[dependabot]

Bumps the rust-minor group with 4 updates in the / directory: spirv-webgpu-transform, sha2, schemars and ort.

Updates spirv-webgpu-transform from 0.1.6 to 0.1.7

Commits

• See full diff in compare view

Updates sha2 from 0.11.0 to 0.11.1

Commits

• 138dc5a Release sha2 v0.11.1 (#927)
• cf01056 sha2: fix unsafe_op_in_unsafe_fn lint, bump MSRV to 1.88 (#926)
• 7c59cad Update Cargo.lock (#921)
• f57b947 streebog: tweak internal implementation (#925)
• 336611f Fix cargo::manual_readme lint (#924)
• 1df8877 md2: fix clippy::needless_range_loop lint (#923)
• 6075989 sha2: fix loading of round constants on AArch64 backends (#922)
• eadfd90 Update Cargo.lock (#913)
• fa30840 blake2 v0.11.0 (#911)
• f6c786d ci: bump the all-deps group across 1 directory with 3 updates (#896)
• Additional commits viewable in compare view

Updates schemars from 1.2.2 to 1.2.3

Release notes

Sourced from schemars's releases.

v1.2.3

Fixed

• schema creation panics with arbitrary precision JSON numbers (GREsau/schemars#527)
• Resolve unused_qualifications lint violation in generated code (GREsau/schemars#539 / GREsau/schemars#541)

Changed

• Put the tag of internally-tagged enums first in the schema's properties array (GREsau/schemars#537 / GREsau/schemars#538)

Changelog

Sourced from schemars's changelog.

[1.2.3] - 2026-10-12

Fixed

• schema creation panics with arbitrary precision JSON numbers (GREsau/schemars#527)
• Resolve unused_qualifications lint violation in generated code (GREsau/schemars#539 / GREsau/schemars#541)

Changed

• Put the tag of internally-tagged enums first in the schema's properties array (GREsau/schemars#537 / GREsau/schemars#538)

Commits

• 4791bb7 v1.2.3
• c6a89b7 Put the tag of an internally tagged enum first in properties
• c5cd8b5 fix: schema creation panics with arbitrary precision JSON numbers
• 766d70b Resolve unused_qualifications lint in crate and generated code - #541 (#541)
• d07655e Resolve clippy error
• See full diff in compare view

Updates ort from 2.0.0-rc.13 to 2.0.0-rc.14

Release notes

Sourced from ort's releases.

v2.0.0-rc.14

2.0.0-rc.14

💖 If you find ort useful, please consider supporting us on Open Collective 💖

🤔 Need help upgrading? Ask questions in GitHub Discussions or in the pyke.io Discord server!

✨ Supporters get priority (<24h) issue resolution & support!

---

⚠️ Manual environments

ort replaced the manual Environment struct with ort::init all the way back in Nov 2023 with 2.0.0-alpha.1 (yes, before rc hell, we used to be in alpha hell). This was done because only one environment was allowed per process anyway. However, almost every other release since then, there has been some kind of issue stemming from the environment being stored as a global variable.

The trouble caused by this now far outweighs the inconvenience of lugging around another variable everywhere, so in rc.14, you must always first create an Environment to start building sessions:

// pre-rc.14
{
    // optional, even!
    ort::init().commit()?;
let mut model = Session::builder()?
    .with_optimization_level(GraphOptimizationLevel::Level3)?
    .with_intra_threads(4)?
    .commit_from_file("yolov8m.onnx")?;

}
// rc.14
{
let env = ort::init().build()?; // <-- must build an environment first
let mut model = Session::builder(&env)?
.with_optimization_level(GraphOptimizationLevel::Level3)?
.with_intra_threads(4)?
.commit_from_file("yolov8m.onnx")?;
}

Note that you don't need to hold onto env unless you intend to create more sessions. Please refrain from storing environments or sessions as global variables -- we can't fix the issues that causes within ONNX Runtime! And library authors, please remember to allow the user to pass their own Environment.

✨ Rust 1.100 compatibility

rc.14 adds support for the upcoming v2 build dir layout that will ship in Rust 1.100. If you intend to update to Rust 1.100, you should upgrade to rc.14 as soon as possible, since older ort versions will fail to build when copy-dylibs is enabled.

Note that, due to the new layout, tests will no longer be able to see dylibs copied by copy-dylibs; you can try to use ort::util::preload_dylib to manually set the path to provider dylibs instead.

📦 You get a binary! You get a binary! Everyone gets binaries!

🟩 rc.14's prebuilt CUDA binaries add support for RTX 50xx/Blackwell cards on x64. We now also ship aarch64 builds for Jetson Orin/Thor, Grace Hopper/Blackwell, & DGX Spark! Turing & Ampere GPUs remain fully supported.

... (truncated)

Commits

• 1ee1f84 2.0.0-rc.14
• 75021e8 chore: remove deprecated execution_providers alias
• b774fea feat(sys): add model package API
• 7fdadd1 fix: hold onto the right allocator; target correct device when copying
• f2a5f73 chore(sys): update to ONNX Runtime v1.31.0
• 085eb2a fix(training): fix a leak on error & hold onto session builder extras (#659)
• beb1b2f perf: extract tensor shape without allocating
• 9dfd75b fix: prevent tensors from outliving the allocator that allocated them (#656)
• 5dc34f8 refactor(operator): share the inplace and alias index list helpers (#660)
• 7b8ba57 fix: guard async run result and waker with one lock so a completion can't be ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4a45ff9a-5354-45b5-aec9-6e4d0a8608be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.