deps: bump tract-onnx from 0.21.15 to 0.23.4

[dependabot]

Bumps tract-onnx from 0.21.15 to 0.23.4.

Changelog

Sourced from tract-onnx's changelog.

0.23.4 - 2026-07-08

Security / deps

• RUSTSEC-2026-0204: bump crossbeam-epoch to 0.9.20 (invalid pointer deref in fmt::Display for Atomic/Shared) (#2454).
• RUSTSEC-2026-0190: bump anyhow to 1.0.103.
• RUSTSEC-2026-0186: dependency refresh.
• Drop the ggml dev-dependency, removing the memmap2 0.5 RustSec advisory.

GPU

• CUDA per-thread streams. Each thread gets its own non-blocking stream; cudarc cross-stream event tracking is disabled and constant uploads are drained at prepare, cutting cross-stream synchronization overhead.
• Metal GGML matmul runs in f16. f16 activations/output for the GGML matmul (no more f32 round-trips), with the f16/f32 branch hoisted out of the hot loop and activation selection done at runtime rather than by template.

CPU / linalg

• Intel AMX GEMM kernels (x86_64). int8 (avx512amx_mmm_i32_8x8 / 16x16) and bf16→f32 (avx512amx_mmm_f32_16x16, TDPBF16PS) matmul micro-kernels with shape-adaptive dispatch (16x16 for large, 8x8 for small), CPUID cache-size detection, and oneDNN-style prefetch. The AMX bf16 f32 path is opt-in via TRACT_AMX_BF16.
• AVX-VNNI int8 GEMM kernels. avxvnni_mmm_i32_8x8 (ymm) and a zmm 16x16 AVX-512-VNNI kernel, the latter gated on runtime-probed dual 512-bit FMA presence (TRACT_AVX512_FMA_UNITS).
• Cache-aware L3 blocking. LLC/SLC-aware budget for the L3 outer blocking tier, gated on the working set actually spilling the LLC (#2352).
• Q1_58 ternary block-quant (BitNet b1.58) and Q4_0::w4a8_gemv (W4A8 int8-dot decode GEMV). (The former Q1_58 label was renamed to Q2_0_T.)
• Separable average pool. Concrete-geometry pool codegen plus an opt-in separable avg-pool, with an NHWC kernel.
• SIMD ReduceMin mirroring the existing max reducer.

Transformers / LLM

• In-place KV cache. Opt-in runtime-fused InPlaceKvSdpa op.
• Fused int4 MatMulNBits. ONNX MatMulNBits int4 now routes through the fused Q4_0 block-quant matmul.
• Speculative decoding example. examples/causal_llm gains n-gram + draft- model speculative decoding.

Core / NNEF / ONNX

• NeMo FastConformer streaming. ONNX loader support for cache-aware streaming FastConformer graphs.
• ONNX model metadata exposed in Graph.properties (#2408).

... (truncated)

Commits

• 4cd79a4 release 0.23.4
• 2dd5369 changelog for 0.23.4
• bdf9e37 onnx: fix onesided DFT shape inference and slice axis
• 6605c7b ci: add /ci wheels (python, py) target to build Python wheels for a PR
• 0d6a652 bump crossbeam-epoch to 0.9.20 to clear RUSTSEC-2026-0204 (invalid pointer de...
• aa0c276 build(deps): bump the actions group with 3 updates (#2451)
• 34c8693 Iff's constant-condition declutter shunted the selected branch directly, but ...
• 4a02956 ScatterNd::eval round-tripped the data tensor through an owned ndarray (into_...
• 9cda9db MultiBroadcastTo's swap-with-AxisOp declutter checked transformed axes with a...
• e58dfed onnx: load NeMo FastConformer cache-aware streaming graphs
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.