Skip to content
TrustMyStack, home

keras

v3.15.1
keras-team/keras

Deep Learning for humans

Version of keras-team/keras you run

CompareView on GitHub
Maintenance
Active449 commits in 3 months · bus factor 4
License
Apache-2.0Permissive · OSI-approved
Security
8 advisories1 critical, 4 high, 3 medium · Scorecard 7.4/10
Supported versions
No scheduleendoflife.date does not track this project

64.4k stars · 19.8k forks · 234 open issues · last release 3 months ago · data checked 5 hours ago

OverviewTourReleasesDocker imagesSecurityLogos

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

  • v3.13.0Dec 18, 2025

    BREAKING changes

    Starting with version 3.13.0, Keras now requires Python 3.11 or higher. Please ensure your environment is updated to Python 3.11+ to install the latest version.

  • v3.12.0Oct 27, 2025

    Breaking changes

    • Layers StringLookup & IntegerLookup now save vocabulary loaded from file. Previously, when instantiating these layers from a vocabulary filepath, only the filepath would be saved when saving the layer. Now, the entire vocabulary is materialized and saved as part of the .keras archive.
  • v3.6.0Oct 3, 2024

    BREAKING changes

    • When using keras.utils.get_file, with extract=True or untar=True, the return value will be the path of the extracted directory, rather than the path of the archive.

Release history

All releases on GitHub
Atom feed/feed/keras-team/keras
BadgeLatest version of keras-team/keras[![version](/badge/keras-team/keras)](/p/keras-team/keras)

Keras 3.12.4

Keras 3.12.4

Keras 3.12.4 is a security patch release that hardens dataset loading and model file handling against insecure deserialization and decompression-bomb attacks.

Security Fixes

  • Restrict unpickling when loading IMDB and Reuters datasets — Replaces np.load(allow_pickle=True) with a restricted unpickler that only permits numpy array reconstruction, preventing arbitrary code execution via crafted .npz files (CWE-502). (#23047) by @LinZiyuu
  • Verify all intermediary H5 groups when navigating H5 files — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal. (#23168) by @hertschuh
  • Reject decompression-bomb members on the .keras asset extraction path — Adds per-member decompression-ratio checks before extracting .keras archives to disk, preventing disk-exhaustion attacks via crafted archives. (#23101) by @LinZiyuu
  • Restrict unpickling when loading CIFAR datasets — Replaces bare cPickle.load in CIFAR-10/100 batch loading with the numpy-only RestrictedUnpickler, blocking arbitrary code execution via pickle gadgets. (#23252) by @SABITHSAHEB

---

Contributors

Thank you to all the contributors who made this release possible! 🎉

  • @LinZiyuu — Security hardening for IMDB, Reuters, and .keras asset extraction (#23047, #23101)
  • @hertschuh — H5 group verification (#23168)
  • @SABITHSAHEB — CIFAR dataset pickle restriction (#23252)

---

Full Changelog: https://github.com/keras-team/keras/compare/v3.12.3...v3.12.4

Full release notesCompare with previous