Bump the pip group across 2 directories with 3 updates by dependabot[bot] · Pull Request #878 · Samsung/CredSweeper

dependabot · 2026-07-11T05:02:11Z

Bumps the pip group with 2 updates in the / directory: onnx and protobuf.
Bumps the pip group with 3 updates in the /experiment directory: keras, onnx and protobuf.

Updates onnx from 1.17.0 to 1.22.0

Release notes

Sourced from onnx's releases.

v1.22.0

ONNX v1.22.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Swap qk_matmul_output_mode 1 & 2 to match computation order by @titaiwangms in onnx/onnx#7913

Spec and Operator

Two new operators LinearAttention-27 and CausalConvWithState-27 were introduced.

Fix number of pad modes in doc_strings.cc by @assafpr in onnx/onnx#7803

Add FlexAttention Op to ai.onnx.preview opset by @mshr-h in onnx/onnx#7534

Fix Attention op softcap ordering: apply before mask/bias by @titaiwangms in onnx/onnx#7867

Add LinearAttention and CausalConvWithState operators (Opset 27) by @tadani3 in onnx/onnx#7950

feat(generator): extend Range operator with float16 and bfloat16 support (opset 27) by @andife in onnx/onnx#7923

Reference Implementation

Fix missing 'mul' reduction in ScatterElements reference implementation by @zdryan in onnx/onnx#7842

Fix QLinearMatMul output saturation by @karimbaidar in onnx/onnx#7868

Fixed more bugs in the Scan reference op by @tadani3 in onnx/onnx#7964

Utilities and Tools

Fix Slice shape inference crashes with SIGABRT on empty dimensions by @titaiwangms in onnx/onnx#7738

Rename misleading input_rank param to input_dim_value in processSlice… by @titaiwangms in onnx/onnx#7739

fix: Conv/Pool strides validation by @edgchen1 in onnx/onnx#7764

fix: add input/output bounds checks in version converter adapter by @andife in onnx/onnx#7813

Harden version conversion against malformed inputs by @andife in onnx/onnx#7872

fix: add input rank checks in Gemm version converter adapters by @andife in onnx/onnx#7880

Fix raw_data handling in version converter adapters by @cyyever in onnx/onnx#7910

Fix checker to use len() instead of sys.getsizeof() for protobuf size check by @OmarAzizi in onnx/onnx#7760

Add version macros by @cbourjau in onnx/onnx#7918

Remove internal spec_to_yaml tool by @cbourjau in onnx/onnx#7985

Address shape inference shortcomings by @yuslepukhin in onnx/onnx#7997

Add unifyInputShape / unifyInputShapePrefix shape inference utilities by @gramalingam in onnx/onnx#7999

Add operator+ and operator- for Dim by @gramalingam in onnx/onnx#8000

Fix KeepAspectRatioHelper precision for scaled output dimensions by @elwhyjay in onnx/onnx#8007

Fix heap buffer over-read in Conv/Pool shape inference for weight rank mismatch by @Copilot in onnx/onnx#8037

Build, CI and Tests

Add update into main.yml by @titaiwangms in onnx/onnx#7687

Update check_urls.yml by @andife in onnx/onnx#7716

Update add_msvc_runtime_flag to work with MSVC_RUNTIME_LIBRARY by @Shadows-of-Fire in onnx/onnx#7660

Try to fix renovate by @andife in onnx/onnx#7742

fix upload; Update release_win.yml by @andife in onnx/onnx#7728

Allow release CIs to run when a labeled PR receives new commits by @Copilot in onnx/onnx#7741

Update pixi.{toml,lock} by @cbourjau in onnx/onnx#7746

hash for googletest by @andife in onnx/onnx#7765

Update RELEASE-MANAGEMENT.md by @andife in onnx/onnx#7773

Update doc CIPipeline by @andife in onnx/onnx#7782

use reviewdog to fix the pr_checks workflow by @andife in onnx/onnx#7780

Update copilot-setup-steps.yml; persist-credentials: false by @andife in onnx/onnx#7768

Update release_linux.yml; replace tag by hash by @andife in onnx/onnx#7769

... (truncated)

Commits

2bb5046 Fix windows workflows on rel-1.22.0 branch (#8087)
eda0385 Update version number to 1.22.0 (#8086)
b124e01 Bump version number to 1.22.0rc2 (#8071)
8de2cf6 Cherrypicks for 1.22.0rc2 (#8066)
53d6120 Cherry-pick: Address shape inference issues in Conv (#8051) to rel-1.22.0 (#8...
bc3be77 Set version number to 1.22.0rc1 (#8024)
e945daf feat(generator): extend Range operator with float16 and bfloat16 support (ops...
293ad62 Run lints also on Windows (#8014)
8847da4 Follow up for scikit-build-core migration (#8017)
882a5ef Fix/sdist missing SBOM cdx json (#8010)
Additional commits viewable in compare view

Updates protobuf from 3.20.3 to 5.29.6

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

This version includes breaking changes to: C++, Objective-C, PHP, Python.

[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

[C++] Make generator headers private (protocolbuffers/protobuf@3a2af35)

[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (protocolbuffers/protobuf@7a75898)

[C++] Add [[nodiscard]] to many APIs. (protocolbuffers/protobuf@a70115f)

[C++] Make the arena-enabled constructors of RepeatedField, RepeatedPtrField, and Map private. (protocolbuffers/protobuf@ef890c3)

[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (protocolbuffers/protobuf@b115358)

[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (protocolbuffers/protobuf@68346ec)

[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (protocolbuffers/protobuf@837a2cd)

[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() && !is_repeated()) instead (protocolbuffers/protobuf@9dbc5d4)

[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

[C++] All entity names have length limit (2afb0dc)

[ObjC] Remove generate_minimal_imports generation option warning (protocolbuffers/protobuf@45b1297)

[ObjC] Fix nullability annotations on some GPB*Dictionary types. (protocolbuffers/protobuf@ea67d6d)

[ObjC] Remove -[GPBFieldDescriptor optional] (protocolbuffers/protobuf@3414dc1)

[Other] Remove deprecated flag for enabling MSVC support (protocolbuffers/protobuf@97c979b)

[PHP] Remove deprecated PHP APIs (protocolbuffers/protobuf@9c45014)

[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (protocolbuffers/protobuf@4208121, protocolbuffers/protobuf@cd76e67, protocolbuffers/protobuf@4208121)

[PHP] Add PHP typehints for setters and remove redundant GPBUtil checks (protocolbuffers/protobuf#25296) (protocolbuffers/protobuf@aee03b7)

[PHP] support default values for editions/proto2 (protocolbuffers/protobuf#25161) (protocolbuffers/protobuf@b01099d)

[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (protocolbuffers/protobuf@5b116fe)

[Python] Remove float_format/double_format from python proto text_format (protocolbuffers/protobuf@e4854a1)

[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (protocolbuffers/protobuf@00aaca1)

[Python] Remove float_precision from python proto json_format (protocolbuffers/protobuf@f027f1f)

[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[Python] Remove deprecated FieldDescriptor.label (protocolbuffers/protobuf@0a8ff55)

[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Migration Guide may include additional guidance for breaking changes.

Bazel

Fix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (#25168) (protocolbuffers/protobuf@8c857c3)

Breaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

Feat(bazel): wire up prebuilt protoc toolchain (#24115) (protocolbuffers/protobuf@cc23698)

Migrate proto_descriptor_set (#23369) (protocolbuffers/protobuf@8d4dfdd)

Compiler

Ruby codegen: support generation of rbs files (#15633) (protocolbuffers/protobuf@6ebdf85)

Avoid collision name problems between a message named Xyz and a direct sibling enum named XyzView (protocolbuffers/protobuf@eba53e8)

Generalizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (protocolbuffers/protobuf@ed3c571)

Fix a bug with custom features outside of the pb package. (protocolbuffers/protobuf@872d3ce)

Fix import option handling when include_imports isn't set. (protocolbuffers/protobuf@9ef9e80)

Fix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (protocolbuffers/protobuf@1229d4a)

Prevent accidental stripping of debug_redact options via import option. (protocolbuffers/protobuf@f58b098)

C++

Add EnumerateEnumValues function. (protocolbuffers/protobuf@397d5d9)

... (truncated)

Commits

See full diff in compare view

Updates onnx from 1.17.0 to 1.22.0

Release notes

Sourced from onnx's releases.

v1.22.0

ONNX v1.22.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Swap qk_matmul_output_mode 1 & 2 to match computation order by @titaiwangms in onnx/onnx#7913

Spec and Operator

Two new operators LinearAttention-27 and CausalConvWithState-27 were introduced.

Fix number of pad modes in doc_strings.cc by @assafpr in onnx/onnx#7803

Add FlexAttention Op to ai.onnx.preview opset by @mshr-h in onnx/onnx#7534

Fix Attention op softcap ordering: apply before mask/bias by @titaiwangms in onnx/onnx#7867

Add LinearAttention and CausalConvWithState operators (Opset 27) by @tadani3 in onnx/onnx#7950

feat(generator): extend Range operator with float16 and bfloat16 support (opset 27) by @andife in onnx/onnx#7923

Reference Implementation

Fix missing 'mul' reduction in ScatterElements reference implementation by @zdryan in onnx/onnx#7842

Fix QLinearMatMul output saturation by @karimbaidar in onnx/onnx#7868

Fixed more bugs in the Scan reference op by @tadani3 in onnx/onnx#7964

Utilities and Tools

Fix Slice shape inference crashes with SIGABRT on empty dimensions by @titaiwangms in onnx/onnx#7738

Rename misleading input_rank param to input_dim_value in processSlice… by @titaiwangms in onnx/onnx#7739

fix: Conv/Pool strides validation by @edgchen1 in onnx/onnx#7764

fix: add input/output bounds checks in version converter adapter by @andife in onnx/onnx#7813

Harden version conversion against malformed inputs by @andife in onnx/onnx#7872

fix: add input rank checks in Gemm version converter adapters by @andife in onnx/onnx#7880

Fix raw_data handling in version converter adapters by @cyyever in onnx/onnx#7910

Fix checker to use len() instead of sys.getsizeof() for protobuf size check by @OmarAzizi in onnx/onnx#7760

Add version macros by @cbourjau in onnx/onnx#7918

Remove internal spec_to_yaml tool by @cbourjau in onnx/onnx#7985

Address shape inference shortcomings by @yuslepukhin in onnx/onnx#7997

Add unifyInputShape / unifyInputShapePrefix shape inference utilities by @gramalingam in onnx/onnx#7999

Add operator+ and operator- for Dim by @gramalingam in onnx/onnx#8000

Fix KeepAspectRatioHelper precision for scaled output dimensions by @elwhyjay in onnx/onnx#8007

Fix heap buffer over-read in Conv/Pool shape inference for weight rank mismatch by @Copilot in onnx/onnx#8037

Build, CI and Tests

Add update into main.yml by @titaiwangms in onnx/onnx#7687

Update check_urls.yml by @andife in onnx/onnx#7716

Update add_msvc_runtime_flag to work with MSVC_RUNTIME_LIBRARY by @Shadows-of-Fire in onnx/onnx#7660

Try to fix renovate by @andife in onnx/onnx#7742

fix upload; Update release_win.yml by @andife in onnx/onnx#7728

Allow release CIs to run when a labeled PR receives new commits by @Copilot in onnx/onnx#7741

Update pixi.{toml,lock} by @cbourjau in onnx/onnx#7746

hash for googletest by @andife in onnx/onnx#7765

Update RELEASE-MANAGEMENT.md by @andife in onnx/onnx#7773

Update doc CIPipeline by @andife in onnx/onnx#7782

use reviewdog to fix the pr_checks workflow by @andife in onnx/onnx#7780

Update copilot-setup-steps.yml; persist-credentials: false by @andife in onnx/onnx#7768

Update release_linux.yml; replace tag by hash by @andife in onnx/onnx#7769

... (truncated)

Commits

2bb5046 Fix windows workflows on rel-1.22.0 branch (#8087)
eda0385 Update version number to 1.22.0 (#8086)
b124e01 Bump version number to 1.22.0rc2 (#8071)
8de2cf6 Cherrypicks for 1.22.0rc2 (#8066)
53d6120 Cherry-pick: Address shape inference issues in Conv (#8051) to rel-1.22.0 (#8...
bc3be77 Set version number to 1.22.0rc1 (#8024)
e945daf feat(generator): extend Range operator with float16 and bfloat16 support (ops...
293ad62 Run lints also on Windows (#8014)
8847da4 Follow up for scikit-build-core migration (#8017)
882a5ef Fix/sdist missing SBOM cdx json (#8010)
Additional commits viewable in compare view

Updates protobuf from 3.20.3 to 5.29.6

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

This version includes breaking changes to: C++, Objective-C, PHP, Python.

[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

[C++] Make generator headers private (protocolbuffers/protobuf@3a2af35)

[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (protocolbuffers/protobuf@7a75898)

[C++] Add [[nodiscard]] to many APIs. (protocolbuffers/protobuf@a70115f)

[C++] Make the arena-enabled constructors of RepeatedField, RepeatedPtrField, and Map private. (protocolbuffers/protobuf@ef890c3)

[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (protocolbuffers/protobuf@b115358)

[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (protocolbuffers/protobuf@68346ec)

[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (protocolbuffers/protobuf@837a2cd)

[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() && !is_repeated()) instead (protocolbuffers/protobuf@9dbc5d4)

[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

[C++] All entity names have length limit (2afb0dc)

[ObjC] Remove generate_minimal_imports generation option warning (protocolbuffers/protobuf@45b1297)

[ObjC] Fix nullability annotations on some GPB*Dictionary types. (protocolbuffers/protobuf@ea67d6d)

[ObjC] Remove -[GPBFieldDescriptor optional] (protocolbuffers/protobuf@3414dc1)

[Other] Remove deprecated flag for enabling MSVC support (protocolbuffers/protobuf@97c979b)

[PHP] Remove deprecated PHP APIs (protocolbuffers/protobuf@9c45014)

[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (protocolbuffers/protobuf@4208121, protocolbuffers/protobuf@cd76e67, protocolbuffers/protobuf@4208121)

[PHP] Add PHP typehints for setters and remove redundant GPBUtil checks (protocolbuffers/protobuf#25296) (protocolbuffers/protobuf@aee03b7)

[PHP] support default values for editions/proto2 (protocolbuffers/protobuf#25161) (protocolbuffers/protobuf@b01099d)

[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (protocolbuffers/protobuf@5b116fe)

[Python] Remove float_format/double_format from python proto text_format (protocolbuffers/protobuf@e4854a1)

[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (protocolbuffers/protobuf@00aaca1)

[Python] Remove float_precision from python proto json_format (protocolbuffers/protobuf@f027f1f)

[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[Python] Remove deprecated FieldDescriptor.label (protocolbuffers/protobuf@0a8ff55)

[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Migration Guide may include additional guidance for breaking changes.

Bazel

Fix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (#25168) (protocolbuffers/protobuf@8c857c3)

Breaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

Feat(bazel): wire up prebuilt protoc toolchain (#24115) (protocolbuffers/protobuf@cc23698)

Migrate proto_descriptor_set (#23369) (protocolbuffers/protobuf@8d4dfdd)

Compiler

Ruby codegen: support generation of rbs files (#15633) (protocolbuffers/protobuf@6ebdf85)

Avoid collision name problems between a message named Xyz and a direct sibling enum named XyzView (protocolbuffers/protobuf@eba53e8)

Generalizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (protocolbuffers/protobuf@ed3c571)

Fix a bug with custom features outside of the pb package. (protocolbuffers/protobuf@872d3ce)

Fix import option handling when include_imports isn't set. (protocolbuffers/protobuf@9ef9e80)

Fix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (protocolbuffers/protobuf@1229d4a)

Prevent accidental stripping of debug_redact options via import option. (protocolbuffers/protobuf@f58b098)

C++

Add EnumerateEnumValues function. (protocolbuffers/protobuf@397d5d9)

... (truncated)

Commits

See full diff in compare view

Updates keras from 2.15.0 to 3.13.2

Release notes

Sourced from keras's releases.

v3.13.2

Security Fixes & Hardening

This release introduces critical security hardening for model loading and saving, alongside improvements to the JAX backend metadata handling.

Disallow TFSMLayer deserialization in safe_mode (#22035)

Previously, TFSMLayer could load external TensorFlow SavedModels during deserialization without respecting Keras safe_mode. This could allow the execution of attacker-controlled graphs during model invocation.

TFSMLayer now enforces safe_mode by default. Deserialization via from_config() will raise a ValueError unless safe_mode=False is explicitly passed or keras.config.enable_unsafe_deserialization() is called.

Fix Denial of Service (DoS) in KerasFileEditor (#21880)

Introduces validation for HDF5 dataset metadata to prevent "shape bomb" attacks.

Hardens the .keras file editor against malicious metadata that could cause dimension overflows or unbounded memory allocation (unbounded numpy allocation of multi-gigabyte tensors).

Block External Links in HDF5 files (#22057)

Keras now explicitly disallows external links within HDF5 files during loading. This prevents potential security risks where a weight file could point to external system datasets.

Includes improved verification for H5 Groups and Datasets to ensure they are local and valid.

Backend-specific Improvements (JAX)

Set mutable=True by default in nnx_metadata (#22074)

Updated the JAX backend logic to ensure that variables are treated as mutable by default in nnx_metadata.

This makes Keras 3.13.2 compatible with Flax 0.12.3 when the Keras NNX integration is enabled.

Saving & Serialization

Improved H5IOStore Integrity (#22057)

Refactored H5IOStore and ShardedH5IOStore to remove unused, unverified methods.

Fixed key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments.

Contributors

We would like to thank the following contributors for their security reports and code improvements: @0xManan, @HyperPS, @hertschuh, and @divyashreepathihalli.

Full Changelog: keras-team/keras@v3.13.1...v3.13.2

v3.13.1

Bug Fixes & Improvements

General

Removed a persistent warning triggered during import keras when using NumPy 2.0 or higher. (#21949)

Backends

JAX: Fixed an issue where CUDNN flash attention was broken when using JAX versions greater than 0.6.2. (#21970)

Export & Serialization

Resolved a regression in the export pipeline that incorrectly forced batch sizes to be dynamic. The export process now correctly respects static batch sizes when defined. (#21944)

Full Changelog: keras-team/keras@v3.13.0...v3.13.1

... (truncated)

Commits

e29d0ef Version bump and cherry picks for 3.13.2 (#22080)
8914427 Patch release commits for 3.13.1 (#22005)
986ff97 Update release version and comment orbax checkpoint (#21934)
ca23fce Refactors AbsMaxQuantizer to accept axis in call (#21931)
1a9893f Adds Serialization Support for QuantizationConfig based quantized models (#21...
86bfab4 More OpenVINO Numpy Operations (#21925)
f48f480 Add adaptive pooling (1D, 2D, 3D) support across JAX, NumPy, TensorFlow, and ...
0771c80 Fix ops.tile shape inference issue on TensorFlow backend (#21860)
024c96d Extended fix OOM Issue #21634 on Keras side (#21755)
71f4997 Introduces QuantizationConfig for fine-grained quantization control (#21896)
Additional commits viewable in compare view

Updates onnx from 1.17.0 to 1.22.0

Release notes

Sourced from onnx's releases.

v1.22.0

ONNX v1.22.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Swap qk_matmul_output_mode 1 & 2 to match computation order by @titaiwangms in onnx/onnx#7913

Spec and Operator

Two new operators LinearAttention-27 and CausalConvWithState-27 were introduced.

Fix number of pad modes in doc_strings.cc by @assafpr in onnx/onnx#7803

Add FlexAttention Op to ai.onnx.preview opset by @mshr-h in onnx/onnx#7534

Fix Attention op softcap ordering: apply before mask/bias by @titaiwangms in onnx/onnx#7867

Add LinearAttention and CausalConvWithState operators (Opset 27) by @tadani3 in onnx/onnx#7950

feat(generator): extend Range operator with float16 and bfloat16 support (opset 27) by @andife in onnx/onnx#7923

Reference Implementation

Fix missing 'mul' reduction in ScatterElements reference implementation by @zdryan in onnx/onnx#7842

Fix QLinearMatMul output saturation by @karimbaidar in onnx/onnx#7868

Fixed more bugs in the Scan reference op by @tadani3 in onnx/onnx#7964

Utilities and Tools

Fix Slice shape inference crashes with SIGABRT on empty dimensions by @titaiwangms in onnx/onnx#7738

Rename misleading input_rank param to input_dim_value in processSlice… by @titaiwangms in onnx/onnx#7739

fix: Conv/Pool strides validation by @edgchen1 in onnx/onnx#7764

fix: add input/output bounds checks in version converter adapter by @andife in onnx/onnx#7813

Harden version conversion against malformed inputs by @andife in onnx/onnx#7872

fix: add input rank checks in Gemm version converter adapters by @andife in onnx/onnx#7880

Fix raw_data handling in version converter adapters by @cyyever in onnx/onnx#7910

Fix checker to use len() instead of sys.getsizeof() for protobuf size check by @OmarAzizi in onnx/onnx#7760

Add version macros by @cbourjau in onnx/onnx#7918

Remove internal spec_to_yaml tool by @cbourjau in onnx/onnx#7985

Address shape inference shortcomings by @yuslepukhin in onnx/onnx#7997

Add unifyInputShape / unifyInputShapePrefix shape inference utilities by @gramalingam in onnx/onnx#7999

Add operator+ and operator- for Dim by @gramalingam in onnx/onnx#8000

Fix KeepAspectRatioHelper precision for scaled output dimensions by @elwhyjay in onnx/onnx#8007

Fix heap buffer over-read in Conv/Pool shape inference for weight rank mismatch by @Copilot in onnx/onnx#8037

Build, CI and Tests

Add update into main.yml by @titaiwangms in onnx/onnx#7687

Update check_urls.yml by @andife in onnx/onnx#7716

Update add_msvc_runtime_flag to work with MSVC_RUNTIME_LIBRARY by @Shadows-of-Fire in onnx/onnx#7660

Try to fix renovate by @andife in onnx/onnx#7742

fix upload; Update release_win.yml by @andife in onnx/onnx#7728

Allow release CIs to run when a labeled PR receives new commits by @Copilot in onnx/onnx#7741

Update pixi.{toml,lock} by @cbourjau in onnx/onnx#7746

hash for googletest by @andife in onnx/onnx#7765

Update RELEASE-MANAGEMENT.md by @andife in onnx/onnx#7773

Update doc CIPipeline by @andife in onnx/onnx#7782

use reviewdog to fix the pr_checks workflow by @andife in onnx/onnx#7780

Update copilot-setup-steps.yml; persist-credentials: false by @andife in onnx/onnx#7768

Update release_linux.yml; replace tag by hash by @andife in onnx/onnx#7769

... (truncated)

Commits

2bb5046 Fix windows workflows on rel-1.22.0 branch (#8087)
eda0385 Update version number to 1.22.0 (#8086)
b124e01 Bump version number to 1.22.0rc2 (#8071)

Bumps the pip group with 2 updates in the / directory: [onnx](https://github.com/onnx/onnx) and [protobuf](https://github.com/protocolbuffers/protobuf). Bumps the pip group with 3 updates in the /experiment directory: [keras](https://github.com/keras-team/keras), [onnx](https://github.com/onnx/onnx) and [protobuf](https://github.com/protocolbuffers/protobuf). Updates `onnx` from 1.17.0 to 1.22.0 - [Release notes](https://github.com/onnx/onnx/releases) - [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md) - [Commits](onnx/onnx@v1.17.0...v1.22.0) Updates `protobuf` from 3.20.3 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `onnx` from 1.17.0 to 1.22.0 - [Release notes](https://github.com/onnx/onnx/releases) - [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md) - [Commits](onnx/onnx@v1.17.0...v1.22.0) Updates `protobuf` from 3.20.3 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `keras` from 2.15.0 to 3.13.2 - [Release notes](https://github.com/keras-team/keras/releases) - [Commits](keras-team/keras@v2.15.0...v3.13.2) Updates `onnx` from 1.17.0 to 1.22.0 - [Release notes](https://github.com/onnx/onnx/releases) - [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md) - [Commits](onnx/onnx@v1.17.0...v1.22.0) Updates `protobuf` from 3.20.3 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `keras` from 2.15.0 to 3.13.2 - [Release notes](https://github.com/keras-team/keras/releases) - [Commits](keras-team/keras@v2.15.0...v3.13.2) Updates `onnx` from 1.17.0 to 1.22.0 - [Release notes](https://github.com/onnx/onnx/releases) - [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md) - [Commits](onnx/onnx@v1.17.0...v1.22.0) Updates `protobuf` from 3.20.3 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) --- updated-dependencies: - dependency-name: keras dependency-version: 3.13.2 dependency-type: direct:production - dependency-name: onnx dependency-version: 1.22.0 dependency-type: direct:production - dependency-name: onnx dependency-version: 1.22.0 dependency-type: direct:production - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: direct:production - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

codecov-commenter · 2026-07-22T20:50:34Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@1064da2). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #878   +/-   ##
=======================================
  Coverage        ?   91.11%           
=======================================
  Files           ?      160           
  Lines           ?     6676           
  Branches        ?     1114           
=======================================
  Hits            ?     6083           
  Misses          ?      382           
  Partials        ?      211

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Co-authored-by: Roman Babenko <babenek@users.noreply.github.com>

babenek

LGTM

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 11, 2026

dependabot Bot requested a review from a team as a code owner July 11, 2026 05:02

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 11, 2026

dependabot Bot force-pushed the dependabot/pip/pip-4822625de2 branch from d239166 to 819af22 Compare July 15, 2026 13:15

dependabot Bot force-pushed the dependabot/pip/pip-4822625de2 branch from 819af22 to 0e9c420 Compare July 22, 2026 11:11

Update GitPython version to 3.1.52

ab1a5d1

babenek reviewed Jul 25, 2026

View reviewed changes

Comment thread experiment/requirements.txt Outdated

babenek reviewed Jul 25, 2026

View reviewed changes

Comment thread experiment/requirements.txt Outdated

Apply suggestions from code review

54201de

Co-authored-by: Roman Babenko <babenek@users.noreply.github.com>

babenek reviewed Jul 25, 2026

View reviewed changes

Comment thread requirements.txt Outdated

Apply suggestion from @babenek

4cb2fae

babenek approved these changes Jul 25, 2026

View reviewed changes

babenek merged commit 5c15718 into main Jul 25, 2026
35 checks passed

dependabot Bot deleted the dependabot/pip/pip-4822625de2 branch July 25, 2026 07:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the pip group across 2 directories with 3 updates - #878

Bump the pip group across 2 directories with 3 updates#878
babenek merged 4 commits into
mainfrom
dependabot/pip/pip-4822625de2

dependabot Bot commented on behalf of github Jul 11, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Jul 22, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

babenek left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.22.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Build, CI and Tests

Protocol Buffers v34.0-rc1

Announcements

Bazel

Compiler

C++

v1.22.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Build, CI and Tests

Protocol Buffers v34.0-rc1

Announcements

Bazel

Compiler

C++

v3.13.2

Security Fixes & Hardening

Backend-specific Improvements (JAX)

Saving & Serialization

Contributors

v3.13.1

Bug Fixes & Improvements

v1.22.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Build, CI and Tests

Uh oh!

codecov-commenter commented Jul 22, 2026

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

babenek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Jul 11, 2026 •

edited

Loading