[dependabot]

Bumps vllm from 0.30.0 to 0.32.0.

Release notes

Sourced from vllm's releases.

v0.32.0

Highlights

This release features 814 commits from 363 contributors (121 new)!

• Structured decisions and generic parsers: the new POST /v1/systemone endpoint answers choice, noul and score questions over a structured state (#59299), is served by default (#60677, #60696), and also runs on Cloudflare/clef-omni (#61064), LiquidAI/d1-3B (#60676) and DiffusionGemma (#60466). The new hf tool and reasoning parser (--tool-call-parser hf, --reasoning-parser hf) reads the checkpoint's response_template, so models that ship it need no model-specific parser (#58604, #58602), in both the Python and Rust frontends (#59005).
• Low-precision KV cache everywhere: NVFP4 KV cache now runs on SM8x and SM12x (#46963), SM90 (#60620) and with XQA decode on SM12x (#60452), and on MiniMax-M3 sparse attention on SM100 (#59300); GLM-5.x defaults to an FP8 KV cache on SM100, halving KV memory per rank with 2.3-5.5% more throughput at a 7-11% TTFT cost in the PR's benchmark (#60140, #60281); fp8_ds_mla on SM90 gives GLM-5.3-Flash up to 31% more output throughput (#59246); ROCm gains the 4-bit ultraquant_4bit KV cache with about 2x the density of FP8 (#57057).
• Model Runner V2: a GPU n-gram speculator with variable-length drafts (#40704), Elastic EP (#53934), pipeline parallelism with prefill context parallelism for MLA models (#59139), a stock torch.compile mode (#59079), and MRV2 is now the default on ROCm with the model-specific MRV1 exceptions removed (#56360).
• Faster startup and serving: vllm download-kernels installs FlashInfer's precompiled kernels (#58765); vllm preload --preload-autotune keeps the FlashInfer autotune table warm across restarts (#60085); a shared-memory tensor arena broadcasts large multimodal tensors to workers with one copy (#51207); tokenizers and processors load from the local snapshot (#60825); and with --api-server-count above 1 each connection goes to the least-loaded API worker, for 43-85% more req/s on short requests (Qwen3-0.6B, 32 input / 1 output tokens) in the PR's benchmark (#60723).
• Model support: new EmbeddingGemma 2 omni-modal embeddings (#60254), MiniCPM-V 4.7 (#58674) and Nemotron 3.5 ASR (#59827); video input in the Transformers modeling backend (#57441); GLM-5.3 sparse MLA index conversions reused across layers (3.5-3.9x on that kernel, #59464) and fused multi-step draft decode (13.3% at concurrency 1, #57443); HiSparse per-request residency caching for up to 58% more throughput on GLM-5.3-NVFP4 on B200 with long, fully GPU-resident contexts at high concurrency (#60083).
• Security: fixes for GHSA-4hhp-h66f-j5j7 (chat template resource exhaustion, #50300), GHSA-q97c-p368-75c4 (tokenizer max_token_id, #59491) and GHSA-frvg-qw88-hww9 (P2P ZMQ socket exhaustion, #51504); CORS no longer allows every origin by default (#61009); untrusted images are limited to raster formats (#60022); shared-memory multimodal cache handles are signed (#59357); and JSON schemas nested deeper than 64 levels are rejected (#60036).
• Breaking changes: Python 3.10 dropped (#60402); default CORS origins restricted (#61009); transformers>=5.16.1,<5.20.0 and tokenizers>=0.23.2 (#57387, #59796); torch.compile sequence parallelism and AsyncTP passes removed (#60517); cascade attention removed (#61126); mamba_cache_mode="all" removed (#58997); max_tokens no longer reserved from the context window (#57035); Responses API reasoning stream events renamed (#59652).

Release Artifacts

Python Wheels

Platform	Install
PyPI (CUDA 13.0)	pip install vllm
PyPI (CUDA 13.0, uv)	uv pip install vllm --torch-backend=auto
ROCm	pip install vllm --extra-index-url https://wheels.vllm.ai/rocm/0.32.0/rocm723
XPU	uv pip install vllm --extra-index-url https://wheels.vllm.ai/0.32.0/xpu --extra-index-url https://download.pytorch.org/whl/xpu --index-strategy unsafe-best-match

Docker Images

Platform	Docker Image
CUDA 13.0 (Default)	docker pull vllm/vllm-openai:v0.32.0
CUDA 12.9	docker pull vllm/vllm-openai:v0.32.0-cu129
CUDA 13.0 + Ubuntu 24.04	docker pull vllm/vllm-openai:v0.32.0-ubuntu2404
CUDA 12.9 + Ubuntu 24.04	docker pull vllm/vllm-openai:v0.32.0-cu129-ubuntu2404
ROCm	docker pull vllm/vllm-openai-rocm:v0.32.0
CPU	docker pull vllm/vllm-openai-cpu:v0.32.0
XPU	docker pull vllm/vllm-openai-xpu:v0.32.0

Other Artifacts

Pre-built release artifacts are available in the Assets section at the bottom of this page, including:

• Source distribution tarball
• CUDA 12.9 Python wheels for x86_64 and arm64
• CUDA 13.0 Python wheels for x86_64 and arm64
• CPU Python wheels for x86_64, arm64, and macOS
• XPU Python wheel for x86_64

Model Support

• New models: EmbeddingGemma 2 (google/embeddinggemma-2), an omni-modal text/image/audio/video embedding model, with unused modality encoders skipped through --limit-mm-per-prompt (#60254, #60289); MiniCPM-V 4.7 (#58674); Nemotron 3.5 ASR (nvidia/nemotron-3.5-asr-streaming-0.6b) complete-audio transcription; native realtime streaming is not yet supported (#59827); Cloudflare/clef-omni (#61064) and LiquidAI/d1-3B (#60676) on /v1/systemone; PLaMo 3 reasoning and tool parsers (#56575); and the zerank-2 reranker score template (#60415).
• Transformers modeling backend: video inputs (#57441), and Glm, Arcee, CWM, Mellum (#59679), GPT-NeoX, Phi, Seed-OSS and Jais2 (#59701) now served through it.
• New model capabilities: LoRA for BERT, RoBERTa and XLM-RoBERTa embedding models (#61033); Granite as an EAGLE3/DFlash target (#60855); Qwen3-ASR EAGLE3 (#52824); Sarvam MLA EAGLE3/DSpark with PP (#55902); GLM-5.3-Flash with the DFlash2 drafter (#56983); and MiniMax-M3 EAGLE3 at PP > 1 on MRV2 (#57197) with MTP sharing target embeddings under PP (#58648).

... (truncated)

Commits

• 5df63a7 [Bugfix][Rust Frontend] Fix macOS build: read inherited listener family from ...
• 82eb574 [Bugfix] Fix NaN output of the Mamba2 chunk scan kernel on sm90 (#61718)
• 1ae8f08 [Bugfix] Make Humming DeviceInfo lookups traceable under torch.compile (#61858)
• 0c86133 [Frontend] Replace return_mm_kwargs with an mm_payload enum on render request...
• 7a27e9b [CI] Run the Clef pooler test on GPU (#61409)
• d875124 [Perf][Bugfix] Prefer MNNVL for single-node FlashInfer allreduce again (#61989)
• 7960eeb [CI] Pin DeepSeek-V4.1-Flash-NVFP4 eval to its FP8-Engram revision (#61763)
• f5f79df [CI] Fix Unlimited-OCR loading after upstream model_type rename (#61590)
• ba899a9 [XPU][MLA] Integrate XPU MLA support into the existing FLASH_ATTN_MLA backend...
• fc14116 [Dependency] Update Humming and remove NVFP4 scale workaround (#61556)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​vllm@​0.30.0 ⏵ 0.32.0	+6	+24

View full report