Skip to content
This repository was archived by the owner on Mar 20, 2023. It is now read-only.

Update dependency onnx to v1.13.0 [SECURITY] #27

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update dependency onnx to v1.13.0 [SECURITY] #27

wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 18, 2023

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
onnx ==1.7.0 -> ==1.13.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-25882

Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd"

Release Notes

onnx/onnx

v1.13.0

Compare Source

ONNX v1.13.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

New operators

Operator extensions

Function updates

Reference Python runtime

Reference Python runtime dependent on only Python and numpy has been added. #​4483

Python 3.11 support

ONNX 1.13.0 supports Python 3.11. #​4490

Apple Silicon support

Support for M1/M2 ARM processors has been added. #​4642

More

ONNX 1.13.0 also comes with numerous:

  • bugfixes
  • infrastructure improvements
  • CI improvements
  • documentation updates
  • security updates

For full details see Logistics for ONNX Release 1.13.0.

Deprecation notice

  • TENSOR_TYPE_TO_STORAGE_TENSOR_TYPE has been deprecated #​4270
  • ONNXIFI: ONNX Interface for Framework Integration has been deprecated #​4431

Installation

You can upgrade to the latest release using pip install onnx --upgrade or build from source following the README instructions.

Contributors

Thanks to these individuals for their contributions in this release since last 1.12.0 release: @​AnandKri, @​cbourjau, @​jcwchen, @​gramalingam, @​garymm, @​GaetanLepage, @​ilya-lavrenov, @​jnovikov, @​JackBoosY, @​jbachurski, @​tjich, @​jantonguirao, @​justinchuby, @​natke, @​philass, @​prasanthpul, @​p-wysocki, @​SpaceIm, @​stephenneuendorffer,@​take-cheeze, @​sechkova, @​thiagocrepaldi, @​xadupre, @​mszhanyi, @​yuanyao-nv, @​andife, @​daquexian, @​kylesayrs, @​liqunfu, @​longlee0622, @​HSQ79815, @​williamberman, @​YanBC

The list has been acquired with a script written by Aaron Bockover.

v1.12.0

Compare Source

ONNX v1.12.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

Key Updates

ai.onnx opset version increased to 17 with following changes:

  • New operators (ai.onnx):
    - LayerNormalization (#​4076)
    - SequenceMap (#​3892)
    - Signal Operators: DFT, HannWindow, HammingWindow, BlackmanWindow, MelWeightMatrix, STFT (#​3741)
  • Operator Updates (ai.onnx):
    - [Scan] Remove unused type constraint I for newer Scan (opset 9+)(#​4012)

Shape inference enhancements

  • Extend InferShapes to expose result of data propagation (#​3879)
  • Update shape inference for constant of shape (#​4141)
  • Catch missing input type in function shape inference (#​4123)
  • Add shape inference for Expand using symbolic shape input (#​3789)
  • Fix Expand shape inference: stop rank inference if the shape is symbolic (#​4019)

Bug fixes and infrastructure improvements

  • Fix a bug in _get_initializer_tensors() (#​4118)
  • Fix bug of resizeShapeInference for Resize13 (#​4140)
  • Fix bug in SCE function body (#​4038)
  • Use correct pytest types in backend (#​3990) (#​3994)
  • Checker should validate the node's inputs/outputs have names when its formal parameter is Variadic (#​3979)
  • Loose NumPy requirement to grant more flexibility (#​4059)
  • Fix crash: Skip unused value_info for version_converter (#​4079)
  • Use %d for integer in version_converter (#​4182)
  • Extend parser to handle other types (#​4136)

Documentation updates

  • Add documentation about functions to IR.md (#​4180)
  • Clarify add new op documentation (#​4150)
  • Clarify NonZero behavior for scalar input in spec (#​4113)
  • Update shape inference documentation (#​4163)
  • Fix a minor typo in operator Gather documentation (#​4125)
  • Fix typo in CIPipelines.md (#​4157)
  • Fix typo in slice doc (#​4117)
  • Fix grammar in documents (#​4094)
  • Clearer description of Slice (#​3908)
  • Add OperatorSetId definition in docs (#​4039)
  • Clean up protocol buffer definitions (#​4201)
  • Change the wrong words of second layer input (#​4044)
  • Clarify that op_type is case sensitive (#​4096)

Installation

You can upgrade to the latest release using pip install onnx --upgrade or build from source following the README instructions.

Notes

  • Beware of the protobuf version gap issue (building onnx with protobuf>=3.12 is not compatible with older protobuf)

Contributors

Thanks to these individuals for their contributions in this release since last 1.11.0 release. (Contributor list obtained with: https://github.com/onnx/onnx/graphs/contributors?from=2022-02-08\&to=2022-05-24\&type=c): @​jcwchen, @​gramalingam, @​xuzijian629, @​garymm, @​diyessi, @​liqunfu, @​jantonguirao, @​daquexian, @​fdwr, @​andife, @​wschin, @​xadupre, @​xkszltl, @​snnn

v1.11.0

Compare Source

ONNX v1.11.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

Key Updates

ai.onnx opset version increased to 16 with following changes:

  • New Operators (ai.onnx):
  • Operator Updates (ai.onnx):
    • Identity, add optional type support.
    • If, add optional data type support for output.
    • LeakyRelu, add bfloat16 type support.
    • Loop, add optional data type support for initial value and output.
    • PRelu, add bfloat16 type support.
    • RoiAlign, add an attribute coordinate_transformation_mode, correct the default behavior.
    • Scan, add bfloat16 type support for output.
    • ScatterElements, add reduction attribute.
    • ScatterND, add reduction attribute.
    • Where, extend Where op to permit bfloat16 types.
    • GreaterOrEqual, add bfloat16 type support.
    • LessOrEqual, add bfloat16 type support.

ai.onnx.ml opset version increased to 3 with following changes:

New functionality:

Shape inference enhancements

  • Extend optional type inference. #​3756
  • Make shape inference handle MapProto. #​3772
  • Improve rank inference for Expand op. #​3807
  • Enhance shape inference: ParseData/Transpose/QuantizeLinear. #​3806
  • Honor existing dim_param in shape inference. #​3896
  • Shape inference for functions. #​3722
  • Use symbolic input for shape inference of ConstantOfShape. #​3784

Bug fixes and infrastructure improvements

  • Use MSVC Runtime as dll for official ONNX Windows release. #​3644
  • Simplify common version converter adapter design patterns. #​3761
  • Use scalar for OneHot's depth to prevent confusion. #​3774
  • Correct wrong subgraph test example for If operator. #​3798
  • [Dup] Add SpaceToDepth test cases. #​3786
  • Fix error in Pad op convert. #​3778
  • Fix some examples for ArgMax. #​3851
  • Shape inference should not propagate missing optional outputs. #​3815
  • Check negative index for attributes of Slice-1. #​3810
  • Cleanup type cast related warnings. #​3801
  • Replace whitelist by safelist. #​3900
  • Fix weekly/Linux CI failures: correct skip list and remove old numpy related code. #​3916
  • Fix old ConvTranspose shape inference and softmax upgrader. #​3893
  • Fix Linux i686 Release CI failure due to the latest NumPy. #​3918
  • Simplify function definition of context-dependent functions. #​3882
  • Migration to using main branch. #​3925
  • Append dim even both dim value and param are not set. #​3828
  • Bump to 10.15 in AzurePipeline because 10.14 was deprecated. #​3941
  • Six: remove all references. #​3926
  • For issue 3849 to confirm that type check is performed during checker. #​3902
  • Remove testing ort-nightly for Mac Python 3.6 due to unsupported ort-nightly. #​3953
  • Mypy: update to 0.760 and remove vendored protobuf stubs. #​3939
  • Upgrade Windows version in AzurePipeline since 2017 was dep. #​3957
  • Version converter for Softmax should not produce empty shape. #​3861
  • Fix Cppcheck warning about memset on NULL backend_ids. #​3970
  • Bug fix of extractor which misses local functions. #​3954
  • Add bfloat16 type to a few ops missing it. #​3960

Documentation updates

  • ONNX Hub Docs. #​3712
  • Clarify definition of a tensor in IR docs. #​3792
  • Document that Where supports multidirectional broadcasting. #​3827
  • Sync build documentation in CONTRIBUTING.md. #​3859
  • [CI][Doc] Add CI Pipelines doc/node tests verification. #​3780
  • Remind release manager to remove old onnx-weekly packages after release. #​3923
  • Fix the bug of shape in docs. #​3927
  • Clean up README. #​3961
  • Remove documentation about Python 2. #​3963

Installation

You can upgrade to the latest release using pip install onnx --upgrade or build from source following the README instructions.

Notes

  • Beware of the protobuf version gap issue (building onnx with protobuf>=3.12 is not compatible with older protobuf)

Additional Notes

  • ONNX will drop Python 3.6 support in next release because it has reached EOL.
  • ONNX will upgrade its NumPy version to 1.21.5 before next release to resolve vulnerability issue for old NumPy 1.16.6.
  • There will be infrastructure change to Linux packaging system to replace manylinux2010 with manylinux2014 or manylinux2.

Contributors

Thanks to these individuals for their contributions in this release since last 1.10.0 release. (Contributor list obtained with: https://github.com/onnx/onnx/graphs/contributors?from=2021-07-30\&to=2022-02-08\&type=c):
@​jcwchen, @​gramalingam, @​garymm, @​mhamilton723, @​TomWildenhain-Microsoft, @​neginraoof, @​xuzijian629, @​liqunfu, @​gwang-msft, @​chudegao, @​AlexandreEichenberger, @​rajeevsrao, @​matteosal, @​stillmatic, @​askhade, @​liuyu21, @​jantonguirao, @​shinh, @​kevinch-nv, @​shubhambhokare1, @​hwangdeyu, @​jiafatom, @​postrational, @​snnn, @​jackwish

v1.10.2

Compare Source

ONNX v1.10.2 is a patch release based on v1.10.1.

Bug fixes:

  • Fix compilation error on older compilers (#​3683)
  • Stricter check for Shape's input: check input type (#​3757)

v1.10.1

Compare Source

This release is a patch release based on v1.10.0.

Bug fix:

v1.10.0

Compare Source

ONNX v1.10.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

Key Updates

IR Updates

Opset version 15

API

Infrastructure

Bug fixes

Installation

You can upgrade to the latest release using pip install onnx --upgrade or build from source following the README instructions.

Notes

  • Beware of the protobuf version gap issue (building onnx with protobuf>=3.12 is not compatible with older protobuf)

Contributors

Thanks to these individuals for their contributions in this release:
@​jcwchen, @​askhade, @​gramalingam, @​neginraoof, @​matteosal, @​postrational, @​garymm, @​yuslepukhin, @​fdwr, @​jackwish, @​manbearian, @​etusien, @​impactaky, @​rajeevsrao, @​prasanthpul, @​take-cheeze, @​chudegao, @​mindest, @​yufenglee, @​annajung, @​hwangdeyu, @​calvinmccarter-at-lightmatter, @​ashbhandare, @​xuzijian629, @​IceTDrinker, @​mrry

v1.9.0

Compare Source

ONNX v1.9.0 is now available with exciting new features! We would like to thank everyone who contributed to this release!
You may learn more about the project, who is involved and what tools are available at the onnx.ai site.

Key Updates

Opset version 14

API

Infrastructure

Bug fixes

Installation

You can simply pip upgrade using the pip install onnx --upgrade or build from source following the instructions on Github.

Notes

  • Be aware of protobuf version gap issue (like building onnx with protobuf>=3.12 is not compatible with older protobuf)

Contributors

Thanks to these individuals for their contributions in this release:
@​jcwchen, @​askhade, @​postrational, @​etusien, @​wschin, @​prasanthpul, @​gramalingam, @​daquexian, @​BowenBao,
@​pranav-prakash, @​matteosal, @​linkerzhang, @​annajung, @​neginraoof, @​tianleiwu, @​tomdol

v1.8.1

Compare Source

This release is a patch release based on v1.8.0.

Bug fixes:

API change:
onnx.shape_inference does not throw shape_inference error now. If you want to see the shape_inference errors, please use onnx.shape_inference.infer_shapes(onnx_model, strict_mode=True).

Release:

  • Mac: The minimum supported version of MacOS has been moved from 10.9 to 10.12.
  • Pipelines: Linux and Mac release pipelines have been moved from Travis-CI under onnx/wheel_builder to GitHub Action under onnx/onnx

v1.8.0

Compare Source

ONNX v1.8 is now available with exciting enhanced features! You may learn more about the project, who is involved and what tools are available at the onnx.ai site. We would like to thank every community member for contributing to the project!

Key Updates

Opset version 13

API

Infrastructure

  • CI improvements for reliability
  • Moved to AzurePipelines to speed up runs
  • pybind11 updated to 2.6.0 to prevent segmentation fault on Windows

Bug fixes

Installation

You can simply pip upgrade using the pip install onnx --upgrade or build from source following the instructions on Github.

Notes

Contributors

Thanks to these individuals for their contributions in this release:
jcwchen, askhade, wschin, vinitra, prasanthpul, gramalingam, daquexian, rajeevnalawadi, sveta-levitan, ashbhandare, chinhuang007, KsenijaS, shinh, BowenBao, shubhambhokare1, pranav-prakash, prabhat00155, pluradj, matteosal, jackwish, Yukigaru, H1Gdev, 462630221, natke, kevinch-nv, RandySheriffH, souptc, fdwr, HectorSVC, jspisak, codemzs, yuslepukhin, linkerzhang

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant