v4.0.0 v4.0.1
xorbitsai/inferenceOct 10, 2026 → Oct 16, 20266 days between releases
What's New
Requires Xoscar 0.12.0 and adds opt-in HMAC-SHA256 actor transport auth
Breaking Changes
- Requires Xoscar 0.12.0 or later
- Authentication disabled by default until XOSCAR_AUTH_KEY is configured
- Keyed and unkeyed peers cannot communicate after enabling auth
Improvements
- Mitigates CVE-2026-49950 via Xoscar 0.12.0 authentication
- Adds deployment guidance for authentication rejection scenarios
Upgrade Notes
Upgrade to v4.0.1 and ensure Xoscar 0.12.0 is installed. Generate a random secret key for XOSCAR_AUTH_KEY and configure it in your deployment settings to enable authentication, as it is disabled by default.
The Two Releases
v4.0.0
Oct 10, 2026· 12 days ago
Version 4.0.0 introduces significant performance and architectural improvements, including native NIXL backend support for vLLM and SGLang PD deployments, advanced Xavier KV cache sharing across multiple engines, and a new runtime log center. The release adds new capabilities like Jina OCR v1, Confucius4-TTS, and a Stateless OpenAI Responses API, alongside performance optimizations and bug fixes for cross-platform compatibility.
Full release notesv4.0.1
Oct 16, 2026· 6 days ago
This patch release introduces actor transport authentication integration to mitigate CVE-2026-49950 by requiring Xoscar 0.12.0 and configuring a secret key for opt-in HMAC-SHA256 protection.
Full release notes