Skip to content

chore(deps): bump onnxruntime-web from 1.25.1 to 1.26.0 - #8

Merged
qnbs merged 1 commit into
mainfrom
dependabot/npm_and_yarn/onnxruntime-web-1.26.0
May 16, 2026
Merged

chore(deps): bump onnxruntime-web from 1.25.1 to 1.26.0#8
qnbs merged 1 commit into
mainfrom
dependabot/npm_and_yarn/onnxruntime-web-1.26.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps onnxruntime-web from 1.25.1 to 1.26.0.

Release notes

Sourced from onnxruntime-web's releases.

1.26.0

n.b. The following was generated via LLM from Git history. Only the contributor list has been verified.

ONNX Runtime Release 1.26.0

Announcement - Breaking Changes

  • Support for CUDA 12 will be removed in 1.27.0.
    • CUDA 13 will continue to be published as onnxruntime-<os>-<arch>-gpu_cuda13-<version>.<ext>
  • CUDA runtime will be moving soon to a dedicated Execution Provider (EP) instead of a published package from ORT core.

Highlights

  • Added optional memory mapping for .ort model loads (#28164).
  • Added RISC-V Vector (RVV) support for CPU EP (#28261).
  • OpenVINO EP upgraded for 1.26.0 development release (#28297).
  • WebGPU gained GridSample support (#28264) and Split-K improvements (#28151).
  • CUDA plugin EP gained graph support (#28002), profiling API (#28216).

Security and Reliability Hardening

  • Replaced unrestricted Python setattr configuration with an allowlist (#28083).
  • Hardened multiple OOB and overflow scenarios across ML and core ops:
    • Attention mask index OOB write (#27789).
    • MaxPoolGrad indices bounds validation (#27903).
    • SVM and TreeEnsemble bounds/security fixes (#27950, #27951, #27952, #27989).
    • RNN sequence_lens OOB read and integer overflow handling (#28052, #28003).
    • GroupQueryAttention seqlens_k bounds validation and compatibility follow-up (#28031, #28259).
    • MatMulBnb4 and ML coefficient SafeInt checks (#27995, #28001).
    • CUDA Gather int32 overflow fix (#28108).
    • GridSample float->int64 cast hardening for NaN/Inf/out-of-range coords (#28302).
  • Fixed session logger use-after-free during EP teardown under verbose logging (#28274).

CUDA, Attention, and MLAS

  • Filled CUDA opset/operator gaps and extended support:
    • Transpose opset 23 -> 25 (#27740).
    • QuantizeLinear/DequantizeLinear opset 25 (#28046).
    • CUDA TopK INT8/INT16/UINT8 support (#27862).
    • LabelEncoder CUDA support for numeric types (#28045).
  • Attention/GQA improvements:
    • Fixed ONNX Attention min-bias alignment crash on SM<80 and masked-batch NaN behavior (#27831).
    • Added FP32 QK accumulation path for unfused GQA attention (#28198).
    • Added CUDART_VERSION reduction compatibility in GQA attention (#28296).
    • Fixed CUDA 13 build error in GQA unfused attention (#28309).
    • PagedAttention fallback for SM<80 fp16 (#28200).
  • MLAS updates:
    • FP16 Gelu enablement (#26815).
    • Arm64 BF16 fast-math conv kernels for NCHW/NCHWc paths (#27878).

... (truncated)

Commits
  • 8c546c3 1.26.0 - cherry-pick for RC2 (#28347)
  • 55c5c82 GridSample: harden float->int64 casts against NaN/Inf/out-of-range coords (#2...
  • 60ce9cc Relax GQA seqlens_k shape validation for backward compat with older models (#...
  • d02a0fd Fix DoubleQDQPairsRemover adding spurious dimension to scalar scale/zero-poin...
  • 9b30f30 remove weights_are_all_positive_ from TreeEnsemble (#27552)
  • 5f2f848 fix(ci): incorrect relative template includes for setup-feeds (#28312)
  • de2bc90 Add QNN Plugin EP repo link to README (#28225)
  • 8dd4a06 Include license file in built distributions (#27783)
  • 6e19374 Fix CUDA 13 build error in gqa_unfused_attention.cu (#28309)
  • d6c363c [OVEP] OpenVINO EP 1.26.0 Development Release Updates (#28297)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 12, 2026
@codeant-ai

codeant-ai Bot commented May 12, 2026

Copy link
Copy Markdown

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

@qnbs

qnbs commented May 12, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch from f952b4a to 22899e9 Compare May 12, 2026 08:25
qnbs
qnbs previously approved these changes May 12, 2026
View reviewed changes

@qnbs qnbs left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-approved: patch/minor dependency bump, all tests expected to pass after rebase on fixed CI main.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch from 22899e9 to 2e0288e Compare May 12, 2026 08:28
@qnbs
qnbs enabled auto-merge (squash) May 12, 2026 08:28
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch from 2e0288e to 5eadf23 Compare May 12, 2026 12:39
@qnbs

qnbs commented May 12, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch 4 times, most recently from c13559e to fcb25fe Compare May 12, 2026 18:23
@qnbs

qnbs commented May 12, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch from fcb25fe to 553a1a0 Compare May 12, 2026 18:59
qnbs
qnbs previously approved these changes May 16, 2026
View reviewed changes

@qnbs qnbs left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved: dependency update

qnbs added a commit that referenced this pull request May 16, 2026
@qnbs @claude
chore(deps): bump 16 packages; resolve Dependabot PRs #6 #8 #10 #12 #13
2538a42 
#20–24

- @playwright/test: 1.59.1 → 1.60.0
- @storybook/{addon-a11y,react,react-vite}: 10.3.5 → 10.3.6
- storybook: 10.3.5 → 10.3.6
- vitest: 4.1.4 → 4.1.6
- @vitest/coverage-v8: 4.1.4 → 4.1.6
- vite: 8.0.8 → 8.0.12
- @tailwindcss/vite: 4.2.2 → 4.3.0
- @types/node: 25.6.0 → 25.7.0
- turbo: 2.9.9 → 2.9.12
- onnxruntime-web: 1.25.1 → 1.26.0
- ai: 6.0.177 → 6.0.178
- @tauri-apps/api: 2.10.1 → 2.11.0
- @tauri-apps/plugin-dialog: 2.7.0 → 2.7.1
- @tauri-apps/plugin-fs: 2.5.0 → 2.5.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@dependabot
chore(deps): bump onnxruntime-web from 1.25.1 to 1.26.0
54b905b 
Bumps [onnxruntime-web](https://github.com/Microsoft/onnxruntime) from 1.25.1 to 1.26.0.
- [Release notes](https://github.com/Microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseManagement.md)
- [Commits](microsoft/onnxruntime@v1.25.1...v1.26.0)

---
updated-dependencies:
- dependency-name: onnxruntime-web
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch from 553a1a0 to 54b905b Compare May 16, 2026 06:33
@qnbs
qnbs merged commit f178b84 into main May 16, 2026
10 of 11 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/onnxruntime-web-1.26.0 branch May 16, 2026 06:54
qnbs added a commit that referenced this pull request Jun 10, 2026
@qnbs @claude
fix(proforge): resolve all 6 CodeAnt PR #107 follow-ups
4e9329a 
- #5 MCP memory re-seed duplicates: cache capability per payload (sha1 of
  payload) in capability.ts + deterministic seed ids (projectId:category:key)
  in nodeProForgeCapability so rebuilds overwrite instead of minting fresh ids.
- #7 Copilot stuck 'streaming' on close: useGlobalCopilot.close() now resets
  finishLastAssistant + setStatus('idle') when streaming, so future sends work.
- #4 import-time crash on bad --project: read the file lazily inside
  resolveCapability, wrapped in an actionable ProForgeError(VALIDATION).
- #6 empty-string runId: runId -> z.string().min(1).optional() in both
  getSupervisorStatus + getHistory schemas (now a VALIDATION error).
- #8 disabling enableGlobalCopilot: useSettingsView clears + closes the copilot
  session on toggle-off so re-enabling never restores a stale panel.
- #1-3 raw err in MCP responses: fail() returns a generic 'Internal error' for
  unexpected errors and writes detail to stderr only; our own ProForgeError
  messages still pass through (actionable).

Tests: capabilityLayer empty-runId VALIDATION, idempotent node seeding,
useGlobalCopilot.close reset, useSettingsView copilot clear-on-disable; MCP
smoke extended with idempotent-seed + missing-project VALIDATION assertions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
qnbs added a commit that referenced this pull request Sep 1, 2026
@qnbs
docs(core): close R-15 bootstrap, catalog, and foreign-source gaps (#445
e66fbf9 
)

Closes 8 review findings: 7 mechanical completions of the prior batch's
control-plane graph, plus a new foreign-protected migration-source
subsystem (finding #8, maintainer-designed).

- Bootstrap (§10.2) now uses the exact same prepare_root_anchor/
  commit_root_anchor two-phase sequence as every later root commit,
  with the initial key-epoch control record created before the first
  root claims active_key_epoch. Closes the crash window where a
  NOT_COMMITTED bootstrap slot had no anchor-bound trusted key
  reference to authenticate against.
- Catalog descriptors (§5.5) now use explicit presence encoding
  (has_active_record_generation/has_active_epoch/has_content_digest)
  so a brand-new PENDING(none->1) descriptor never has to invent a
  committed generation/epoch/digest that doesn't exist yet;
  enumerable-but-not-yet-readable is now an explicit, distinct state
  from readable.
- Removed a leftover sentence describing catalog pages as "covered by
  the marker set," which contradicted the catalog self-exclusion rule.
- inventory_digest now has a normative sort tuple (record-class token,
  tagged identity, tagged project scope, source-authority kind,
  source-scheme id) instead of an undefined "sorted."
- marker_set_digest's outer entry is now consistently described as
  five fields (including marker_generation) everywhere it's
  paraphrased, not just in the normative table.
- §6.2 now has a deterministic direct-vs-hashed AAD selection rule for
  the case where two individually-in-bound identity fields would
  jointly exceed the 32 KiB AAD limit.
- New: a three-way source_authority_kind (LEGACY_PLAINTEXT/
  R15_PROTECTED/FOREIGN_PROTECTED), a versioned source_scheme_id
  registry (WEBVIEW_IDB_AT_REST_V1, CREDENTIAL_IDB_KEYSTORE_V1), a
  MigrationSourceAdapter boundary distinct from KeyProvider (§15.3), a
  preserve-first foreign-migration flow with no-transitive-trust
  validation (§10.6), an explicit per-class migration-disposition
  model including credentials' RETAIN_APPROVED_SEPARATE_PROTECTED_
  AUTHORITY (§10.4.1), and 13 new foreign-source fault-injection
  requirements (§16 assertion 19).

No implementation, no status-line or refusal-list change, no other
files touched. Verified: KeyProvider / MigrationSourceAdapter /
source_scheme registry / Core remain four distinct, non-collapsing
layers.
@qnbs qnbs mentioned this pull request Sep 1, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@qnbs qnbs qnbs left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@qnbs