v1.3.9

🚀 Added

🔀 Detections Difference — a fusion block for before/after comparison

The new roboflow_core/detections_difference@v1 fusion block compares two sets of detections and reports what changed: which objects disappeared, which persisted, and which are new. Matching is configurable (IoU threshold plus optional class agreement), which makes the block a natural building brick for tamper detection, shelf-restock monitoring, or any workflow that needs to reason about the delta between a reference frame and the current one instead of raw per-frame predictions (@adawgwats, #2765).

📦 Write Vision Event Bundle sink

The new roboflow_core/vision_event_bundle@v1 sink block packages predictions, annotated frames and event metadata into a single portable bundle archive, with cooldown control so bundles are emitted at a sensible rate rather than per frame. This gives Workflows a first-class way to hand a complete, self-describing evidence package to downstream systems instead of loose files (@rvirani1, #2761).

🤖 VLM lineup: Qwen 3.8 Max and per-model detection prompts for open_ai@v5

The Qwen VLM block family gains Qwen 3.8 Max served via OpenRouter (@Erol444, #2755). Alongside it, open_ai@v5 learns per-model detection prompt styles — each OpenAI model family gets the prompt format it detects best with, including absolute-pixel box_2d output — and vlm_as_detector@v2 ships the matching parser so those responses turn into first-class detections, correctly rescaled from the downsized upload back to the original image (@SkalskiP, #2750).

🦴 rfdetr-keypoint-preview alias

The COCO-pretrained RF-DETR keypoint model is now reachable under the rfdetr-keypoint-preview alias, resolving like the other pretrained aliases (yolo26n-pose-640 and friends) in both inference and the SDK (@mkaic, #2758).

🔐 Hardened RTSPS streaming

Two more installments of the stream-security series land in this release. The GStreamer RTSPS path now supports a custom CA bundle and explicit TLS validation flags, so self-hosted deployments with private certificate authorities can validate camera connections properly instead of loosening security to connect (@NVergunst-ROBO, #2726). And camera source references are sanitized at the inference pipeline boundary — RTSP credentials embedded in stream URLs no longer leak into logs, status events or error messages, while error classification still runs on the raw text so redaction never changes what kind of error gets reported (@NVergunst-ROBO, #2683).

⚡ Faster semantic segmentation post-processing

Two performance PRs cut the cost of the semantic segmentation workflow path: model responses can now carry the class map as an in-process numpy array instead of a base64-encoded PNG when model and workflow run in the same process (@theo-roboflow, #2729), and post-processing uses a present_class_ids hint plus a single F-order conversion so per-class mask extraction stops re-scanning and re-converting the full-resolution class map for every class (@theo-roboflow, #2728).

🔧 Fixed

• Dataset Upload no longer cuts instance masks when downscaling images — annotation scaling now uses separate horizontal and vertical factors matched to the exact stored JPEG dimensions, and dense masks are resized directly instead of round-tripping through polygons, so boxes and masks stay on-canvas for non-uniform resizes (@SolomonLake, #2738).
• Usage tracking can no longer fail an inference call — telemetry errors are contained instead of propagating into the request path (@arthi-arumugam-git, #2745).
• Model usage attribution fixed for cached SAM2/SAM3 requests (@hansent, #2751) and fine-tuned SAM 3 Serverless failures now return actionable error messages (@hansent, #2756).
• OPC UA sessions are released instead of orphaned — the OPC UA writer sink now closes sessions on the server when done, preventing session exhaustion on industrial endpoints (@rvirani1, #2763).
• Weights proxy URL builder aligned with wrap_url — proxy-prefixed weight downloads now compose base paths correctly and idempotently (@rs-03, #2747).
• Removed a deadlock in the RTSPS TLS serialization test that hung the UNIT TESTS - inference job until its 15-minute timeout on every CI run (@PawelPeczek-Roboflow, #2749).

🚧 Maintenance

• supervision pinned <0.30.0 — supervision 0.30.0 changed detections-ingestion behavior (invalid polygons are no longer skipped) and added per-detection validation on the data container, both of which break current inference behavior and CI; the pin holds until the code is adapted deliberately (@Erol444, #2760).
• fastapi upper bound relaxed to <0.129, unblocking installs alongside newer FastAPI (@saikrishna01301, #2741).
• Security dependency patch, August 2026 edition (@PawelPeczek-Roboflow, #2766).
• Docs moved home: inference.roboflow.com now redirects to docs.roboflow.com (@Erol444, #2754).

---

📦 Side note: dual GPU build for Cosmos 3

There is still no released transformers version that ships the NVIDIA Cosmos 3 model code, so this release again publishes two GPU server builds:

• roboflow/roboflow-inference-server-gpu:1.3.9 — the standard build, with the regular dependency stack (no Cosmos 3).

• roboflow/roboflow-inference-server-gpu:1.3.9-cosmos3 — identical server, but with the custom transformers dependency set required by NVIDIA Cosmos 3 Edge:

  docker pull roboflow/roboflow-inference-server-gpu:1.3.9-cosmos3

Use the -cosmos3 tag only if you need the Cosmos 3 Edge preview self-hosted; all other images are single-build.

---

🏅 New Contributors

• @theo-roboflow made their first contribution in #2728
• @saikrishna01301 made their first contribution in #2741
• @rs-03 made their first contribution in #2747
• @adawgwats made their first contribution in #2765
• @arthi-arumugam-git made their first contribution in #2745

Full Changelog: v1.3.8...v1.3.9