Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/22054
**Author:** [@dependabot[bot]](https://github.com/apps/dependabot)
**Created:** 3/1/2026
**Status:** ❌ Closed
**Base:** `dev` ← **Head:** `dependabot/uv/dev/onnxruntime-1.24.2`
---
### 📝 Commits (1)
- [`fe3e87f`](https://github.com/open-webui/open-webui/commit/fe3e87f170c02f40ecb46ec074d4a119931342cf) chore(deps): bump onnxruntime from 1.24.1 to 1.24.2
### 📊 Changes
**3 files changed** (+1366 additions, -1009 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/requirements.txt` (+1 -1)
📝 `pyproject.toml` (+1 -1)
📝 `uv.lock` (+1364 -1007)
</details>
### 📄 Description
Bumps [onnxruntime](https://github.com/microsoft/onnxruntime) from 1.24.1 to 1.24.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/microsoft/onnxruntime/releases">onnxruntime's releases</a>.</em></p>
<blockquote>
<h2>ONNX Runtime v1.24.2</h2>
<p>This is a patch release for ONNX Runtime 1.24, containing several bug fixes, security improvements, and execution provider updates.</p>
<h2>Bug Fixes</h2>
<ul>
<li><strong>NuGet</strong>: Fixed native library loading issues in the ONNX Runtime NuGet package on Linux and macOS. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27266">#27266</a>)</li>
<li><strong>macOS</strong>: Fixed Java support and Jar testing on macOS ARM64. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27271">#27271</a>)</li>
<li><strong>Core</strong>: Enable Robust Symlink Support for External Data for Huggingface Hub Cache. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27374">#27374</a>)</li>
<li><strong>Core</strong>: Added boundary checks for <code>SparseTensorProtoToDenseTensorProto</code> to improve robustness. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27323">#27323</a>)</li>
<li><strong>Security</strong>: Fixed an out-of-bounds read vulnerability in <code>ArrayFeatureExtractor</code>. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27275">#27275</a>)</li>
</ul>
<h2>Execution Provider Updates</h2>
<ul>
<li><strong>MLAS</strong>: Fixed flakiness and accuracy issues in Lut GEMM (MatMulNBitsLutGemm). (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27216">#27216</a>)</li>
<li><strong>QNN</strong>: Enabled 64-bit UDMA mode for HTP target v81 or above. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/26677">#26677</a>)</li>
<li><strong>WebGPU</strong>:
<ul>
<li>Used <code>LazyRelease</code> for prepack allocator. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27077">#27077</a>)</li>
<li>Fixed <code>ConvTranspose</code> bias validation in both TypeScript and C++ implementations. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27213">#27213</a>)</li>
</ul>
</li>
<li><strong>OpenVINO (OVEP)</strong>: Patch to reduce resident memory by reusing weight files across shared contexts. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27238">#27238</a>)</li>
<li><strong>DNNL</strong>: Fixed DNNL build error by including missing files. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27334">#27334</a>)</li>
</ul>
<h2>Build and Infrastructure</h2>
<ul>
<li><strong>CUDA</strong>:
<ul>
<li>Added support for CUDA architecture family codes (suffix 'f') introduced in CUDA 12.9. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27278">#27278</a>)</li>
<li>Fixed build errors and warnings for various CUDA versions (12.8, 13.0, 13.1.1). (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27276">#27276</a>)</li>
<li>Applied patches for Abseil CUDA warnings. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27096">#27096</a>, <a href="https://redirect.github.com/microsoft/onnxruntime/pull/27126">#27126</a>)</li>
</ul>
</li>
<li><strong>Pipelines</strong>:
<ul>
<li>Fixed Python packaging pipeline for Windows ARM64 and release. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27339">#27339</a>, <a href="https://redirect.github.com/microsoft/onnxruntime/pull/27350">#27350</a>, <a href="https://redirect.github.com/microsoft/onnxruntime/pull/27299">#27299</a>)</li>
<li>Fixed DirectML NuGet pipeline to correctly bundle x64 and ARM64 binaries for release. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27349">#27349</a>)</li>
<li>Updated <code>Microsoft.ML.OnnxRuntime.Foundry</code> package for Windows ARM64 support and NuGet signing. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27294">#27294</a>)</li>
</ul>
</li>
<li><strong>Testing</strong>: Updated <code>BaseTester</code> to support plugin EPs with both compiled nodes and registered kernels. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27176">#27176</a>)</li>
<li><strong>Telemetry</strong>: Added service name and framework name to telemetry events for better usage understanding on Windows. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27252">#27252</a>, <a href="https://redirect.github.com/microsoft/onnxruntime/pull/27256">#27256</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/microsoft/onnxruntime/compare/rel-1.24.1...rel-1.24.2">v1.24.1...v1.24.2</a></p>
<h2>Contributors</h2>
<p><a href="https://github.com/tianleiwu"><code>@tianleiwu</code></a>, <a href="https://github.com/hariharans29"><code>@hariharans29</code></a>, <a href="https://github.com/edgchen1"><code>@edgchen1</code></a>, <a href="https://github.com/xiaofeihan1"><code>@xiaofeihan1</code></a>, <a href="https://github.com/adrianlizarraga"><code>@adrianlizarraga</code></a>, <a href="https://github.com/angelser"><code>@angelser</code></a>, <a href="https://github.com/angelserMS"><code>@angelserMS</code></a>, <a href="https://github.com/ankitm3k"><code>@ankitm3k</code></a>, <a href="https://github.com/baijumeswani"><code>@baijumeswani</code></a>, <a href="https://github.com/bmehta001"><code>@bmehta001</code></a>, <a href="https://github.com/ericcraw"><code>@ericcraw</code></a>, <a href="https://github.com/eserscor"><code>@eserscor</code></a>, <a href="https://github.com/fs-eire"><code>@fs-eire</code></a>, <a href="https://github.com/guschmue"><code>@guschmue</code></a>, <a href="https://github.com/mc-nv"><code>@mc-nv</code></a>, <a href="https://github.com/qjia7"><code>@qjia7</code></a>, <a href="https://github.com/qti-monumeen"><code>@qti-monumeen</code></a>, <a href="https://github.com/titaiwangms"><code>@titaiwangms</code></a>, <a href="https://github.com/yuslepukhin"><code>@yuslepukhin</code></a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/microsoft/onnxruntime/commit/058787ceead760166e3c50a0a4cba8a833a6f53f"><code>058787c</code></a> ORT 1.24.2 Release cherry pick round 4 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27388">#27388</a>)</li>
<li><a href="https://github.com/microsoft/onnxruntime/commit/6fc7ee38cdc5755a7e4ab6cdc26c5f73a2d94dd7"><code>6fc7ee3</code></a> ORT 1.24.2 release cherry pick round 3 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27378">#27378</a>)</li>
<li><a href="https://github.com/microsoft/onnxruntime/commit/98711820882dc178e995ec24f4587350dbf16360"><code>9871182</code></a> ORT 1.24.2 release cherry-pick round 2 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27343">#27343</a>)</li>
<li><a href="https://github.com/microsoft/onnxruntime/commit/f34d11d3e99abb3b1c2236f33e0e1aa30160b922"><code>f34d11d</code></a> ORT 1.24.2 release cherry pick round 1 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27330">#27330</a>)</li>
<li><a href="https://github.com/microsoft/onnxruntime/commit/8ba51c754c3c853e420a38051f76c5d97e78ff89"><code>8ba51c7</code></a> update version to 1.24.2</li>
<li>See full diff in <a href="https://github.com/microsoft/onnxruntime/compare/v1.24.1...v1.24.2">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/22054
Author: @dependabot[bot]
Created: 3/1/2026
Status: ❌ Closed
Base:
dev← Head:dependabot/uv/dev/onnxruntime-1.24.2📝 Commits (1)
fe3e87fchore(deps): bump onnxruntime from 1.24.1 to 1.24.2📊 Changes
3 files changed (+1366 additions, -1009 deletions)
View changed files
📝
backend/requirements.txt(+1 -1)📝
pyproject.toml(+1 -1)📝
uv.lock(+1364 -1007)📄 Description
Bumps onnxruntime from 1.24.1 to 1.24.2.
Release notes
Sourced from onnxruntime's releases.
Commits
058787cORT 1.24.2 Release cherry pick round 4 (#27388)6fc7ee3ORT 1.24.2 release cherry pick round 3 (#27378)9871182ORT 1.24.2 release cherry-pick round 2 (#27343)f34d11dORT 1.24.2 release cherry pick round 1 (#27330)8ba51c7update version to 1.24.2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.