Bump Microsoft.ML.OnnxRuntime from 1.27.1 to 1.28.0

[dependabot]

Updated Microsoft.ML.OnnxRuntime from 1.27.1 to 1.28.0.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.28.0

Announcements & Breaking Changes

• Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#​28754, #​29606, #​28967). Graph optimizer opset version checks were updated accordingly (#​28966).
• cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#​29252, #​29808, #​29705, #​29620).
• An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#​28746, #​29142, #​28990).
• Deprecated / removed:
  • SkipLayerNorm strict mode is deprecated (#​29388).
  • The TensorRT fused causal attention kernels were removed from the CUDA EP (#​29143).
  • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#​29141, #​28355).
  • CUDA_QUANT_PREPROCESS is off by default (#​29687).
• NPM packages are now published from the CUDA 13 pipeline (#​28773).
• The CUDA 12.8 package architecture list was refreshed for this release (#​29711).

Security Fixes

Memory safety & input validation

• Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#​28186, #​29068)
• Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#​28839)
• Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#​28973)
• Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#​28991, #​29011, #​29012, #​29014)
• Validated Col2Im inputs to prevent heap over-read (#​28706)
• Hardened CropAndResize against malformed crop_size tensors (#​28766)
• Validated BeamSearch vocab_size against logits width (#​28774)
• Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#​29239)
• Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#​29015, #​29242)
• Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#​29240, #​29447)
• Clamped 1D attention mask_index to valid bounds (#​29449)
• Validated MaxpoolWithMask kernel rank against input spatial rank (#​29253)
• Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#​29264)
• Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#​29268, #​29448)
• Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#​29293, #​29060)
• Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#​29462)
• Handled non-trivially-copyable types in Loop/Scan output concatenation (#​29397)
• Normalized bool tensor raw_data to {0, 1} on unpack (#​29238)
• Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#​28779, #​28780, #​28801)
• Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#​29251)

Integer overflow & allocation size

• Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#​29444, #​29446)
• Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#​29443)
• Hardened QMoE against integer overflow and partial K tiles (#​29067)
• Validated B/scales/zero-points shape in MatMulNBits::PrePack (#​29445)
• Pre-checked ConstantOfShape output size against the input initializer before constant folding (#​28751)
• Fixed integer overflow in RKNPU implicit bias allocation (#​29249)
• Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#​28721, #​28704, #​28718)

Supply chain & tooling

... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 27, 2026, 2:16 AM ET / 06:16 UTC.

ClawSweeper review

What this changes

Updates the shared speech-transcription dependency Microsoft.ML.OnnxRuntime, the native ONNX model inference engine used alongside Whisper.net, from 1.27.1 to 1.28.0.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep this fresh Dependabot PR open for normal dependency review. It makes a one-line direct production package update, but the repository-required build and shared/tray test validation is not yet evidenced in the PR context and the upstream minor release changes the native inference runtime.

Priority: P2
Reviewed head: de1b393476017783042d39dcf911e5903ee9c93b

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is narrowly scoped, but confidence remains limited until the repository-required validation completes for the updated native runtime.
Proof confidence	🌊 off-meta tidepool	Not applicable: This is a Dependabot bot PR, for which the external-contributor real-behavior-proof gate does not apply; required repository validation remains the appropriate evidence.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This is a Dependabot bot PR, for which the external-contributor real-behavior-proof gate does not apply; required repository validation remains the appropriate evidence.
Evidence reviewed	3 items	Proposed dependency diff: The PR changes exactly one direct production PackageReference, increasing Microsoft.ML.OnnxRuntime from 1.27.1 to 1.28.0. Repository validation policy: The repository AGENTS.md requires the full build plus shared and tray test suites after every code change; the supplied PR context shows relevant CI still in progress rather than completed validation evidence. Upstream release scope: The supplied Dependabot release notes describe an ONNX Runtime minor release with native-runtime and upstream dependency changes, so compatibility should be confirmed on this repository's supported transcription path.
Findings	None	None.
Security	None	None.

How this fits together

OpenClaw's shared library supplies speech-transcription capabilities used by Windows-node and tray-adjacent workflows. Audio/model inference flows through Whisper.net into Microsoft.ML.OnnxRuntime, which loads and executes the native ONNX runtime before returning transcription results to higher-level features.

flowchart LR
  A[Audio or speech input] --> B[Whisper.net transcription]
  B --> C[Shared OpenClaw library]
  C --> D[ONNX Runtime package]
  D --> E[Native model inference]
  E --> F[Transcribed result for node and tray flows]

Loading

Before merge

• Resolve merge risk (P1) - Microsoft.ML.OnnxRuntime includes native inference binaries and the 1.28.0 release changes upstream runtime behavior; merging before the required build and transcription-adjacent tests complete could expose compatibility failures only on supported Windows environments.
• Complete next step (P2) - Await the required build and shared/tray validation results before making a normal dependency-merge decision.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency surface	1 direct production PackageReference changed	The patch is intentionally narrow, so validation should focus on the shared native inference dependency rather than unrelated product behavior.

Merge-risk options

Maintainer options:

1. Validate the native runtime upgrade (recommended)
   Run the repository-required build plus shared and tray test suites on this head, and merge if they pass without ONNX or Whisper compatibility regressions.
2. Pause for upstream compatibility investigation
   Pause this update if validation exposes model-loading, native-binary, or transcription regressions that need a targeted compatibility fix.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Run the required project build plus the shared and tray test suites on the dependency-updated head; merge only if they pass without ONNX Runtime or Whisper compatibility failures.

Technical review

Best possible solution:

Merge the narrow package update only after the required build, shared tests, and tray tests pass on the proposed head, with any ONNX or Whisper runtime failure investigated as an upgrade-compatibility regression.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a dependency version rather than reporting an existing product failure. Compatibility validation is still needed on the supported transcription/runtime path.

Is this the best way to solve the issue?

Unclear: changing the existing direct PackageReference is the narrowest implementation, but the best merge decision depends on the required build and test evidence for the updated native runtime.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against acf4ab1d2b02.

Labels

Label changes:

• add P2: This is a normal-priority production dependency update with a limited but real native-runtime compatibility surface.
• add merge-risk: 🚨 compatibility: Updating a direct native inference runtime can alter model loading or supported-environment behavior for existing speech-transcription users.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot PR, for which the external-contributor real-behavior-proof gate does not apply; required repository validation remains the appropriate evidence.

Label justifications:

• P2: This is a normal-priority production dependency update with a limited but real native-runtime compatibility surface.
• merge-risk: 🚨 compatibility: Updating a direct native inference runtime can alter model loading or supported-environment behavior for existing speech-transcription users.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot PR, for which the external-contributor real-behavior-proof gate does not apply; required repository validation remains the appropriate evidence.

Evidence

What I checked:

• Proposed dependency diff: The PR changes exactly one direct production PackageReference, increasing Microsoft.ML.OnnxRuntime from 1.27.1 to 1.28.0. (src/OpenClaw.Shared/OpenClaw.Shared.csproj:24, de1b39347601)
• Repository validation policy: The repository AGENTS.md requires the full build plus shared and tray test suites after every code change; the supplied PR context shows relevant CI still in progress rather than completed validation evidence. (AGENTS.md:1, acf4ab1d2b02)
• Upstream release scope: The supplied Dependabot release notes describe an ONNX Runtime minor release with native-runtime and upstream dependency changes, so compatibility should be confirmed on this repository's supported transcription path. (src/OpenClaw.Shared/OpenClaw.Shared.csproj:24, de1b39347601)

Likely related people:

• Unresolved current-main dependency owner: The supplied review context identifies the changed production project file but does not provide current-main blame or history for its dependency ownership; route through the repository's .NET/dependency review path. (role: likely follow-up owner; confidence: low; files: src/OpenClaw.Shared/OpenClaw.Shared.csproj)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Provide completed build, shared-test, and tray-test results from the dependency-updated head.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.