Releases: zerfoo/zerfoo
Releases · zerfoo/zerfoo
Release list
v1.59.0
v1.58.0
1.58.0 (2026-08-08)
Features
- cli: wire --rate-limit/--rate-limit-burst/--keystore serve flags (T145.1) (7a60a62)
Bug Fixes
- ci: scope benchmark PR-comment write token to the commenting job (CICD-3, T144.3) (a1bf81e)
- ci: scope govulncheck to allowlist only the no-fix bbolt advisory (CICD-6, T144.6) (70f8ac5)
- cli: default worker to loopback, add --tls-* flags (T140.2) (9b886c2)
- cuda: prefer absolute vendor-library paths across native loaders (CUDA-2, T141.2) (252a92d)
- deploy: digest-pin Dockerfile base images (CICD-4) (1f75836)
- deps: bump golang.org/x/net to v0.53.0 (GO-2026-4918 HTTP/2 DoS) (941bab8)
- deps: bump google.golang.org/grpc to v1.82.1 (GO-2026-6061) (33ed17d)
- distributed: authenticate coordinator worker registration (35db753)
- gguf: cap metadata array nesting depth to prevent stack overflow (F4) (3c9dae8)
- gguf: cap tensor dimension count at 8 (F3, T139.3) (7ad5cc0)
- registry: reject non-https registry URLs unless explicitly opted in (OCI-2, T139.5) (3177eac)
- registry: support out-of-band expected hash for HF pulls (HF-1, T143.10) (7557dfb)
- registry: verify blob digest on OCI pull (OCI-1, T139.4) (026ca1f)
- serve: block unspecified + CGNAT addresses in SSRF guard (5794d09)
- serve: bound GuardianMiddleware body read, skip SSE buffering (SERVE-4) (ed482ba)
- serve: bound RateLimiter memory via scheduled cleanup + size cap (4d93744)
- serve: cap /v1/embeddings input array size (SERVE-3, T143.3) (6ef8841)
- serve: cap per-request image-fetch fan-out (SERVE-3b, T143.4) (8e8622b)
- serve: eliminate KeyStore Revoked/ExpiresAt data race (CONC-M2, T142.4) (09e0e8a)
- serve: log escaped request path to prevent log injection (SERVE-6, T143.8) (eae4e83)
- serve: reap executeBatch ctx-wait goroutines promptly (CONC-L1) (0e8e7b7)
- serve: remove dead SSRF validation code (SERVE-7, T143.9) (37d1c8a)
- serve: validate max_tokens/temperature bounds (SERVE-5, T143.6) (214f06a)
v1.57.0
1.57.0 (2026-07-04)
Features
- cmd: bench_train -seed flag + exact loss bit patterns (T135.5) (d125201)
- docs: add EXTRA_ENV_PLACEHOLDER marker to validate-arm64 manifest (2fff208)
- scripts: plumb extra env vars through dgx-validate for env-gated fixtures (40b6653)
- timeseries: seedable weight init + GPU determinism double-run proof (T135.5) (0f6a316)
Bug Fixes
- attention: replay-stable FusedSDPA scratch (T133.2) (5093a9b)
- attention: stream-order flash-decode on the engine stream (T133.1) (db8c7b9)
- ci: add least-privilege permissions blocks to PR-triggered workflows (5ebc449)
- ci: pin mutable govulncheck/pip installs to exact versions (CICD-2) (3154617)
- cuda: bump ztensor to v1.19.1 and guard darwin dlopen probe (T137.1) (215fcef)
- cuda: guard FP16 graceful test from poisoning the CUDA context (T135.1) (047f2cc)
- cuda: guard sgemv_m1 float4 vectorized load on row pointer alignment (94834c4)
- cuda: include cooperative_groups/reduce.h in gemv_q4k_sm121 (d1dd5aa)
- cuda: port ztensor-required kernels missing from the fork (.so drift) (46c412c)
- cuda: port ztensor's flash_decode.cu into zerfoo's kernel fork (3c02533)
- cuda: remove CWD-relative dlopen candidates for the kernel library (CUDA-1, T141.1) (3f0d2fd)
- distributed: wire mTLS into worker gRPC server, refuse non-loopback without TLS (d6b2562)
- gguf: bounds-check tensor offset before mmap slice (F2, T139.2) (ab01d5d)
- gguf: check-before-multiply on tensor element-count overflow (F1, T139.1) (285fafe)
- gguf: restore missing math import in loader_mmap.go and split_file.go (ca1eb41)
- inference: serialize SpeculativeGenerate through the graph mutex (5e409a9)
- layers: FFN GELU backward always differentiated the SwiGLU branch (dd46acd)
- scripts: fail loudly on zero matched tests (T135.1) (9c8e4e4)
- serve: bound error-metric label cardinality via route normalization (9922a0b)
- serve: close model-delete TOCTOU and WaitGroup-misuse race (CONC-H2) (dcf1c90)
- serve: validate LoRA adapter name against traversal (SERVE-2) (3ad21c3)
- training: allocation-stable cached loss seed (non-arena device storage) (42b87a9)
- training: remove #878 containment gate (T133.4) (9968843)
v1.56.0
1.56.0 (2026-07-03)
Features
- bench: add validate-arm64 Spark pod manifest (T131.1) (f95633a)
- scripts: -pkgs override for targeted GPU test scoping (T131.3) (2b96e9e)
- scripts: add -delete mode to dgx-validate for pod cleanup (T131.3) (3135db9)
- scripts: add dgx-validate.sh one-command GPU validation submit (T131.1) (9b500f6)
- scripts: committed in-pod validation stage dgx-validate-inpod.sh (T131.3) (518ef61)
- training: loud-fail gate on capture-replay training pending zerfoo#878 (T129.2) (72cfb48)
Bug Fixes
- bench: drop unprovisioned hostPath mounts from validate-arm64 pod (T131.3) (2b79ca4)
- bench: parameterize test scope via TEST_PKGS substitution (T131.3) (697ea89)
- bench: purego package set for validate-arm64 env (T131.3) (1e82694)
- bench: single-line bootstrap args -- Spark YAML drops block scalars (T131.3) (14c3141)
- cuda: skip dlsym invalid-handle test on linux -- handle 0 is RTLD_DEFAULT on glibc (T131.3) (7e29ef6)
- scripts: dgx-validate diagnosis hardening -- image pre-pull, events on failure, -keep flag (T131.3) (d6e8b0d)
- scripts: in-pod CGo header paths + QUALITY.md vet policy for purego warnings (T131.3) (7b6daa3)
- scripts: scope standing gate to purego GPU path; -tags cuda tracked in #921 (T131.3) (87465c5)