Skip to content

build(deps): bump the runtime group with 4 updates - #48

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-6cef65e832
Closed

build(deps): bump the runtime group with 4 updates#48
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-6cef65e832

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the runtime group with 4 updates: @aws-sdk/client-s3, @aws-sdk/s3-request-presigner, dexie and onnxruntime-web.

Updates @aws-sdk/client-s3 from 3.1026.0 to 3.1136.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1136.0

3.1136.0(2026-09-18)

New Features
  • client-datazone: Adds support for specifying Notebook type (dfe90a44)
  • client-sagemaker: Adds support for the hub content resource in SageMaker Search. (5733f294)
  • client-glue: Introducing AWS Glue Data Quality advanced rule recommendations for faster recommendations. This capability uses Amazon Athena to analyze a sample of table data and Amazon Bedrock to recommend DQDL rules. (984a8422)
  • client-ec2: This release adds documentation for the T8i instance family to the EC2 ModifyDefaultCreditSpecification and GetDefaultCreditSpecification APIs. (27cc9e36)
  • client-appintegrations: This release adds support for A2A servers via the ApplicationType and AuthConfig fields, allowing customers to register their agent-to-agent servers with API key authentication. (6be76cb1)
  • client-transcribe: Amazon Transcribe now lets you encrypt your custom vocabularies, custom vocabulary filters, and custom language models with a customer managed AWS KMS key instead of an AWS owned key, and adds a new UpdateLanguageModel operation to transition CLM encryption to a different KMS key. (22124b1c)
  • client-qconnect: Amazon Connect AI Agents now support multi-agent orchestration and structured JSON input and output messaging for orchestration agents. (299b4e03)
  • client-connect: This release adds the ListSecurityProfileAIAgents API and updates the CreateSecurityProfile and UpdateSecurityProfile APIs to support the AllowedAIAgents field on security profiles, allowing customers to manage the 3P AI agents associated with a security profile for Agent-to-Agent interactions. (2c765d8d)
  • client-ivs-realtime: GetParticipant, ListParticipantEvents, ListParticipantReplicas, StartParticipantReplication, and StopParticipantReplication now accept participant IDs containing underscores. (dc23e6f2)
Tests
  • undici-http-handler: skip invokeModelWithBidirectionalStream test (#8309) (82637a1c)

For list of updated packages, view updated-packages.md in assets-3.1136.0.zip

v3.1135.0

3.1135.0(2026-09-17)

Documentation Changes
  • client-sns: SNS API reference documentation update (0e22e2d7)
New Features
  • client-connect: Made the replicaAlias attribute optional in the ReplicateInstance API to support Global routing for Amazon Connect Global Resiliency (ACGR) instances. This change maintains backward compatibility. When onboarding to ACGR without Global routing, you must specify a custom replicaAlias in your API call (f134c352)
  • client-ec2: Adding support for "Tunnel" VPC Endpoint (cb7c9bc5)
  • client-notifications: Added support for attachments on managed notification events. Added support to access and subscribe sensitive managed notification events. (c8a9cc10)
  • client-guardduty: This change surfaces AI Protection resources on existing public IAM attack sequences. Customers will now see which model was accessed and whether a guardrail intervened as part of the credential-compromise sequence. (854ccbfa)
  • client-sesv2: Added support to query the tenant name for BatchGetMetricData and CreateExportJob APIs to filter metrics and messages at the tenant level. (3beafcbc)
  • client-iot-wireless: Adds Multi-frame GNSS support to the AWS IoT Core Device Location GetPositionEstimate API. The new GnssMultiFrame measurement type improves location accuracy by combining multiple GNSS signal captures (2, 4, 8, 16, or 32) from the same device to estimate its position. (294ad0a3)
  • client-vpc-lattice: Adding support for CIDR Resource Configuration (46656caf)
  • client-socialmessaging: Add support for WhatsApp Calling APIs. (b897c28f)
  • client-bedrock-agentcore: Batch evaluation now supports evaluating specific traces within a session. Each session can specify up to 100 trace IDs to evaluate. (fac9ee4c)

For list of updated packages, view updated-packages.md in assets-3.1135.0.zip

v3.1134.0

3.1134.0(2026-09-16)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1136.0 (2026-09-18)

Note: Version bump only for package @​aws-sdk/client-s3

3.1135.0 (2026-09-17)

Note: Version bump only for package @​aws-sdk/client-s3

3.1134.0 (2026-09-16)

Note: Version bump only for package @​aws-sdk/client-s3

3.1133.0 (2026-09-15)

Note: Version bump only for package @​aws-sdk/client-s3

3.1132.0 (2026-09-14)

Note: Version bump only for package @​aws-sdk/client-s3

3.1131.0 (2026-09-11)

Note: Version bump only for package @​aws-sdk/client-s3

3.1130.0 (2026-09-10)

... (truncated)

Commits

Updates @aws-sdk/s3-request-presigner from 3.1026.0 to 3.1136.0

Release notes

Sourced from @​aws-sdk/s3-request-presigner's releases.

v3.1136.0

3.1136.0(2026-09-18)

New Features
  • client-datazone: Adds support for specifying Notebook type (dfe90a44)
  • client-sagemaker: Adds support for the hub content resource in SageMaker Search. (5733f294)
  • client-glue: Introducing AWS Glue Data Quality advanced rule recommendations for faster recommendations. This capability uses Amazon Athena to analyze a sample of table data and Amazon Bedrock to recommend DQDL rules. (984a8422)
  • client-ec2: This release adds documentation for the T8i instance family to the EC2 ModifyDefaultCreditSpecification and GetDefaultCreditSpecification APIs. (27cc9e36)
  • client-appintegrations: This release adds support for A2A servers via the ApplicationType and AuthConfig fields, allowing customers to register their agent-to-agent servers with API key authentication. (6be76cb1)
  • client-transcribe: Amazon Transcribe now lets you encrypt your custom vocabularies, custom vocabulary filters, and custom language models with a customer managed AWS KMS key instead of an AWS owned key, and adds a new UpdateLanguageModel operation to transition CLM encryption to a different KMS key. (22124b1c)
  • client-qconnect: Amazon Connect AI Agents now support multi-agent orchestration and structured JSON input and output messaging for orchestration agents. (299b4e03)
  • client-connect: This release adds the ListSecurityProfileAIAgents API and updates the CreateSecurityProfile and UpdateSecurityProfile APIs to support the AllowedAIAgents field on security profiles, allowing customers to manage the 3P AI agents associated with a security profile for Agent-to-Agent interactions. (2c765d8d)
  • client-ivs-realtime: GetParticipant, ListParticipantEvents, ListParticipantReplicas, StartParticipantReplication, and StopParticipantReplication now accept participant IDs containing underscores. (dc23e6f2)
Tests
  • undici-http-handler: skip invokeModelWithBidirectionalStream test (#8309) (82637a1c)

For list of updated packages, view updated-packages.md in assets-3.1136.0.zip

v3.1135.0

3.1135.0(2026-09-17)

Documentation Changes
  • client-sns: SNS API reference documentation update (0e22e2d7)
New Features
  • client-connect: Made the replicaAlias attribute optional in the ReplicateInstance API to support Global routing for Amazon Connect Global Resiliency (ACGR) instances. This change maintains backward compatibility. When onboarding to ACGR without Global routing, you must specify a custom replicaAlias in your API call (f134c352)
  • client-ec2: Adding support for "Tunnel" VPC Endpoint (cb7c9bc5)
  • client-notifications: Added support for attachments on managed notification events. Added support to access and subscribe sensitive managed notification events. (c8a9cc10)
  • client-guardduty: This change surfaces AI Protection resources on existing public IAM attack sequences. Customers will now see which model was accessed and whether a guardrail intervened as part of the credential-compromise sequence. (854ccbfa)
  • client-sesv2: Added support to query the tenant name for BatchGetMetricData and CreateExportJob APIs to filter metrics and messages at the tenant level. (3beafcbc)
  • client-iot-wireless: Adds Multi-frame GNSS support to the AWS IoT Core Device Location GetPositionEstimate API. The new GnssMultiFrame measurement type improves location accuracy by combining multiple GNSS signal captures (2, 4, 8, 16, or 32) from the same device to estimate its position. (294ad0a3)
  • client-vpc-lattice: Adding support for CIDR Resource Configuration (46656caf)
  • client-socialmessaging: Add support for WhatsApp Calling APIs. (b897c28f)
  • client-bedrock-agentcore: Batch evaluation now supports evaluating specific traces within a session. Each session can specify up to 100 trace IDs to evaluate. (fac9ee4c)

For list of updated packages, view updated-packages.md in assets-3.1135.0.zip

v3.1134.0

3.1134.0(2026-09-16)

... (truncated)

Changelog

Sourced from @​aws-sdk/s3-request-presigner's changelog.

3.1136.0 (2026-09-18)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1135.0 (2026-09-17)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1134.0 (2026-09-16)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1133.0 (2026-09-15)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1132.0 (2026-09-14)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1131.0 (2026-09-11)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1130.0 (2026-09-10)

... (truncated)

Commits

Updates dexie from 4.4.2 to 4.4.6

Release notes

Sourced from dexie's releases.

Dexie v4.4.6

This is a maintenance release that improves schema synchronization in dexie-cloud-addon, fixes an issue with updating hooks in the minified production bundle, fixes filtered chunked exports in dexie-export-import, and adds OAuth provider types for Facebook, LinkedIn, and Discord.

Related Package Releases

Package Version
dexie 4.4.6
dexie-cloud-addon 4.4.15
dexie-react-hooks 4.4.0+ (no change)
y-dexie 4.4.0+ (no change)
dexie-export-import 4.4.1

Bug Fixes

dexie@4.4.6

  • fix: keep updating-hook modifications intact in minified production bundles — Multiple updating-hook subscribers now reliably receive the record modifications object when using the minified production build. (#2333, fixes #2330). Contributed by @​Tyagiquamar.

dexie-cloud-addon@4.4.15

  • fix: resync tables added to the schema — Tables that are new to a client are now detected by comparing the declared cloud schema with the schema persisted from earlier syncs. They are marked for an initial synchronization so their current contents are full-loaded, while pending sync state is preserved until completion is acknowledged by the server. (#2332, fixes dexie-cloud#205).

  • feat: include additional social provider types — Added Facebook, LinkedIn, and Discord to OAuthProviderInfo. (#2327).

dexie-export-import@4.4.1

  • fix: avoid trailing commas in filtered chunked exports — exportDB() no longer produces invalid JSON when a later chunk contains no rows matching the active filter. (#2328, fixes #1070). Contributed by @​buildwithakhila.

Thanks to @​Tyagiquamar and @​buildwithakhila for their contributions.

Dexie v4.4.5

This is a maintenance release that fixes an issue with indexes named after inherited Object properties and improves authentication recovery in dexie-cloud-addon.

Related Package Releases

Package Version
dexie 4.4.5
dexie-cloud-addon 4.4.14+
dexie-react-hooks 4.4.0+ (no change)
y-dexie 4.4.0+ (no change)
dexie-export-import 4.4.0+ (no change)

Bug Fixes

dexie@4.4.5

  • fix: don't crash when an index is named constructor — Tables with a primary key or index named constructor could cause db.open() to fail with TypeError: indexList.push is not a function. The internal index lookup now uses an object without a prototype, avoiding collisions with inherited Object.prototype properties such as constructor, toString, and valueOf. (#2325, fixes #1920). Contributed by @​tarann26.

... (truncated)

Commits
  • adc6f50 dexie@4.4.6
  • 22798e9 Remove package-lock files. We're using pnpm!
  • 58d1afe dexie-export-import@4.4.1
  • 0cd6f42 fix(updating hook): keep modifications intact in minified bundle (#2333)
  • 0fa2b84 dexie-cloud-addon@4.4.15
  • 1e01299 fix(dexie-cloud): resync tables added to the schema (#2332)
  • 32ad221 fix(dexie-export-import): don't emit a trailing comma when a chunk is fully f...
  • 51c138b fix(dexie-cloud): include new social provider types (#2327)
  • 4df3823 npm audit fix on samples/dexie-cloud-todo-app
  • 22bdff1 dexie@4.4.5
  • Additional commits viewable in compare view

Updates onnxruntime-web from 1.24.3 to 1.30.0

Release notes

Sourced from onnxruntime-web's releases.

ONNX Runtime v1.30.0

ONNX Runtime 1.30.0 expands generative AI inference, improves CPU and GPU performance, adds Go bindings, and strengthens runtime reliability. These notes cover changes since ONNX Runtime 1.29.1.

Highlights

  • Expanded CUDA inference support with variable-length causal convolution for continuous batching, speculative decoding in paged XQA, and INT4 paged KV caches with per-channel scales (#32168, #32340, #32515).
  • Improved WebGPU PagedAttention, added GPT-OSS support and INT8 KV-cache block quantization, and extended convolution optimizations (#31727, #32277, #32284, #32420).
  • Added fused CPU LinearAttention kernels for AVX-512, Arm64 NEON, and SVE, plus AVX2 LayerNorm/RMSNorm acceleration (#31674, #31973, #32178, #32356).
  • Added Go bindings for the ONNX Runtime C API and DeepSeek Engram contrib operators (#29615, #32268).

Announcements & Compatibility

  • FP4 QMoE kernels are now enabled by default in CUDA builds, with Windows build support added in this release. Source builds can opt out with -Donnxruntime_USE_FP4_QMOE=OFF (#32096, #32163).
  • CUDA fpA-intB builds now default to a compact kernel set for FP16 activations, INT4/INT8 weights, scale-only quantization, and block_size=32. Set -Donnxruntime_USE_FPA_INTB_GEMM_FULL=ON when building from source to retain the full kernel set, including BF16, zero-point, bias, larger-block-size, and native Hopper variants (#32324).
  • CPU FP16 Gemm and MatMul execution is gated on hardware acceleration. CPU-assigned FP16 nodes without a matching kernel now fall back to FP32 (#32301, #32197).
  • WebGPU plugin EP packaging now supports Linux AArch64. Plugin versions were advanced to WebGPU 0.4.0 and CUDA 0.2 (#32287, #31960, #31970).

Security & Reliability

Model Loading, Memory, and Input Validation

  • Limited nested model-graph depth and canonicalized external-data locations to harden model loading (#32344, #32135).
  • Added checked rounding for BFC arena allocations and fixed prepacked-weight reference lifetimes (#32010, #32040).
  • Strengthened shape, rank, and parameter validation for Split, Scan, GatherND, ScatterND, SpaceToDepth/DepthToSpace, Crop, Conv, Normalizer, and pooling (#29461, #31668, #32034, #32039, #32076, #32157, #32160, #32161, #32345, #32349).
  • Hardened generation and attention input handling, including attention-attribute narrowing, BifurcationDetector inputs, generation subgraph shapes, and QEmbed segment inputs. BeamSearch buffer expansion now uses dynamic shape storage (#31648, #31701, #32009, #32078, #32144).
  • Validated TreeEnsemble node references and bounded subtree comparison, rejected non-finite CPU RoiAlign coordinates, and required ImageScaler bias to match the channel count (#32031, #32043, #32011, #32002).
  • Added an allowlist of safe LoRA adapter parameter data types, validated MatMulFpQ4 shape inputs, and checked MLAS blockwise quantization/dequantization index ranges (#31682, #32032, #32007).

GPU Bounds and Resource Lifetimes

  • Hardened CUDA indexing and buffer-size arithmetic in MatMulNBits, RemovePadding, RotaryEmbedding, SparseAttention, Whisper beam search, NMS, QDQ, and GatherElements (#31643, #31994, #31995, #31996, #31998, #32014, #32029, #32030).
  • Fixed overflow in CUDA reduction scans and Softmax offset arithmetic, and handled zero-sized outputs in CUDA random-generator kernels (#32137, #32330, #31997).
  • Fixed CUDA MultiHeadAttention shared-cache scratch lifetimes and kept CudaAsyncBuffer staging storage alive across CUDA graph replay (#31968, #32121).
  • Fixed WebGPU out-of-bounds subgroup-matrix loads for partial tiles, zero-initialized writable device-allocator buffers, and rejected foreign GPU handles in built-in data transfers (#32364, #32063, #32317).

Dependencies and Tooling

  • Upgraded Protobuf to 33.6 and refreshed Python documentation dependencies, including an ONNX security-related update (#29906, #32190, #32424).
  • Updated JavaScript dependencies including js-yaml, joi, fast-uri, and the Next.js end-to-end fixture (#32397, #32486, #32488, #32505, #32508).
  • Pinned GitHub Actions to full-length commit SHAs and strengthened packaging infrastructure with authenticated package feeds and NPM network isolation (#32176, #32005, #32440).

New Features

Core APIs & Runtime

  • Added Go bindings for the ONNX Runtime C API (#29615).
  • Extended memory importing with host-pointer support and added access to preallocated outputs through KernelContext::GetPreallocatedOutput (#29726, #32089).
  • Added packed-attention workspace recipes and estimates, and made workspace input-shape handling aware of optional inputs (#32283, #32321, #32312).
  • Added DeepSeek Engram contrib operators, EngramGate and NGramHashMapping, and expanded kernel coverage for Qwen-3.5 operators (#32268, #32106).

... (truncated)

Commits
  • f2c39fe [CUDA] Add INT4 paged KV cache with per-channel scales (#32515)
  • 5894ba8 Add portable random-access file reads to Env (#32503)
  • a2ee3eb Fix CUDA plugin device discovery on WSL (#32517)
  • b652e59 [WebGPU] Prepack Conv weights for the im2col-matmul path (#32420)
  • 0f0f29f Get rid of spurious warning about not being able to find spectre mitigation (...
  • 23dd651 Register ONNX schemas only when static registration is disabled (#32353)
  • 33af5d3 Release external data loaders after graph initialization (#32502)
  • 2e3c24d Clarify external initializer and EP context path interaction (#32442)
  • e76036b [CUDA] Pin FP8 GEMV residency for grids just past two blocks per SM (#32433)
  • 82583c5 Add session option for a BNHS GroupQueryAttention Value cache layout (#32139)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for onnxruntime-web since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the runtime group with 4 updates
109bbc7 
Bumps the runtime group with 4 updates: [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3), [@aws-sdk/s3-request-presigner](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/s3-request-presigner), [dexie](https://github.com/dexie/Dexie.js) and [onnxruntime-web](https://github.com/Microsoft/onnxruntime).


Updates `@aws-sdk/client-s3` from 3.1026.0 to 3.1136.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1136.0/clients/client-s3)

Updates `@aws-sdk/s3-request-presigner` from 3.1026.0 to 3.1136.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/s3-request-presigner/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1136.0/packages/s3-request-presigner)

Updates `dexie` from 4.4.2 to 4.4.6
- [Release notes](https://github.com/dexie/Dexie.js/releases)
- [Commits](dexie/Dexie.js@v4.4.2...v4.4.6)

Updates `onnxruntime-web` from 1.24.3 to 1.30.0
- [Release notes](https://github.com/Microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.24.3...v1.30.0)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1136.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
- dependency-name: "@aws-sdk/s3-request-presigner"
  dependency-version: 3.1136.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
- dependency-name: dexie
  dependency-version: 4.4.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime
- dependency-name: onnxruntime-web
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 24, 2026
@dependabot
dependabot Bot requested a review from janakhpon as a code owner September 24, 2026 18:08
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying monocr with  Cloudflare Pages  Cloudflare Pages

Latest commit: 109bbc7
Status:🚫  Build failed.

View logs

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 24, 2026
@janakhpon janakhpon closed this Sep 25, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 25, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/runtime-6cef65e832 branch September 25, 2026 03:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@janakhpon janakhpon Awaiting requested review from janakhpon janakhpon is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@janakhpon