chore(deps): bump the uv group across 12 directories with 5 updates by dependabot[bot] · Pull Request #6483 · aws/deep-learning-containers

dependabot · 2026-08-04T18:42:23Z

Bumps the uv group with 3 updates in the /docker/pytorch/2.11/cpu directory: aiohttp, onnx and pyasn1.
Bumps the uv group with 3 updates in the /docker/pytorch/2.11/cuda directory: aiohttp, onnx and pyasn1.
Bumps the uv group with 3 updates in the /docker/pytorch/2.12/cpu directory: aiohttp, onnx and pyasn1.
Bumps the uv group with 3 updates in the /docker/pytorch/2.12/cuda directory: aiohttp, onnx and pyasn1.
Bumps the uv group with 3 updates in the /docker/pytorch/2.13/cpu directory: aiohttp, onnx and pyasn1.
Bumps the uv group with 3 updates in the /docker/pytorch/2.13/cuda directory: aiohttp, onnx and pyasn1.
Bumps the uv group with 2 updates in the /docker/ray directory: aiohttp and awscli.
Bumps the uv group with 1 update in the /docker/ray-train directory: aiohttp.
Bumps the uv group with 1 update in the /docker/sklearn/1.4-2-py312 directory: cryptography.
Bumps the uv group with 1 update in the /docker/sklearn/1.9-0 directory: cryptography.
Bumps the uv group with 2 updates in the /docker/tensorflow/2.21/cpu directory: aiohttp and onnx.
Bumps the uv group with 2 updates in the /docker/tensorflow/2.21/cuda directory: aiohttp and onnx.

Updates aiohttp from 3.14.1 to 3.14.3
Updates onnx from 1.21.0 to 1.22.0

Release notes

Sourced from onnx's releases.

v1.22.0

ONNX v1.22.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Swap qk_matmul_output_mode 1 & 2 to match computation order by @titaiwangms in onnx/onnx#7913

Spec and Operator

Two new operators LinearAttention-27 and CausalConvWithState-27 were introduced.

Fix number of pad modes in doc_strings.cc by @assafpr in onnx/onnx#7803

Add FlexAttention Op to ai.onnx.preview opset by @mshr-h in onnx/onnx#7534

Fix Attention op softcap ordering: apply before mask/bias by @titaiwangms in onnx/onnx#7867

Add LinearAttention and CausalConvWithState operators (Opset 27) by @tadani3 in onnx/onnx#7950

feat(generator): extend Range operator with float16 and bfloat16 support (opset 27) by @andife in onnx/onnx#7923

Reference Implementation

Fix missing 'mul' reduction in ScatterElements reference implementation by @zdryan in onnx/onnx#7842

Fix QLinearMatMul output saturation by @karimbaidar in onnx/onnx#7868

Fixed more bugs in the Scan reference op by @tadani3 in onnx/onnx#7964

Utilities and Tools

Fix Slice shape inference crashes with SIGABRT on empty dimensions by @titaiwangms in onnx/onnx#7738

Rename misleading input_rank param to input_dim_value in processSlice… by @titaiwangms in onnx/onnx#7739

fix: Conv/Pool strides validation by @edgchen1 in onnx/onnx#7764

fix: add input/output bounds checks in version converter adapter by @andife in onnx/onnx#7813

Harden version conversion against malformed inputs by @andife in onnx/onnx#7872

fix: add input rank checks in Gemm version converter adapters by @andife in onnx/onnx#7880

Fix raw_data handling in version converter adapters by @cyyever in onnx/onnx#7910

Fix checker to use len() instead of sys.getsizeof() for protobuf size check by @OmarAzizi in onnx/onnx#7760

Add version macros by @cbourjau in onnx/onnx#7918

Remove internal spec_to_yaml tool by @cbourjau in onnx/onnx#7985

Address shape inference shortcomings by @yuslepukhin in onnx/onnx#7997

Add unifyInputShape / unifyInputShapePrefix shape inference utilities by @gramalingam in onnx/onnx#7999

Add operator+ and operator- for Dim by @gramalingam in onnx/onnx#8000

Fix KeepAspectRatioHelper precision for scaled output dimensions by @elwhyjay in onnx/onnx#8007

Fix heap buffer over-read in Conv/Pool shape inference for weight rank mismatch by @Copilot in onnx/onnx#8037

Build, CI and Tests

Add update into main.yml by @titaiwangms in onnx/onnx#7687

Update check_urls.yml by @andife in onnx/onnx#7716

Update add_msvc_runtime_flag to work with MSVC_RUNTIME_LIBRARY by @Shadows-of-Fire in onnx/onnx#7660

Try to fix renovate by @andife in onnx/onnx#7742

fix upload; Update release_win.yml by @andife in onnx/onnx#7728

Allow release CIs to run when a labeled PR receives new commits by @Copilot in onnx/onnx#7741

Update pixi.{toml,lock} by @cbourjau in onnx/onnx#7746

hash for googletest by @andife in onnx/onnx#7765

Update RELEASE-MANAGEMENT.md by @andife in onnx/onnx#7773

Update doc CIPipeline by @andife in onnx/onnx#7782

use reviewdog to fix the pr_checks workflow by @andife in onnx/onnx#7780

Update copilot-setup-steps.yml; persist-credentials: false by @andife in onnx/onnx#7768

Update release_linux.yml; replace tag by hash by @andife in onnx/onnx#7769

... (truncated)

Commits

2bb5046 Fix windows workflows on rel-1.22.0 branch (#8087)
eda0385 Update version number to 1.22.0 (#8086)
b124e01 Bump version number to 1.22.0rc2 (#8071)
8de2cf6 Cherrypicks for 1.22.0rc2 (#8066)
53d6120 Cherry-pick: Address shape inference issues in Conv (#8051) to rel-1.22.0 (#8...
bc3be77 Set version number to 1.22.0rc1 (#8024)
e945daf feat(generator): extend Range operator with float16 and bfloat16 support (ops...
293ad62 Run lints also on Windows (#8014)
8847da4 Follow up for scikit-build-core migration (#8017)
882a5ef Fix/sdist missing SBOM cdx json (#8010)
Additional commits viewable in compare view

Updates pyasn1 from 0.6.3 to 0.6.4

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.

CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.

Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)

CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.float() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)

Pinned PyPI publish GitHub Action to an immutable commit [pr #113](pyasn1/pyasn1#113)

Commits

72e4803 Prepare release 0.6.4
0c19eeb Pin PyPI publish action to immutable commit (#113)
45bdb19 Merge commit from fork
628e36e Merge commit from fork
e60c691 Merge commit from fork
See full diff in compare view

Updates aiohttp from 3.14.1 to 3.14.3
Updates onnx from 1.21.0 to 1.22.0

Release notes

Sourced from onnx's releases.

v1.22.0

ONNX v1.22.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Swap qk_matmul_output_mode 1 & 2 to match computation order by @titaiwangms in onnx/onnx#7913

Spec and Operator

Two new operators LinearAttention-27 and CausalConvWithState-27 were introduced.

Fix number of pad modes in doc_strings.cc by @assafpr in onnx/onnx#7803

Add FlexAttention Op to ai.onnx.preview opset by @mshr-h in onnx/onnx#7534

Fix Attention op softcap ordering: apply before mask/bias by @titaiwangms in onnx/onnx#7867

Add LinearAttention and CausalConvWithState operators (Opset 27) by @tadani3 in onnx/onnx#7950

feat(generator): extend Range operator with float16 and bfloat16 support (opset 27) by @andife in onnx/onnx#7923

Reference Implementation

Fix missing 'mul' reduction in ScatterElements reference implementation by @zdryan in onnx/onnx#7842

Fix QLinearMatMul output saturation by @karimbaidar in onnx/onnx#7868

Fixed more bugs in the Scan reference op by @tadani3 in onnx/onnx#7964

Utilities and Tools

Fix Slice shape inference crashes with SIGABRT on empty dimensions by @titaiwangms in onnx/onnx#7738

Rename misleading input_rank param to input_dim_value in processSlice… by @titaiwangms in onnx/onnx#7739

fix: Conv/Pool strides validation by @edgchen1 in onnx/onnx#7764

fix: add input/output bounds checks in version converter adapter by @andife in onnx/onnx#7813

Harden version conversion against malformed inputs by @andife in onnx/onnx#7872

fix: add input rank checks in Gemm version converter adapters by @andife in onnx/onnx#7880

Fix raw_data handling in version converter adapters by @cyyever in onnx/onnx#7910

Fix checker to use len() instead of sys.getsizeof() for protobuf size check by @OmarAzizi in onnx/onnx#7760

Add version macros by @cbourjau in onnx/onnx#7918

Remove internal spec_to_yaml tool by @cbourjau in onnx/onnx#7985

Address shape inference shortcomings by @yuslepukhin in onnx/onnx#7997

Add unifyInputShape / unifyInputShapePrefix shape inference utilities by @gramalingam in onnx/onnx#7999

Add operator+ and operator- for Dim by @gramalingam in onnx/onnx#8000

Fix KeepAspectRatioHelper precision for scaled output dimensions by @elwhyjay in onnx/onnx#8007

Fix heap buffer over-read in Conv/Pool shape inference for weight rank mismatch by @Copilot in onnx/onnx#8037

Build, CI and Tests

Add update into main.yml by @titaiwangms in onnx/onnx#7687

Update check_urls.yml by @andife in onnx/onnx#7716

Update add_msvc_runtime_flag to work with MSVC_RUNTIME_LIBRARY by @Shadows-of-Fire in onnx/onnx#7660

Try to fix renovate by @andife in onnx/onnx#7742

fix upload; Update release_win.yml by @andife in onnx/onnx#7728

Allow release CIs to run when a labeled PR receives new commits by @Copilot in onnx/onnx#7741

Update pixi.{toml,lock} by @cbourjau in onnx/onnx#7746

hash for googletest by @andife in onnx/onnx#7765

Update RELEASE-MANAGEMENT.md by @andife in onnx/onnx#7773

Update doc CIPipeline by @andife in onnx/onnx#7782

use reviewdog to fix the pr_checks workflow by @andife in onnx/onnx#7780

Update copilot-setup-steps.yml; persist-credentials: false by @andife in onnx/onnx#7768

Update release_linux.yml; replace tag by hash by @andife in onnx/onnx#7769

... (truncated)

Commits

2bb5046 Fix windows workflows on rel-1.22.0 branch (#8087)
eda0385 Update version number to 1.22.0 (#8086)
b124e01 Bump version number to 1.22.0rc2 (#8071)
8de2cf6 Cherrypicks for 1.22.0rc2 (#8066)
53d6120 Cherry-pick: Address shape inference issues in Conv (#8051) to rel-1.22.0 (#8...
bc3be77 Set version number to 1.22.0rc1 (#8024)
e945daf feat(generator): extend Range operator with float16 and bfloat16 support (ops...
293ad62 Run lints also on Windows (#8014)
8847da4 Follow up for scikit-build-core migration (#8017)
882a5ef Fix/sdist missing SBOM cdx json (#8010)
Additional commits viewable in compare view

Updates pyasn1 from 0.6.3 to 0.6.4

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.

CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.

Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)

CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.float() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)

Pinned PyPI publish GitHub Action to an immutable commit [pr #113](pyasn1/pyasn1#113)

Commits

72e4803 Prepare release 0.6.4
0c19eeb Pin PyPI publish action to immutable commit (#113)
45bdb19 Merge commit from fork
628e36e Merge commit from fork
e60c691 Merge commit from fork
See full diff in compare view

Updates aiohttp from 3.14.1 to 3.14.3
Updates onnx from 1.21.0 to 1.22.0

Release notes

Sourced from onnx's releases.

v1.22.0

ONNX v1.22.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Swap qk_matmul_output_mode 1 & 2 to match computation order by @titaiwangms in onnx/onnx#7913

Spec and Operator

Two new operators LinearAttention-27 and CausalConvWithState-27 were introduced.

Fix number of pad modes in doc_strings.cc by @assafpr in onnx/onnx#7803

Add FlexAttention Op to ai.onnx.preview opset by @mshr-h in onnx/onnx#7534

Fix Attention op softcap ordering: apply before mask/bias by @titaiwangms in onnx/onnx#7867

Add LinearAttention and CausalConvWithState operators (Opset 27) by @tadani3 in onnx/onnx#7950

feat(generator): extend Range operator with float16 and bfloat16 support (opset 27) by @andife in onnx/onnx#7923

Reference Implementation

Fix missing 'mul' reduction in ScatterElements reference implementation by @zdryan in onnx/onnx#7842

Fix QLinearMatMul output saturation by @karimbaidar in onnx/onnx#7868

Fixed more bugs in the Scan reference op by @tadani3 in onnx/onnx#7964

Utilities and Tools

Fix Slice shape inference crashes with SIGABRT on empty dimensions by @titaiwangms in onnx/onnx#7738

Rename misleading input_rank param to input_dim_value in processSlice… by @titaiwangms in onnx/onnx#7739

fix: Conv/Pool strides validation by @edgchen1 in onnx/onnx#7764

fix: add input/output bounds checks in version converter adapter by @andife in onnx/onnx#7813

Harden version conversion against malformed inputs by @andife in onnx/onnx#7872

fix: add input rank checks in Gemm version converter adapters by @andife in onnx/onnx#7880

Fix raw_data handling in version converter adapters by @cyyever in onnx/onnx#7910

Fix checker to use len() instead of sys.getsizeof() for protobuf size check by @OmarAzizi in onnx/onnx#7760

Add version macros by @cbourjau in onnx/onnx#7918

Remove internal spec_to_yaml tool by @cbourjau in onnx/onnx#7985

Address shape inference shortcomings by @yuslepukhin in onnx/onnx#7997

Add unifyInputShape / unifyInputShapePrefix shape inference utilities by @gramalingam in onnx/onnx#7999

Add operator+ and operator- for Dim by @gramalingam in onnx/onnx#8000

Fix KeepAspectRatioHelper precision for scaled output dimensions by @elwhyjay in onnx/onnx#8007

Fix heap buffer over-read in Conv/Pool shape inference for weight rank mismatch by @Copilot in onnx/onnx#8037

Build, CI and Tests

Add update into main.yml by @titaiwangms in onnx/onnx#7687

Update check_urls.yml by @andife in onnx/onnx#7716

Update add_msvc_runtime_flag to work with MSVC_RUNTIME_LIBRARY by @Shadows-of-Fire in onnx/onnx#7660

Try to fix renovate by @andife in onnx/onnx#7742

fix upload; Update release_win.yml by @andife in onnx/onnx#7728

Allow release CIs to run when a labeled PR receives new commits by @Copilot in onnx/onnx#7741

Update pixi.{toml,lock} by @cbourjau in onnx/onnx#7746

hash for googletest by @andife in onnx/onnx#7765

Update RELEASE-MANAGEMENT.md by @andife in onnx/onnx#7773

Update doc CIPipeline by @andife in onnx/onnx#7782

use reviewdog to fix the pr_checks workflow by @andife in onnx/onnx#7780

Update copilot-setup-steps.yml; persist-credentials: false by @andife in onnx/onnx#7768

Update release_linux.yml; replace tag by hash by @andife in onnx/onnx#7769

... (truncated)

Commits

2bb5046 Fix windows workflows on rel-1.22.0 branch (#8087)
eda0385 Update version number to 1.22.0 (#8086)
b124e01 Bump version number to 1.22.0rc2 (#8071)
8de2cf6 Cherrypicks for 1.22.0rc2 (#8066)
53d6120 Cherry-pick: Address shape inference issues in Conv (#8051) to rel-1.22.0 (#8...
bc3be77 Set version number to 1.22.0rc1 (#8024)
e945daf feat(generator): extend Range operator with float16 and bfloat16 support (ops...
293ad62 Run lints also on Windows (#8014)
8847da4 Follow up for scikit-build-core migration (#8017)
882a5ef Fix/sdist missing SBOM cdx json (#8010)
Additional commits viewable in compare view

Updates pyasn1 from 0.6.3 to 0.6.4

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.

CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.

Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)

CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.float() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)

Pinned PyPI publish GitHub Action to an immutable commit [pr #113](pyasn1/pyasn1#113)

Commits

72e4803 Prepare release 0.6.4
0c19eeb Pin PyPI publish action to immutable commit (#113)
45bdb19 Merge commit from fork
628e36e Merge commit from fork
e60c691 Merge commit from fork
See full diff in compare view

Updates aiohttp from 3.14.1 to 3.14.3
Updates onnx from 1.21.0 to 1.22.0

Release notes

Sourced from onnx's releases.

v1.22.0

ONNX v1.22.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Swap qk_matmul_output_mode 1 & 2 to match computation order by @titaiwangms in onnx/onnx#7913

Spec and Operator

Two new operators LinearAttention-27 and CausalConvWithState-27 were introduced.

Fix number of pad modes in doc_strings.cc by @assafpr in onnx/onnx#7803

Add FlexAttention Op to ai.onnx.preview opset by @mshr-h in onnx/onnx#7534

Fix Attention op softcap ordering: apply before mask/bias by @titaiwangms in onnx/onnx#7867

Add LinearAttention and CausalConvWithState operators (Opset 27) by @tadani3 in onnx/onnx#7950

feat(generator): extend Range operator with float16 and bfloat16 support (opset 27) by @andife in onnx/onnx#7923

Reference Implementation

Fix missing 'mul' reduction in ScatterElements reference implementation by @zdryan in onnx/onnx#7842

Fix QLinearMatMul output saturation by @karimbaidar in onnx/onnx#7868

Fixed more bugs in the Scan reference op by @tadani3 in onnx/onnx#7964

Utilities and Tools

Fix Slice shape inference crashes with SIGABRT on empty dimensions by @titaiwangms in onnx/onnx#7738

Rename misleading input_rank param to input_dim_value in processSlice… by @titaiwangms in onnx/onnx#7739

fix: Conv/Pool strides validation by @edgchen1 in onnx/onnx#7764

fix: add input/output bounds checks in version converter adapter by @andife in onnx/onnx#7813

Harden version conversion against malformed inputs by @andife in onnx/onnx#7872

fix: add input rank checks in Gemm version converter adapters by @andife in onnx/onnx#7880

Fix raw_data handling in version converter adapters by @cyyever in onnx/onnx#7910

Fix checker to use len() instead of sys.getsizeof() for protobuf size check by @OmarAzizi in onnx/onnx#7760

Add version macros by @cbourjau in onnx/onnx#7918

Remove internal spec_to_yaml tool by @cbourjau in onnx/onnx#7985

Address shape inference shortcomings by @yuslepukhin in onnx/onnx#7997

Add unifyInputShape / unifyInputShapePrefix shape inference utilities by @gramalingam in onnx/onnx#7999

Add operator+ and operator- for Dim by @gramalingam in onnx/onnx#8000

Fix KeepAspectRatioHelper precision for scaled output dimensions by @elwhyjay in onnx/onnx#8007

Fix heap buffer over-read in Conv/Pool shape inference for weight rank mismatch by @Copilot in onnx/onnx#8037

Build, CI and Tests

Add update into main.yml by @titaiwangms in onnx/onnx#7687

Update check_urls.yml by @andife in onnx/onnx#7716

Update add_msvc_runtime_flag to work with MSVC_RUNTIME_LIBRARY by @Shadows-of-Fire in onnx/onnx#7660

Try to fix renovate by @andife in onnx/onnx#7742

fix upload; Update release_win.yml by @andife in onnx/onnx#7728

Allow release CIs to run when a labeled PR receives new commits by @Copilot in onnx/onnx#7741

Update pixi.{toml,lock} by @cbourjau in onnx/onnx#7746

hash for googletest by @andife in onnx/onnx#7765

Update RELEASE-MANAGEMENT.md by @andife in onnx/onnx#7773

Update doc CIPipeline by @andife in onnx/onnx#7782

use reviewdog to fix the pr_checks workflow by @andife in onnx/onnx#7780

Update copilot-setup-steps.yml; persist-credentials: false by @andife in onnx/onnx#7768

Update release_linux.yml; replace tag by hash by @andife in onnx/onnx#7769

... (truncated)

Commits

2bb5046 Fix windows workflows on rel-1.22.0 branch (#8087)
eda0385 Update version number to 1.22.0 (#8086)
b124e01 Bump version number to 1.22.0rc2 (#8071)
8de2cf6 Cherrypicks for 1.22.0rc2 (#8066)
53d6120 Cherry-pick: Address shape inference issues in Conv (#8051) to rel-1.22.0 (#8...
bc3be77 Set version number to 1.22.0rc1 (#8024)
e945daf feat(generator): extend Range operator with float16 and bfloat16 support (ops...
293ad62 Run lints also on Windows (#8014)
8847da4 Follow up for scikit-build-core migration (#8017)
882a5ef Fix/sdist missing SBOM cdx json (#8010)
Additional commits viewable in compare view

Updates pyasn1 from 0.6.3 to 0.6.4

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.

CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.

Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)

CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.float() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)

Pinned PyPI publish GitHub Action to an immutable commit [pr #113](pyasn1/pyasn1#113)

Commits

72e4803 Prepare release 0.6.4
0c19eeb Pin PyPI publish action to immutable commit (#113)
45bdb19 Merge commit from fork
628e36e Merge commit from fork
e60c691 Merge commit from fork
See full diff in compare view

Updates aiohttp from 3.14.1 to 3.14.3
Updates onnx from 1.21.0 to 1.22.0

Release notes

Sourced from onnx's releases.

v1.22.0

ONNX v1.22.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Swap qk_matmul_output_mode 1 & 2 to match computation order by @titaiwangms in onnx/onnx#7913

Spec and Operator

Two new operators LinearAttention-27 and CausalConvWithState-27 were introduced.

Fix number of pad modes in doc_strings.cc by @assafpr in onnx/onnx#7803

Add FlexAttention Op to ai.onnx.preview opset by @mshr-h in onnx/onnx#7534

Fix Attention op softcap ordering: apply before mask/bias by @titaiwangms in onnx/onnx#7867

Add LinearAttention and CausalConvWithState operators (Opset 27) by @tadani3 in onnx/onnx#7950

feat(generator): extend Range operator with float16 and bfloat16 support (opset 27) by @andife in onnx/onnx#7923

Reference Implementation

Fix missing 'mul' reduction in ScatterElements reference implementation by @zdryan in onnx/onnx#7842

Fix QLinearMatMul output saturation by @karimbaidar in onnx/onnx#7868

Fixed more bugs in the Scan reference op by @tadani3 in onnx/onnx#7964

Utilities and Tools

Fix Slice shape inference crashes with SIGABRT on empty dimensions by @titaiwangms in onnx/onnx#7738

Rename misleading input_rank param to input_dim_value in processSlice… by @titaiwangms in onnx/onnx#7739

fix: Conv/Pool strides validation by @edgchen1 in onnx/onnx#7764

fix: add input/output bounds checks in version converter adapter by @andife in onnx/onnx#7813

Harden version conversion against malformed inputs by @andife in Description has been truncated

dependabot · 2026-08-04T21:09:09Z

Dependabot can't resolve your Python dependency files. Because of this, Dependabot cannot update this pull request.

--- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: indirect - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: indirect - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production - dependency-name: awscli dependency-version: 1.44.78 dependency-type: direct:production - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect - dependency-name: onnx dependency-version: 1.22.0 dependency-type: indirect - dependency-name: onnx dependency-version: 1.22.0 dependency-type: indirect - dependency-name: onnx dependency-version: 1.22.0 dependency-type: indirect - dependency-name: onnx dependency-version: 1.22.0 dependency-type: indirect - dependency-name: onnx dependency-version: 1.22.0 dependency-type: indirect - dependency-name: onnx dependency-version: 1.22.0 dependency-type: indirect - dependency-name: onnx dependency-version: 1.22.0 dependency-type: indirect - dependency-name: onnx dependency-version: 1.22.0 dependency-type: indirect - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-07T18:21:04Z

Dependabot can't resolve your Python dependency files. Because of this, Dependabot cannot update this pull request.

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 4, 2026

aws-deep-learning-containers-ci Bot added the authorized label Aug 4, 2026

dependabot Bot force-pushed the dependabot/uv/docker/pytorch/2.11/cpu/uv-c67522e5d7 branch from 1a98fed to 424d8fe Compare August 5, 2026 18:53

Navigation Menu

Uh oh!

chore(deps): bump the uv group across 12 directories with 5 updates - #6483

chore(deps): bump the uv group across 12 directories with 5 updates#6483
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/docker/pytorch/2.11/cpu/uv-c67522e5d7

dependabot Bot commented on behalf of github Aug 4, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 4, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.22.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Build, CI and Tests

Release 0.6.4

Revision 0.6.4, released 08-07-2026

v1.22.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Build, CI and Tests

Release 0.6.4

Revision 0.6.4, released 08-07-2026

v1.22.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Build, CI and Tests

Release 0.6.4

Revision 0.6.4, released 08-07-2026

v1.22.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Build, CI and Tests

Release 0.6.4

Revision 0.6.4, released 08-07-2026

v1.22.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Uh oh!

dependabot Bot commented on behalf of github Aug 4, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 4, 2026 •

edited

Loading