Skip to content

Bump Microsoft.ML.OnnxRuntime from 1.24.4 to 1.26.0#14

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/libs/BeeMemoryBank.Core/Microsoft.ML.OnnxRuntime-1.26.0
Open

Bump Microsoft.ML.OnnxRuntime from 1.24.4 to 1.26.0#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/libs/BeeMemoryBank.Core/Microsoft.ML.OnnxRuntime-1.26.0

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 15, 2026

Updated Microsoft.ML.OnnxRuntime from 1.24.4 to 1.26.0.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.26.0

n.b. The following was generated via LLM from Git history. Only the contributor list has been verified.

ONNX Runtime Release 1.26.0

Announcement - Breaking Changes

  • Support for CUDA 12 will be removed in 1.27.0.
    • CUDA 13 will continue to be published as onnxruntime-<os>-<arch>-gpu_cuda13-<version>.<ext>
  • CUDA runtime will be moving soon to a dedicated Execution Provider (EP) instead of a published package from ORT core.

Highlights

  • Added optional memory mapping for .ort model loads (#​28164).
  • Added RISC-V Vector (RVV) support for CPU EP (#​28261).
  • OpenVINO EP upgraded for 1.26.0 development release (#​28297).
  • WebGPU gained GridSample support (#​28264) and Split-K improvements (#​28151).
  • CUDA plugin EP gained graph support (#​28002), profiling API (#​28216).

Security and Reliability Hardening

  • Replaced unrestricted Python setattr configuration with an allowlist (#​28083).
  • Hardened multiple OOB and overflow scenarios across ML and core ops:
  • Fixed session logger use-after-free during EP teardown under verbose logging (#​28274).

CUDA, Attention, and MLAS

  • Filled CUDA opset/operator gaps and extended support:
    • Transpose opset 23 -> 25 (#​27740).
    • QuantizeLinear/DequantizeLinear opset 25 (#​28046).
    • CUDA TopK INT8/INT16/UINT8 support (#​27862).
    • LabelEncoder CUDA support for numeric types (#​28045).
  • Attention/GQA improvements:
    • Fixed ONNX Attention min-bias alignment crash on SM<80 and masked-batch NaN behavior (#​27831).
    • Added FP32 QK accumulation path for unfused GQA attention (#​28198).
    • Added CUDART_VERSION reduction compatibility in GQA attention (#​28296).
    • Fixed CUDA 13 build error in GQA unfused attention (#​28309).
    • PagedAttention fallback for SM<80 fp16 (#​28200).
  • MLAS updates:
    • FP16 Gelu enablement (#​26815).
    • Arm64 BF16 fast-math conv kernels for NCHW/NCHWc paths (#​27878).

WebGPU, WebNN, and JavaScript

... (truncated)

1.25.1

n.b. This changelog is LLM generated. Only the contributor listing has been verified.

ONNX Runtime Release 1.25.1

📢 Announcements & Breaking Changes

ONNX Op Updates

  • Enhanced ONNX operator support with new opset versions: Reshape (opset 25), Transpose (opset 24) (#​27752)

✨ New Features

📊 New ONNX Ops & Model Support

  • LinearAttention and CausalConvState operators for Qwen3.5 model support (#​27907)
  • RotaryEmbedding (RotEMB) and RMSNorm operators added (#​27752)
  • Linear Attention signature support (#​27842)

🌐 Web & JavaScript

WebGPU EP

  • Qwen3.5 model support on WebGPU execution provider (#​27996)
  • QMoE 1-token decode path optimization — fused operations to reduce GPU dispatches for improved performance (#​27998)

🐛 Bug Fixes

Core Runtime Fixes

  • Improved filesystem error messages during Linux device discovery for better debugging experience (#​27289)
  • Fixed missing include for SetRawDataInTensorProto in NVIDIA TensorRT RTX tests (#​28065)

🙏 Contributors

Thanks to our 7 contributors for this release:
@​guschmue, @​sanaa-hamel-microsoft, @​apsonawane, @​eserscor, @​ishwar-raut1, @​qjia7, @​theHamsta

Full Changelog: microsoft/onnxruntime@v1.25.0...v1.25.1

1.25.0

📢 Announcements & Breaking Changes

Build & Platform

  • C++20 is now required to build ONNX Runtime from source. Minimum toolchains: MSVC 19.29+, GCC 10+, Clang 10+. Users of prebuilt packages are unaffected. (#​27178)
  • CUDA minimum version raised to 12.0 — CUDA 11.x is no longer supported. Users pinned to CUDA 11.x should stay on ORT 1.24.x or upgrade their CUDA toolkit/driver. (#​27570)
  • ONNX upgraded to 1.21.0 (#​27601)
  • sympy is now an optional dependency for Python builds. (#​27200)

Execution Provider Changes

  • ArmNN EP has been removed. Users should remove any --use_armnn build flags and migrate to the MLAS/KleidiAI-backed CPU EP or QNN EP for Qualcomm hardware. (#​27447)

API Version


🔒 Security Fixes

  • Fixed potential integer truncation leading to heap out-of-bounds read/write (#​27544)
  • Addressed Pad Reflect vulnerability (#​27652)
  • Security fix for transpose optimizer (#​27555)
  • Upgraded minimatch 3.1.2 → 3.1.4 for CVE-2026-27904 (#​27667)
  • Hardened shell command handling for constant strings (#​27840)
  • Added validation of onnx::TensorProto data size before allocation (#​27547)
  • Cleaned up external data path validation (#​27539)
  • Fixed misaligned address reads for tensor attributes from raw data buffers (#​27312)
  • Fixed CPU Attention overflow issue (#​27822)
  • Fixed CPU LRN integer overflow issues (#​27886)
  • Additional input validation hardening:

✨ New Features

🔌 Execution Provider Plugin API & CUDA Plugin EP

... (truncated)

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: Microsoft.ML.OnnxRuntime
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels May 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants