Skip to content

build(deps): bump the runtime group with 4 updates - #45

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-9e1807e9f0
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-9e1807e9f0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the runtime group with 4 updates: @aws-sdk/client-s3, @aws-sdk/s3-request-presigner, dexie and onnxruntime-web.

Updates @aws-sdk/client-s3 from 3.1026.0 to 3.1130.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1130.0

3.1130.0(2026-09-10)

New Features
  • clients: update client endpoints as of 2026-09-10 (96951f65)
  • client-outposts: Added fields to identify Outpost generation and rack scaling configuration on Outpost and CatalogItem resources. (d6ec7dce)
  • client-resiliencehubv2: This release adds the ListTestRunSourceEvents and ListTestRunDependencies APIs, which return the alarm state changes during a test run and the dependencies the run blocked. (b918658d)
  • client-bedrock-agent: TwelveLabs Marengo 3.0 is now an embedding model option in Amazon Bedrock Managed Knowledge Base. Create multimodal embeddings for video, audio, and image content that capture visual scenes, speech, and video cues, not just transcribed text. (2671d465)
  • client-ec2: The CreateImage API now supports a BootModeOverride parameter to explicitly set UEFI boot mode on a new AMI, overriding the source instance's inherited boot mode. (c47027fb)
  • client-sagemaker: This release adds the ability for customers to attach customer owned Elastic Network Interfaces (ENIs) to HyperPod cluster nodes. (a7414730)
  • client-rtbfabric: AWS RTB Fabric now lets you control how traffic is routed to your responder gateway across Availability Zones. Set the new clientRoutingPolicy parameter to keep traffic within the same Availability Zone or distribute traffic across all Availability Zones. (e3d270a9)

For list of updated packages, view updated-packages.md in assets-3.1130.0.zip

v3.1129.0

3.1129.0(2026-09-09)

New Features
  • client-elementalinference: This release adds contextual metadata, a feed output type that generates a descriptive summary of your media content along with IAB taxonomy and GARM suitability classifications. It also adds feed resource policies for granting cross-account access to a feed. (249639c6)
  • client-connect: Add metric configuration field to evaluation forms and ListEvaluationFormAIVersions API for retrieving AI-generated evaluation form versions (abf73c4a)
  • client-ec2: This release adds support for sharing Amazon EBS volumes across AWS accounts using AWS Resource Access Manager (RAM). Consuming accounts can view shared volume metadata and create copies of shared volumes within the same Availability Zone, with optional re-encryption using their own KMS key. (2fd8923f)
  • client-mediapackagev2: Dynamic Multiview enables viewers to watch multiple live video streams in a single combined output. Viewers can select from 6 preset tiled layouts. Create MediaPackage channels with Input Type MULTIVIEW and configure Available Layouts and Available Sources. See the API Documentation for details. (db6626ce)
  • client-pcs: This release adds support for custom Gres.conf configuration and Slurm version 26.05 in AWS PCS. Customers can now specify generic resource (GRES) settings to control how GPUs and other resources are configured and shared on their compute node groups. (dd8afaa5)
  • client-lambda: Updates documentation for lambda function timeout. (f268e066)
  • client-mediatailor: Added the AWS Service Request function type for MediaTailor Functions, enabling authenticated requests to AWS Elemental Inference for contextual ad targeting during ad insertion. (92f39ade)
  • client-medialive: MediaLive now supports Manual Style Control for vertical caption positioning in TTML, WebVTT, and Embedded captions, Contextual Metadata Enrichment via Elemental Inference, and an Output Usage field on MediaPackage v2 for Dynamic Multiview validation. (a546f70b)
  • dynamic-client: create untyped clients from Smithy JSON AST (#8270) (4334050c)

For list of updated packages, view updated-packages.md in assets-3.1129.0.zip

v3.1128.0

3.1128.0(2026-09-08)

New Features
  • clients: update client endpoints as of 2026-09-08 (bdcc40a7)
  • client-ec2: Adds the InterfaceTypes field to NetworkCardInfo in the DescribeInstanceTypes response. This field identifies the network interface types supported by each network card. (9336e689)
  • client-appflow: Amazon AppFlow now supports key pair (RSA private key) authentication for the Snowflake connector. You can provide a privateKey in SnowflakeConnectorProfileCredentials, and password is no longer required. This is a non-breaking, additive change available via the AWS SDK and CLI. (ec8753ad)
  • client-sagemaker: Add support for InstancePreferences list for multiple instance type input support on SageMaker Training and Processing (45153f6c)
  • client-cloudtrail: Adds support for the RecursiveLogging trail setting, which suppresses recursive events generated when CloudTrail delivers logs to a trail's destinations. (62a43c78)
  • client-s3: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (8b589875)
  • client-s3-control: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (5765b68b)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1130.0 (2026-09-10)

Note: Version bump only for package @​aws-sdk/client-s3

3.1129.0 (2026-09-09)

Note: Version bump only for package @​aws-sdk/client-s3

3.1128.0 (2026-09-08)

Features

  • client-s3: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (8b58987)

3.1127.0 (2026-09-04)

Note: Version bump only for package @​aws-sdk/client-s3

3.1126.0 (2026-09-03)

Note: Version bump only for package @​aws-sdk/client-s3

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/client-s3

... (truncated)

Commits

Updates @aws-sdk/s3-request-presigner from 3.1026.0 to 3.1130.0

Release notes

Sourced from @​aws-sdk/s3-request-presigner's releases.

v3.1130.0

3.1130.0(2026-09-10)

New Features
  • clients: update client endpoints as of 2026-09-10 (96951f65)
  • client-outposts: Added fields to identify Outpost generation and rack scaling configuration on Outpost and CatalogItem resources. (d6ec7dce)
  • client-resiliencehubv2: This release adds the ListTestRunSourceEvents and ListTestRunDependencies APIs, which return the alarm state changes during a test run and the dependencies the run blocked. (b918658d)
  • client-bedrock-agent: TwelveLabs Marengo 3.0 is now an embedding model option in Amazon Bedrock Managed Knowledge Base. Create multimodal embeddings for video, audio, and image content that capture visual scenes, speech, and video cues, not just transcribed text. (2671d465)
  • client-ec2: The CreateImage API now supports a BootModeOverride parameter to explicitly set UEFI boot mode on a new AMI, overriding the source instance's inherited boot mode. (c47027fb)
  • client-sagemaker: This release adds the ability for customers to attach customer owned Elastic Network Interfaces (ENIs) to HyperPod cluster nodes. (a7414730)
  • client-rtbfabric: AWS RTB Fabric now lets you control how traffic is routed to your responder gateway across Availability Zones. Set the new clientRoutingPolicy parameter to keep traffic within the same Availability Zone or distribute traffic across all Availability Zones. (e3d270a9)

For list of updated packages, view updated-packages.md in assets-3.1130.0.zip

v3.1129.0

3.1129.0(2026-09-09)

New Features
  • client-elementalinference: This release adds contextual metadata, a feed output type that generates a descriptive summary of your media content along with IAB taxonomy and GARM suitability classifications. It also adds feed resource policies for granting cross-account access to a feed. (249639c6)
  • client-connect: Add metric configuration field to evaluation forms and ListEvaluationFormAIVersions API for retrieving AI-generated evaluation form versions (abf73c4a)
  • client-ec2: This release adds support for sharing Amazon EBS volumes across AWS accounts using AWS Resource Access Manager (RAM). Consuming accounts can view shared volume metadata and create copies of shared volumes within the same Availability Zone, with optional re-encryption using their own KMS key. (2fd8923f)
  • client-mediapackagev2: Dynamic Multiview enables viewers to watch multiple live video streams in a single combined output. Viewers can select from 6 preset tiled layouts. Create MediaPackage channels with Input Type MULTIVIEW and configure Available Layouts and Available Sources. See the API Documentation for details. (db6626ce)
  • client-pcs: This release adds support for custom Gres.conf configuration and Slurm version 26.05 in AWS PCS. Customers can now specify generic resource (GRES) settings to control how GPUs and other resources are configured and shared on their compute node groups. (dd8afaa5)
  • client-lambda: Updates documentation for lambda function timeout. (f268e066)
  • client-mediatailor: Added the AWS Service Request function type for MediaTailor Functions, enabling authenticated requests to AWS Elemental Inference for contextual ad targeting during ad insertion. (92f39ade)
  • client-medialive: MediaLive now supports Manual Style Control for vertical caption positioning in TTML, WebVTT, and Embedded captions, Contextual Metadata Enrichment via Elemental Inference, and an Output Usage field on MediaPackage v2 for Dynamic Multiview validation. (a546f70b)
  • dynamic-client: create untyped clients from Smithy JSON AST (#8270) (4334050c)

For list of updated packages, view updated-packages.md in assets-3.1129.0.zip

v3.1128.0

3.1128.0(2026-09-08)

New Features
  • clients: update client endpoints as of 2026-09-08 (bdcc40a7)
  • client-ec2: Adds the InterfaceTypes field to NetworkCardInfo in the DescribeInstanceTypes response. This field identifies the network interface types supported by each network card. (9336e689)
  • client-appflow: Amazon AppFlow now supports key pair (RSA private key) authentication for the Snowflake connector. You can provide a privateKey in SnowflakeConnectorProfileCredentials, and password is no longer required. This is a non-breaking, additive change available via the AWS SDK and CLI. (ec8753ad)
  • client-sagemaker: Add support for InstancePreferences list for multiple instance type input support on SageMaker Training and Processing (45153f6c)
  • client-cloudtrail: Adds support for the RecursiveLogging trail setting, which suppresses recursive events generated when CloudTrail delivers logs to a trail's destinations. (62a43c78)
  • client-s3: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (8b589875)
  • client-s3-control: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (5765b68b)

... (truncated)

Changelog

Sourced from @​aws-sdk/s3-request-presigner's changelog.

3.1130.0 (2026-09-10)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1129.0 (2026-09-09)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1128.0 (2026-09-08)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1127.0 (2026-09-04)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1126.0 (2026-09-03)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1124.0 (2026-09-01)

... (truncated)

Commits

Updates dexie from 4.4.2 to 4.4.6

Release notes

Sourced from dexie's releases.

Dexie v4.4.6

This is a maintenance release that improves schema synchronization in dexie-cloud-addon, fixes an issue with updating hooks in the minified production bundle, fixes filtered chunked exports in dexie-export-import, and adds OAuth provider types for Facebook, LinkedIn, and Discord.

Related Package Releases

Package Version
dexie 4.4.6
dexie-cloud-addon 4.4.15
dexie-react-hooks 4.4.0+ (no change)
y-dexie 4.4.0+ (no change)
dexie-export-import 4.4.1

Bug Fixes

dexie@4.4.6

  • fix: keep updating-hook modifications intact in minified production bundles — Multiple updating-hook subscribers now reliably receive the record modifications object when using the minified production build. (#2333, fixes #2330). Contributed by @​Tyagiquamar.

dexie-cloud-addon@4.4.15

  • fix: resync tables added to the schema — Tables that are new to a client are now detected by comparing the declared cloud schema with the schema persisted from earlier syncs. They are marked for an initial synchronization so their current contents are full-loaded, while pending sync state is preserved until completion is acknowledged by the server. (#2332, fixes dexie-cloud#205).

  • feat: include additional social provider types — Added Facebook, LinkedIn, and Discord to OAuthProviderInfo. (#2327).

dexie-export-import@4.4.1

  • fix: avoid trailing commas in filtered chunked exportsexportDB() no longer produces invalid JSON when a later chunk contains no rows matching the active filter. (#2328, fixes #1070). Contributed by @​buildwithakhila.

Thanks to @​Tyagiquamar and @​buildwithakhila for their contributions.

Dexie v4.4.5

This is a maintenance release that fixes an issue with indexes named after inherited Object properties and improves authentication recovery in dexie-cloud-addon.

Related Package Releases

Package Version
dexie 4.4.5
dexie-cloud-addon 4.4.14+
dexie-react-hooks 4.4.0+ (no change)
y-dexie 4.4.0+ (no change)
dexie-export-import 4.4.0+ (no change)

Bug Fixes

dexie@4.4.5

  • fix: don't crash when an index is named constructor — Tables with a primary key or index named constructor could cause db.open() to fail with TypeError: indexList.push is not a function. The internal index lookup now uses an object without a prototype, avoiding collisions with inherited Object.prototype properties such as constructor, toString, and valueOf. (#2325, fixes #1920). Contributed by @​tarann26.

... (truncated)

Commits
  • adc6f50 dexie@4.4.6
  • 22798e9 Remove package-lock files. We're using pnpm!
  • 58d1afe dexie-export-import@4.4.1
  • 0cd6f42 fix(updating hook): keep modifications intact in minified bundle (#2333)
  • 0fa2b84 dexie-cloud-addon@4.4.15
  • 1e01299 fix(dexie-cloud): resync tables added to the schema (#2332)
  • 32ad221 fix(dexie-export-import): don't emit a trailing comma when a chunk is fully f...
  • 51c138b fix(dexie-cloud): include new social provider types (#2327)
  • 4df3823 npm audit fix on samples/dexie-cloud-todo-app
  • 22bdff1 dexie@4.4.5
  • Additional commits viewable in compare view

Updates onnxruntime-web from 1.24.3 to 1.29.0

Release notes

Sourced from onnxruntime-web's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

  • Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
  • Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
  • Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
  • Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
  • Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for onnxruntime-web since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the runtime group with 4 updates: [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3), [@aws-sdk/s3-request-presigner](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/s3-request-presigner), [dexie](https://github.com/dexie/Dexie.js) and [onnxruntime-web](https://github.com/Microsoft/onnxruntime).


Updates `@aws-sdk/client-s3` from 3.1026.0 to 3.1130.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1130.0/clients/client-s3)

Updates `@aws-sdk/s3-request-presigner` from 3.1026.0 to 3.1130.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/s3-request-presigner/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1130.0/packages/s3-request-presigner)

Updates `dexie` from 4.4.2 to 4.4.6
- [Release notes](https://github.com/dexie/Dexie.js/releases)
- [Commits](dexie/Dexie.js@v4.4.2...v4.4.6)

Updates `onnxruntime-web` from 1.24.3 to 1.29.0
- [Release notes](https://github.com/Microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.24.3...v1.29.0)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1130.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
- dependency-name: "@aws-sdk/s3-request-presigner"
  dependency-version: 3.1130.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
- dependency-name: dexie
  dependency-version: 4.4.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime
- dependency-name: onnxruntime-web
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
@dependabot
dependabot Bot requested a review from janakhpon as a code owner September 14, 2026 06:06
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying monocr with  Cloudflare Pages  Cloudflare Pages

Latest commit: 65e65aa
Status:🚫  Build failed.

View logs

@janakhpon janakhpon closed this Sep 23, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/runtime-9e1807e9f0 branch September 23, 2026 05:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant