kserve/kserve v0.18.0-rc0 on GitHub

What's Changed

choir: fix missing markers by @Jooho in #4793
fix: update base image for PMML to use eclipse-temurin JDK by @sivanantha321 in #4794
add suffix kserve for helm chart of llmisvc by @Jooho in #4792
Parallelize blob downloads from azure in storage-initializer by @agoston in #4709
Parallelize blob downloads from S3 in storage-initializer by @agoston in #4714
chore: bump k8s package versions to v0.34.0 by @murataslan in #4713
Prevent path traversal on https.go by @spolti in #4796
Refactor existing script to use centralized installation scripts by @Jooho in #4787
fix: CI failure caused by deprecated MinIO image by @Jooho in #4812
feat: Add a python script to generate quick install script by @Jooho in #4806
fix generator to be executable without cloning repo by @Jooho in #4813
Fixing LLMISVC CRD Installation Paths by @brettmthompson in #4811
feat: Add pathTemplate configuration for inference service routing by @DeepFlame-JR in #4817
helmchart: add image pull policy for serving runtimes by @stergem in #4814
fix: multiple storage uri volume mount error by @sivanantha321 in #4822
Fix Bug in LLMISVC E2E Test Setup by @brettmthompson in #4841
fix: Fix various bugs in quickstart scripts by @JonahSussman in #4832
Pin starlette to version 0.49.1 to fix CVE-2025-62727 by @hdefazio in #4846
fix(llmisvc): adds missing generated clients by @bartoszmajsak in #4849
Change security mailing list email address by @terrytangyuan in #4853
Allow stopping LLMInferenceService by @pierDipi in #4839
Add cjohannsen-cloudera as a reviewer by @terrytangyuan in #4854
update go version to 1.25 and kubebuilder version to 1.9.0 by @Jooho in #4862
fix: remove cert-manager annotation in inferenceservice crd by @juhyeon-cha in #4837
update kserve version and update helm chart name by @Jooho in #4860
fix: Address CVE-2025-22872, CVE-2025-47914, CVE-2025-58181 by @sivanantha321 in #4866
Add Support For Protocol in S3 Endpoint by @brettmthompson in #4797
fix: llmisvc image patch script to use renamed manager yaml file by @sivanantha321 in #4820
fix make deploy target in makefile by @Jooho in #4872
ci: add manual trigger for helm publish workflow by @sivanantha321 in #4873
docs: Update KServe diagram to use the KubeCon NA version by @terrytangyuan in #4877
CVE-2024-43598: Update lightgbm version to 4.6.0 by @sivanantha321 in #4799
fix: the quick install scripts temporarily. by @Jooho in #4880
mock test for ray by @Jooho in #4885
fix: synced kserve-helm.sh and kserve-kustomize.sh by @Jooho in #4891
fix: update LWS version to 0.7.0 to fix multi-node E2E test failure by @vivekk16 in #4892
OCI model storage is not working with multi-node feature by @spolti in #4889
Follow up 4787 by @Jooho in #4810
Fix CI precommit error by @andyi2it in #4897
fix: clear stale router and scheduler conditions on config changes by @vivekk16 in #4876
feat: bump up vllm version to 0.11.2 & remove python 3.9 support by @csy1204 in #4851
Remove deprecated --disable-log-requests flag for vLLM 0.11 compatibility by @vivekk16 in #4883
Improved CA Bundle Management For LLM Inference Services by @brettmthompson in #4803
ci: split KServe and Storage publish workflow into separate jobs by @sivanantha321 in #4801
chore: Add .gitattributes to mark vendored and generated code by @terrytangyuan in #4904
ci: add retry request for e2e tests to reduce transient failures by @sivanantha321 in #4795
Address several CVEs by @spolti in #4912
fix: make deploy-dev for development env by @Jooho in #4881
Add precommit check to sync golangci Go version with go.mod by @Jooho in #4930
refactor: replace bash script with Python and improve generate-version by @Jooho in #4935
Fix: opentelemetry helm installation script by @Jooho in #4932
chore: bump github.com/kedacore/keda/v2 from 2.16.1 to 2.17.3 by @jlost in #4927
CVE-2025-66418 - Unbounded number of links in the decompression chain by @spolti in #4928
Fix: LLMInferenceService reconciliation for Gateway refs in baseRefs by @vivekk16 in #4944
Fix: use correct image tag in LLMISvc E2E workflow by @pierDipi in #4948
refactor: deduplicate test configs with helper functions by @Jooho in #4952
Fix CVE-2025-68156: Update expr-lang/expr to v1.17.7 by @mholder6 in #4934
Separate LocalModelCache webhook from KServe controller. by @Jooho in #4941
Bump Gateway API Inference Extension (GIE) to v1.2.0 by @sbekkerm in #4886
feat: add automatic modelFormat annotation for InferenceServices by @Jooho in #4953
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb by @spolti in #4939
ci: PR style check by @sivanantha321 in #4499
add openvino model server runtime by @dtrawins in #4592
feat: add enqueueOnHttpRouteChange handler by @vivekk16 in #4955
feat: add LLMInferenceService CRD webhook + E2E tests by @KillianGolds in #4967
fix: watch pod init container status changes by @jlost in #4910
ci: centralize image variables by @Jooho in #4969
refactor: restructure manifests with component-based by @Jooho in #4962
feat: add predictive inference server runtime by @Jooho in #4954
feat: add predictiveserver runtime build/publish gitaction by @Jooho in #4974
fix: path traversal vulnerability in extractTarFiles by @sivanantha321 in #4975
feat: allow llmisvc scheduler config using a CM or inline by @pierDipi in #4856
fix: add the (default) zmq port 5557 to scheduler by @pierDipi in #4964
feat: add predictiveserver runtime e2e test by @Jooho in #4973
fix: use existing serviceAccount when specified by @cyon13 in #4913
fix: makefile target 'deploy-dev' by @Jooho in #4993
docs: add contributor graph to README by @terrytangyuan in #4991
fix: update envoy ai gateway installation script by @Jooho in #4978
refactor: interface + factory pattern for reconcilers by @rajatvig in #4922
fix: update precise prefix routing example by @pierDipi in #5004
feat: llmisvc preserves externally managed replicas by @pierDipi in #4996
rm cleanHeadSvc from service reconciler by @cjackal in #4758
fix: removed GIE crd from llmisvc kustomzation/Makefile by @Jooho in #4997
fix: resolve flaky TestServerTimeout race condition by @jlost in #5001
feat: update llmisvc e2e test environment script by @Jooho in #4999
refactor: add prefix 'kserve' for llmisvc role by @Jooho in #4992
feat: added git download support to storage initializer by @agoston in #4966
feat: replace minio with seaweedfs by @Jooho in #5014
ci: Add charts/kserve-llmisvc-resources to workflow paths by @terrytangyuan in #5027
fix: llmisvc ClusterRoleBinding to point to new ClusterRole by @pierDipi in #5022
fix: yq download issue & resolving pseudo-versions by @Jooho in #5023
feat(llmisvc): inferencePool auto-migration by @KillianGolds in #5007
feat: make LLMInferenceService storageInitializer optional by @cabrinha in #4970
fix(build): enforce local yq installation by @bartoszmajsak in #5046
fix(build): remove GOPATH dependency from OpenAPI script by @bartoszmajsak in #5045
chore: migrate flake to ruff by @moulin-louis in #4981
feat(llmisvc): move vLLM args to command field by @KillianGolds in #5049
chore(pytest): replaces deprecated get_event_loop by @bartoszmajsak in #5066
fix: h11 accepts malformed bodies - CVE-2025-43859 by @sivanantha321 in #5040
fix: incl. port 8080 in status.address.url for headless svcs by @jlost in #4998
fix: improve storage-initializer error messages by @mwaykole in #5016
fix: make Uvicorn event loop configurable by @joshyjoseph in #4971
feat(llmisvc): watch pods for init container failures by @jlost in #5034
fix: normalize deprec. deploymentMode annos; allow deletion by @jlost in #5025
chore: add pierdipi to reviewers by @pierDipi in #5081
fix: avoid storage-initializer rollout on operator upgrade by @bartoszmajsak in #5085
feat: route only completions through InferencePool by @bartoszmajsak in #5087
feat(llmisvc): listener hostname fallback for URL discovery by @bartoszmajsak in #5079
fix(llmisvc): allow custom gateway with managed route by @bartoszmajsak in #5075
refactor(llmisvc): centralize test namespace management by @bartoszmajsak in #5077
fix(llmisvc): readiness logic for multiple ctrl statuses by @bartoszmajsak in #5055
test: remove blanket sleeps from E2E test utilities by @bartoszmajsak in #5071
fix: broken go tests by @sivanantha321 in #5091
fix(build): upgrade golangci-lint to v2.9.0 by @bartoszmajsak in #5072
feat: 5024 - Upgrade to Gateway API v1.4.0 by @cjohannsen-cloudera in #5038
fix(llmisvc): use server state for Delete owner verification by @bartoszmajsak in #5088
chore(scripts): makes script worktree-friendly by @bartoszmajsak in #5069
fix(inferenceservice): skip VS if Istio CRD missing by @Siva-Sainath in #4985
fix(localmodel): use ObjectOld in node update predicate by @tmvfb in #5095
feat(llmisvc): propagate Prometheus annotations to workloads by @bartoszmajsak in #5086
chore: change 'owners' to 'project-leads' in OWNERS file by @terrytangyuan in #5100
feat: llmisvc supports scaling and HA for scheduler by @pierDipi in #5032
feat: faster parallel S3 file downloads by @bluayer in #5102
feat(llmisvc): add DNS/IP SAN & renewal to self-signed certs by @bartoszmajsak in #5099
feat: inf. log batching, external marshalling support by @cjohannsen-cloudera in #5061
feat(llmisvc): add versioned well-known config resolution by @bartoszmajsak in #5096
fix(llmisvc): return nil instead of empty InferencePoolSpec by @bartoszmajsak in #5108
fix(llmisvc): handle JSON marshal error in ReplaceVariables by @bartoszmajsak in #5109
chore: update OWNERS file by @terrytangyuan in #5112
fix(llmisvc): restricts GlobalConfig fields for templates by @bartoszmajsak in #5111
fix(llmisvc): return error from selectListener on mismatch by @bartoszmajsak in #5105
feat: include all required files to installation script by @Jooho in #5103
fix: surface failure conditions in InferenceService status by @houshengbo in #5114
fix(llmisvc): unblocks certificate renewal by @bartoszmajsak in #5106
feat: new env var INFERENCE_SERVICE_NAME by @dkoder20 in #5013
fix: skip validation for empty modelcar fields by @bartoszmajsak in #5083
fix: add no-cache option for generate-versions-from-gomod.py by @Jooho in #5123
fix(llmisvc): preserve SchedulerConfigSpec conversion by @bartoszmajsak in #5110
feat(llmisvc): add startupProbe to vLLM containers by @KillianGolds in #5063
feat: allow storage init to download only selected files by @pierDipi in #5119
feat: add schedulerName field to ServingRuntimePodSpec by @Jooho in #5073
fix(isvc): preserve reason/message on true conditions by @Siva-Sainath in #5129
ci: add workflow to check if tests are passed before merge by @sivanantha321 in #5092
ci: bump k8s & minikube version by @sivanantha321 in #5125
feat: make agent container resources configurable by @samuelkim7 in #5127
feat: add annotation-based runtime defaults for MLServer by @Jooho in #5064
feat: upgrade VLLM open source version to 0.15.1 by @cjohannsen-cloudera in #5098
test: harden patch-update E2E tests by @bartoszmajsak in #5065
feat: restructure helm charts and the way how to patch by @Jooho in #5089
feat(llmisvc): enhance Gateway API URL discovery by @bartoszmajsak in #5104
fix: resolve CVE-2026-26007 cryptography subgroup attack by @spolti in #5151
feat(llmisvc): enable label/annotation propagation by @khushiiagrawal in #5009
fix: generate OpenAPI and Python SDK models for v1alpha2 LLMISVC by @bartoszmajsak in #5152
feat(llmisvc): add autoscaling API with WVA support by @vivekk16 in #5130
docs: Mention vLLM and llm-d in README by @terrytangyuan in #5160
fix: respect user logging config in kserve (#3919) by @KageRyo in #4687
fix(llmisvc): change TLS cert mount path to avoid CA bundle conflict by @bartoszmajsak in #5157
feat: preserves scheduler config and restart on cert rotation by @bartoszmajsak in #5084
test: automatic envtest cleanup and suite alignment by @bartoszmajsak in #5068
feat: 5235 update knative-serving to v1.21.1 by @cjohannsen-cloudera in #5136
fix: cve-2026-24486: python-multipart arbitrary file write by @spolti in #5170
fix: uv dead lock issue between kserve and kserve-storage by @Jooho in #5176
fix: update manifests for release by @Jooho in #5177
feat: improve KServe release automation and simplify workflow by @Jooho in #5184
release: prepare release v0.17.0-rc0 by @Jooho in #5185
build(make): add optional overrides include to Makefile by @bartoszmajsak in #5164
fix: skip _folder to package helm chart by @Jooho in #5186
refactor(e2e/llmisvc): flexible endpoint testing by @bartoszmajsak in #5093
refactor: change kserve chart name to kserve-resources by @Jooho in #5190
feat(release): add draft release automation and improve release process by @Jooho in #5191
feat: 5060 CSV and Parquet marshallers by @cjohannsen-cloudera in #5115
feat(ci): conditionally trigger helm or kustomize e2e tests based on … by @Jooho in #5193
fix(llmisvc): resolve LWS leader address for ZMQ and increase /dev/shm by @bartoszmajsak in #5155
fix(utils): prevent overwriting existing SecurityContext when configu… by @fyuan1316 in #5167
chore: add MAINTAINERS.md for LFX Insights by @terrytangyuan in #5195
feat(logger): log occurrence and record time in CloudEvents by @samuelkim7 in #5139
fix(llmisvc): handle missing LWS CRD gracefully by @bartoszmajsak in #5201
feat: include GIE CRDs as part of Kserve bundle by @pierDipi in #5214
fix: add helm chart version to kserve-runtime-configs by @Jooho in #5209
modelcache: add Namespace Scoped ModelCache by @VedantMahabaleshwarkar in #4887
release: prepare release v0.17.0-rc1 by @Jooho in #5222
fix(llmisvc): add validations for unsupported scaling configurations by @vivekk16 in #5212
fix(make): increase test timeout from 20m to 30m by @bartoszmajsak in #5165
fix: improve cherry-pick workflow with validation and PR fetch by @Jooho in #5233
chore: bump kustomize from v5.5.0 to v5.8.0 by @bartoszmajsak in #5218
feat(llmisvc): add build hooks for distribution-specific logic by @bartoszmajsak in #5217
test(llmisvc): unit tests for versioned config resolution by @bartoszmajsak in #5182
fix: resolve go test -cover failure by @bartoszmajsak in #5178
fix(build): fall back to existing version when URL verification fails by @bartoszmajsak in #5180
feat: allow configuring GatewayClass for llmisvc e2e tests by @pierDipi in #5238
feat: upgrade llm-d to 0.6 by @pierDipi in #5121
fix(llmisvc): add default for MinReplicas & make MaxReplicas required int32 by @vivekk16 in #5237
feat(llmisvc): add --disable-uvicorn-access-log to vllm configs by @pierDipi in #5154
feat: merge target branch in each GH action job by @pierDipi in #5232
feat(llmisvc): implement autoscaling for WVA and KEDA/HPA integration by @vivekk16 in #5194
feat: add storage migration for LLMinferenceService APIs by @pierDipi in #5149
fix(llmisvc): add missing os.Exit(1) after controller setup failure by @vivekk16 in #5242
fix: change wrong crd kustomization update by @spolti in #5234
fix: to install specific kserve version with kustomize script by @Jooho in #5247
test(llmisvc): add envtest integration tests for scaling reconciliation by @vivekk16 in #5246
release: prepare release v0.17.0 by @Jooho in #5248
feat(llmisvc): evaluate both InferencePool readiness by @bartoszmajsak in #5202
fix(ci): configure git identity for merge commits in CI workflows by @pierDipi in #5251
feat(llmisvc): update LLMInferenceServiceConfig and add TLS flag by @pierDipi in #5249
chore: migrate Python formatter from black to ruff format by @jlost in #5000
fix(ci): add readiness to seaweedfs deployment by @pierDipi in #5267
feat: replace vllm-cpu image with upstream built image by @pierDipi in #5264
fix(e2e): retry predict on transient gateway errors by @pierDipi in #5266
feat: enable scheduler TLS cert reload by @pierDipi in #5260
feat: adding version overrides helm chart dependencies by @andresllh in #5268
fix(ci): restrict workflow re-run to repo collaborators by @bartoszmajsak in #5280
fix: prevent double-build when pushing llmisvc-controller image by @israel-hdez in #5207
chore(ci): align action versions across workflows by @bartoszmajsak in #5277
fix(ci): correct self-referencing path in llmisvc docker workflow by @bartoszmajsak in #5275
fix(ci): add missing disk space cleanup to docker push jobs by @bartoszmajsak in #5278
chore: support for merge queue by @israel-hdez in #5253
ci: optimize Go Dockerfiles for faster CI builds by @bartoszmajsak in #5273
modelcache: run namespace-scoped download jobs in jobNamespace by @VedantMahabaleshwarkar in #5262
chore(ci): remove redundant Go dependency download step by @bartoszmajsak in #5279
ci: improve GHA runner infra (disk cleanup, minikube addons) by @bartoszmajsak in #5281
feat(llmisvc): add extra_headers to wait_for_model_response by @jlost in #5215
feat(localmodel): add build hooks for distribution-specific logic by @VedantMahabaleshwarkar in #5263
[WIP] feat: detect Gateway for auto-migration to v1 InferencePool by @pierDipi in #5041
fix: include 0.17.0 installation scripts by @Jooho in #5256
fix: replace MD5 with SHA-256 in e2e fixtures by @maskarb in #5271
fix: "[WIP] feat: detect Gateway for auto-migration to v1 InferencePool" by @pierDipi in #5316
fix(llmisvc): migrate tokenProcessorConfig and blockSize by @pierDipi in #5305
ci: improvements for setup-uv and build-graph image by @bartoszmajsak in #5220
build: optimize Python Dockerfile caching and build context by @bartoszmajsak in #5274
chore: bump mlserver seldon image to latest 1.7.1 by @seBasKov in #4573
fix(llmisvc): autoscaling config logging by @Gregory-Pereira in #5304
fix(llmisvc): remove unreachable RefsInvalid early-return guards by @bartoszmajsak in #5288
chore(hack): remove legacy quick install scripts by @Jooho in #5289
refactor(test): migrate pod webhook suite to centralized envtest setup by @bartoszmajsak in #5179
chore: fix CVE-2026-32597 PyJWT crit header validation by @spolti in #5283
feat: update .gitattributes with all generated files by @pierDipi in #5258
fix(deps): bump go.opentelemetry.io/otel/sdk to v1.40.0 by @SebastienSyd in #5199
chore(config): clean up trailing whitespaces by @juhyeon-cha in #5300
fix(llmisvc): remove cert-hash restart annotation from scheduler by @bartoszmajsak in #5308
fix(llmisvc): defer storage migration until webhooks are serving by @bartoszmajsak in #5286
fix(controllers): gracefully handle resource deletion by @bartoszmajsak in #5252
fix(build): pin setup-envtest by @bartoszmajsak in #5323
chore: pin standalone kustomize and decouple from kubectl by @jlost in #5322
ci: reduce Go image build times by @bartoszmajsak in #5287
refactor(llmisvc): simplify EPPServiceName guard logic by @bartoszmajsak in #5107
feat(llmisvc): propagate imagePullSecrets from default SA by @pierDipi in #5324
test: centralizes logger setup by @bartoszmajsak in #5042
fix: merge automation by @pierDipi in #5328
ci: add pinact to pin GitHub Actions to SHA by @pierDipi in #5320
fix(test): ensures GinkgoRecover is used correctly by @bartoszmajsak in #5171
fix(ci): pins github actions in license check by @bartoszmajsak in #5329
fix(ci): 'commit not found' in go-security-scan upload-sarif by @Jooho in #5336
feat(llmisvc): upgrade WVA dependency from v0.5.1 to v0.6.0-rc3 by @vivekk16 in #5333
docs: add e2e guide for running GPT-OSS-20B with LLMInferenceService by @sbekkerm in #5150
fix: 5337: upgrade vLLM to 0.17.1 by @cjohannsen-cloudera in #5338
feat: add offset_mapping output for HuggingFace token classification by @Yuuuuuu0319 in #5244
fix(llmisvc): always set status.URL with a discovered address by @pierDipi in #5339
feat(ingress): add DisableHTTPRouteTimeout config flag for GKE Gateway by @sophieliu15 in #5313
feat: add /v1/responses HTTPRoute for OpenAI Responses API support by @RishabhSaini in #5291
chore(llmisvc): bump LLMISvc dependency versions by @vivekk16 in #5344
feat: block PYTHONPATH env var in ISVC and ServingRuntime webhooks by @Jooho in #5340
fix(llmisvc): upgrading to LLM-D v0.6.0 for llmisvc by @Gregory-Pereira in #5346
feat(llmisvc): add platform hooks for networking and manager cfg by @bartoszmajsak in #5240
feat(llmisvc): enable LWS as autoscaling target for multi-node workloads by @vivekk16 in #5356
fix: hardcode Status.Address scheme to http in raw deployment by @jlost in #5363
chore: remove coverage badge by @israel-hdez in #5298
feat(multinode): add groundwork for multinode support without ray by @Jooho in #5366
fix: upgrade vLLM to 0.19.0 by @cjohannsen-cloudera in #5367
fix: enforce PSS restricted profile on LLMInferenceService default template by @alokdangre in #5302
fix: recover multi download flag in default CSC by @israel-hdez in #5368
fix(agent): mirror user-defined httpGet path onto agent readiness probe by @reyshazni in #5345
fix(llmisvc): shorten webhook name to comply with 63-char label limit by @spolti in #5381
fix: CVE-2026-33186 gRPC authorization bypass by @sivanantha321 in #5342
docs: fix typo in OpenShift guide by @iranzo in #5197
revert(llmisvc): restore original webhook names, reverts #5381 by @bartoszmajsak in #5398
fix: intermittent 403 Forbidden errors during S3 model download by @agoston in #5393
feat(llmisvc): add SectionName support to Gateway refs by @bartoszmajsak in #5410
build: add GOTAGS build arg to manager and agent Dockerfiles by @bartoszmajsak in #5403
refactor(test): migrate credentials suite to NewEnvTest by @bartoszmajsak in #5397
fix: address CVE-2026-30922: pyasn1 Vulnerable to DoS by @spolti in #5404
feat(release): add Copilot CLI release automation by @Jooho in #5419
release: prepare release v0.18.0-rc0 by @Jooho in #5422

New Contributors

@agoston made their first contribution in #4709
@murataslan made their first contribution in #4713
@DeepFlame-JR made their first contribution in #4817
@stergem made their first contribution in #4814
@JonahSussman made their first contribution in #4832
@juhyeon-cha made their first contribution in #4837
@vivekk16 made their first contribution in #4892
@csy1204 made their first contribution in #4851
@jlost made their first contribution in #4927
@sbekkerm made their first contribution in #4886
@dtrawins made their first contribution in #4592
@KillianGolds made their first contribution in #4967
@cyon13 made their first contribution in #4913
@cjackal made their first contribution in #4758
@cabrinha made their first contribution in #4970
@moulin-louis made their first contribution in #4981
@joshyjoseph made their first contribution in #4971
@Siva-Sainath made their first contribution in #4985
@bluayer made their first contribution in #5102
@dkoder20 made their first contribution in #5013
@samuelkim7 made their first contribution in #5127
@khushiiagrawal made their first contribution in #5009
@KageRyo made their first contribution in #4687
@fyuan1316 made their first contribution in #5167
@maskarb made their first contribution in #5271
@seBasKov made their first contribution in #4573
@Gregory-Pereira made their first contribution in #5304
@SebastienSyd made their first contribution in #5199
@Yuuuuuu0319 made their first contribution in #5244
@sophieliu15 made their first contribution in #5313
@RishabhSaini made their first contribution in #5291
@alokdangre made their first contribution in #5302
@reyshazni made their first contribution in #5345
@iranzo made their first contribution in #5197

Full Changelog: v0.16.0...v0.18.0-rc0