Bump onnxruntime-genai from 0.9.0 to 0.14.1 in /python - #14212
Bump onnxruntime-genai from 0.9.0 to 0.14.1 in /python#14212dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates the Python dependency pin for onnxruntime-genai in the onnx optional dependency group.
Changes:
- Bumps
onnxruntime-genaifrom0.9.0to0.14.1inpyproject.toml.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # onnxruntime>=1.24.0 dropped Python 3.10 support; pin to last compatible version for 3.10. | ||
| "onnxruntime==1.22.1; python_version == '3.10'", | ||
| "onnxruntime>=1.24.3; python_version > '3.10'", | ||
| "onnxruntime-genai==0.9.0" | ||
| "onnxruntime-genai==0.14.1" |
github-actions
Bot
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Code Review
Reviewers: 5 | Confidence: 93%
✓ Correctness
This PR bumps onnxruntime-genai from 0.9.0 to 0.14.1 in pyproject.toml but does not regenerate python/uv.lock, which still pins onnxruntime-genai==0.9.0. This mismatch will cause
uv lock --checkanduv syncto fail. The Python 3.10 compatibility gap (already flagged in the existing review thread) is confirmed: 0.14.1 ships no Python 3.10 wheels while the project supports >=3.10 and the same extra explicitly handles 3.10 for onnxruntime.
✓ Security Reliability
This is a straightforward dependency version bump for onnxruntime-genai from 0.9.0 to 0.14.1. The code consuming the library (onnx_gen_ai_completion_base.py) is unchanged. The API surface used (Model, Tokenizer, Generator, GeneratorParams, Images.open, Audios.open, etc.) appears to be stable across these versions based on the upstream release notes. The exact pin (==0.14.1) is appropriate for reproducibility. The existing review comment about missing Python version markers on this dependency is the only notable concern and is already tracked.
✓ Test Coverage
This is a dependency version bump for onnxruntime-genai from 0.9.0 to 0.14.1 with no accompanying code changes. The existing unit tests (27 across text completion, chat completion, utils, and settings) all mock onnxruntime_genai classes, covering the full API surface used by the project (Model, Tokenizer, GeneratorParams, Images, Audios). Since the tests use mocks, they verify the wrapper code's correctness but cannot detect API breaking changes in the bumped library. However, this is a pre-existing architectural decision, not a gap introduced by this PR. No new behavior is added, so no new tests are required.
✓ Failure Modes
The version bump in pyproject.toml from onnxruntime-genai 0.9.0 to 0.14.1 is not accompanied by a uv.lock regeneration. The lockfile at python/uv.lock:3959 still pins version 0.9.0, and at line 6816 the specifier remains ==0.9.0. This means
uv sync --frozen(or CI using the lockfile as-is) would silently install the old 0.9.0 version, defeating the purpose of this bump. Auv lockrun is needed before merge to bring the lockfile in sync.
✗ Design Approach
The dependency bump is incomplete in the repo’s
uv-managed workflow:pyproject.tomlnow asks foronnxruntime-genai==0.14.1, but the checked-in lockfile still pins0.9.0, so documented lock-based installs do not actually get the new version. I did not find a second design issue beyond that.
Flagged Issues
-
python/pyproject.tomlnow requestsonnxruntime-genai==0.14.1, butpython/uv.lockstill pinsonnxruntime-genaito0.9.0(python/uv.lock:3958-3960,python/uv.lock:6816). This violates the repo's own invariant to update the uv lockfile whenpython/pyproject.tomlchanges (python/.pre-commit-config.yaml:44-47) and means lock-based installs such as the documenteduv syncflow (python/DEV_SETUP.md:40-43) will not receive the bumped package.
Automated review by dependabot[bot]'s agents
| "onnxruntime==1.22.1; python_version == '3.10'", | ||
| "onnxruntime>=1.24.3; python_version > '3.10'", | ||
| "onnxruntime-genai==0.9.0" | ||
| "onnxruntime-genai==0.14.1" |
There was a problem hiding this comment.
python/uv.lock still resolves onnxruntime-genai as 0.9.0 (package block at line 3958, specifier at line 6816). The repo's pre-commit hook (python/.pre-commit-config.yaml:44-47) requires the lockfile to be updated when pyproject.toml changes. As-is, uv lock --check will fail and uv sync --frozen will silently install the old 0.9.0 version, completely negating this bump. Please run uv lock --upgrade-package onnxruntime-genai from the python/ directory and commit the updated uv.lock.
|
Flagged issue
Source: automated DevFlow PR review |
Bumps [onnxruntime-genai](https://github.com/microsoft/onnxruntime-genai) from 0.9.0 to 0.14.1. - [Release notes](https://github.com/microsoft/onnxruntime-genai/releases) - [Commits](https://github.com/microsoft/onnxruntime-genai/commits) --- updated-dependencies: - dependency-name: onnxruntime-genai dependency-version: 0.14.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
a9b0d37 to
aead170
Compare
### Motivation and Context Consolidates the currently open Python and .NET Dependabot updates into one coordinated dependency change. This reduces duplicate review and CI work while preserving each source PR's update intent. The npm and Yarn updates are intentionally excluded from this draft and remain in their original Dependabot PRs. ### Related Issue Supersedes: - microsoft#14178 - microsoft#14184 - microsoft#14185 - microsoft#14186 - microsoft#14187 - microsoft#14188 - microsoft#14189 - microsoft#14191 - microsoft#14192 - microsoft#14202 - microsoft#14203 - microsoft#14204 - microsoft#14205 - microsoft#14207 - microsoft#14208 - microsoft#14211 - microsoft#14212 - microsoft#14213 - microsoft#14214 - microsoft#14215 - microsoft#14216 - microsoft#14217 - microsoft#14218 - microsoft#14219 - microsoft#14221 ### Description - Updates the selected .NET Aspire and AWS SDK package versions in central package management. - Updates the selected Python requirements and regenerates both affected uv lockfiles without losing earlier bumps. - Keeps the compatible ONNX Runtime/GenAI pair on Python 3.10 while applying ONNX Runtime GenAI 0.14.1 on Python 3.11 and newer. - Retains pyOpenSSL 26.2.0, which is newer than the 26.0.0 requested by its source PR and is required by the consolidated cryptography update. - Uses Pinecone 7.3 or newer on Windows, where Pinecone 7.0.1 imports the unavailable Unix `readline` module, while retaining the existing `~=7.0` range on macOS and Linux. - Constrains MCP to the compatible 1.x API because the current Semantic Kernel integration imports interfaces removed by MCP 2.0. ### Validation - Python unit tests passed across Python 3.10-3.13 on Ubuntu, Windows, and macOS, including Dapr jobs. - Python pre-commit, lock validation, spell checking, and integration-test aggregate checks passed. - .NET 9/10 builds, package-install checks, unit tests, AOT tests, formatting, and coverage checks passed on Ubuntu and Windows. - Merge Gatekeeper passed. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄
|
Superseded by #14222 |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps onnxruntime-genai from 0.9.0 to 0.14.1.
Release notes
Sourced from onnxruntime-genai's releases.
... (truncated)
Commits