[dependabot]

Bumps the python-minor group with 2 updates: openadapt-flow and onnxruntime.

Updates openadapt-flow from 2.1.0 to 2.3.0

Release notes

Sourced from openadapt-flow's releases.

openadapt-flow 2.3.0

The shared contracts are back in openadapt-types, which depends only on Pydantic; this package requires openadapt-types>=0.24.0,<0.25.0, and openadapt_flow.contracts returns the same modules as openadapt_types (#1270).

Features

• Offline Seals can be signed with a key the customer holds: a key file, the OS keychain, or a PKCS#11 token. local-seal key creates, pins and revokes keys, and a configured key that can't be used signs nothing (#1392).
• local-seal anchor records an offline Seal in Sigstore Rekor. Only a digest, the Seal key's public key and a signature leave the machine, and local-seal verify --require-anchor checks the stored inclusion proof offline (#1394).
• Run authorizations (openadapt.run-authorization/v1) are signed with the SSH key a person publishes on GitHub. local-seal authorize sign shows what is being authorized before it signs, verification runs offline, and --live re-reads the person's keys from GitHub. local-seal run --authorization seals only the items, profile and Seal keys the statement covers (#1401).
• local-seal timestamp adds an RFC 3161 timestamp from Sigstore's TSA (or --tsa-url) to a Seal or a run authorization, and verify --require-timestamp checks it offline against the bundled TSA root (#1401).
• local-seal profile writes an operator profile per Seal key: outcome counts, apps, programs and log times from anchored Seals, with no patient data. A report sealed again counts once (#1401, #1416).
• Session tokens, credential headers and bearer tokens are redacted from run reports before they are written, so no Seal covers them. The Seal refuses an unredacted report, and openadapt-flow redact-report cleans runs written earlier (#1407).
• The compiler groups every program into named sections (sections.json) from the consequential write, the recorded form structure and the fields, with no model call (#1405). openadapt_flow.visualize projects a bundle into the program map that Desktop and openadapt.ai render (#1387).
• openadapt-flow compile-agent compiles an agent's first verified run into a program that replays with zero model calls, on browser, Windows, macOS, Linux, RDP and Citrix apps, with a code-as-action agent for run 1 (#1277, #1283, #1305, #1303).
• Every teach path (JIT capture, compile-agent, teach over MCP and the guard) runs under the task's declared inputs, origins and writes, and a violation leaves no draft (#1359, #1386). An approval shows who asked for a save, the agent's own reason, the screen text it saw, and any of it that reads like an instruction to an agent (#1359).
• The MCP server can teach a workflow and then call it with no model calls (#1335), keeps a task ledger and can ask the user (#1332), and pins authoring to the app a deployment file names (#1287).
• A guarded save wraps any agent's write: check the record, hold for approval, read back (#1258). A CDP commit guard covers an agent you already run (#1357).
• JIT: a person names the record check's idempotency key at confirm_params (#1339); a retyped input is lifted from the saved record, and distill drops a corrected save (#1336).
• API steps: a clean save in a recording's network capture compiles into an API step with the same record check, and falls back to page structure before anything is sent when the API is unavailable (#1269). API steps run in durable runs without ever resending a save (#1358), under governed runs and the Standard and Regulated profiles (#1361), and under per-item approval of the exact request (#1355); the read-back is pipelined (#1362).
• Self-repair: a halted run can be repaired under one person's approval (#1265), including with a short bridge of up to three new steps (#1325); repairs a person approved in advance apply as standard changes (#1294); and every stop that wrote nothing is repaired by default (#1360).
• After a stop: a change ledger, a write-ordering lint and declared undo steps (#1263). openadapt-flow undo propose proposes an undo for each save and keeps it only if a test copy shows every record restored; a person approves it once with undo accept (#1346).
• Record checks: scaffold-verifier builds a working check from the reads the app made while the person viewed the saved record (#1284); the recording teaches the check when the person looks the record up after saving (#1290); a desktop, RDP or Citrix save is checked by looking the record up in a separate read-only session (#1280), with a fresh session for desktop relaunch and a second RDP session (#1241); a check level per save, a learned reopen, a read-only guard and reference capture (#1239).
• A save confirmed by a later report or acknowledgment is SAVED_AWAITING_CHECK and never counts as done until then (#1297). The receipt keeps the server's own answer to a save, labelled same_screen (#1298), and signs checked_how (#1240). verify-run treats a changed non-target record as collateral, not only a vanished one (#1375).
• Identity: extra looks before stopping on a look-alike record ID (fresh frames, the known-ID list, a select-and-copy of the ID) (#1333); a hover check on icon-only targets and a fresh-frame re-check right before every pixel click (#1334); one re-observation before halting on an identity mismatch (#1293).
• Learning from many runs: shadow-mined episodes become candidate drafts, and a program admitted once stops only on problems (#1212); induce --probe-on settles a disagreement between recordings on a browser, desktop or remote test copy (#1276); a deterministic router sends each item to the right admitted variant (#1264); narration proposes branch rules that recordings, a probe or a person certify (#1291); common local edits are classified from the recording on strict evidence (#1366).
• One program switches tabs, popups and backends mid-run (#1197); lists and worktables are walked with focus and modal checks before each copy (#1253); worklists run in parallel with one session per worker (#1296).
• Records: READ is a workflow step (#1229), with a record and field schema (#1214), an interchange format (#1215), one read channel by default with an opt-in double read (#1218), a review queue with signed, write-once decisions (#1219), and export to CSV, DB-API databases and webhooks (#1220).
• Everything that leaves the machine is scrubbed by default (#1262), and every PHI file is encrypted at rest under one sealed index (#1354).
• The phone approval shows the values a save writes (#1257).
• A qualification project can bind to the generic web environment observer (observe_web_environment), whose digest is the one a governed browser run on the same machine observes (#1353).
• A compatibility matrix, checked against the runtime in CI (#1364).
• Harness²: a benchmark adapter scored by read-back, GUI rollouts on pixel-only surfaces, and a Meta-Harness-style trace export (#1299, #1301, #1300, #1304).

Performance

• Apple Vision identity reads match RapidOCR on the dense surface (#1228).

Fixes

• In a governed run, an armed step whose identity is unreadable halts before acting, whether or not the authorization lists it (#1397).
• A scroll skipped because its target was already in view verifies instead of counting as undelivered (#1395).
• Bundles certified by earlier releases load and keep their workflow contract hash: an effect's forbid_collateral_change is serialized only when it is on (#1406).
• A bad local-seal input (missing, empty, not JSON, repeated keys, the wrong shape, or a saved web page) fails in one clear line with exit 2, never a traceback (#1401).
• Next-step hints repeat the uvx form when Flow runs from a uvx environment, so they reach the same version (#1404).
• API steps: secrets and tokens in JSON bodies and headers are withheld from network capture (#1367); fields bind by the step that typed them, not by equal values (#1368); record identifiers in URLs stay run parameters (#1369); a step whose span also wrote is refused (#1370); native form validation is enforced (#1371); an API step binds to the complete definition of the steps it replaces (#1372).
• A relabelled Save halts on the Save, not on the scroll before it (#1337); a self-closing popup click counts as delivered only when the step expects it (#1321).
• Pixel-path replays keep running across display scaling and ClearType (#1286); emit, serve-execute, bench and resume no longer assume a browser (#1285).
• The durable authority database is created owner-only before SQLite opens it (#1363).
• The agent CLI help states the approval-mode default and the agent approval tools (#1238).

openadapt-flow 2.2.0

... (truncated)

Changelog

Sourced from openadapt-flow's changelog.

CHANGELOG

v1.18.0 (2026-10-20)

Breaking Changes

• Require openadapt-flow 2.2 (>=2.2.0,<3.0.0). The quickstart uses Flow's offline Seals, shared browser and OCR prewarm, and openadapt pull uses openadapt-flow pull; none of these are in Flow 2.0 or 2.1. openadapt doctor and openadapt deploy report an older Flow as unsupported.

Features

• openadapt quickstart is three short acts: show the task in the synthetic clinic app and compile it, run the program on five new notes at once, then make one save fail silently and watch the run stop. It ends with one receipt card, the command to check its Seal, and two next steps (#1408).
• When an older openadapt comes first on PATH, the quickstart names it and gives the fix. Under uvx it also says how to keep the installed version (#1408).
• openadapt pull downloads a packaged workflow from the registry, and openadapt pull --list shows what is available (#1173).

Fixes

• Next-step hints repeat the uvx form when the launcher runs from a uvx environment, so they reach the same version (#1404).
• The quickstart describes the failing run as a save that didn't reach the record (#1236), and openadapt agent serve help shows --bundles DIR --mode production (#1238).
• CLI help and built-in links point at the docs glossary and the monorepo (#1200).

v1.17.0 (2026-10-15)

Breaking Changes

• Require openadapt-flow 2 (>=2.0.0,<3.0.0). Flow 2 gates every run that saves anything for approval by default; opt out with --approval-mode not_gated or runtime.approval_mode: not_gated.

Features

• openadapt seal verify <file|url> checks an OpenAdapt Execute Seal

... (truncated)

Commits

• See full diff in compare view

Updates onnxruntime from 1.20.1 to 1.31.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.31.0

ONNX Runtime 1.31.0 stabilizes model-package and EPContext data APIs, improves CPU model loading and quantized MoE inference, expands device-based execution-provider selection, and strengthens model-loading and runtime reliability. These notes cover changes since ONNX Runtime 1.30.0. CUDA and WebGPU kernel updates are summarized here; detailed provider notes are covered by their separate plugin EP releases.

Highlights

• Promoted the model-package API and EPContext data callbacks to stable C and C++ APIs, with EPContext callback support added across language bindings (#33166, #32265).
• Reduced CPU session-initialization overhead by parallelizing eligible weight prepacking, and accelerated block-wise INT4/INT8 QMoE experts with MLAS QNBit kernels and grouped expert dispatch (#31691, #32644, #32668).
• Added x86 FP16 LayerNorm/RMSNorm acceleration, Arm KleidiAI SVE2.1 FP16 GEMM support, and additional RISC-V vector kernels (#32715, #32670, #32710).
• Enabled CoreML participation in device-based EP selection, including Apple Neural Engine selection through PREFER_NPU (#31975).
• Added workspace-memory accounting and verification for constrained-memory graph partitioning, alongside broader model, graph, and tensor validation (#31962, #32189).

Announcements & Compatibility

• CUDA Plugin EP v0.3.0 and WebGPU Plugin EP v0.5.0 are matched with ONNX Runtime 1.31.0. For contrib-op compatibility, core and the plugin must use the same contributed-operator schemas; building both from the same ONNX Runtime revision is recommended. Schema mismatches can cause incorrect execution or crashes and may not be detected during plugin registration.
• GatherBlockQuantized behavior change: out-of-range indices now produce zero output slices across CPU, CUDA, and WebGPU for both integer and floating-point quantized formats. This deliberately differs from ONNX Gather error semantics (#32480).
• Experimental API migration: model-package consumers should use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table. EPContext callback registration now uses stable APIs; the corresponding experimental lookup entries were removed. The stable native callback contract carries callback/state pointers, with payload limits enforced by application callbacks, bindings, or EPs rather than a native read-options policy (#33166, #32265).
• ACL EP is deprecated and will be removed in a future release. Source builds using --use_acl now receive a deprecation warning (#32564).
• The ONNX dependency remains at 1.22.0. The initial ONNX 1.23 integration was reverted pending upstream fixes; this release does not ship that integration's new opset or FLOAT6 support (#33073).
• Supported native builds now default to 1DS telemetry. Windows TraceLogging remains selectable with --use_windows_telemetry or onnxruntime_USE_WINDOWS_TELEMETRY=ON; telemetry can be disabled with --no_telemetry (#32384).

New Features

Core APIs & Runtime

• Stabilized the model-package C and C++ APIs for loading packages, selecting compatible model variants, and creating sessions (#33166).
• Stabilized named EPContext data read/write callbacks for application-managed storage. Added EP support negotiation so registered callbacks do not silently fall back to filesystem I/O (#32265).
• Extended the Compile API to write external initializers and EP context data to buffers, enabling in-memory compilation workflows for models larger than 2 GB (#31347).
• Added workspace-memory accounting, source reporting, and post-partition reservation verification. Set session.strict_workspace_verification=1 to fail initialization on workspace declaration overruns or nonzero orphaned reservations; strict verification is not supported for ORT-format model loads (#31962, #32189).
• Added the opt-in source-build option onnxruntime_DISABLE_DEVICE_DISCOVERY=ON to skip platform accelerator probing and report only the CPU device (#32592).

Shared Contrib Operators

These updates affect core operator schemas and cross-provider behavior, not only the separately released GPU plugins.

• Extended EngramGate and NGramHashMapping for Qwen4-Exp, and added VarlenNGramHashMapping for packed DeepSeek Engram batching with request-local history. Packed hashing also supports Qwen4-Exp head offsets, EOS resets, and segment boundaries (#32285, #32358, #32467).
• Added the activation attribute to GatedRMSNorm for SiLU, its Swish alias, and Sigmoid gating across CPU, CUDA, and WebGPU. SiLU remains the default (#32512).
• Added weightless hyper-connection operators BranchwiseRMSNorm, ScaledSiLU, HyperConnectionPreMix, and HyperConnectionPostMix, with CPU, CUDA, and WebGPU implementations (#32687).
• Extended GatherBlockQuantized to FP8/FP4 data, full-axis blocks, and scale broadcasting, and improved CPU UINT8 dequantization. See the out-of-range-index behavior change above (#32480, #32621).

Plugin Execution Provider Infrastructure

• Added support for statically linked plugin EPs, with a static WebGPU plugin build configuration (#32395).
• Preserved caller streams in single-tensor plugin data transfers and handled null plugin allocator returns (#32666, #32683).
• Deduplicated AutoEP custom-op domains and corrected EP assignment reporting after NHWC layout transformation (#32711, #33184).
• Added reference guidance for compiled-model compatibility validation, including multi-device scenarios (#29168).

Execution Provider Updates

CUDA EP

... (truncated)

Commits

• 402979a Revert "Bump version to 1.32.0 (#33197)" (#33212)
• 660125b [Compile API] Add support for writing external initializers and EP context to...
• 06cab16 Update parameterized requirement from >=0.8.1 to >=0.9.0 (#33022)
• 864d871 Fix isolated provider tests in Windows GPU CI (#33203)
• 1744702 Bump baseline-browser-mapping from 2.10.31 to 2.11.26 in /js/react_native/e2e...
• be3b8e8 Fix complex STFT window handling (#33136)
• 40a7167 [CPU] Avoid degenerate GQA FlashAttention tiles when L2 cache size is unknown...
• 430f563 Fix EP assignment reporting after NHWC layout transformation (#33184)
• 26ab6c7 Improve GQA shared-cache and sliding-window handling (#33175)
• d8024cd Improve CUDA RMSNorm reduction and aligned half2 output (#33178)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions