v1.5.2

# 🚀 Added

## 🎬 Action Recognition — a new video task

Action Recognition labels frame ranges in a clip: the output is a list of `(start_frame_idx, end_frame_idx, class)` tuples, and ranges may overlap. The temporal contract travels with the model — a `VideoSampling` description states the window length, the sample rate and the limits the model was trained with, so a caller sends a clip and nothing else, with no window or frame-rate knobs to get wrong. Two kinds of checkpoint share the one output type: fine-tunes trained on Roboflow use sliding windows and a constrained decoder, while zero-shot models read a whole clip in one call and name the events they find in their own words (@leeclemnet, https://github.com/roboflow/inference/pull/2854).

**How to use it.** Four surfaces reach the task: the `roboflow_core/roboflow_action_recognition_model@v1` Workflow block, the new `POST /infer/action_recognition` route, the legacy `/{model}/{version}` route that serverless serves today, and `client.infer_on_video` in the SDK. Zero-shot checkpoints are endpoint-only — a stream has no end to span, so the block refuses a whole-video package and points at the endpoint instead.

## 🧠 Roboflow Cosmos 3 Edge fine-tunes

Cosmos 3 Edge fine-tunes trained on Roboflow ship as LoRA adapter packages, and the server now loads them over the base checkpoint the same way the other fine-tuned VLMs do — until now `Cosmos3EdgeReasoner` could only load a full checkpoint. The `roboflow_core/cosmos3_edge@v1` block accepts a fine-tune's model id in `model_version` and no longer injects its own default system prompt, so a fine-tune reached through Workflows is prompted exactly as it was trained. As part of this, `InferenceConfig` no longer requires a training input size for models that accept any input size, and the model gained the documentation page it never had (@probicheaux, https://github.com/roboflow/inference/pull/2905).

## 📍 RF-DETR keypoint detection on TensorRT

The registry had an ONNX backend for RF-DETR keypoints and nothing else. This release adds `RFDetrForKeyPointsTRT`: `AutoModel.from_pretrained(..., backend=BackendType.TRT, device="cuda")` loads a local TRT package and returns `KeyPoints` with the same contract as ONNX, reusing the instance-segmentation TRT engine-loading path with CUDA graphs (@MehdiH7, https://github.com/roboflow/inference/pull/2900). 

We've tested the model locally, **but registration of platform weights is going to be completed soon**. Nevertheless, we would like to **highlight** @MehdiH7 contribution.

## 🤖 More VLM options in Workflows

The Anthropic Claude blocks gain Claude Fable 5.1, the Google Gemini v5 block gains Gemini 3.8 Flash and the Meta VLM v2 block gains Muse Spark 1.3. OpenRouter-backed VLM blocks are now routed to native-precision providers, and GLM 5.3 Flash detection switched to the validated `bbox_2d` prompt. These landed on the post-v1.5.1 fast-track branches and are upstreamed here (@SkalskiP, @Erol444, https://github.com/roboflow/inference/pull/2910, https://github.com/roboflow/inference/pull/2913, https://github.com/roboflow/inference/pull/2926).

## 🔍 Camera Focus v2 runs on the GPU

When the frame is already a device tensor, `roboflow_core/camera_focus@v2` computes grayscale, Sobel and the focus measure with torch ops and pulls the overall value plus every per-box mean to the host in a single sync, instead of materialising the full frame and copying it several more times for the overlays. The numpy path is untouched, and the device path is bit-exact against it — overlays included (@shntu, https://github.com/roboflow/inference/pull/2901).

## 🩺 Proxy health probe — `GET /secure-gateway/health`

Deployments that reach Roboflow through the secure gateway (or the legacy license server) had no way to tell a broken proxy from a broken server: a model download failing behind the gateway looked exactly like the inference server being unhealthy. The server now exposes an opt-in `GET /secure-gateway/health` route that probes the configured proxy's own `/health` endpoint from inside the inference server and reports a verdict, so monitoring can point at the right component (@PawelPeczek-Roboflow, https://github.com/roboflow/inference/pull/2908).

**How to configure it.**
The route is disabled by default and only makes sense on a server that has a proxy configured. Set `SECURE_GATEWAY_HEALTH_ENDPOINT_ENABLED=True` next to your existing `SECURE_GATEWAY` value (the legacy `LICENSE_SERVER` variable is still honoured).  Additionally `SECURE_GATEWAY_HEALTH_CHECK_TIMEOUT` determines the timeout requesting response from the proxy

```bash
docker run -d --name inference -p 9001:9001 \
  -e SECURE_GATEWAY=https://gateway.internal \
  -e SECURE_GATEWAY_HEALTH_ENDPOINT_ENABLED=True \
  -e SECURE_GATEWAY_HEALTH_CHECK_TIMEOUT=5 \
  roboflow/roboflow-inference-server-cpu:1.5.2
```

Try it out with

```bash
curl -s http://localhost:9001/secure-gateway/health
# {"status": "healthy", "reason": null, "gateway_status_code": 200, "latency_ms": 12.4}
```

## 📊 Nsight trace analysis in the profiling tools

The profiling harness gains a scriptable analysis step: it runs `nsys stats` on a captured `.nsys-rep`, joins host-side NVTX ranges with GPU-projected ranges by process, thread and range id, validates the iteration set declared by the run manifest, and writes a versioned `analysis.json` next to the trace — no desktop UI needed to review a capture (@Silas-Asamoah, https://github.com/roboflow/inference/pull/2878).

# 🔧 Fixed

- **Custom Python blocks over WebSocket stay connected** — the webexec server closed idle sockets after ten seconds while the client's keepalive pings were answered below the application layer and never reset that timer, which sat behind the recent video-processing incidents. The protocol moves to v2 with app-level heartbeats that actually reset the server's idle timer, typed frame handling so a stray text frame is treated as a dead connection instead of parsed, request ids with per-container dedup so a resend after a lost response is answered from cache, an announced graceful close, and an opt-in loud failure when a reconnect lands on a container that lost the Python session. `WEBEXEC_WS_MAX_CONNECTION_SECONDS` drops from 3600 to 600 so the server always closes cleanly before Modal's per-input timeout, and `websocket-client` is now a declared dependency (@rafel-roboflow, https://github.com/roboflow/inference/pull/2879).
- **Custom Python blocks fed with semantic segmentation predictions work again** — every run failed with a lost WebSocket and no traceback, because the transport dropped the RLE masks and sent an image with no dimensions. RLE masks and image size now survive both Modal transports, and the confidence map is stored so boolean filtering of the detections works too (@Erol444, https://github.com/roboflow/inference/pull/2923).
- **VLM output parsing in the `vlm_as_*` blocks is lenient and model-agnostic** — replaying two weeks of playground parse failures drove the change: single detection objects emitted without their list, list bodies with the opening bracket dropped, one empty array per line, and classifier outputs without their wrapper are all recovered now, while truncated output still fails loudly (@Erol444, https://github.com/roboflow/inference/pull/2921 via https://github.com/roboflow/inference/pull/2926, https://github.com/roboflow/inference/pull/2930).
- **Cache Get, Cache Set and the ONVIF sink no longer refuse to run based on `step_execution_mode`** — that flag only says where model steps execute and was the wrong proxy for "is this a long-lived process". The cache blocks now carry the same soft multi-replica caveat every tracker has, and the ONVIF sink keeps its hard restriction on hosted runtimes that cannot reach a customer LAN (@rafel-roboflow, https://github.com/roboflow/inference/pull/2918).
- **OWLv2 cache test kept off `torch.compile`** — torch 2.14 rejects the mocked model (@probicheaux, https://github.com/roboflow/inference/pull/2914).
- **Jetson 6.0.0 build repaired** — it copied `libnvdla_compiler.so` from a directory that only exists at container runtime and had failed on every push since June (@probicheaux, https://github.com/roboflow/inference/pull/2924); superseded by the deprecation below.
- **Docs sitemap no longer lists the homepage twice** (@Erol444, https://github.com/roboflow/inference/pull/2899).

# 🚧 Maintenance

- **Security dependency refresh (2026-09-04)** — `inference-models` moves to 0.37.0 (from 0.37.0rc3) and transformers to the 5.15 line in its lock, alongside hydra-core, tornado and mkdocs-material (@PawelPeczek-Roboflow, https://github.com/roboflow/inference/pull/2929, https://github.com/roboflow/inference/pull/2931). See the JetPack 5 notice below for the one image this refresh does not cover.
- **CI hygiene** — the e2e CI suite is green again and obsolete AWS references are gone from the GitHub Actions workflows (@grzegorz-roboflow, https://github.com/roboflow/inference/pull/2895, https://github.com/roboflow/inference/pull/2894); linter cleanup (@PawelPeczek-Roboflow, https://github.com/roboflow/inference/pull/2911).

# ⚠️ Jetson platform notices

- **JetPack 6.0 and JetPack 7.1 images are discontinued.** Starting with v1.5.2 we no longer build `roboflow-inference-server-jetson-6.0.0` and `roboflow-inference-server-jetson-7.1.0` (https://github.com/roboflow/inference/pull/2932). If you are on JetPack 6, move to `roboflow-inference-server-jetson-6.2.0`; if you are on JetPack 7, move to `roboflow-inference-server-jetson-7.2.0`. Both are drop-in replacements within the same JetPack generation.
- **JetPack 5 and JetPack 6.2 reach end of life at the end of 2026.** The `jetson-5.1.1` and `jetson-6.2.0` images keep receiving builds until then and stop afterwards. JetPack 7.2 is the platform going forward, so plan the migration now — and if your fleet cannot move on its own, contact your Roboflow support representative for a transition plan.
- **Security caveat for the JetPack 5 image.** The security refresh above moves every image onto a transformers release that addresses [CVE-2026-9856](https://nvd.nist.gov/vuln/detail/cve-2026-9856), except one: the JetPack 5 build does not work with the patched transformers 5.10 line, and we had to pin it back to transformers 5.7.0 to keep the image buildable (https://github.com/roboflow/inference/pull/2933). The `jetson-5.1.1` image therefore remains exposed to that vulnerability. If you run JetPack 5 devices on untrusted inputs, treat this as one more reason to bring the JetPack 7.2 migration forward.

## 🏅 New Contributors

* @Silas-Asamoah made their first contribution in https://github.com/roboflow/inference/pull/2878
* @MehdiH7 made their first contribution in https://github.com/roboflow/inference/pull/2900

**Full Changelog**: https://github.com/roboflow/inference/compare/v1.5.1...v1.5.2