Skip to content

Releases: keras-team/keras

Release list

Keras 3.15.1

Keras 3.15.1

Choose a tag to compare

View all tags
@laxmareddyp laxmareddyp released this 29 Jul 18:25
v3.15.1
250b421
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Notes

Keras 3.15.1 is a patch release containing important security hardening, bug fixes, and Python 3.14 compatibility improvements.

Security Fixes

  • Restrict unpickling when loading IMDB and Reuters datasets — Prevents insecure deserialization (CWE-502) by replacing bare np.load(allow_pickle=True) with a restricted unpickler that only permits numpy array reconstruction. (#23047) by @LinZiyuu
  • Verify all intermediary H5 groups when navigating H5 files — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal issues. (#23168) by @hertschuh
  • Reject decompression-bomb members on the .keras asset extraction path — Adds per-member decompression-ratio checks before extracting .keras archives to disk, preventing disk-exhaustion attacks via crafted archives. (#23101) by @LinZiyuu
  • Restrict unpickling when loading CIFAR datasets — Replaces bare cPickle.load in CIFAR-10/100 batch loading with the numpy-only RestrictedUnpickler, blocking arbitrary code execution via pickle gadgets. (#23252) by @SABITHSAHEB

Bug Fixes

  • Refactor _load_state to capture weight store while preserving Keras test passing — Improves model loading efficiency by capturing the weight store into a local variable, and enhances nested container detection in legacy files with isolated failure tracking. (#23226) by @buildwithsuhana
  • Fix TraceContext error for NNX backend — Fixes TraceContext errors when using JAX NNX backend with models like T5 that lack a build method. Skips trace-level checks during symbolic shape inference and handles Flax 0.12 API changes. Fixes #23289. (#23326) by @divyashreepathihalli

Compatibility

  • Fixes for Python 3.14 — Resolves NotImplementedError boolean coercion changes in Python 3.14 and fixes dimension filtering in shape utilities. (#23259) by @hertschuh

Contributors

Thank you to all the contributors who made this release possible! 🎉

Full Changelog: v3.15.0...v3.15.1

Contributors

hertschuh, divyashreepathihalli, and 3 other contributors
Loading

Keras 3.12.4

Keras 3.12.4 Latest
Latest

Choose a tag to compare

View all tags
@laxmareddyp laxmareddyp released this 29 Jul 22:19
v3.12.4
6c0caa7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Keras 3.12.4

Keras 3.12.4 is a security patch release that hardens dataset loading and model file handling against insecure deserialization and decompression-bomb attacks.

Security Fixes

  • Restrict unpickling when loading IMDB and Reuters datasets — Replaces np.load(allow_pickle=True) with a restricted unpickler that only permits numpy array reconstruction, preventing arbitrary code execution via crafted .npz files (CWE-502). (#23047) by @LinZiyuu
  • Verify all intermediary H5 groups when navigating H5 files — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal. (#23168) by @hertschuh
  • Reject decompression-bomb members on the .keras asset extraction path — Adds per-member decompression-ratio checks before extracting .keras archives to disk, preventing disk-exhaustion attacks via crafted archives. (#23101) by @LinZiyuu
  • Restrict unpickling when loading CIFAR datasets — Replaces bare cPickle.load in CIFAR-10/100 batch loading with the numpy-only RestrictedUnpickler, blocking arbitrary code execution via pickle gadgets. (#23252) by @SABITHSAHEB

Contributors

Thank you to all the contributors who made this release possible! 🎉

Full Changelog: v3.12.3...v3.12.4

Contributors

hertschuh, SABITHSAHEB, and LinZiyuu
Assets 2
Loading

v3.12.3

v3.12.3

Choose a tag to compare

View all tags
@laxmareddyp laxmareddyp released this 26 Jun 17:52
v3.12.3
64ab216
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Keras 3.12.3 is a security patch release that hardens model saving, loading, and deserialization against a range of attack vectors.

HDF5 Hardening

  • Eject ExternalLink/SoftLink groups in KerasFileEditor (#22899)
    • Prevents HDF5 external/soft links from being exploited to read arbitrary files during model editing.
  • Reject ExternalLink/SoftLink on legacy .h5 dispatcher (#22900)
    • Extends HDF5 link rejection to the legacy load_weights path for .h5 files.
  • Reject HDF5 shape-bomb datasets (#22975)
    • Blocks HDF5 datasets that declare excessively large shapes to trigger out-of-memory crashes during load_model/load_weights.
  • Reject HDF5 virtual datasets in KerasFileEditor (#22976)
    • Prevents virtual dataset references from being used to access external files.

Archive Hardening

  • Reject hard-link tar members escaping extraction directory (#22973)
    • Blocks tar hard links whose target resolves outside the extraction root.
  • Reject decompression-bomb archive members (#23010)
    • Detects and rejects .keras archive members that declare far more data than is actually stored, preventing memory exhaustion.
  • Prevent symlink traversal during extraction (#23015)
    • Resolves paths with realpath to prevent symlink-based directory traversal attacks.
  • Reject npz weight bombs (#23016)
    • Validates npz weight members against shape/decompression bombs before allocating memory.
  • Validate DiskIOStore asset paths (#23017)
    • Ensures asset paths stay within the working directory during model saving/loading.
  • Use filter="data" in TarFile.extractall (#23108)
    • Applies Python's built-in tar extraction safety filter on supported versions.

Deserialization Safety

  • Fix insecure deserialization in dataset utilities (#23026)
    • Closes an insecure deserialization path in dataset utility functions.
  • Explicitly disable pickle in np.load (#23034)
    • Prevents pickle execution when loading NumPy weight files.
  • Make Lambda/TorchModuleWrapper from_config fail closed (#23048)
    • When safe_mode is unset, Lambda and TorchModuleWrapper deserialization now fails closed instead of silently allowing arbitrary code execution.
  • Restrict reloadable APIs (#23115)
    • Expands the list of APIs that should not be part of a deserialized model.

Full Changelog: v3.12.2...v3.12.3

Loading

v3.15.0

v3.15.0

Choose a tag to compare

View all tags
@laxmareddyp laxmareddyp released this 24 Jun 23:38
v3.15.0
9d1bbf9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Keras-to-Torch Export: New export_torch enables exporting Keras models to native PyTorch nn.Module format, along with LiteRT (TFLite) export support for the PyTorch backend.
  • Sliding Window Attention: Added sliding_window parameter to MultiHeadAttention and GroupedQueryAttention for efficient long-context attention.
  • Flash / Fused SDPA: Causal-only MHA/GQA now automatically dispatches to Flash Attention (cuDNN SDPA), and the manual attention path correctly applies causal masking.
  • Multi-Optimizer Training: New MultiOptimizer supports assigning different optimizers to sub-networks.
  • New Math Operations: Added unique, pinv, matrix_rank, fabs, fmax, fmin, erfc, dsplit, percentile, nanpercentile, sobel_edges, and ssim (structural similarity) to keras.ops.
  • Security Hardening: Comprehensive hardening of model reloading against HDF5 exploits, tar/zip traversal attacks, insecure deserialization.

New Features and Operations

Multi-Backend Operations

  • New NumPy Operations: Added unique, fabs, fmax, fmin, dsplit, erfc, percentile, nanpercentile in keras.ops.numpy.
  • New Linear Algebra Operations: Added pinv (pseudo-inverse) and matrix_rank in keras.ops.linalg.
  • New Image Operations: Added sobel_edges for edge detection and ssim (structural similarity) in keras.ops.image.
  • Negative Axes in Transpose: keras.ops.transpose now supports negative axis values.

Layers and Attention

  • Sliding Window Attention: MultiHeadAttention and GroupedQueryAttention layers support the sliding_window parameter for efficient long-sequence processing.
  • Flash Attention Engagement: Causal-only attention in MHA/GQA now uses Flash SDPA for significant speedups.
  • Fused Bidirectional LSTM/GRU: JAX backend now fuses Bidirectional LSTM into a single cuDNN call; fused bidirectional GRU added for Torch backend.
  • CTC Beam Search Decoder: Added CTC beam search decoding for the Torch backend.

Training and Optimizers

  • MultiOptimizer: Supports training sub-networks with different optimizers.
  • SKLearn Classifier: Added predict_proba method to SKLearnClassifier.

Export and Deployment

  • Keras-to-Torch Export: Export Keras models to native PyTorch nn.Module via model.export(..., format="torch").
  • LiteRT (TFLite) Export for PyTorch: Added LiteRT export support for models using the PyTorch backend.
  • LiteRT Compatibility Fix: Fixed LiteRT export for Keras 3 + TF 2.20 + Python 3.13.
  • ONNX Export: Support for dict/list inputs in Torch ONNX export; documented static input signature requirement for LiteRT PyTorch export.

Distribution and Parallelism

  • ModelParallel Improvements: Defined contiguous replica-group data shard ID convention; added distribution information (num_processes, num_model_replicas, data_shard_id).
  • Initializer Distribution Layout: Initializers can now handle the distribution layout directly with JAX.
  • TF Dataset Distribution: Refactored TF dataset distribution with centralized sharding routing; fixed data distribution for model training in JAX.

OpenVINO Backend Support

The OpenVINO backend received continued improvements:

  • New Operations: Implemented glu, sparsemax, gaussian_blur, logdet, cholesky, lu_factor, erfc, segment_min, segment_prod, percentile, nanmedian, nanpercentile, unique, flash_attn, greedy ctc_decode, solve_triangular, compute_homography_matrix, and image transforms (affine, perspective, elastic).
  • Opset Upgrades: Upgraded to opset16 for select operations and full upgrade.
  • Fixes: Dynamic/symbolic shape handling, mask propagation, random seed determinism, dropout during predict, Lanczos interpolation in resize, dynamic batch shape propagation, and improved efficiency using native ops.

Security

  • HDF5 Hardening: Reject ExternalLink/SoftLink groups, virtual datasets, and shape-bomb datasets in model loading.
  • Archive Hardening: Reject tar members and links escaping extraction directory, ZIP/NPZ members declaring excessive data. Validate asset paths from Orbax checkpoints.
  • Deserialization Safety: Disable pickle in np.load, fix insecure deserialization in dataset utilities, and make Lambda/TorchModuleWrapper from_config fail closed when safe_mode is unset.
  • CI/Workflow: Fix prompt injection in issue triage workflow.

Bug Fixes and Improvements

Backend Specific Improvements

  • PyTorch: Fixed convert_to_tensor for Python scalars, divide_no_nan() NaN gradients, BiLSTM dispatch, lstsq with rcond, SymInt/SymFloat handling in convert_to_tensor and slice, and median for even-length inputs.
  • JAX: Fused Bidirectional LSTM into cuDNN call.
  • TensorFlow: Fixed depthwise/separable conv with stride and dilation. Optimized tf.tensordot by removing redundant float casts.

Layers and Ops

  • Mixed Precision Fix: Fixed float16 numerical instability in GroupNormalization with small epsilon; disabled autocast for mixed precision stability.
  • Dense Layer OOM: Fixed GPU OOM with rank-3 input due to BatchMatMulV2 gradient materialization.
  • GroupQueryAttention: Fixed symbolic output shape with return_attention_scores.
  • Conv Transpose: Save output_padding in Conv1D/2D/3DTranspose get_config.
  • Attention Layer: Fixed stale return_attention_scores flag in compute_output_spec; save seed in get_config.
  • Ops Validation: Added comprehensive axis validation in softmax, normalize, swapaxes, moveaxis, sort, argsort, cumsum, cumprod, take, stack, concatenate, split, diff, transpose, and more.
  • EinsumDense: Fixed compute_output_shape to work before build.
  • Discretization: Fixed bin boundaries calculation.

Model Saving and Loading

  • Nested Sublayers: Fixed save/load for custom models/layers with sublayers in nested lists.
  • Orbax: Fixed bug from Orbax's recent rename from "pytree" to "state".
  • Sequential: Improved error handling for missing keys during deserialization.
  • Pipeline: Validated from_config layers and avoid mutating input config.

Other Improvements

  • Callbacks: Fixed EarlyStopping/ReduceLROnPlateau resetting self.best between fit calls; fixed TensorBoard callback step counter never updating.
  • Progress Bar: Removed double averaging of metrics.
  • LoRA Weights: Use float32 to avoid underflow/overflow risk.
  • Tree Utilities: Optimized tree.flatten and tree.map_structure for common cases.
  • Depthwise/Separable Conv: Removed backend-specific strides + dilation_rate restriction; validated output shapes in build; transposed channels_first to NHWC on CPU.
  • Regularizers: Allow plain callables as regularizers; fixed L1L2 regularizer.
  • Added AI Contribution Policy.
  • Added CITATION.cff for repository citation.

New Contributors

We would like to thank our new contributors for making their first contribution to the Keras project:

Full Changelog: v3.14.0...v3.15.0

Contributors

jeffcarp, peinguim, and 25 other contributors
Loading

v3.14.1

v3.14.1

Choose a tag to compare

View all tags
@sachinprasadhs sachinprasadhs released this 07 May 22:22
v3.14.1
b7f0905
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Saving & Reloading

  • Harden path and link resolution when extracting files from archives (#22839)
    • Fixed link resolution bug when validating links extracted from TAR archives.
    • Fixed path confusion bug when validating files extracted from ZIP and TAR archives (including .keras files).
    • Added path validation when extracting assets from Orbax checkpoints.
  • Harden H5 validation code and apply it to legacy .h5 files (#22801)
    • Disallow external links and virtual datasets in H5 files.
    • Also apply all the validation to the legacy .h5 file extraction.
  • Improve validation and error reporting in functional model deserialization (#22800)
    • Detect loops in the graph when deserializing a functional model.
    • Improve error reporting for missing nodes in the graph.

Other Fixes

  • Fix data sharding logic in ModelParallel (#22179)
  • Fix regression with metrics passed to compile (#22663)
    • Fixed a regression introduced in #22308 where y_pred (as a list) and y_true (as a dict with keys matching Functional model output names) were not ordered identically and could be paired incorrectly.
  • Fix regression preventing compilation with the L1L2 regularizer (#22629)
  • Fix test compatibility with JAX 0.10.0 (#22694)

Full Changelog: v3.14.0...v3.14.1

Loading

v3.12.2

v3.12.2

Choose a tag to compare

View all tags
@sachinprasadhs sachinprasadhs released this 07 May 22:21
v3.12.2
8f987f1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Saving & Reloading

  • Harden path and link resolution when extracting files from archives (#22194 & #22839)
    • Fixed based folder used when validating files extracted from ZIP and TAR archives.
    • Fixed link resolution bug when validating links extracted from TAR archives.
    • Fixed path confusion bug when validating files extracted from ZIP and TAR archives (including .keras files).
    • Added path validation when extracting assets from Orbax checkpoints.
  • Harden H5 validation code and apply it to legacy .h5 files (#22801)
    • Disallow external links and virtual datasets in H5 files.
    • Also apply all the validation to the legacy .h5 file extraction.
  • Improve validation and error reporting in functional model deserialization (#22800)
    • Detect loops in the graph when deserializing a functional model.
    • Improve error reporting for missing nodes in the graph.

Other Fixes

  • Fix lazy module import for h5py
    • Fixed lazy module import handling for h5py to ensure correct and safe validation behavior when the package is lazy-loaded.
  • Remove deprecated openvino.runtime import (#21826)

What's Changed

Full Changelog: v3.12.1...v3.12.2

Contributors

sachinprasadhs
Loading

v3.14.0

v3.14.0

Choose a tag to compare

View all tags
@sachinprasadhs sachinprasadhs released this 03 Apr 01:45
v3.14.0
050671c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Orbax Checkpoint Integration: Full support for Orbax checkpoints, including sharding, remote paths, and step recovery.
  • Quantization Upgrades: Added support for Activation-aware Weight Quantization (AWQ) and Asymmetric INT4 Sub-Channel Quantization.
  • Batch Renormalization in BatchNorm: Added batch renormalization feature to the BatchRenormalization layer.
  • New Optimizer: Added ScheduleFreeAdamW optimizer.
  • Gated Attention: Introduced optional Gated Attention support in MultiHeadAttention and GroupedQueryAttention layers.

New Features and Operations

Multi-Backend Operations

  • NaN-aware NumPy Operations: Added support for nanmin, nanmax, nanmean, nanmedian, nanvar, nanstd, nanprod, nanargmin, nanargmax, and nanquantile in keras.ops.numpy.
  • New Math & Linear Algebra Operators: Added nextafter, ptp, view, sinc, fmod, i0, fliplr, flipud, rad2deg, geomspace, depth_to_space, space_to_depth, and fold.

Preprocessing and Layers

  • CLAHE Layer: Added Contrast Limited Adaptive Histogram Equalization preprocessing layer.
  • Adapt Support for Iterables: Preprocessing layers now support Python iterables in the adapt() method, which allows the direct use of Grain datasets.

OpenVINO Backend Support

The OpenVINO backend received a massive update, implementing a wide array of NumPy and Neural Network operations to achieve feature parity with other backends:

  • NumPy Operations: vander, trapezoid, corrcoef, correlate, flip, diagonal, cbrt, hypot, trace, kron, argpartition, logaddexp2, ldexp, select, round, vstack, hsplit, vsplit, tile, nansum, tensordot, exp2, trunc, gcd, unravel_index, inner, cumprod, searchsorted, hanning, diagflat, norm, histogram, lcm, allclose, real, imag, isreal, kaiser, shuffle, einsum, quantile, conj, randint, in_top_k, signbit, gamma, heaviside, var, std, inv, solve, cholesky_inverse, fft, fft2, ifft2, rfft, irfft, stft, istft, scatter, binomial, unfold, QR decomposition, view, and more.
  • Neural Network Operations: Added support for separable_conv, conv_transpose, adaptive_average_pool, adaptive_max_pool, RNN, LSTM, and GRU.
  • Control Flow Operations: Implemented cond, scan, associative_scan, map, switch, fori_loop, and vectorized_map.

Bug Fixes and Improvements

Backend Specific Improvements

  • PyTorch: Dynamic shapes support in export, device selection improvements, and bug fixes to the CuDNN based LSTM and GRU implementation.
  • JAX: Improved RNG handling in FlaxLayer and JaxLayer, variable jitting improvements, and direct JAX-to-ONNX export.
  • NumPy: Enabled masking support for the NumPy backend.

Other Improvements

  • Fixed multiple symbolic shape bugs across layers like Conv1DTranspose, IndexLookup, and TextVectorization.
  • Fixed activity regularizer normalization by batch size.
  • Improved Sequential error messages for incompatible layers.
  • Minimized memory usage issues in sparse_categorical_crossentropy.

New Contributors

We would like to thank our new contributors for making their first contribution to the Keras project:

Full Changelog: v3.13.2...v3.14.0

Contributors

cpuguy96, dagecko, and 44 other contributors
Loading

v3.13.2

v3.13.2

Choose a tag to compare

View all tags
@sachinprasadhs sachinprasadhs released this 30 Jan 01:03
v3.13.2
e29d0ef
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security Fixes & Hardening

This release introduces critical security hardening for model loading and saving, alongside improvements to the JAX backend metadata handling.

  • Disallow TFSMLayer deserialization in safe_mode (#22035)

    • Previously, TFSMLayer could load external TensorFlow SavedModels during deserialization without respecting Keras safe_mode. This could allow the execution of attacker-controlled graphs during model invocation.
    • TFSMLayer now enforces safe_mode by default. Deserialization via from_config() will raise a ValueError unless safe_mode=False is explicitly passed or keras.config.enable_unsafe_deserialization() is called.

  • Fix Denial of Service (DoS) in KerasFileEditor (#21880)

    • Introduces validation for HDF5 dataset metadata to prevent "shape bomb" attacks.
    • Hardens the .keras file editor against malicious metadata that could cause dimension overflows or unbounded memory allocation (unbounded numpy allocation of multi-gigabyte tensors).

  • Block External Links in HDF5 files (#22057)

    • Keras now explicitly disallows external links within HDF5 files during loading. This prevents potential security risks where a weight file could point to external system datasets.
    • Includes improved verification for H5 Groups and Datasets to ensure they are local and valid.

Backend-specific Improvements (JAX)

  • Set mutable=True by default in nnx_metadata (#22074)
    • Updated the JAX backend logic to ensure that variables are treated as mutable by default in nnx_metadata.
    • This makes Keras 3.13.2 compatible with Flax 0.12.3 when the Keras NNX integration is enabled.

Saving & Serialization

  • Improved H5IOStore Integrity (#22057)
    • Refactored H5IOStore and ShardedH5IOStore to remove unused, unverified methods.
    • Fixed key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments.

Contributors

We would like to thank the following contributors for their security reports and code improvements:
@0xManan, @HyperPS, @hertschuh, and @divyashreepathihalli.

Full Changelog: v3.13.1...v3.13.2

Contributors

hertschuh, yomananchill, and 2 other contributors
Loading

v3.12.1

v3.12.1

Choose a tag to compare

View all tags
@sachinprasadhs sachinprasadhs released this 30 Jan 18:36
v3.12.1
f704c88
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security Fixes & Hardening

This release introduces critical security hardening for model loading and saving, alongside improvements to the JAX backend metadata handling.

  • Disallow TFSMLayer deserialization in safe_mode (#22035)

    • Previously, TFSMLayer could load external TensorFlow SavedModels during deserialization without respecting Keras safe_mode. This could allow the execution of attacker-controlled graphs during model invocation.
    • TFSMLayer now enforces safe_mode by default. Deserialization via from_config() will raise a ValueError unless safe_mode=False is explicitly passed or keras.config.enable_unsafe_deserialization() is called.

  • Fix Denial of Service (DoS) in KerasFileEditor (#21880)

    • Introduces validation for HDF5 dataset metadata to prevent "shape bomb" attacks.
    • Hardens the .keras file editor against malicious metadata that could cause dimension overflows or unbounded memory allocation (unbounded numpy allocation of multi-gigabyte tensors).

  • Block External Links in HDF5 files (#22057)

    • Keras now explicitly disallows external links within HDF5 files during loading. This prevents potential security risks where a weight file could point to external system datasets.
    • Includes improved verification for H5 Groups and Datasets to ensure they are local and valid.

Saving & Serialization

  • Improved H5IOStore Integrity (#22057)
    • Refactored H5IOStore and ShardedH5IOStore to remove unused, unverified methods.
    • Fixed key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments.

Acknowledgments

Special thanks to the security researchers and contributors who reported these vulnerabilities and helped implement the fixes: @0xManan, @HyperPS, and @hertschuh.

Full Changelog: v3.12.0...v3.12.1

Contributors

hertschuh, yomananchill, and HyperPS
Loading

v3.13.1

v3.13.1

Choose a tag to compare

View all tags
@sachinprasadhs sachinprasadhs released this 14 Jan 19:04
v3.13.1
8914427
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bug Fixes & Improvements

  • General
    • Removed a persistent warning triggered during import keras when using NumPy 2.0 or higher. (#21949)
  • Backends
    • JAX: Fixed an issue where CUDNN flash attention was broken when using JAX versions greater than 0.6.2. (#21970)
  • Export & Serialization
    • Resolved a regression in the export pipeline that incorrectly forced batch sizes to be dynamic. The export process now correctly respects static batch sizes when defined. (#21944)

Full Changelog: v3.13.0...v3.13.1

Loading