ONNX Runtime

Highlights

• Major performance work for attention-heavy LLMs.

  • FlashAttention decode kernels were fused and extended for any sequence length (#28389).
  • FlashAttention prefill shared-memory path was generalized (#28520).
  • Dynamic max_k_step was enabled for NVIDIA (#28511).
  • QKV bias support was added for FlashAttention in MultiHeadAttention (#28380).
  • M4 Max-specific FlashAttention optimization landed (#27780).

• Qwen3 and Gemma 4 model-path improvements.

  • QKV and MLP fusions for Qwen3-style models (#28280).
  • Q/K RMSNorm fusion into GroupQueryAttention for Qwen3-style models (#28484).
  • Opset 24 and KV-shared decoder layer support for Gemma 4 (#28501).
  • GroupQueryAttention now supports optional present-key/value outputs (#28242).

• LinearAttention and quantized-path optimizations.

  • LinearAttention subgroup optimizations and larger tile_v with subgroup support (#28412, #28519).
  • GatherBlockQuantized gained 2-bit support (#28530).

• Reliability and hardening fixes.

  • Fixes for out-of-bounds read risks in GatherBlockQuantized and Pad (#28718, #28721).
  • Fix for past_state == present_state buffer handling (#28753).
  • Fixes in QMoE numerical stability and SkipSimplifiedLayerNormalization bias behavior (#28434, #28427).
  • ConvTranspose weight shape validation improvement (#28524).

• Graph-capture and buffer-management improvements.

  • Per-graph buffer manager and session-level buffer pool updates for graph capture reuse (#28260, #28761).

Note: This section was AI-generated. It may have inaccuracies.

Contributors

Thanks to everyone who contributed to the WebGPU EP (human contributors, alphabetical):

@apsonawane, @daijh, @edgchen1, @feich-ms, @GopalakrishnanN, @guschmue, @hariharans29, @HectorSVC, @jchen10, @qjia7, @tianleiwu, @xiaofeihan1, @xenova, @yuslepukhin.

Note: This list was compiled on a best-effort basis from PRs that touched WebGPU EP-specific paths and intentionally includes human contributors only, so it may not capture every contribution. If yours was missed, the omission is unintentional. Your work is no less appreciated.

Announcements & Breaking Changes

• Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#28754, #29606, #28967). Graph optimizer opset version checks were updated accordingly (#28966).
• cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#29252, #29808, #29705, #29620).
• An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#28746, #29142, #28990).
• Deprecated / removed:
  • SkipLayerNorm strict mode is deprecated (#29388).
  • The TensorRT fused causal attention kernels were removed from the CUDA EP (#29143).
  • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#29141, #28355).
  • CUDA_QUANT_PREPROCESS is off by default (#29687).
• NPM packages are now published from the CUDA 13 pipeline (#28773).
• The CUDA 12.8 package architecture list was refreshed for this release (#29711).

Security Fixes

Memory safety & input validation

• Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#28186, #29068)
• Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#28839)
• Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#28973)
• Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#28991, #29011, #29012, #29014)
• Validated Col2Im inputs to prevent heap over-read (#28706)
• Hardened CropAndResize against malformed crop_size tensors (#28766)
• Validated BeamSearch vocab_size against logits width (#28774)
• Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#29239)
• Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#29015, #29242)
• Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#29240, #29447)
• Clamped 1D attention mask_index to valid bounds (#29449)
• Validated MaxpoolWithMask kernel rank against input spatial rank (#29253)
• Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#29264)
• Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#29268, #29448)
• Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#29293, #29060)
• Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#29462)
• Handled non-trivially-copyable types in Loop/Scan output concatenation (#29397)
• Normalized bool tensor raw_data to {0, 1} on unpack (#29238)
• Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#28779, #28780, #28801)
• Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#29251)

Integer overflow & allocation size

• Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#29444, #29446)
• Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#29443)
• Hardened QMoE against integer overflow and partial K tiles (#29067)
• Validated B/scales/zero-points shape in MatMulNBits::PrePack (#29445)
• Pre-checked ConstantOfShape output size against the input initializer before constant folding (#28751)
• Fixed integer overflow in RKNPU implicit bias allocation (#29249)
• Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#28721, #28704, #28718)

Supply chain & tooling

• Updated protobuf to mitigate CVE-2026-0994 and bumped ONNX/protobuf to fix additional CVEs (#28967, #29606)
• Avoided shell injection in the training helper and switched Triton compile helpers to subprocess (#28776, #28775)
• Validated archive extraction paths in the transformers tooling (#28777)
• Validated and inlined external data in node tensor attributes during session initialization (#29250)
• Enabled Spectre-mitigated MSVC libraries for BinSkim builds (#29624)
• Bumped npm dependencies: shell-quote, esbuild, tmp, ws, protobufjs, js-yaml, tar, markdown-it, @babel/core (#29022, #29044, #29055, #29057, #29061, #29062, #29063, #29079, #29090, #29156)

New Features

Execution Provider ABI & Plugin EPs

• Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#28271, #28989, #29501)
• Added an API to select the best compiled-model compatibility info from candidate strings (#28387)
• Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#28624)
• Implemented name-based partitioning with accompanying documentation (#28903)
• Added Linux NPU discovery through sysfs accel devices (#28703)
• Relaxed CompileModel validation to accept zero-input OrtModel graphs (#28771)
• CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#29221, #29244, #28896, #28789)
• WebGPU plugin EP version bumped to 0.3.0 (#29056)

Core APIs & Runtime

• Added OrtErrorCode documentation, single-sourced the values so StatusCode stays in sync, and added OrtErrorCode::ORT_DEVICE_RESET (#29018, #29065, #29748)
• Added memory statistics to profiling output (#29058)
• Added EP version logging on inference failure, in the EpDeviceUsage event, and ORT version logging (#28794)
• User-supplied external initializers are now used in place when already on the planned device (#29013)
• model_external_initializers_file_folder_path is now honored for file-path model loads (#29459)
• Added a Python API for HOST_ACCESSIBLE OrtValue allocation (#28038)

Quantization Tooling

• Added CudaQuantizer to onnxruntime.quantization (#29509)
• Registered Flatten as a Direct8Bit op in the Python QDQ static quantizer (#28340)
• Skipped MaxPool during FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#28488, #29350)
• Added Float16/BFloat16/Float8 support in the TensorArray custom op (#28335)
• Clarified CPU parameter recommendations in the quantization docs (#28415)

Execution Provider Updates

NVIDIA CUDA EP

Attention & LLM decode

• Enabled XQA by default for FP16/BF16 GroupQueryAttention, and extended XQA decode with attention sink, sliding window, and QK-Norm support (#29046, #29162, #29177, #29186)
• Upgraded cudnn_frontend to 1.24 and enabled cuDNN SDPA for MHA/GQA (#28849)
• Added decode-optimized LinearAttention (GatedDeltaNet) kernels (#28985)
• Optimized FlashDecode split planning for local-window GQA and fixed Flash/Lean attention split heuristics (#29161, #29554)
• Updated the GroupQueryAttention contrib op documentation (#29173)

MoE & quantized GEMM

• Prepacked int4/int8 QMoE expert weights in the PrePack hook, symmetric with MatMulNBits, and fixed the prepack to always use the SM80 layout (#28749, #28978, #28965)
• Optimized the QMoE SoftmaxTopK router for small-batch decode, added a Split-K2 SwiGLU GEMV kernel, defaulted to fp16 accumulation for fp16 activations, and fused the MoE router bias into the MatMulNBits GEMV (#28980, #29167, #29166, #29170)
• Added a batched small-M GEMV path for 4-bit/8-bit MatMulNBits (#29451)
• Enabled fpA_intB GEMM in CUDA builds with configurable options, added prepacked fpA_intB weight support, and enabled native SM90, block_size=32, and fused bias (#29622, #29499, #29585)
• Fixed a QMoE profiler cross-stream race and made it CUDA-graph-capture safe (#29584)

Coverage, dependencies & fixes

• Added cuDNN-free ArgMax/ArgMin/ReduceSum and fixed LogSoftmax on the plugin EP (#29620)
• Filled the CUDA opset gap for Softplus and Softsign up to opset 22 (#28982)
• Fixed the XQA GroupQueryAttention cudaErrorInvalidValue on Blackwell (sm_120) (#29706)
• Initialized large-head FMHA shared memory per kernel variant (#29140)
• Fixed CUDA/cuDNN DLL preload paths for the CUDA 13 consolidated wheel layout, and fixed the libcudart.so.13 hard dependency that broke import on CPU-only Linux (#29202, #29590)
• Fixed a null allocator passed to plugin EP kernel PrePack, and plugin EP allocator deleter lifetime (#29658, #29663)
• Removed unused code in moe_kernels.cu (#29295)

WebGPU EP

• Added KV cache quantization for ORT WebGPU (#28059)
• Fused FlashAttention decode kernels and extended them to any sequence length (#28389)
• Fused Q/K RMSNorm into GroupQueryAttention for Qwen3-style models (#28484)
• Gemma 4 enablement: indirect dispatch for FlashAttention graph capture, and INT64 support for Equal/Sub/Where/ReduceSum under the enable_int64 flag (#29236, #29392)
• Added a session-level buffer pool for graph capture reuse and made max_num_pending_dispatches configurable (#28761, #28894)
• Added 2-bit quantization support to GatherBlockQuantized (#29054)
• Enabled Cast to int64 by default and switched to naive reduction (#28804, #28174)
• Default non-debug validation mode is now disabled (#28679)
• Tuned parameters for the gemm-subgroup kernel (#28760)
• Enabled FlashAttention for batched GQA with right-padded prompts and fixed batched right-padded prefill with do_rotary (#29247, #29002)
• Fixed a GQA decode split-reduce head_size out-of-bounds race, the past_state == present_state buffer aliasing case, and GatherBlockQuantized dispatch failure for empty indices (#29593, #28753, #29030)
• Fixed nearest half-tie handling for round_prefer_ceil/round_prefer_floor (#28757)
• Skipped MatMulNBitsMlpFusion when the kernel is unavailable (#29089)
• Fixed profiling timestamp alignment with the ORT profiler (#29021)

CoreML EP

• Added Where and And builders (#28597)
• Fixed extended minimal builds with the Core ML EP (#29387)
• Fixed the "model_path" must not be empty error (#29394)
• Fixed CoreML-enabled static builds on macOS (#27960)

QNN EP

• Fixed a segfault in PadNodeGroupSelector::Check when dq_nodes is empty (#28733)
• Added a Gather handler for the transpose optimizer (#28755)

WebNN EP

• Added support for 8-bit MatMulNBits (#29025)
• Removed unnecessary casts around normalization ops (#29024)

OpenVINO / VitisAI / DML / XNNPACK / VSINPU

• OpenVINO EP development updates (#28954)
• VitisAI: recognize native-endian in-memory address tag in process_ext_address (#29248)
• DML: fixed batched readback size (#28680)
• XNNPACK: fixed Clip/Relu fusion when the producer output has other consumers (#28814)
• VSINPU: fixed EP build error (#29440)

CPU & Core Optimizations

MLAS

• Added AVX512 (+VNNI) 2-bit weight CPU kernels (#29064)
• Added ARM64 2-bit weight CPU kernels (#29466)
• Extended the NHWC-sans-transposes path to support depthwise convolutions, and fixed NHWC conv support gating (#28565, #29127)
• Added RISC-V RVV INT8 GEMM/GEMV, M=1 routing, and activation kernels (#28308)
• Fixed a fastmath corner case in sbgemm_neon_kernel and fixed failing KleidiAI NHWC unit tests (#28394, #29010)
• Hinted GCC >= 12 on aarch64 for bf16/fp16 capability probes (#28785)

CPU Attention & Kernels

• Added flash attention for non-quantized CPU GroupQueryAttention, plus a FP32 GEMV decode kernel (#28962, #29216)
• Fixed packed-QKV and broadcast-head bias strides in quantized GQA flash attention (#28963)
• Enabled pre-packed weight sharing for CPU MatMulNBits (#29163)
• Added int8/uint8 CPU support for SpaceToDepth and int8 for DepthToSpace (#29154)
• Fixed CPU Attention causal mask alignment and is_causal bottom-right alignment for external KV cache (#29050, #28958)
• Fixed CPU GQA NaN output for right-padded batched prompts with rotary embeddings (#29069)
• Fixed ReverseSequence returning zeros for zero-length sequences (#28759)
• Fixed a regression in RandomForestClassifier binary classification predictions (#28685)

Graph, Optimizer, and Fusion

• Fixed NHWC second-pass EP assignment cleanup (#27858)
• Rejected QDQ Gemm → QGemm fusion when alpha != 1 with bias, and validated DQ scale/zero-point shapes before QGemm fusion (#28131, #28714)
• Fixed incorrect output for QDQ Resize with non-nearest interpolation modes under ORT_ENABLE_ALL (#28454)
• Fixed INT64 initializer data propagation and the Shape → Gather → TopK rank-1 regression (#28778, #29084)
• Fixed a TransposeOptimizer type error on zero-point-less DequantizeLinear (#29192)
• Fixed SimplifiedLayerNorm fusion with a node-produced Pow exponent (#29196)
• Fixed DropQDQ not dropping Q/DQ around opset-22 MaxPool (#29201)
• Recovered Conv/ConvTranspose rank from weights when the input shape is unknown (#29149)
• Fixed STFT complex input frame offsets (#28961)

Web & JavaScript

• Forwarded WebGPU EP buffer cache mode options from JS (#29017)
• Added a Python implementation for wgsl-gen and removed the dynamic WGSL generator path (#28355, #29141)
• Switched NPM publishing to consume from the CUDA 13 pipeline, and fixed the Node.js packaging stage to use CFS (#28773, #29006)
• Fixed a Dawn parallel build race condition in the wasm_Release / build-wasm CI (#29040)

Language Bindings

Python

• Added an API for HOST_ACCESSIBLE OrtValue allocation (#28038)
• Made the TF converter tolerate a missing requests package (#28825)

Java

• Released outputHandlesArr in the OrtTrainingSession.evalStep JNI binding (#29576)

Rust

• Fixed unbounded lifetime on WithOutputTensor (#29251)

Build, Packaging & CI

• Updated the cpuinfo dependency and integrated cpuinfo_deinitialize() (#28245)
• Built with abseil 20250814 under NVCC (#28586)
• Fixed the Linux CUDA 13.3 build (abseil + CCCL parse errors) and the Windows CUDA 13.3 build for VS 2026 (#29042, #29266)
• Fixed the Windows build for SM90 and later, and CUDA packaging build errors (#29776, #29580)
• Fixed the wrong ORT version in Windows DLL VersionInfo for pipeline builds (#29545)
• Fixed Python and CUDA packaging pipeline failures (#29200, #29241)
• Installed Java in the Windows NuGet packaging job and added Java setup to the Windows x64 QNN CI pipeline (#29774, #29754)
• Sharded Windows ASan test runs and fixed ASan OOM in QDQ Gemm transformer tests (#29503, #28797)
• Propagated and fixed PIP_INDEX_URL piping for container build stages (#29803, #29823)
• Removed deprecated docfx in favor of a newer docs validation method (#29812)
• Fixed a build failure from a direct ONNX schema include in layernorm optimizer tests (#29073)
• Test stability: fixed a data race in CUDA graph tests, a non-deterministic CUDA custom-op test, a thread-pool parameter self-assignment, duplicate schema registration, and incorrect string tensor creation (#29398, #29082, #28799, #29219, #29218)
• Encapsulated the global random seed in a function and improved LinearRegressor test coverage (#28979, #29083)

Contributors

Thanks to our 103 contributors for this release!

@adrastogi, @ankitm3k, @apsonawane, @ArsalanShakil, @bachelor-dou, @bopeng1234, @cbourjau, @chilo-ms, @chunghow-qti, @chwarr, @claude, @Craigacp, @crvineeth97, @dabhattimsft, @daijh, @danielsongmicrosoft, @derdeljan-msft, @edgchen1, @elwhyjay, @ericcraw, @eserscor, @fanchenkong1, @feich-ms, @fs-eire, @FuZoe, @gaugarg-nv, @gblong1, @GopalakrishnanN, @grybouilli, @guschmue, @haoxli, @hariharans29, @hnsyprst, @Honry, @intbf, @ishwar-raut1, @jambayk, @Jaswanth51, @jatinwadhwa921, @javier-intel, @jiafatom, @Jiawei-Shao, @JonathanC-ARM, @justinchuby, @jwludzik, @Kotomi-Du, @kpkbandi, @lucka-me, @maoger, @martin-klacer-arm, @maxwbuckley, @MayureshV1, @mc-nv, @mcollinswisc, @mdvoretc-intel, @mingyueliuh, @mklimenk, @n1harika, @namgyu-youn, @neilmsft, @orlmon01, @Osamaali313, @prathikr, @preetha-intel, @psakhamoori, @qiurui144, @qjia7, @qti-hungjuiw, @qti-yuduo, @quic-muchhsu, @raagrawal, @RajeevSekar, @Reranko05, @Rishi-Dave, @RyanMetcalfeInt8, @Sammy-Dabbas, @sanaa-hamel-microsoft, @sayanshaw24, @selenayang888, @sfatimar, @sgbihu, @Shivani767, @ssam18, @susbhere, @sushraja-msft, @tairenpiao, @the0cp, @tianleiwu, @titaiwangms, @umireon, @vthaniel, @wangw-1991, @wenqinI, @xadupre, @xenova, @xhcao, @xiaofeihan1, @xieofxie, @xuke537, @yen-shi, @yinli-systems, @yuslepukhin, @ZackyLake

Full Changelog: v1.27.1...v1.28.0

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

• [MLAS] Fixed an igemm regression in the KleidiAI path (#28571)
• Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#29081)
• Fixed a regression in graph-capture session initialization that rejected an empty graph (#29457)
• Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#29574)

Performance

NVIDIA CUDA EP

• Added a QMoE GEMV fast path for batch-1 decode (#29038)

CI & Build Infrastructure

• Fixed an incorrect identity for azcopy (#29274)
• Fixed a brew install applesimutils failure by trusting the wix/brew tap (#29450)
• Upgraded to Xcode 26 (#29468)
• Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#29575)
• Fixed the web e2e (npm/vite) and Python DML CI pipelines (#29609)

Contributors

Thanks to our 8 contributors for this release!

@tianleiwu, @chilo-ms, @edgchen1, @adrastogi, @damdoo01-arm, @JonathanC-ARM, @martin-klacer-arm, @sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28. n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

• CUDA 12 package files are now explicitly named as such.
• CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

---

Security Fixes

• Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#28004)
• Hardened OneHot input validation and output-size computation (#28014)
• Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#28055)
• Bounded total output allocation size in Tile kernel (#28070)
• Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#28223)
• Fixed BitShift UB for shift amounts greater than or equal to bit width (#28272)
• Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#28277)
• Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#28279)
• Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#28386)
• Fixed out-of-bounds read in CropBase scale handling (#28399)
• Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#28400)
• Added sparse tensor external file path validation and additional external-path hardening (#28408, #28709, #28725)
• Switched remaining torch.load() calls to weights_only=True (#28421)
• Added CPU cache-indirection beam-index validation (#28486)
• Added additional overflow/bounds checks and test coverage in runtime buffers (#28713, #28747)

---

New Features

Execution Provider Plugin API

• Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#28037)
• Added OrtEp::OnSessionInitializationEnd() callback (#28319)
• Added plugin EP session-options getters (#28377)
• Added CUDA Plugin EP provider options for streams and external allocators (#28603)

Core APIs & Runtime

• Added support for ONNX overloaded functions (IR v10+) (#28275)
• Added FLOAT8E8M0 datatype support in ONNX Runtime (#28381)
• Added CPU Cast support for FLOAT8E8M0 (#28435)
• Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#28282)

Quantization & Training Tooling

• Added calibration cache support to quantize_static (#28221)
• Added ActivationRestrictedAsymmetric quantization option (#28237)
• Added opset-21 block_size attribute support to QDQ quantization (#28522)
• Added CPU fallback for FusedAdam optimizer in ORT Training (#28233)

---

Execution Provider Updates

NVIDIA CUDA EP

• Added ConvTranspose-22 support (#27710)
• Filled CUDA opset gaps for LSTM, RNN, Reshape, Cast, Round/Equal, ReduceMax/ReduceMin, Sin/Cos, and Random* ops (#27737, #27743, #27742, #27744, #27754, #27755, #27756, #27759)
• Added LpNormalization support for CUDA EP (#28724)
• Added chunked dequant+GEMM for MatMulNBits to reduce peak GPU memory (#28712)
• Added QMoE tests for standard swiglu and improved decode-path routing/softmax kernels (#28741, #29026)
• Fixed CUDA Attention dispatch mismatch for GQA head-size cases (#28358)
• Fixed CUTLASS FMHA bias-loader alignment on unaligned kernel path (#28369)

WebGPU EP

• Added LSTM support on WebGPU (#27881)
• Added per-graph buffer manager for multi-graph capture (#28260)
• Added QKV and MLP layer fusions for Qwen3-style models (#28280)
• Added QKV bias support in FlashAttention for MultiHeadAttention (#28380)
• Added shader dump-to-file environment variable and nightly validation checks (#28674)
• Added opset-24 + KV-shared decoder support (Gemma 4) (#28501)
• Performance improvements: FlashAttention M4 Max optimization and subgroup-based LinearAttention tuning (#27780, #28412, #28519, #28520)
• Fixed numerical and correctness issues in QMoE, LayerNorm/SkipLayerNorm, and MatMul bias indexing (#28427, #28434, #28475)

CoreML EP

• Added support for pre-opset-13 Split (split attribute path) and scalar Gather indices (#28270, #28278)
• Added FusedConv, Identity, Ceil, Tile, Cast(bool), Sin, Cos, and GatherND support (#28289, #28293, #28595, #28596, #28598)

TensorRT / DML / QNN

• Improved TensorRT RTX compatibility (multi-GPU tests, API guards, and subgraph fixes) (#27837, #28361, #28611, #28503)
• Added diagnostics for DML failure paths (#28495)
• Updated QNN ETW log level rule handling (#27593)

---

Web & JavaScript

JavaScript / Node.js

• Updated JavaScript dependencies (next, postcss, tmp, qs, body-parser, and other npm packages) (#27705, #27894, #28304, #28547, #28644, #28683, [#28694]

---

CPU & Core Optimizations

MLAS / Quantization / Attention

• Added NHWC convolution path in MLAS to reduce transpose overhead (#26834)
• Added CPU QMoE 2-bit support and LUT GEMM fast path (#28185)
• Added quantized KV-cache support for CPU GroupQueryAttention with SIMD optimizations and tiled compute (#28576, #28578, #28606, #28695)
• Added RVV-optimized NCHWc convolution/pooling and LLM operators for RISC-V (#28411, #28518)
• Parallelized CPU ScatterElements and optimized MatMulNBits 2-bit float-zero-point path (#28588, #28589)
• Added optional bias support in MatMulNBits CPU LUT GEMM path (#28742)

Graph, Optimizer, and Fusion

• Added DiT attention fusion for F5-TTS and diffusion transformer models (#27999)
• Improved ONNX Attention dispatch path and removed legacy unfused MHA path (#27992)
• Added support for optional present_key/present_value outputs in GQA and Gemma4 support (#28242)
• Added implicit-input handling for partitioning/fusion around control-flow nodes (#28608, #28690)

---

Language Bindings

Python

• Fixed runtime-unresolvable type annotations in Session and InferenceSession (#27802)
• Made sympy an optional runtime dependency (#28141)
• Added PEP 561 py.typed marker to the onnxruntime package (#28438)

C#

• Added EP tests for CUDA Plugin EP (#28375)

---

Bug Fixes

Critical & Correctness Fixes

• Fixed session use-after-free when UserLoggingFunction is used (#28314)
• Prevented double-free in OrtModelEditorApi ownership transfer (#28123)
• Fixed plugin EP provider-library load refcount leak and added regression test (#28396, #28430)
• Fixed dangling pointer from temporary return value (#28419)
• Fixed PRelu returning NaN for infinite inputs on CPU EP (#28750)
• Fixed CPU Attention softcap/attn_mask ordering and added CUDA spec coverage consolidation (#28379)
• Fixed Reshape allowzero=1 handling for chained zero-size tensors (#28455)
• Fixed CPU QLinearConv per-channel weight zero-point handling for distinct values (#28456)
• Fixed Unicode-path handling issues on Windows and AppContainer path canonicalization (#28390, #28509)

Portability Fixes

• Build and portability fixes across AIX, GCC-15, S390x, libc++/Clang, FreeBSD, and cross-compilation flows (#26704, #27191, #28016, #28049, #28074, #28362, #28567, #28507)
• Fixed CPUIDInfo bounds handling for unknown ARM vendors (#28344)
• Fixed Resize nearest-mode rounding bug for negative halfway values (#28345)

---

Contributors

Thanks to our 106 contributors for this release!

@adrastogi, @adrianlizarraga, @AIFrameworksIntegration, @AlekseiNikiforovIBM, @angelser, @angelserMS, @ankitm3k, @anzzraju1997-glitch, @apsonawane, @arajendra, @ayappanec, @bachelor-dou, @badranX, @baijumeswani, @BoarQing, @bopeng1234, @bsosnader, @cbourjau, @chilo-ms, @chunghow-qti, @chwarr, @Craigacp, @daijh, @derdeljan-msft, @dparikh79, @edgchen1, @elwhyjay, @ericcraw, @eserscor, @feich-ms, @fs-eire, @gaugarg-nv, @gblong1, @GopalakrishnanN, @gramalingam, @guschmue, @hariharans29, @HectorSVC, @intbf, @ishwar-raut1, @Jaswanth51, @jatinwadhwa921, @javier-intel, @jchen10, @jiafatom, @Jiawei-Shao, @jnagi-intel, @jocelyn-stericker, @JonathanC-ARM, @justinchuby, @jwludzik, @kevinch-nv, @Kotomi-Du, @kpkbandi, @KV2773, @Laan33, @lhrios, @maxwbuckley, @MayureshV1, @mdvoretc-intel, @mingyueliuh, @mklimenk, @mustjab, @n1harika, @nazanin-beheshti, @orlmon01, @prathikr, @preetha-intel, @psakhamoori, @qiurui144, @qjia7, @qti-ashwshan, @qti-hungjuiw, @qti-yuduo, @rajatmonga, @RajeevSekar, @Rishi-Dave, @rvandermeulen, @RyanMetcalfeInt8, @SamuelLess, @sanaa-hamel-microsoft, @sfatimar, @sgbihu, @shiyi9801, @simonbyrne, @skottmckay, @susbhere, @sushraja-msft, @tairenpiao, @TejalKhade28, @theHamsta, @tianleiwu, @titaiwangms, @umangb-09, @velonica0, @vraspar, @vthaniel, @wenqinI, @xadupre, @xenova, @xhan65, @xiaofeihan1, @xieofxie, @yuslepukhin, @ZackyLake, @zejianzhang1982, @zz002

Full Changelog: https://github.com/microsoft/onnxruntime/compare/v0.1.4...v1.27.0

We're excited to ship the first release of the WebGPU Execution Provider as a plugin EP for ONNX Runtime. Instead of being baked into the core onnxruntime binary, the WebGPU EP is now distributed as a standalone artifact that registers with an existing ONNX Runtime installation at runtime.

Highlights

• Broad operator coverage on WebGPU. Native WebGPU kernels for the operators needed by common transformer, vision, and generative workloads — including Conv variants, MatMul/Gemm, normalizations, attention (Attention, MultiHeadAttention, GroupQueryAttention), rotary embeddings, quantized matmul, quantized Mixture-of-Experts (QMoE), and more. See the Operator coverage section below for a summary.
• Quantized & accelerated kernels. DP4A and subgroup-matrix MatMulNBits, a FlashAttention kernel, and vendor-optimized Intel MatMul/Gemm paths. See the Performance features section below.
• Plugin EP packaging. WebGPU support now ships as a separate, independently versioned library (onnxruntime_providers_webgpu) that plugs into a compatible ONNX Runtime (1.24.4 or newer) at runtime. Users can adopt WebGPU acceleration without switching their core ORT package, and the EP can iterate on its own cadence.
• Cross-platform native binaries for Windows x64/arm64 (bundled with dxil.dll / dxcompiler.dll), Linux x64, and macOS arm64.
• Language packages.
  • Python: onnxruntime-ep-webgpu wheel, installed alongside the onnxruntime package, registered via onnxruntime.register_execution_provider_library(...). See package page for details on installation and usage.
  • .NET: Microsoft.ML.OnnxRuntime.EP.WebGpu NuGet package, referenced alongside Microsoft.ML.OnnxRuntime, registered via OrtEnv.RegisterExecutionProviderLibrary(...). See package page for details on installation and usage.

Operator coverage

The WebGPU EP registers kernels for the majority of ONNX standard-domain operators used by mainstream model architectures, plus a curated set of com.microsoft contrib operators. Highlights by category:

• Math, normalization & reduction: MatMul, Gemm, Softmax, LayerNormalization, RMSNormalization, InstanceNormalization, BatchNormalization, LpNormalization, unary/binary elementwise ops, all standard reductions (ReduceMean, ReduceSum, ReduceMax, ...), CumSum, Einsum, TopK, ArgMax/ArgMin.
• Neural network: Conv, ConvTranspose, MaxPool/AveragePool (and Global* variants), plus a FusedConv contrib op.
• Tensor manipulation: Transpose, Reshape, Slice, Concat, Split, Gather/GatherElements/GatherND, ScatterElements/ScatterND, Pad, Tile, Cast, Resize, GridSample, Where, Flatten, Squeeze, Identity, Shape, and more.
• Transformer / LLM contrib ops: Attention, MultiHeadAttention, GroupQueryAttention, RotaryEmbedding, SkipLayerNormalization, SkipSimplifiedLayerNormalization, SimplifiedLayerNormalization, BiasAdd, BiasGelu, BiasSplitGelu, FastGelu, Gelu, QuickGelu, CausalConvWithState, LinearAttention.
• Quantization: DequantizeLinear, MatMulNBits (with DP4A and subgroup-matrix paths), GatherBlockQuantized, QMoE.

For the authoritative list, see the kernel registrations in webgpu_execution_provider.cc and webgpu_contrib_kernels.cc.

Performance features

• DP4A and subgroup-matrix MatMulNBits paths for accelerated quantized matmul on supported hardware.
• FlashAttention kernel for attention-heavy workloads.
• Intel-optimized MatMul/Gemm code paths for improved performance on Intel GPUs.
• Program caching to amortize shader compilation costs across runs.
• Optional PIX frame capture and WebGPU profiler integration for performance investigation.

Known limitations

• Platform support in this release is limited to the platforms listed above (no mobile, no Linux arm64, no macOS x64).

Acknowledgments

This initial release is the result of contributions from engineers at Microsoft, Intel, and the broader community. Thank you to everyone who built, reviewed, and tested the WebGPU plugin EP — including (in alphabetical order):

@aciddelgado, @adrastogi, @adrianlizarraga, @chilo-ms, @daijh, @derdeljan-msft, @edgchen1, @eserscor, @feich-ms, @fs-eire, @guschmue, @HectorSVC, @ingyukoh, @jchen10, @jiangzhaoming, @Jiawei-Shao, @jing-bao, @justinchuby, @kunal-vaishnavi, @mindest, @prathikr, @qjia7, @satyajandhyala, @shaoboyan091, @sheetalarkadam, @skottmckay, @snnn, @sushraja-msft, @tianleiwu, @titaiwangms, @TomCrypto, @vraspar, @wenqinI, @xenova, @xhcao, @xiaofeihan1, @yuslepukhin.

Special thanks to the Intel team for the vendor-optimized MatMul/Gemm kernels.

Note: This list was compiled on a best-effort basis from PRs that touched WebGPU EP-specific paths, so it may not capture every contribution. If yours was missed, the omission is unintentional — your work is no less appreciated.

n.b. The following was generated via LLM from Git history. Only the contributor list has been verified.

ONNX Runtime Release 1.26.0

Announcement - Breaking Changes

• Support for CUDA 12 will be removed in 1.27.0.
  • CUDA 13 will continue to be published as onnxruntime-<os>-<arch>-gpu_cuda13-<version>.<ext>
• CUDA runtime will be moving soon to a dedicated Execution Provider (EP) instead of a published package from ORT core.

Highlights

• Added optional memory mapping for .ort model loads (#28164).
• Added RISC-V Vector (RVV) support for CPU EP (#28261).
• OpenVINO EP upgraded for 1.26.0 development release (#28297).
• WebGPU gained GridSample support (#28264) and Split-K improvements (#28151).
• CUDA plugin EP gained graph support (#28002), profiling API (#28216).

Security and Reliability Hardening

• Replaced unrestricted Python setattr configuration with an allowlist (#28083).
• Hardened multiple OOB and overflow scenarios across ML and core ops:
  • Attention mask index OOB write (#27789).
  • MaxPoolGrad indices bounds validation (#27903).
  • SVM and TreeEnsemble bounds/security fixes (#27950, #27951, #27952, #27989).
  • RNN sequence_lens OOB read and integer overflow handling (#28052, #28003).
  • GroupQueryAttention seqlens_k bounds validation and compatibility follow-up (#28031, #28259).
  • MatMulBnb4 and ML coefficient SafeInt checks (#27995, #28001).
  • CUDA Gather int32 overflow fix (#28108).
  • GridSample float->int64 cast hardening for NaN/Inf/out-of-range coords (#28302).
• Fixed session logger use-after-free during EP teardown under verbose logging (#28274).

CUDA, Attention, and MLAS

• Filled CUDA opset/operator gaps and extended support:
  • Transpose opset 23 -> 25 (#27740).
  • QuantizeLinear/DequantizeLinear opset 25 (#28046).
  • CUDA TopK INT8/INT16/UINT8 support (#27862).
  • LabelEncoder CUDA support for numeric types (#28045).
• Attention/GQA improvements:
  • Fixed ONNX Attention min-bias alignment crash on SM<80 and masked-batch NaN behavior (#27831).
  • Added FP32 QK accumulation path for unfused GQA attention (#28198).
  • Added CUDART_VERSION reduction compatibility in GQA attention (#28296).
  • Fixed CUDA 13 build error in GQA unfused attention (#28309).
  • PagedAttention fallback for SM<80 fp16 (#28200).
• MLAS updates:
  • FP16 Gelu enablement (#26815).
  • Arm64 BF16 fast-math conv kernels for NCHW/NCHWc paths (#27878).

WebGPU, WebNN, and JavaScript

• WebGPU feature and correctness updates:
  • Added GridSample (#28264).
  • Split-K support for batch size > 1 (#28151).
  • MatMulNBits refactor and batching improvements (#28109, #28197).
  • MHA correctness fix when present outputs are not requested (#28027).
  • Buffer upload overflow fix (#27948).
  • Position ID bounds validation in WebGPU/JS RotaryEmbedding (#28214).
• WebNN change:
  • Renamed pool2d property roundingType -> outputShapeRounding (#28172).
• JavaScript ecosystem maintenance:
  • Multiple dependency bumps.

Plugin EP and EP Ecosystem

• CUDA plugin EP:
  • Graph capture/replay support ported and expanded (#27958, #28002).
  • Sync support for IOBinding (#27919).
  • Profiling API implementation (#28216).
  • Resource accounting integration (#28028).
• WebGPU plugin EP:
  • Pipeline updates and API init error handling fixes (#28121, #28211).
• Other EP updates:
  • CoreML: HardSigmoid and QuickGelu support; Pad reflect support/fixes (#28182, #28184, #28073, #28062).
  • NvTensorRTRTX compatibility and diagnostics updates (#28263, #27577).
  • QNN file-mapping guard improvements (#27871).

Contributors

@tianleiwu, @yuslepukhin, @edgchen1, @vraspar, @hariharans29, @skottmckay, @eserscor, @xadupre, @sanaa-hamel-microsoft, @elwhyjay, @Rishi-Dave, @titaiwangms, @adrianlizarraga, @jatinwadhwa921, @jchen10, @Jiawei-Shao, @maxwbuckley, @preetha-intel, @qjia7, @qti-hungjuiw, @RajeevSekar, @umangb-09, @adrastogi, @akote123, @amd-genmingz, @ankitm3k, @apsonawane, @bachelor-dou, @baijumeswani, @bopeng1234, @chilo-ms, @chwarr, @Craigacp, @dccarmo, @derdeljan-msft, @ericcraw, @fdwr, @fs-eire, @gaugarg-nv, @gblong1, @GopalakrishnanN, @Honry, @intbf, @ishwar-raut1, @Jaswanth51, @javier-intel, @JonathanC-ARM, @julia-thorn, @justinchuby, @jwludzik, @Kevin-Taha, @Kotomi-Du, @MayureshV1, @mdvoretc-intel, @miaobin, @milpuz01, @mingyueliuh, @mklimenk, @n1harika, @prathikr, @psakhamoori, @qti-yuduo, @quic-calvnguy, @RyanMetcalfeInt8, @sfatimar, @sgbihu, @ShirasawaSama, @ssam18, @susbhere, @sushraja-msft, @TejalKhade28, @theHamsta, @TomCrypto, @TsofnatMaman, @velonica0, @vthaniel, @wenqinI, @xhan65, @xhcao

n.b. This changelog is LLM generated. Only the contributor listing has been verified.

ONNX Runtime Release 1.25.1

📢 Announcements & Breaking Changes

ONNX Op Updates

• Enhanced ONNX operator support with new opset versions: Reshape (opset 25), Transpose (opset 24) (#27752)

---

✨ New Features

📊 New ONNX Ops & Model Support

• LinearAttention and CausalConvState operators for Qwen3.5 model support (#27907)
• RotaryEmbedding (RotEMB) and RMSNorm operators added (#27752)
• Linear Attention signature support (#27842)

---

🌐 Web & JavaScript

WebGPU EP

• Qwen3.5 model support on WebGPU execution provider (#27996)
• QMoE 1-token decode path optimization — fused operations to reduce GPU dispatches for improved performance (#27998)

---

🐛 Bug Fixes

Core Runtime Fixes

• Improved filesystem error messages during Linux device discovery for better debugging experience (#27289)
• Fixed missing include for SetRawDataInTensorProto in NVIDIA TensorRT RTX tests (#28065)

---

🙏 Contributors

Thanks to our 7 contributors for this release: @guschmue, @sanaa-hamel-microsoft, @apsonawane, @eserscor, @ishwar-raut1, @qjia7, @theHamsta

Full Changelog: https://github.com/microsoft/onnxruntime/compare/v1.25.0...v1.25.1

📢 Announcements & Breaking Changes

Build & Platform

• C++20 is now required to build ONNX Runtime from source. Minimum toolchains: MSVC 19.29+, GCC 10+, Clang 10+. Users of prebuilt packages are unaffected. (#27178)
• CUDA minimum version raised to 12.0 — CUDA 11.x is no longer supported. Users pinned to CUDA 11.x should stay on ORT 1.24.x or upgrade their CUDA toolkit/driver. (#27570)
• ONNX upgraded to 1.21.0 (#27601)
• sympy is now an optional dependency for Python builds. (#27200)

Execution Provider Changes

• ArmNN EP has been removed. Users should remove any --use_armnn build flags and migrate to the MLAS/KleidiAI-backed CPU EP or QNN EP for Qualcomm hardware. (#27447)

API Version

• ORT_API_VERSION updated to 25. (#27280)

---

🔒 Security Fixes

• Fixed potential integer truncation leading to heap out-of-bounds read/write (#27544)
• Addressed Pad Reflect vulnerability (#27652)
• Security fix for transpose optimizer (#27555)
• Upgraded minimatch 3.1.2 → 3.1.4 for CVE-2026-27904 (#27667)
• Hardened shell command handling for constant strings (#27840)
• Added validation of onnx::TensorProto data size before allocation (#27547)
• Cleaned up external data path validation (#27539)
• Fixed misaligned address reads for tensor attributes from raw data buffers (#27312)
• Fixed CPU Attention overflow issue (#27822)
• Fixed CPU LRN integer overflow issues (#27886)
• Additional input validation hardening:
  • Tile kernel dim overflow (#27566)
  • Out-of-bounds read in cross entropy (#27568)
  • TreeEnsembleClassifier attributes (#27571)
  • AffineGrid (#27572)
  • EmbedLayerNorm position_ids (#27573)
  • RotaryEmbedding position_ids (#27597)
  • RoiAlign batch_indices (#27603)
  • MaxUnpool indices (#27432)
  • QMoECPU swiglu OOB (#27748)
  • SVMClassifier initializer (#27699)
  • Col2Im SafeInt (#27625)

---

✨ New Features

🔌 Execution Provider Plugin API & CUDA Plugin EP

ORT 1.25.0 introduces the CUDA Plugin EP — the first core implementation that enables third-party CUDA-backed EPs to be delivered as dynamically loaded plugins without rebuilding ORT.

• CUDA Plugin EP: Core implementation (#27816)
• CUDA Plugin EP: BFC-style arena and CUDA mempool allocators for stream-aware memory management (#27931)
• Plugin EP Sync API for synchronous execution (#27538)
• Plugin EP event profiling APIs (#27649)
• Plugin EP APIs to retrieve ONNX operator schemas (#27713)
• Annotation-based graph partitioning with resource accounting (#27595, #27972)
• EP API adapter improvements: header-only adapter, OpKernelInfo::GetConfigOptions, LoggingManager::HasDefaultLogger() (#26879, #26919, #27540, #27541, #27587)
• WebGPU EP made compatible with EP API (#26907)

🔧 Core APIs

• Per-session thread pool work callbacks API (#27253)
• enable_profiling in RunOptions (#26846)
• KernelInfo string-array attribute APIs for C and C++ (#27599)
• OrtModel input support for Compile API (#27332)
• Session config to create weightless EPContext models during compilation (#27197)
• Compiled model compatibility APIs in example plugin EP (#27088)
• Model Package support (preview): Initial infrastructure for automatically selecting compiled EPContext model variants from a packaged collection based on EP, device, and hardware constraints. The directory structure is not yet finalized. (#27786)

📊 New ONNX Ops & Opset Coverage

• Attention opset 23 on CUDA with GQA, boolean masks, softcap, and softmax precision (#26466, #27030, #27082, #27428, #27714)
• Attention opset 24 on CUDA, disjoint from contrib op (#27542); nonpad KV seqlen on CPU (#27384)
• TensorScatter-24 for CPU and CUDA (#27389, #27446)
• DeformConv for CPU/CUDA (#27393)
• LpNormalization-22 (#27164)
• CUDA opset gap fills:
  • Control flow & misc: Flatten, Identity, If, Loop, Scan, ConstantOfShape, Size (opset 21/23) (#27728)
  • Pooling: GlobalAveragePool/GlobalMaxPool (→22) (#27733)
  • Shape ops: Shape (→25), Squeeze/Unsqueeze (→25) (#27734, #27739)
  • TopK (→24, BF16) (#27735), GRU (→22) (#27738)
  • Pad (→25, wrap mode) (#27774), Resize v19 (#27415), RoiAlign v16/v22 (#27646)

---

🖥️ Execution Provider Updates

NVIDIA CUDA EP

• GQA with XQA and quantized KV cache, including FP8 (E4M3) KV cache support (#27246, #27321)
• CUDA graph capture compatibility for LLM ops and pre-compiled paths (#27484, #27477)
• Volumetric (3-D) GridSample support (#27201)
• Optimized 3D nearest resize kernel for 5D tensors (#27578)
• Optional router_weights input to QMoE (#27687)

NVIDIA TensorRT RTX EP

• D3D12 external resource import support (#26948)

Qualcomm QNN EP

• Disabled file mapping for embedded cache (#27627)
• Fixed use-after-free of logger object (#27804)
• Fixed wheel build issues on WSL and Linux SDK version propagation (#27730, #27800)

Other EPs

• VitisAI EP: Added PE version info to provider DLL (#27626)
• DML EP: Fixed overflow in DmlGraphFusionHelper::ProcessInputData (#27815), fixed new-delete mismatch in QuantizeLinear (#27823)

---

🌐 Web & JavaScript

WebGPU EP — Performance

• Gemm/MatMul optimization using subgroup features (#26433)
• MatMulNBits: 2-bit zero-point support (#27285, #27325), higher K-parallelism (#27834), DP4A SmallM tiling (#27910)
• Flash Attention: head_sink support (#27410), configurable multi rotary cache concat offset (#27434)
• Optimized 4D Transpose (#26942), string stream optimization (#27223)

WebGPU EP — New Op Support

• Added TopK (#27560), Softplus (#27457), Identity (#27067)
• Added Conv3D support (#27917), LpNorm support (#27876)
• int64/bool support for Range, Expand, Flatten, Gather, Unsqueeze (#26673, #27478, #27561)
• DequantizeLinear fixes (#27706), Einsum 5D tensor fixes (#27779)

WebGPU EP — Stability

• Fixed device destroyed on session release breaking recreation (#27634)
• Fixed static destruction crash on exit (#27470, #27569)
• Backward compat: Legacy WebGPU/WebNN memory info names are now accepted again (#27637)
• Deterministic Split-K handling (#27086), buffer segment alignment fix (#27853)
• Binary size reduction for WebAssembly builds (#27370, #27371)

WebNN EP

• Broader GQA support and improved MultiHeadAttention (#27234, #27494)
• Added DepthToSpace support (#27508)

Node.js & React Native

• Fixed float16 tensor support in Node.js and React Native (#27327, #27549)
• Added 16KB page size alignment for Android (required for Android 15+) (#27523)

---

🧠 CPU & Core Optimizations

MLAS / KleidiAI / Quantization

• KleidiAI BF16 SME2 kernel integration (#26773), asymmetric 4-bit MatMulNBits on ARM64 (#27751)
• Fused Silu and Gelu kernels for AVX512 (#27690)
• Depthwise conv kernel for NCHW on AVX512 (#27874)
• ARM64 NCHWc NEON asm kernels (#27099, #27788), BF16 KAI SBGemm on NCHWc ARM (#27703)
• POWER10 Sgemm PackA optimization (#27575)
• Improved pre-packing for 2-bit LUT kernels (#27131)
• Backend kernel selector config in MLAS, allowing users to opt out of KleidiAI kernels on ARM platforms (#27136)

DQ→MatMulNBits Fusion

Extended to cover significantly more quantized LLM inference scenarios on CPU:

• 2-bit and 8-bit weights with Cast(fp16→fp32) patterns (#27614)
• FP16 models on CPU EP (#27640), fp16 8-bit on ARM64 (#27692)
• Gemm + per-tensor/per-channel quantization (#27769)
• FP16 quantized weight compatibility: models with HQNBIT quantized weights now route through the FP32 MLAS path for broader CPU compatibility (#27820)

Model Optimizer & Fusions

• Qwen3 model type support and RotaryEmbedding fusion for Qwen3 RoPE patterns (#27556, #27590)
• MobileClip attention fusion for both attention block patterns (#27883)
• Nemotron speech conformer encoder MHA fusion (#27764)
• Fixed GPT-2 no-past attention fusion for transformers ≥ 4.27 (#27449)
• Fixed BART attention fusion for SDPA pattern from transformers ≥ 4.49 (#27458)
• Pre-layer normalization support in attention fusion (#27418)
• SkipLayerNorm fusion with bias Add (#27765), broadcasting skip shapes (#27489)
• SpaceToDepth fusion pattern (#27747)
• NCHWc transformer: more patterns and ONNX-domain Gelu/HardSigmoid activations (#27691, #27821)
• Optimized qMoE code path for single-token execution (#27383)
• ONNX Attention KV cache optimization with ConcatNewToPast (#27613)

---

🔌 Language Bindings

Python

• Exposed OrtDeviceVendorId enum for vendor-aware OrtDevice aliases (#27594)
• Added bindings for GetCompatibilityInfoFromModel / GetCompatibilityInfoFromModelBytes (#27565)
• Fixed OrtValue.from_dlpack rejecting zero-size tensors as non-contiguous (#27451)

C#

• Added bindings for GetCompatibilityInfoFromModel / GetCompatibilityInfoFromModelBytes (#27565)

Java

• Avoid provider resource extraction when library already exists in onnxruntime.native.path (#27668)

---

🐛 Bug Fixes

Critical Fixes

• Fixed CPU Attention overflow issue (#27822)
• Fixed CPU LRN integer overflow issues (#27886)
• Fixed incorrect pad indices in AveragePool count_include_pad computation — silent correctness issue (#27375)
• Fixed integer division/modulo by zero in CPU EP Div and Mod operators (#27693, #27833)
• Fixed non-ASCII Unicode model path crash (#27724)
• Fixed arithmetic overflow in Det operator (#27070)
• Fixed narrow-to-wide string conversion bugs in DLL load error reporting (#27777)

Operator & Graph Fixes

• Fixed 3D attention mask broadcasting in MHA (#27464)
• Fixed GQA shape inference for present outputs (#27250)
• Fixed Einsum bugs for reduction and empty input cases (#27225, #27226)
• Prevented cross-EP Cast fusion in RemoveDuplicateCastTransformer (#27363)
• Fixed ConvTranspose bias input validation on CPU/CUDA (#27209)
• Fixed Cast node naming collisions in float16 conversion (#27469)
• Fixed concat/slice elimination and unsqueeze elimination against optional attrs and invalid models (#27638)
• Improved EPContext error message when node is not assigned to an EP (#27474)

EP-Specific Fixes

• Fixed MiGraphX EP double allocation (#27551)
• Fixed MLAS qgemm dispatch and kernel regressions in quantized conv tests (#27671)
• Fixed run-level profiling for subgraph operators (#27870)
• Fixed --build_wasm_static_lib implicitly enabling --build_wasm (#27342)

---

🙏 Contributors

Thanks to our 72 contributors for this release!

@tianleiwu, @fs-eire, @edgchen1, @titaiwangms, @hariharans29, @eserscor, @Rishi-Dave, @guschmue, @adrianlizarraga, @jambayk, @qjia7, @skottmckay, @adrastogi, @sanaa-hamel-microsoft, @yuslepukhin, @ingyukoh, @Jiawei-Shao, @vraspar, @xhcao, @chilo-ms, @Honry, @JonathanC-ARM, @kunal-vaishnavi, @ShirasawaSama, @chaya2350, @derdeljan-msft, @gedoensmax, @HectorSVC, @milpuz01, @quic-calvnguy, @xenova, @akholodnamdcom, @AlekseiNikiforovIBM, @amd-genmingz, @ashrit-ms, @bachelor-dou, @BODAPATIMAHESH, @Colm-in-Arm, @daijh, @dodokw, @fanchenkong1, @ivarusic-amd, @JanSellner, @jchen10, @jiafatom, @jnagi-intel, @johannes-rehm-snkeos, @justinchuby, @keshavv27, @Kevin-Taha, @kevinlam92, @kpkbandi, @Laan33, @melkap01-Arm, @miaobin, @n-v-k, @nico-martin, @patryk-kaiser-ARM, @praneshgo, @prathikr, @qc-tbhardwa, @sagarbhure-msft, @sdotpeng, @the0cp, @TsofnatMaman, @umangb-09, @walidbr, @wenqinI, @xadupre, @xhan65, @xiaofeihan1

---

Full Changelog: v1.24.4...v1.25.0

This is a patch release for ONNX Runtime 1.24, containing bug fixes and execution provider updates.

Bug Fixes

• Core: Added PCI bus fallback for Linux GPU device discovery in containerized environments (e.g., AKS/Kubernetes) where nvidia-drm is not loaded but GPU PCI devices are still exposed via sysfs. (#27591)
• Plugin EP: Fixed null pointer dereference when iterating output spans in GetOutputIndex. (#27644)
• Plugin EP: Fixed bug that incorrectly assigned duplicate MetaDef IDs to fused nodes in different GraphViews (e.g., then/else branches of an If node), causing session creation to fail with a conflicting kernel error. (#27666)

Execution Provider Updates

• QNN EP: Enabled offline x64 compilation with memhandle IO type by deferring rpcmem library loading to inference time. (#27479)
• QNN EP: Reverted QNN SDK logging verbosity changes that caused segmentation faults on backend destruction. (#27650)

Build and Infrastructure

• Python: Updated python_requires from >=3.10 to >=3.11 to reflect dropped Python 3.10 support. (#27354)
• Build: Replaced __builtin_ia32_tpause with the compiler-portable _tpause intrinsic to fix cross-compiler portability issues between GCC and LLVM. (#27607)

Full Changelog: v1.24.3...v1.24.4

Contributors

@derdeljan-msft, @adrianlizarraga, @apwojcik, @baijumeswani, @edgchen1, @mocknen, @tianleiwu, @XXXXRT666

This is a patch release for ONNX Runtime 1.24, containing bug fixes, security improvements, performance enhancements, and execution provider updates.

Security Fixes

• Core: Fixed GatherCopyData integer truncation leading to heap out-of-bounds read/write. (#27444)
• Core: Fixed RoiAlign heap out-of-bounds read via unchecked batch_indices. (#27543)
• Core: Prevent heap OOB from maliciously crafted Lora Adapters. (#27518)
• Core: Fixed out-of-bounds access for Resize operation. (#27419)

Bug Fixes

• Core: Fixed GatherND division by zero when batch dimensions mismatch. (#27090)
• Core: Fixed validation for external data paths for models loaded from bytes. (#27430)
• Core: Fixed SkipLayerNorm fusion incorrectly applied when gamma/beta are not 1D. (#27459)
• Core: Fixed double-free in TRT EP custom op domain Release functions. (#27471)
• Core: Fixed QMoE CPU Operator. (#27360)
• Core: Fixed MatmulNBits prepacking scales. (#27412)
• Python: Fixed refcount bug in map input conversion that caused shutdown segfault. (#27413)
• NuGet: Fixed DllImportResolver. (#27397)
• NuGet: Added OrtEnv.DisableDllImportResolver to prevent fatal error on resolver conflict. (#27535)

Performance Improvements

• Core: QMoE CPU performance update (up to 4x on 4-bit). (#27364)
• Core: Fixed O(n²) model load time for TreeEnsemble with categorical feature chains. (#27391)

Execution Provider Updates

• NvTensorRtRtx EP:
  • Avoid repetitive creation of fp4/fp8 native-custom-op domains. (#27192)
  • Added missing override specifiers to suppress warnings. (#27288)
  • DQ→MatMulNBits fusion transformer. (#27466)
• WebGPU:
  • Used embedded WASM module in Blob URL workers when wasmBinary is provided. (#27318)
  • Fixed usage of wasmBinary together with a blob URL for .mjs. (#27411)
  • Removed the unhelpful "Unknown CPU vendor" warning. (#27399)
  • Allows new memory info name for WebGPU. (#27475)
• MLAS:
  • Added DynamicQGemm function pointers and ukernel interface. (#27403)
  • Fixed error where bytes is not assigned for dynamic qgemm pack b size. (#27421)
• VitisAI EP: Removed s_kernel_registry_vitisaiep.reset() in deinitialize_vitisai_ep(). (#27295)
• Plugin EPs: Added "library_path" metadata entry to OrtEpDevice instances for plugin and provider bridge EPs. (#27522)

Build and Infrastructure

• Pipelines:
  • Build Windows ARM64X binaries as part of packaging pipeline. (#27316)
  • Moved JAR testing pipelines to canonical pipeline template. (#27480)
• Python: Enabled Python 3.14 CI and upgraded dependencies. (#27401)
• Build: Suppressed spurious Array Out of Bounds warnings produced by GCC 14.2 compiler on Linux builds. (#27454)
• Build: Fixed -Warray-bounds build error in MLAS on clang 17+. (#27499)
• Telemetry: Added/Updated telemetry events. (#27356)
• Config: Increased kMaxValueLength to 8192. (#27521)

Full Changelog: v1.24.2...v1.24.3

Contributors

@tianleiwu, @fs-eire, @adrianlizarraga, @yuslepukhin, @0-don, @anujj, @chaya2350, @chilo-ms, @dabhattimsft, @edgchen1, @eserscor, @hariharans29, @JonathanC-ARM, @lukas-folle-snkeos, @patryk-kaiser-ARM, @praneshgo, @skottmckay, @theHamsta, @vektah, @vishalpandya1990, @vthaniel, @xieofxie, @zz002