dependabot[bot] opened a new pull request, #1145: URL: https://github.com/apache/opennlp/pull/1145
Bumps `onnxruntime.version` from 1.26.0 to 1.27.0. Updates `com.microsoft.onnxruntime:onnxruntime` from 1.26.0 to 1.27.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/microsoft/onnxruntime/releases";>com.microsoft.onnxruntime:onnxruntime's releases</a>.</em></p> <blockquote> <h2>ONNX Runtime v1.27.0</h2> <p>n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28. n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.</p> <h2>Announcements & Breaking Changes</h2> <ul> <li>CUDA 12 package files are now explicitly named as such.</li> <li>CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.</li> </ul> <hr /> <h2>Security Fixes</h2> <ul> <li>Fixed out-of-bounds read in <code>SoftmaxCrossEntropyLoss</code> via label bounds validation (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28004";>#28004</a>)</li> <li>Hardened <code>OneHot</code> input validation and output-size computation (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28014";>#28014</a>)</li> <li>Added SafeInt overflow protection in <code>Expand</code> and capped constant-folding output sizes (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28055";>#28055</a>)</li> <li>Bounded total output allocation size in <code>Tile</code> kernel (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28070";>#28070</a>)</li> <li>Added mask/input shape consistency checks in <code>MaxpoolWithMask::Compute</code> (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28223";>#28223</a>)</li> <li>Fixed <code>BitShift</code> UB for shift amounts greater than or equal to bit width (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28272";>#28272</a>)</li> <li>Validated sequence bounds in GQA (<code>seqlens_k</code> vs <code>cos_cache</code>) (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28277";>#28277</a>)</li> <li>Validated conv bias shape in <code>WordConvEmbedding</code> to prevent OOB reads (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28279";>#28279</a>)</li> <li>Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28386";>#28386</a>)</li> <li>Fixed out-of-bounds read in <code>CropBase</code> scale handling (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28399";>#28399</a>)</li> <li>Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28400";>#28400</a>)</li> <li>Added sparse tensor external file path validation and additional external-path hardening (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28408";>#28408</a>, <a href="https://redirect.github.com/microsoft/onnxruntime/pull/28709";>#28709</a>, <a href="https://redirect.github.com/microsoft/onnxruntime/pull/28725";>#28725</a>)</li> <li>Switched remaining <code>torch.load()</code> calls to <code>weights_only=True</code> (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28421";>#28421</a>)</li> <li>Added CPU cache-indirection beam-index validation (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28486";>#28486</a>)</li> <li>Added additional overflow/bounds checks and test coverage in runtime buffers (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28713";>#28713</a>, <a href="https://redirect.github.com/microsoft/onnxruntime/pull/28747";>#28747</a>)</li> </ul> <hr /> <h2>New Features</h2> <h3>Execution Provider Plugin API</h3> <ul> <li>Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28037";>#28037</a>)</li> <li>Added <code>OrtEp::OnSessionInitializationEnd()</code> callback (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28319";>#28319</a>)</li> <li>Added plugin EP session-options getters (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28377";>#28377</a>)</li> <li>Added CUDA Plugin EP provider options for streams and external allocators (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28603";>#28603</a>)</li> </ul> <h3>Core APIs & Runtime</h3> <ul> <li>Added support for ONNX overloaded functions (IR v10+) (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28275";>#28275</a>)</li> <li>Added FLOAT8E8M0 datatype support in ONNX Runtime (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28381";>#28381</a>)</li> <li>Added CPU Cast support for FLOAT8E8M0 (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28435";>#28435</a>)</li> <li>Added <code>kOrtEpDevice_EpMetadataKey_OSDriverVersion</code> example and docs (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28282";>#28282</a>)</li> </ul> <h3>Quantization & Training Tooling</h3> <ul> <li>Added calibration cache support to <code>quantize_static</code> (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28221";>#28221</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/microsoft/onnxruntime/commit/8f0278c77bf44b0cc83c098c6c722b92a36ac4b5";><code>8f0278c</code></a> [CUDA] Optimize QMoE SoftmaxTopK router for small-batch decode (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/29026";>#29026</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/66916b0ac8b6fd66008487abfa035296d6975b36";><code>66916b0</code></a> fix: NodeJS pkging stage needs to use CFS (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/29007";>#29007</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/af99e196674ea7150a9c1f21f2facf818f6d3230";><code>af99e19</code></a> Disable OrtEp::ort_version_supported sanity check to work around EPs that don...</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/6fc112f3889e97f00a9cb64fe21d0f43e82e621f";><code>6fc112f</code></a> 1.27.0 - cherry pick 2 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28900";>#28900</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/8f5403c847884eed9fff8b92c2589ce009d4d684";><code>8f5403c</code></a> 1.27.0 - cherry pick 1 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28817";>#28817</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/0b451f516f99e063b646c2a12dbdd45540ae3e43";><code>0b451f5</code></a> Switch NPM publishing to consume from CUDA 13 pipeline (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28773";>#28773</a>) (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28792";>#28792</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/a8baf5c4a589f923a3f0243411405d17af8ec47b";><code>a8baf5c</code></a> Skip SetupDi device discovery if Win32k system calls are disabled (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28535";>#28535</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/5c34495a23a26160627fcf24ccff67c2aa125166";><code>5c34495</code></a> fix(quantization): validate bias scale in QDQ Conv → QLinearConv fusion (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28229";>#28229</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/8da5e9101f1629008afb89237ec828bd2c526017";><code>8da5e91</code></a> Use abseil for readable POSIX stack traces in debug builds (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28405";>#28405</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/8fcb725d6967915f7e2cb010b6583fc27101d14d";><code>8fcb725</code></a> feat(quantization): add opset-21 block_size attribute to QDQ (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28522";>#28522</a>)</li> <li>Additional commits viewable in <a href="https://github.com/microsoft/onnxruntime/compare/v1.26.0...v1.27.0";>compare view</a></li> </ul> </details> <br /> Updates `com.microsoft.onnxruntime:onnxruntime_gpu` from 1.26.0 to 1.27.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/microsoft/onnxruntime/releases";>com.microsoft.onnxruntime:onnxruntime_gpu's releases</a>.</em></p> <blockquote> <h2>ONNX Runtime v1.27.0</h2> <p>n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28. n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.</p> <h2>Announcements & Breaking Changes</h2> <ul> <li>CUDA 12 package files are now explicitly named as such.</li> <li>CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.</li> </ul> <hr /> <h2>Security Fixes</h2> <ul> <li>Fixed out-of-bounds read in <code>SoftmaxCrossEntropyLoss</code> via label bounds validation (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28004";>#28004</a>)</li> <li>Hardened <code>OneHot</code> input validation and output-size computation (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28014";>#28014</a>)</li> <li>Added SafeInt overflow protection in <code>Expand</code> and capped constant-folding output sizes (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28055";>#28055</a>)</li> <li>Bounded total output allocation size in <code>Tile</code> kernel (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28070";>#28070</a>)</li> <li>Added mask/input shape consistency checks in <code>MaxpoolWithMask::Compute</code> (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28223";>#28223</a>)</li> <li>Fixed <code>BitShift</code> UB for shift amounts greater than or equal to bit width (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28272";>#28272</a>)</li> <li>Validated sequence bounds in GQA (<code>seqlens_k</code> vs <code>cos_cache</code>) (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28277";>#28277</a>)</li> <li>Validated conv bias shape in <code>WordConvEmbedding</code> to prevent OOB reads (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28279";>#28279</a>)</li> <li>Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28386";>#28386</a>)</li> <li>Fixed out-of-bounds read in <code>CropBase</code> scale handling (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28399";>#28399</a>)</li> <li>Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28400";>#28400</a>)</li> <li>Added sparse tensor external file path validation and additional external-path hardening (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28408";>#28408</a>, <a href="https://redirect.github.com/microsoft/onnxruntime/pull/28709";>#28709</a>, <a href="https://redirect.github.com/microsoft/onnxruntime/pull/28725";>#28725</a>)</li> <li>Switched remaining <code>torch.load()</code> calls to <code>weights_only=True</code> (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28421";>#28421</a>)</li> <li>Added CPU cache-indirection beam-index validation (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28486";>#28486</a>)</li> <li>Added additional overflow/bounds checks and test coverage in runtime buffers (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28713";>#28713</a>, <a href="https://redirect.github.com/microsoft/onnxruntime/pull/28747";>#28747</a>)</li> </ul> <hr /> <h2>New Features</h2> <h3>Execution Provider Plugin API</h3> <ul> <li>Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28037";>#28037</a>)</li> <li>Added <code>OrtEp::OnSessionInitializationEnd()</code> callback (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28319";>#28319</a>)</li> <li>Added plugin EP session-options getters (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28377";>#28377</a>)</li> <li>Added CUDA Plugin EP provider options for streams and external allocators (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28603";>#28603</a>)</li> </ul> <h3>Core APIs & Runtime</h3> <ul> <li>Added support for ONNX overloaded functions (IR v10+) (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28275";>#28275</a>)</li> <li>Added FLOAT8E8M0 datatype support in ONNX Runtime (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28381";>#28381</a>)</li> <li>Added CPU Cast support for FLOAT8E8M0 (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28435";>#28435</a>)</li> <li>Added <code>kOrtEpDevice_EpMetadataKey_OSDriverVersion</code> example and docs (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28282";>#28282</a>)</li> </ul> <h3>Quantization & Training Tooling</h3> <ul> <li>Added calibration cache support to <code>quantize_static</code> (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/28221";>#28221</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/microsoft/onnxruntime/commit/8f0278c77bf44b0cc83c098c6c722b92a36ac4b5";><code>8f0278c</code></a> [CUDA] Optimize QMoE SoftmaxTopK router for small-batch decode (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/29026";>#29026</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/66916b0ac8b6fd66008487abfa035296d6975b36";><code>66916b0</code></a> fix: NodeJS pkging stage needs to use CFS (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/29007";>#29007</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/af99e196674ea7150a9c1f21f2facf818f6d3230";><code>af99e19</code></a> Disable OrtEp::ort_version_supported sanity check to work around EPs that don...</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/6fc112f3889e97f00a9cb64fe21d0f43e82e621f";><code>6fc112f</code></a> 1.27.0 - cherry pick 2 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28900";>#28900</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/8f5403c847884eed9fff8b92c2589ce009d4d684";><code>8f5403c</code></a> 1.27.0 - cherry pick 1 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28817";>#28817</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/0b451f516f99e063b646c2a12dbdd45540ae3e43";><code>0b451f5</code></a> Switch NPM publishing to consume from CUDA 13 pipeline (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28773";>#28773</a>) (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28792";>#28792</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/a8baf5c4a589f923a3f0243411405d17af8ec47b";><code>a8baf5c</code></a> Skip SetupDi device discovery if Win32k system calls are disabled (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28535";>#28535</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/5c34495a23a26160627fcf24ccff67c2aa125166";><code>5c34495</code></a> fix(quantization): validate bias scale in QDQ Conv → QLinearConv fusion (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28229";>#28229</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/8da5e9101f1629008afb89237ec828bd2c526017";><code>8da5e91</code></a> Use abseil for readable POSIX stack traces in debug builds (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28405";>#28405</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/8fcb725d6967915f7e2cb010b6583fc27101d14d";><code>8fcb725</code></a> feat(quantization): add opset-21 block_size attribute to QDQ (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/28522";>#28522</a>)</li> <li>Additional commits viewable in <a href="https://github.com/microsoft/onnxruntime/compare/v1.26.0...v1.27.0";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
