Skip to content

chore(deps): bump onnxruntime-web from 1.23.0-dev.20250917-21fbad8a65 to 1.27.0#2718

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/onnxruntime-web-1.27.0
Open

chore(deps): bump onnxruntime-web from 1.23.0-dev.20250917-21fbad8a65 to 1.27.0#2718
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/onnxruntime-web-1.27.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown
Contributor

Bumps onnxruntime-web from 1.23.0-dev.20250917-21fbad8a65 to 1.27.0.

Release notes

Sourced from onnxruntime-web's releases.

ONNX Runtime v1.27.0

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28. n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

  • CUDA 12 package files are now explicitly named as such.
  • CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

Security Fixes

  • Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#28004)
  • Hardened OneHot input validation and output-size computation (#28014)
  • Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#28055)
  • Bounded total output allocation size in Tile kernel (#28070)
  • Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#28223)
  • Fixed BitShift UB for shift amounts greater than or equal to bit width (#28272)
  • Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#28277)
  • Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#28279)
  • Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#28386)
  • Fixed out-of-bounds read in CropBase scale handling (#28399)
  • Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#28400)
  • Added sparse tensor external file path validation and additional external-path hardening (#28408, #28709, #28725)
  • Switched remaining torch.load() calls to weights_only=True (#28421)
  • Added CPU cache-indirection beam-index validation (#28486)
  • Added additional overflow/bounds checks and test coverage in runtime buffers (#28713, #28747)

New Features

Execution Provider Plugin API

  • Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#28037)
  • Added OrtEp::OnSessionInitializationEnd() callback (#28319)
  • Added plugin EP session-options getters (#28377)
  • Added CUDA Plugin EP provider options for streams and external allocators (#28603)

Core APIs & Runtime

  • Added support for ONNX overloaded functions (IR v10+) (#28275)
  • Added FLOAT8E8M0 datatype support in ONNX Runtime (#28381)
  • Added CPU Cast support for FLOAT8E8M0 (#28435)
  • Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#28282)

Quantization & Training Tooling

  • Added calibration cache support to quantize_static (#28221)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by erscor_msft, a new releaser for onnxruntime-web since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [onnxruntime-web](https://github.com/Microsoft/onnxruntime) from 1.23.0-dev.20250917-21fbad8a65 to 1.27.0.
- [Release notes](https://github.com/Microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseManagement.md)
- [Commits](https://github.com/Microsoft/onnxruntime/commits/v1.27.0)

---
updated-dependencies:
- dependency-name: onnxruntime-web
  dependency-version: 1.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 13, 2026
Copilot AI review requested due to automatic review settings July 13, 2026 19:25
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 13, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

@github-actions

Copy link
Copy Markdown

pkg.pr.new

packages
Ready to be installed by your favorite package manager ⬇️

https://pkg.pr.new/software-mansion/TypeGPU/tgpu-gen@5cdeacabc44326019cf827946b77242072466582
https://pkg.pr.new/software-mansion/TypeGPU/tinyest-for-wgsl@5cdeacabc44326019cf827946b77242072466582
https://pkg.pr.new/software-mansion/TypeGPU/typegpu@5cdeacabc44326019cf827946b77242072466582
https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/cli@5cdeacabc44326019cf827946b77242072466582
https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/color@5cdeacabc44326019cf827946b77242072466582
https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/gl@5cdeacabc44326019cf827946b77242072466582
https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/noise@5cdeacabc44326019cf827946b77242072466582
https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/radiance-cascades@5cdeacabc44326019cf827946b77242072466582
https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/react@5cdeacabc44326019cf827946b77242072466582
https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/sdf@5cdeacabc44326019cf827946b77242072466582
https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/three@5cdeacabc44326019cf827946b77242072466582
https://pkg.pr.new/software-mansion/TypeGPU/unplugin-typegpu@5cdeacabc44326019cf827946b77242072466582

benchmark
view benchmark

commit
view commit

@github-actions

Copy link
Copy Markdown

Bundle size comparison (import * as ... in PR vs import * as ... in target):

🟢 Decreased ➖ Unchanged 🔴 Increased ❔ Unknown
0 321 0 0

import { ... } in PR vs import * as ... in PR (is the library tree-Shakeable?):

Test tsdown
tgpu_init.ts 255.87 kB ($${\color{green}-3.2\%}$$)
tgpu_initFromDevice.ts 255.36 kB ($${\color{green}-3.4\%}$$)
tgpu_resolve.ts 161.34 kB ($${\color{green}-38.9\%}$$)
tgpu_resolveWithContext.ts 161.28 kB ($${\color{green}-39.0\%}$$)
tgpu_bindGroupLayout.ts 68.92 kB ($${\color{green}-73.9\%}$$)
tgpu_mutableAccessor.ts 65.91 kB ($${\color{green}-75.1\%}$$)
tgpu_accessor.ts 65.90 kB ($${\color{green}-75.1\%}$$)
tgpu_privateVar.ts 65.27 kB ($${\color{green}-75.3\%}$$)
tgpu_workgroupVar.ts 65.27 kB ($${\color{green}-75.3\%}$$)
tgpu_const.ts 64.52 kB ($${\color{green}-75.6\%}$$)
tgpu_fn.ts 37.98 kB ($${\color{green}-85.6\%}$$)
tgpu_fragmentFn.ts 37.88 kB ($${\color{green}-85.7\%}$$)
tgpu_vertexFn.ts 37.70 kB ($${\color{green}-85.7\%}$$)
tgpu_computeFn.ts 37.40 kB ($${\color{green}-85.8\%}$$)
tgpu_vertexLayout.ts 26.63 kB ($${\color{green}-89.9\%}$$)
tgpu_comptime.ts 14.43 kB ($${\color{green}-94.5\%}$$)
tgpu_unroll.ts 2.60 kB ($${\color{green}-99.0\%}$$)
tgpu_slot.ts 1.54 kB ($${\color{green}-99.4\%}$$)
tgpu_lazy.ts 1.19 kB ($${\color{green}-99.5\%}$$)

If you wish to run a comparison for other, slower bundlers, run the 'Tree-shake test' from the GitHub Actions menu.

@github-actions

Copy link
Copy Markdown

Resolution Time Benchmark

---
config:
  themeVariables:
    xyChart:
      plotColorPalette: "#E63946, #3B82F6, #059669"
---
xychart
  title "Random Branching (🔴 PR | 🔵 main | 🟢 release)"
  x-axis "max depth" [1, 2, 3, 4, 5, 6, 7, 8]
  y-axis "time (ms)"
  line [0.78, 1.66, 3.40, 5.67, 6.05, 9.82, 18.83, 21.62]
  line [0.82, 1.76, 3.50, 5.00, 6.38, 10.86, 18.89, 21.61]
  line [0.83, 1.71, 3.77, 5.11, 6.04, 10.15, 18.72, 19.25]
Loading
---
config:
  themeVariables:
    xyChart:
      plotColorPalette: "#E63946, #3B82F6, #059669"
---
xychart
  title "Linear Recursion (🔴 PR | 🔵 main | 🟢 release)"
  x-axis "max depth" [1, 2, 3, 4, 5, 6, 7, 8]
  y-axis "time (ms)"
  line [0.27, 0.48, 0.57, 0.69, 0.92, 1.01, 1.23, 1.27]
  line [0.28, 0.48, 0.59, 0.78, 1.00, 1.02, 1.26, 1.40]
  line [0.27, 0.47, 0.63, 0.77, 0.96, 1.05, 1.26, 1.35]
Loading
---
config:
  themeVariables:
    xyChart:
      plotColorPalette: "#E63946, #3B82F6, #059669"
---
xychart
  title "Full Tree (🔴 PR | 🔵 main | 🟢 release)"
  x-axis "max depth" [1, 2, 3, 4, 5, 6, 7, 8]
  y-axis "time (ms)"
  line [0.75, 1.88, 3.43, 5.57, 10.66, 23.07, 48.10, 94.92]
  line [0.76, 1.89, 3.29, 5.64, 10.31, 22.11, 48.57, 95.18]
  line [0.78, 1.87, 4.33, 6.70, 11.53, 22.55, 47.58, 97.15]
Loading

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant