[dependabot]

Bumps vllm from 0.10.1.1 to 0.32.0.

Release notes

Sourced from vllm's releases.

v0.32.0

Highlights

This release features 814 commits from 363 contributors (121 new)!

• Structured decisions and generic parsers: the new POST /v1/systemone endpoint answers choice, noul and score questions over a structured state (#59299), is served by default (#60677, #60696), and also runs on Cloudflare/clef-omni (#61064), LiquidAI/d1-3B (#60676) and DiffusionGemma (#60466). The new hf tool and reasoning parser (--tool-call-parser hf, --reasoning-parser hf) reads the checkpoint's response_template, so models that ship it need no model-specific parser (#58604, #58602), in both the Python and Rust frontends (#59005).
• Low-precision KV cache everywhere: NVFP4 KV cache now runs on SM8x and SM12x (#46963), SM90 (#60620) and with XQA decode on SM12x (#60452), and on MiniMax-M3 sparse attention on SM100 (#59300); GLM-5.x defaults to an FP8 KV cache on SM100, halving KV memory per rank with 2.3-5.5% more throughput at a 7-11% TTFT cost in the PR's benchmark (#60140, #60281); fp8_ds_mla on SM90 gives GLM-5.3-Flash up to 31% more output throughput (#59246); ROCm gains the 4-bit ultraquant_4bit KV cache with about 2x the density of FP8 (#57057).
• Model Runner V2: a GPU n-gram speculator with variable-length drafts (#40704), Elastic EP (#53934), pipeline parallelism with prefill context parallelism for MLA models (#59139), a stock torch.compile mode (#59079), and MRV2 is now the default on ROCm with the model-specific MRV1 exceptions removed (#56360).
• Faster startup and serving: vllm download-kernels installs FlashInfer's precompiled kernels (#58765); vllm preload --preload-autotune keeps the FlashInfer autotune table warm across restarts (#60085); a shared-memory tensor arena broadcasts large multimodal tensors to workers with one copy (#51207); tokenizers and processors load from the local snapshot (#60825); and with --api-server-count above 1 each connection goes to the least-loaded API worker, for 43-85% more req/s on short requests (Qwen3-0.6B, 32 input / 1 output tokens) in the PR's benchmark (#60723).
• Model support: new EmbeddingGemma 2 omni-modal embeddings (#60254), MiniCPM-V 4.7 (#58674) and Nemotron 3.5 ASR (#59827); video input in the Transformers modeling backend (#57441); GLM-5.3 sparse MLA index conversions reused across layers (3.5-3.9x on that kernel, #59464) and fused multi-step draft decode (13.3% at concurrency 1, #57443); HiSparse per-request residency caching for up to 58% more throughput on GLM-5.3-NVFP4 on B200 with long, fully GPU-resident contexts at high concurrency (#60083).
• Security: fixes for GHSA-4hhp-h66f-j5j7 (chat template resource exhaustion, #50300), GHSA-q97c-p368-75c4 (tokenizer max_token_id, #59491) and GHSA-frvg-qw88-hww9 (P2P ZMQ socket exhaustion, #51504); CORS no longer allows every origin by default (#61009); untrusted images are limited to raster formats (#60022); shared-memory multimodal cache handles are signed (#59357); and JSON schemas nested deeper than 64 levels are rejected (#60036).
• Breaking changes: Python 3.10 dropped (#60402); default CORS origins restricted (#61009); transformers>=5.16.1,<5.20.0 and tokenizers>=0.23.2 (#57387, #59796); torch.compile sequence parallelism and AsyncTP passes removed (#60517); cascade attention removed (#61126); mamba_cache_mode="all" removed (#58997); max_tokens no longer reserved from the context window (#57035); Responses API reasoning stream events renamed (#59652).

Release Artifacts

Python Wheels

Platform	Install
PyPI (CUDA 13.0)	pip install vllm
PyPI (CUDA 13.0, uv)	uv pip install vllm --torch-backend=auto
ROCm	pip install vllm --extra-index-url https://wheels.vllm.ai/rocm/0.32.0/rocm723
XPU	uv pip install vllm --extra-index-url https://wheels.vllm.ai/0.32.0/xpu --extra-index-url https://download.pytorch.org/whl/xpu --index-strategy unsafe-best-match

Docker Images

Platform	Docker Image
CUDA 13.0 (Default)	docker pull vllm/vllm-openai:v0.32.0
CUDA 12.9	docker pull vllm/vllm-openai:v0.32.0-cu129
CUDA 13.0 + Ubuntu 24.04	docker pull vllm/vllm-openai:v0.32.0-ubuntu2404
CUDA 12.9 + Ubuntu 24.04	docker pull vllm/vllm-openai:v0.32.0-cu129-ubuntu2404
ROCm	docker pull vllm/vllm-openai-rocm:v0.32.0
CPU	docker pull vllm/vllm-openai-cpu:v0.32.0
XPU	docker pull vllm/vllm-openai-xpu:v0.32.0

Other Artifacts

Pre-built release artifacts are available in the Assets section at the bottom of this page, including:

• Source distribution tarball
• CUDA 12.9 Python wheels for x86_64 and arm64
• CUDA 13.0 Python wheels for x86_64 and arm64
• CPU Python wheels for x86_64, arm64, and macOS
• XPU Python wheel for x86_64

Model Support

• New models: EmbeddingGemma 2 (google/embeddinggemma-2), an omni-modal text/image/audio/video embedding model, with unused modality encoders skipped through --limit-mm-per-prompt (#60254, #60289); MiniCPM-V 4.7 (#58674); Nemotron 3.5 ASR (nvidia/nemotron-3.5-asr-streaming-0.6b) complete-audio transcription; native realtime streaming is not yet supported (#59827); Cloudflare/clef-omni (#61064) and LiquidAI/d1-3B (#60676) on /v1/systemone; PLaMo 3 reasoning and tool parsers (#56575); and the zerank-2 reranker score template (#60415).
• Transformers modeling backend: video inputs (#57441), and Glm, Arcee, CWM, Mellum (#59679), GPT-NeoX, Phi, Seed-OSS and Jais2 (#59701) now served through it.
• New model capabilities: LoRA for BERT, RoBERTa and XLM-RoBERTa embedding models (#61033); Granite as an EAGLE3/DFlash target (#60855); Qwen3-ASR EAGLE3 (#52824); Sarvam MLA EAGLE3/DSpark with PP (#55902); GLM-5.3-Flash with the DFlash2 drafter (#56983); and MiniMax-M3 EAGLE3 at PP > 1 on MRV2 (#57197) with MTP sharing target embeddings under PP (#58648).

... (truncated)

Commits

• 5df63a7 [Bugfix][Rust Frontend] Fix macOS build: read inherited listener family from ...
• 82eb574 [Bugfix] Fix NaN output of the Mamba2 chunk scan kernel on sm90 (#61718)
• 1ae8f08 [Bugfix] Make Humming DeviceInfo lookups traceable under torch.compile (#61858)
• 0c86133 [Frontend] Replace return_mm_kwargs with an mm_payload enum on render request...
• 7a27e9b [CI] Run the Clef pooler test on GPU (#61409)
• d875124 [Perf][Bugfix] Prefer MNNVL for single-node FlashInfer allreduce again (#61989)
• 7960eeb [CI] Pin DeepSeek-V4.1-Flash-NVFP4 eval to its FP8-Engram revision (#61763)
• f5f79df [CI] Fix Unlimited-OCR loading after upstream model_type rename (#61590)
• ba899a9 [XPU][MLA] Integrate XPU MLA support into the existing FLASH_ATTN_MLA backend...
• fc14116 [Dependency] Update Humming and remove NVFP4 scale workaround (#61556)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

📋 Review Summary

This Dependabot PR bumps vllm from 0.10.1.1 to 0.32.0 directly in sdks/python/container/ml/py312/gpu_image_requirements.txt. Because this file is an autogenerated, fully pinned lockfile, updating vllm in isolation introduces severe dependency conflicts with existing pinned packages and omits required transitive dependencies.

🔍 General Feedback

• sdks/python/container/ml/py312/gpu_image_requirements.txt is generated via ./gradlew :sdks:python:container:generatePythonRequirementsAll from sdks/python/setup.py and should not be modified manually without regenerating the full dependency tree.
• sdks/python/setup.py currently pins 'vllm': ['openai==1.107.1', 'vllm==0.10.1.1', 'triton==3.3.1'] (line 552) and bounds 'torch>=2.3.0,<2.12.0' in the transformers extra (line 513), both of which conflict with vllm==0.32.0 (which requires torch==2.13.0 and openai>=2.25.0).
• If vllm is to be upgraded across Python ML containers, sdks/python/setup.py should be updated and all Python container requirement files (py310, py311, py312, py313) regenerated accordingly (noting also that vllm==0.32.0 drops Python 3.10 support).

---

💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.

[github-actions]

🔴 Critical: Bumping vllm to 0.32.0 in isolation breaks this pinned requirements file:

1. Incompatible pinned dependencies in this file: vllm==0.32.0 requires torch==2.13.0 (pinned to 2.7.1), torchaudio==2.11.0 (pinned to 2.7.1), torchvision==0.28.0 (pinned to 0.22.1), transformers>=5.16.1,<5.20.0 (pinned to 4.55.4), tokenizers>=0.23.2 (pinned to 0.21.4), huggingface_hub>=1.31.0 (pinned to 0.36.2), openai>=2.25.0 (pinned to 1.107.1), fastapi[standard]>=0.133.0,<0.137.0 (pinned to 0.141.1), compressed-tensors==0.17.0 (pinned to 0.10.2), depyf==0.20.0 (pinned to 0.19.0), lm-format-enforcer==0.11.3 (pinned to 0.10.12), llguidance>=1.7.0,<1.8.0 (pinned to 0.7.30), numba==0.65.0 (pinned to 0.61.2), outlines_core==0.2.14 (pinned to 0.2.10), and xgrammar==0.2.8 (pinned to 0.1.21).
2. Missing transitive dependencies: New dependencies required by vllm==0.32.0 (such as flashinfer-python==0.7.0.post1, apache-tvm-ffi==0.1.11, anthropic>=0.71.0, mcp>=2.0.0,<3.0.0, torchcodec>=0.14, etc.) are absent from this file.
3. Out of sync with sdks/python/setup.py: Per the header of this file, updates should be made in sdks/python/setup.py (which still pins vllm==0.10.1.1, openai==1.107.1, and torch<2.12.0) and regenerated using ./gradlew :sdks:python:container:generatePythonRequirementsAll.

[github-actions]

Closing this PR because dependabot updates for container/** are not allowed due to generated files and excluded_paths is disabled due to dependabot/dependabot-core#14408. Once issue is resolved, please remove this step.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.