Sync with Microsoft ONNX Runtime - 30072026 - #1235
Merged
Merged
Conversation
…icrosoft#29926) ## Description Updates vulnerable dev/test npm dependencies in the `nextjs-default` export e2e fixture lockfile. Follow-up to microsoft#29827, which covered the other five lockfiles but not this one. ## Updates - `next` `15.5.18` -> `15.5.22` - `postcss` `8.5.14` -> `8.5.24` - `nanoid` `3.3.12` -> `3.3.16` Modified lockfile: - `js/web/test/e2e/exports/testcases/nextjs-default/package-lock.json` `next` 15.5.18 predates the `15.5.21` security release co-published with `16.2.11`, so the fixture still resolved to a version affected by the CVE-2026-64641..64649 advisory batch. `postcss` 8.5.14 is likewise inside the affected range (`<= 8.5.17`) for CVE-2026-45623. Note the fixture intentionally tracks the `15.x` line (`next: ^15.0.0` in package.json, per microsoft#28547), so `15.5.22` — not `16.2.11` — is the correct target. No package manifests or runtime source files are changed. The resolved dependency set is unchanged (identical package keys before/after); the diff is purely `version`/`resolved`/`integrity`. ## Validation - Regenerated with `npm audit fix --package-lock-only` against `registry.npmjs.org`; verified zero `resolved` URLs point anywhere else. - `npm audit --package-lock-only` no longer reports `next` or `postcss` advisories; the diff is a balanced 46 insertions / 46 deletions. - Confirmed package key sets are identical pre/post, so no dependency was added or dropped. - Preserved `libc` metadata that npm >= 11.6 drops when rewriting lockfiles (the packages still declare it), keeping musl/glibc optional-dep selection intact for the `@next/swc-linux-*` binaries.
### Description Adds uint8 data type support to the Reshape operator in the WebGPU execution provider. The op is used by [detr-resnet-50](https://huggingface.co/Xenova/detr-resnet-50/blob/main/onnx/model.onnx) and other models that reshape uint8 tensors. ### Motivation and Context Adds uint8 to the WebGPU `Reshape` type constraint so uint8 Reshape nodes stop falling back to the CPU EP. Reshape is a pure copy/view op (it aliases the input buffer, or does a raw byte copy when not in-place) and never interprets element values in a shader, so uint8 is enabled unconditionally in both the versioned and latest-opset kernel factories -- no shader changes are needed. This PR also adds a WebGPU uint8 Reshape test. It runs on a WebGPU-only session with CPU-EP fallback disabled (kOrtSessionOptionsDisableCPUEPFallback), so the node must be placed on the WebGPU kernel.
uint8 is a 1-byte-per-element type that cannot be stored directly in a WebGPU storage buffer, so it is packed 4-per-u32 just like bool. Extend the existing bool-only packed path to also handle uint8: route it through the same flatten/4-component/broadcast-indices setup, and generalize the shader so the three broadcast branches (whole-word copy, splat, and per-element pack) differ only in how a single element is extracted from and assembled into the packed word. bool keeps using vec4<bool>; uint8 uses byte shift/mask extraction and reassembly. Add uint8 to the Expand kernel type constraints and cover all three shader branches with tests. This is to fix part of microsoft#29756
### Description Implements the `DFT` operator (opset 17–20) for the WebGPU (JSEP) execution provider: a batched shared-memory mixed-radix (2/3/4/5) Stockham FFT, with an O(N^2) direct-DFT fallback for non-5-smooth lengths. Handles real/complex input, forward/inverse (1/N-normalized), one-sided RFFT and one-sided-inverse IRFFT, and the opset-20 `dft_length`/`axis` tensor inputs — matching the semantics of the CPU kernel in `core/providers/cpu/signal/dft.cc`. ### Motivation and Context The WebGPU EP had no DFT/FFT kernel, so spectral and audio-preprocessing models fall back to a slow path (microsoft#20997). This adds it to the JSEP EP. The op test suite was extended to cover the WebGPU backend; I also verified the kernel against ORT's CPU DFT on real WebGPU across the forward, inverse, RFFT, and IRFFT paths. As with other `onnxruntime-web` op PRs, CI is the source of truth for the full web build. Closes microsoft#20997 --------- Co-authored-by: Nicholas Celestin <nitroviper@Nicholass-Air.lan> Co-authored-by: Nicholas Celestin <nitroviper@Nicholass-MacBook-Air.local>
…el (Phase 1) (microsoft#29715) ### Description Adds a cuDNN SDPA tier to the ONNX `Attention` (opset 23/24) CUDA kernel, making the effective dispatch cascade **cuDNN → Flash → MEA → Unfused**. The tier is narrowly gated to the opset-24 external-KV-cache single-token decode path (its actual value proposition) and takes the valid KV length as a device `int*`, so it stays CUDA-graph-capturable — unlike the host-readback approach that sank microsoft#29689. This is a **draft** landing Phase 1 only; correctness-sensitive follow-ups are gated out and flagged inline. - **Cascade (`attention.cc` `ComputeInternal`)** — new cuDNN eligibility block before the Flash block. Hard gate (all required): `nonpad_kv_seqlen != nullptr`, `past_key == nullptr`, `is_causal`, `q_sequence_length == 1`, no `attn_mask`/`output_qk`/`softcap`, fp16/bf16, `cudnn_sdpa::is_supported`. Not built-guarded (relies on the wrapper's `CUDNN_MAJOR` stubs + `is_stable()`). - **`RunCudnnSdpaAttention`** — honors existing ONNX-Attention semantics: rank-branched `qkv_format` (`Q_K_V_BSNH` for 3-D, mixed `Q_K_V_BSNH_BNSH_BNSH` for 4-D with Q transposed BNSH→BSNH), BSNH output scratch → transpose to BNSH, device int32 seqlens via the existing `LaunchConvertNonpadKvSeqlenToFlashSeqlensK`, `sequence_length_kv = total_sequence_length` (capacity) + per-batch mask, `mask_sequence_lengths_q = nullptr`, separate `present_key`/`present_value` population. - **Fully-masked-batch guard** — `LaunchZeroOutputForFullyMaskedBatches` after `run()`. cuDNN emits NaN for a `nonpad==0` row where every other tier defines `0`; this is a spec-equivalence requirement, not defense-in-depth (can't be a host-side gate without a D2H sync). - **Option plumbing** — reuses the shared `UseCudnnFlashAttention()` / `AllowCudnnFlashAttentionAuto()` (no new option key); adds `enable_/auto_enable_cudnn_flash_attention_` members mirroring GQA. - **Debug-info wiring** — adds the `AttentionKernelDebugInfo` dispatch block the op previously lacked, recording which tier ran. - **Tests** — cuDNN decode parity test forcing cuDNN via `sdpa_kernel`, covering MHA/MQA/GQA, fully-masked and heterogeneous `nonpad`; falls back to unfused (still parity-correct) where cuDNN is unavailable. **Deferred / needs validation (inline TODOs):** Phase 2 (internal `past_key`/`past_value`) and Phase 3 (prefill `s_q>1`) are gated out. Cold cuDNN plan-cache miss under graph capture relies on the warmup-before-capture invariant (documented in the function header); wrapper-API enhancement + a C++ cold-cache capture test are follow-ups. CUDA was not buildable in this environment — compilation and GPU tests need validation on cuDNN 9.3+/SM≥90. ### Motivation and Context The standard ONNX `Attention` CUDA kernel has no decode-specialized tier, capping decode latency at the Flash floor (~13 µs) versus GQA's cuDNN/XQA tiers (~10 µs). Fixing Flash split-sizing (microsoft#29686, wontfix) can't close this structural gap. cuDNN SDPA is the widest-eligibility, already-linked option and reads valid length device-side, so it reaches GQA-class decode latency without breaking CUDA-graph capture. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f38b9775-a6b6-4422-8f42-9e48e626a358 Copilot-Session: 1d32dce6-edfc-4d15-9d94-0bc65713f01d Copilot-Session: a1011908-d09e-411a-8979-fcf0dc18e20e
ai-fw-intg
requested review from
Jaswanth51,
ankitm3k,
jatinwadhwa921 and
vthaniel
July 29, 2026 20:35
hdharpure9922
self-requested a review
July 30, 2026 05:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated daily backmerge from ORT main to ovep-develop. No conflicts detected. Do NOT squash or rebase - use merge commit only.