Bump the nuget-minor-and-patch group with 11 updates by dependabot[bot] · Pull Request #16 · jrfrigat/Aiko

ONNX Runtime 1.31.0 stabilizes model-package and EPContext data APIs, improves CPU model loading and quantized MoE inference, expands device-based execution-provider selection, and strengthens model-loading and runtime reliability. These notes cover changes since ONNX Runtime 1.30.0. CUDA and WebGPU kernel updates are summarized here; detailed provider notes are covered by their separate plugin EP releases.

Highlights

Promoted the model-package API and EPContext data callbacks to stable C and C++ APIs, with EPContext callback support added across language bindings (#33166, #32265).
Reduced CPU session-initialization overhead by parallelizing eligible weight prepacking, and accelerated block-wise INT4/INT8 QMoE experts with MLAS QNBit kernels and grouped expert dispatch (#31691, #32644, #32668).
Added x86 FP16 LayerNorm/RMSNorm acceleration, Arm KleidiAI SVE2.1 FP16 GEMM support, and additional RISC-V vector kernels (#32715, #32670, #32710).
Enabled CoreML participation in device-based EP selection, including Apple Neural Engine selection through PREFER_NPU (#31975).
Added workspace-memory accounting and verification for constrained-memory graph partitioning, alongside broader model, graph, and tensor validation (#31962, #32189).

Announcements & Compatibility

CUDA Plugin EP v0.3.0 and WebGPU Plugin EP v0.5.0 are matched with ONNX Runtime 1.31.0. For contrib-op compatibility, core and the plugin must use the same contributed-operator schemas; building both from the same ONNX Runtime revision is recommended. Schema mismatches can cause incorrect execution or crashes and may not be detected during plugin registration.
GatherBlockQuantized behavior change: out-of-range indices now produce zero output slices across CPU, CUDA, and WebGPU for both integer and floating-point quantized formats. This deliberately differs from ONNX Gather error semantics (#32480).
Experimental API migration: model-package consumers should use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table. EPContext callback registration now uses stable APIs; the corresponding experimental lookup entries were removed. The stable native callback contract carries callback/state pointers, with payload limits enforced by application callbacks, bindings, or EPs rather than a native read-options policy (#33166, #32265).
ACL EP is deprecated and will be removed in a future release. Source builds using --use_acl now receive a deprecation warning (#32564).
The ONNX dependency remains at 1.22.0. The initial ONNX 1.23 integration was reverted pending upstream fixes; this release does not ship that integration's new opset or FLOAT6 support (#33073).
Supported native builds now default to 1DS telemetry. Windows TraceLogging remains selectable with --use_windows_telemetry or onnxruntime_USE_WINDOWS_TELEMETRY=ON; telemetry can be disabled with --no_telemetry (#32384).

New Features

Core APIs & Runtime

Stabilized the model-package C and C++ APIs for loading packages, selecting compatible model variants, and creating sessions (#33166).
Stabilized named EPContext data read/write callbacks for application-managed storage. Added EP support negotiation so registered callbacks do not silently fall back to filesystem I/O (#32265).
Extended the Compile API to write external initializers and EP context data to buffers, enabling in-memory compilation workflows for models larger than 2 GB (#31347).
Added workspace-memory accounting, source reporting, and post-partition reservation verification. Set session.strict_workspace_verification=1 to fail initialization on workspace declaration overruns or nonzero orphaned reservations; strict verification is not supported for ORT-format model loads (#31962, #32189).
Added the opt-in source-build option onnxruntime_DISABLE_DEVICE_DISCOVERY=ON to skip platform accelerator probing and report only the CPU device (#32592).

Shared Contrib Operators

These updates affect core operator schemas and cross-provider behavior, not only the separately released GPU plugins.

Extended EngramGate and NGramHashMapping for Qwen4-Exp, and added VarlenNGramHashMapping for packed DeepSeek Engram batching with request-local history. Packed hashing also supports Qwen4-Exp head offsets, EOS resets, and segment boundaries (#32285, #32358, #32467).
Added the activation attribute to GatedRMSNorm for SiLU, its Swish alias, and Sigmoid gating across CPU, CUDA, and WebGPU. SiLU remains the default (#32512).
Added weightless hyper-connection operators BranchwiseRMSNorm, ScaledSiLU, HyperConnectionPreMix, and HyperConnectionPostMix, with CPU, CUDA, and WebGPU implementations (#32687).
Extended GatherBlockQuantized to FP8/FP4 data, full-axis blocks, and scale broadcasting, and improved CPU UINT8 dequantization. See the out-of-range-index behavior change above (#32480, #32621).

Plugin Execution Provider Infrastructure

Added support for statically linked plugin EPs, with a static WebGPU plugin build configuration (#32395).
Preserved caller streams in single-tensor plugin data transfers and handled null plugin allocator returns (#32666, #32683).
Deduplicated AutoEP custom-op domains and corrected EP assignment reporting after NHWC layout transformation (#32711, #33184).
Added reference guidance for compiled-model compatibility validation, including multi-device scenarios (#29168).

Execution Provider Updates

CUDA EP

CUDA updates include sparse attention and packed continuous batching, expanded paged speculative decoding, INT2 and mixed-width QMoE execution, opt-in MatMul auto-tuning, improved MXFP4 support on Blackwell consumer GPUs, and reliability fixes.
... (truncated)

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.11.0 What's Changed

Fix TRX logger mangling astral-plane (non-BMP) characters by @azat-msft in Fix TRX logger mangling astral-plane (non-BMP) characters microsoft/vstest#16318
Disable the MTP testhost by default by @nohwnd in Disable the MTP testhost by default microsoft/vstest#16337
Fix OS-blind apphost probe in MTP bridge on Unix (regression from #16201) by @azat-msft in Fix OS-blind apphost probe in MTP bridge on Unix (regression from #16201) microsoft/vstest#16336
Retarget the MTP client onto Microsoft.Testing.Platform.ServerMode.Client.Sources by @nohwnd in Retarget the MTP client onto Microsoft.Testing.Platform.ServerMode.Client.Sources microsoft/vstest#16300
Pass arguments to PowerShell with -File instead of -command by @nohwnd in Pass arguments to PowerShell with -File instead of -command microsoft/vstest#16363
Respect console logger verbosity from a settings file by @nohwnd in Respect console logger verbosity from a settings file microsoft/vstest#16044
Fix backslash normalization in VSTestCLIRunSettings on Unix by @nohwnd in [fix] Fix backslash normalization in VSTestCLIRunSettings on Unix microsoft/vstest#15795
Docs: fix typo explicitely -> explicitly by @vaibhav8a in docs: fix typo explicitely -> explicitly microsoft/vstest#16397
Copy acceptance test diagnostic logs into the test results directory by @nohwnd in Copy acceptance test diagnostic logs into the test results directory microsoft/vstest#16403

New Contributors

@vaibhav8a made their first contribution in docs: fix typo explicitely -> explicitly microsoft/vstest#16397

Full Changelog: microsoft/vstest@v18.10.1...v18.11.0

Commits viewable in compare view.

Updated ModelContextProtocol from 2.2.0 to 2.3.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.3.0

This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a TimeProvider for deterministic client timeout tests. It also corrects optional server-identity handling; applications reading McpClient.ServerInfo should adopt nullable handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

McpClient.ServerInfo is nullable — #1903
- Its return annotation changes from Implementation to Implementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.
- On 2026-07-28 connections, ServerInfo is null when the server omits optional identity metadata from server/discover. Legacy initialize still requires serverInfo. Reading the property before connecting still throws InvalidOperationException.
- Migrate with a null check or a fallback such as client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.
- This corrective source-compatibility change is intentionally included in 2.3.0.

What's Changed

Correct protocol-version telemetry for stateless server spans #1810 by @luisangelrod
Preserve HTTP errors and correct discovery fallback handling #1791 by @PranavSenthilnathan (co-authored by @Copilot)
Make modern Streamable HTTP status mapping deterministic #1837 by @jstar0
- Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout. Legacy eager-header behavior is preserved.
Accept opaque legacy metadata and correct request-scoped capabilities and discovery advertisement #1852 by @halter73 (co-authored by @Copilot)
Avoid redundant SSE fallback after discovery is rejected with 400 or 404 #1855 by @scottt732
Close server stdin before waiting for graceful stdio process exit #1838 by @luisangelrod
Preserve insertion order when listing server tools, prompts, and resources #1924 by @PederHP (co-authored by Claude Opus 5.5)
Allow missing optional server identity in discovery and make ServerInfo nullable #1903 by @Coding-Professional
Include JSON parse details in Streamable HTTP 400 responses #1844 by @ump45nose
Exclude OAuth from DiscoverProbeTimeout, expose McpClientOptions.TimeProvider for deterministic timeout tests, and default SSE to legacy initialization #1719 by @halter73 (co-authored by @Copilot)
- OAuth remains subject to the overall InitializationTimeout and caller cancellation; it is excluded only from the short discovery-probe budget.
- Modern discovery over SSE requires both explicit HttpTransportMode.Sse and ProtocolVersion = "2026-07-28"; pinning the version with AutoDetect is not equivalent.
Preserve numeric progress tokens in RequestOptions serialization #1832 by @dfedoryshchev
Dispose legacy SSE POST responses to release connections deterministically #1841 by @yalcinfu22 (co-authored by Claude Fable 5)

Documentation Updates

Document standing support for new MCP specification revisions #1826 by @halter73 (co-authored by @Copilot)

Test Improvements

Stabilize discovery-capable test connections while retaining initialization deadlines #1943 by @tarekgh

Repository Infrastructure Updates

Add a source selector for manual documentation publishes #1828 by @jeffhandley (co-authored by @Copilot)
Update SourceLink's private build dependency to resolve a vulnerable Git dependency #1873 by @halter73 (co-authored by @Copilot)
Correct obsolete McpServerFactory references in Copilot instructions #1892 by @Zir0-93
Update Microsoft.Extensions.AI and AI.Abstractions to 10.11.0 and align shared System dependencies to 10.0.13 #1940

Acknowledgements

@scottt732 made their first contribution in #1855
@Zir0-93 made their first contribution in #1892
@Coding-Professional made their first contribution in #1903
... (truncated)

Commits viewable in compare view.

Updated xunit.runner.visualstudio from 4.0.0 to 4.0.1.

Release notes

Sourced from xunit.runner.visualstudio's releases.

4.0.1

Release notes: https://xunit.net/releases/visualstudio/4.0.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps Flare.Blazor from 0.44.0 to 0.51.0 Bumps Flare.Icons.MaterialDesign3.Svg from 0.44.0 to 0.51.0 Bumps Flare.Theme.MaterialDesign3Expressive from 0.44.0 to 0.51.0 Bumps Microsoft.AspNetCore.Components.WebAssembly from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Components.WebAssembly.DevServer from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Components.WebAssembly.Server from 10.0.13 to 10.0.14 Bumps Microsoft.Data.Sqlite from 10.0.12 to 10.0.14 Bumps Microsoft.ML.OnnxRuntime from 1.30.0 to 1.31.0 Bumps Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0 Bumps ModelContextProtocol from 2.2.0 to 2.3.0 Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1 --- updated-dependencies: - dependency-name: Flare.Blazor dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: Flare.Blazor dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: Flare.Icons.MaterialDesign3.Svg dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: Flare.Theme.MaterialDesign3Expressive dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.AspNetCore.Components.WebAssembly dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.AspNetCore.Components.WebAssembly.DevServer dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.AspNetCore.Components.WebAssembly.Server dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.Data.Sqlite dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.ML.OnnxRuntime dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: ModelContextProtocol dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: ModelContextProtocol dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the .NET Pull requests that update .NET code label Oct 28, 2026

dependabot Bot requested a review from jrfrigat as a code owner October 28, 2026 13:14

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 28, 2026

dependabot Bot mentioned this pull request Oct 28, 2026

Bump the nuget-minor-and-patch group with 11 updates #11

Closed

Navigation Menu

Repository navigation

Bump the nuget-minor-and-patch group with 11 updates - #16

Bump the nuget-minor-and-patch group with 11 updates#16
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/Aiko.Infrastructure/nuget-minor-and-patch-923f64a11b

dependabot Bot commented on behalf of github Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 28, 2026

0.51.0

0.50.0

0.49.0

0.48.0

0.47.0

0.46.0

0.45.0

0.51.0

0.50.0

0.49.0

0.48.0

0.47.0

0.46.0

0.45.0

0.51.0

0.50.0

0.49.0

0.48.0

0.47.0

0.46.0

0.45.0

1.31.0

Highlights

Announcements & Compatibility

New Features

Core APIs & Runtime

Shared Contrib Operators

Plugin Execution Provider Infrastructure

Execution Provider Updates

CUDA EP

18.11.0

What's Changed

New Contributors

2.3.0

Breaking Changes

What's Changed

Documentation Updates

Test Improvements

Repository Infrastructure Updates

Acknowledgements

4.0.1

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants