Python: Bump onnxruntime-genai from 0.9.0 to 0.15.0 in /python - #14255
Python: Bump onnxruntime-genai from 0.9.0 to 0.15.0 in /python#14255dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [onnxruntime-genai](https://github.com/microsoft/onnxruntime-genai) from 0.9.0 to 0.15.0. - [Release notes](https://github.com/microsoft/onnxruntime-genai/releases) - [Commits](microsoft/onnxruntime-genai@v0.9.0...v0.15.0) --- updated-dependencies: - dependency-name: onnxruntime-genai dependency-version: 0.15.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
github-actions
Bot
changed the title
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates the Python dependency pins for the onnx extra, specifically adjusting the Python 3.10 onnxruntime-genai version.
Changes:
- Bumped
onnxruntime-genaipin for Python 3.10 from0.9.0to0.15.0.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # onnxruntime>=1.24.0 dropped Python 3.10 support; retain the last compatible runtime/genai pair for 3.10. | ||
| "onnxruntime==1.22.1; python_version == '3.10'", | ||
| "onnxruntime>=1.26.0; python_version > '3.10'", | ||
| "onnxruntime-genai==0.9.0; python_version == '3.10'", | ||
| "onnxruntime-genai==0.15.0; python_version == '3.10'", |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Code Review
Reviewers: 5 | Confidence: 65%
✓ Correctness
The bump applies onnxruntime-genai 0.15.0 to the Python 3.10 line while the Python > 3.10 line remains at 0.14.1. This creates an inversion where the constrained/legacy Python 3.10 environment gets a newer genai version than the primary Python > 3.10 environment. This is almost certainly applied to the wrong line — the existing review comment about onnxruntime 1.22.1 compatibility further supports this being incorrect.
✓ Security Reliability
This PR bumps onnxruntime-genai from 0.9.0 to 0.15.0 for the Python 3.10 environment marker. The existing unresolved review comment correctly identifies the primary concern: compatibility between onnxruntime==1.22.1 (pined for 3.10) and onnxruntime-genai==0.15.0. Additionally, the change creates a version inversion where Python 3.10 would get a newer genai (0.15.0) than Python >3.10 (0.14.1), which is suspicious and likely a mistake. No new security issues (injection, secrets, deserialization) are introduced by this dependency version bump.
✓ Test Coverage
This is a dependency version bump for onnxruntime-genai (0.9.0 → 0.15.0) constrained to Python 3.10. The existing unresolved review comment already covers the compatibility concern with the pined onnxruntime==1.22.1. From a test coverage standpoint, dependency bumps of this nature typically rely on CI integration tests rather than new unit tests. There are no new behavioral changes in the project's own code that would require additional test coverage. The PR is a pure dependency pin change with no corresponding code modifications to test.
✓ Failure Modes
This PR bumps onnxruntime-genai from 0.9.0 to 0.15.0 for Python 3.10, but the existing unresolved review comment already covers the primary concern: potential incompatibility between onnxruntime-genai==0.15.0 and the pined onnxruntime==1.22.1 on Python 3.10. Additionally, the Python 3.10 variant (0.15.0) is now a higher version than the Python >3.10 variant (0.14.1), which is an inconsistency that could indicate an error. No additional failure modes beyond what's already flaged were found.
✓ Design Approach
I did not identify an additional design-approach issue in this diff. The change is limited to a version pin update, and aside from the already-open compatibility concern on this line, the provided evidence does not establish a repo-local invariant violation, a silently mishandled code path, or a clearly better existing pattern that this approach contradicts.
Automated review by dependabot[bot]'s agents
| "onnxruntime==1.22.1; python_version == '3.10'", | ||
| "onnxruntime>=1.26.0; python_version > '3.10'", | ||
| "onnxruntime-genai==0.9.0; python_version == '3.10'", | ||
| "onnxruntime-genai==0.15.0; python_version == '3.10'", |
There was a problem hiding this comment.
This creates a version inversion: Python 3.10 (with onnxruntime==1.22.1) would now get onnxruntime-genai 0.15.0, while Python >3.10 (with onnxruntime>=1.26.0) stays on the older 0.14.1 on line 123. The newer genai release almost certainly requires a newer onnxruntime, so this bump likely belongs on line 123 (the Python >3.10 line) rather than here.
| "onnxruntime==1.22.1; python_version == '3.10'", | ||
| "onnxruntime>=1.26.0; python_version > '3.10'", | ||
| "onnxruntime-genai==0.9.0; python_version == '3.10'", | ||
| "onnxruntime-genai==0.15.0; python_version == '3.10'", |
There was a problem hiding this comment.
Version inversion: this pins onnxruntime-genai==0.15.0 for Python 3.10 (paired with onnxruntime==1.22.1), while Python >3.10 (paired with onnxruntime>=1.26.0) gets the older onnxruntime-genai==0.14.1 on line 123. This is likely backwards — a newer genai release typically requires a newer onnxruntime. If the goal is to bump genai broadly, line 123 should get 0.15.0 and line 122 should retain a version known-compatible with onnxruntime 1.22.1.
| "onnxruntime-genai==0.15.0; python_version == '3.10'", | |
| "onnxruntime-genai==0.9.0; python_version == '3.10'", |
Bumps onnxruntime-genai from 0.9.0 to 0.15.0.
Release notes
Sourced from onnxruntime-genai's releases.
... (truncated)
Commits
dfdc254Version 0.15.0832889eFix Apple telemetry packaging builds (#2331)5423fd1Add cross-platform 1DS telemetry to the compiled library (opt-out) (#2293)ac7df6fClean up config path validation: free function in config.cpp, tests via C API...cbef334Fix C# native bool marshaling (#2327)3868119Add Tool Calling and Reasoning Token Metadata togenai_config.jsonwith Fal...d66e6b0Remove onnxruntime-genai-cuda.dll from foundry package win-arm64 rid (#2329)a2cad1eUpdate prechecks in model builder (#2312)f09256fAdd address validation feature (#2223)0be0a44[WebGPU] append WebGPUExecutionProvider to config (#2326)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)