build: bump the python-minor group with 2 updates

[dependabot]

Bumps the python-minor group with 2 updates: openadapt-types and onnxruntime.

Updates openadapt-types from 0.17.0 to 0.18.0

Release notes

Sourced from openadapt-types's releases.

v0.18.0 (2026-09-03)

Bug Fixes

• reward: Refuse the certificate claims this version cannot check (#40, b7b40f3)

A reward certificate was trusted on its shape. Four properties it asserted were never checked anywhere:

• calibration_scope: production. The validator refused only the pair self_signed + production, so issuer="organization" bought a receipt reading certified: true, calibration_scope: production, production_certified: true with no worker, no oracle, and no read.

• issuer: organization. There is no issuer key registry, so nothing can resolve issuer_key_id to a key anyone trusts. * The contract's own certificate_policy. RewardCertificateV1.satisfies had exactly one caller, a test. A certificate measured at epsilon 0.248885 against a contract demanding 0.05 still produced certified. * Revocation. grep -i revok over the reward code in types, evals, and flow returns nothing, and the certificate docstring described revocation as an existing mechanism checked by the issuer.

The narrowing:

• RewardCalibrationScopeV1 keeps SYNTHETIC only, and RewardCertificateIssuerV1 keeps SELF_SIGNED only. Both stay enums, so adding a member back once a registry exists is not a breaking change. * RewardEvidenceReceiptV1.production_certified is gone. With one scope it could only ever return False, and its name promised a distinction the type cannot draw. * score() takes the contract as a required keyword and drops scoring. It reads the scalar from contract.scoring and certifies only a certificate that names this contract by digest and clears contract.certificate_policy. RewardScoreV1 gains certification_refusals, so a false certified says why. * RewardCertificateV1.unmet(policy) lists each shortfall; satisfies is now not unmet(...) and is live code on the certification path. * RewardEvidenceReceiptV1.certification_refusals(contract, certificate) lets a reader who holds both recheck a receipt's flag. The receipt carries digests, so it cannot check itself during validation. * The docstrings drop the revocation sentence and say plainly that signature is checked for encoding and length only.

Breaking for score() callers and for anything that reads production_certified or constructs a production-scope certificate. Nothing outside tests constructs one today.

Co-authored-by: Claude Opus 5 noreply@anthropic.com

---

Detailed Changes: v0.17.1...v0.18.0

v0.17.1 (2026-09-03)

Bug Fixes

• types: Close production admission and authoring contracts (#39, f8a1ca1)

---

Detailed Changes: v0.17.0...v0.17.1

Changelog

Sourced from openadapt-types's changelog.

v0.18.0 (2026-09-03)

Bug Fixes

• reward: Refuse the certificate claims this version cannot check (#40, b7b40f3)

A reward certificate was trusted on its shape. Four properties it asserted were never checked anywhere:

• calibration_scope: production. The validator refused only the pair self_signed + production, so issuer="organization" bought a receipt reading certified: true, calibration_scope: production, production_certified: true with no worker, no oracle, and no read.

• issuer: organization. There is no issuer key registry, so nothing can resolve issuer_key_id to a key anyone trusts. * The contract's own certificate_policy. RewardCertificateV1.satisfies had exactly one caller, a test. A certificate measured at epsilon 0.248885 against a contract demanding 0.05 still produced certified. * Revocation. grep -i revok over the reward code in types, evals, and flow returns nothing, and the certificate docstring described revocation as an existing mechanism checked by the issuer.

The narrowing:

• RewardCalibrationScopeV1 keeps SYNTHETIC only, and RewardCertificateIssuerV1 keeps SELF_SIGNED only. Both stay enums, so adding a member back once a registry exists is not a breaking change. * RewardEvidenceReceiptV1.production_certified is gone. With one scope it could only ever return False, and its name promised a distinction the type cannot draw. * score() takes the contract as a required keyword and drops scoring. It reads the scalar from contract.scoring and certifies only a certificate that names this contract by digest and clears contract.certificate_policy. RewardScoreV1 gains certification_refusals, so a false certified says why. * RewardCertificateV1.unmet(policy) lists each shortfall; satisfies is now not unmet(...) and is live code on the certification path. * RewardEvidenceReceiptV1.certification_refusals(contract, certificate) lets a reader who holds both recheck a receipt's flag. The receipt carries digests, so it cannot check itself during validation. * The docstrings drop the revocation sentence and say plainly that signature is checked for encoding and length only.

Breaking for score() callers and for anything that reads production_certified or constructs a production-scope certificate. Nothing outside tests constructs one today.

Co-authored-by: Claude Opus 5 noreply@anthropic.com

v0.17.1 (2026-09-03)

Bug Fixes

• types: Close production admission and authoring contracts (#39,

... (truncated)

Commits

• 07b8b0c chore: release 0.18.0
• b7b40f3 fix(reward)!: refuse the certificate claims this version cannot check (#40)
• cf6d860 chore: release 0.17.1
• f8a1ca1 fix(types): close production admission and authoring contracts (#39)
• See full diff in compare view

Updates onnxruntime from 1.20.1 to 1.29.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

• onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
• POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
• The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

• Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
• Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
• Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
• Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
• Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

• Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

• Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
• Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
• Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
• Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

• WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
• Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
• Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

• Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
• Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
• Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
• Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
• Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

... (truncated)

Commits

• 2e2543f [CUDA] Update cuda archs in packaging pipelines (#31992)
• 9b174a4 [CUDA] Add GatedAdd contrib operator (#31835)
• a29da16 Validate SkipLayerNorm prepacked lengths (#31676)
• 831fa2f Validate whisper beginning_timestamp_token_id bounds (#31636)
• 3cee186 Handle RNN activation parameters safely (#31675)
• 37d79e3 Harden CUDA fp16 transpose index math against int overflow (#31644)
• 45bdd4c Validate QLinearConv bias size against output channels (#31684)
• f5de4c3 Fix TfIdfVectorizer weight indexing semantics (#31649)
• d3abafc Validate FeatureVectorizer batch sizes (#31671)
• 1441b36 [WebGPU] Add MRotaryEmbedding support (#31976)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions