Upgrading onnxruntime 0.5 to 1

Removes the TensorRT fused causal attention kernels from the CUDA EP.

Removes the dynamic WGSL generator (duktape/Node) path in favor of the Python wgsl-gen implementation.

Improves the ONNX Attention dispatch path and removes the legacy unfused MHA path.

Support for CUDA 12 will be removed in 1.27.0.

Renames WebNN pool2d property roundingType to outputShapeRounding.

VitisAI EP: Removed s_kernel_registry_vitisaiep.reset() in deinitialize_vitisai_ep().

Effective immediately, the Arm NN EP is deprecated and will no longer be maintained.

All build options, documentation, and examples referencing ArmNN will be removed once the upstream change merges; the removal will appear in the first ONNX Runtime release that includes that change.

OnnxRuntime GPU packages require CUDA 12.x, packages built for CUDA 11.x are no longer published.

Deleted the constant SKIP_CUDA_TEST_WITH_DML - @CodingSeaotter.

OpenCV dependency removed from C API build.

Removed Xamarin support.

Removes Windows ARM32 binaries from official packages; users who still need them can build from source.

GatherBlockQuantized now produces zero output slices for out-of-range indices across CPU, CUDA and WebGPU, differing from ONNX Gather error semantics.

Model-package consumers must use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table; experimental lookup entries were removed.

Removes the unused internal onnxruntime/python/tools/tensorrt dashboard tooling; TensorRT EP APIs are unaffected.

Negative CPU Split axes now produce an error instead of being accepted.

Upgrades to ONNX 1.22.0 and protobuf 6.33.5, with graph optimizer opset version checks updated accordingly.

ORT_API_VERSION updated to 25.

ORT_API_VERSION updated to 24.

Splits the ONNX Runtime GPU Nuget package into two packages.

Limits sparse-initializer dense allocations, checks sparse value cardinality, validates inline raw and ORT-format string initializer sizes, and includes string payloads in size limits.

Rejects duplicate model-local functions, recursive function graph attributes, non-control-flow nodes with subgraphs, inputs to zero-input schemas, and bounds AOT function expansion.

Validates optional graph inputs, Constant nodes, ORT-format input argument counts, and contrib-op shape inference; fixes out-of-bounds reads in Loop/Scan initializers and shape-inference input data.

Bounds external-data validation to opened files and rejects model-package-controlled output-file options, including optimized-model output paths.

Strengthens optimizer validation for initializer types, shape propagation, QDQ weight shapes and axes, and LabelEncoder fusion attributes.

Limits nested model-graph depth and canonicalizes external-data locations to harden model loading.

Adds checked rounding for BFC arena allocations and fixes prepacked-weight reference lifetimes.

Strengthens shape, rank, and parameter validation for Split, Scan, GatherND, ScatterND, SpaceToDepth/DepthToSpace, Crop, Conv, Normalizer, and pooling.

Hardens generation and attention input handling, including attention-attribute narrowing, BifurcationDetector inputs, generation subgraph shapes, and QEmbed segment inputs.

Validates TreeEnsemble node references, bounds subtree comparison, rejects non-finite CPU RoiAlign coordinates, and requires ImageScaler bias to match channel count.

Adds an allowlist of safe LoRA adapter parameter data types, validates MatMulFpQ4 shape inputs, and checks MLAS blockwise quantization index ranges.

Hardens CUDA indexing and buffer-size arithmetic in MatMulNBits, RemovePadding, RotaryEmbedding, SparseAttention, Whisper beam search, NMS, QDQ, and GatherElements.

Hardens graph optimizers against model-supplied indices and invalid fusion inputs, including MatMulNBits dequantization block sizes, GQA projection shapes, and Slice starts rank.

Fixes a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional.

Validates the CPU MoE k attribute against the number of experts and fixes a CPU TensorScatter security issue.

Adds missing rank, shape, and parameter validation for pooling, LSTM, DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample…

Hardens CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool.

Fixes packed sub-byte tensor over-copying in OrtApi::GetValue and validates DML constant tensor byte sizes.

Updates npm lockfiles, refreshes the Next.js end-to-end fixture lockfile for security advisories, and upgrades adm-zip for onnxruntime-node.

Hardens the ORT FlatBuffer model loader against malformed buffers and removes now-redundant table offset validation.

Fixes type confusion in raw-pointer bind_input that caused an out-of-bounds write.

Fixes an out-of-bounds pointer in TensorAt for sub-byte packed types.

Fixes arbitrary memory read, out-of-bounds dereference and other OOB accesses in kernels.

Validates Col2Im inputs to prevent heap over-read.

Hardens CropAndResize against malformed crop_size tensors.

Validates BeamSearch vocab_size against logits width.

Fixes bounds in WhisperDecoderSubgraph::CreateInitialFeeds.

Validates SparseAttention CSR indices and key lengths and rejects zero-dimension block_row_indices.

Clamps derived sequence lengths and KV-cache index in CUDA GroupQueryAttention and fixes a CPU GQA out-of-bounds read in the past-KV buffer.

Clamps 1D attention mask_index to valid bounds.

Validates MaxpoolWithMask kernel rank against input spatial rank.

Rejects CUDA BERT EmbedLayerNorm and SkipLayerNorm shapes exceeding 32-bit output indexing.

Fixes the optional-output guard in DecoderAttention and MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference.

Fixes TreeEnsemble target id validation and adds input validation to LinearClassifier.

Fixes zero-point and scale validation typos in DynamicQuantizeLSTM.

Handles non-trivially-copyable types in Loop and Scan output concatenation.

Normalizes bool tensor raw_data to {0, 1} when unpacking.

Addresses hardening gaps in Resize, PadFusion, and LoRA handling.

Fixes unbounded lifetime on WithOutputTensor in the Rust bindings.

Guards MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt.

Fixes signed-int overflow in SamplingState::Init that could cause a heap buffer overflow.

Hardens QMoE against integer overflow and partial K tiles.

Validates B, scales, and zero-points shapes in MatMulNBits::PrePack.

Pre-checks ConstantOfShape output size against the input initializer before constant folding.

Fixes integer overflow in RKNPU implicit bias allocation.

Fixes WebGPU out-of-bounds reads in Pad, Slice, and GatherBlockQuantized.

Updates protobuf to mitigate CVE-2026-0994 and bumps ONNX/protobuf to fix additional CVEs.

Avoids shell injection in the training helper and switches Triton compile helpers to subprocess.

Validates archive extraction paths in the transformers tooling.

Validates and inlines external data in node tensor attributes during session initialization.

Enables Spectre-mitigated MSVC libraries for BinSkim builds.

Bumps npm dependencies shell-quote, esbuild, tmp, ws, protobufjs, js-yaml, tar, markdown-it, and @babel/core.

Fixes out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation.

Hardens OneHot input validation and output-size computation.

Adds SafeInt overflow protection in Expand and caps constant-folding output sizes.

Bounds total output allocation size in the Tile kernel.

Adds mask/input shape consistency checks in MaxpoolWithMask::Compute.

Fixes BitShift undefined behavior for shift amounts greater than or equal to bit width.

Validates sequence bounds in GQA (seqlens_k vs cos_cache).

Validates conv bias shape in WordConvEmbedding to prevent out-of-bounds reads.

Fixes int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors.

Fixes out-of-bounds read in CropBase scale handling.

Fixes rank-underflow bug in Inverse kernel trailing-dimension indexing.

Adds sparse tensor external file path validation and additional external-path hardening.

Switches remaining torch.load() calls to weights_only=True.

Adds CPU cache-indirection beam-index validation.

Adds additional overflow and bounds checks with test coverage in runtime buffers.

Replaces unrestricted Python setattr configuration with an allowlist.

Hardens multiple OOB and overflow scenarios across ML and core ops.

Fixes Attention mask index OOB write.

Adds MaxPoolGrad indices bounds validation.

Applies SVM and TreeEnsemble bounds and security fixes.

Fixes RNN sequence_lens OOB read and integer overflow handling.

Adds GroupQueryAttention seqlens_k bounds validation and a compatibility follow-up.

Adds MatMulBnb4 and ML coefficient SafeInt checks.

Fixes CUDA Gather int32 overflow.

Hardens GridSample float to int64 cast for NaN, Inf and out-of-range coordinates.

Adds position ID bounds validation in WebGPU/JS RotaryEmbedding.

Fixed potential integer truncation leading to heap out-of-bounds read/write.

Addressed Pad Reflect vulnerability.

Security fix for transpose optimizer.

Upgraded minimatch 3.1.2 → 3.1.4 for CVE-2026-27904.

Hardened shell command handling for constant strings.

Added validation of onnx::TensorProto data size before allocation.

Cleaned up external data path validation.

Fixed misaligned address reads for tensor attributes from raw data buffers.

Fixed CPU Attention overflow issue.

Fixed CPU LRN integer overflow issues.

Additional input validation hardening.

Core: Fixed GatherCopyData integer truncation leading to heap out-of-bounds read/write.

Core: Fixed RoiAlign heap out-of-bounds read via unchecked batch_indices.

Core: Prevent heap OOB from maliciously crafted Lora Adapters.

Core: Fixed out-of-bounds access for Resize operation.

Builds Linux binaries (except AMD GPU packages) in a more secure way compliant with BinSkim's default policy, e.g. no executable stack.

Python: Updated python_requires from >=3.10 to >=3.11 to reflect dropped Python 3.10 support.

Python 3.14 support added.

Free-threaded Python (PEP 703) — Added support for Python 3.13t and 3.14t in Linux.

x86_64 binaries for macOS/iOS are no longer provided and minimum macOS is raised to 14.0.

iOS >= 15.1.

Discontinued support for iOS 12 and increasing the minimum supported iOS version to 13.

Building for Linux ARM64 or Android requires a C/C++ compiler with BFloat16 support; Android NDK 24.x support is removed, use NDK 25.x or 26.x.

Deprecates the ACL EP, which will be removed in a future release; source builds using --use_acl now receive a deprecation warning.

onnxruntime-web deprecates WebGL and JSEP; the native WebGPU EP is the recommended path going forward.

Deprecates SkipLayerNorm strict mode.

CUDA 12 packages are deprecated; users should move to CUDA 13.

All ONNX Runtime Training packages have been deprecated.

The onnxruntime-mobile Android package and onnxruntime-mobile-c/onnxruntime-mobile-objc iOS cocoapods are being deprecated.

Announces that support for Windows ARM32 will be totally dropped in the next release.