ci(deps): Bump tract-onnx from 0.21.4 to 0.23.3 in /packages/dfn-wasm

[dependabot]

Bumps tract-onnx from 0.21.4 to 0.23.3.

Changelog

Sourced from tract-onnx's changelog.

0.23.3 - 2026-06-19

GPU

• Native STFT / FFT on GPU. Backend-agnostic GpuStft (CUDA + Metal) backed by a 512-point Stockham FFT kernel, generalized to power-of-two frames (256/512/1024/2048), plus inverse FFT and lowering of the standalone Fft op.

CPU / linalg

• SVE2 RmsNorm. VLA SVE2 rms_norm_f32 kernel for aarch64 SVE2 hosts.

Transformers / LLM

• KV-cache quantization (KIVI-style). QuantizedKvSdpa op with packed u8 storage and configurable bit-width, an auto-wiring transform, and NNEF de/serialization round-trip.

Core / NNEF / ONNX

• Resize / GridSample in core. A clean Resize subset and GridSample moved into tract-core: f16 resize, a sizes input on tract_core_resize, a clamped resize floor for negative source coordinates, and a retained grid_sample alias.

0.23.2 - 2026-06-16

Security

• fix for CVE-2026-55832 in tract-onnx (moderate): lack of sanitation in ONNX split tensor file paths.

0.23.1 - 2026-06-10

Security

• fix for CVE-2026-55093 in tract-nnef (moderate): validation of tensor shapes in NNEF .dat files to prevent of multiplication overflow in buffer size computation.

CPU / linalg

• int8 GEMM kernels across backends. aarch64 SDOT (FEAT_DotProd), x86_64 AVX-512-VNNI (avx512vnni_mmm_i32_8x8), and ARM SME2 SMOPA (sme_qmmm_i32_32x32) int8→i32 matmul micro-kernels.
• AVX-512 element-wise + reduction kernels. Dedicated AVX-512 kernels for the f32 and f16 activations (sigmoid, tanh, hardswish, silu, gelu, leaky_relu), erf, max, and fastcompact softmax (f32 + f16). On AVX-512-FP16 hosts, a native-f16 hardswish kernel is plugged in where it wins.
• Fused RmsNorm. A single 2-pass kernel replaces the MeanOfSquares+Add+Rsqrt+Mul composition for trailing-axis f32/f16 RmsNorm — AVX-512 on x86_64, NEON on aarch64, scalar generic elsewhere.

GPU

• Constant Pad on GPU. Backend-agnostic GpuPad (CUDA + Metal) via the

... (truncated)

Commits

• ffa4087 release 0.23.3
• a11f45f core: drop the dead axes field from core Resize
• 60b6e5f core,nnef,onnx: handle f16 resize, keep grid_sample alias, guard upsample factor
• cd325ff core,onnx: clamp the resize floor for negative source coords
• 3572a72 nnef: accept a sizes input on tract_core_resize
• da11169 core,nnef,onnx: move clean Resize subset and GridSample into tract-core
• d0b5111 harness: drop STFT from the cuda assert-op-only allow-lists too
• 7accf69 gpu: inverse FFT + lower the standalone Fft op
• 03388d6 gpu: generalize the STFT/FFT kernels to pow2 frames (256/512/1024/2048)
• 45496e1 harness: drop STFT from the metal assert-op-only allow-lists
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

This PR has been inactive for 60 days and will be closed in 14 days without further activity.