNet) kernels (#​28985)
  • Optimized FlashDecode split planning for local-window GQA and fixed Flash/Lean attention split heuristics (#​29161, #​29554)
  • Updated the GroupQueryAttention contrib op documentation (#​29173)

MoE & quantized GEMM

  • Prepacked int4/int8 QMoE expert weights in the PrePack hook, symmetric with MatMulNBits, and fix

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 9am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot

@solrbot

Copy link
Copy Markdown
CollaboratorAuthor

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

@solrbot
solrbotforce-pushed the renovate/all-non-major-dependencies branch from 44a0e97 to 7fa382aCompareSeptember 1, 2026 08:28
@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

It must be the first day of the month! Look at all these lovely updates grouped together.. Adn the tests pass!

@epugh

epugh commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

I think a refinement would be to integrae the dangling licenses clean up logic. There are ten licenses that no longer are needed... I'll manually remove them and commit. But maybe we can tuen the job to do it as well?

So this is a real gap, not a Renovate misconfiguration — nothing in the pipeline (Renovate's postUpgradeTasks, or the Gradle build itself) is designed to catch this automatically; it only surfaces when someone runs check (or checkDanglingLicenseFiles) by hand, as you just did. If you want to close the gap, the cheapest fix is adding ./gradlew checkDanglingLicenseFiles to postUpgradeTasks.commands so Renovate's branch build fails loudly (forcing manual attention) instead of silently opening a red-CI PR — actually auto-deleting would need a new Gradle task, which is more invasive for something this infrequent.

@epugh
epugh requested a review from janhoySeptember 1, 2026 10:53
@@ -0,0 +1,7 @@
title: Update all non-major dependencies

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These auto generated changelog files are not very precise for grouped updates.

So either skip changelog for this, or edit the title with a comma separated list of all deps upgraded.

And realistically we will already have changelog files in unreleased folder touching many of the same libs, so there will be duplicates. Perhaps there is no avoiding the RM having to de-duplicate by hand (or LLM) before a release, so that each dependency bump is mentioned only once and with the actual latest version.

And David wants no dependency_update entries at all, while I believe they are important, although perhaps noisy and a bit annoying to keep up to date. Will need to discuss this more elsewhere...

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. I can't imagine that a meaningful useful changelog can be made either a editorial step. I am hoping we get to a point that these rote Solr bot prs do not require human intervention unless the tests fail.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I sent a follow up to my email asking how we want to handle thise: https://lists.apache.org/thread/gp56nzp4hl2v757q0j54pzd7dnywy21n

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, just skip the changelog for this PR, leave it to RM to clean up

@epugh

epugh commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

I am inclined to just remove the changelog, until we get more agreement... so that I can get this merged.... Or do you think ishould wait?

@epugh
epugh merged commit 100431c into apache:mainSep 2, 2026
7 of 8 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@solrbot@epugh@janhoy