# Keras v3.12.1

- Product: Keras (https://whatsnew.fyi/product/keras)
- Vendor: Keras
- Date: 2026-01-30
- Version: v3.12.1
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.12.1
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.12.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Disallow TFSMLayer deserialization in safe_mode to prevent execution of attacker-controlled graphs, enforcing safe_mode by default and raising ValueError unless safe_mode=False is explicitly passed or keras.config.enable_unsafe_deserialization() is called
- **security** — Fix Denial of Service in KerasFileEditor by introducing validation for HDF5 dataset metadata to prevent shape bomb attacks and unbounded memory allocation
- **security** — Block external links in HDF5 files during loading to prevent weight files from pointing to external system datasets
- **fixed** — Fix key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments
- **changed** — Refactor H5IOStore and ShardedH5IOStore to remove unused, unverified methods

##### Security Fixes & Hardening

This release introduces critical security hardening for model loading and saving, alongside improvements to the JAX backend metadata handling.

*   **Disallow `TFSMLayer` deserialization in `safe_mode` ([#22035](https://github.com/keras-team/keras/pull/22035))**
    *   Previously, `TFSMLayer` could load external TensorFlow SavedModels during deserialization without respecting Keras `safe_mode`. This could allow the execution of attacker-controlled graphs during model invocation.
    *   `TFSMLayer` now enforces `safe_mode` by default. Deserialization via `from_config()` will raise a `ValueError` unless `safe_mode=False` is explicitly passed or `keras.config.enable_unsafe_deserialization()` is called.

*   **Fix Denial of Service (DoS) in `KerasFileEditor` ([#21880](https://github.com/keras-team/keras/pull/21880))**
    *   Introduces validation for HDF5 dataset metadata to prevent "shape bomb" attacks. 
    *   Hardens the `.keras` file editor against malicious metadata that could cause dimension overflows or unbounded memory allocation (unbounded numpy allocation of multi-gigabyte tensors).

*   **Block External Links in HDF5 files ([#22057](https://github.com/keras-team/keras/pull/22057))**
    *   Keras now explicitly disallows external links within HDF5 files during loading. This prevents potential security risks where a weight file could point to external system datasets.
    *   Includes improved verification for H5 Groups and Datasets to ensure they are local and valid.

##### Saving & Serialization

*   **Improved H5IOStore Integrity ([#22057](https://github.com/keras-team/keras/pull/22057))**
    *   Refactored `H5IOStore` and `ShardedH5IOStore` to remove unused, unverified methods.
    *   Fixed key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments.

---

###### Acknowledgments
Special thanks to the security researchers and contributors who reported these vulnerabilities and helped implement the fixes: @0xManan, @HyperPS, and @hertschuh.

**Full Changelog**: https://github.com/keras-team/keras/compare/v3.12.0...v3.12.1