Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 3 updates#86

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/production-dependencies-eb3ba74dc1
Closed

chore(deps): bump the production-dependencies group across 1 directory with 3 updates#86
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/production-dependencies-eb3ba74dc1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Dec 1, 2025

Bumps the production-dependencies group with 3 updates in the / directory: @modelcontextprotocol/sdk, @sap/cds and onnxruntime-web.

Updates @modelcontextprotocol/sdk from 1.20.2 to 1.29.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.29.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.28.0...v1.29.0

v1.28.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

v1.27.1

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by pcarleton, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates @sap/cds from 9.4.4 to 9.9.0

Updates onnxruntime-web from 1.23.0 to 1.24.3

Release notes

Sourced from onnxruntime-web's releases.

ONNX Runtime v1.24.3

This is a patch release for ONNX Runtime 1.24, containing bug fixes, security improvements, performance enhancements, and execution provider updates.

Security Fixes

  • Core: Fixed GatherCopyData integer truncation leading to heap out-of-bounds read/write. (#27444)
  • Core: Fixed RoiAlign heap out-of-bounds read via unchecked batch_indices. (#27543)
  • Core: Prevent heap OOB from maliciously crafted Lora Adapters. (#27518)
  • Core: Fixed out-of-bounds access for Resize operation. (#27419)

Bug Fixes

  • Core: Fixed GatherND division by zero when batch dimensions mismatch. (#27090)
  • Core: Fixed validation for external data paths for models loaded from bytes. (#27430)
  • Core: Fixed SkipLayerNorm fusion incorrectly applied when gamma/beta are not 1D. (#27459)
  • Core: Fixed double-free in TRT EP custom op domain Release functions. (#27471)
  • Core: Fixed QMoE CPU Operator. (#27360)
  • Core: Fixed MatmulNBits prepacking scales. (#27412)
  • Python: Fixed refcount bug in map input conversion that caused shutdown segfault. (#27413)
  • NuGet: Fixed DllImportResolver. (#27397)
  • NuGet: Added OrtEnv.DisableDllImportResolver to prevent fatal error on resolver conflict. (#27535)

Performance Improvements

  • Core: QMoE CPU performance update (up to 4x on 4-bit). (#27364)
  • Core: Fixed O(n²) model load time for TreeEnsemble with categorical feature chains. (#27391)

Execution Provider Updates

  • NvTensorRtRtx EP:
    • Avoid repetitive creation of fp4/fp8 native-custom-op domains. (#27192)
    • Added missing override specifiers to suppress warnings. (#27288)
    • DQ→MatMulNBits fusion transformer. (#27466)
  • WebGPU:
    • Used embedded WASM module in Blob URL workers when wasmBinary is provided. (#27318)
    • Fixed usage of wasmBinary together with a blob URL for .mjs. (#27411)
    • Removed the unhelpful "Unknown CPU vendor" warning. (#27399)
    • Allows new memory info name for WebGPU. (#27475)
  • MLAS:
    • Added DynamicQGemm function pointers and ukernel interface. (#27403)
    • Fixed error where bytes is not assigned for dynamic qgemm pack b size. (#27421)
  • VitisAI EP: Removed s_kernel_registry_vitisaiep.reset() in deinitialize_vitisai_ep(). (#27295)
  • Plugin EPs: Added "library_path" metadata entry to OrtEpDevice instances for plugin and provider bridge EPs. (#27522)

Build and Infrastructure

  • Pipelines:
    • Build Windows ARM64X binaries as part of packaging pipeline. (#27316)
    • Moved JAR testing pipelines to canonical pipeline template. (#27480)
  • Python: Enabled Python 3.14 CI and upgraded dependencies. (#27401)
  • Build: Suppressed spurious Array Out of Bounds warnings produced by GCC 14.2 compiler on Linux builds. (#27454)
  • Build: Fixed -Warray-bounds build error in MLAS on clang 17+. (#27499)
  • Telemetry: Added/Updated telemetry events. (#27356)
  • Config: Increased kMaxValueLength to 8192. (#27521)

... (truncated)

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 1, 2025
@sjvans
Copy link
Copy Markdown
Contributor

sjvans commented Apr 27, 2026

@dependabot rebase

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 27, 2026

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@sjvans
Copy link
Copy Markdown
Contributor

sjvans commented Apr 27, 2026

@dependabot recreate

…y with 3 updates

Bumps the production-dependencies group with 3 updates in the / directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk), [@sap/cds](https://cap.cloud.sap/) and [onnxruntime-web](https://github.com/Microsoft/onnxruntime).


Updates `@modelcontextprotocol/sdk` from 1.20.2 to 1.29.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.20.2...v1.29.0)

Updates `@sap/cds` from 9.4.4 to 9.9.0

Updates `onnxruntime-web` from 1.23.0 to 1.24.3
- [Release notes](https://github.com/Microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseManagement.md)
- [Commits](microsoft/onnxruntime@v1.23.0...v1.24.3)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sap/cds"
  dependency-version: 9.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: onnxruntime-web
  dependency-version: 1.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-eb3ba74dc1 branch from 82723bb to 0ebdb2f Compare April 27, 2026 07:13
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 27, 2026

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 27, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-eb3ba74dc1 branch April 27, 2026 20:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant