v3.5.0

# What's new in 3.5.0 (2026-09-25)
These are the changes in inference v3.5.0.
## Security

Xinference 3.5.0 fixes a custom-model registration vulnerability that allowed a caller to forge built-in provenance and bypass repository-code execution restrictions. See [GHSA-jv65-rccw-j2j6](https://github.com/xorbitsai/inference/security/advisories/GHSA-jv65-rccw-j2j6) for affected versions and authentication requirements.

Upgrade every supervisor and worker to 3.5.0 or a later supported release. Also review existing persisted custom-model registrations for an unexpected `is_builtin: true` value: the patch sanitizes new registration requests but does not rewrite registrations saved before the upgrade. The advisory includes cleanup guidance.

Thanks to [Paul White (Su1ph3r), Cairn Security](https://github.com/Su1ph3r) for reporting and validating this issue, and to [Jan Kahmen (kah-ja), turingpoint](https://github.com/kah-ja) for the independent report and patch.

## New features
* feat(audio): add AuK and AuK-Flash TTS support by @Minamiyama in https://github.com/xorbitsai/inference/pull/5525
* feat(audio): add Irodori TTS v4.1 support by @Minamiyama in https://github.com/xorbitsai/inference/pull/5527
* feat(virtualenv): add package details by @Minamiyama in https://github.com/xorbitsai/inference/pull/5529
* feat(ui): sort package details by @Minamiyama in https://github.com/xorbitsai/inference/pull/5539
* feat(world): add LingBot-World-V2 support by @Minamiyama in https://github.com/xorbitsai/inference/pull/5536
* feat(audio): add YuE2 music generation by @Minamiyama in https://github.com/xorbitsai/inference/pull/5526
* feat(llm): add Spark-X2.5 model support by @Minamiyama in https://github.com/xorbitsai/inference/pull/5538
* feat(api): add opt-in model request logging by @m199369309 in https://github.com/xorbitsai/inference/pull/5545
* feat(core): propagate correlation metadata across actor calls by @m199369309 in https://github.com/xorbitsai/inference/pull/5547
* feat(audio): support FishAudio-S2-Pro with MLX by @qinxuye in https://github.com/xorbitsai/inference/pull/5551
* feat(audio): support Irodori TTS Small with MLX by @qinxuye in https://github.com/xorbitsai/inference/pull/5553
* feat(model):support MinerU2.5 model by @llyycchhee in https://github.com/xorbitsai/inference/pull/5550
* feat(audio): support Breeze TTS 2 with MLX by @qinxuye in https://github.com/xorbitsai/inference/pull/5555
* feat(audio): support MiniMax Music3 with MLX by @qinxuye in https://github.com/xorbitsai/inference/pull/5558
* feat: recommend launch configurations for LLM, embedding, rerank and audio by @qinxuye in https://github.com/xorbitsai/inference/pull/5563
* feat(logging): add model request source identity by @m199369309 in https://github.com/xorbitsai/inference/pull/5559
* feat(api): add protected model request log access by @m199369309 in https://github.com/xorbitsai/inference/pull/5560
* feat(monitoring): index model request logs separately by @m199369309 in https://github.com/xorbitsai/inference/pull/5561
* feat(webui): add model request log observability by @m199369309 in https://github.com/xorbitsai/inference/pull/5562
* feat(UI): enhance running model capability experience by @maoyuehui in https://github.com/xorbitsai/inference/pull/5569
* feat(image): add Qwen-Image-2.1 support by @Minamiyama in https://github.com/xorbitsai/inference/pull/5571
* feat(ui): add audit time range options by @leslie2046 in https://github.com/xorbitsai/inference/pull/5577
* feat: recommend model sizes using offline memory metadata by @qinxuye in https://github.com/xorbitsai/inference/pull/5576
* feat(diffusion): expose native concurrency for image and Wan video engines by @qinxuye in https://github.com/xorbitsai/inference/pull/5579
* FEAT: show per-replica model launch progress by @leslie2046 in https://github.com/xorbitsai/inference/pull/5581
* feat(image): add Ming-Image support by @Minamiyama in https://github.com/xorbitsai/inference/pull/5582
* feat(image): add TeleOCR OCR and GGUF support by @Minamiyama in https://github.com/xorbitsai/inference/pull/5583
## Enhancements
* ENH: Report disk usage in cache management by @Minamiyama in https://github.com/xorbitsai/inference/pull/5528
* ENH(llm): extend Ling-3.0-flash model support by @Minamiyama in https://github.com/xorbitsai/inference/pull/5556
* perf: modify model_ability to suit frontend pages by @llyycchhee in https://github.com/xorbitsai/inference/pull/5552
* perf(pooling): use native vLLM batching for embedding and rerank by @qinxuye in https://github.com/xorbitsai/inference/pull/5574
* perf(api): freeze startup heap and combine request middleware by @qinxuye in https://github.com/xorbitsai/inference/pull/5575
## Bug fixes
* fix(core): reset client-supplied is_builtin on custom model registration by @kah-ja in https://github.com/xorbitsai/inference/pull/5530
* fix(metrics): start cluster updater from API lifespan by @m199369309 in https://github.com/xorbitsai/inference/pull/5534
* fix(llm): materialize client-supplied media before vendor readers by @bluefish-08 in https://github.com/xorbitsai/inference/pull/5533
* fix(audio): handle silent inputs for FunASR and MegaTTS3 by @m199369309 in https://github.com/xorbitsai/inference/pull/5537
* fix: improve ModelScope and offline model loading by @amumu96 in https://github.com/xorbitsai/inference/pull/5541
* fix(llm): normalize streamed tool calls and usage by @amumu96 in https://github.com/xorbitsai/inference/pull/5544
* fix(worker): run supervisor reporting RPCs on actor loop by @m199369309 in https://github.com/xorbitsai/inference/pull/5554
* fix(vllm): abort requests on client disconnect by @amumu96 in https://github.com/xorbitsai/inference/pull/5549
* fix: avoid full-sequence Qwen3 reranker logits by @Solaris-star in https://github.com/xorbitsai/inference/pull/5557
* fix: correct embedding benchmark concurrency and throughput by @qinxuye in https://github.com/xorbitsai/inference/pull/5566
* fix(logging): keep uvicorn access records out of application logs by @m199369309 in https://github.com/xorbitsai/inference/pull/5565
* fix(logging): normalize model request IDs and event types by @m199369309 in https://github.com/xorbitsai/inference/pull/5564
* fix(cluster): improve node version and resource display by @m199369309 in https://github.com/xorbitsai/inference/pull/5570
* fix(flux): remove duplicate quantizations by @Minamiyama in https://github.com/xorbitsai/inference/pull/5573
* fix(ui): improve launch progress layout by @leslie2046 in https://github.com/xorbitsai/inference/pull/5578
* fix(docker): include RPC context in pypiserver build by @qinxuye in https://github.com/xorbitsai/inference/pull/5584
* fix(docker): parse marked wheel references in mirror selfcheck by @qinxuye in https://github.com/xorbitsai/inference/pull/5586
## Documentation
* doc: update README model highlights for v3.4.0 by @qinxuye in https://github.com/xorbitsai/inference/pull/5531
* doc: add v3.4.0 to release notes index and locale catalogs by @martinma51 in https://github.com/xorbitsai/inference/pull/5535
* doc: organize user guide and complete Chinese translations by @qinxuye in https://github.com/xorbitsai/inference/pull/5567
## Others
* refactor: split built-in model catalogs into per-model files by @qinxuye in https://github.com/xorbitsai/inference/pull/5568
* refactor(image): remove custom Diffusers step scheduler by @qinxuye in https://github.com/xorbitsai/inference/pull/5580
* chore(catalog): add model spec schemas by @Minamiyama in https://github.com/xorbitsai/inference/pull/5572

## New Contributors
* @kah-ja made their first contribution in https://github.com/xorbitsai/inference/pull/5530

**Full Changelog**: https://github.com/xorbitsai/inference/compare/v3.4.0...v3.5.0