v4.2.0

Compare Source

[4.2.0] - 2026-07-14

VOD / Random Access

• Added TUNE-VMAF mode targeting ~15% VMAF BD-rate improvement at minimal PSNR loss
• Implemented single-thread processing mode with RA handling
• RA preset tuning and bitrate optimization for M3-M5
• New CLI options: --cqp, --enable-intrabc, --hbd-mds, --enable-kf-tf
• Added raw OBU output format as an alternative to IVF
• Signal initial_display_delay in sequence header to fix A/V sync on seek

RTC / Low Delay

• Added CBR rate control with Kalman-filter QP estimation, cyclic refresh, and frame re-encode
• Added on-the-fly MG size, preset, bitrate, and frame rate changes
• Added reference frame management API with LTR support and two-layer RPS structure
• Exposed --max-intra-bitrate-pct and --max-inter-bitrate-pct parameters
• Improved compression efficiency vs. cycle tradeoff across RTC presets
• Optimized memory footprint for RTC mode with small resolutions
• Further speed and quality tuning for RTC

Encoder (general)

• Refactored entropy coding: direct tile-buffer writes, arithmetic coder simplifications, coefficient shaving
• CDEF optimizations: 8-bit boundary-aware filter, persistent scratch buffers, luma/chroma specialization
• MD and ME optimizations (LPD1 early-skip, VLPD0 fast path, static-block ME bypass)
• Optimized still-image screen content detection
• Optimized TPL dispatch when TPL is disabled
• Added ENABLE_STACK_PROTECTOR CMake option to prevent the stack protector flag from being added

Arm

• Added lowbd (8-bit) int16 forward transform NEON kernels (4x4 through 32x32)
• Added Neon SAD, quantize-matrix, SSIM, VMAF, variance, and pixel projection error kernels
• Added SVE2 VMAF kernels and hardware CRC-32C for hash-based ME
• Optimized convolution, full distortion, and SAD calculation functions

Bug fixes and documentation

• Fixed superres recode crash, RESIZE_DYNAMIC under --rtc, RTC candidate-count overflow, recon output, and memory leak
• Fixed signed left-shift UB, OOB reads, and race conditions in rate control
• Added NVTX/Nsight Systems profiling hooks, PPC toolchain, and macOS universal binary support
• Addressed cppcheck warnings and rewrote affected unit tests
• Addressed USAN and MSAN warnings
• Reduced OBMC stack usage to fix a crash with PGO
• General code cleanup, documentation updates, and test improvements

v2.38.2: IGC v2.38.2

Compare Source

Fixed Issues / Improvements

List of all changes: intel/intel-graphics-compiler@v2.36.3...v2.38.2

Dependencies revisions

Supported platforms

• DG1
• Alchemist (DG2)
• Battlemage
• Tiger Lake
• Rocket Lake
• Alder Lake
• Meteor Lake
• Raptor Lake
• Lunar Lake
• Arrow Lake
• Panther Lake
• Wildcat Lake
• Crescent Island
• Nova Lake

The release is based on build 22051.
Ubuntu 24.04 binary packages for LLVM17/Clang17 are included.

Packages' sha256 checksums:

3dbcbe4e716d62e9bd43a4a476d724cf772b4581dbcdd096d70df382e7ccad7e  intel-igc-core-2_2.38.2+22051_amd64.deb
9f5baaaaa9125fe24c2a08f04e8db5f84287df81932d01cf460a48e3c668fe2a  intel-igc-core-devel_2.38.2+22051_amd64.deb
e265d191590efd5491bfbbd148c144fdd40aea51e0b57f8651130d2da20b8186  intel-igc-opencl-2_2.38.2+22051_amd64.deb
4996231446be5af4cd0f875d6dc4a13d61c0ca80b1a5c388056d19c79ea7c490  intel-igc-opencl-devel_2.38.2+22051_amd64.deb

v1.28.0: ONNX Runtime v1.28.0

Compare Source

Announcements & Breaking Changes

• Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
• cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
• An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
• Deprecated / removed:
  • SkipLayerNorm strict mode is deprecated (#​29388).
  • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
  • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
  • CUDA_QUANT_PREPROCESS is off by default (#​29687).
• NPM packages are now published from the CUDA 13 pipeline (#​28773).
• The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation

• Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
• Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
• Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
• Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
• Validated Col2Im inputs to prevent heap over-read (#​28706)
• Hardened CropAndResize against malformed crop_size tensors (#​28766)
• Validated BeamSearch vocab_size against logits width (#​28774)
• Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
• Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
• Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
• Clamped 1D attention mask_index to valid bounds (#​29449)
• Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
• Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
• Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
• Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
• Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
• Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
• Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
• Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
• Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)

Integer overflow & allocation size

• Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
• Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
• Hardened QMoE against integer overflow and partial K tiles (#​29067)
• Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
• Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
• Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
• Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)

Supply chain & tooling

• Updated protobuf to mitigate CVE-2026-0994 and bumped ONNX/protobuf to fix additional CVEs (#​28967, #​29606)
• Avoided shell injection in the training helper and switched Triton compile helpers to subprocess (#​28776, #​28775)
• Validated archive extraction paths in the transformers tooling (#​28777)
• Validated and inlined external data in node tensor attributes during session initialization (#​29250)
• Enabled Spectre-mitigated MSVC libraries for BinSkim builds (#​29624)
• Bumped npm dependencies: shell-quote, esbuild, tmp, ws, protobufjs, js-yaml, tar, markdown-it, @babel/core (#​29022, #​29044, #​29055, #​29057, #​29061, #​29062, #​29063, #​29079, #​29090, #​29156)

New Features

Execution Provider ABI & Plugin EPs

• Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#​28271, #​28989, #​29501)
• Added an API to select the best compiled-model compatibility info from candidate strings (#​28387)
• Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#​28624)
• Implemented name-based partitioning with accompanying documentation (#​28903)
• Added Linux NPU discovery through sysfs accel devices (#​28703)
• Relaxed CompileModel validation to accept zero-input OrtModel graphs (#​28771)
• CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#​29221, #​29244, #​28896, #​28789)
• WebGPU plugin EP version bumped to 0.3.0 (#​29056)

Core APIs & Runtime

• Added OrtErrorCode documentation, single-sourced the values so StatusCode stays in sync, and added OrtErrorCode::ORT_DEVICE_RESET (#​29018, #​29065, #​29748)
• Added memory statistics to profiling output (#​29058)
• Added EP version logging on inference failure, in the EpDeviceUsage event, and ORT version logging (#​28794)
• User-supplied external initializers are now used in place when already on the planned device (#​29013)
• model_external_initializers_file_folder_path is now honored for file-path model loads (#​29459)
• Added a Python API for HOST_ACCESSIBLE OrtValue allocation (#​28038)

Quantization Tooling

• Added CudaQuantizer to onnxruntime.quantization (#​29509)
• Registered Flatten as a Direct8Bit op in the Python QDQ static quantizer (#​28340)
• Skipped MaxPool during FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#​28488, #​29350)
• Added Float16/BFloat16/Float8 support in the TensorArray custom op (#​28335)
• Clarified CPU parameter recommendations in the quantization docs (#​28415)

Execution Provider Updates

NVIDIA CUDA EP

Attention & LLM decode

• Enabled XQA by default for FP16/BF16 GroupQueryAttention, and extended XQA decode with attention sink, sliding window, and QK-Norm support (#​29046, #​29162, #​29177, #​29186)
• Upgraded cudnn_frontend to 1.24 and enabled cuDNN SDPA for MHA/GQA (#​28849)
• Added decode-optimized LinearAttention (GatedDeltaNet) kernels (#​28985)
• Optimized FlashDecode split planning for local-window GQA and fixed Flash/Lean attention split heuristics (#​29161, #​29554)
• Updated the GroupQueryAttention contrib op documentation (#​29173)

MoE & quantized GEMM

• Prepacked int4/int8 QMoE expert weights in the PrePack hook, symmetric with MatMulNBits, and fixed the prepack to always use the SM80 layout (#​28749, #​28978, #​28965)
• Optimized the QMoE SoftmaxTopK router for small-batch decode, added a Split-K2 SwiGLU GEMV kernel, defaulted to fp16 accumulation for fp16 activations, and fused the MoE router bias into the MatMulNBits GEMV (#​28980, #​29167, #​29166, #​29170)
• Added a batched small-M GEMV path for 4-bit/8-bit MatMulNBits (#​29451)
• Enabled fpA_intB GEMM in CUDA builds with configurable options, added prepacked fpA_intB weight support, and enabled native SM90, block_size=32, and fused bias (#​29622, #​29499, #​29585)
• Fixed a QMoE profiler cross-stream race and made it CUDA-graph-capture safe (#​29584)

Coverage, dependencies & fixes

• Added cuDNN-free ArgMax/ArgMin/ReduceSum and fixed LogSoftmax on the plugin EP (#​29620)
• Filled the CUDA opset gap for Softplus and Softsign up to opset 22 (#​28982)
• Fixed the XQA GroupQueryAttention cudaErrorInvalidValue on Blackwell (sm_120) (#​29706)
• Initialized large-head FMHA shared memory per kernel variant (#​29140)
• Fixed CUDA/cuDNN DLL preload paths for the CUDA 13 consolidated wheel layout, and fixed the libcudart.so.13 hard dependency that broke import on CPU-only Linux (#​29202, #​29590)
• Fixed a null allocator passed to plugin EP kernel PrePack, and plugin EP allocator deleter lifetime (#​29658, #​29663)
• Removed unused code in moe_kernels.cu (#​29295)

WebGPU EP

• Added KV cache quantization for ORT WebGPU (#​28059)
• Fused FlashAttention decode kernels and extended them to any sequence length (#​28389)
• Fused Q/K RMSNorm into GroupQueryAttention for Qwen3-style models (#​28484)
• Gemma 4 enablement: indirect dispatch for FlashAttention graph capture, and INT64 support for Equal/Sub/Where/ReduceSum under the enable_int64 flag (#​29236, #​29392)
• Added a session-level buffer pool for graph capture reuse and made max_num_pending_dispatches configurable (#​28761, #​28894)
• Added 2-bit quantization support to GatherBlockQuantized (#​29054)
• Enabled Cast to int64 by default and switched to naive reduction (#​28804, #​28174)
• Default non-debug validation mode is now disabled (#​28679)
• Tuned parameters for the gemm-subgroup kernel (#​28760)
• Enabled FlashAttention for batched GQA with right-padded prompts and fixed batched right-padded prefill with do_rotary (#​29247, #​29002)
• Fixed a GQA decode split-reduce head_size out-of-bounds race, the past_state == present_state buffer aliasing case, and GatherBlockQuantized dispatch failure for empty indices (#​29593, #​28753, #​29030)
• Fixed nearest half-tie handling for round_prefer_ceil/round_prefer_floor (#​28757)
• Skipped MatMulNBitsMlpFusion when the kernel is unavailable (#​29089)
• Fixed profiling timestamp alignment with the ORT profiler (#​29021)

CoreML EP

• Added Where and And builders (#​28597)
• Fixed extended minimal builds with the Core ML EP (#​29387)
• Fixed the "model_path" must not be empty error (#​29394)
• Fixed CoreML-enabled static builds on macOS (#​27960)

QNN EP

• Fixed a segfault in PadNodeGroupSelector::Check when dq_nodes is empty (#​28733)
• Added a Gather handler for the transpose optimizer (#​28755)

WebNN EP

• Added support for 8-bit MatMulNBits (#​29025)
• Removed unnecessary casts around normalization ops (#​29024)

OpenVINO / VitisAI / DML / XNNPACK / VSINPU

• OpenVINO EP development updates (#​28954)
• VitisAI: recognize native-endian in-memory address tag in process_ext_address (#​29248)
• DML: fixed batched readback size (#​28680)
• XNNPACK: fixed Clip/Relu fusion when the producer output has other consumers (#​28814)
• VSINPU: fixed EP build error (#​29440)

CPU & Core Optimizations

MLAS

• Added AVX512 (+VNNI) 2-bit weight CPU kernels (#​29064)
• Added ARM64 2-bit weight CPU kernels (#​29466)
• Extended the NHWC-sans-transposes path to support depthwise convolutions, and fixed NHWC conv support gating (#​28565, #​29127)
• Added RISC-V RVV INT8 GEMM/GEMV, M=1 routing, and activation kernels (#​28308)
• Fixed a fastmath corner case in sbgemm_neon_kernel and fixed failing KleidiAI NHWC unit tests (#​28394, #​29010)
• Hinted GCC >= 12 on aarch64 for bf16/fp16 capability probes (#​28785)

CPU Attention & Kernels

• Added flash attention for non-quantized CPU GroupQueryAttention, plus a FP32 GEMV decode kernel (#​28962, #​29216)
• Fixed packed-QKV and broadcast-head bias strides in quantized GQA flash attention (#​28963)
• Enabled pre-packed weight sharing for CPU MatMulNBits (#​29163)
• Added int8/uint8 CPU support for SpaceToDepth and int8 for DepthToSpace (#​29154)
• Fixed CPU Attention causal mask alignment and is_causal bottom-right alignment for external KV cache (#​29050, #​28958)
• Fixed CPU GQA NaN output for right-padded batched prompts with rotary embeddings (#​29069)
• Fixed ReverseSequence returning zeros for zero-length sequences (#​28759)
• Fixed a regression in RandomForestClassifier binary classification predictions (#​28685)

Graph, Optimizer, and Fusion

• Fixed NHWC second-pass EP assignment cleanup (#​27858)
• Rejected QDQ Gemm → QGemm fusion when alpha != 1 with bias, and validated DQ scale/zero-point shapes before QGemm fusion (#​28131, #​28714)
• Fixed incorrect output for QDQ Resize with non-nearest interpolation modes under ORT_ENABLE_ALL (#​28454)
• Fixed INT64 initializer data propagation and the Shape → Gather → TopK rank-1 regression (#​28778, #​29084)
• Fixed a TransposeOptimizer type error on zero-point-less DequantizeLinear (#​29192)
• Fixed SimplifiedLayerNorm fusion with a node-produced Pow exponent (#​29196)
• Fixed DropQDQ not dropping Q/DQ around opset-22 MaxPool (#​29201)
• Recovered Conv/ConvTranspose rank from weights when the input shape is unknown (#​29149)
• Fixed STFT complex input frame offsets (#​28961)

Web & JavaScript

• Forwarded WebGPU EP buffer cache mode options from JS (#​29017)
• Added a Python implementation for wgsl-gen and removed the dynamic WGSL generator path (#​28355, #​29141)
• Switched NPM publishing to consume from the CUDA 13 pipeline, and fixed the Node.js packaging stage to use CFS (#​28773, #​29006)
• Fixed a Dawn parallel build race condition in the wasm_Release / build-wasm CI (#​29040)

Language Bindings

Python

• Added an API for HOST_ACCESSIBLE OrtValue allocation (#​28038)
• Made the TF converter tolerate a missing requests package (#​28825)

Java

• Released outputHandlesArr in the OrtTrainingSession.evalStep JNI binding (#​29576)

Rust

• Fixed unbounded lifetime on WithOutputTensor (#​29251)

Build, Packaging & CI

• Updated the cpuinfo dependency and integrated cpuinfo_deinitialize() (#​28245)
• Built with abseil 2025081 under NVCC (#​28586)
• Fixed the Linux CUDA 13.3 build (abseil + CCCL parse errors) and the Windows CUDA 13.3 build for VS 2026 (#​29042, #​29266)
• Fixed the Windows build for SM90 and later, and CUDA packaging build errors (#​29776, #​29580)
• Fixed the wrong ORT version in Windows DLL VersionInfo for pipeline builds (#​29545)
• Fixed Python and CUDA packaging pipeline failures (#​29200, #​29241)
• Installed Java in the Windows NuGet packaging job and added Java setup to the Windows x64 QNN CI pipeline (#​29774, #​29754)
• Sharded Windows ASan test runs and fixed ASan OOM in QDQ Gemm transformer tests (#​29503, #​28797)
• Propagated and fixed PIP_INDEX_URL piping for container build stages (#​29803, #​29823)
• Removed deprecated docfx in favor of a newer docs validation method (#​29812)
• Fixed a build failure from a direct ONNX schema include in layernorm optimizer tests (#​29073)
• Test stability: fixed a data race in CUDA graph tests, a non-deterministic CUDA custom-op test, a thread-pool parameter self-assignment, duplicate schema registration, and incorrect string tensor creation (#​29398, #​29082, #​28799, #​29219, #​29218)
• Encapsulated the global random seed in a function and improved LinearRegressor test coverage (#​28979, #​29083)

Contributors

Thanks to our 103 contributors for this release!

@​adrastogi, @​ankitm3k, @​apsonawane, @​ArsalanShakil, @​bachelor-dou, @​bopeng1234, @​cbourjau, @​chilo-ms, @​chunghow-qti, @​chwarr, @​claude, @​Craigacp, @​crvineeth97, @​dabhattimsft, @​daijh, @​danielsongmicrosoft, @​derdeljan-msft, @​edgchen1, @​elwhyjay, @​ericcraw, @​eserscor, @​fanchenkong1, @​feich-ms, @​fs-eire, @​FuZoe, @​gaugarg-nv, @​gblong1, @​GopalakrishnanN, @​grybouilli, @​guschmue, @​haoxli, @​hariharans29, @​hnsyprst, @​Honry, @​intbf, @​ishwar-raut1, @​jambayk, @​Jaswanth51, @​jatinwadhwa921, @​javier-intel, @​jiafatom, @​Jiawei-Shao, @​JonathanC-ARM, @​justinchuby, @​jwludzik, @​Kotomi-Du, @​kpkbandi, @​lucka-me, @​maoger, @​martin-klacer-arm, @​maxwbuckley, @​MayureshV1, @​mc-nv, @​mcollinswisc, @​mdvoretc-intel, @​mingyueliuh, @​mklimenk, @​n1harika, @​namgyu-youn, @​neilmsft, @​orlmon01, @​Osamaali313, @​prathikr, @​preetha-intel, @​psakhamoori, @​qiurui144, @​qjia7, @​qti-hungjuiw, @​qti-yuduo, @​quic-muchhsu, @​raagrawal, @​RajeevSekar, @​Reranko05, @​Rishi-Dave, @​RyanMetcalfeInt8, @​Sammy-Dabbas, @​sanaa-hamel-microsoft, @​sayanshaw24, @​selenayang888, @​sfatimar, @​sgbihu, @​Shivani767, @​ssam18, @​susbhere, @​sushraja-msft, @​tairenpiao, @​the0cp, @​tianleiwu, @​titaiwangms, @​umireon, @​vthaniel, @​wangw-1991, @​wenqinI, @​xadupre, @​xenova, @​xhcao, @​xiaofeihan1, @​xieofxie, @​xuke537, @​yen-shi, @​yinli-systems, @​yuslepukhin, @​ZackyLake

Full Changelog: v1.27.1...v1.28.0

v1.27.1: ONNX Runtime v1.27.1

Compare Source

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

• [MLAS] Fixed an igemm regression in the KleidiAI path (#​28571)
• Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#​29081)
• Fixed a regression in graph-capture session initialization that rejected an empty graph (#​29457)
• Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#​29574)

Performance

NVIDIA CUDA EP

• Added a QMoE GEMV fast path for batch-1 decode (#​29038)

CI & Build Infrastructure

• Fixed an incorrect identity for azcopy (#​29274)
• Fixed a brew install applesimutils failure by trusting the wix/brew tap (#​29450)
• Upgraded to Xcode 26 (#​29468)
• Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#​29575)
• Fixed the web e2e (npm/vite) and Python DML CI pipelines (#​29609)

Contributors

Thanks to our 8 contributors for this release!

@​tianleiwu, @​chilo-ms, @​edgchen1, @​adrastogi, @​damdoo01-arm, @​JonathanC-ARM, @​martin-klacer-arm, @​sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1

v1.32.0

Compare Source

• Update to L0 Zero Spec v1.17.24: https://oneapi-src.github.io/level-zero-spec/releases/index.html#level-zero-v1-17-24
• Fix: add .mako deduplication to prevent multiple to_string definitions
• Fix: CONTRIBUTING.md minor updates to versioning and command lines

v1.31.0

Compare Source

• Fix: logger use-after-free in ZeLogger during teardown
• Fix: .mako drift from actual headers
• Fix: Static Analysis Fixes
• Feature: Enable System Resource Tracker on Windows
• Removed unnused size_t for to_string in 32b compiles
• Use PROJECT_DIR instead of CMAKE_DIR to support subproject builds