v1.3.0

# 🚀 Added

## 🦾 RF-DETR Keypoints — pose estimation joins the RF-DETR family

The big one this release: thanks to @sergii-bond, RF-DETR now supports **keypoint** detection alongside the existing detection head — a single model architecture across detection and pose. Thanks to the contribution (https://github.com/roboflow/inference/pull/2401, https://github.com/roboflow/inference/pull/2416) you can pull a fine-tuned RF-DETR keypoints model and run it through the standard inference + workflows path with no extra plumbing.

## 🧬 YOLO26 Semantic Segmentation — fine-tuned models + binary head

Following YOLO26's earlier landing, @leeclemnet rounded out the segmentation story this release: fine-tuned YOLO26 sem-seg models are now first-class in `inference` (https://github.com/roboflow/inference/pull/2407, https://github.com/roboflow/inference/pull/2419).

<img  alt="image" src="https://github.com/user-attachments/assets/2efa5024-cb4f-41f9-bd8f-24ec5560e4a0" />

## 🔥 New Workflows blocks

| Block | Type Slug | What it does |
| --- | --- | --- |
| current_time/v1.py | `roboflow_core/current_time@v1` | Inject the current wall-clock time into the workflow graph as a typed step output |
| Vision Events (local mode) | enterprise | Run the Vision Events block in an in-process event-store mode instead of round-tripping through Roboflow infra |

- `roboflow_core/current_time@v1` — by @patricknihranz in https://github.com/roboflow/inference/pull/2410. Drop it before any block that needs a timestamp (audit trails, time-windowed aggregations, freshness gates) without writing a custom block.
- **Vision Events block — local event-store mode** (ENT-1192) — by @rvirani1 in https://github.com/roboflow/inference/pull/2402. Useful for on-prem and isolated-network deployments where the central event sink isn't reachable.

## 🧰 Workflow block improvements

A theme this release: a handful of existing blocks gained **selector** inputs so you can drive their parameters from upstream step outputs instead of hard-coding at the block level.

- **GLM-OCR** — accepts a selector for `task_type` (@nathan-marraccini, https://github.com/roboflow/inference/pull/2409). Switch OCR mode dynamically based on prior workflow signals.
- **Qwen3.5-VL** — accepts selectors for `prompt` and `system_prompt` (@nathan-marraccini, https://github.com/roboflow/inference/pull/2408). Compose prompts from prior steps without an intermediate Python block.
- **NumberInRange operator** is now exposed in the Workflow Builder UI (@patricknihranz, https://github.com/roboflow/inference/pull/2229) — previously only reachable by hand-editing the YAML.

## 🌟 Other additions

- **Gemini 2.5 native object-detection format** is now parsed by `vlm_as_detector`, so you can route Gemini 2.5 outputs through the same downstream blocks as any other detector (@dkosowski87, https://github.com/roboflow/inference/pull/2400).
- **Volume support** added by @nkuneman in https://github.com/roboflow/inference/pull/2413 — see the PR for the mount conventions.
- **`roboflow/inference-server-experimental`** image published (@grzegorz-roboflow, https://github.com/roboflow/inference/pull/2406) — an opt-in track for early bits before they hit the main image.


# 🔒 Security — please review your deployment

This release ships **security enhancements for local deployments** (https://github.com/roboflow/inference/pull/2417 by @PawelPeczek-Roboflow) and, alongside it, a new dedicated documentation page that walks through how to harden a self-hosted Inference server:

👉 **[inference.roboflow.com/install/security](https://inference.roboflow.com/install/security/)**

> [!IMPORTANT]
> If you run Inference outside of localhost — in a container, on a shared host, on a private network, or anywhere reachable beyond a single developer machine — please take a few minutes to read the new guide. **You own the security posture of your deployment.** A default-configured server is adjusted to work in development-friendly mode and **should not be deployed as is in production grade environments**, due to exposing unauthenticated endpoints and ability to run Custom Python Blocks in Workflows Execution Engine.

The guide covers, in short:

- **Restrict network access** — bind to localhost, keep on a private network, or place behind a firewall. Never expose the inference port directly to the public internet without authentication and TLS.
- **Enforce authentication** — use `WORKSPACES_WHITELISTED_FOR_LOCAL_DEPLOYMENT` to require valid API keys, or place your own auth layer (OAuth, mTLS) in front.
- **Enable TLS** — terminate HTTPS at a reverse proxy or set `ENABLE_HTTPS=true` on the server itself.
- **Disable custom Python execution** — set `ALLOW_CUSTOM_PYTHON_EXECUTION_IN_WORKFLOWS=false` unless you specifically need it.

If you have a public-facing or multi-tenant deployment, these are not optional. The new docs page is the canonical reference going forward.


# 🔧 Fixed

* **Core models — forward `countinference` / `service_secret` when downloading weights** by @iurisilvio in https://github.com/roboflow/inference/pull/2398 — keeps usage attribution and gated-weights flows working when models are pulled at runtime.
* **Batch processing** fix by @digaobarbosa in https://github.com/roboflow/inference/pull/2411.
* **Workflows / Data Aggregator** — corrected `values_difference` aggregation by @madhavcodez in https://github.com/roboflow/inference/pull/2388. First-time contribution — thank you!
* **Graceful fallback on ephemeral cache failure** by @dkosowski87 in https://github.com/roboflow/inference/pull/2387 — the cache layer no longer takes the whole request down when its store is unavailable.
* **Server-side TTL on model-monitoring zset writes** by @bigbitbus in https://github.com/roboflow/inference/pull/2390 — model-monitoring entries now expire on the cache server even if a client never cleans up.


# 🚧 Maintenance

* Bump `inference` to 1.2.13 by @dkosowski87 in https://github.com/roboflow/inference/pull/2396.
* Update dependencies to fix main by @PawelPeczek-Roboflow in https://github.com/roboflow/inference/pull/2415.
* CI: concurrency cancellation on PR-triggered test workflows by @bigbitbus in https://github.com/roboflow/inference/pull/2392 — newer pushes to a PR cancel stale CI runs.
* Updated runtime-compatibility docs by @rafel-roboflow in https://github.com/roboflow/inference/pull/2391.
* Docs build sets `LOAD_ENTERPRISE_BLOCKS=TRUE` by @rvirani1 in https://github.com/roboflow/inference/pull/2386 — enterprise blocks now show up in the rendered docs.


# 👋 New contributors

A warm welcome to two first-time contributors landing in this release:

- **@nkuneman** — Volume support (https://github.com/roboflow/inference/pull/2413)
- **@madhavcodez** — `values_difference` aggregation fix in Data Aggregator (https://github.com/roboflow/inference/pull/2388)

---

**Full Changelog**: https://github.com/roboflow/inference/compare/v1.2.13...v1.3.0