Skip to content

chore(deps): bump onnxruntime-web from 1.25.1 to 1.26.0 - #8

Merged
qnbs merged 1 commit into
mainfrom
dependabot/npm_and_yarn/onnxruntime-web-1.26.0
May 16, 2026
Merged

chore(deps): bump onnxruntime-web from 1.25.1 to 1.26.0#8
qnbs merged 1 commit into
mainfrom
dependabot/npm_and_yarn/onnxruntime-web-1.26.0

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubMay 12, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps onnxruntime-web from 1.25.1 to 1.26.0.

Release notes

Sourced from onnxruntime-web's releases.

1.26.0

n.b. The following was generated via LLM from Git history. Only the contributor list has been verified.

ONNX Runtime Release 1.26.0

Announcement - Breaking Changes

  • Support for CUDA 12 will be removed in 1.27.0.
    • CUDA 13 will continue to be published as onnxruntime-<os>-<arch>-gpu_cuda13-<version>.<ext>
  • CUDA runtime will be moving soon to a dedicated Execution Provider (EP) instead of a published package from ORT core.

Highlights

  • Added optional memory mapping for .ort model loads (#28164).
  • Added RISC-V Vector (RVV) support for CPU EP (#28261).
  • OpenVINO EP upgraded for 1.26.0 development release (#28297).
  • WebGPU gained GridSample support (#28264) and Split-K improvements (#28151).
  • CUDA plugin EP gained graph support (#28002), profiling API (#28216).

Security and Reliability Hardening

  • Replaced unrestricted Python setattr configuration with an allowlist (#28083).
  • Hardened multiple OOB and overflow scenarios across ML and core ops:
    • Attention mask index OOB write (#27789).
    • MaxPoolGrad indices bounds validation (#27903).
    • SVM and TreeEnsemble bounds/security fixes (#27950, #27951, #27952, #27989).
    • RNN sequence_lens OOB read and integer overflow handling (#28052, #28003).
    • GroupQueryAttention seqlens_k bounds validation and compatibility follow-up (#28031, #28259).
    • MatMulBnb4 and ML coefficient SafeInt checks (#27995, #28001).
    • CUDA Gather int32 overflow fix (#28108).
    • GridSample float->int64 cast hardening for NaN/Inf/out-of-range coords (#28302).
  • Fixed session logger use-after-free during EP teardown under verbose logging (#28274).

CUDA, Attention, and MLAS

  • Filled CUDA opset/operator gaps and extended support:
    • Transpose opset 23 -> 25 (#27740).
    • QuantizeLinear/DequantizeLinear opset 25 (#28046).
    • CUDA TopK INT8/INT16/UINT8 support (#27862).
    • LabelEncoder CUDA support for numeric types (#28045).
  • Attention/GQA improvements:
    • Fixed ONNX Attention min-bias alignment crash on SM<80 and masked-batch NaN behavior (#27831).
    • Added FP32 QK accumulation path for unfused GQA attention (#28198).
    • Added CUDART_VERSION reduction compatibility in GQA attention (#28296).
    • Fixed CUDA 13 build error in GQA unfused attention (#28309).
    • PagedAttention fallback for SM<80 fp16 (#28200).
  • MLAS updates:
    • FP16 Gelu enablement (#26815).
    • Arm64 BF16 fast-math conv kernels for NCHW/NCHWc paths (#27878).

... (truncated)

Commits
  • 8c546c3 1.26.0 - cherry-pick for RC2 (#28347)
  • 55c5c82 GridSample: harden float->int64 casts against NaN/Inf/out-of-range coords (#2...
  • 60ce9cc Relax GQA seqlens_k shape validation for backward compat with older models (#...
  • d02a0fd Fix DoubleQDQPairsRemover adding spurious dimension to scalar scale/zero-poin...
  • 9b30f30 remove weights_are_all_positive_ from TreeEnsemble (#27552)
  • 5f2f848 fix(ci): incorrect relative template includes for setup-feeds (#28312)
  • de2bc90 Add QNN Plugin EP repo link to README (#28225)
  • 8dd4a06 Include license file in built distributions (#27783)
  • 6e19374 Fix CUDA 13 build error in gqa_unfused_attention.cu (#28309)
  • d6c363c [OVEP] OpenVINO EP 1.26.0 Development Release Updates (#28297)
  • Additional commits viewable in compare view

@dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 12, 2026
@codeant-ai

codeant-aiBot commented May 12, 2026

Copy link
Copy Markdown

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

@qnbs

qnbs commented May 12, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabotBotforce-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch from f952b4a to 22899e9CompareMay 12, 2026 08:25
qnbs
qnbs previously approved these changes May 12, 2026
View reviewed changes

@qnbsqnbs left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-approved: patch/minor dependency bump, all tests expected to pass after rebase on fixed CI main.

@dependabot
dependabotBotforce-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch from 22899e9 to 2e0288eCompareMay 12, 2026 08:28
@qnbs
qnbs enabled auto-merge (squash) May 12, 2026 08:28
@dependabot
dependabotBotforce-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch from 2e0288e to 5eadf23CompareMay 12, 2026 12:39
@qnbs

qnbs commented May 12, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabotBotforce-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch 4 times, most recently from c13559e to fcb25feCompareMay 12, 2026 18:23
@qnbs

qnbs commented May 12, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabotBotforce-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch from fcb25fe to 553a1a0CompareMay 12, 2026 18:59
qnbs
qnbs previously approved these changes May 16, 2026
View reviewed changes

@qnbsqnbs left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved: dependency update

qnbs added a commit that referenced this pull request May 16, 2026
@qnbs@claude
chore(deps): bump 16 packages; resolve Dependabot PRs#6#8#10#12#13
2538a42
#20–24
- @playwright/test: 1.59.1 → 1.60.0
- @storybook/{addon-a11y,react,react-vite}: 10.3.5 → 10.3.6
- storybook: 10.3.5 → 10.3.6
- vitest: 4.1.4 → 4.1.6
- @vitest/coverage-v8: 4.1.4 → 4.1.6
- vite: 8.0.8 → 8.0.12
- @tailwindcss/vite: 4.2.2 → 4.3.0
- @types/node: 25.6.0 → 25.7.0
- turbo: 2.9.9 → 2.9.12
- onnxruntime-web: 1.25.1 → 1.26.0
- ai: 6.0.177 → 6.0.178
- @tauri-apps/api: 2.10.1 → 2.11.0
- @tauri-apps/plugin-dialog: 2.7.0 → 2.7.1
- @tauri-apps/plugin-fs: 2.5.0 → 2.5.1
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@dependabot
chore(deps): bump onnxruntime-web from 1.25.1 to 1.26.0
54b905b
Bumps [onnxruntime-web](https://github.com/Microsoft/onnxruntime) from 1.25.1 to 1.26.0.
- [Release notes](https://github.com/Microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseManagement.md)
- [Commits](microsoft/onnxruntime@v1.25.1...v1.26.0)
---
updated-dependencies:
- dependency-name: onnxruntime-web
dependency-version: 1.26.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabotBotforce-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch from 553a1a0 to 54b905bCompareMay 16, 2026 06:33
@qnbs
qnbs merged commit f178b84 into mainMay 16, 2026
10 of 11 checks passed
@dependabot
dependabotBot deleted the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch May 16, 2026 06:54
qnbs added a commit that referenced this pull request Jun 10, 2026
@qnbs@claude
fix(proforge): resolve all 6 CodeAnt PR#107follow-ups
4e9329a
- #5 MCP memory re-seed duplicates: cache capability per payload (sha1 of
payload) in capability.ts + deterministic seed ids (projectId:category:key)
in nodeProForgeCapability so rebuilds overwrite instead of minting fresh ids.
- #7 Copilot stuck 'streaming' on close: useGlobalCopilot.close() now resets
finishLastAssistant + setStatus('idle') when streaming, so future sends work.
- #4 import-time crash on bad --project: read the file lazily inside
resolveCapability, wrapped in an actionable ProForgeError(VALIDATION).
- #6 empty-string runId: runId -> z.string().min(1).optional() in both
getSupervisorStatus + getHistory schemas (now a VALIDATION error).
- #8 disabling enableGlobalCopilot: useSettingsView clears + closes the copilot
session on toggle-off so re-enabling never restores a stale panel.
- #1-3 raw err in MCP responses: fail() returns a generic 'Internal error' for
unexpected errors and writes detail to stderr only; our own ProForgeError
messages still pass through (actionable).
Tests: capabilityLayer empty-runId VALIDATION, idempotent node seeding,
useGlobalCopilot.close reset, useSettingsView copilot clear-on-disable; MCP
smoke extended with idempotent-seed + missing-project VALIDATION assertions.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@qnbsqnbsqnbs left review comments

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@qnbs