Sync with Microsoft ONNX Runtime - 26102026 by ai-fw-intg · Pull Request #1365 · intel/onnxruntime

ai-fw-intg · 2026-10-25T20:39:22Z

Automated daily backmerge from ORT main to ovep-develop. No conflicts detected. Do NOT squash or rebase - use merge commit only.

) ## Summary Implements the P0 reference/tooling and P1 QMoE v1 contract/host-validation slices of the [INT3 QMoE delivery plan](https://github.com/microsoft/onnxruntime/blob/2b1185e24a5a79c56fd01226ad81b016450d0ef3/docs/design/int3-qmoe-end-to-end-delivery-plan.md). Related roadmap: microsoft#32657. No P2 CUDA kernels are included. ### P0: Portable Format and Numerical References - Generic row-local LSB-first UINT8 pack/unpack for widths 1..8, checked size arithmetic, and separate canonical-padding validation. INT5/INT6 utility coverage does not enable those widths in QMoE. - INT3 offset-4 decoding, deterministic fixture RTN with stored-scale rounding and subnormal-underflow reporting, and handwritten byte/numerical vectors covering row/expert boundaries, packed block zero points, and a tiny predetermined-route SwiGLU MoE. - Independent scalar oracles and standard opset-18 ONNX unpack/decode graphs; no draft Pack/Unpack operator is required. - Self-contained reference tests use local golden vectors and installed standard ONNX operators; no external ONNX source checkout or pinned ONNX commit is required. - Reference pytest coverage runs in the existing Python quantization CI stage; CMake copies the helper modules and golden JSON fixture into the build output. No feature-specific workflow is added. ### P1: Compatible QMoE v1 Extension - INT3 is added to QMoE version 1. There is no QMoE v2 registration and no Microsoft-domain available/released-version increase. - Models without an effective INT3 projection keep legacy shape/type propagation. Existing 2/4/8-bit byte semantics and attribute defaults are preserved, including expert_weight_bits=4, quant_type="int", and weights_prepacked=-1. - INT3 requires integer quantization, explicit weights_prepacked=0, activation_type="swiglu", fused interleaved gate/up, block sizes 32/64/128, block-aligned H/I, and matching FP16/BF16 activation/scale types. Omitting quant_type uses the existing "int" default; exporters should still emit it explicitly. - Support independent projection metadata, including (3,4), (3,3), and (4,3), and packed per-row block zero points. Infer H from activation shape and I from fused FC1 output rows, not FC2 packed bytes. Check shapes, types, symbolic dimensions, byte counts, and overflow. - Shared host-only ValidateInt3ProjectionContent requires block-aligned K (not N) at the projection level and checks exact buffer sizes, finite nonnegative FP16/BF16 scales, all-4 explicit zero points, canonical padding, and checked dimensions. Padded byte-count arithmetic is overflow-safe without changing the strict byte-aligned helper. - Native regressions verify that legacy INT4 models resolve to QMoE v1 and find the existing CPU kernel both with and without an explicit Microsoft-domain import. Adjacent Microsoft operators remain at v1. - Generated QMoE documentation is synchronized; non-QMoE documentation is unchanged. ## Validation of the v1 Revision Commit eda7353 was validated inside Docker jiafa-dev: - Offline Python reference tests: **223 passed, 1 skipped**. The historical optional external-checkout case was removed in 6c875ae; current results are listed below. ONNX 1.23.2, NumPy 2.4.6, ml_dtypes 0.6.0; BF16 coverage executed. - Actual current ORT schema, registration entry point and QMoE test sources compiled using cached Ninja-generated flags and linked with cached ORT libraries: **17 passed** (11 schema/registry tests and 6 content/byte-helper tests). - C++ filter: QMoEShapeInferenceTest.*:QMoEFormatValidationTest.*. New test files are collected by the existing contrib-test CMake glob. - Pinned clang-format 20.1.8, Ruff 0.12.12 check/format, editor diagnostics and git whitespace checks passed. - QMoE description was checked byte-for-byte using the documentation generator's rendering rules; all other operator documentation is byte-identical to the preceding PR head. - This is isolated current-source compilation/linking, **not a clean full ORT build** or CUDA inference qualification. The cached build predates two neighboring schemas, so their current definitions were also compiled for linking. Container CUDA runtime paths and system -lrt replaced unavailable cached paths. Only the existing MLAS GNU-stack linker warning remained. - Hosted CI for this new head is pending. Previous external-reference interoperability results are historical; that opt-in test was not rerun for this schema-only revision. ## Scope and Review Gates This PR adds **no INT3 execution kernel**. Existing v1 CPU/CUDA/WebGPU registrations remain; schema acceptance does not establish INT3 inference support. Provider validation/execution, packed CUDA decode, bounded prefill, export and model qualification belong to subsequent work. The end-to-end follow-up now builds on this v1 revision; see the coordinated Draft PRs below. The host content validator has **no runtime call sites yet**: it accepts caller-supplied host buffers and is directly unit-tested. Schema inference checks metadata, not weight contents; model loading does not automatically scan scales or zero points. Python-only tails/empty dimensions/FP32-scale fixtures do not broaden the block-aligned FP16/BF16 operator profile. The v1-compatible extension approach supersedes this PR's earlier v2/domain-version proposal. Operator/exporter owner review and format freeze remain required. No approved ONNX datatype, standard operator, production quantizer/exporter, checkpoint importer, accuracy or performance claim is made. ## Scoped Checkpoint Audit The local Olive audit at a9290ab9bf668cae5a02ad7473c8cb0f5476d35e found WeightQuantizer and pack_to_uint8 restricted to 2/4/8 bits, with packing_factor = 8 // bits; the inspected GPTQ pass imports that quantizer, and PrecisionBits has no three-bit option. These inspected paths do not establish a compatible native INT3 checkpoint source. External GPTQ implementations and GGUF Q3_K/IQ3 were not audited. Future importers must verify code mapping, bit order, tensor orientation, grouping, scales, zero points, permutations, gate/up interleaving and FC2 orientation rather than relabel unknown checkpoint bytes. Unrelated local files and submodule changes are excluded. ## Follow-up End-to-End Work The experimental end-to-end implementation now builds on this PR's compatible QMoE v1 contract. The work is split across three coordinated **Draft PRs**: - **ORT runtime: [microsoft#33519](microsoft#33519, stacked directly on this PR. Adds CUDA execution for `(FC1, FC2)=(3,3), (3,4), (4,3)` with FP16/BF16, direct packed extraction in both projections, routing and fused SwiGLU, strict validation, bounded activation tiling, tests, and experimental model results. - **Olive quantization: [microsoft/Olive#2749](microsoft/Olive#2749. Adds symmetric grouped INT3 RTN with offset-4 codes, stored-scale rounding, canonical row-local three-bit packing/unpacking, and ceil-bit storage shapes. - **Mobius export: [onnxruntime/mobius#783](onnxruntime/mobius#783. Enables expert-only INT3 overrides for the three width pairs while retaining the model-wide INT4 fallback, using existing native fused QMoE graph and external-data plumbing. Together these changes exercised source checkpoint -> Olive quantization -> Mobius ONNX export -> ORT CUDA inference. Six small cross-project cases cover both activation dtypes and all three width pairs. Full Qwen3-30B-A3B exports and model measurements cover all routed expert gate/up/down weights at INT3 `(3,3)` versus matched INT4 `(4,4)`, with 48 QMoE layers, block64, FP16, attention/embedding INT4 and head INT8. Graph-plus-weight size is 12,782,047,512 versus 16,405,926,354 bytes, a **22.09% reduction**. The runtime PR records A100 measurements at input lengths 128/512/2048/4096 and output length 32. **Current INT3 inference is substantially slower than INT4; this is not a performance delivery.** The paired 5-shot MMLU pipeline check uses only one question per subject (57 total): INT3 40/57 and INT4 49/57, with matching document/prompt/target hashes. These are **not full MMLU scores**; no completed full-MMLU result is claimed here. ### Delivery Plan Status These follow-ups do **not** complete planned PR2 through PR4: | Planned stage | Implemented evidence | Remaining gate | | --- | --- | --- | | PR2: CUDA correctness | Independent references, bounded execution, actual CUDA Session coverage | Clean provider-target build and formal integration-test acceptance | | PR3: packed decode | Direct packed FC1/FC2 execution for all three pairs | Versioned provider-private prepack, cache identity/lifetime and prepack-cost qualification | | PR4a: baseline prefill | Functional bounded direct-packed prefill, including full-model long prompts | Required selected-expert/tiled dequantization plus existing GEMM and dedicated acceptance tests | | PR4b/4c: optimized prefill | Not delivered | Winning kernel candidate, integration and performance acceptance | Before submission, the follow-up runtime's 82 actual CUDA Session cases passed; Olive's 176 scoped quantization tests and Mobius's 18 new tests also passed. Runtime experiments reused isolated cached build artifacts with explicit ABI alignment, **not a clean full build**. Formal OpTester execution, capture, concurrency, lifetime and full-model qualification remain open. Full-model mixed-pair qualification is also open; small fixtures do not close that gate. See microsoft#33519 and its committed results report/JSON for protocols, provenance, measurements and limitations. The checkpoint audit above describes the inspected pre-change Olive revision; microsoft#2749 supplies the subsequent producer changes. None of these follow-ups changes this PR's P0/P1-only diff or constitutes ONNX standard approval or production qualification. ## Review Fixes and Padding Experiment Follow-up Commit e45296b integrates the no-exceptions assertion guards, symbolic projection-row consistency fix and regression cases, and unpacked zero-point code clarification directly into this PR. Rebuilt current-source normal schema/format tests: **17/17 passed**; format tests compiled with ORT_NO_EXCEPTIONS plus the real helper implementation: **6/6 passed**. Pinned clang-format, whitespace and schema/doc synchronization checks passed. These remain isolated cached-dependency builds, not clean full or globally exception-disabled builds. Padding experiments remain separately reviewable in microsoft#33530: two corrected full A100/CUDA13 runs, 108 cases each, with all128expert rotation covered per full trial. For block64,24->32byte padding adds33.33% weight payload and is approximately11% slower for decode projection and10% slower for32token projection in the tested scalar-load implementation. This is not a whole-model or pure-bandwidth conclusion and does not rule out future vectorized private layouts. The padding design thread remains open for reviewer acceptance; experiment source and raw records are not added to this P0/P1 diff. ## Existing CI Integration Commit 8a41267 removes the dedicated packed-reference workflow and runs the suite from the existing Python quantization test stage in tools/ci_build/build.py, after unittest discovery when contrib ops are enabled. CMake copies the complete reference directory and golden_vectors.json into the test build output. Explicit pytest execution is necessary because unittest discovery does not collect these module-level pytest functions. Existing Python CI already installs pytest; no new workflow or dependency-install job is introduced. Validated by copying the directory with cmake -E copy_directory and executing the exact new pytest command extracted from build.py: **223 passed, 1 skipped** at 8a41267 (historical optional checkout test, removed in 6c875ae). Ruff check/format and git whitespace checks passed. Hosted CI for this head is not yet verified. ## Latest Review Fixes Commit 6c875ae addresses the latest review comments: - Removes the pinned external ONNX reference checkout test entirely. The suite is self-contained: **223 passed**, with no external-checkout skip. The ONNX submodule gitlink is unchanged by this PR. - Requires explicit `activation_type="swiglu"` for the INT3 fused profile and rejects the default/non-SwiGLU cases. Legacy INT4 activation behavior remains covered. Schema documentation is synchronized. - Removes the projection-level N-alignment restriction (K remains block-aligned), removes unreachable weight-tail validation, and computes each expected zero-point byte once before checking rows. Adds an N=127 acceptance regression. - Adds standard copyright/license headers and trailing newlines, restores the unrelated CPU model test to the main-branch version, and fixes CMake COMMAND indentation. Recompiled current affected C++ sources with cached dependency libraries: **18/18 normal schema/format tests passed** and **7/7 format tests passed with ORT_NO_EXCEPTIONS and the real helper implementation**. These are scoped cached-dependency builds, not a clean whole-ORT or globally no-exceptions build. The exact existing-CI pytest command also passed after CMake-copying the suite into a temporary build-output directory. Pinned clang-format, Ruff check/format, schema/doc synchronization and git whitespace checks passed. Hosted CI for this new head has not yet been verified. --------- Signed-off-by: David Fan <jiafa@microsoft.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

…ete (microsoft#33313) ### Description  Make CUDA Level-1 workspace estimates route-complete for MatMulNBits, PackedAttention, and PackedMultiHeadAttention. - Reserve the legacy dequantize+GEMM fallback using the same checked chunking plan as runtime, including builds with `USE_FPA_INTB_GEMM=OFF`. - Honor the fpA M-chunk policy and include retained GEMM workspace in the complete runtime-preparation peak when a partial tail can lazily profile. Preserve the accountant's maximum-of-peaks calculation rather than double charging workspace. - Match estimator, include, and test-bridge guards to CUDA contrib source availability, excluding CUDA-minimal builds without disabling ordinary fpA-OFF estimation. - Charge the existing route-aware PackedAttention/PackedMultiHeadAttention aggregate during CUDA partitioning and fail closed when a complete sizing proof is unavailable. - Keep legacy arithmetic, structured-estimate, and capacity-threshold tests active with fpA compiled out. Enable and execute them in the existing fpA-OFF CI lane, with explicit success checks; cover CUDA-minimal with fpA explicitly OFF. Parent microsoft#33311 has merged. This PR targets main directly and now includes main at `314ff8d4e87816bafa1b8e0fefa476c896c4dedd`, merged in `0ad091a33f`. Framework conflict resolution retains both MatMulNBits chunk-policy forwarding and main's strict dispatch-policy validation and tests. ### Motivation and Context  Capacity-aware placement must reserve a complete requested-buffer bound for every reachable route. In particular, ordinary GEMM workspace can remain live while an unprofiled partial tail allocates its profiling scratch. The regression asserts the source-derived SM80 M=6144/N=256/K=1024 case as 28,672 + 5,421,568 = 5,450,240 bytes, with a smaller partial-tail case and dynamic, unchunked, and fully profiled controls. This is not a measured allocator/VRAM or OOM claim. Review follow-ups: `d080f7b7e9` addresses the overlap, minimal-build, and fpA-OFF coverage findings. `0ad091a33f` includes `core/framework/node_shape_resolver.h` inside the existing native/nonminimal packed-attention test guard, repairing the missing declaration reported in the CUDA CI jobs. No local forward declaration or runtime behavior change was introduced. **Validation** After integrating main, the following commands passed using the existing isolated environment and CI-pinned lintrunner 0.13.1 / clang-format 20.1.8: ```powershell . .\.venv\Scripts\Activate.ps1 $files = @(git diff --name-only origin/main -- include onnxruntime | Where-Object { $_ -match '\.(cc|h)$' } | ForEach-Object { $_.Replace('/', '\') }) & .\.venv\Scripts\lintrunner.exe @files git diff --check origin/main -- .github docs include onnxruntime ``` Results: **passed**, `ok No lint issues.` for all 15 changed C++ files; **passed** for PR-delta whitespace. - Static source audit - **passed**: exact one-line include repair inside the native/nonminimal guard, no conflict markers/duplicate tests in the 18-file PR delta, both parents' framework tests retained, and main's strict policy-validation block preserved alongside chunk-size forwarding. - PyYAML parsing of both affected workflows and unchanged fpA-OFF legacy test selection after the merge - **passed**. Existing requested-buffer regressions still assert 5,450,240 and 494,720 bytes; these are source-derived assertions, not local execution or measured VRAM evidence. - Local builds and C++/GPU tests - **not run**, per request. New-head ordinary CUDA, fpA-OFF/no-cuDNN, TensorRT, and Windows CI must compile the repaired test and execute the estimate/budget and legacy regressions. --------- Co-authored-by: Chi Lo <lochi@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c132130a-b0c7-422c-9ff7-75826b6ea3fc Copilot-Session: b95559c4-5cbe-4787-8dd7-ffa45a2157f9

### Description  Shares Q/K/V, weight-shape, projection-size, and cache-length checks between Attention prepacking and execution across CPU, CUDA, and native WebGPU. Uses checked packing/GEMM sizes, preserves pruned/unequal-V layouts and shared prepacking, and supports omitted CPU projection bias. Adds initializer-time, dynamic/unpacked, dimension-boundary, cache, and graph-independent validation coverage; updates the operator documentation. Refreshed on main `397657de778d05b17c0249ba37c0b4290e1ab3b5`: - Retains main's environment-based Android size allowance instead of reverting it to the stale branch constant. - Keeps both main's malformed-prepacking regressions and the new unequal-hidden-size sharing test. - Central validation preserves main's `"qkv_hidden_sizes values should be positive"` diagnostic. Shared malformed-case expectations were corrected after the first fresh native run exposed the mismatch. - Includes main's independent CUDA GQA build integration fix. ### Motivation and Context  Attention must enforce the same projection contract whether weights are packed at initialization or supplied during execution. Status-based validation rejects unsupported dimensions before unsafe packing/index arithmetic and keeps cache capacity checks consistent between implementations. ### Testing Fresh Windows Release CPU/DirectML build with MSVC and Ninja passed. MSBuild's CL task stalled without compiling; Ninja built the same configuration successfully. Tests ran from its fresh executable directory. ```powershell .\onnxruntime_provider_test.exe --gtest_filter=ContribOpAttentionTest.*:ContribOpAttentionValidationTest.* ``` **57 passed, 3 explicit unavailable WebGPU/cuDNN skips, zero failures; 1 existing disabled test.** Includes the main prepacking diagnostics and all three graph-independent helper cases. The initial run failed two malformed-projection tests solely because their expected diagnostics did not match the deliberately preserved main diagnostic; the corrected expectations were rebuilt and this entire selector passed. ```powershell .\onnxruntime_provider_test.exe --gtest_filter=QuantizeAttention*:*QAttention* ``` **20 passed, no skips**, verifying QAttention's shared validation. ```powershell .\onnxruntime_mlas_test.exe --gtest_filter=FGemmPackB.SizeBounds ``` **1 passed, no skips**, including exact accepted/rejected packing-size boundaries. Historical earlier-head evidence: 3 isolated no-exception/minimal validation cases and 601 packed-SGEMM cases passed. These configurations were not rebuilt for the main reconciliation above; they are not fresh-head minimal coverage. **Final-head GPU execution is now verified**, not inferred from green builds: - [Linux CUDA test job](https://github.com/microsoft/onnxruntime/actions/runs/37694054857/job/113070913707): `InvalidProjectionSizesCUDA`, `InvalidWeightsRankCUDA`, and `ProjectionSizeLimitCUDA` explicitly ran/passed; CTest **16/16 passed**. - [Native Metal WebGPU job](https://github.com/microsoft/onnxruntime/actions/runs/37694055050/job/113041537081): `InvalidProjectionSizesWebGPU` and `InvalidWeightsRankWebGPU` explicitly ran/passed; CTest **17/17 passed**. Remaining CI: three Linux minimal/no-optional build jobs and Suggest fixes are still genuinely queued without runners for more than eight hours. They have not run and are not passes; provisioning attention is requested without duplicating queued work. All other completed head checks passed. Independent approval remains required. --------- Co-authored-by: Gopalakrishnan Nallasamy <gopalakrishnan.nallasamy@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

@tianleiwu

### Description  Replaces seven `DataTypeUtils::ToType` calls in `GetCpuPreferredNodes` with an internal `constexpr` switch on the input tensor's element-type enum. The public header is unchanged. Graph-level regressions cover FP32 plus FLOAT16, BFLOAT16, four FLOAT8 formats, and FLOAT4E2M1. Refreshed on main `397657de778d05b17c0249ba37c0b4290e1ab3b5`; the already-corrected enum implementation is retained, not replaced by another string table. ### Motivation and Context  The original checks parsed `TypeProto` values and acquired the global interning mutex up to seven times per candidate input. Fixed element-type metadata needs neither string parsing nor registry access. The old pointer comparison used canonical wrapped names such as `tensor(float16)`, not bare `float16`. The earlier bare-string revision was incorrect and is replaced by tensor-type/element-type inspection, as suggested by @tianleiwu. Non-tensor types retain their previous behavior. ### Testing Fresh Windows Release CPU/DirectML build with MSVC and Ninja passed. From its executable directory: ```powershell .\onnxruntime_test_all.exe --gtest_filter=*EpConformance*:*OrtEpConformanceInvariantTest*:FallbackCpuCapabilityTest.*:InferenceSessionTests.RunWith*ReturnsError ``` **56 passed, 33 explicit unavailable-provider/contract skips, zero failures.** Both `FallbackCpuCapabilityTest` cases passed; the reduced-precision case asserts all seven element types through `GetCpuPreferredNodes`, while FP32 is a positive control. Historical evidence from the preceding enum revision: its negative-control predicate forced to `false` failed all seven reduced-precision assertions, while the FP32 control passed. That mutation was not retained or repeated for this refresh. Fresh current-head CI and human approval remain pending. The formal request-changes review concerns the earlier bare-string implementation; explicit re-review is requested rather than dismissing the review administratively. --------- Co-authored-by: Gopalakrishnan Nallasamy <gopalakrishnan.nallasamy@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

### Description  Add detail to the final release step. Other minor updates. ### Motivation and Context  Improve docs. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

### Description Adds a CMake option, `onnxruntime_DISABLE_STREAM` (default OFF), that keeps `onnxruntime_set_compile_flags` from defining `ORT_ENABLE_STREAM` in a non-minimal build. Minimal builds already compile without it, and the framework and session code it controls is guarded by `#ifdef ORT_ENABLE_STREAM`, so nothing else needs to change. Execution providers that use device streams (CUDA, TensorRT, WebGPU, ...) need stream support, so the option is meant for builds that do not use them. It does not refuse those providers at configure time, since plugin execution providers can be loaded at runtime anyway; if you would like a configure-time check for the built-in ones, or a `build.py` flag next to `--disable_rtti`, I can add either. Full training builds (`onnxruntime_ENABLE_TRAINING`) also need streams, so that combination is rejected at configure time. The stream-disabled planner path now honors the session's execution order (priority-based ordering was ignored there, in minimal builds too), covered by a new planner test. ### Motivation and Context Firefox ships ONNX Runtime as a CPU-only shared library (non-minimal, `--disable_exceptions`, `--disable_rtti`, lite protobuf) for its on-device ML features, and carries a local patch that comments out the `ORT_ENABLE_STREAM` definition. This option would replace that patch. Measured on main, Linux x86-64, MinSizeRel with LTO: compiling streams in makes the library's code about 104 KB (0.7%) larger, and our CPU inference benchmarks on Linux, Windows and macOS show no benefit from it. Most differences are within noise; the repeatable ones are small costs (a few MiB more memory in one benchmark, slightly slower short inference on Windows). A CPU-only non-minimal Release build of main with streams disabled (GCC 15.2, Linux x86-64) passes the same ctest suite as the default build, except for the eight stream-specific tests that are compiled out (multi-stream `PlannerTest` cases, `DeviceStreamCollection.TestOverride`, `StreamAwareArenaTest.TwoStreamAllocation`). `ActivationOpNoInfTest.Softsign` fails locally in both configurations. Earlier reports about this define (microsoft#16345, microsoft#20180) were closed as stale without a decision on supporting the configuration. --------- Signed-off-by: Ryan VanderMeulen <rvandermeulen@mozilla.com>

…3491) ### Description - Batch eligible input uploads for built-in and plugin WebGPU EPs, including UMA devices. - Use staging batches up to 16 MiB while preserving mapped-buffer, single-input, oversized-input, and ineligible-transfer fallbacks. - Add regression tests for data integrity, batch boundaries, repeated uploads, and plugin submission counts. ### Performance Intel Arc 140V / Vulkan, previous A/B measurement: **44.84 MB of adapter data across 784 tensors: 95.3 → 10.8 ms upload host-call time (~8.8× faster).** ### Validation - Built-in and plugin Vulkan builds passed. - All 6 built-in data-transfer tests and 62 enabled plugin tests passed. - All seven added regression tests passed; lint and whitespace checks passed.

### Description Record `ComputeContext::FillZero` as a captured buffer-clear command and replay it in order with copies and compute dispatches. Captured clears retain their target buffer and requested size without consuming profiling timestamp slots. Allocator initialization clears keep their existing behavior. The graph-capture tests live under `onnxruntime/test/providers/webgpu/plugin` and use the WebGPU plugin API. The existing plugin test glob includes them, so no CMake changes are needed. The file uses the same plugin test guard as neighboring tests. ### Motivation and Context GRU and LSTM explicitly zero their initial hidden/cell scratch buffers, then overwrite those buffers while ping-ponging through timesteps. With sequence length >= 2, omitting the clear from replay lets a subsequent invocation start from stale recurrent state. Empty-sequence output clears are also lost, which becomes observable when a bound output is dirtied between calls. The shared fix also covers existing `FillZero` calls in CausalConvWithState, PagedAttention, and PackedSparseAttentionIndexer. Their individual model-level outcomes were not separately probed. ### Validation - Initially validated the fix with the existing built-in WebGPU Windows Release build at `build/Windows/Release`; built `onnxruntime` and `onnxruntime_provider_test`. - Before the fix, reproduced seven failing regressions: missing clear capture, plus GRU/LSTM with capture enabled at sequence lengths 0, 2, and 3. All ten controls passed. - After the fix, 82 tests passed in the built-in WebGPU build with one expected platform-conditional skip. Coverage includes GRU/LSTM with capture enabled/disabled at sequence lengths 0/1/2/3, changing inputs, dirty bound outputs, graph release/recapture, clear-only buffer lifetime, partial clears between copies, and existing context/copy/profiling tests. WebGPU model tests disable CPU fallback and compare nonempty recurrent results against CPU execution. - Reused the existing shared-plugin build at `build/WindowsPlugin/Release`, regenerated CMake, and rebuilt `onnxruntime_provider_test` and its WebGPU plugin DLL dependency. All 24 tests in the moved file passed against the shared plugin, with no skips. The generated project includes the moved file exactly once with the plugin test guard enabled. - `lintrunner` on changed files and `git diff --check` passed.

Bumps [electron](https://github.com/electron/electron) from 42.11.3 to 42.11.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/electron/electron/releases">electron's releases</a>.</em></p> <blockquote> <h2>electron v42.11.9</h2> <h1>Release Notes for v42.11.9</h1> <h2>Fixes</h2> <ul> <li>Fixed <code>clipboard.read()</code>, <code>readText()</code> and <code>has()</code> resolving seconds late on Linux while the app was idle. <a href="https://redirect.github.com/electron/electron/pull/54310">#54310</a> (Also in <a href="https://redirect.github.com/electron/electron/pull/54309">43</a>, <a href="https://redirect.github.com/electron/electron/pull/54308">44</a>, <a href="https://redirect.github.com/electron/electron/pull/54307">45</a>)</li> <li>Fixed <code>fs.rmSync</code> failing to remove read-only files on Windows. <a href="https://redirect.github.com/electron/electron/pull/54257">#54257</a> (Also in <a href="https://redirect.github.com/electron/electron/pull/54256">43</a>, <a href="https://redirect.github.com/electron/electron/pull/54255">44</a>, <a href="https://redirect.github.com/electron/electron/pull/54190">45</a>)</li> <li>Fixed <code>pointerLock</code> permission requests from some iframes reporting the parent frame. <a href="https://redirect.github.com/electron/electron/pull/54466">#54466</a> (Also in <a href="https://redirect.github.com/electron/electron/pull/54465">43</a>, <a href="https://redirect.github.com/electron/electron/pull/54464">44</a>, <a href="https://redirect.github.com/electron/electron/pull/54463">45</a>)</li> <li>Fixed <code>utilityProcess</code> dropping <code>stdout</code>/<code>stderr</code> output that the child wrote immediately before exiting. <a href="https://redirect.github.com/electron/electron/pull/54332">#54332</a> (Also in <a href="https://redirect.github.com/electron/electron/pull/54279">43</a>, <a href="https://redirect.github.com/electron/electron/pull/54278">44</a>, <a href="https://redirect.github.com/electron/electron/pull/54335">45</a>)</li> <li>Fixed WebAssembly exception handlers failing to catch, or crashing during tier-up, in modules using wasm exceptions. <a href="https://redirect.github.com/electron/electron/pull/54236">#54236</a></li> <li>Fixed WebAssembly modules loaded from the code cache crashing or throwing <code>RuntimeError: unreachable</code> after updating between certain patch releases. <a href="https://redirect.github.com/electron/electron/pull/54239">#54239</a> (Also in <a href="https://redirect.github.com/electron/electron/pull/54238">43</a>, <a href="https://redirect.github.com/electron/electron/pull/54246">44</a>, <a href="https://redirect.github.com/electron/electron/pull/54237">45</a>)</li> </ul> <h2>electron v42.11.8</h2> <h1>Release Notes for v42.11.8</h1> <h2>Other Changes</h2> <ul> <li>Backported fixes from upstream ANGLE, Chromium, Dawn, PDFium and V8. <a href="https://redirect.github.com/electron/electron/pull/54223">#54223</a></li> </ul> <h2>electron v42.11.7</h2> <h1>Release Notes for v42.11.7</h1> <h2>Fixes</h2> <ul> <li>Fixed a spurious "<code>sandboxed_renderer.bundle.js</code> script failed to run" console error when DevTools attached to a sandboxed frame before its first navigation. <a href="https://redirect.github.com/electron/electron/pull/54175">#54175</a> (Also in <a href="https://redirect.github.com/electron/electron/pull/54176">43</a>)</li> <li>Fixed an "Invalid <code>guestInstanceId</code>" error when removing a loaded <code><webview></code> from the DOM. <a href="https://redirect.github.com/electron/electron/pull/54098">#54098</a> (Also in <a href="https://redirect.github.com/electron/electron/pull/54097">43</a>, <a href="https://redirect.github.com/electron/electron/pull/54099">44</a>, <a href="https://redirect.github.com/electron/electron/pull/54096">45</a>)</li> </ul> <h2>electron v42.11.6</h2> <h1>Release Notes for v42.11.6</h1> <h2>Other Changes</h2> <ul> <li>Backported fixes from upstream Chromium, Dawn, PDFium, Skia and V8. <a href="https://redirect.github.com/electron/electron/pull/54083">#54083</a></li> </ul> <h2>electron v42.11.5</h2> <h1>Release Notes for v42.11.5</h1> <h2>Other Changes</h2> <ul> <li>Backported fixes from upstream ANGLE, Chromium, Skia and V8. <a href="https://redirect.github.com/electron/electron/pull/53986">#53986</a></li> </ul> <h2>electron v42.11.4</h2> <h1>Release Notes for v42.11.4</h1> <h2>Fixes</h2> <ul> <li>Fixed a renderer crash when an iframe was removed right after loading with <code>nodeIntegrationInSubFrames</code> enabled and <code>sandbox</code> disabled, e.g. on pages that embed Meta Pixel. <a href="https://redirect.github.com/electron/electron/pull/53886">#53886</a> (Also in <a href="https://redirect.github.com/electron/electron/pull/53884">43</a>, <a href="https://redirect.github.com/electron/electron/pull/53885">44</a>, <a href="https://redirect.github.com/electron/electron/pull/53883">45</a>)</li> </ul> <h2>Other Changes</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/electron/electron/commit/d460d611a3d76010a3b0e02ca8739ed42ab591de"><code>d460d61</code></a> test: parse all custom page size PDFs in one pdf.js process (<a href="https://redirect.github.com/electron/electron/issues/54539">#54539</a>)</li> <li><a href="https://github.com/electron/electron/commit/05a599ea67c174ae24525affffa4dee85b5abd8e"><code>05a599e</code></a> test: wait for focus before requesting pointer lock in spec (<a href="https://redirect.github.com/electron/electron/issues/54531">#54531</a>)</li> <li><a href="https://github.com/electron/electron/commit/00e2f2ed68ca31fbd336061a68455f6c871b8f2a"><code>00e2f2e</code></a> test: wait for earlier Electron workers to exit before serial specs (<a href="https://redirect.github.com/electron/electron/issues/54509">#54509</a>)</li> <li><a href="https://github.com/electron/electron/commit/5bbb44efe6e5195744ccc55f86e033cd1bc57eea"><code>5bbb44e</code></a> test: fix flaky navigationHistory.restore PageState spec (<a href="https://redirect.github.com/electron/electron/issues/54478">#54478</a>)</li> <li><a href="https://github.com/electron/electron/commit/77ffb7bc21337f382fc6db03ffa1386770d8c5e5"><code>77ffb7b</code></a> test: fix chrome.tabs reload spec race with the reload commit (<a href="https://redirect.github.com/electron/electron/issues/54477">#54477</a>)</li> <li><a href="https://github.com/electron/electron/commit/1755ee598697356959219beefee1e139bc3f8207"><code>1755ee5</code></a> fix: attribute pointer lock requests from in-process iframes to the requestin...</li> <li><a href="https://github.com/electron/electron/commit/b969f462d3f0f60823f4a3a46e1a7534fbb2eaaf"><code>b969f46</code></a> build: update PGO profiles (<a href="https://redirect.github.com/electron/electron/issues/54472">#54472</a>)</li> <li><a href="https://github.com/electron/electron/commit/759b912b074eed470fbeb8d9ec4cdefd68884705"><code>759b912</code></a> ci: send child-process logging to a file on the Windows test legs (42-x-y) (#...</li> <li><a href="https://github.com/electron/electron/commit/ba665804679753e3dff9fa800f63feb36f495c2e"><code>ba66580</code></a> test: run the spec suite with vitest (42-x-y) (<a href="https://redirect.github.com/electron/electron/issues/54414">#54414</a>)</li> <li><a href="https://github.com/electron/electron/commit/840f1525b66f44701069d1a88008f6bde3e85ad2"><code>840f152</code></a> ci: minimize the runner agent's terminal window before Windows tests (<a href="https://redirect.github.com/electron/electron/issues/54367">#54367</a>)</li> <li>Additional commits viewable in <a href="https://github.com/electron/electron/compare/v42.11.3...v42.11.9">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=electron&package-manager=npm_and_yarn&previous-version=42.11.3&new-version=42.11.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/onnxruntime/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the codeql group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.38.2 to 4.39.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.39.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>v4.38.3</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"><code>6f2ac81</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4239">#4239</a> from github/update-v4.39.0-d63383a73</li> <li><a href="https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d"><code>eb1c428</code></a> Trigger workflows</li> <li><a href="https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1"><code>4443333</code></a> Update changelog for v4.39.0</li> <li><a href="https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a"><code>d63383a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4233">#4233</a> from github/mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022"><code>8dec0b9</code></a> Rename <code>path</code> to <code>result</code> in tests</li> <li><a href="https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350"><code>4eabea6</code></a> Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d"><code>57938b8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4201">#4201</a> from github/mario-campos/automate-changenotes-assemble</li> <li><a href="https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b"><code>ee07b50</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4236">#4236</a> from github/mbg/add-missing-changenotes</li> <li><a href="https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581"><code>a897ed5</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4206">#4206</a></li> <li><a href="https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82"><code>c8bd019</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4198">#4198</a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.38.2 to 4.39.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.39.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>v4.38.3</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"><code>6f2ac81</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4239">#4239</a> from github/update-v4.39.0-d63383a73</li> <li><a href="https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d"><code>eb1c428</code></a> Trigger workflows</li> <li><a href="https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1"><code>4443333</code></a> Update changelog for v4.39.0</li> <li><a href="https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a"><code>d63383a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4233">#4233</a> from github/mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022"><code>8dec0b9</code></a> Rename <code>path</code> to <code>result</code> in tests</li> <li><a href="https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350"><code>4eabea6</code></a> Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d"><code>57938b8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4201">#4201</a> from github/mario-campos/automate-changenotes-assemble</li> <li><a href="https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b"><code>ee07b50</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4236">#4236</a> from github/mbg/add-missing-changenotes</li> <li><a href="https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581"><code>a897ed5</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4206">#4206</a></li> <li><a href="https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82"><code>c8bd019</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4198">#4198</a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.38.2 to 4.39.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.39.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>v4.38.3</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"><code>6f2ac81</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4239">#4239</a> from github/update-v4.39.0-d63383a73</li> <li><a href="https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d"><code>eb1c428</code></a> Trigger workflows</li> <li><a href="https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1"><code>4443333</code></a> Update changelog for v4.39.0</li> <li><a href="https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a"><code>d63383a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4233">#4233</a> from github/mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022"><code>8dec0b9</code></a> Rename <code>path</code> to <code>result</code> in tests</li> <li><a href="https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350"><code>4eabea6</code></a> Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d"><code>57938b8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4201">#4201</a> from github/mario-campos/automate-changenotes-assemble</li> <li><a href="https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b"><code>ee07b50</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4236">#4236</a> from github/mbg/add-missing-changenotes</li> <li><a href="https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581"><code>a897ed5</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4206">#4206</a></li> <li><a href="https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82"><code>c8bd019</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4198">#4198</a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.39.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p> <blockquote> <h2>v4.39.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>v4.38.3</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"><code>6f2ac81</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4239">#4239</a> from github/update-v4.39.0-d63383a73</li> <li><a href="https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d"><code>eb1c428</code></a> Trigger workflows</li> <li><a href="https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1"><code>4443333</code></a> Update changelog for v4.39.0</li> <li><a href="https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a"><code>d63383a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4233">#4233</a> from github/mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022"><code>8dec0b9</code></a> Rename <code>path</code> to <code>result</code> in tests</li> <li><a href="https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350"><code>4eabea6</code></a> Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d"><code>57938b8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4201">#4201</a> from github/mario-campos/automate-changenotes-assemble</li> <li><a href="https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b"><code>ee07b50</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4236">#4236</a> from github/mbg/add-missing-changenotes</li> <li><a href="https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581"><code>a897ed5</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4206">#4206</a></li> <li><a href="https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82"><code>c8bd019</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4198">#4198</a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> <h2>v5.0.5</h2> <h2>What's Changed</h2> <ul> <li>Update ts-http-runtime dependency by <a href="https://github.com/yacaovsnc"><code>@yacaovsnc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1747">actions/cache#1747</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.5">https://github.com/actions/cache/compare/v5...v5.0.5</a></p> <h2>v5.0.4</h2> <h2>What's Changed</h2> <ul> <li>Add release instructions and update maintainer docs by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li> <li>Potential fix for code scanning alert no. 52: Workflow does not contain permissions by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li> <li>Fix workflow permissions and cleanup workflow names / formatting by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li> <li>docs: Update examples to use the latest version by <a href="https://github.com/XZTDean"><code>@XZTDean</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li> <li>Fix proxy integration tests by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li> <li>Fix cache key in examples.md for bun.lock by <a href="https://github.com/RyPeck"><code>@RyPeck</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li> <li>Update dependencies & patch security vulnerabilities by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/XZTDean"><code>@XZTDean</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li> <li><a href="https://github.com/RyPeck"><code>@RyPeck</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p> <h2>v5.0.3</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.3">https://github.com/actions/cache/compare/v5...v5.0.3</a></p> <h2>v.5.0.2</h2> <h1>v5.0.2</h1> <h2>What's Changed</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant "Cache save failed" warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/v5...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [markdown-it](https://github.com/markdown-it/markdown-it) from 14.3.2 to 14.3.3. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/markdown-it/markdown-it/blob/14.3.3/CHANGELOG.md">markdown-it's changelog</a>.</em></p> <blockquote> <h2>[14.3.3] - 2026-10-16</h2> <h3>Security</h3> <ul> <li>Backported 15.0.3 fixes.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/markdown-it/markdown-it/commit/d372f0d8a68bef0b0acaa68868ce8ae8ba85b384"><code>d372f0d</code></a> 14.3.3 released</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503"><code>d99f488</code></a> Backported 15.0.3 fixes</li> <li>See full diff in <a href="https://github.com/markdown-it/markdown-it/compare/14.3.2...14.3.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=markdown-it&package-manager=npm_and_yarn&previous-version=14.3.2&new-version=14.3.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/onnxruntime/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…microsoft#33034) ### Description Adds a manually queued CUDA 13 packaging pipeline that produces one wheel per platform for Windows x64, Linux x64, and Linux ARM64. Each wheel contains the CPython 3.11–3.14 extension modules and shares a single copy of the native libraries; Linux also includes the 3.13t and 3.14t ABIs. The pipeline uses dedicated stage templates, tests the same Windows wheel on every supported Python version, and installs/imports the Linux wheel on every included ABI. Outputs are nightly-versioned pipeline artifacts. Existing packaging pipeline definitions remain unchanged, and the Linux build helpers retain their per-Python behavior unless explicitly invoked with `-m`. ### Motivation and Context Building a separate wheel for every Python version duplicates the large CUDA and TensorRT libraries. This experimental pipeline allows validation of unified wheels and native-library reuse without changing the existing packaging workflows. ### Validation - All 31 packaging tests pass, including regression coverage for consecutive ABI builds and unchanged per-Python wheel collection. The regression test reproduces stale auditwheel inputs before the fix; compilation and pip are stubbed while the shell build script and wheel merger run normally. - Nine focused shell checks pass for `-a`/`-m` forwarding, CUDA architecture overrides, ARM64 parallelism, and free-threaded dependency selection. - Repository lint passes for both Python files. - YAML template references and parameters, Bash syntax, embedded PowerShell syntax, and whitespace checks pass. - Full Azure packaging builds have not been run. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

This pull request updates the Azure Pipelines configuration to explicitly set the Python version used during the package validation step. The main change is the addition of a task to ensure Python 3.12 is available in the build environment before running validation scripts. Pipeline environment update: * Added a `UsePythonVersion@0` task in `validate-package.yml` to set up Python 3.12 before running the package validation script, ensuring consistent Python environment across builds.

) ### Description  Increase the reusable macOS build-and-test job timeout from 120 to 150 minutes. This applies to the CPU, CoreML, XNNPACK, and WebGPU matrix jobs using this reusable workflow. Build and test parallelism are unchanged, and the parallelism experiment is not included. ### Motivation and Context  Hosted macOS runner throughput varies enough that the current two-hour job limit can interrupt otherwise progressing tests. In [this WebGPU Debug job](https://github.com/microsoft/onnxruntime/actions/runs/39837763852/job/120030461543?pr=33542), compilation took 55m 10s and the job was canceled during testing at approximately two hours. An additional 30 minutes provides headroom without changing the workload or runner selection. Validation: parsed the workflow with PyYAML and confirmed the timeout is 150 minutes and the only content change relative to main is the timeout value. `git diff --check` passed. CI has not yet run for this timeout-only change. This is an intermediate change. We will work on onboarding AcesShared to github as a more permenant fix. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…op (microsoft#33384) ## Description Adds `com.microsoft.HyperConnectionLowRankMix`, a CUDA contrib operator that fuses one hyper-connection block with a **low-rank gate network** (the Qwen3.8-Flash-Next block: 4 residual streams x 2560, rank 320, 96 blocks per model) into a single node: optional post-mix of the previous block, branchwise RMS norm, down projection, `ScaledSiLU`, up projection, sigmoid, pre-mix, and the post-mix inject gate. A chain of blocks needs one node per block; the unfused graph today needs 9-11 nodes (about 10 kernels) per block. ## Motivation and Context On a Qwen3.8-Flash-Next decode graph (batch 1, H200) the hyper-connection chain is ~16% of a decode cycle. In our research stack (a custom-op library, **not** part of this PR) fusing it removed 2.1 ms/token at S=1 (13.4 -> ~11 ms graph replay, bf16). This PR upstreams the part that is generic: standard row-major `[K, N]` weights used in place, no software grid barrier, no thread-block clusters, no process-wide state. The research one-kernel variant (pre-tiled weights + software grid barrier) is intentionally **not** proposed here. `HyperConnectionPreMix` / `HyperConnectionPostMix` (already in `main`) are unchanged and stay the building blocks of the unfused graph. A graph fusion that matches the unfused pattern and emits this op is a follow-up (out of scope here). ### Why one new op (and not extending PreMix/PostMix) The fused block needs the norm weight, two weight matrices with different shapes, four activation constants and two consumers of the normalized tensor. Folding that into `PreMix`/`PostMix` attributes would create a second op under their names. One op with an optional prologue (`prev_block_output`, `prev_post_gate`) gives one node per block in a chain and one place to state the rounding contract. ### Relation to microsoft#32123 microsoft#32123 (`HyperConnectionMix`, DeepSeek-V4 mHC) is a different op: a single linear gate on the flattened residual with Sinkhorn normalization and scalar-per-stream pre-mix. Qwen's block has a low-rank MLP gate (down -> SiLU -> up -> sigmoid), per-stream-per-feature pre-mix gates, no stream mixing and a per-branch weighted RMS norm, so no attribute setting of microsoft#32123 reproduces it. No code is shared; I followed its documentation and testing conventions (rounding points in the schema, torch reference test). ## Schema summary ``` HyperConnectionLowRankMix(streams, norm_scale, down_weight, up_weight, inject_weight [, prev_block_output, prev_post_gate]) -> (pre_output, post_gate [, streams_out]) ``` `T` = float / float16 / bfloat16 for every tensor. `streams` is flattened `(..., C*H)`; `down_weight` `(C*H, R)`, `up_weight` `(R, C*H)`, `inject_weight` `(C*H, C)` row-major `[K, N]`; `prev_block_output` `(..., H)`, `prev_post_gate` `(..., C)`; `pre_output` `(..., H)`, `post_gate` `(..., C)`, `streams_out` = streams after the prologue (a copy of `streams` without prologue). Attributes: `num_branches` (required), `epsilon` (1e-5), `reduction_scale` (1), `silu_alpha` (1), `gate_div` (1), `gate_mul` (1). Qwen3.8 uses `num_branches=4, epsilon=1e-6, reduction_scale=0.25, silu_alpha=0.25, gate_div=4, gate_mul=2`. ``` S = streams + prev_post_gate * prev_block_output (prologue; otherwise S = streams) hn = S / sqrt(mean_h(S^2) + epsilon) * norm_scale per branch d = ScaledSiLU(hn @ down_weight, silu_alpha) (..., R) g = sigmoid(d @ up_weight) per stream and feature pre_output = reduction_scale * sum_c(hn * g) post_gate = sigmoid((hn @ inject_weight) / gate_div) * gate_mul ``` ### Numerics contract Matrix products and reductions accumulate in fp32; the result of every step is rounded once to `T` where the equivalent standard operator would round (listed in the schema doc: `S, hn, down, Z, SG, hidden, up, g, pre_output, inject, post_gate`, as in the `ScaledSiLU` contract). The sigmoid is an accurate fp32 `expf`-based sigmoid rounded once to `T`: it does **not** reproduce the current CUDA `Sigmoid<bf16>` (round after every elementary operation; microsoft#33312 is the open fix), so on today's `main` the unfused chain and this op differ at the sigmoid sites, and after microsoft#33312 they agree up to accumulation order. Accumulation order is fixed: deterministic, and a row gives the same bits at any batch size. ## Summary of Changes | File | Change | |------|--------| | `onnxruntime/core/graph/contrib_ops/bert_defs.cc`, `ms_opset.h` | Schema + shape/type inference (next to the `HyperConnectionPreMix/PostMix` schemas) | | `onnxruntime/contrib_ops/cuda/bert/hyper_connection_low_rank_mix.{h,cc}` | Kernel class, input validation, path selection, scratch allocation via the allocator | | `onnxruntime/contrib_ops/cuda/bert/hyper_connection_low_rank_mix_impl.{h,cu}` | Fused two-kernel path and the general cuBLAS path | | `onnxruntime/contrib_ops/cuda/cuda_contrib_kernels.cc` | Registration (float, MLFloat16, BFloat16) | | `docs/ContribOperators.md`, `docs/OperatorKernels.md` | New op entries | | `onnxruntime/test/python/transformers/test_hyper_connection_low_rank_mix.py`, `onnxruntime/test/contrib_ops/hyper_connection_low_rank_mix_op_test.cc` | Tests | ### CUDA implementation * **Fused path** (rows <= 8, fp16/bf16, `hidden % 8 == 0 && <= 4096`, `rank % 8 == 0 && <= 512`, `num_branches` in {1,2,4,8}, 16-byte aligned tensors, sm_80+): two kernels. `HcDownKernel`: optional post-mix + RMS norm + down GEMV + inject GEMV; K is split in slices inside one branch and each CTA writes fp32 partial sums. `HcUpPreKernel`: fixed-order partial reduction + ScaledSiLU + up GEMV + sigmoid + pre-mix + inject gate. Weights are streamed through shared memory (`cp.async`) before the kernel waits for its producer. One or two rows share a CTA (and its weight reads), more rows use more CTAs. No atomics, clusters, cooperative launch or spin waits. * **PDL**: on sm_90+ (CUDA >= 12.3) both kernels are launched with programmatic stream serialization (`cudaLaunchKernelEx`); everything that consumes another kernel's output is after `griddepcontrol.wait`, so correctness does not depend on trigger placement. Older GPUs use plain launches (and plain copies instead of `cp.async` below sm_80 are compiled in, though the fused path is only selected on sm_80+). * **General path** (any shape, any row count, fp32): norm kernel + 3 cuBLAS GEMMs (`CUBLAS_COMPUTE_32F`) + elementwise kernels with the same rounding points. * CUDA-graph capturable: no host synchronization, scratch only through the allocator (verified by capture/replay in the tests and the benchmark). ## Testing All run for real on one H200 (`CUDA_VISIBLE_DEVICES=2`, sm_90, CUDA 13.0, Release build of this branch rebased on `main` dc89460): * `python -m pytest onnxruntime/test/python/transformers/test_hyper_connection_low_rank_mix.py`: **9 tests, 192 subtests passed.** Torch reference built from the ONNX primitives (BranchwiseRMSNorm / MatMul / ScaledSiLU / Sigmoid / PreMix / Div-Sigmoid-Mul / PostMix) in fp32 with the contract's rounding points: real shape (4 x 2560, rank 320) x {fp32, fp16, bf16} x rows {1, 2, 4, 16, 128} x {with, without prologue}; 8 small and irregular shapes (1/2/3/4/8 branches, hidden 32..4096 incl. not a multiple of 8, rank 8..512, multi-slice and multi-chunk cases); default and non-default attributes; two chained blocks; bitwise row independence; `streams_out` passthrough; zero rows; CUDA graph capture and replay (bitwise equal to eager). On the real bf16 shape the fused path is bit-identical to the reference (fp16: 99% of elements, rest 1 ulp; fp32 max abs error 4e-7). * `onnxruntime_provider_test --gtest_filter='HyperConnection*'`: 25/25 pass (10 new `HyperConnectionLowRankMixTest.*` cases: fused/unfused paths, optional output, K slices, weight chunks, fp32, error cases). * `compute-sanitizer` memcheck, racecheck, synccheck on the fused and unfused gtest cases: 0 errors / 0 hazards. * Cross-check against our research kernels (two-block real-shaped random case, bf16): **bit-identical** (all five outputs, rows 1 and 2) to the research two-kernel ops after swapping their bf16-Sigmoid emulation for the accurate sigmoid; with the original research kernels `pre` differs by exactly 1 bf16 ulp at the sigmoid sites (the contract change above). * `lintrunner -a` on the changed files: no issues. ## Benchmark 96-block chain, bf16, CUDA graph replay, 8 distinct weight sets (208 MB, larger than L2); us/block = slope between the 96- and 48-block graphs (min of 15 x 100 replays); H200. The unfused chain is the stock graph per block: PostMix, BranchwiseRMSNorm, MatMul, ScaledSiLU, MatMul, Sigmoid, PreMix, MatMul, Div, Sigmoid, Mul (11 nodes). | rows (S) | fused op | stock unfused chain | research two-kernel ops (clusters), same harness | | ---: | ---: | ---: | ---: | | 1 | **10.2 us** | 33.2 us | 10.5 us | | 2 | **12.9 us** | 36.8 us | 17.5 us | | 4 | 21.1 us | 36.3 us | | | 8 (fused limit) | 33.2 us | 37.6 us | | | 9 / 16 (general path) | 33.9 / 32.8 us | 38.7 / 37.9 us | | fp16: 10.2 / 12.7 us (S=1 / 2) vs 32.2 / 36.0 us unfused. For 96 blocks at S=1 that is 3.2 ms -> 1.0 ms of replay. For reference, our research one-kernel variant (pre-tiled weights, software grid barrier, not in this PR) measured 8.2 us/block (S=1) and 10.1 us (S=2) in the research stack with a different harness, so this two-kernel upstreamable variant is about 2 us (25%) per block slower at S=1 and ~2.8 us at S=2. In a real model the producer kernel does not trigger early, so expect +0.5..1 us per block over the chain benchmark. ## Limitations * CUDA only (no CPU / WebGPU kernel). fp32 uses the general path. Fused kernels need sm_80+; PDL needs sm_90+ (and CUDA >= 12.3 at build time). * Fused path limits: rows <= 8, hidden <= 4096, rank <= 512, branches in {1, 2, 4, 8}, 16-byte aligned tensors; everything else (including prefill) takes the general path, which is correct but about as fast as the unfused chain. * Exact agreement with the stock bf16 `Sigmoid` needs microsoft#33312. * No graph fusion transformer yet (follow-up). ## Checklist - [x] Tests added/updated - [x] No breaking changes (new op, no existing behavior touched) - [x] Documentation updated (schema doc, `docs/ContribOperators.md`, `docs/OperatorKernels.md`) --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…crosoft#29561) ### Description  Include the originating function name in the C-API catch-all diagnostic without introducing throwing string allocations: - Route the catch-all through a single out-of-line `noexcept` helper. - Format into a bounded 256-byte stack buffer and pass its known bounded length to the internal status constructor. - Share status allocation/copying with public `CreateStatus`, preserving its message cap and allocation-failure behavior. - Avoid the GCC warning caused by rescanning that buffer with the public factory's 4096-byte `strnlen` bound. - Add regression tests for function context, truncation, nonstandard exceptions, null/empty messages, and the public message limit. - Keep the no-exceptions macro path unchanged. Lambda sites may identify the function as `operator()`. ### Motivation and Context  The earlier `MakeString` implementation could terminate during diagnostic formatting inside `noexcept`. Bounded, allocation-free formatting removes that risk without expanding stream construction at every catch-all site. The GCC follow-up fixes the reported warning rather than suppressing it. ### Validation - Fresh Windows Release CPU/DirectML build and `.\onnxruntime_test_all.exe --gtest_filter="ErrorCodeTest.*"`: 5 passed after the GCC fix. - Earlier native allocator-failure harness reproduced termination in the previous allocating handler and verified the allocation-free handler survived failing C++ allocations. - Earlier no-exceptions compilation passed with warnings treated as errors. - Linux/GCC14 current-head CI is required to confirm the portability correction; no local GNU environment is available. - Full minimal/mobile binary-size comparison was not run locally; applicable CI remains required. --------- Co-authored-by: Gopalakrishnan Nallasamy <gopalakrishnan.nallasamy@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…oft#32194) ### Description  Fix MXFP4 QMoE session initialization on Ampere by applying the SM80 grouped-GEMM routing decision **before** default tactic discovery. The original failure was: ```text TMA WS grouped MoE GEMM for SM80 is not compiled, and this QMoE configuration has no SM80 fallback ``` `CutlassMoeFCRunner` previously queried tactics before QMoE could call `setUseSm80Fp4()`, so an SM80 MXFP4 runner queried the unavailable TMA family with the provisional `false` flag. Changes addressing the review: - Add a defaulted `use_sm80_fp4` constructor argument and initialize through the existing `setUseSm80Fp4()` helper, which selects both default GEMM tactics. - Pass the captured decision from both FP16 and BF16 primary MXFP4 QMoE construction sites. Standard MoE, dense fallback, and other quantization callers retain the default `false` behavior. - Remove the blanket exception catch entirely. Unsupported configurations and allocation failures propagate from initialization; there is no suppressed failure or deferred error. With no remaining `std::exception` reference, an `<exception>` include is unnecessary. - Add six session-construction regressions covering FP16/BF16 with `ORT_FP4_SM80_GEMM` unset, explicitly enabled, and disabled. Disable CPU EP fallback in these regressions. - Ensure A100 runs both the new initialization tests and the existing parity/initializer-release tests. After merging current main, preserve its expanded SM80+ eligibility, including SM120/121. - Give the shared MXFP4 test graph builder explicit standard and `com.microsoft` opset imports so the regression models also pass the ONNX checker. - Merge current main and resolve the two overlapping QMoE/test edits, retaining main's new empty-tactic initialization check and expanded architecture support. #### Validation of this revision Run from a neutral directory with the transformers helper directory on `PYTHONPATH`, using the existing isolated Python environment: ```powershell python -m pytest C:\Users\gnallasamy\Codes\onnxruntime-pr32194\onnxruntime\test\python\transformers\test_qmoe_fp4_cuda.py -q -rs -k 'TestFP4PackingUtility or TestQMoEFP4Sm80SingleWeightCopy' ``` **Result:** 4 passed, 15 skipped, 19 deselected. The skips are 14 CUDA cases (including all six new initialization cases) and one unavailable native packing binding. These skips are **not GPU validation**. ```powershell lintrunner --take CLANGFORMAT,RUFF,RUFF-FORMAT onnxruntime\contrib_ops\cuda\llm\moe_gemm\moe_kernels.h onnxruntime\contrib_ops\cuda\llm\moe_gemm\moe_kernels.cu onnxruntime\contrib_ops\cuda\moe\moe_quantization.cc onnxruntime\test\python\transformers\test_qmoe_fp4_cuda.py git diff --check ``` **Result:** both passed. Additional focused runtime checks passed: Python syntax parsing, ONNX checker validation of the actual FP16/BF16 regression graphs, acceptance of SM80/86/89/90/100/119/120/121 and exclusion of SM79 by the regime gate, and environment override/restoration for all three modes. **Still required before merge:** build the revised CUDA provider and execute the targeted tests on an SM80/A100 CUDA 12.8+ FP4-QMoE-enabled build. This Windows validation environment has an SM86 RTX A1000, CPU-only Python test packages, and no CUDA toolkit; it cannot compile or execute the revised CUDA implementation. Also confirm the new-head CI results and obtain maintainer approval. #### Historical author-reported validation The original revision was exercised on A100-80GB (SM80), using `openai/gpt-oss-20b` MXFP4 with ONNX Runtime GenAI continuous batching. The reported SM80 path initialized successfully, used 24,149 MiB peak GPU memory versus approximately 49,800 MiB for the dequant fallback, loaded in 4.56 s versus approximately 5.9 s, and had exact output parity. This empirical run predates the constructor-plumbing revision above and has **not** been repeated for it. ### Motivation and Context  The SM80 MXFP4 grouped-GEMM path is selected by default on supported GPUs, but tactic discovery during runner construction happened before that selection was applied. This made the intended Ampere path unreachable at session initialization. Passing the decision into construction fixes the ordering at its source without suppressing unrelated initialization failures in the shared MoE runner. Regression coverage now includes the affected SM80 architecture instead of skipping it. --------- Co-authored-by: Gopalakrishnan Nallasamy <gopalakrishnan.nallasamy@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

microsoft#33554) ### Description Replace the `static __device__ constexpr` variable template `kFp4RawRescale<T>` in `moe_gemv_fp4.cu` with a `__device__ __forceinline__ constexpr` function template `Fp4RawRescale<T>()`. The single use site in `AccumulateWeightVector` reads the value into a local first. The returned constants and the arithmetic are unchanged. ### Motivation and Context The Windows CUDA 13 build of `onnxruntime_providers_cuda_llm` fails in `moe_gemv_fp4.cu` with nvcc error: `A __device__ variable template cannot have a const qualified type on Windows`. The error is reported for both `T=half` and `T=__nv_bfloat16`. Windows nvcc rejects const-qualified `__device__` variable templates, so the value is now computed by a constexpr function instead. Verification: - Reproduced the diagnostic with a minimal standalone file: the old pattern fails with the same error under nvcc 13.4 + MSVC (vcvars64), and the new pattern compiles. - `clang-format==20.1.8` (the version pinned in `requirements-lintrunner.txt`) reports no formatting violations on the changed file. - Not run: a full local build of `moe_gemv_fp4.cu` in the ORT CUDA build. It needs the complete vcpkg/CUTLASS dependency tree, so the CI Windows CUDA build is the real verification for this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

## Summary - Add opt-in explicit FP32 arithmetic and packed input slicing for BranchwiseRMSNorm. - Add versioned RotaryEmbedding exact arithmetic while retaining existing default dispatch. - Keep RMS-chain regression coverage with this PR, independent of tensor fusions. ## Review follow-up - Honor deterministic CUDA sessions by using the existing fixed-order column reduction instead of the single-row floating-point atomic reduction. Default dispatch remains unchanged. The schema documents that deterministic summation may round differently from the default path or deterministic ReduceMean. - Add CUDA exact-mode branch-scale parity coverage for distinct `(C, H)` and flattened `(C * H)` scales over multiple outer rows, covering FP32, FP16, and BF16 input and scale storage. - Add a width-8192 single-row deterministic-session regression with a numerical reference, repeated bitwise comparison, and widened-output checks. - Prevent GroupQueryAttentionFusion from removing either RotaryEmbedding node when `use_fp32_arithmetic` is requested. Add a version-2 graph-transformer regression for query-only, key-only, both-exact, and ordinary fusion. - Regenerate the affected contrib and kernel documentation using the official renderers with source-derived metadata, including version-2 availability/history, optional widened outputs, type constraints, and CPU/CUDA/DML registrations. Full native `--gen_doc validate` remains a CI check. ## Clean main-based replacement Supersedes microsoft#33459. Reconstructed directly on `main` (`28225b8583474cf6a6e7f97222227ae668f80e8b`), without the old divergent feature-branch history. This PR targets `main` directly and has no dependency on another operator PR. Family documentation is bundled here; the separate old documentation PR microsoft#33465 is retired. ## Validation - Used the `qwen-flash` Conda environment. - Ran `lintrunner -a` before committing, followed by a passing check-only run on the full PR delta and `git diff --check`. - Per request, the review follow-up does **not** rebuild ORT/GenAI or execute the new native/GPU tests. Their execution and full generated-documentation validation are left to CI. - The original branch was previously checked with schema syntax checks and affected CUDA/host/test translation-unit compilation (SM90); this historical compile evidence does not validate the new review follow-up. - The previous head's React Native Android failure was an npm `ETIMEDOUT` downloading `supports-color`, not a source compilation failure. CUDA builds succeeded, but CUDA test jobs were canceled. The new push starts fresh CI; no claim that all pipelines are green. - Full main-based model/GPU requalification remains outstanding; keeping this PR in draft. - No benchmark/profiling/evaluation scripts or local task metadata are included.

…support (microsoft#33569) ## Description Adds fast CUDA execution kernels for `INT3` and mixed-width `(FC1, FC2) ∈ {2, 3, 4} × {2, 3, 4}` `com.microsoft::QMoE` projections, and extends the SM80 (`fpA_intB`) packed `INT2` and mixed `INT2`/`INT4` execution paths (`moe_gemv` decode and `RunInt2MoePrefill` grouped GEMM prefill) and single-CTA fused routing to support offline prepacked weights (`weights_prepacked = 1`), `block_size = 32` 2-scale GEMV dequantization, `num_experts <= 512`, `k = 10`, `expanded_num_rows <= 80`, and `kFusedRouteMaxRows = 8` ($S \le 8$, 7-draft DFlash2 speculative decoding). ## Summary of Changes ### Fast `INT3` & Mixed-Width `QMoE` CUDA Kernels | File | Change | |------|--------| | `onnxruntime/contrib_ops/cuda/moe/qmoe_kernels.h` | Declares `Int3Projection`, `Int3MoeParams`, `LaunchInt3Moe`, and `ValidateInt3MoeContent`. | | `onnxruntime/contrib_ops/cuda/moe/qmoe_kernels.cu` | Implements `Unpack8CenteredCodes` / `Unpack8CenteredCodes128` (aligned 32-bit `__ldg` + hardware `__funnelshift_r` 24-bit 8-element `INT3` unpacking), `FusedFc1FastKernel` (shared-memory `s_input` staging + 2-column `(gate, up)` register reuse per warp), `Fc2RouteFastKernel` (parallel-route `gridDim.y = rows * top_k` launch + shared-memory `s_act` staging + 16-lane half-warp 2-column tiling), and `FinalizeRoutesFastKernel`. | | `onnxruntime/contrib_ops/cuda/moe/moe_quantization.h` | Adds `ComputeInt3`, `has_int3_`, and per-instance `int3_content_validated_` atomic flag. | | `onnxruntime/contrib_ops/cuda/moe/moe_quantization.cc` | Enables `expert_weight_bits` and `fc{1,2,3}_expert_weight_bits` in `{2, 3, 4, 8}`, dispatches `INT3` projections to `ComputeInt3`, and caches one-time content validation while skipping host synchronization during CUDA Graph capture. | ### Offline SM80 `INT2` / Mixed `INT2`/`INT4` Prepacking (`weights_prepacked = 1`), `block_size = 32` Decode `moe_gemv`, & $S \le 8$ Routing | File | Change | |------|--------| | `onnxruntime/contrib_ops/cuda/llm/moe_gemm/moe_gemv.h` | Raises `kMaxProfiledExpandedRows` from `8` to `80` so $S \le 8, k = 10$ (`expanded_num_rows <= 80`) dispatches to `moe_gemv`. | | `onnxruntime/contrib_ops/cuda/moe/qmoe_fused_route.cuh` | Widens `kFusedRouteMaxRows` from `4` to `8` (`kFusedRouteThreads = 256`, `s_sorted[256]`) so single-CTA `FusedSoftmaxTopKMapsKernel` handles up to 8 rows ($S = 8$ DFlash2 verification). | | `onnxruntime/contrib_ops/cuda/llm/moe_gemm/moe_gemv.cu` | Adds `dequantize_and_pack_to_vec2<Details, GroupSize, TypeA>` and `scales_iterator_hi` across all 4 `moe_gemv` kernels so `Int2DetailsW` (`StepK = 64`) supports 2-scale `GroupSize == 32` dequantization alongside `GroupSize == 64` and `128`. | | `onnxruntime/contrib_ops/cuda/moe/moe_quantization.cc` | Accepts `weights_prepacked = 1` for `INT2` (`(2, 2)`) and mixed `INT2`/`INT4` (`(2, 4)`, `(4, 2)`), consuming offline SM80 `fpA_intB` weight tensors directly in-place (`packed_int_fc1`, `packed_int_fc2`) for `block_size ∈ {32, 64, 128}`, `num_experts <= 512`, and `k ∈ {1, 2, 4, 6, 8, 10}` while releasing untransposed `[E, N, K_blocks]` scales in `PrePack`. | | `docs/contrib_ops/cuda/moe_qmoe.md` | Documents `INT3` QMoE CUDA execution and offline SM80-prepacked `INT2` / mixed `INT2`/`INT4` support. | | `onnxruntime/test/contrib_ops/moe_test.cc` | Adds `QMoETest_MixedWidthCudaPackedDecodeBlock32` and `QMoETest_Int3AndMixedWidthCudaSwiGLU` unit tests. | ## Testing - Verified `QMoETest_MixedWidthCudaPackedDecodeBlock32` and `QMoETest_Int3AndMixedWidthCudaSwiGLU` across `(3, 3)`, `(3, 4)`, `(4, 3)`, `(2, 3)`, `(2, 4)`, `(4, 2)`, and `(2, 2)` with `block_size ∈ {32, 64}` and `num_rows ∈ {1, 4, 64}`. - Evaluated $S = 8$ (7-draft DFlash2) and 9 lower-precision 48-layer 512-expert `QMoE` model packages on the full 800-sample MMLU-Pro benchmark (`max_new = 8192`) on NVIDIA H200 GPUs (`361.14 tok/s` median, `411.32 tok/s` P90, `453.30 tok/s` max at $S = 8$). --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

hdharpure9922

LGTM

jiafatom and others added 22 commits October 22, 2026 22:41

Merge remote-tracking branch 'origin/master' into sync_msft_26102026

f7a4b49

ai-fw-intg requested review from Jaswanth51, ankitm3k, jatinwadhwa921 and vthaniel October 25, 2026 20:39

hdharpure9922 self-requested a review October 26, 2026 04:42

hdharpure9922 approved these changes Oct 26, 2026

View reviewed changes

hdharpure9922 merged commit fc0bb4f into ovep-develop Oct 26, 2026
7 of 10 checks passed

Navigation Menu

Repository navigation

Sync with Microsoft ONNX Runtime - 26102026 - #1365

Sync with Microsoft ONNX Runtime - 26102026#1365
hdharpure9922 merged 22 commits into
ovep-developfrom
sync_msft_26102026

ai-fw-intg commented Oct 25, 2026

Uh oh!

hdharpure9922 left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

Conversation

ai-fw-intg commented Oct 25, 2026

Uh oh!

hdharpure9922 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants