build: bump the python-minor group with 2 updates

[dependabot]

Bumps the python-minor group with 2 updates: openadapt-types and onnxruntime.

Updates openadapt-types from 0.17.0 to 0.18.0

Release notes

Sourced from openadapt-types's releases.

v0.18.0 (2026-09-03)

Bug Fixes

• reward: Refuse the certificate claims this version cannot check (#40, b7b40f3)

A reward certificate was trusted on its shape. Four properties it asserted were never checked anywhere:

• calibration_scope: production. The validator refused only the pair self_signed + production, so issuer="organization" bought a receipt reading certified: true, calibration_scope: production, production_certified: true with no worker, no oracle, and no read.

• issuer: organization. There is no issuer key registry, so nothing can resolve issuer_key_id to a key anyone trusts. * The contract's own certificate_policy. RewardCertificateV1.satisfies had exactly one caller, a test. A certificate measured at epsilon 0.248885 against a contract demanding 0.05 still produced certified. * Revocation. grep -i revok over the reward code in types, evals, and flow returns nothing, and the certificate docstring described revocation as an existing mechanism checked by the issuer.

The narrowing:

• RewardCalibrationScopeV1 keeps SYNTHETIC only, and RewardCertificateIssuerV1 keeps SELF_SIGNED only. Both stay enums, so adding a member back once a registry exists is not a breaking change. * RewardEvidenceReceiptV1.production_certified is gone. With one scope it could only ever return False, and its name promised a distinction the type cannot draw. * score() takes the contract as a required keyword and drops scoring. It reads the scalar from contract.scoring and certifies only a certificate that names this contract by digest and clears contract.certificate_policy. RewardScoreV1 gains certification_refusals, so a false certified says why. * RewardCertificateV1.unmet(policy) lists each shortfall; satisfies is now not unmet(...) and is live code on the certification path. * RewardEvidenceReceiptV1.certification_refusals(contract, certificate) lets a reader who holds both recheck a receipt's flag. The receipt carries digests, so it cannot check itself during validation. * The docstrings drop the revocation sentence and say plainly that signature is checked for encoding and length only.

Breaking for score() callers and for anything that reads production_certified or constructs a production-scope certificate. Nothing outside tests constructs one today.

Co-authored-by: Claude Opus 5 noreply@anthropic.com

---

Detailed Changes: v0.17.1...v0.18.0

v0.17.1 (2026-09-03)

Bug Fixes

• types: Close production admission and authoring contracts (#39, f8a1ca1)

---

Detailed Changes: v0.17.0...v0.17.1

Changelog

Sourced from openadapt-types's changelog.

v0.18.0 (2026-09-03)

Bug Fixes

• reward: Refuse the certificate claims this version cannot check (#40, b7b40f3)

A reward certificate was trusted on its shape. Four properties it asserted were never checked anywhere:

• calibration_scope: production. The validator refused only the pair self_signed + production, so issuer="organization" bought a receipt reading certified: true, calibration_scope: production, production_certified: true with no worker, no oracle, and no read.

• issuer: organization. There is no issuer key registry, so nothing can resolve issuer_key_id to a key anyone trusts. * The contract's own certificate_policy. RewardCertificateV1.satisfies had exactly one caller, a test. A certificate measured at epsilon 0.248885 against a contract demanding 0.05 still produced certified. * Revocation. grep -i revok over the reward code in types, evals, and flow returns nothing, and the certificate docstring described revocation as an existing mechanism checked by the issuer.

The narrowing:

• RewardCalibrationScopeV1 keeps SYNTHETIC only, and RewardCertificateIssuerV1 keeps SELF_SIGNED only. Both stay enums, so adding a member back once a registry exists is not a breaking change. * RewardEvidenceReceiptV1.production_certified is gone. With one scope it could only ever return False, and its name promised a distinction the type cannot draw. * score() takes the contract as a required keyword and drops scoring. It reads the scalar from contract.scoring and certifies only a certificate that names this contract by digest and clears contract.certificate_policy. RewardScoreV1 gains certification_refusals, so a false certified says why. * RewardCertificateV1.unmet(policy) lists each shortfall; satisfies is now not unmet(...) and is live code on the certification path. * RewardEvidenceReceiptV1.certification_refusals(contract, certificate) lets a reader who holds both recheck a receipt's flag. The receipt carries digests, so it cannot check itself during validation. * The docstrings drop the revocation sentence and say plainly that signature is checked for encoding and length only.

Breaking for score() callers and for anything that reads production_certified or constructs a production-scope certificate. Nothing outside tests constructs one today.

Co-authored-by: Claude Opus 5 noreply@anthropic.com

v0.17.1 (2026-09-03)

Bug Fixes

• types: Close production admission and authoring contracts (#39,

... (truncated)

Commits

• 07b8b0c chore: release 0.18.0
• b7b40f3 fix(reward)!: refuse the certificate claims this version cannot check (#40)
• cf6d860 chore: release 0.17.1
• f8a1ca1 fix(types): close production admission and authoring contracts (#39)
• See full diff in compare view

Updates onnxruntime from 1.20.1 to 1.30.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.30.0

ONNX Runtime 1.30.0 expands generative AI inference, improves CPU and GPU performance, adds Go bindings, and strengthens runtime reliability. These notes cover changes since ONNX Runtime 1.29.1.

Highlights

• Expanded CUDA inference support with variable-length causal convolution for continuous batching, speculative decoding in paged XQA, and INT4 paged KV caches with per-channel scales (#32168, #32340, #32515).
• Improved WebGPU PagedAttention, added GPT-OSS support and INT8 KV-cache block quantization, and extended convolution optimizations (#31727, #32277, #32284, #32420).
• Added fused CPU LinearAttention kernels for AVX-512, Arm64 NEON, and SVE, plus AVX2 LayerNorm/RMSNorm acceleration (#31674, #31973, #32178, #32356).
• Added Go bindings for the ONNX Runtime C API and DeepSeek Engram contrib operators (#29615, #32268).

Announcements & Compatibility

• FP4 QMoE kernels are now enabled by default in CUDA builds, with Windows build support added in this release. Source builds can opt out with -Donnxruntime_USE_FP4_QMOE=OFF (#32096, #32163).
• CUDA fpA-intB builds now default to a compact kernel set for FP16 activations, INT4/INT8 weights, scale-only quantization, and block_size=32. Set -Donnxruntime_USE_FPA_INTB_GEMM_FULL=ON when building from source to retain the full kernel set, including BF16, zero-point, bias, larger-block-size, and native Hopper variants (#32324).
• CPU FP16 Gemm and MatMul execution is gated on hardware acceleration. CPU-assigned FP16 nodes without a matching kernel now fall back to FP32 (#32301, #32197).
• WebGPU plugin EP packaging now supports Linux AArch64. Plugin versions were advanced to WebGPU 0.4.0 and CUDA 0.2 (#32287, #31960, #31970).

Security & Reliability

Model Loading, Memory, and Input Validation

• Limited nested model-graph depth and canonicalized external-data locations to harden model loading (#32344, #32135).
• Added checked rounding for BFC arena allocations and fixed prepacked-weight reference lifetimes (#32010, #32040).
• Strengthened shape, rank, and parameter validation for Split, Scan, GatherND, ScatterND, SpaceToDepth/DepthToSpace, Crop, Conv, Normalizer, and pooling (#29461, #31668, #32034, #32039, #32076, #32157, #32160, #32161, #32345, #32349).
• Hardened generation and attention input handling, including attention-attribute narrowing, BifurcationDetector inputs, generation subgraph shapes, and QEmbed segment inputs. BeamSearch buffer expansion now uses dynamic shape storage (#31648, #31701, #32009, #32078, #32144).
• Validated TreeEnsemble node references and bounded subtree comparison, rejected non-finite CPU RoiAlign coordinates, and required ImageScaler bias to match the channel count (#32031, #32043, #32011, #32002).
• Added an allowlist of safe LoRA adapter parameter data types, validated MatMulFpQ4 shape inputs, and checked MLAS blockwise quantization/dequantization index ranges (#31682, #32032, #32007).

GPU Bounds and Resource Lifetimes

• Hardened CUDA indexing and buffer-size arithmetic in MatMulNBits, RemovePadding, RotaryEmbedding, SparseAttention, Whisper beam search, NMS, QDQ, and GatherElements (#31643, #31994, #31995, #31996, #31998, #32014, #32029, #32030).
• Fixed overflow in CUDA reduction scans and Softmax offset arithmetic, and handled zero-sized outputs in CUDA random-generator kernels (#32137, #32330, #31997).
• Fixed CUDA MultiHeadAttention shared-cache scratch lifetimes and kept CudaAsyncBuffer staging storage alive across CUDA graph replay (#31968, #32121).
• Fixed WebGPU out-of-bounds subgroup-matrix loads for partial tiles, zero-initialized writable device-allocator buffers, and rejected foreign GPU handles in built-in data transfers (#32364, #32063, #32317).

Dependencies and Tooling

• Upgraded Protobuf to 33.6 and refreshed Python documentation dependencies, including an ONNX security-related update (#29906, #32190, #32424).
• Updated JavaScript dependencies including js-yaml, joi, fast-uri, and the Next.js end-to-end fixture (#32397, #32486, #32488, #32505, #32508).
• Pinned GitHub Actions to full-length commit SHAs and strengthened packaging infrastructure with authenticated package feeds and NPM network isolation (#32176, #32005, #32440).

New Features

Core APIs & Runtime

• Added Go bindings for the ONNX Runtime C API (#29615).
• Extended memory importing with host-pointer support and added access to preallocated outputs through KernelContext::GetPreallocatedOutput (#29726, #32089).
• Added packed-attention workspace recipes and estimates, and made workspace input-shape handling aware of optional inputs (#32283, #32321, #32312).
• Added DeepSeek Engram contrib operators, EngramGate and NGramHashMapping, and expanded kernel coverage for Qwen-3.5 operators (#32268, #32106).

... (truncated)

Commits

• f2c39fe [CUDA] Add INT4 paged KV cache with per-channel scales (#32515)
• 5894ba8 Add portable random-access file reads to Env (#32503)
• a2ee3eb Fix CUDA plugin device discovery on WSL (#32517)
• b652e59 [WebGPU] Prepack Conv weights for the im2col-matmul path (#32420)
• 0f0f29f Get rid of spurious warning about not being able to find spectre mitigation (...
• 23dd651 Register ONNX schemas only when static registration is disabled (#32353)
• 33af5d3 Release external data loaders after graph initialization (#32502)
• 2e3c24d Clarify external initializer and EP context path interaction (#32442)
• e76036b [CUDA] Pin FP8 GEMV residency for grids just past two blocks per SM (#32433)
• 82583c5 Add session option for a BNHS GroupQueryAttention Value cache layout (#32139)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions