ONNX Runtime v1.30.0

ONNX Runtime 1.30.0 expands generative AI inference, improves CPU and GPU performance, adds Go bindings, and strengthens runtime reliability. These notes cover changes since ONNX Runtime 1.29.1.

Highlights

• Expanded CUDA inference support with variable-length causal convolution for continuous batching, speculative decoding in paged XQA, and INT4 paged KV caches with per-channel scales (#32168, #32340, #32515).
• Improved WebGPU PagedAttention, added GPT-OSS support and INT8 KV-cache block quantization, and extended convolution optimizations (#31727, #32277, #32284, #32420).
• Added fused CPU LinearAttention kernels for AVX-512, Arm64 NEON, and SVE, plus AVX2 LayerNorm/RMSNorm acceleration (#31674, #31973, #32178, #32356).
• Added Go bindings for the ONNX Runtime C API and DeepSeek Engram contrib operators (#29615, #32268).

Announcements & Compatibility

• FP4 QMoE kernels are now enabled by default in CUDA builds, with Windows build support added in this release. Source builds can opt out with -Donnxruntime_USE_FP4_QMOE=OFF (#32096, #32163).
• CUDA fpA-intB builds now default to a compact kernel set for FP16 activations, INT4/INT8 weights, scale-only quantization, and block_size=32. Set -Donnxruntime_USE_FPA_INTB_GEMM_FULL=ON when building from source to retain the full kernel set, including BF16, zero-point, bias, larger-block-size, and native Hopper variants (#32324).
• CPU FP16 Gemm and MatMul execution is gated on hardware acceleration. CPU-assigned FP16 nodes without a matching kernel now fall back to FP32 (#32301, #32197).
• WebGPU plugin EP packaging now supports Linux AArch64. Plugin versions were advanced to WebGPU 0.4.0 and CUDA 0.2 (#32287, #31960, #31970).

Security & Reliability

Model Loading, Memory, and Input Validation

• Limited nested model-graph depth and canonicalized external-data locations to harden model loading (#32344, #32135).
• Added checked rounding for BFC arena allocations and fixed prepacked-weight reference lifetimes (#32010, #32040).
• Strengthened shape, rank, and parameter validation for Split, Scan, GatherND, ScatterND, SpaceToDepth/DepthToSpace, Crop, Conv, Normalizer, and pooling (#29461, #31668, #32034, #32039, #32076, #32157, #32160, #32161, #32345, #32349).
• Hardened generation and attention input handling, including attention-attribute narrowing, BifurcationDetector inputs, generation subgraph shapes, and QEmbed segment inputs. BeamSearch buffer expansion now uses dynamic shape storage (#31648, #31701, #32009, #32078, #32144).
• Validated TreeEnsemble node references and bounded subtree comparison, rejected non-finite CPU RoiAlign coordinates, and required ImageScaler bias to match the channel count (#32031, #32043, #32011, #32002).
• Added an allowlist of safe LoRA adapter parameter data types, validated MatMulFpQ4 shape inputs, and checked MLAS blockwise quantization/dequantization index ranges (#31682, #32032, #32007).

GPU Bounds and Resource Lifetimes

• Hardened CUDA indexing and buffer-size arithmetic in MatMulNBits, RemovePadding, RotaryEmbedding, SparseAttention, Whisper beam search, NMS, QDQ, and GatherElements (#31643, #31994, #31995, #31996, #31998, #32014, #32029, #32030).
• Fixed overflow in CUDA reduction scans and Softmax offset arithmetic, and handled zero-sized outputs in CUDA random-generator kernels (#32137, #32330, #31997).
• Fixed CUDA MultiHeadAttention shared-cache scratch lifetimes and kept CudaAsyncBuffer staging storage alive across CUDA graph replay (#31968, #32121).
• Fixed WebGPU out-of-bounds subgroup-matrix loads for partial tiles, zero-initialized writable device-allocator buffers, and rejected foreign GPU handles in built-in data transfers (#32364, #32063, #32317).

Dependencies and Tooling

• Upgraded Protobuf to 33.6 and refreshed Python documentation dependencies, including an ONNX security-related update (#29906, #32190, #32424).
• Updated JavaScript dependencies including js-yaml, joi, fast-uri, and the Next.js end-to-end fixture (#32397, #32486, #32488, #32505, #32508).
• Pinned GitHub Actions to full-length commit SHAs and strengthened packaging infrastructure with authenticated package feeds and NPM network isolation (#32176, #32005, #32440).

New Features

Core APIs & Runtime

• Added Go bindings for the ONNX Runtime C API (#29615).
• Extended memory importing with host-pointer support and added access to preallocated outputs through KernelContext::GetPreallocatedOutput (#29726, #32089).
• Added packed-attention workspace recipes and estimates, and made workspace input-shape handling aware of optional inputs (#32283, #32321, #32312).
• Added DeepSeek Engram contrib operators, EngramGate and NGramHashMapping, and expanded kernel coverage for Qwen-3.5 operators (#32268, #32106).

Plugin Execution Providers

• Added LoRA adapter support with plugin EP allocators, preserved custom allocators during EP registration, and reset plugin stream chunks before release (#32221, #32272, #31983).
• Fixed CUDA plugin device discovery on WSL and improved Windows ARM64 packaging (#32517, #32355).

...

ONNX Runtime v1.29.1

This is a patch release on top of v1.29.0, containing GroupQueryAttention capability and KV-cache layout improvements, plugin Execution Provider performance tooling updates, and targeted graph and optimizer fixes.

GroupQueryAttention

• Added bidirectional GroupQueryAttention support on CPU and CUDA through a backward-compatible causal attribute, with explicit handling for unsupported execution paths (#31704)
• Added a session option and Execution Provider metadata contract for using the BNHS Value KV-cache layout, with graph transformations that preserve compatibility with the existing BNSH operator schema (#32139)
• Added CPU support for attention_bias with a sliding-window KV cache, including explicit position IDs and post-eviction bias indexing (#32302)

Runtime and Performance Tools

• Fixed Compile API model serialization when output-model and custom initializer-location callbacks are used together, preventing duplicate graph fields in emitted models (#32303)
• Updated onnxruntime_perf_test to use plugin Execution Provider device allocators for generated inputs, loaded test data, and pre-allocated outputs, avoiding unnecessary per-run host/device copies (#32244)

Bug Fixes and Documentation

• Hardened FastGelu fusion to skip malformed Mul and Pow patterns (#32016)
• Added validation for in-memory external initializer references, rejecting unregistered or mismatched data before graph transformation (#32042)
• Restored the C API documentation workflow by switching the pinned Doxygen download to the official GitHub release asset (#32210)

Contributors

Thanks to our 7 contributors for this release!

@adrastogi, @apsonawane, @edgchen1, @javier-intel, @jnagi-intel, @tianleiwu, @Wayne-Ch

_{Release highlights were drafted with AI assistance and are subject to release-team review.}

Full Changelog: v1.29.0...v1.29.1

ONNX Runtime v1.28.2

This is a patch release on top of v1.28.1, containing a targeted fix for Compile API model serialization.

Highlights

Bug Fixes

• Fixed Compile API callback serialization to prevent duplicate graph nodes, inputs, outputs, and value information in emitted optimized models, including models with embedded or external initializers (#32303)

Contributors

Thanks to our contributor for this release!

@adrastogi

Full Changelog: v1.28.1...v1.28.2

These release notes were drafted with assistance from GitHub Copilot.

ONNX Runtime WebGPU Plugin EP v0.3.0

ONNX Runtime WebGPU Plugin EP 0.3.0 expands model and data-type coverage, improves generative-model performance, and strengthens configuration, reliability, and release tooling.

These release notes were drafted with AI assistance.

Highlights

Model and operator coverage

• Added initial PagedAttention support, MRotaryEmbedding, GRU, DFT, PRelu, HardSwish, Trilu, Max and Min, and MatMulBnb4. (#31611, #31976, #29840, #29454, #30512, #29828, #29845, #29833, #29587)
• Expanded integer support across common operators, including int64 for Add, Cast, Clip, Concat, Equal, Gather, Min, Max, ReduceSum, Reshape, Sub, Tile, and Where; uint8 for Cast, Expand, Gather, and Reshape; and int32/uint32 for CumSum and Tile. (#28804, #29392, #29830, #29834, #29839, #29844, #29847, #29854, #29861, #29897, #31049, #31702, #31709, #31714)
• Added 2-bit GatherBlockQuantized support and integrated ONNX 1.22 with opset 27. (#29054, #28754)

Generative models

• Added quantized KV cache support and expanded GQA with sliding-window cache, batched right-padded prompts, and FlashAttention graph capture for Gemma 4. (#28059, #29236, #29247, #29904)
• Fixed GQA and quantized KV cache correctness for rotary batched prefill, split-reduce decode, and per-batch sequence lengths. (#29002, #29593, #29752)

Performance

• Added deferred dispatch to parallelize shader compilation during cold start. (#29557)
• Added Intel subgroup-matrix MatMul and FP16 Gemm kernels, then extended them with batched-B and odd-N weight support and additional tiling optimizations. (#29271, #29592, #29749, #29813, #29893, #30514)
• Switched Softmax and non-flash Attention to an online softmax algorithm and tuned FlashAttention decode. (#29694, #29724, #29586)

Reliability and configuration

• Added a robustness provider option, made the pending-dispatch limit configurable, and exposed WebGPU buffer-cache options through the JavaScript API. (#31971, #28894, #29017)
• Improved validation and bounds handling in GridSample, LSTM, DynamicQuantizedLSTM, Slice, and GatherBlockQuantized, and fixed WebGPU data-transfer callbacks on Windows x86. (#28704, #29030, #29255, #29595, #31568)
• Corrected profiling timestamp alignment with the ONNX Runtime profiler. (#29021)

Build and release tooling

• Added device-free compile-only sessions for offline graph transformation and removed the dynamic Duktape/Node WGSL-generation path in favor of generated shader sources. (#29681, #28355, #29141)
• Upgraded Dawn, fixed parallel-build races, refreshed release and packaging documentation, and enabled WebGPU CI on plugin release branches. (#29389, #29040, #29777, #29059, #32090)

Contributors

Thank you to everyone who contributed to this release:

@AngelGalindo7, @daijh, @danielsongmicrosoft, @edgchen1, @fanchenkong1, @feich-ms, @guschmue, @haoxli, @hariharans29, @Honry, @huningxin, @jchen10, @Jiawei-Shao, @miaobin, @mingmingtasd, @mirounga, @mustjab, @nicholascelestin, @prathikr, @qjia7, @Reranko05, @Shivani767, @skottmckay, @ssam18, @sushraja-msft, @tairenpiao, @tianleiwu, @titaiwangms, @wuisabel-gif, @xhcao, and @xiaofeihan1.

Scope: commits affecting ONNX Runtime WebGPU Plugin EP code, tests, build integration, and packaging since plugin-ep-webgpu/v0.2.1.

ONNX Runtime v1.28.1

This is a patch release on top of v1.28.0, containing support for device-free WebGPU compilation, improved compatibility with sandboxed Windows processes, and targeted graph-validation fixes.

WebGPU EP

• Added support for device-free compile-only sessions, enabling offline graph transformation and optimized-model serialization without access to GPU hardware (#29681)

Bug Fixes

• Prevented an access violation in Windows processes under Win32k lockdown by skipping DXGI device discovery (#29755)
• Allowed zero-input EPContext nodes, aligning their schema with support for compiling zero-input models (#29799)
• Hardened FastGelu fusion to skip malformed Mul and Pow patterns (#32016)
• Added validation for in-memory external initializer references, rejecting unregistered or mismatched data before graph transformation (#32042)

Contributors

Thanks to our 4 contributors for this release!

@apsonawane, @shiyi9801, @adrastogi, @mingmingtasd

Full Changelog: v1.28.0...v1.28.1

ONNX Runtime CUDA Plugin EP 0.1.0

This is the first release of ONNX Runtime CUDA Plugin EP, providing CUDA execution as a separately packaged plugin execution provider.

These notes cover commits affecting CUDA Plugin EP core code, CMake integration, and its primary build and package pipeline.

Please refer to QUICK_START.md for the usage.

Highlights

Plugin Runtime

• Introduces the CUDA Plugin EP core and makes it the default CUDA provider implementation (#27816, #29544).
• Adds arena allocation, resource accounting, available-resource reporting, and IOBinding synchronization (#27931, #28028, #28103, #27919).
• Adds provider options for user compute streams, copy behavior, EP-level unified streams, and external allocators, with compatibility back to ONNX Runtime 1.24.4 through version-gated callbacks (#28603, #28824).

CUDA Graphs and Profiling

• Adds CUDA Graph capture and replay, including user compute stream support, synchronization controls, and a kernel sync stream for scratch allocation (#27958, #28002, #28686, #29221, #29244).
• Adds plugin profiling APIs and memory statistics in profiling output (#28216, #29058).

Operators and Dependencies

• Expands model coverage with NHWC hardening, cuDNN SDPA for MHA/GQA, quantized MoE kernels, block-quantized FP4 MatMul, and native NVFP4 QMoE prefill on SM120 (#28612, #28849, #28467, #29818, #29824).
• Adds cuDNN-free ArgMax, ArgMin, and ReduceSum and fixes LogSoftmax for plugin deployments (#29620).
• Reduces runtime dependencies by making cuDNN and cuFFT optional and removing the nvrtc link requirement (#29252, #29808, #29705).

Build and Packaging

• Adds dedicated build and packaging pipelines, the onnxruntime-ep-cuda Python wheel, and NuGet packages (#27959, #28152, #28299, #28378).
• Adds Windows ARM64 packages, package-size controls, and aligned package metadata and artifact naming (#28896, #31635).
• Improves CUDA build coverage and reliability across CUDA 12.8/13, SM90, and SM120 while reducing CI build time with per-architecture object libraries and quick-build support (#29711, #28736, #29776, #31608, #31609, #28645).

Contributors

Thank all contributors that contributed to the CUDA execution provider:

@abudup, @aciddelgado, @AdamLouly, @adamreeve, @adrianlizarraga, @Alexey-Kamenev, @amancini-N, @amathews-amd, @AndreyOrb, @apsonawane, @ashbhandare, @askhade, @baijumeswani, @BowenBao, @chenfucn, @chengchen666, @chilo-ms, @cloudhan, @cocotdf, @codemzs, @cschreib-ibex, @dakenf, @decahedron1, @derdeljan-msft, @duli2012, @e-tao, @edgchen1, @elwhyjay, @eserscor, @fajin-corp, @feihugis, @frank-dong-ms, @fs-eire, @fthielke, @gedoensmax, @georgthegreat, @gh-yewang, @gineshidalgo99, @GopalakrishnanN, @gramalingam, @guoyu-wang, @guoyuhong, @hadiFute, @hanbitmyths, @hariharans29, @harrysummer, @harshithapv, @HectorSVC, @hubertlu-tw, @jagadish-amd, @jambayk, @jchen351, @jeffdaily, @jessebenson, @jiafatom, @jiangzhuo, @jignparm, @jingyanwangms, @jixiongdeng, @johannes-rehm-snkeos, @jslhcl, @JTischbein, @justinchuby, @jywu-mysoft, @kailums, @ke1337, @khspear, @kit1980, @KnightYao, @kpkbandi, @krahenbuhl, @kunal-vaishnavi, @Lafi7e, @linkerzhang, @liqunfu, @liuziyue, @lukas-folle-snkeos, @mastryukov1990, @mc-nv, @micmelesse, @mika-fischer, @mindest, @mityada, @mszhanyi, @mtavenrath, @mwootton, @namgyu-youn, @naomiOvad, @natke, @neginraoof, @nenad1002, @oliviajain, @PatriceVignola, @PeixuanZuo, @pengwa, @petermcaughan, @poweiw, @pranavsharma, @praneshgo, @prathikr, @qti-jkilpatrick, @qti-kromero, @RandySheriffH, @RandyShuai, @raviskolli, @Rishi-Dave, @RyanUnderhill, @satyajandhyala, @selenayang888, @seungtaek94, @shaahji, @shahasad, @sheetalarkadam, @SherlockNoMad, @ShirasawaSama, @skottmckay, @skyline75489, @smk2007, @snnn, @sohaibiftikhar, @souptc, @stevenlix, @Stonesjtu, @suffiank, [Vishal Agarwal (@thevishalagarwal)](https...

ONNX Runtime v1.29.0

Announcements & Breaking Changes

• onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
• POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
• The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

• Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
• Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
• Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
• Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
• Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

• Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

• Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
• Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
• Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
• Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

• WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
• Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
• Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

• Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
• Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
• Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
• Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
• Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

• Added NVFP4 QMoE, including native FP4xFP4 prefill on SM120, faster decode GEMV, fused routing/finalization paths, and reduced activation and weight-dequantization overhead (#29697, #29824, #29887, #29919, #31156, #31159, #31349, #31479).
• Added MatMulBlockQuantizedFp4Weight and MatMulBlockQuantizedFp8Weight, plus block-scaled tensor-core/GEMV decode paths, packed FP4 decode, M-tiling, and folded W8A8 activation QDQ (#29818, #29850, #29896, #31155, #31481).
• Improved MatMulNBits and QMoE robustness and efficiency by optimizing 8-bit dequantization, releasing raw MXFP4 initializers after prepack, and fixing subgraph prepacking and mixed FP8/FP4 build failures (#29852, #31141, #31154, #31350).

Operators and collectives

• Added LinearAttentionGate, GatedRMSNorm, and GatedAdd contrib operators (#31158, #31835).
• Added bfloat16 support to AllReduce, AllGather, and AllToAll (#31571).
• Fixed the default zero point in CUDA GatherBlockQuantized (#31693).

WebGPU EP

• Added DFT, HardSwish, Max/Min, Trilu, GRU, PRelu, MatMulBnb4, and MRotaryEmbedding support (#29454, #29587, #29828, #29833, #29840, [#29845](https://github.com/microsoft/...

ONNX Runtime WebGPU Plugin EP v0.2.1

Highlights

• Major performance work for attention-heavy LLMs.

  • FlashAttention decode kernels were fused and extended for any sequence length (#28389).
  • FlashAttention prefill shared-memory path was generalized (#28520).
  • Dynamic max_k_step was enabled for NVIDIA (#28511).
  • QKV bias support was added for FlashAttention in MultiHeadAttention (#28380).
  • M4 Max-specific FlashAttention optimization landed (#27780).

• Qwen3 and Gemma 4 model-path improvements.

  • QKV and MLP fusions for Qwen3-style models (#28280).
  • Q/K RMSNorm fusion into GroupQueryAttention for Qwen3-style models (#28484).
  • Opset 24 and KV-shared decoder layer support for Gemma 4 (#28501).
  • GroupQueryAttention now supports optional present-key/value outputs (#28242).

• LinearAttention and quantized-path optimizations.

  • LinearAttention subgroup optimizations and larger tile_v with subgroup support (#28412, #28519).
  • GatherBlockQuantized gained 2-bit support (#28530).

• Reliability and hardening fixes.

  • Fixes for out-of-bounds read risks in GatherBlockQuantized and Pad (#28718, #28721).
  • Fix for past_state == present_state buffer handling (#28753).
  • Fixes in QMoE numerical stability and SkipSimplifiedLayerNormalization bias behavior (#28434, #28427).
  • ConvTranspose weight shape validation improvement (#28524).

• Graph-capture and buffer-management improvements.

  • Per-graph buffer manager and session-level buffer pool updates for graph capture reuse (#28260, #28761).

Note: This section was AI-generated. It may have inaccuracies.

Contributors

Thanks to everyone who contributed to the WebGPU EP (human contributors, alphabetical):

@apsonawane, @daijh, @edgchen1, @feich-ms, @GopalakrishnanN, @guschmue, @hariharans29, @HectorSVC, @jchen10, @qjia7, @tianleiwu, @xiaofeihan1, @xenova, @yuslepukhin.

Note: This list was compiled on a best-effort basis from PRs that touched WebGPU EP-specific paths and
intentionally includes human contributors only, so it may not capture every contribution. If yours was
missed, the omission is unintentional. Your work is no less appreciated.

ONNX Runtime v1.28.0

Announcements & Breaking Changes

• Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#28754, #29606, #28967). Graph optimizer opset version checks were updated accordingly (#28966).
• cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#29252, #29808, #29705, #29620).
• An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#28746, #29142, #28990).
• Deprecated / removed:
  • SkipLayerNorm strict mode is deprecated (#29388).
  • The TensorRT fused causal attention kernels were removed from the CUDA EP (#29143).
  • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#29141, #28355).
  • CUDA_QUANT_PREPROCESS is off by default (#29687).
• NPM packages are now published from the CUDA 13 pipeline (#28773).
• The CUDA 12.8 package architecture list was refreshed for this release (#29711).

Security Fixes

Memory safety & input validation

• Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#28186, #29068)
• Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#28839)
• Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#28973)
• Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#28991, #29011, #29012, #29014)
• Validated Col2Im inputs to prevent heap over-read (#28706)
• Hardened CropAndResize against malformed crop_size tensors (#28766)
• Validated BeamSearch vocab_size against logits width (#28774)
• Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#29239)
• Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#29015, #29242)
• Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#29240, #29447)
• Clamped 1D attention mask_index to valid bounds (#29449)
• Validated MaxpoolWithMask kernel rank against input spatial rank (#29253)
• Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#29264)
• Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#29268, #29448)
• Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#29293, #29060)
• Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#29462)
• Handled non-trivially-copyable types in Loop/Scan output concatenation (#29397)
• Normalized bool tensor raw_data to {0, 1} on unpack (#29238)
• Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#28779, #28780, #28801)
• Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#29251)

Integer overflow & allocation size

• Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#29444, #29446)
• Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#29443)
• Hardened QMoE against integer overflow and partial K tiles (#29067)
• Validated B/scales/zero-points shape in MatMulNBits::PrePack (#29445)
• Pre-checked ConstantOfShape output size against the input initializer before constant folding (#28751)
• Fixed integer overflow in RKNPU implicit bias allocation (#29249)
• Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#28721, #28704, #28718)

Supply chain & tooling

• Updated protobuf to mitigate CVE-2026-0994 and bumped ONNX/protobuf to fix additional CVEs (#28967, #29606)
• Avoided shell injection in the training helper and switched Triton compile helpers to subprocess (#28776, #28775)
• Validated archive extraction paths in the transformers tooling (#28777)
• Validated and inlined external data in node tensor attributes during session initialization (#29250)
• Enabled Spectre-mitigated MSVC libraries for BinSkim builds (#29624)
• Bumped npm dependencies: shell-quote, esbuild, tmp, ws, protobufjs, js-yaml, tar, markdown-it, @babel/core (#29022, #29044, #29055, #29057, #29061, #29062, #29063, #29079, #29090, #29156)

New Features

Execution Provider ABI & Plugin EPs

• Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#28271, #28989, #29501)
• Added an API to select the best compiled-model compatibility info from candidate strings (#28387)
• Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#28624)
• Implemented name-based partitioning with accompanying documentation (#28903)
• Added Linux NPU discovery through sysfs accel devices (#28703)
• Relaxed CompileModel validation to accept zero-input OrtModel graphs (#28771)
• CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#29221, [#29244](https://github.com/microsoft/onnxruntime/...

ONNX Runtime v1.27.1

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

• [MLAS] Fixed an igemm regression in the KleidiAI path (#28571)
• Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#29081)
• Fixed a regression in graph-capture session initialization that rejected an empty graph (#29457)
• Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#29574)

Performance

NVIDIA CUDA EP

• Added a QMoE GEMV fast path for batch-1 decode (#29038)

CI & Build Infrastructure

• Fixed an incorrect identity for azcopy (#29274)
• Fixed a brew install applesimutils failure by trusting the wix/brew tap (#29450)
• Upgraded to Xcode 26 (#29468)
• Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#29575)
• Fixed the web e2e (npm/vite) and Python DML CI pipelines (#29609)

Contributors

Thanks to our 8 contributors for this release!

@tianleiwu, @chilo-ms, @edgchen1, @adrastogi, @damdoo01-arm, @JonathanC-ARM, @martin-klacer-arm, @sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1