Coding & agents New
vLLM 0.32.0 fixes three security advisories, tightens default CORS and drops Python 3.10
Published:
The vLLM project published v0.32.0 on October 18 at 08:50 CEST. The release notes credit 814 commits from 363 contributors.
On security, it fixes three advisories: GHSA-4hhp-h66f-j5j7 (chat template resource exhaustion), GHSA-q97c-p368-75c4 (tokenizer max_token_id) and GHSA-frvg-qw88-hww9 (P2P ZMQ socket exhaustion). CORS no longer allows every origin by default, untrusted images are limited to raster formats, shared-memory multimodal cache handles are signed and JSON schemas nested deeper than 64 levels are rejected.
Breaking changes include dropping Python 3.10, new transformers and tokenizers version pins, removal of cascade attention and of the torch.compile sequence-parallelism and AsyncTP passes, no longer reserving max_tokens from the context window, and renamed Responses API reasoning stream events. Other additions include a new POST /v1/systemone endpoint for structured decisions and NVFP4 KV-cache support on more GPU generations.
Caveat. Throughput gains quoted in the release notes come from individual pull-request benchmarks on specific models and hardware, not independent tests.
Sources