v1.5.2

🚀 Added

🎬 Action Recognition — a new video task

Action Recognition labels frame ranges in a clip: the output is a list of (start_frame_idx, end_frame_idx, class) tuples, and ranges may overlap. The temporal contract travels with the model — a VideoSampling description states the window length, the sample rate and the limits the model was trained with, so a caller sends a clip and nothing else, with no window or frame-rate knobs to get wrong. Two kinds of checkpoint share the one output type: fine-tunes trained on Roboflow use sliding windows and a constrained decoder, while zero-shot models read a whole clip in one call and name the events they find in their own words (@leeclemnet, #2854).

How to use it. Four surfaces reach the task: the roboflow_core/roboflow_action_recognition_model@v1 Workflow block, the new POST /infer/action_recognition route, the legacy /{model}/{version} route that serverless serves today, and client.infer_on_video in the SDK. Zero-shot checkpoints are endpoint-only — a stream has no end to span, so the block refuses a whole-video package and points at the endpoint instead.

🧠 Roboflow Cosmos 3 Edge fine-tunes

Cosmos 3 Edge fine-tunes trained on Roboflow ship as LoRA adapter packages, and the server now loads them over the base checkpoint the same way the other fine-tuned VLMs do — until now Cosmos3EdgeReasoner could only load a full checkpoint. The roboflow_core/cosmos3_edge@v1 block accepts a fine-tune's model id in model_version and no longer injects its own default system prompt, so a fine-tune reached through Workflows is prompted exactly as it was trained. As part of this, InferenceConfig no longer requires a training input size for models that accept any input size, and the model gained the documentation page it never had (@probicheaux, #2905).

📍 RF-DETR keypoint detection on TensorRT

The registry had an ONNX backend for RF-DETR keypoints and nothing else. This release adds RFDetrForKeyPointsTRT: AutoModel.from_pretrained(..., backend=BackendType.TRT, device="cuda") loads a local TRT package and returns KeyPoints with the same contract as ONNX, reusing the instance-segmentation TRT engine-loading path with CUDA graphs (@MehdiH7, #2900).

We've tested the model locally, but registration of platform weights is going to be completed soon. Nevertheless, we would like to highlight @MehdiH7 contribution.

🤖 More VLM options in Workflows

The Anthropic Claude blocks gain Claude Fable 5.1, the Google Gemini v5 block gains Gemini 3.8 Flash and the Meta VLM v2 block gains Muse Spark 1.3. OpenRouter-backed VLM blocks are now routed to native-precision providers, and GLM 5.3 Flash detection switched to the validated bbox_2d prompt. These landed on the post-v1.5.1 fast-track branches and are upstreamed here (@SkalskiP, @Erol444, #2910, #2913, #2926).

🔍 Camera Focus v2 runs on the GPU

When the frame is already a device tensor, roboflow_core/camera_focus@v2 computes grayscale, Sobel and the focus measure with torch ops and pulls the overall value plus every per-box mean to the host in a single sync, instead of materialising the full frame and copying it several more times for the overlays. The numpy path is untouched, and the device path is bit-exact against it — overlays included (@shntu, #2901).

🩺 Proxy health probe — GET /secure-gateway/health

Deployments that reach Roboflow through the secure gateway (or the legacy license server) had no way to tell a broken proxy from a broken server: a model download failing behind the gateway looked exactly like the inference server being unhealthy. The server now exposes an opt-in GET /secure-gateway/health route that probes the configured proxy's own /health endpoint from inside the inference server and reports a verdict, so monitoring can point at the right component (@PawelPeczek-Roboflow, #2908).

How to configure it.
The route is disabled by default and only makes sense on a server that has a proxy configured. Set SECURE_GATEWAY_HEALTH_ENDPOINT_ENABLED=True next to your existing SECURE_GATEWAY value (the legacy LICENSE_SERVER variable is still honoured). Additionally SECURE_GATEWAY_HEALTH_CHECK_TIMEOUT determines the timeout requesting response from the proxy

docker run -d --name inference -p 9001:9001 \
  -e SECURE_GATEWAY=https://gateway.internal \
  -e SECURE_GATEWAY_HEALTH_ENDPOINT_ENABLED=True \
  -e SECURE_GATEWAY_HEALTH_CHECK_TIMEOUT=5 \
  roboflow/roboflow-inference-server-cpu:1.5.2

Try it out with

curl -s http://localhost:9001/secure-gateway/health
# {"status": "healthy", "reason": null, "gateway_status_code": 200, "latency_ms": 12.4}

📊 Nsight trace analysis in the profiling tools

The profiling harness gains a scriptable analysis step: it runs nsys stats on a captured .nsys-rep, joins host-side NVTX ranges with GPU-projected ranges by process, thread and range id, validates the iteration set declared by the run manifest, and writes a versioned analysis.json next to the trace — no desktop UI needed to review a capture (@Silas-Asamoah, #2878).

🔧 Fixed

• Custom Python blocks over WebSocket stay connected — the webexec server closed idle sockets after ten seconds while the client's keepalive pings were answered below the application layer and never reset that timer, which sat behind the recent video-processing incidents. The protocol moves to v2 with app-level heartbeats that actually reset the server's idle timer, typed frame handling so a stray text frame is treated as a dead connection instead of parsed, request ids with per-container dedup so a resend after a lost response is answered from cache, an announced graceful close, and an opt-in loud failure when a reconnect lands on a container that lost the Python session. WEBEXEC_WS_MAX_CONNECTION_SECONDS drops from 3600 to 600 so the server always closes cleanly before Modal's per-input timeout, and websocket-client is now a declared dependency (@rafel-roboflow, #2879).
• Custom Python blocks fed with semantic segmentation predictions work again — every run failed with a lost WebSocket and no traceback, because the transport dropped the RLE masks and sent an image with no dimensions. RLE masks and image size now survive both Modal transports, and the confidence map is stored so boolean filtering of the detections works too (@Erol444, #2923).
• VLM output parsing in the vlm_as_* blocks is lenient and model-agnostic — replaying two weeks of playground parse failures drove the change: single detection objects emitted without their list, list bodies with the opening bracket dropped, one empty array per line, and classifier outputs without their wrapper are all recovered now, while truncated output still fails loudly (@Erol444, #2921 via #2926, #2930).
• Cache Get, Cache Set and the ONVIF sink no longer refuse to run based on step_execution_mode — that flag only says where model steps execute and was the wrong proxy for "is this a long-lived process". The cache blocks now carry the same soft multi-replica caveat every tracker has, and the ONVIF sink keeps its hard restriction on hosted runtimes that cannot reach a customer LAN (@rafel-roboflow, #2918).
• OWLv2 cache test kept off torch.compile — torch 2.14 rejects the mocked model (@probicheaux, #2914).
• Jetson 6.0.0 build repaired — it copied libnvdla_compiler.so from a directory that only exists at container runtime and had failed on every push since June (@probicheaux, #2924); superseded by the deprecation below.
• Docs sitemap no longer lists the homepage twice (@Erol444, #2899).

🚧 Maintenance

• Security dependency refresh (2026-09-04) — inference-models moves to 0.37.0 (from 0.37.0rc3) and transformers to the 5.15 line in its lock, alongside hydra-core, tornado and mkdocs-material (@PawelPeczek-Roboflow, #2929, #2931). See the JetPack 5 notice below for the one image this refresh does not cover.
• CI hygiene — the e2e CI suite is green again and obsolete AWS references are gone from the GitHub Actions workflows (@grzegorz-roboflow, #2895, #2894); linter cleanup (@PawelPeczek-Roboflow, #2911).

⚠️ Jetson platform notices

• JetPack 6.0 and JetPack 7.1 images are discontinued. Starting with v1.5.2 we no longer build roboflow-inference-server-jetson-6.0.0 and roboflow-inference-server-jetson-7.1.0 (#2932). If you are on JetPack 6, move to roboflow-inference-server-jetson-6.2.0; if you are on JetPack 7, move to roboflow-inference-server-jetson-7.2.0. Both are drop-in replacements within the same JetPack generation.
• JetPack 5 and JetPack 6.2 reach end of life at the end of 2026. The jetson-5.1.1 and jetson-6.2.0 images keep receiving builds until then and stop afterwards. JetPack 7.2 is the platform going forward, so plan the migration now — and if your fleet cannot move on its own, contact your Roboflow support representative for a transition plan.
• Security caveat for the JetPack 5 image. The security refresh above moves every image onto a transformers release that addresses CVE-2026-9856, except one: the JetPack 5 build does not work with the patched transformers 5.10 line, and we had to pin it back to transformers 5.7.0 to keep the image buildable (#2933). The jetson-5.1.1 image therefore remains exposed to that vulnerability. If you run JetPack 5 devices on untrusted inputs, treat this as one more reason to bring the JetPack 7.2 migration forward.

🏅 New Contributors

• @Silas-Asamoah made their first contribution in #2878
• @MehdiH7 made their first contribution in #2900

Full Changelog: v1.5.1...v1.5.2