RATATOSKRATATOSK
Sign in

KServe

v0.21.0AI & ML
Sep 25, 2026

ACTION 7CHECK 8OTHER 89

A feature-rich release expands LLMInferenceService, autoscaling, routing, storage, tracing, and installation support, alongside correctness fixes and dependency updates. Potentially breaking migrations and dependency changes warrant review before upgrading.

Action needed (7)

Check if affected (8)

  • securitycriticalgolang.org/x/crypto v0.52.0 update in bgtest

    Applies if you use bgtest.

    golang.org/x/crypto was updated to v0.52.0 in bgtest to address CVE-2026-46595.

    kserve#5993

  • securityhighPillow 12.3.0 update in alibiexplainer

    Applies if you use alibiexplainer.

    Pillow was updated to 12.3.0 in alibiexplainer to address CVE-2026-59200.

    kserve#6010

  • securityhighopentelemetry-go v1.43.0 update in qpext

    Applies if you use qpext.

    opentelemetry-go was updated to v1.43.0 in qpext to address CVE-2026-39883.

    kserve#6019

  • securityhighsetuptools 78.1.1 update in python/kserve

    Applies if you use python/kserve.

    setuptools was updated to 78.1.1 in python/kserve to address CVE-2025-47273.

    kserve#6055

  • securityaiohttp 3.13.3 update in python/storage

    Applies if you use python/storage.

    aiohttp was updated to 3.13.3 in python/storage to address the zip bomb denial-of-service issue.

    kserve#5971

  • breakingThe old disagg-sidecar flag, removed

    Applicability is not stated in the release notes.

    The old flag for disagg-sidecar was dropped to support the new TLS flag in the LLMInferenceService changes.

    kserve#5875

  • breakingThe deprecated LLMInferenceService plugin, removed

    Applicability is not stated in the release notes.

    The deprecated plugin was removed from the LLMInferenceService changes.

    kserve#6067

  • breakingThe LLMInferenceService flag, renamed

    Applicability is not stated in the release notes.

    A flag was renamed in the LLMInferenceService changes.

    kserve#6067

All 89 other recorded changesfixes 36 · additions 21 · value changes 19 · constraints 10 · defaults 1 · removals 1 · renames 1

fixes (36)

  • * fix(llmisvc): handling stopped members in group by @bartoszmajsak in https://github.com/kserve/kserve/pull/5847
  • * fix(llmisvc): skip v1alpha2 InfPool reconcile when CRD absent by @bartoszmajsak in https://github.com/kserve/kserve/pull/5890
  • * fix: prevent agent crash when model spec unmarshal fails by @unichronic in https://github.com/kserve/kserve/pull/5700
  • * fix(llmisvc): escape quotes in generated --kv-transfer-config by @iasthc in https://github.com/kserve/kserve/pull/5880
  • * fix(llmisvc): migrate --model-server-metrics-scheme when set on Args by @zdtsw in https://github.com/kserve/kserve/pull/5892
  • * fix(utils): eliminate data race in API resource discovery cache by @bartoszmajsak in https://github.com/kserve/kserve/pull/5891
  • * fix(python): map numpy unicode string dtype to BYTES in from_np_dtype by @harshhh817 in https://github.com/kserve/kserve/pull/5889
  • * fix(llmisvc): strip validation from LLMIServiceConfig CRD by @bartoszmajsak in https://github.com/kserve/kserve/pull/5888
  • * fix(llmisvc): skip pod spec build when tokenizer disabled by @vivekk16 in https://github.com/kserve/kserve/pull/5913
  • * fix(router): resolve flaky TestServerTimeout nil pointer panic by @bartoszmajsak in https://github.com/kserve/kserve/pull/5887
  • * fix: template storage resources in inferenceservice-config ConfigMap by @mgonzalezo in https://github.com/kserve/kserve/pull/5697
  • * fix(llmisvc): detect scheduler plugins from template args by @vivekk16 in https://github.com/kserve/kserve/pull/5931
  • * fix(llmisvc): close v1alpha1 validation gaps for LoRA and DRA annotations by @bartoszmajsak in https://github.com/kserve/kserve/pull/5938
  • * fix(llmisvc): detect latency-producer plugin from template args by @vivekk16 in https://github.com/kserve/kserve/pull/5937
  • * fix(llmisvc): re-enqueue group peers when status model names change by @jlost in https://github.com/kserve/kserve/pull/5943
  • * fix(reconcilers): set owner refs inside RawKubeReconciler.Reconcile by @Jooho in https://github.com/kserve/kserve/pull/5934
  • * fix(isvc): isvc headless status.address.url has incorrect port by @spolti in https://github.com/kserve/kserve/pull/5968
  • * fix(isvc): gate canary traffic on readiness to prevent transient 503s by @yuzisun in https://github.com/kserve/kserve/pull/5984
  • * fix(deps): kin-openapi nil-pointer panic in request validation by @spolti with @Copilot in https://github.com/kserve/kserve/pull/5992
  • * fix: reconcile orderings with consistent keys by @bartoszmajsak in https://github.com/kserve/kserve/pull/6021
  • * fix: apply ${TAG} to docker image build/push targets by @Jooho in https://github.com/kserve/kserve/pull/6057
  • * fix(llmisvc): detect removals when reconciling generated routing rules by @bartoszmajsak in https://github.com/kserve/kserve/pull/6046
  • * fix: don't assume LoRA served names are valid object names by @bartoszmajsak in https://github.com/kserve/kserve/pull/6077
  • * fix(autoscaler): skip KEDA ScaledObject for components without autoScaling by @spolti in https://github.com/kserve/kserve/pull/6029
  • * fix(llmisvc): validate LoRA adapters declared in a config by @bartoszmajsak in https://github.com/kserve/kserve/pull/6092
  • * fix(llmisvc): disambiguate colliding LoRA adapter mount paths by @bartoszmajsak in https://github.com/kserve/kserve/pull/6085
  • * fix(llmisvc): give P/D engines a NixlConnector so KV actually transfers by @nickaggarwal in https://github.com/kserve/kserve/pull/6027
  • * fix: clean up orphaned autoscaler and OTel resources on canary promotion by @maskarb in https://github.com/kserve/kserve/pull/5899
  • * fix(llmisvc): template base llmisvcconfig files in the correct namespace by @NoOverflow in https://github.com/kserve/kserve/pull/6088
  • * fix(llmisvc): render presets against the merged configuration by @bartoszmajsak in https://github.com/kserve/kserve/pull/6126
  • * fix(llmisvc): match group backends by their referenced pool by @bartoszmajsak in https://github.com/kserve/kserve/pull/6149
  • * fix(llmisvc): release terminating members from owned routes by @bartoszmajsak in https://github.com/kserve/kserve/pull/6156
  • * fix(autogluon): prevent path traversal in model loading by @Wojciech-Rebisz in https://github.com/kserve/kserve/pull/5802
  • * fix(llmisvc): recognizes header case-insensitively by @bartoszmajsak in https://github.com/kserve/kserve/pull/6161
  • * fix(llmisvc): report HTTPRoutesReady after a route is observed by @bartoszmajsak in https://github.com/kserve/kserve/pull/6164
  • * fix(release): generate missing install manifests for v0.21.0-rc1 by @cjohannsen-cloudera in https://github.com/kserve/kserve/pull/6273

additions (21)

  • * feat(servingruntime): add resourceClaims support for DRA by @VedantMahabaleshwarkar in https://github.com/kserve/kserve/pull/5828
  • * feat: restructure CRD management for independent installation by @Jooho in https://github.com/kserve/kserve/pull/5843
  • * feat: integrate with cluster TLS security profile by @ugiordan in https://github.com/kserve/kserve/pull/5791
  • * feat: add canary traffic splitting to RawDeployment HTTPRoutes by @maskarb in https://github.com/kserve/kserve/pull/5912
  • * feat(llmisvc): add direct KEDA scaling by @0-Zaid-0 in https://github.com/kserve/kserve/pull/5839
  • * feat(transfor): inject the ca bundle env for httpx by @spolti in https://github.com/kserve/kserve/pull/5932
  • * feat(llmisvc): add rolloutStrategy for controlling rolling update beh… by @dagrayvid in https://github.com/kserve/kserve/pull/5916
  • * feat(llmisvc): validate rendered config templates by @bartoszmajsak in https://github.com/kserve/kserve/pull/5918
  • * feat(storage): add oci+fetch:// KServe-side OCI image pull (Step 3, #4083) by @kliukovkin in https://github.com/kserve/kserve/pull/5739
  • * feat: add ModelScope storage download support (ms:// URI scheme) by @xrwang8 in https://github.com/kserve/kserve/pull/5330
  • * feat(llmisvc): localModelCache support for LoRA adapters by @mholder6 in https://github.com/kserve/kserve/pull/5690
  • * feat(kernelcache): add kernelcache/mcv initial code donation by @spolti in https://github.com/kserve/kserve/pull/5590
  • * feat(autogluonserver): inject synthetic item ID for two-column ts by @Wojciech-Rebisz in https://github.com/kserve/kserve/pull/6009
  • * feat(transformer): allow ssl configuration on transformer by @spolti in https://github.com/kserve/kserve/pull/6045
  • * feat: reload rotated TLS certificates by @maskarb in https://github.com/kserve/kserve/pull/6106
  • * feat(kernelcache): add security verification framework by @Jooho in https://github.com/kserve/kserve/pull/6099
  • * feat(kernelcache): cert-mode signature verification by @Jooho in https://github.com/kserve/kserve/pull/6103
  • * feat(llmisvc): automatically label workloads with InferencePool ref by @pierDipi in https://github.com/kserve/kserve/pull/5624
  • * feat(kernelcache): add signing contract by @Jooho in https://github.com/kserve/kserve/pull/6118
  • * refactor(kernelcache): extract security data contracts into types package by @Jooho in https://github.com/kserve/kserve/pull/6130
  • * feat(api): add InferenceService tracing configuration by @maskarb in https://github.com/kserve/kserve/pull/6108

value changes (19)

  • * chore(llmisvc): migrate EndpointPickerConfig apiversion by @zdtsw in https://github.com/kserve/kserve/pull/5774
  • * feat(llmisvc): migrate WVA from VA CRD to annotation-based discovery by @vivekk16 in https://github.com/kserve/kserve/pull/5722
  • * chore: bump dulwich to >=1.2.5 in kserve-storage by @mholder6 in https://github.com/kserve/kserve/pull/5840
  • * feat(llmisvc): migrate deprecated flag to metrics-data-source plugin by @zdtsw in https://github.com/kserve/kserve/pull/5877
  • * fix(rbac): harden controller manager ClusterRoles by @mholder6 in https://github.com/kserve/kserve/pull/5785
  • * feat(llmisvc): migrate remaining --model-server-metrics-* flags for llm-d by @zdtsw in https://github.com/kserve/kserve/pull/5930
  • * chore(llmisvc): aligns additional url discovery by @bartoszmajsak in https://github.com/kserve/kserve/pull/5940
  • * deps: bump cryptography to >=48.0.1 by @bartoszmajsak in https://github.com/kserve/kserve/pull/5957
  • * fix(llmisvc): fully qualify opt-125m-cpu sample image and bump to v0.23.0 by @KillianGolds in https://github.com/kserve/kserve/pull/5970
  • * fix(agent): migrate AWS SDK from v1 to v2 by @spolti in https://github.com/kserve/kserve/pull/5438
  • * fix(pmmlserver): bump pyjnius to 1.7.0 for Python 3.13 support by @kliukovkin in https://github.com/kserve/kserve/pull/5978
  • * deps(llmisvc): bump llm-d images to the latest 0.10 release by @zdtsw in https://github.com/kserve/kserve/pull/6026
  • * refactor: kustomize image overrides and add deploy-dev-kind-localmodel. by @Jooho in https://github.com/kserve/kserve/pull/6060
  • * fix: update kserve install script for old version/add a new install script by @Jooho in https://github.com/kserve/kserve/pull/6061
  • * feat: improve autogluon artifact loading security by @ZabinskiMichal in https://github.com/kserve/kserve/pull/5803
  • * chore(deps): upgrade Envoy AI Gateway to v1.1.0 by @cjohannsen-cloudera in https://github.com/kserve/kserve/pull/6122
  • * feat(deps): upgrade golang to 1.26 by @spolti in https://github.com/kserve/kserve/pull/6127
  • * chore(build): stamp Go toolchain into tool cache key by @bartoszmajsak in https://github.com/kserve/kserve/pull/6146
  • * chore(deps): upgrade KEDA to v2.20.2 by @vivekk16 in https://github.com/kserve/kserve/pull/6153

constraints (10)

  • * feat: add support for Python 3.13 by @noah4477 in https://github.com/kserve/kserve/pull/5897
  • * feat(llmisvc): allow idleReplicaCount=0 for true KEDA scale-to-zero by @vivekk16 in https://github.com/kserve/kserve/pull/5996
  • * fix(llmisvc): grant configmap write RBAC for CA bundle sync by @cabrinha in https://github.com/kserve/kserve/pull/5965
  • * fix: support both full JWK and raw key formats in JWE decryption by @maskarb in https://github.com/kserve/kserve/pull/6034
  • * fix(httproute): restrict canary weights to predictor rules only by @maskarb in https://github.com/kserve/kserve/pull/5944
  • * fix(llmisvc): allow triggerAuthName without authModes for KEDA by @ThatsMrTalbot in https://github.com/kserve/kserve/pull/6004
  • * fix(rbac): add leader election role for localmodel controller by @mwaykole in https://github.com/kserve/kserve/pull/6120
  • * fix(deps): allow pyarrow to use newer versions > 20 by @spolti in https://github.com/kserve/kserve/pull/6125
  • * fix(llmisvc): grant events create/patch to the scheduler Role by @UgaTheDev in https://github.com/kserve/kserve/pull/6142
  • * feat: adding Power support for storage-initializer. by @Sunidhi-Gaonkar1 in https://github.com/kserve/kserve/pull/5235

defaults (1)

  • * refactor(llmisvc): default EPP scheduler config as presets, latest plugins by @zdtsw in https://github.com/kserve/kserve/pull/5921

removals (1)

  • * fix(quick-install): remove stray generated script by @Jooho in https://github.com/kserve/kserve/pull/6101

renames (1)

  • * feat(llmisvc): replace UDS tokenizer sidecar with vLLM render deployment by @vivekk16 in https://github.com/kserve/kserve/pull/5712
Add KServe to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All KServe releases →