Bump Microsoft.ML.OnnxRuntime from 1.30.0 to 1.31.0

[dependabot]

Updated Microsoft.ML.OnnxRuntime from 1.30.0 to 1.31.0.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.31.0

ONNX Runtime 1.31.0 stabilizes model-package and EPContext data APIs, improves CPU model loading and quantized MoE inference, expands device-based execution-provider selection, and strengthens model-loading and runtime reliability. These notes cover changes since ONNX Runtime 1.30.0. CUDA and WebGPU kernel updates are summarized here; detailed provider notes are covered by their separate plugin EP releases.

Highlights

• Promoted the model-package API and EPContext data callbacks to stable C and C++ APIs, with EPContext callback support added across language bindings (#​33166, #​32265).
• Reduced CPU session-initialization overhead by parallelizing eligible weight prepacking, and accelerated block-wise INT4/INT8 QMoE experts with MLAS QNBit kernels and grouped expert dispatch (#​31691, #​32644, #​32668).
• Added x86 FP16 LayerNorm/RMSNorm acceleration, Arm KleidiAI SVE2.1 FP16 GEMM support, and additional RISC-V vector kernels (#​32715, #​32670, #​32710).
• Enabled CoreML participation in device-based EP selection, including Apple Neural Engine selection through PREFER_NPU (#​31975).
• Added workspace-memory accounting and verification for constrained-memory graph partitioning, alongside broader model, graph, and tensor validation (#​31962, #​32189).

Announcements & Compatibility

• CUDA Plugin EP v0.3.0 and WebGPU Plugin EP v0.5.0 are matched with ONNX Runtime 1.31.0. For contrib-op compatibility, core and the plugin must use the same contributed-operator schemas; building both from the same ONNX Runtime revision is recommended. Schema mismatches can cause incorrect execution or crashes and may not be detected during plugin registration.
• GatherBlockQuantized behavior change: out-of-range indices now produce zero output slices across CPU, CUDA, and WebGPU for both integer and floating-point quantized formats. This deliberately differs from ONNX Gather error semantics (#​32480).
• Experimental API migration: model-package consumers should use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table. EPContext callback registration now uses stable APIs; the corresponding experimental lookup entries were removed. The stable native callback contract carries callback/state pointers, with payload limits enforced by application callbacks, bindings, or EPs rather than a native read-options policy (#​33166, #​32265).
• ACL EP is deprecated and will be removed in a future release. Source builds using --use_acl now receive a deprecation warning (#​32564).
• The ONNX dependency remains at 1.22.0. The initial ONNX 1.23 integration was reverted pending upstream fixes; this release does not ship that integration's new opset or FLOAT6 support (#​33073).
• Supported native builds now default to 1DS telemetry. Windows TraceLogging remains selectable with --use_windows_telemetry or onnxruntime_USE_WINDOWS_TELEMETRY=ON; telemetry can be disabled with --no_telemetry (#​32384).

New Features

Core APIs & Runtime

• Stabilized the model-package C and C++ APIs for loading packages, selecting compatible model variants, and creating sessions (#​33166).
• Stabilized named EPContext data read/write callbacks for application-managed storage. Added EP support negotiation so registered callbacks do not silently fall back to filesystem I/O (#​32265).
• Extended the Compile API to write external initializers and EP context data to buffers, enabling in-memory compilation workflows for models larger than 2 GB (#​31347).
• Added workspace-memory accounting, source reporting, and post-partition reservation verification. Set session.strict_workspace_verification=1 to fail initialization on workspace declaration overruns or nonzero orphaned reservations; strict verification is not supported for ORT-format model loads (#​31962, #​32189).
• Added the opt-in source-build option onnxruntime_DISABLE_DEVICE_DISCOVERY=ON to skip platform accelerator probing and report only the CPU device (#​32592).

Shared Contrib Operators

These updates affect core operator schemas and cross-provider behavior, not only the separately released GPU plugins.

• Extended EngramGate and NGramHashMapping for Qwen4-Exp, and added VarlenNGramHashMapping for packed DeepSeek Engram batching with request-local history. Packed hashing also supports Qwen4-Exp head offsets, EOS resets, and segment boundaries (#​32285, #​32358, #​32467).
• Added the activation attribute to GatedRMSNorm for SiLU, its Swish alias, and Sigmoid gating across CPU, CUDA, and WebGPU. SiLU remains the default (#​32512).
• Added weightless hyper-connection operators BranchwiseRMSNorm, ScaledSiLU, HyperConnectionPreMix, and HyperConnectionPostMix, with CPU, CUDA, and WebGPU implementations (#​32687).
• Extended GatherBlockQuantized to FP8/FP4 data, full-axis blocks, and scale broadcasting, and improved CPU UINT8 dequantization. See the out-of-range-index behavior change above (#​32480, #​32621).

Plugin Execution Provider Infrastructure

• Added support for statically linked plugin EPs, with a static WebGPU plugin build configuration (#​32395).
• Preserved caller streams in single-tensor plugin data transfers and handled null plugin allocator returns (#​32666, #​32683).
• Deduplicated AutoEP custom-op domains and corrected EP assignment reporting after NHWC layout transformation (#​32711, #​33184).
• Added reference guidance for compiled-model compatibility validation, including multi-device scenarios (#​29168).

Execution Provider Updates

CUDA EP

CUDA updates include sparse attention and packed continuous batching, expanded paged speculative decoding, INT2 and mixed-width QMoE execution, opt-in MatMul auto-tuning, improved MXFP4 support on Blackwell consumer GPUs, and reliability fixes.
... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR updates Microsoft.ML.OnnxRuntime from 1.30.0 to 1.31.0 in the shared library.

Example: Preview a downloaded Piper voice with the text "Hello from OpenClaw".

• Before: The bundled native speech stack uses ONNX Runtime 1.30.0.
• After: The stack uses ONNX Runtime 1.31.0, with local speech behavior expected to remain unchanged.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The version edit is coherent, but required final-effect privacy evidence is absent.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Maintenance · Worth it: Yes
User problem: Users depend on a supported, reliable native runtime for local speech.
Reason: The conventional one-line update follows prior merged dependency maintenance and adds no application option or public API.

Merge readiness

⛔ Blocked before merge - 3 items remain

This PR remains useful because main and the latest release still use 1.30.0; no concrete introduced defect was established.

Priority: P2
Reviewed head: 18c4f7a5c4c8ccc8130e7909c8fdef91fb465dfb

Before merge

• Add real behavior proof - Authority-chain proof required: identify the restored Windows native backend and show local speech produces no unauthorized Microsoft collector traffic with diagnostics disabled, including after clearing an endpoint and restarting with any pending native uploads; configured diagnostics must remain limited to the user's collector. Ordinary contributor proof is exempt for this bot PR, but that exemption does not settle the privacy boundary. Redact addresses, credentials, and non-public endpoints. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve security concern: Verify the native collector respects user consent - Upstream 1.31.0 can initialize an enabled Microsoft uploader, while this application supplies no native suppression. Windows packaging can select another backend, so this is a material uncertainty rather than a proven introduced leak.
• Resolve merge risk - The restored 1.31.0 native DLL's telemetry backend is unresolved; a 1DS-enabled artifact could upload diagnostics to Microsoft without the user's configured endpoint or consent.

Findings

• [medium] Verify the native collector respects user consent — src/OpenClaw.Shared/OpenClaw.Shared.csproj:24

Tests

• Missing end-to-end proof: Missing package-specific desktop evidence showing local speech inference and collector behavior with diagnostics disabled and after clearing a previously configured endpoint.

Agent review details

How this fits together

The shared package supplies managed ONNX inference and native libraries used by the speech stack; models and input tensors produce speech probabilities or synthesized audio, while current microphone capture uses managed energy detection.

flowchart LR
 A[NuGet package reference] --> B[Shared library]
 B --> C[ONNX managed and native runtime]
 C --> D[Silero model inference]
 C --> E[Piper native speech engine]
 E --> F[Local audio playback]

Loading

Technical review

Best possible solution:

Land the narrow dependency update with native telemetry suppressed or verified to preserve the existing privacy contract.

Do we have a high-confidence way to reproduce the issue?

This dependency-maintenance PR reports no application bug; source inspection establishes the version change but does not reproduce unintended telemetry from the shipped artifact.

Is this the best way to solve the issue?

Updating the existing reference is the narrowest maintenance path, provided the native runtime preserves local speech and the telemetry privacy boundary.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 817b0b586c1e.

Merge-risk options

Maintainer options:

1. Resolve native telemetry behavior (recommended)
   Identify the restored Windows DLL's backend and preserve the application's opt-in, configured-endpoint privacy boundary before landing.
2. Hold the update
   Retain 1.30.0 while package-specific telemetry behavior remains unresolved.

Provenance checked

• ONNX Runtime package version keeps the original intent (273b018: The preceding merged dependency update moved the same reference to 1.30.0: Bump Microsoft.ML.OnnxRuntime from 1.29.0 to 1.30.0 #1417.)

Testing

Proof path: unit tests only.

Security

Needs attention: The native telemetry privacy boundary needs package-specific verification.

Evidence

Security concerns:

• [medium] Verify the native collector respects user consent — src/OpenClaw.Shared/OpenClaw.Shared.csproj:24
  Upstream 1.31.0 can initialize an enabled Microsoft uploader, while this application supplies no native suppression. Windows packaging can select another backend, so this is a material uncertainty rather than a proven introduced leak.
  Confidence: 0.94

What I checked:

• Verified introduced change: The pinned introduction diff changes only the existing package version; it adds no feed, workflow, permission, or application code. (src/OpenClaw.Shared/OpenClaw.Shared.csproj:24, 18c4f7a5c4c8)
• Not implemented on main or released: Fetched main and release v2026.9.8-1 both reference 1.30.0. (src/OpenClaw.Shared/OpenClaw.Shared.csproj:24, 817b0b586c1e)
• Dependency contract applies: VoiceActivityDetector directly imports ONNX Runtime and constructs an InferenceSession, establishing an affirmative dependency-contract signal; Piper also constructs the native Sherpa OfflineTts engine. (src/OpenClaw.Shared/Audio/VoiceActivityDetector.cs:49, 18c4f7a5c4c8)
• Privacy contract: Telemetry documentation requires export disabled by default and restricted to the user-configured endpoint; repository searches found no native ORT telemetry suppression. (docs/TELEMETRY.md:9, 18c4f7a5c4c8)
• Native telemetry behavior: At v1.31.0, OneDsTelemetry starts enabled and initializes a Microsoft collector unless suppression applies; upstream explicitly changed supported native builds to default to 1DS in [Telemetry] Default native builds to 1DS microsoft/onnxruntime#32384. (onnxruntime/core/platform/telemetry_1ds.cc:74, 402979ac1bef)
• Package backend remains uncertain: The Windows packaging helper selects no telemetry, Windows TraceLogging, or default 1DS depending on build inputs; source defaults alone do not identify the restored NuGet DLL's backend. (tools/ci_build/github/windows/set_telemetry_var.ps1:13, 402979ac1bef)

Likely related people:

• Régis Brid: Raw commit b0ba9af adds src/OpenClaw.Shared/Audio/VoiceActivityDetector.cs:49 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: b0ba9affa25d; files: src/OpenClaw.Shared/Audio/VoiceActivityDetector.cs)
• Steve Allen: Raw commit 5aff6f7 adds tests/OpenClaw.Tray.Tests/NativeSpeechStackRuntimeTests.cs:49 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 5aff6f799e9b; files: tests/OpenClaw.Tray.Tests/NativeSpeechStackRuntimeTests.cs)

Labels

Label changes:

• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 📣 needs proof.

Label justifications:

• P2: Focused dependency maintenance has a concrete privacy uncertainty but no established urgent user regression.
• merge-risk: 🚨 security-boundary: Upstream defaults native builds to an enabled Microsoft collector, while the restored artifact's backend and preservation of user consent remain unverified.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Provide package-specific desktop network evidence that disabling diagnostics, including clearing a previously configured endpoint, prevents native Microsoft uploads before and after shutdown and restart.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (1 earlier review cycle)

• reviewed 2026-10-12T18:23:19.673Z sha 18c4f7a :: blocked before merge. :: none

Reviewed October 14, 2026, 12:37 AM ET / 04:37 UTC (Revision 2).

[vincentkoc]

Package-specific review evidence for head 18c4f7a5c4c8ccc8130e7909c8fdef91fb465dfb:

The Windows DLLs in the official Microsoft.ML.OnnxRuntime 1.31.0 NuGet package select the Windows ETW/TraceLogging backend, not the new 1DS network uploader. I inspected the actual decompressed PE files from the official package, whose nuspec records upstream commit 402979ac1bef89dcd55add41eaa7277c407599eb.

Native asset	SHA-256
runtimes/win-x64/native/onnxruntime.dll	0c42dc4e278f0968fdf9ebf1b1e54a74c657a9942e70803e453c91993451cf4c
runtimes/win-arm64/native/onnxruntime.dll	b6da671624bce049c13c34a3b48b7ddfd1b521dbf07d20e83ff9af4441110641

Both import EventWriteTransfer, EventRegister, EventSetInformation, and EventUnregister; contain TraceLogging, Microsoft.ML.ONNXRuntime, and ORT_RUNNING_UNIT_TESTS; and lack the 1DS collector endpoint, OneCollector, and LogManager strings. Their imported DLL lists contain no WinHTTP or WinINet library. These observations match the Windows telemetry implementation, not telemetry_1ds.cc. The CMake selection and Windows packaging selector distinguish these backends explicitly.

I also inspected the preceding 1.30.0 package: both Windows DLLs have the same ETW markers and lack the same 1DS markers. Its x64 SHA-256 is 7e39e2bdbba836d98071ef28620735ba36a47c554cf794585269aecc50fab0da; ARM64 is 46b7ec24a6ee2932bb315edb39d26d6b2d51eef21f02c8e1ceafe801fe991a89. This update therefore does not introduce the suspected Windows 1DS uploader or change that backend selection.

This is native-artifact and source proof, not a packet-capture claim. ETW is Windows-owned diagnostics; any broader audit of its existing consent policy is a separate follow-up. The rank-up request to clear a configured endpoint and inspect pending 1DS uploads does not exercise the absent 1DS backend in these Windows assets. No speculative suppression setting or application behavior change has been added.

The one failed-only CI rerun is attempt 2 of the exact-head run. The run completed successfully: Core/CLI, Functional UI, Tray UI, accessibility, and the aggregate CI gate all passed. No release, tag, or package publication has been requested.