Skip to content
InvokeAI Logo InvokeAI Documentation

All versions since InvokeAI v6.13.5
All versions

InvokeAI v6.13.5

This is a maintenance release of InvokeAI focused on bug fixes and stability. Version 6.14.0 will be the next major feature release, featuring video generation, multiple GPU support, the Wan 2.2 image and video models, pressure-sensitive canvas, HiDiffusion integration, workflow to workflow calls, and much more.

Here are the highlights of the current release:

Updated Libraries

  • React version 19 (frontend support) @joshistoast
  • ROCm version 7.1 (AMD GPU support) @lstein @heathen711
  • Transformers version 5.5.4 (AI inference and training support) @kappacommit

Major Bug Fixes

  • Fix the image viewer progress preview behavior when selecting a gallery image during image generation. @JPPhoto
  • Save and restore both positive and negative prompt history for SD images. @DustyShoe
  • Fix crash when a LoRA was applied to a Flux.2 4B/9B Diffusers model loaded with FP8 storage. @Pfannkuchensack
  • Restore the X/Y queue badges when running in multiuser mode. @lstein
  • Prevent main panel from being squeezed out of existence on small screens. @lstein
  • Gallery maintenance script updated to correctly handle nested image subfolders when structured image directory activated. @lstein
  • Fix crash when using a Z-Image model with regional guidance. @Pfannkuchensack
  • Prevent crash when Heun (2d order) sampler applied to a FLUX.2 Klein model with reference images. @Pfannkuchensack
  • Prevent hang when an unknown wildcard was passed to the dynamic prompt processor. @Pfannkuchensack

New Features

  • Support PEFT named-adapter LoRAs. @Pfannkuchensack
  • Add Qwen Image single-file checkpoint loader with fp8 support. @Pfannkuchensack

Documentation

  • Added information on 3d party GPU providers that host InvokeAI. @lstein @michaelmanly
  • Fix uvicorn URL. @fishd72
  • Add graph execution example to API guide. @wunianze666-netizen

Full List of Changes

New Contributors

Full Changelog: https://github.com/invoke-ai/InvokeAI/compare/v6.13.0…v6.13.5

InvokeAI v6.13.6

This is a patch release.

It corrects a bug introduced in v6.13.5 that caused Qwen Image and Qwen Image Edit models to crash with a dictionary key error when used with the default single-file Qwen 2.2 VL Encoder.

Please see https://github.com/invoke-ai/InvokeAI/releases/tag/v6.13.5 for information on what’s in this release.

Full Changelog: https://github.com/invoke-ai/InvokeAI/compare/v6.13.5…v6.13.6

v6.13.7 Latest

InvokeAI Version 6.13.7

⚠️ This is a security patch release

All recent versions of InvokeAI through 6.13.6 contain a security hole that potentially allows an attacker to recover the contents of the running instance’s invokeai.yaml and api_keys.yaml files. These files can contain sensitive data including API keys for image generation hosting services and API download tokens for HuggingFace and other model download sites.

Your keys/tokens may have been compromised if:

  1. Your invokeai.yaml file contains download API tokens for any model provider (e.g. Civitai, HuggingFace),
  2. Your api_keys.yaml file contains API keys for one or more remote image generation services (e.g. Alibaba, OpenAI),
  3. At any point, you set the listen host to 0.0.0.0 to enable network access to your InvokeAI machine, and
  4. Either you exposed the InvokeAI machine to the Internet, or you share your LAN with untrusted individuals.

In the event that these apply to you, or just to be safe, please upgrade to version 6.13.7 and rotate your API tokens and keys.

👉 Note: The InvokeAI team discourages opening your InvokeAI host to the internet. If you choose to do so, we recommend that 1) you use the multiuser configuration and pick strong passwords; and 2) that you isolate the InvokeAI instance in a Docker container. 👈

Additional security fixes

This patch also closes a series of related but less critical security issues:

  • Leakage of model paths: An attacker could recursively enumerate the paths of all models and model-like files, in an arbitrary directory on the Invoke server’s filesystem.
  • Testing existence of arbitrary paths: An attacker could also determine whether a certain file is present on the Invoke server’s filesystem, even if it wasn’t a model file.
  • Administrator functions available to regular users: In multiuser mode, several functions intended for the use of Administrator users were available for use by unprivileged users. Not an obvious security hole, but a potential problem.

Many thanks to George Chen (@geo-chen), for reporting the original issue.

Full Changelog: https://github.com/invoke-ai/InvokeAI/compare/v6.13.6…v6.13.7

This site was designed and developed by Aether Fox Studio.