Skip to content

Bump the microsoft group with 9 updates#317

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/build/props/microsoft-671e64aa8b
Open

Bump the microsoft group with 9 updates#317
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/build/props/microsoft-671e64aa8b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor

Updated Microsoft.AspNetCore.SignalR.Client from 10.0.2 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.SignalR.Client's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.AI.Abstractions from 10.2.0 to 10.8.0.

Release notes

Sourced from Microsoft.Extensions.AI.Abstractions's releases.

10.8.0

This release adds new experimental APIs to Microsoft.Extensions.AI.Abstractions and updates the OpenAI dependency to 2.12.0, alongside documentation, test, and repository maintenance.

Experimental API Changes

New Experimental APIs

  • New experimental API: AIFunctionNameAttribute and AIParameterNameAttribute #​7610 by @​jozkee (co-authored by @​jeffhandley @​Copilot)
  • New experimental API: ToolApprovalRequestContent.RequiresConfirmation (MEAI001) #​7549 by @​javiercn (co-authored by @​Copilot)

What's Changed

AI

  • Upgrade OpenAI dependency to 2.12.0 #​7608 by @​jozkee (co-authored by @​Copilot)
  • Auto-detect audio format in OpenAISpeechToTextClient #​7575 by @​jozkee (co-authored by @​Copilot)
  • Fix ToolJson.AdditionalProperties to accept sub-schema objects #​7546 by @​jozkee (co-authored by @​Copilot)
  • Fix ImageGeneratingChatClient duplicating preceding content and dropping following content #​7624 by @​jozkee (co-authored by @​Copilot)

Vector Data

  • Make all test methods virtual in VectorData.ConformanceTests #​7606 by @​adamsitnik (co-authored by @​Copilot)

Documentation Updates

  • Remove links to ai-samples repo #​7574 by @​gewarren
  • Fix up docs with Copilot (MEVD) #​7597 by @​gewarren
  • Fix up docs with Copilot (M.E.ServiceDiscovery) #​7598 by @​gewarren (co-authored by @​Copilot)
  • Fix up docs with Copilot (MEAI) #​7600 by @​gewarren
  • Fix up docs with Copilot #​7601 by @​gewarren

Test Improvements

  • Fix flaky StampedeTests and harden related test waits #​7572 by @​jeffhandley (co-authored by @​Copilot)
  • Fix SQLitePCLRaw.lib.e_sqlite3 vulnerability by replacing SemanticKernel connectors with CommunityToolkit #​7579 by @​adamsitnik (co-authored by @​Copilot)
  • Removing SemanticKernel Connectors dependency and replacing it #​7584 by @​adamsitnik (co-authored by @​Copilot)
  • Migrate to xUnit v3 #​7607 by @​adamsitnik (co-authored by @​shyamnamboodiripad @​Copilot)

Repository Infrastructure Updates

  • Update OTel GenAI conventions skill for standalone semconv-genai repo #​7519 by @​jeffhandley (co-authored by @​Copilot)
  • Bump dotnet-coverage from 18.7.0 to 18.8.0 #​7552
  • [main] Update dependencies from dotnet/arcade #​7559
  • Fix transitive MessagePack vulnerability in AI template AppHost projects #​7561 by @​adamsitnik (co-authored by @​Copilot)
  • Bump esbuild, @​vitejs/plugin-react and vite in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7564
  • Bump tmp from 0.2.6 to 0.2.7 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7569
  • Bump js-yaml from 4.1.1 to 4.2.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7570
  • Bump PowerShell from 7.6.2 to 7.6.3 #​7576
  • Remove duplicate 'WebAPI' classification from template #​7577 by @​danroth27
  • [main] Update dependencies from dotnet/arcade #​7590
  • Eliminate redundant Correctness CI stage by merging into Build #​7594 by @​adamsitnik (co-authored by @​Copilot)
    ... (truncated)

10.7.0

v10.7.0 graduates the Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes package to stable. The package registers a Kubernetes-aware ResourceQuotaProvider that reads the pod's CPU and memory requests and limits and exposes them to Microsoft.Extensions.Diagnostics.ResourceMonitoring as baseline and maximum quotas, which then feed the request and limit dimensions of the published resource utilization metrics. The companion ResourceQuota and ResourceQuotaProvider types in Microsoft.Extensions.Diagnostics.ResourceMonitoring graduate to stable in the same change so that consumers can implement custom quota providers without taking an experimental dependency.

On the AI side, Microsoft.Extensions.AI.OpenAI moves to OpenAI 2.11.0 and fixes a deserialization bug in ToolJson.AdditionalProperties so that JSON Schema additionalProperties values shaped as sub-schema objects (for example {"type":"string"}) are preserved instead of throwing during deserialization. HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt graduate to stable since both values are consistently available across hosted-file providers, while Purpose and Scope remain experimental as provider-shaped vocabulary. FunctionInvokingChatClient drops a backward-compat path that auto-marked ToolApprovalResponseContent entries with InformationalOnly: true; consumers that need to continue accepting sessions serialized before #​7468 can use the sample ApprovalHistoryNormalizingChatClient middleware added in the test project.

Experimental API Changes

Now Stable

  • Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes package is now stable #​7253
  • Resource Monitoring ResourceQuota and ResourceQuotaProvider APIs are now stable (previously EXTEXP0008) #​7253
  • HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt are now stable (previously MEAI001) #​7513

What's Changed

AI

  • Graduate HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt #​7513 by @​jozkee (co-authored by @​Copilot)
  • Remove backward-compat InformationalOnly case from FICC; suggest middleware workaround #​7538 by @​jozkee (co-authored by @​Copilot)
  • Upgrade OpenAI package from 2.10.0 to 2.11.0 #​7544 by @​jozkee (co-authored by @​Copilot)
  • Fix ToolJson.AdditionalProperties to accept sub-schema objects #​7546 by @​jozkee (co-authored by @​Copilot)

Diagnostics, Health Checks, and Resource Monitoring

  • Move Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes to stable #​7253 by @​amadeuszl (co-authored by @​Copilot)

Repository Infrastructure Updates

  • [main] Update dependencies from dotnet/arcade #​7521
  • Bump dotnet-reportgenerator-globaltool from 5.5.9 to 5.5.10 #​7522
  • Bump dotnet-coverage from 18.6.2 to 18.7.0 #​7530
  • Bump PowerShell from 7.6.1 to 7.6.2 #​7531
  • Bump qs from 6.15.1 to 6.15.2 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7532
  • [main] Update dependencies from dotnet/arcade #​7534
  • Bump tmp from 0.2.5 to 0.2.6 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7537

Acknowledgements

  • @​ericstj submitted issue #​7509 (resolved by #​7544)
  • @​scottt732 submitted issue #​7540 (resolved by #​7546)
  • @​DeagleGross @​wtgodbe @​dariusclay @​evgenyfedorov2 @​peterwald @​PranavSenthilnathan @​shyamnamboodiripad @​stephentoub @​tarekgh reviewed pull requests

Full Changelog: dotnet/extensions@v10.6.0...v10.7.0

10.6.0

Version 10.6.0 stabilizes the response continuation token and background-response APIs in Microsoft.Extensions.AI.Abstractions. Most other AI work for May shipped in 10.5.1; this monthly release rolls those changes up alongside dependency updates and a small Resource Monitoring cleanup.

Experimental API Changes

Now Stable

  • ResponseContinuationToken and background-response APIs are now stable (previously MEAI001) #​7512

What's Changed

AI

  • Stabilize ResponseContinuationToken / background-response APIs #​7512 by @​jozkee (co-authored by @​Copilot)

Repository Infrastructure Updates

  • Update version to 10.6.0 #​7458 by @​jeffhandley
  • [main] Update dependencies from dotnet/arcade #​7451
  • Bump follow-redirects from 1.15.11 to 1.16.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/azure-devops-report/tasks/PublishAIEvaluationReport #​7469
  • Merge release/10.5 into main #​7470 by @​jeffhandley
  • Bump microsoft.visualstudio.slngen.tool from 12.0.13 to 12.0.32 #​7484
  • Bump postcss from 8.5.9 to 8.5.12 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7494
  • Bump dotnet-reportgenerator-globaltool from 5.5.7 to 5.5.9 #​7504
  • Rename release-notes skill to write-release-notes #​7511 by @​jeffhandley (co-authored by @​Copilot)

Acknowledgements

  • @​wtgodbe @​tarekgh @​peterwald @​JeremyLikness @​eiriktsarpalis @​ericstj @​evgenyfedorov2 reviewed pull requests

Full Changelog: dotnet/extensions@v10.5.2...v10.6.0

10.5.2

This patch release ships a single fix to Microsoft.Extensions.VectorData.Abstractions, correcting StorageName resolution when external serialization is enabled. Microsoft.Extensions.VectorData.ConformanceTests, Microsoft.Extensions.AI.Abstractions, Microsoft.Extensions.AI, and Microsoft.Extensions.AI.OpenAI are published alongside it for version coherency — they contain no code changes from 10.5.1.

Packages in this release

Package Version
Microsoft.Extensions.VectorData.Abstractions 10.5.2
Microsoft.Extensions.VectorData.ConformanceTests 10.5.2
Microsoft.Extensions.AI.Abstractions 10.5.2
Microsoft.Extensions.AI 10.5.2
Microsoft.Extensions.AI.OpenAI 10.5.2

What's Changed

Microsoft.Extensions.VectorData.Abstractions

  • Minor fixes to MEVD.Abstractions: correct StorageName behavior when external serialization is enabled, and disable a warning for net462. (by @​roji in #​7475)

Full Changelog: dotnet/extensions@v10.5.1...v10.5.2

10.5.1

Version 10.5.1 of the Microsoft.Extensions.AI packages stabilizes CodeInterpreter, WebSearch, and ImageGeneration tool content types. The release adds new experimental tool search and OpenAI request policy hooks. And the OpenTelemetry gen-ai semantic conventions are updated to align with v1.41.

The 'aiagent-webapi' project template in Microsoft.Agents.AI.ProjectTemplates is updated to align with v1.3.0 of Agent Framework, updating the OpenTelemetry dependencies within the template projects as well.

Packages in this release

Package Version
Microsoft.Extensions.AI 10.5.1
Microsoft.Extensions.AI.Abstractions 10.5.1
Microsoft.Extensions.AI.OpenAI 10.5.1
Microsoft.Extensions.AI.Templates 10.5.1-preview.3.26251.3
Microsoft.Agents.AI.ProjectTemplates 1.3.0-preview.1.26251.3

Experimental API Changes

Now Stable

The following types previously emitted the MEAI001 experimental diagnostic and are now stable.

  • CodeInterpreter and WebSearch tool content types are now stable #​7493
    • CodeInterpreterToolCallContent
    • CodeInterpreterToolResultContent
    • WebSearchToolCallContent
    • WebSearchToolResultContent
  • ImageGeneration tool content types and tool are now stable #​7476
    • ImageGenerationToolCallContent
    • ImageGenerationToolResultContent
    • HostedImageGenerationTool
    • ImageGenerationOptions
    • ImageGenerationResponseFormat (the Hosted enum value remains experimental)
    • IImageGenerator and the rest of the image generation infrastructure also remain experimental

New Experimental APIs

The following new APIs emit the MEAI001 experimental diagnostic.

  • New experimental API: HostedToolSearchTool with DeferredTools for tool-search-driven deferred tool loading #​7471
  • New experimental API: OpenAIRequestPolicies extension hook for appending System.ClientModel.PipelinePolicy instances to outgoing OpenAI requests #​7495

Breaking Changes to Experimental APIs

  • WebSearchToolResultContent.Results was renamed to Outputs as part of the stabilization in #​7493, aligning with CodeInterpreterToolResultContent.Outputs. The original Results property was included in version 10.4.0 and 10.5.0; this is a binary breaking change and consumers need to update to consume the updated property.

    WebSearchToolResultContent content = ...;
- IList<AIContent>? items = content.Results;
+ IList<AIContent>? items = content.Outputs;

... (truncated)

10.5.0

HTTP Logging Middleware APIs in Microsoft.AspNetCore.Diagnostics.Middleware are now stable. This release also transfers Microsoft.Extensions.VectorData.Abstractions and Microsoft.Extensions.VectorData.ConformanceTests from the Semantic Kernel repository into dotnet/extensions, jumping from 10.1.0 to 10.5.0 for consistent versioning. The release also delivers fixes across the AI libraries, AI Evaluation, and Service Discovery.

Breaking Changes

  1. Rename VectorStoreVectorAttribute constructor parameter #​7460
    • The Dimensions parameter was renamed to dimensions (lowercase). This is a source-breaking change only — binary compatibility is preserved.
    • If you use the named argument syntax new VectorStoreVectorAttribute(Dimensions: 1536), update it to new VectorStoreVectorAttribute(dimensions: 1536).

Experimental API Changes

Now Stable

  • HTTP Logging Middleware APIs are now stable (previously EXTEXP0013): AddHttpLogEnricher<T>, IHttpLogEnricher, and RequestHeadersLogEnricherOptions.HeadersDataClasses #​7380

What's Changed

AI

  • Fix OpenAIResponsesChatClient to respect "store":false in responses #​7417 by @​stephentoub
  • Fix InvalidOperationException in CoalesceWebSearchToolCallContent #​7419 by @​stephentoub
  • Handle F# optional parameters in AIFunctionFactory schema generation #​7439 by @​eiriktsarpalis
  • Fix ComputerCallResponseItem using Item.Id instead of CallId #​7446 by @​jozkee
  • Fix HostedFileContent with image MIME type sent as input_file instead of input_image #​7438 by @​stephentoub (co-authored by @​copilot)
  • Guard Activity.Current restore with null check in OpenTelemetry streaming clients #​7443 by @​stephentoub (co-authored by @​copilot)
  • Enable stateless mode in remote MCP server template (released as v1.2.0 on 2026-04-01) #​7441 by @​jeffhandley

Vector Data

  • Move Microsoft.Extensions.VectorData.Abstractions over from Semantic Kernel #​7434 by @​roji
  • Rename VectorStoreVectorAttribute dimensions constructor parameter #​7460 by @​roji

AI Evaluation

  • Add Path Validation for DiskBasedResponseCache and DiskBasedResultStore #​7397 by @​peterwald
  • Update brace-expansion for CVE-2026-33750 #​7457 by @​SamMonoRT

ASP.NET Core Extensions

  • Removing experimental attribute from Http logging middleware #​7380 by @​mariamgerges

Service Discovery

  • Implement RFC6761 reserved DNS names handling #​6924 by @​rzikm

Documentation Updates

  • Remove per-library CHANGELOG.md files #​7413 by @​jeffhandley

Test Improvements

... (truncated)

10.4.1

This release of the Microsoft.Extensions.AI packages adds new experimental APIs for Realtime client sessions and Text-to-Speech, along with OpenTelemetry and middleware improvements.

Packages in this release

Package Version
Microsoft.Extensions.AI.Abstractions 10.4.1
Microsoft.Extensions.AI 10.4.1
Microsoft.Extensions.AI.OpenAI 10.4.1

Experimental API Changes

New Experimental APIs

  • New experimental API: Realtime Client Sessions #​7285 and #​7399
  • New experimental API: Text-to-Speech Client #​7381

Changes to Experimental APIs

  • Hosted File Download Stream: write-path methods now explicitly throw NotSupportedException #​7394

What's Changed

AI

  • Add ITextToSpeechClient abstraction, middleware, and OpenAI implementation #​7381 by @​stephentoub
  • Realtime Client Proposal #​7285 by @​tarekgh
  • Add VoiceActivityDetection options to realtime session abstractions #​7399 by @​tarekgh
  • Make UriContent mediaType parameter optional with inference from URI file extension #​7398 by @​stephentoub (co-authored by @​Copilot)
  • Emit gen_ai.client.operation.exception via ILogger LoggerMessage on OpenTelemetry instrumentation classes #​7379 by @​stephentoub (co-authored by @​Copilot)
  • Support invoke_workflow as an equivalent parent span to invoke_agent in FunctionInvokingChatClient #​7382 by @​stephentoub (co-authored by @​Copilot)
  • Make HostedFileDownloadStream explicitly read-only #​7394 by @​stephentoub (co-authored by @​Copilot)

Documentation Updates

  • Document JSON schema derivation for return types in AIFunctionFactory #​7400 by @​stephentoub (co-authored by @​Copilot)

Test Improvements

  • Fix test warnings #​7369 by @​jozkee
  • Add tests for JSON deserialization of serializable types #​7373 by @​stephentoub (co-authored by @​Copilot)

Repository Infrastructure Updates

  • Update Package Validation Baseline to 10.4.0 #​7389 by @​jeffhandley (co-authored by @​Copilot)
  • Update ModelContextProtocol libraries to version 1.0.0 #​7340 by @​stephentoub (co-authored by @​Copilot)

Acknowledgements

  • @​eiriktsarpalis @​ericstj @​CodeBlanch @​lmolkova @​adamsitnik @​joperezr reviewed pull requests
    ... (truncated)

10.4.0

This release advances the AI abstractions with new hosted file, web search, and reasoning content types, stabilizes MCP and tool approval APIs, adds streaming latency metrics to OpenTelemetry instrumentation, and delivers bug fixes across caching, data ingestion, and resource monitoring.

Experimental API Changes

Now Stable

  • MCP Server Tool Content and Function Call Approval APIs are now stable (previously MEAI001) #​7299
  • FakeLogCollector.GetLogsAsync(CancellationToken) is now stable (previously EXTEXP0003) #​7332

New Experimental APIs

  • New experimental AddExtendedHttpClientLogging overloads with wrapHandlersPipeline parameter (EXTEXP0013) #​7231

Removed Experimental APIs

  • AI Tool Reduction experimental APIs removed (was experimental under MEAI001) #​7353

What's Changed

AI

  • Add IHostedFileClient and friends #​7269 by @​stephentoub
  • Add web search tool call content #​7276 by @​stephentoub (co-authored by @​Copilot)
  • Surface OpenAI-compatible reasoning_content as TextReasoningContent #​7295 by @​stephentoub
  • MCP/Approvals/Tool Contents stabilization #​7299 by @​jozkee
  • Implement time_to_first_chunk and time_per_output_chunk streaming metrics in OpenTelemetryChatClient #​7325 by @​stephentoub (co-authored by @​Copilot)
  • Add openai.api.type telemetry attribute to OpenAI IChatClient implementations #​7316 by @​stephentoub (co-authored by @​Copilot)
  • Update OpenTelemetry Gen AI semantic conventions to v1.40 #​7322 by @​stephentoub (co-authored by @​Copilot)
  • Fix tool definitions emission regardless of sensitivity setting #​7346 by @​stephentoub (co-authored by @​Copilot)
  • Honor [Required] attribute in AI function parameter JSON schema generation #​7272 by @​stephentoub (co-authored by @​Copilot)
  • AddAIContentType automatically registers content type against every base in the inheritance chain up to AIContent #​7358 by @​jozkee (co-authored by @​Copilot)
  • Auto-mark server-handled FunctionCallContent as InformationalOnly #​7314 by @​stephentoub (co-authored by @​Copilot)
  • Map ReasoningEffort.None and ExtraHigh to none and xhigh in OpenAI IChatClient implementations #​7319 by @​stephentoub (co-authored by @​Copilot)
  • Handle DynamicMethod reflection limitations in AIFunctionFactory #​7287 by @​stephentoub (co-authored by @​Copilot)
  • Fix Activity.Current nulled during streaming tool invocation #​7321 by @​flaviocdc (co-authored by @​Copilot)
  • Handle FunctionCallOutputResponseItem in streaming response conversion #​7307 by @​stephentoub (co-authored by @​Copilot)
  • Fix serialization of response continuation tokens #​7356 by @​stephentoub
  • Remove AI Tool Reduction experimental APIs #​7353 by @​stephentoub (co-authored by @​Copilot)
  • Update OpenAI to 2.9.1 #​7349 by @​stephentoub

Telemetry and Observability

  • Introduce support for the Gauge metric type #​7203 by @​rainsxng
  • Update logging source generator to support generic methods #​7331 by @​svick (co-authored by @​Copilot)
  • Update logging source generator to match runtime PR #​124589 (ref readonly/params/scoped) #​7333 by @​svick (co-authored by @​Copilot)
  • Promote FakeLogCollector.GetLogsAsync(CancellationToken) from experimental to stable #​7332 by @​Demo30
  • Remove obsolete CS1591 warning suppression from generated file preamble #​7308 by @​luissena

HTTP Resilience and Diagnostics

... (truncated)

10.3.0

Experimental API Changes

Now Stable

  • IChatReducer interface — graduated from experimental to stable. The interface is now stable; concrete implementations (MessageCountingChatReducer, SummarizingChatReducer, ReducingChatClient) remain experimental. #​7235 by @​jeffhandley
  • FunctionCallContent and FunctionResultContent unsealed — changed from sealed class to class, enabling derivation. #​7229 by @​stephentoub (co-authored by @​Copilot)

Breaking Changes to Experimental APIs

  • Experimental diagnostic ID reorganization — the blanket MEAI001 diagnostic ID was split into feature-specific constants. OpenAI-specific experimental APIs now use OPENAI001, OPENAI002, or SCME0001 instead of MEAI001. Consumers who suppressed MEAI001 for OpenAI APIs may need to suppress OPENAI001/OPENAI002 instead. #​7116 by @​jeffhandley (co-authored by @​Copilot), #​7235 by @​jeffhandley

New Experimental APIs

  • Chat reduction implementations — MessageCountingChatReducer, SummarizingChatReducer, ReducingChatClient, and UseChatReducer builder extension. #​7235 by @​jeffhandley
  • OpenAI Responses/Assistants/Realtime/Image/Audio integrations — assigned feature-specific experimental diagnostic IDs (OPENAI001, OPENAI002). #​7235 by @​jeffhandley
  • ImageGenerationToolCallContent and ImageGenerationToolResultContent — added to JSON serialization infrastructure. #​7275 by @​stephentoub (co-authored by @​Copilot)

What's Changed

AI

  • Add ReasoningOptions to ChatOptions #​7252 by @​stephentoub (co-authored by @​Copilot)
  • Add LoadFromAsync and SaveToAsync helper methods to DataContent #​7159 by @​stephentoub (co-authored by @​Copilot)
  • Add FunctionCallContent.InformationalOnly property #​7126, #​7262 by @​stephentoub (co-authored by @​Copilot)
  • Add server tool call support to OpenTelemetryChatClient per semantic conventions #​7240 by @​stephentoub (co-authored by @​Copilot)
  • Add ImageGenerationToolCallContent and ImageGenerationToolResultContent to JSON serialization infrastructure #​7275 by @​stephentoub (co-authored by @​Copilot)
  • Add logging to FunctionInvokingChatClient for approval flow, error handling, and loop control #​7228 by @​stephentoub (co-authored by @​Copilot)
  • Allow FunctionResultContent pass-through when CallId matches #​7229 by @​stephentoub (co-authored by @​Copilot)
  • Remove AIFunctionDeclaration tools on last iteration in FunctionInvokingChatClient #​7207 by @​stephentoub (co-authored by @​Copilot)
  • Propagate CachedInputTokenCount in OpenTelemetry telemetry #​7234 by @​stephentoub (co-authored by @​Copilot)
  • Categorize MEAI001 experimental APIs #​7116 by @​jeffhandley (co-authored by @​Copilot)
  • MEAI: Update Experimental / Preview Features #​7235 by @​jeffhandley
  • ToChatResponse: Merge AdditionalProperties into ChatMessage instead of ChatResponse #​7194 by @​stephentoub (co-authored by @​Copilot)
  • Fix FunctionInvokingChatClient to respect ChatOptions.Tools modifications by function tools #​7218 by @​stephentoub (co-authored by @​Copilot)
  • Fix FunctionInvokingChatClient invoke_agent span detection with exact match or space delimiter #​7224 by @​stephentoub (co-authored by @​Copilot)
  • Fix approval request/response correlation in FunctionInvokingChatClient #​7261 by @​stephentoub (co-authored by @​Copilot)
  • Fix DataUriParser to default to text/plain;charset=US-ASCII per RFC 2397 #​7247 by @​stephentoub (co-authored by @​Copilot)
  • Fix NRT resolution for AIFunction parameters #​7200 by @​eiriktsarpalis
  • Preserve extra JSON schema properties in ToolJson serialization #​7250 by @​stephentoub (co-authored by @​Copilot)
  • Fix token metric unit to use UCUM format {token} #​7241 by @​stephentoub
  • Fix OpenAI responses streaming to preserve encrypted reasoning content #​7266 by @​stephentoub
  • Update OpenAIResponsesChatClient to handle streaming code interpreter content #​7267 by @​stephentoub

Diagnostics, Health Checks, and Resource Monitoring

  • [5752] FakeLogCollector waiting capabilities #​6228 by @​Demo30
  • Bring new cpu.requests formula from Kubernetes #​7239 by @​amadeuszl

Service Discovery

... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection from 10.0.2 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging from 10.0.2 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Logging's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.ML.OnnxRuntime from 1.23.2 to 1.27.1.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.27.1

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

  • [MLAS] Fixed an igemm regression in the KleidiAI path (#​28571)
  • Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#​29081)
  • Fixed a regression in graph-capture session initialization that rejected an empty graph (#​29457)
  • Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#​29574)

Performance

NVIDIA CUDA EP

  • Added a QMoE GEMV fast path for batch-1 decode (#​29038)

CI & Build Infrastructure

  • Fixed an incorrect identity for azcopy (#​29274)
  • Fixed a brew install applesimutils failure by trusting the wix/brew tap (#​29450)
  • Upgraded to Xcode 26 (#​29468)
  • Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#​29575)
  • Fixed the web e2e (npm/vite) and Python DML CI pipelines (#​29609)

Contributors

Thanks to our 8 contributors for this release!

@​tianleiwu, @​chilo-ms, @​edgchen1, @​adrastogi, @​damdoo01-arm, @​JonathanC-ARM, @​martin-klacer-arm, @​sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1

1.27.0

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28.
n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

  • CUDA 12 package files are now explicitly named as such.
  • CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

Security Fixes

  • Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#​28004)
  • Hardened OneHot input validation and output-size computation (#​28014)
  • Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#​28055)
  • Bounded total output allocation size in Tile kernel (#​28070)
  • Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#​28223)
  • Fixed BitShift UB for shift amounts greater than or equal to bit width (#​28272)
  • Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#​28277)
  • Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#​28279)
  • Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#​28386)
  • Fixed out-of-bounds read in CropBase scale handling (#​28399)
  • Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#​28400)
  • Added sparse tensor external file path validation and additional external-path hardening (#​28408, #​28709, #​28725)
  • Switched remaining torch.load() calls to weights_only=True (#​28421)
  • Added CPU cache-indirection beam-index validation (#​28486)
  • Added additional overflow/bounds checks and test coverage in runtime buffers (#​28713, #​28747)

New Features

Execution Provider Plugin API

  • Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#​28037)
  • Added OrtEp::OnSessionInitializationEnd() callback (#​28319)
  • Added plugin EP session-options getters (#​28377)
  • Added CUDA Plugin EP provider options for streams and external allocators (#​28603)

Core APIs & Runtime

  • Added support for ONNX overloaded functions (IR v10+) (#​28275)
  • Added FLOAT8E8M0 datatype support in ONNX Runtime (#​28381)
  • Added CPU Cast support for FLOAT8E8M0 (#​28435)
  • Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#​28282)

Quantization & Training Tooling

  • Added calibration cache support to quantize_static (#​28221)
  • Added ActivationRestrictedAsymmetric quantization option (#​28237)
    ... (truncated)

1.26.0

n.b. The following was generated via LLM from Git history. Only the contributor list has been verified.

ONNX Runtime Release 1.26.0

Announcement - Breaking Changes

  • Support for CUDA 12 will be removed in 1.27.0.
    • CUDA 13 will continue to be published as onnxruntime-<os>-<arch>-gpu_cuda13-<version>.<ext>
  • CUDA runtime will be moving soon to a dedicated Execution Provider (EP) instead of a published package from ORT core.

Highlights

  • Added optional memory mapping for .ort model loads (#​28164).
  • Added RISC-V Vector (RVV) support for CPU EP (#​28261).
  • OpenVINO EP upgraded for 1.26.0 development release (#​28297).
  • WebGPU gained GridSample support (#​28264) and Split-K improvements (#​28151).
  • CUDA plugin EP gained graph support (#​28002), profiling API (#​28216).

Security and Reliability Hardening

  • Replaced unrestricted Python setattr configuration with an allowlist (#​28083).
  • Hardened multiple OOB and overflow scenarios across ML and core ops:
  • Fixed session logger use-after-free during EP teardown under verbose logging (#​28274).

CUDA, Attention, and MLAS

  • Filled CUDA opset/operator gaps and extended support:
    • Transpose opset 23 -> 25 (#​27740).
    • QuantizeLinear/DequantizeLinear opset 25 (#​28046).
    • CUDA TopK INT8/INT16/UINT8 support (#​27862).
    • LabelEncoder CUDA support for numeric types (#​28045).
  • Attention/GQA improvements:
    • Fixed ONNX Attention min-bias alignment crash on SM<80 and masked-batch NaN behavior (#​27831).
    • Added FP32 QK accumulation path for unfused GQA attention (#​28198).
    • Added CUDART_VERSION reduction compatibility in GQA attention (#​28296).
    • Fixed CUDA 13 build error in GQA unfused attention (#​28309).
    • PagedAttention fallback for SM<80 fp16 (#​28200).
  • MLAS updates:
    • FP16 Gelu enablement (#​26815).
    • Arm64 BF16 fast-math conv kernels for NCHW/NCHWc paths (#​27878).

WebGPU, WebNN, and JavaScript

... (truncated)

1.25.1

n.b. This changelog is LLM generated. Only the contributor listing has been verified.

ONNX Runtime Release 1.25.1

📢 Announcements & Breaking Changes

ONNX Op Updates

  • Enhanced ONNX operator support with new opset versions: Reshape (opset 25), Transpose (opset 24) (#​27752)

✨ New Features

📊 New ONNX Ops & Model Support

  • LinearAttention and CausalConvState operators for Qwen3.5 model support (#​27907)
  • RotaryEmbedding (RotEMB) and RMSNorm operators added (#​27752)
  • Linear Attention signature support (#​27842)

🌐 Web & JavaScript

WebGPU EP

  • Qwen3.5 model support on WebGPU execution provider (#​27996)
  • QMoE 1-token decode path optimization — fused operations to reduce GPU dispatches for improved performance (#​27998)

🐛 Bug Fixes

Core Runtime Fixes

  • Improved filesystem error messages during Linux device discovery for better debugging experience (#​27289)
  • Fixed missing include for SetRawDataInTensorProto in NVIDIA TensorRT RTX tests (#​28065)

🙏 Contributors

Thanks to our 7 contributors for this release:
@​guschmue, @​sanaa-hamel-microsoft, @​apsonawane, @​eserscor, @​ishwar-raut1, @​qjia7, @​theHamsta

Full Changelog: microsoft/onnxruntime@v1.25.0...v1.25.1

1.25.0

📢 Announcements & Breaking Changes

Build & Platform

  • C++20 is now required to build ONNX Runtime from source. Minimum toolchains: MSVC 19.29+, GCC 10+, Clang 10+. Users of prebuilt packages are unaffected. (#​27178)
  • CUDA minimum version raised to 12.0 — CUDA 11.x is no longer supported. Users pinned to CUDA 11.x should stay on ORT 1.24.x or upgrade their CUDA toolkit/driver. (#​27570)
  • ONNX upgraded to 1.21.0 (#​27601)
  • sympy is now an optional dependency for Python builds. (#​27200)

Execution Provider Changes

  • ArmNN EP has been removed. Users should remove any --use_armnn build flags and migrate to the MLAS/KleidiAI-backed CPU EP or QNN EP for Qualcomm hardware. (#​27447)

API Version

🔒 Security Fixes

  • Fixed potential integer truncation leading to heap out-of-bounds read/write (#​27544)
  • Addressed Pad Reflect vulnerability (#​27652)
  • Security fix for transpose optimizer (#​27555)
  • Upgraded minimatch 3.1.2 → 3.1.4 for CVE-2026-27904 (#​27667)
  • Hardened shell command handling for constant strings (#​27840)
  • Added validation of onnx::TensorProto data size before allocation (#​27547)
  • Cleaned up external data path validation (#​27539)
  • Fixed misaligned address reads for tensor attributes from raw data buffers (#​27312)
  • Fixed CPU Attention overflow issue (#​27822)
  • Fixed CPU LRN integer overflow issues (#​27886)
  • Additional input validation hardening:

✨ New Features

🔌 Execution Provider Plugin API & CUDA Plugin EP

... (truncated)

1.24.4

This is a patch release for ONNX Runtime 1.24, containing bug fixes and execution provider updates.

Bug Fixes

  • Core: Added PCI bus fallback for Linux GPU device discovery in containerized environments (e.g., AKS/Kubernetes) where nvidia-drm is not loaded but GPU PCI devices are still exposed via sysfs. (#​27591)
  • Plugin EP: Fixed null pointer dereference when iterating output spans in GetOutputIndex. (#​27644)
  • Plugin EP: Fixed bug that incorrectly assigned duplicate MetaDef IDs to fused nodes in different GraphViews (e.g., then/else branches of an If node), causing session creation to fail with a conflicting kernel error. (#​27666)

Execution Provider Updates

  • QNN EP: Enabled offline x64 compilation with memhandle IO type by deferring rpcmem library loading to inference time. (#​27479)
  • QNN EP: Reverted QNN SDK logging verbosity changes that caused segmentation faults on backend destruction. (#​27650)

Build and Infrastructure

  • Python: Updated python_requires from >=3.10 to >=3.11 to reflect dropped Python 3.10 support. (#​27354)
  • Build: Replaced __builtin_ia32_tpause with the compiler-portable _tpause intrinsic to fix cross-compiler portability issues between GCC and LLVM. (#​27607)

Full Changelog: v1.24.3...v1.24.4

Contributors

@​derdeljan-msft, @​adrianlizarraga, @​apwojcik, @​baijumeswani, @​edgchen1, @​mocknen, @​tianleiwu, @​XXXXRT666

1.24.3

This is a patch release for ONNX Runtime 1.24, containing bug fixes, security improvements, performance enhancements, and execution provider updates.

Security Fixes

  • Core: Fixed GatherCopyData integer truncation leading to heap out-of-bounds read/write. (#​27444)
  • Core: Fixed RoiAlign heap out-of-bounds read via unchecked batch_indices. (#​27543)
  • Core: Prevent heap OOB from maliciously crafted Lora Adapters. (#​27518)
  • Core: Fixed out-of-bounds access for Resize operation. (#​27419)

Bug Fixes

  • Core: Fixed GatherND division by zero when batch dimensions mismatch. (#​27090)
  • Core: Fixed validation for external data paths for models loaded from bytes. (#​27430)
  • Core: Fixed SkipLayerNorm fusion incorrectly applied when gamma/beta are not 1D. (#​27459)
  • Core: Fixed double-free in TRT EP custom op domain Release functions. (#​27471)
  • Core: Fixed QMoE CPU Operator. (#​27360)
  • Core: Fixed MatmulNBits prepacking scales. (#​27412)
  • Python: Fixed refcount bug in map input conversion that caused shutdown segfault. (#​27413)
  • NuGet: Fixed DllImportResolver. (#​27397)
  • NuGet: Added OrtEnv.DisableDllImportResolver to prevent fatal error on resolver conflict. (#​27535)

Performance Improvements

  • Core: QMoE CPU performance update (up to 4x on 4-bit). (#​27364)
  • Core: Fixed O(n²) model load time for TreeEnsemble with categorical feature chains. (#​27391)

Execution Provider Updates

  • NvTensorRtRtx EP:
    • Avoid repetitive creation of fp4/fp8 native-custom-op domains. (#​27192)
    • Added missing override specifiers to suppress warnings. (#​27288)
    • DQ→MatMulNBits fusion transformer. (#​27466)
  • WebGPU:
    • Used embedded WASM module in Blob URL workers when wasmBinary is provided. (#​27318)
    • Fixed usage of wasmBinary together with a blob URL for .mjs. (#​27411)
    • Removed the unhelpful "Unknown CPU vendor" warning. (#​27399)
    • Allows new memory info name for WebGPU. (#​27475)
  • MLAS:
    • Added DynamicQGemm function pointers and ukernel interface. (#​27403)
    • Fixed error where bytes is not assigned for dynamic qgemm pack b size. (#​27421)
  • VitisAI EP: Removed s_kernel_registry_vitisaiep.reset() in deinitialize_vitisai_ep(). (#​27295)
  • Plugin EPs: Added "library_path" metadata entry to OrtEpDevice instances for plugin and provider bridge EPs. (#​27522)

Build and Infrastructure

  • Pipelines:
    • Build Windows ARM64X binaries as part of packaging pipeline. (#​27316)
    • Moved JAR testing pipelines to canonical pipeline template. (#​27480)
  • Python: Enabled Python 3.14 CI and upgraded dependencies. (#​27401)
  • Build: Suppressed spurious Array Out of Bounds warnings produced by GCC 14.2 compiler on Linux builds. (#​27454)
  • Build: Fixed -Warray-bounds build error in MLAS on clang 17+. (#​27499)
  • Telemetry: Added/Updated telemetry events. (#​27356)
  • Config: Increased kMaxValueLength to 8192. (#​27521)

... (truncated)

1.24.2

This is a patch release for ONNX Runtime 1.24, containing several bug fixes, security improvements, and execution provider updates.

Bug Fixes

  • NuGet: Fixed native library loading issues in the ONNX Runtime NuGet package on Linux and macOS. (#​27266)
  • macOS: Fixed Java support and Jar testing on macOS ARM64. (#​27271)
  • Core: Enable Robust Symlink Support for External Data for Huggingface Hub Cache. (#​27374)
  • Core: Added boundary checks for SparseTensorProtoToDenseTensorProto to improve robustness. (#​27323)
  • Security: Fixed an out-of-bounds read vulnerability in ArrayFeatureExtractor. (#​27275)

Execution Provider Updates

  • MLAS: Fixed flakiness and accuracy issues in Lut GEMM (MatMulNBitsLutGemm). (#​27216)
  • QNN: Enabled 64-bit UDMA mode for HTP target v81 or above. (#​26677)
  • WebGPU:
    • Used LazyRelease for prepack allocator. (#​27077)
    • Fixed ConvTranspose bias validation in both TypeScript and C++ implementations. (#​27213)
  • OpenVINO (OVEP): Patch to reduce resident memory by reusing weight files across shared contexts. (#​27238)
  • DNNL: Fixed DNNL build error by including missing files. (#​27334)

Build and Infrastructure

  • CUDA:
    • Added support for CUDA architecture family codes (suffix 'f') introduced in CUDA 12.9. (#​27278)
    • Fixed build errors and warnings for various CUDA versions (12.8, 13.0, 13.1.1). (#​27276)
    • Applied patches for Abseil CUDA warnings. (#​27096, #​27126)
  • Pipelines:
    • Fixed Python packaging pipeline for Windows ARM64 and release. (#​27339, #​27350, #​27299)
    • Fixed DirectML NuGet pipeline to correctly bundle x64 and ARM64 binaries for release. (#​27349)
    • Updated Microsoft.ML.OnnxRuntime.Foundry package for Windows ARM64 support and NuGet signing. (#​27294)
  • Testing: Updated BaseTester to support plugin EPs with both compiled nodes and registered kernels. (#​27176)
  • Telemetry: Added service name and framework name to telemetry events for better usage understanding on Windows. (#​27252, #​27256)

Full Changelog: v1.24.1...v1.24.2

Contributors

@​tianleiwu, @​hariharans29, @​edgchen1, @​xiaofeihan1, @​adrianlizarraga, @​angelser, @​angelserMS, @​ankitm3k, @​baijumeswani, @​bmehta001, @​ericcraw, @​eserscor, @​fs-eire, @​guschmue, @​mc-nv, @​qjia7, @​qti-monumeen, @​titaiwangms, @​yuslepukhin

1.24.1

📢 Announcements & Breaking Changes

Platform Support Changes

  • Python 3.10 wheels are no longer published — Please upgrade to Python 3.11+
  • Python 3.14 support added
  • Free-threaded Python (PEP 703) — Added support for Python 3.13t and 3.14t in Linux (#​26786)
  • x86_64 binaries for macOS/iOS are no longer provided and minimum macOS is raised to 14.0

API Version

✨ New Features

🤖 Execution Provider (EP) Plugin API

A major infrastructure enhancement enabling plugin-based EPs with dynamic loading:

  • Initial kernel-based EP support (#​26206)
  • Weight pre-packing support for plugin EPs (#​26754)
  • EP Context model support (#​25124)
  • Control flow kernel APIs (#​26927)
  • OrtKernelInfo APIs for kernel-based plugin EPs (#​26803)

🔧 Core APIs

  • OrtApi::CreateEnvWithOptions() and OrtEpApi::GetEnvConfigEntries() (#​26971)
  • EP Device Compatibility APIs (#​26922)
  • External Resource Importer API for D3D12 shared resources (#​26828)
  • Session config access from KernelInfo (#​26589)

📊 Dependencies & Integration

🖥️ Execution Provider Updates

NVIDIA

  • CUDA EP: Flash Attention updates, GQA kernel fusion, BF16 support for MoE/qMoE/MatMulNBits, CUDA 13.0 support
  • TensorRT EP: Upgraded to TensorRT 10.14, automatic plugin loading, NVFP4 custom ops
  • TensorRT RTX EP: RTX runtime caching, CUDA graph support, BFloat16, memory-mapped engines

Qualcomm QNN EP

  • QNN SDK upgraded to 2.42.0 with new ops (RMSNorm, ScatterElements, GatherND, STFT, RandomUniformLike)
  • Gelu pattern fusion, LPBQ quantization support, ARM64 wheel builds, v81 device support

Intel & AMD

  • OpenVINO EP: Upgraded to 2025.4.1
  • VitisAI EP: External EP loader, compiled model compatibility API
    ... (truncated)

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.0.0 to 18.8.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.8.1

What's Changed

Full Changelog: microsoft/vstest@v18.8.0...v18.8.1

18.8.0

What's Changed

Full Changelog: microsoft/vstest@v18.7.0...v18.8.0

18.7.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

18.6.0

What's Changed

Changes to tests and infra

18.5.1

What's Changed

Full Changelog: microsoft/vstest@v18.5.0...v18.5.1

18.5.0

⚠️ Unlisted on Nuget, because of #​15718

What's Changed

Full Changelog: https://github.com/microsoft/vstest/co...

_Descrip...

Description has been truncated

@dependabot
Bump the microsoft group with 9 updates
e1009e0 
Bumps Microsoft.AspNetCore.SignalR.Client from 10.0.2 to 10.0.10
Bumps Microsoft.Extensions.AI.Abstractions from 10.2.0 to 10.8.0
Bumps Microsoft.Extensions.DependencyInjection from 10.0.2 to 10.0.10
Bumps Microsoft.Extensions.Logging from 10.0.2 to 10.0.10
Bumps Microsoft.ML.OnnxRuntime from 1.23.2 to 1.27.1
Bumps Microsoft.NET.Test.Sdk from 18.0.0 to 18.8.1
Bumps System.CommandLine from 2.0.2 to 2.0.10
Bumps System.IdentityModel.Tokens.Jwt from 8.15.0 to 8.19.2
Bumps System.IO.Ports from 10.0.2 to 10.0.10

---
updated-dependencies:
- dependency-name: Microsoft.AspNetCore.SignalR.Client
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft
- dependency-name: Microsoft.Extensions.AI.Abstractions
  dependency-version: 10.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: microsoft
- dependency-name: Microsoft.Extensions.DependencyInjection
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft
- dependency-name: Microsoft.Extensions.Logging
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft
- dependency-name: Microsoft.ML.OnnxRuntime
  dependency-version: 1.27.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: microsoft
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: microsoft
- dependency-name: System.CommandLine
  dependency-version: 2.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 8.19.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: microsoft
- dependency-name: System.IO.Ports
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: microsoft
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Jul 15, 2026
@dependabot dependabot Bot mentioned this pull request Jul 15, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants