Uh oh!
There was an error while loading. Please reload this page.
Update all non-major dependencies - #4842
Conversation
solrbot
commented
Sep 1, 2026
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
44a0e97 to
7fa382aCompareepugh
commented
Sep 1, 2026
It must be the first day of the month! Look at all these lovely updates grouped together.. Adn the tests pass! |
epugh
commented
Sep 1, 2026
I think a refinement would be to integrae the dangling licenses clean up logic. There are ten licenses that no longer are needed... I'll manually remove them and commit. But maybe we can tuen the job to do it as well?
|
| @@ -0,0 +1,7 @@ | |||
| title: Update all non-major dependencies | |||
There was a problem hiding this comment.
These auto generated changelog files are not very precise for grouped updates.
So either skip changelog for this, or edit the title with a comma separated list of all deps upgraded.
And realistically we will already have changelog files in unreleased folder touching many of the same libs, so there will be duplicates. Perhaps there is no avoiding the RM having to de-duplicate by hand (or LLM) before a release, so that each dependency bump is mentioned only once and with the actual latest version.
And David wants no dependency_update entries at all, while I believe they are important, although perhaps noisy and a bit annoying to keep up to date. Will need to discuss this more elsewhere...
There was a problem hiding this comment.
Yeah. I can't imagine that a meaningful useful changelog can be made either a editorial step. I am hoping we get to a point that these rote Solr bot prs do not require human intervention unless the tests fail.
There was a problem hiding this comment.
I sent a follow up to my email asking how we want to handle thise: https://lists.apache.org/thread/gp56nzp4hl2v757q0j54pzd7dnywy21n
There was a problem hiding this comment.
Yea, just skip the changelog for this PR, leave it to RM to clean up
epugh
commented
Sep 2, 2026
I am inclined to just remove the changelog, until we get more agreement... so that I can get this merged.... Or do you think ishould wait? |
Uh oh!
There was an error while loading. Please reload this page.
This PR contains the following updates:
1.7.3→1.7.42.2.52→2.2.542.2.552.2.52→2.2.542.2.552.2.52→2.2.542.2.554.10.2→4.10.47.23.0→7.25.01.26.0→1.29.00.6.2→0.6.45.0.1→5.0.25.1.0→5.1.11.19.15→1.19.161.1.0→1.1.11.17.0→1.19.02.14.2→2.14.34.0.6→4.0.733.6.0-jre→33.7.1-jre7.7.0.202606012155-r→7.7.1.202607240634-r8.7.0→8.10.08.10.126.06.0→26.08.11.22.0→1.22.14.2.0→4.2.20.10.0→0.11.11.84→1.85.21.84→1.850.54.0→0.61.03.3.1→3.3.22.5.10→2.5.112.5.10→2.5.114.5.0→4.6.05.1.0→5.2.0Release Notes
ThreeTen/threetenbp (org.threeten:threetenbp)
v1.7.4See the change notes for more information.
swagger-api/swagger-core (io.swagger.core.v3:swagger-jaxrs2-jakarta)
v2.2.54Fixed
OffsetTime,Duration,LocalTime) now map by defaultto the correct OpenAPI Formats Registry strings (
"time","duration","time-local")instead of an unusable expanded object. (#5172)
LocalDateTimedeserialization from an existing OpenAPI spec now correctlyround-trips through the new
TimeSchema/DurationSchema/DateTimeLocalSchema/TimeLocalSchemaclasses instead of falling back to a genericStringSchema.Added
PrimitiveType.enableJava8Formats()— opt-in to mapLocalDateTimeto theregistry-compliant
"date-time-local"format (default remains"date-time"for backward compatibility).
Deprecated
PrimitiveType.enablePartialTime()— prefer the new default"time-local"mapping for
LocalTime; kept for callers who specifically need thenon-registry
"partial-time"format.v2.2.53: Swagger-core 2.2.53 released!writer(new DefaultPrettyPrinter())withwriterWithDefaultPrettyPrinter()(#5252)spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)
v4.10.4Compare Source
Fixed
NN_NAKED_NOTIFYfalse negatives when a field read is stored in a local variable beforenotify()ornotifyAll()(#3884)ASE_ASSERTION_WITH_SIDE_EFFECTandASE_ASSERTION_WITH_SIDE_EFFECT_METHODfalse positives in every method analysed after a method that reads$assertionsDisabledwithout throwing anAssertionError(#3483)INT_BAD_COMPARISON_WITH_SIGNED_BYTEfalse positive for meaningful comparisons of a signed byte with127(b < 127,b >= 127) (#4201)EI_EXPOSE_REPfalse negative for public getters in anonymous classes (#4237)java.util.Collections$EmptyNavigableSetandjava.util.Collections$EmptyNavigableMapwhen the result ofCollections.emptySortedSet(),emptyNavigableSet(),emptySortedMap()oremptyNavigableMap()is stored (#4244)URF_UNREAD_FIELDfalse negative for unread instance fields declared in enums (#4246)v4.10.3Compare Source
Fixed
LI_LAZY_INIT_STATICfalse negative when the null guard is written in yoda-style (null == field) (#4144)DC_DOUBLECHECK,NP_SYNC_AND_NULL_CHECK_FIELDandSP_SPIN_ON_FIELDfalse negatives when the null guard is written in yoda-style (null == field) (#4144)UNS_UNSAFE_CALLbug patternUWF_NULL_FIELDfalse negative for fields initialized with cast null values (#4034)UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASSfalse positive for methods reached only through method references (#4059)Changed
FindBugsViewerTask: use default look and feel by default. (#4165)Refactor
FindBugsViewerTask: extendAbstractFindBugsTaskto reduce duplicate code. (#4165)microsoft/onnxruntime (com.microsoft.onnxruntime:onnxruntime)
v1.29.0: ONNX Runtime v1.29.0Announcements & Breaking Changes
ORT_DISABLE_TELEMETRY=1before initialization disables non-Windows telemetry for the process (#27379, #29872).onnxruntime/python/tools/tensorrtdashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).Security Fixes
Path, bounds, and input validation
kattribute against the number of experts and fixed a CPUTensorScattersecurity issue (#29907, #29916).Range, andCropAndResize(#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).OrtApi::GetValueand validated DML constant tensor byte sizes (#29157, #31665).Supply chain and tooling
adm-zipforonnxruntime-node(#29827, #29926, #31192).New Features
Core APIs & Runtime
ORT_INTRA_OP_NUM_THREADSandORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and0preserves machine-sized defaults (#29688).EpContextnodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).MRotaryEmbeddingcontrib operator for Qwen mRoPE variants (#29261, #31728).onnxruntime_perf_testthrough--data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).Execution Provider ABI & Plugin EPs
Execution Provider Updates
NVIDIA CUDA EP
Attention and decoding
PagedAttentionwith quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).AttentionCUDA kernel and enabled cuDNN SDPA for contribAttention(#29715, #29717).attention_biassupport to the GroupQueryAttention unfused path andstate_windowsupport to LinearAttention and CausalConvWithState for MTP (#29525, #31157).MoE and quantized GEMM
MatMulBlockQuantizedFp4WeightandMatMulBlockQuantizedFp8Weight, plus block-scaled tensor-core/GEMV decode paths, packed FP4 decode, M-tiling, and folded W8A8 activation QDQ (#29818, #29850, #29896, #31155, #31481).Operators and collectives
LinearAttentionGate,GatedRMSNorm, andGatedAddcontrib operators (#31158, #31835).AllReduce,AllGather, andAllToAll(#31571).GatherBlockQuantized(#31693).WebGPU EP
WebNN EP
GatherBlockQuantizedandLpNormalization, reused the shared WASM loader for Blob-backed external data, and fixed per-axis QDQ and MatMulNBits edge cases (#29475, #29801, #31151, #31152, #31197).OpenVINO / QNN / DML / XNNPACK / TensorRT
Mfrom the input tensor at compute time (#31189).CPU & Core Optimizations
MLAS
CPU Attention & Kernels
Cosand int32 support to CPUTrilu, and fixed int8 QLinearSoftmax saturation and AvgPoolceil_mode/count_include_padbehavior (#28975, #29476, #29629, #29728).TfIdfVectorizerweight indexing and skipped MinLength logits-processor construction wheneos_token_idis negative (#29604, #31649).Graph, Optimizer, and Runtime
GetOverridableInitializerNames()(#29349, #29589, #29616).Splitaxes now produce an error instead of being accepted (#31149).Web & JavaScript
ceil_mode, allowed DFT to ignore excess input data, and fixed a webpack/Terser release-build crash (#29627, #29680, #31652).Build, Packaging & CI
CUDA package architecture selections are now aligned across plugin EP, Python, C API, TensorRT, and Node.js pipelines. Windows arm64 is only available in CUDA plugin EP (#31992):
-realform)Reduced CUDA compilation time and memory usage by splitting generated SM80 MoE, fpA_intB, and MatMulNBits translation units and adding two-level workspace estimation (#29614, #29699, #29811, #31834, #31837).
Fixed CUDA 13 plugin and packaging builds on Windows, Linux, and Windows ARM64, including MSVC/TMA compatibility and CI memory limits (#31608, #31609, #31615, #31616, #31617, #31622, #31729, #31748).
Fixed MLAS AVX2 builds on toolchains without AVX-VNNI assembler support, GCC 15
-Werrorbuilds, and an MSVC C1001 issue in the W2 AVX-512-VNNI dispatch path (#28767, #29679, #29885).Improved Windows compatibility by skipping DXGI discovery when Win32k system calls are unavailable and delay-loading
shell32(#29755, #30889).Fixed Dawn parallel-build races, and GPU discovery in build/test environments (#29858, #29866).
Contributors
Thanks to our 63 contributors for this release!
@adrastogi, @ahsan-ca, @AngelGalindo7, @ankitm3k, @apsonawane, @blazingphoenix7, @bmehta001, @chilo-ms, @claude, @daijh, @ducviet00, @edgchen1, @elwhyjay, @eserscor, @GopalakrishnanN, @guptaishaan, @hariharans29, @Honry, @huningxin, @jchen10, @jiafatom, @jiangzhuo, @Jiawei-Shao, @JonathanC-ARM, @justinchuby, @kjg0724, @kunal-vaishnavi, @kylo5aby, @Laan33, @martin-klacer-arm, @mastryukov1990, @mcollinswisc, @miaobin, @mingmingtasd, @mirounga, @mustjab, @n1harika, @namgyu-youn, @neilmsft, @nenad1002, @nicholascelestin, @OscarFree, @prathikr, @qjia7, @quic-muchhsu, @Sammy-Dabbas, @sanaa-hamel-microsoft, @shiyi9801, @skottmckay, @tairenpiao, @TedThemistokleous, @the0cp, @tianleiwu, @titaiwangms, @velonica0, @wangw-1991, @wuisabel-gif, @xadupre, @xhcao, @xiaofeihan1, @xiaoyu-work, @yen-shi, @zlma7001
Full Changelog: v1.28.0...v1.29.0
v1.28.0: ONNX Runtime v1.28.0Announcements & Breaking Changes
nvrtcis no longer linked, which significantly reduces the required CUDA redistributable footprint (#29252, #29808, #29705, #29620).OrtModelPackageApinow lives in the experimental C API and may change in future releases (#28746, #29142, #28990).wgsl-genimplementation (#29141, #28355).CUDA_QUANT_PREPROCESSis off by default (#29687).Security Fixes
Memory safety & input validation
bind_inputcausing an out-of-bounds write (#28839)TensorAtfor sub-byte packed types (#28973)Col2Iminputs to prevent heap over-read (#28706)CropAndResizeagainst malformedcrop_sizetensors (#28766)BeamSearchvocab_sizeagainst logits width (#28774)WhisperDecoderSubgraph::CreateInitialFeeds(#29239)SparseAttentionCSR indices/key lengths and rejected zero-dimensionblock_row_indices(#29015, #29242)mask_indexto valid bounds (#29449)MaxpoolWithMaskkernel rank against input spatial rank (#29253)EmbedLayerNorm/SkipLayerNormshapes exceeding 32-bit output indexing (#29264)DecoderAttention/MultiHeadAttentionshape inference and negative-axis handling inExpandDimsshape inference (#29268, #29448)TreeEnsembletarget id validation and added input validation toLinearClassifier(#29293, #29060)DynamicQuantizeLSTMzero-point/scale validation typos (#29462)Loop/Scanoutput concatenation (#29397)raw_datato{0, 1}on unpack (#29238)Resize,PadFusion, and LoRA handling (#28779, #28780, #28801)WithOutputTensorin the Rust bindings (#29251)Integer overflow & allocation size
MlasConvPrepareworking-buffer products andConvTransposepad computation with SafeInt (#29444, #29446)SamplingState::Initthat could cause a heap buffer overflow (#29443)B/scales/zero-points shape inMatMulNBits::PrePack(#29445)ConstantOfShapeoutput size against the input initializer before constant folding (#28751)Pad(int64/int32 truncation),Slice, andGatherBlockQuantized(#28721, #28704, #28718)Supply chain & tooling
subprocess(#28776, #28775)shell-quote,esbuild,tmp,ws,protobufjs,js-yaml,tar,markdown-it,@babel/core(#29022, #29044, #29055, #29057, #29061, #29062, #29063, #29079, #29090, #29156)New Features
Execution Provider ABI & Plugin EPs
external_datainto session options (#28271, #28989, #29501)CompileModelvalidation to accept zero-inputOrtModelgraphs (#28771)Core APIs & Runtime
OrtErrorCodedocumentation, single-sourced the values soStatusCodestays in sync, and addedOrtErrorCode::ORT_DEVICE_RESET(#29018, #29065, #29748)EpDeviceUsageevent, and ORT version logging (#28794)model_external_initializers_file_folder_pathis now honored for file-path model loads (#29459)HOST_ACCESSIBLEOrtValueallocation (#28038)Quantization Tooling
CudaQuantizertoonnxruntime.quantization(#29509)Flattenas a Direct8Bit op in the Python QDQ static quantizer (#28340)MaxPoolduring FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#28488, #29350)TensorArraycustom op (#28335)Execution Provider Updates
NVIDIA CUDA EP
Attention & LLM decode
cudnn_frontendto 1.24 and enabled cuDNN SDPA for MHA/GQA (#28849)MoE & quantized GEMM
PrePackhook, symmetric withMatMulNBits, and fixConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot