chore(deps): bump onnxruntime-web from 1.23.0-dev.20250917-21fbad8a65 to 1.27.0

[dependabot]

Bumps onnxruntime-web from 1.23.0-dev.20250917-21fbad8a65 to 1.27.0.

Release notes

Sourced from onnxruntime-web's releases.

ONNX Runtime v1.27.0

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28. n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

• CUDA 12 package files are now explicitly named as such.
• CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

---

Security Fixes

• Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#28004)
• Hardened OneHot input validation and output-size computation (#28014)
• Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#28055)
• Bounded total output allocation size in Tile kernel (#28070)
• Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#28223)
• Fixed BitShift UB for shift amounts greater than or equal to bit width (#28272)
• Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#28277)
• Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#28279)
• Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#28386)
• Fixed out-of-bounds read in CropBase scale handling (#28399)
• Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#28400)
• Added sparse tensor external file path validation and additional external-path hardening (#28408, #28709, #28725)
• Switched remaining torch.load() calls to weights_only=True (#28421)
• Added CPU cache-indirection beam-index validation (#28486)
• Added additional overflow/bounds checks and test coverage in runtime buffers (#28713, #28747)

---

New Features

Execution Provider Plugin API

• Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#28037)
• Added OrtEp::OnSessionInitializationEnd() callback (#28319)
• Added plugin EP session-options getters (#28377)
• Added CUDA Plugin EP provider options for streams and external allocators (#28603)

Core APIs & Runtime

• Added support for ONNX overloaded functions (IR v10+) (#28275)
• Added FLOAT8E8M0 datatype support in ONNX Runtime (#28381)
• Added CPU Cast support for FLOAT8E8M0 (#28435)
• Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#28282)

Quantization & Training Tooling

• Added calibration cache support to quantize_static (#28221)

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by erscor_msft, a new releaser for onnxruntime-web since your current version.

[Copilot]

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

[github-actions]

pkg.pr.new

packages
Ready to be installed by your favorite package manager ⬇️

https://pkg.pr.new/software-mansion/TypeGPU/eslint-plugin-typegpu@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/tgpu-gen@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/tinyest-for-wgsl@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/typegpu@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/cli@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/color@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/gl@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/noise@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/radiance-cascades@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/react@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/sdf@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/@typegpu/three@41942d4f7e46cb1eece2846b30766b8152f6b500

https://pkg.pr.new/software-mansion/TypeGPU/unplugin-typegpu@41942d4f7e46cb1eece2846b30766b8152f6b500

benchmark
view benchmark

commit
view commit

[github-actions]

Bundle size comparison (import * as ... in PR vs import * as ... in target):

🟢 Decreased	➖ Unchanged	🔴 Increased	❔ Unknown
0	324	0	0

import { ... } in PR vs import * as ... in PR (is the library tree-Shakeable?):

Test	tsdown
tgpu_init.ts	270.69 kB ($${\color{green}-3.3\%}$$)
tgpu_initFromDevice.ts	270.15 kB ($${\color{green}-3.5\%}$$)
tgpu_resolve.ts	170.93 kB ($${\color{green}-38.9\%}$$)
tgpu_resolveWithContext.ts	170.87 kB ($${\color{green}-39.0\%}$$)
tgpu_bindGroupLayout.ts	73.93 kB ($${\color{green}-73.6\%}$$)
tgpu_mutableAccessor.ts	68.66 kB ($${\color{green}-75.5\%}$$)
tgpu_accessor.ts	68.66 kB ($${\color{green}-75.5\%}$$)
tgpu_privateVar.ts	67.35 kB ($${\color{green}-75.9\%}$$)
tgpu_workgroupVar.ts	67.35 kB ($${\color{green}-75.9\%}$$)
tgpu_const.ts	66.77 kB ($${\color{green}-76.1\%}$$)
tgpu_lazy.ts	66.56 kB ($${\color{green}-76.2\%}$$)
tgpu_fragmentFn.ts	38.92 kB ($${\color{green}-86.1\%}$$)
tgpu_fn.ts	38.87 kB ($${\color{green}-86.1\%}$$)
tgpu_vertexFn.ts	38.74 kB ($${\color{green}-86.2\%}$$)
tgpu_computeFn.ts	38.44 kB ($${\color{green}-86.3\%}$$)
tgpu_vertexLayout.ts	27.57 kB ($${\color{green}-90.2\%}$$)
tgpu_comptime.ts	15.18 kB ($${\color{green}-94.6\%}$$)
tgpu_unroll.ts	1.75 kB ($${\color{green}-99.4\%}$$)
tgpu_slot.ts	1.70 kB ($${\color{green}-99.4\%}$$)

If you wish to run a comparison for other, slower bundlers, run the 'Tree-shake test' from the GitHub Actions menu.

[github-actions]

Resolution Time Benchmark

---
config:
  themeVariables:
    xyChart:
      plotColorPalette: "#E63946, #3B82F6, #059669"
---
xychart
  title "Random Branching (🔴 PR | 🔵 main | 🟢 release)"
  x-axis "max depth" [1, 2, 3, 4, 5, 6, 7, 8]
  y-axis "time (ms)"
  line [0.68, 1.28, 2.72, 4.49, 5.43, 8.45, 15.73, 18.23]
  line [0.69, 1.40, 3.04, 4.53, 5.20, 7.97, 16.64, 17.14]
  line [0.69, 1.45, 3.24, 4.39, 5.52, 7.64, 15.84, 18.35]

Loading

---
config:
  themeVariables:
    xyChart:
      plotColorPalette: "#E63946, #3B82F6, #059669"
---
xychart
  title "Linear Recursion (🔴 PR | 🔵 main | 🟢 release)"
  x-axis "max depth" [1, 2, 3, 4, 5, 6, 7, 8]
  y-axis "time (ms)"
  line [0.21, 0.37, 0.50, 0.56, 0.78, 0.82, 0.98, 1.09]
  line [0.21, 0.38, 0.50, 0.62, 0.80, 0.87, 1.06, 1.17]
  line [0.27, 0.41, 0.53, 0.65, 0.85, 0.88, 0.98, 1.11]

Loading

---
config:
  themeVariables:
    xyChart:
      plotColorPalette: "#E63946, #3B82F6, #059669"
---
xychart
  title "Full Tree (🔴 PR | 🔵 main | 🟢 release)"
  x-axis "max depth" [1, 2, 3, 4, 5, 6, 7, 8]
  y-axis "time (ms)"
  line [0.57, 1.44, 2.97, 4.64, 8.11, 17.39, 38.35, 77.67]
  line [0.58, 1.64, 2.69, 4.75, 8.71, 18.83, 39.28, 80.55]
  line [0.71, 1.53, 3.20, 4.65, 9.38, 19.13, 39.49, 80.17]

Loading

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.