Merge branch 'main' into titaiwang/public_op_shape_inference

Author: titaiwangms

.github/workflows/auto_update_doc.yml

@@ -54,7 +54,7 @@ jobs:
         git diff -- . ':(exclude)onnx/onnx-data.proto' ':(exclude)onnx/onnx-data.proto3'
 
     - name: Commit changes with updated files
-      uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
+      uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
       with:
         commit_message: CI:apply auto updated documentation/backend test data
         commit_options: "--signoff"

.github/workflows/codeql.yml

@@ -60,7 +60,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+      uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         languages: ${{ matrix.language }}
         queries: security-extended,security-and-quality
@@ -91,6 +91,6 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+      uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/copilot-setup-steps.yml

@@ -11,6 +11,9 @@ on:
     paths:
       - .github/workflows/copilot-setup-steps.yml
 
+permissions:
+  contents: read
+
 jobs:
   # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
   copilot-setup-steps:

.github/workflows/lint.yml

@@ -103,7 +103,7 @@ jobs:
         # To toggle linter comments in the files page, press `i` on the keyboard
         if: always()
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           # Path to SARIF file relative to the root of the repository
           sarif_file: lintrunner.sarif

.github/workflows/pixi_build.yml

@@ -9,6 +9,9 @@ on:
     # run weekly on Sunday 23:59
     - cron:  '29 23 * * SUN'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
@@ -34,7 +37,7 @@ jobs:
           submodules: recursive
           fetch-depth: 0
       - name: Set up pixi
-        uses: prefix-dev/setup-pixi@v0.8.8
+        uses: prefix-dev/setup-pixi@v0.8.10
         with:
           environments: ${{ matrix.environment }}
       - name: Install repository

.github/workflows/release_mac.yml

@@ -25,7 +25,7 @@ permissions:
 jobs:
   build:
     if: github.event_name != 'pull_request' || startsWith( github.base_ref, 'rel-') || contains( github.event.pull_request.labels.*.name, 'run release CIs')
-    runs-on: macos-latest
+    runs-on: macos-14
     strategy:
       matrix:
         python-version: ['3.14-dev', '3.13t', '3.13', '3.12', '3.11', '3.10', '3.9']

.github/workflows/release_win_x86_64.yml

@@ -22,6 +22,7 @@ jobs:
     if: github.event_name != 'pull_request' || startsWith( github.base_ref, 'rel-') || contains( github.event.pull_request.labels.*.name, 'run release CIs')
     runs-on: windows-2022
     strategy:
+      fail-fast: false
       matrix:
         python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.13t']
         architecture: ['x64', 'x86']
@@ -79,17 +80,17 @@ jobs:
         python -m build --wheel
         Get-ChildItem -Path dist/*.whl | foreach {python -m pip install --upgrade $_.fullname}
 
-    - name: Test the installed wheel
-      if: steps.build_wheel.outcome == 'success'
-      run: |
-        python -m pip install -q -r requirements-release_test.txt
-        pytest
-
     - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
       if: steps.build_wheel.outcome == 'success'
       with:
         name: wheels-${{ inputs.os }}-${{ matrix.python-version }}-${{matrix.architecture}}
         path: ./dist
+    
+    - name: Test the installed wheel
+      if: steps.build_wheel.outcome == 'success'
+      run: |
+        python -m pip install -q -r requirements-release_test.txt
+        pytest
 
     - name: Verify ONNX with the latest numpy
       if: steps.build_wheel.outcome == 'success'

.github/workflows/scorecard.yml

@@ -71,6 +71,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: results.sarif

.lintrunner.toml

@@ -74,8 +74,7 @@ include_patterns = [
 exclude_patterns = [
     'onnx/backend/test/**',
     'onnx/reference/ops/**',  # FIXME: Enable this once typing is fixed
-    'onnx/test/parser_test.py',
-    'onnx/test/numpy_helper_test.py',
+    'onnx/test/**',  # Disable mypy for tests
     'onnx/reference/reference_evaluator.py',
 ]
 command = [

CMakeLists.txt

@@ -117,6 +117,10 @@ if(MSVC)
     string(APPEND CMAKE_C_FLAGS " /EHsc /wd26812")
   endif()
   add_compile_options(/MP /utf-8 /nologo)
+  add_compile_options(
+    /wd5287  # https://developercommunity.visualstudio.com/t/warning-C5287:-operands-are-different-e/10877942?sort=newest
+    /Zc:lambda  # https://developercommunity.visualstudio.com/t/fatal--error-C1001:-Internal-compiler-er/10906076
+  )
 endif()
 
 if(ONNX_DISABLE_EXCEPTIONS)
@@ -271,8 +275,8 @@ if(NOT ONNX_PROTOC_EXECUTABLE)
     set(ONNX_CMAKE_CXX_FLAGS ${CMAKE_CXX_FLAGS})
     # Use this setting to build third-party libs.
     set(BUILD_SHARED_LIBS ${ONNX_USE_PROTOBUF_SHARED_LIBS})
-    set(ProtobufURL https://github.com/protocolbuffers/protobuf/releases/download/v31.0/protobuf-31.0.tar.gz)
-    set(ProtobufSHA1 c0cecb7cfc881f56a5b09f00a965aae408265fd0)
+    set(ProtobufURL https://github.com/protocolbuffers/protobuf/releases/download/v31.1/protobuf-31.1.tar.gz)
+    set(ProtobufSHA1 da10aaa3bf779735a8a9acde1256a47ce5d148be)
     FetchContent_Declare(
       Protobuf
       URL ${ProtobufURL}
@@ -282,7 +286,7 @@ if(NOT ONNX_PROTOC_EXECUTABLE)
     message(STATUS "Download and build Protobuf from ${ProtobufURL}")
     FetchContent_MakeAvailable(Protobuf)
     set(ONNX_PROTOC_EXECUTABLE $<TARGET_FILE:protobuf::protoc>)
-    set(Protobuf_VERSION "6.31.0")
+    set(Protobuf_VERSION "6.31.1")
     # Change back the BUILD_SHARED_LIBS to control the onnx project.
     set(BUILD_SHARED_LIBS ${ONNX_BUILD_SHARED_LIBS})
     set(PROTOBUF_DIR "${protobuf_BINARY_DIR}")
@@ -428,14 +432,14 @@ target_include_directories(onnx_proto PUBLIC
 if(MSVC)
   # For disabling Protobuf related warnings
   target_compile_options(onnx_proto PUBLIC
-                      /wd4146 # unary minus operator applied to unsigned type,
-                              # result still unsigned
-                      /wd4244 # 'argument': conversion from 'google::
-                              # protobuf::uint64' to 'int', possible
-                              # loss of data
-                      /wd4267 # Conversion from 'size_t' to 'int',
-                              # possible loss of data
-                      /wd4141 # 'inline': used more than once
+    /wd4146 # unary minus operator applied to unsigned type,
+            # result still unsigned
+    /wd4244 # 'argument': conversion from 'google::
+            # protobuf::uint64' to 'int', possible
+            # loss of data
+    /wd4267 # Conversion from 'size_t' to 'int',
+            # possible loss of data
+    /wd4141 # 'inline': used more than once
   )
 endif()