# Keras v3.13.2

- Product: Keras (https://whatsnew.fyi/product/keras)
- Vendor: Keras
- Date: 2026-01-30
- Version: v3.13.2
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.13.2
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.13.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Disallow TFSMLayer deserialization in safe_mode to prevent execution of attacker-controlled graphs during model invocation
- **security** — Introduce validation for HDF5 dataset metadata in KerasFileEditor to prevent shape bomb attacks and unbounded memory allocation
- **security** — Block external links in HDF5 files during loading to prevent weight files from pointing to external system datasets
- **changed** — Set mutable=True by default in nnx_metadata for JAX backend to ensure compatibility with Flax 0.12.3
- **fixed** — Fix key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments
- **changed** — Refactor H5IOStore and ShardedH5IOStore to remove unused, unverified methods

##### Security Fixes & Hardening

This release introduces critical security hardening for model loading and saving, alongside improvements to the JAX backend metadata handling.

*   **Disallow `TFSMLayer` deserialization in `safe_mode` ([#22035](https://github.com/keras-team/keras/pull/22035))**
    *   Previously, `TFSMLayer` could load external TensorFlow SavedModels during deserialization without respecting Keras `safe_mode`. This could allow the execution of attacker-controlled graphs during model invocation.
    *   `TFSMLayer` now enforces `safe_mode` by default. Deserialization via `from_config()` will raise a `ValueError` unless `safe_mode=False` is explicitly passed or `keras.config.enable_unsafe_deserialization()` is called.

*   **Fix Denial of Service (DoS) in `KerasFileEditor` ([#21880](https://github.com/keras-team/keras/pull/21880))**
    *   Introduces validation for HDF5 dataset metadata to prevent "shape bomb" attacks. 
    *   Hardens the `.keras` file editor against malicious metadata that could cause dimension overflows or unbounded memory allocation (unbounded numpy allocation of multi-gigabyte tensors).

*   **Block External Links in HDF5 files ([#22057](https://github.com/keras-team/keras/pull/22057))**
    *   Keras now explicitly disallows external links within HDF5 files during loading. This prevents potential security risks where a weight file could point to external system datasets.
    *   Includes improved verification for H5 Groups and Datasets to ensure they are local and valid.

##### Backend-specific Improvements (JAX)

*   **Set `mutable=True` by default in `nnx_metadata` ([#22074](https://github.com/keras-team/keras/pull/22074))**
    *   Updated the JAX backend logic to ensure that variables are treated as mutable by default in `nnx_metadata`. 
    *   This makes Keras 3.13.2 compatible with Flax 0.12.3 when the Keras NNX integration is enabled.

##### Saving & Serialization

*   **Improved H5IOStore Integrity ([#22057](https://github.com/keras-team/keras/pull/22057))**
    *   Refactored `H5IOStore` and `ShardedH5IOStore` to remove unused, unverified methods.
    *   Fixed key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments.

---

###### Contributors
We would like to thank the following contributors for their security reports and code improvements:
@0xManan, @HyperPS, @hertschuh, and @divyashreepathihalli.


**Full Changelog**: https://github.com/keras-team/keras/compare/v3.13.1...v3.13.2