Bump Microsoft.ML.OnnxRuntime from 1.29.0 to 1.30.0

[dependabot]

Updated Microsoft.ML.OnnxRuntime from 1.29.0 to 1.30.0.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.30.0

ONNX Runtime 1.30.0 expands generative AI inference, improves CPU and GPU performance, adds Go bindings, and strengthens runtime reliability. These notes cover changes since ONNX Runtime 1.29.1.

Highlights

• Expanded CUDA inference support with variable-length causal convolution for continuous batching, speculative decoding in paged XQA, and INT4 paged KV caches with per-channel scales (#​32168, #​32340, #​32515).
• Improved WebGPU PagedAttention, added GPT-OSS support and INT8 KV-cache block quantization, and extended convolution optimizations (#​31727, #​32277, #​32284, #​32420).
• Added fused CPU LinearAttention kernels for AVX-512, Arm64 NEON, and SVE, plus AVX2 LayerNorm/RMSNorm acceleration (#​31674, #​31973, #​32178, #​32356).
• Added Go bindings for the ONNX Runtime C API and DeepSeek Engram contrib operators (#​29615, #​32268).

Announcements & Compatibility

• FP4 QMoE kernels are now enabled by default in CUDA builds, with Windows build support added in this release. Source builds can opt out with -Donnxruntime_USE_FP4_QMOE=OFF (#​32096, #​32163).
• CUDA fpA-intB builds now default to a compact kernel set for FP16 activations, INT4/INT8 weights, scale-only quantization, and block_size=32. Set -Donnxruntime_USE_FPA_INTB_GEMM_FULL=ON when building from source to retain the full kernel set, including BF16, zero-point, bias, larger-block-size, and native Hopper variants (#​32324).
• CPU FP16 Gemm and MatMul execution is gated on hardware acceleration. CPU-assigned FP16 nodes without a matching kernel now fall back to FP32 (#​32301, #​32197).
• WebGPU plugin EP packaging now supports Linux AArch64. Plugin versions were advanced to WebGPU 0.4.0 and CUDA 0.2 (#​32287, #​31960, #​31970).

Security & Reliability

Model Loading, Memory, and Input Validation

• Limited nested model-graph depth and canonicalized external-data locations to harden model loading (#​32344, #​32135).
• Added checked rounding for BFC arena allocations and fixed prepacked-weight reference lifetimes (#​32010, #​32040).
• Strengthened shape, rank, and parameter validation for Split, Scan, GatherND, ScatterND, SpaceToDepth/DepthToSpace, Crop, Conv, Normalizer, and pooling (#​29461, #​31668, #​32034, #​32039, #​32076, #​32157, #​32160, #​32161, #​32345, #​32349).
• Hardened generation and attention input handling, including attention-attribute narrowing, BifurcationDetector inputs, generation subgraph shapes, and QEmbed segment inputs. BeamSearch buffer expansion now uses dynamic shape storage (#​31648, #​31701, #​32009, #​32078, #​32144).
• Validated TreeEnsemble node references and bounded subtree comparison, rejected non-finite CPU RoiAlign coordinates, and required ImageScaler bias to match the channel count (#​32031, #​32043, #​32011, #​32002).
• Added an allowlist of safe LoRA adapter parameter data types, validated MatMulFpQ4 shape inputs, and checked MLAS blockwise quantization/dequantization index ranges (#​31682, #​32032, #​32007).

GPU Bounds and Resource Lifetimes

• Hardened CUDA indexing and buffer-size arithmetic in MatMulNBits, RemovePadding, RotaryEmbedding, SparseAttention, Whisper beam search, NMS, QDQ, and GatherElements (#​31643, #​31994, #​31995, #​31996, #​31998, #​32014, #​32029, #​32030).
• Fixed overflow in CUDA reduction scans and Softmax offset arithmetic, and handled zero-sized outputs in CUDA random-generator kernels (#​32137, #​32330, #​31997).
• Fixed CUDA MultiHeadAttention shared-cache scratch lifetimes and kept CudaAsyncBuffer staging storage alive across CUDA graph replay (#​31968, #​32121).
• Fixed WebGPU out-of-bounds subgroup-matrix loads for partial tiles, zero-initialized writable device-allocator buffers, and rejected foreign GPU handles in built-in data transfers (#​32364, #​32063, #​32317).

Dependencies and Tooling

• Upgraded Protobuf to 33.6 and refreshed Python documentation dependencies, including an ONNX security-related update (#​29906, #​32190, #​32424).
• Updated JavaScript dependencies including js-yaml, joi, fast-uri, and the Next.js end-to-end fixture (#​32397, #​32486, #​32488, #​32505, #​32508).
• Pinned GitHub Actions to full-length commit SHAs and strengthened packaging infrastructure with authenticated package feeds and NPM network isolation (#​32176, #​32005, #​32440).

New Features

Core APIs & Runtime

• Added Go bindings for the ONNX Runtime C API (#​29615).
• Extended memory importing with host-pointer support and added access to preallocated outputs through KernelContext::GetPreallocatedOutput (#​29726, #​32089).
• Added packed-attention workspace recipes and estimates, and made workspace input-shape handling aware of optional inputs (#​32283, #​32321, #​32312).
• Added DeepSeek Engram contrib operators, EngramGate and NGramHashMapping, and expanded kernel coverage for Qwen-3.5 operators (#​32268, #​32106).

Plugin Execution Providers

... (truncated)

1.29.1

This is a patch release on top of v1.29.0, containing GroupQueryAttention capability and KV-cache layout improvements, plugin Execution Provider performance tooling updates, and targeted graph and optimizer fixes.

GroupQueryAttention

• Added bidirectional GroupQueryAttention support on CPU and CUDA through a backward-compatible causal attribute, with explicit handling for unsupported execution paths (#​31704)
• Added a session option and Execution Provider metadata contract for using the BNHS Value KV-cache layout, with graph transformations that preserve compatibility with the existing BNSH operator schema (#​32139)
• Added CPU support for attention_bias with a sliding-window KV cache, including explicit position IDs and post-eviction bias indexing (#​32302)

Runtime and Performance Tools

• Fixed Compile API model serialization when output-model and custom initializer-location callbacks are used together, preventing duplicate graph fields in emitted models (#​32303)
• Updated onnxruntime_perf_test to use plugin Execution Provider device allocators for generated inputs, loaded test data, and pre-allocated outputs, avoiding unnecessary per-run host/device copies (#​32244)

Bug Fixes and Documentation

• Hardened FastGelu fusion to skip malformed Mul and Pow patterns (#​32016)
• Added validation for in-memory external initializer references, rejecting unregistered or mismatched data before graph transformation (#​32042)
• Restored the C API documentation workflow by switching the pinned Doxygen download to the official GitHub release asset (#​32210)

Contributors

Thanks to our 7 contributors for this release!

@​adrastogi, @​apsonawane, @​edgchen1, @​javier-intel, @​jnagi-intel, @​tianleiwu, @​Wayne-Ch

_{Release highlights were drafted with AI assistance and are subject to release-team review.}

Full Changelog: v1.29.0...v1.29.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 14, 2026, 2:14 AM ET / 06:14 UTC.

ClawSweeper review

What this changes

Updates the shared library’s Microsoft.ML.OnnxRuntime dependency from 1.29.0 to 1.30.0 for the bundled native speech stack.

Merge readiness

✅ Ready for maintainer review

This focused dependency update remains useful: current main and the latest release still use 1.29.0. No introduced correctness or security defect was identified.

Priority: P3
Reviewed head: dc08e057104d0373e05ce75c9eb28288de41c455

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, conventional dependency update with existing native compatibility checks and no identified patch defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot update is exempt from contributor runtime proof; existing Windows checks cover native loading, but no after-update execution was performed during this read-only review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot update is exempt from contributor runtime proof; existing Windows checks cover native loading, but no after-update execution was performed during this read-only review.
Evidence reviewed	9 items	Verified introduced change: The pinned base-to-head diff changes exactly one package version, with no feed, workflow, permission, or application-code changes. Still needed on main: The fetched default branch references Microsoft.ML.OnnxRuntime 1.29.0. Latest release comparison: Release v2026.9.3 also references 1.29.0, so the requested version update is not already shipped.
Findings	None	None.
Security	None	None.

How this fits together

ONNX Runtime supplies model inference and native libraries used by the Windows companion’s speech components. The shared library retains a Silero speech detector, while current microphone capture uses managed energy detection; native packaging also supports Piper speech output.

flowchart LR
  A[NuGet dependency version] --> B[Shared library build]
  B --> C[ONNX managed and native libraries]
  C --> D[Shared model inference]
  C --> E[Native speech stack]
  E --> F[Piper speech output]
  C --> G[Windows load and packaging checks]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep the update confined to the existing package reference and retain the established Windows native-loading and release-packaging safeguards.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a dependency and does not report a specific application bug.

Is this the best way to solve the issue?

Yes: changing the existing package reference is the narrowest update path, and the inspected code supplies native-loading regression checks.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against bd9ce43b4d9c.

Labels

Label changes:

• add P3: This is routine dependency maintenance with no demonstrated urgent product regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot update is exempt from contributor runtime proof; existing Windows checks cover native loading, but no after-update execution was performed during this read-only review.

Label justifications:

• P3: This is routine dependency maintenance with no demonstrated urgent product regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot update is exempt from contributor runtime proof; existing Windows checks cover native loading, but no after-update execution was performed during this read-only review.

Evidence

What I checked:

• Verified introduced change: The pinned base-to-head diff changes exactly one package version, with no feed, workflow, permission, or application-code changes. (src/OpenClaw.Shared/OpenClaw.Shared.csproj:24, dc08e057104d)
• Still needed on main: The fetched default branch references Microsoft.ML.OnnxRuntime 1.29.0. (src/OpenClaw.Shared/OpenClaw.Shared.csproj:24, bd9ce43b4d9c)
• Latest release comparison: Release v2026.9.3 also references 1.29.0, so the requested version update is not already shipped. (src/OpenClaw.Shared/OpenClaw.Shared.csproj:24, 84928c4370bc)
• Dependency contract and consumer boundary: VoiceActivityDetector directly imports ONNX Runtime and constructs an InferenceSession, establishing dependency relevance. SpeechInputContractTests explicitly preserve managed energy detection in the current recording pipeline. (src/OpenClaw.Shared/Audio/VoiceActivityDetector.cs:49, dc08e057104d)
• Official upstream release: The official 1.30.0 release notes confirm the release and describe model-loading hardening and runtime fixes. No specific incompatibility with the inspected CPU consumer was established.
• Existing native compatibility safeguards: Windows tests load ONNX Runtime from the test host and probe the tray’s native speech libraries. CI builds the x64 tray before these tests and invokes the release native-dependency verifier for published payloads. (tests/OpenClaw.Tray.Tests/NativeSpeechStackRuntimeTests.cs:41, dc08e057104d)

Likely related people:

• Steve Allen: Raw commit 5aff6f7 adds tests/OpenClaw.Tray.Tests/NativeSpeechStackRuntimeTests.cs:49 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 5aff6f799e9b; files: tests/OpenClaw.Tray.Tests/NativeSpeechStackRuntimeTests.cs)
• Régis Brid: Raw commit b0ba9af adds src/OpenClaw.Shared/Audio/VoiceActivityDetector.cs:49 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: b0ba9affa25d; files: src/OpenClaw.Shared/Audio/VoiceActivityDetector.cs)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.