chore(deps-dev): update onnxruntime-gpu requirement from <1.27,>=1.21 to >=1.21,<1.32 by dependabot[bot] · Pull Request #247 · lyonzin/knowledge-rag

dependabot · 2026-10-16T15:55:50Z

Updates the requirements on onnxruntime-gpu to permit the latest version.

Release notes

Sourced from onnxruntime-gpu's releases.

ONNX Runtime v1.31.0

ONNX Runtime 1.31.0 stabilizes model-package and EPContext data APIs, improves CPU model loading and quantized MoE inference, expands device-based execution-provider selection, and strengthens model-loading and runtime reliability. These notes cover changes since ONNX Runtime 1.30.0. CUDA and WebGPU kernel updates are summarized here; detailed provider notes are covered by their separate plugin EP releases.

Highlights

Promoted the model-package API and EPContext data callbacks to stable C and C++ APIs, with EPContext callback support added across language bindings (#33166, #32265).

Reduced CPU session-initialization overhead by parallelizing eligible weight prepacking, and accelerated block-wise INT4/INT8 QMoE experts with MLAS QNBit kernels and grouped expert dispatch (#31691, #32644, #32668).

Added x86 FP16 LayerNorm/RMSNorm acceleration, Arm KleidiAI SVE2.1 FP16 GEMM support, and additional RISC-V vector kernels (#32715, #32670, #32710).

Enabled CoreML participation in device-based EP selection, including Apple Neural Engine selection through PREFER_NPU (#31975).

Added workspace-memory accounting and verification for constrained-memory graph partitioning, alongside broader model, graph, and tensor validation (#31962, #32189).

Announcements & Compatibility

CUDA Plugin EP v0.3.0 and WebGPU Plugin EP v0.5.0 are matched with ONNX Runtime 1.31.0. For contrib-op compatibility, core and the plugin must use the same contributed-operator schemas; building both from the same ONNX Runtime revision is recommended. Schema mismatches can cause incorrect execution or crashes and may not be detected during plugin registration.

GatherBlockQuantized behavior change: out-of-range indices now produce zero output slices across CPU, CUDA, and WebGPU for both integer and floating-point quantized formats. This deliberately differs from ONNX Gather error semantics (#32480).

Experimental API migration: model-package consumers should use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table. EPContext callback registration now uses stable APIs; the corresponding experimental lookup entries were removed. The stable native callback contract carries callback/state pointers, with payload limits enforced by application callbacks, bindings, or EPs rather than a native read-options policy (#33166, #32265).

ACL EP is deprecated and will be removed in a future release. Source builds using --use_acl now receive a deprecation warning (#32564).

The ONNX dependency remains at 1.22.0. The initial ONNX 1.23 integration was reverted pending upstream fixes; this release does not ship that integration's new opset or FLOAT6 support (#33073).

Supported native builds now default to 1DS telemetry. Windows TraceLogging remains selectable with --use_windows_telemetry or onnxruntime_USE_WINDOWS_TELEMETRY=ON; telemetry can be disabled with --no_telemetry (#32384).

New Features

Core APIs & Runtime

Stabilized the model-package C and C++ APIs for loading packages, selecting compatible model variants, and creating sessions (#33166).

Stabilized named EPContext data read/write callbacks for application-managed storage. Added EP support negotiation so registered callbacks do not silently fall back to filesystem I/O (#32265).

Extended the Compile API to write external initializers and EP context data to buffers, enabling in-memory compilation workflows for models larger than 2 GB (#31347).

Added workspace-memory accounting, source reporting, and post-partition reservation verification. Set session.strict_workspace_verification=1 to fail initialization on workspace declaration overruns or nonzero orphaned reservations; strict verification is not supported for ORT-format model loads (#31962, #32189).

Added the opt-in source-build option onnxruntime_DISABLE_DEVICE_DISCOVERY=ON to skip platform accelerator probing and report only the CPU device (#32592).

Shared Contrib Operators

These updates affect core operator schemas and cross-provider behavior, not only the separately released GPU plugins.

Extended EngramGate and NGramHashMapping for Qwen4-Exp, and added VarlenNGramHashMapping for packed DeepSeek Engram batching with request-local history. Packed hashing also supports Qwen4-Exp head offsets, EOS resets, and segment boundaries (#32285, #32358, #32467).

Added the activation attribute to GatedRMSNorm for SiLU, its Swish alias, and Sigmoid gating across CPU, CUDA, and WebGPU. SiLU remains the default (#32512).

Added weightless hyper-connection operators BranchwiseRMSNorm, ScaledSiLU, HyperConnectionPreMix, and HyperConnectionPostMix, with CPU, CUDA, and WebGPU implementations (#32687).

Extended GatherBlockQuantized to FP8/FP4 data, full-axis blocks, and scale broadcasting, and improved CPU UINT8 dequantization. See the out-of-range-index behavior change above (#32480, #32621).

Plugin Execution Provider Infrastructure

Added support for statically linked plugin EPs, with a static WebGPU plugin build configuration (#32395).

Preserved caller streams in single-tensor plugin data transfers and handled null plugin allocator returns (#32666, #32683).

Deduplicated AutoEP custom-op domains and corrected EP assignment reporting after NHWC layout transformation (#32711, #33184).

Added reference guidance for compiled-model compatibility validation, including multi-device scenarios (#29168).

Execution Provider Updates

CUDA EP

... (truncated)

Commits

402979a Revert "Bump version to 1.32.0 (#33197)" (#33212)
660125b [Compile API] Add support for writing external initializers and EP context to...
06cab16 Update parameterized requirement from >=0.8.1 to >=0.9.0 (#33022)
864d871 Fix isolated provider tests in Windows GPU CI (#33203)
1744702 Bump baseline-browser-mapping from 2.10.31 to 2.11.26 in /js/react_native/e2e...
be3b8e8 Fix complex STFT window handling (#33136)
40a7167 [CPU] Avoid degenerate GQA FlashAttention tiles when L2 cache size is unknown...
430f563 Fix EP assignment reporting after NHWC layout transformation (#33184)
26ab6c7 Improve GQA shared-cache and sliding-window handling (#33175)
d8024cd Improve CUDA RMSNorm reduction and aligned half2 output (#33178)
Additional commits viewable in compare view

search_knowledge(category), list_documents(category) and add_from_url(title) were annotated `str = None`. The tool schema then advertised "default": null on a string-only field, and the MCP SDK's argument model rejected {"category": null} before the tool ran. Annotate them Optional[str], like the other optional arguments. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

The GHCR image was built only for linux/amd64, forcing Apple Silicon and ARM server users into slow QEMU emulation. Add setup-qemu-action and build for linux/amd64,linux/arm64 so the manifest list covers both.

dependabot · 2026-10-16T15:55:53Z

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

coderabbitai · 2026-10-16T15:56:00Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: a953f01d-9d18-46ae-a687-49b4788712ac

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-10-16T15:56:11Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/onnxruntime-gpu@1.26.0 ⏵ 1.31.0	⁺¹				⁺³¹

View full report

…ma's default EF (#253) On a fresh data_dir the preflight child ran get_or_create_collection() without an embedding function, so ChromaDB persisted its `default` EF. The server then opened the collection with FastEmbed and ChromaDB raised "Embedding function conflict: new: fastembed-... vs persisted: default". v4.10.0 removed the destructive recovery that used to hide this, so every fresh install and every new Docker volume failed to start. - The probe reads the collection with get_collection() and reports "missing" when it does not exist yet. - _safe_get_collection() recreates the collection the old probe left behind, only when it is empty and bound to the default EF. A collection with data is never dropped; the error is raised as before. - Tests run the real probe child against a fresh data_dir, a production FastEmbed collection with data and the empty default-EF leftover. Closes #248 Closes #252 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ndex (#254) #249 reported four defects on a 4.11.0 install. Two reproduce on master: A. os.replace fails with WinError 5/32 while an antivirus, indexer or concurrent reader holds the destination or the source without FILE_SHARE_DELETE. Checkpoint writes swallowed it as non-fatal, and the final metadata save aborted the reindex. replace_with_retry() retries only those two codes for about 1.5 s, then re-raises the original error. It now backs every atomic replace: metadata, checkpoint, repair journal, FTS5 state and staged documents. Other platforms are unchanged. C. reindex_documents answered "started" while a watcher pass or a document write held the index lock, and index_all then refused the run at once. start_reindex_background now probes the lock and returns the existing already_running envelope. nuclear_rebuild still starts, because it waits for the lock instead of refusing. docs/API.md now says which operations make reindex_documents answer already_running. The Windows test declares CloseHandle types so a 64-bit HANDLE is not truncated. B and D do not apply upstream: reindex_state.json, _write_reindex_state and a per-document metadata flush are not in any published release, and _maybe_persist_checkpoint already checks the 500-docs/30-s cadence before it saves. Closes #249 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Patch release. Fixes the startup crash on every fresh install and every new data directory since v4.10.0 (#248, #252), makes state-file writes robust on Windows and stops reindex_documents from reporting a refused run as started (#249). Also ships #236 and the multi-arch Docker image from #242. - pyproject.toml: 4.11.0 -> 4.11.1 - mcp_server/__init__.py: __version__ -> 4.11.1 - npm/package.json: 4.11.0 -> 4.11.1 - CHANGELOG.md: Unreleased promoted to v4.11.1 with highlights and credits - .github/api-surface-baseline.json: regenerated with --snapshot. Additive only: 8 modules and 5 methods added since the 2026-08-10 snapshot, none removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Updates the requirements on [onnxruntime-gpu](https://github.com/microsoft/onnxruntime) to permit the latest version. - [Release notes](https://github.com/microsoft/onnxruntime/releases) - [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md) - [Commits](microsoft/onnxruntime@v1.21.0...v1.31.0) --- updated-dependencies: - dependency-name: onnxruntime-gpu dependency-version: 1.31.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

vishalhabib99 and others added 2 commits October 13, 2026 09:11

ci(release): publish multi-arch Docker image (amd64 + arm64) (#242)

639e357

The GHCR image was built only for linux/amd64, forcing Apple Silicon and ARM server users into slow QEMU emulation. Add setup-qemu-action and build for linux/amd64,linux/arm64 so the manifest list covers both.

dependabot Bot requested a review from lyonzin as a code owner October 16, 2026 15:55

lyonzin and others added 4 commits October 25, 2026 12:10

dependabot Bot force-pushed the dependabot/pip/onnxruntime-gpu-gte-1.21-and-lt-1.32 branch from 9d5e675 to 90025e9 Compare October 25, 2026 16:52

lyonzin force-pushed the master branch from ed561c2 to c28772e Compare October 25, 2026 19:16

Navigation Menu

Repository navigation

chore(deps-dev): update onnxruntime-gpu requirement from <1.27,>=1.21 to >=1.21,<1.32 - #247

chore(deps-dev): update onnxruntime-gpu requirement from <1.27,>=1.21 to >=1.21,<1.32#247
dependabot[bot] wants to merge 6 commits into
masterfrom
dependabot/pip/onnxruntime-gpu-gte-1.21-and-lt-1.32

dependabot Bot commented on behalf of github Oct 16, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 16, 2026

Uh oh!

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading

Review skipped

Uh oh!

socket-security Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ONNX Runtime v1.31.0

Highlights

Announcements & Compatibility

New Features

Core APIs & Runtime

Shared Contrib Operators

Plugin Execution Provider Infrastructure

Execution Provider Updates

CUDA EP

Uh oh!

dependabot Bot commented on behalf of github Oct 16, 2026

Labels

Uh oh!

coderabbitai Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

socket-security Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot Bot commented on behalf of github Oct 16, 2026 •

edited

Loading

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading

socket-security Bot commented Oct 16, 2026 •

edited

Loading