dependabot[bot] opened a new pull request, #40162: URL: https://github.com/apache/beam/pull/40162
Bumps [vllm](https://github.com/vllm-project/vllm) from 0.10.1.1 to 0.28.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vllm-project/vllm/releases";>vllm's releases</a>.</em></p> <blockquote> <h1>v0.28.0</h1> <h2>Highlights</h2> <p>This release features 584 commits from 270 contributors (76 new)!</p> <ul> <li><strong>Kimi-K3 performance push</strong>: a major optimization effort for Kimi-K3 across the stack — Decode Context Parallel (DCP) support (<a href="https://redirect.github.com/vllm-project/vllm/issues/50484";>#50484</a>), fused FlashKDA decode and prefill kernels (<a href="https://redirect.github.com/vllm-project/vllm/issues/50654";>#50654</a>, <a href="https://redirect.github.com/vllm-project/vllm/issues/51311";>#51311</a>, <a href="https://redirect.github.com/vllm-project/vllm/issues/52458";>#52458</a>), SiTU activation support for MegaMoE (<a href="https://redirect.github.com/vllm-project/vllm/issues/50510";>#50510</a>), GEMM-RS for sequence parallelism (<a href="https://redirect.github.com/vllm-project/vllm/issues/52079";>#52079</a>), combined all-gathers with 1.5~3x kernel-level speedup (<a href="https://redirect.github.com/vllm-project/vllm/issues/51070";>#51070</a>), an adaptive speculative token budget delivering ~60% better DSpark TTFT (<a href="https://redirect.github.c om/vllm-project/vllm/issues/51725">#51725</a>), and optional shared-expert sharding saving ~17 GiB of memory per GPU (<a href="https://redirect.github.com/vllm-project/vllm/issues/50912";>#50912</a>). Kimi-K3 also now runs on ROCm with the V2 model runner (<a href="https://redirect.github.com/vllm-project/vllm/issues/51653";>#51653</a>).</li> <li><strong>DeepSeek V4</strong>: sparse MLA now works end-to-end for plain decode, MTP, and DSpark speculative decoding (<a href="https://redirect.github.com/vllm-project/vllm/issues/51538";>#51538</a>), joined by AMD Quark NVFP4 support (<a href="https://redirect.github.com/vllm-project/vllm/issues/47972";>#47972</a>), reasoning-effort prompts and mappings (<a href="https://redirect.github.com/vllm-project/vllm/issues/50580";>#50580</a>), sparse top-k metadata kernel optimizations (<a href="https://redirect.github.com/vllm-project/vllm/issues/52084";>#52084</a>, <a href="https://redirect.github.com/vllm-project/vllm/issues/51967";>#51967</a>), narrowed eager CUDA graph regions (<a href="https://redirect.github.com/vllm-project/vllm/issues/51430";>#51430</a>, <a href="https://redirect.github.com/vllm-project/vllm/issues/52401";>#52401</a>), and ROCm enablement on gfx11 and gfx950 (<a href="https://redirect.github.com/vllm-project/vllm/issues/47017";>#47017</a>, <a href="https://redirect. github.com/vllm-project/vllm/issues/52212">#52212</a>).</li> <li><strong>Speculative decoding advances</strong>: DFlash2 with local convolution and a candidate selector (<a href="https://redirect.github.com/vllm-project/vllm/issues/52816";>#52816</a>), DSpark confidence-scheduled verification (<a href="https://redirect.github.com/vllm-project/vllm/issues/47808";>#47808</a>), and async scheduling auto-enabled for draft models (<a href="https://redirect.github.com/vllm-project/vllm/issues/48341";>#48341</a>).</li> <li><strong>Model Runner V2 maturation</strong>: E/P/D disaggregation (<a href="https://redirect.github.com/vllm-project/vllm/issues/38390";>#38390</a>), weight offloading (<a href="https://redirect.github.com/vllm-project/vllm/issues/51413";>#51413</a>), multi-layer MTP KV cache support (<a href="https://redirect.github.com/vllm-project/vllm/issues/50062";>#50062</a>), encoder CUDA graphs (<a href="https://redirect.github.com/vllm-project/vllm/issues/49852";>#49852</a>), decoder token-wise pooling (<a href="https://redirect.github.com/vllm-project/vllm/issues/50931";>#50931</a>) plus Transformers pooling models (<a href="https://redirect.github.com/vllm-project/vllm/issues/52425";>#52425</a>), attention-free models (<a href="https://redirect.github.com/vllm-project/vllm/issues/52374";>#52374</a>), and <code>thinking_token_budget</code> support (<a href="https://redirect.github.com/vllm-project/vllm/issues/46727";>#46727</a>).</li> <li><strong>Tiered KV cache offloading</strong>: disk offloading support (<a href="https://redirect.github.com/vllm-project/vllm/issues/49644";>#49644</a>), out-of-tree secondary tier managers via <code>module_path</code> (<a href="https://redirect.github.com/vllm-project/vllm/issues/51007";>#51007</a>), partial secondary-tier load results (<a href="https://redirect.github.com/vllm-project/vllm/issues/50321";>#50321</a>), tiering metrics (<a href="https://redirect.github.com/vllm-project/vllm/issues/48798";>#48798</a>), and a canonical CPU layout for parallelism-agnostic offload (<a href="https://redirect.github.com/vllm-project/vllm/issues/48414";>#48414</a>).</li> <li><strong>Rust frontend & gRPC</strong>: a standalone renderer (<a href="https://redirect.github.com/vllm-project/vllm/issues/50289";>#50289</a>), multimodal image inference over gRPC (<a href="https://redirect.github.com/vllm-project/vllm/issues/50368";>#50368</a>), explicit data-parallel rank routing (<a href="https://redirect.github.com/vllm-project/vllm/issues/51178";>#51178</a>), and RL lifecycle control (<a href="https://redirect.github.com/vllm-project/vllm/issues/51316";>#51316</a>), with protobuf schemas now published to Buf (<a href="https://redirect.github.com/vllm-project/vllm/issues/51276";>#51276</a>).</li> <li><strong>New defaults</strong>: <code>max_num_batched_tokens</code> raised from 8192 to 16384 (<a href="https://redirect.github.com/vllm-project/vllm/issues/51726";>#51726</a>), prefix caching enabled by default for Mamba models (<a href="https://redirect.github.com/vllm-project/vllm/issues/50991";>#50991</a>), and the Blackwell CUDA graph capture default raised to 1024 (<a href="https://redirect.github.com/vllm-project/vllm/issues/49390";>#49390</a>).</li> <li><strong>Breaking changes</strong>: bitsandbytes support migrated to an out-of-tree plugin (<a href="https://redirect.github.com/vllm-project/vllm/issues/43529";>#43529</a>); Transformers bumped to 5.15.0 (<a href="https://redirect.github.com/vllm-project/vllm/issues/51668";>#51668</a>); the deprecated <code>calculate_kv_scales</code> runtime KV scale calculation was removed (<a href="https://redirect.github.com/vllm-project/vllm/issues/49389";>#49389</a>); <code>override_attention_dtype</code> was removed (<a href="https://redirect.github.com/vllm-project/vllm/issues/48684";>#48684</a>).</li> </ul> <h2>Release Artifacts</h2> <h3>Python Wheels</h3> <table> <thead> <tr> <th>Platform</th> <th>Install</th> </tr> </thead> <tbody> <tr> <td>PyPI (CUDA 13.0)</td> <td><code>pip install vllm</code></td> </tr> <tr> <td>PyPI (CUDA 13.0, uv)</td> <td><code>uv pip install vllm --torch-backend=auto</code></td> </tr> <tr> <td>ROCm</td> <td><code>pip install vllm --extra-index-url https://wheels.vllm.ai/rocm/0.28.0/rocm722</code></td> </tr> </tbody> </table> <h3>Docker Images</h3> <table> <thead> <tr> <th>Platform</th> <th>Docker Image</th> </tr> </thead> <tbody> <tr> <td>CUDA 13.0 (Default)</td> <td><code>docker pull vllm/vllm-openai:v0.28.0</code> (<code>v0.28.0-cu130</code> also works)</td> </tr> <tr> <td>CUDA 12.9</td> <td><code>docker pull vllm/vllm-openai:v0.28.0-cu129</code></td> </tr> <tr> <td>CUDA 13.0 + Ubuntu 24.04</td> <td><code>docker pull vllm/vllm-openai:v0.28.0-ubuntu2404</code></td> </tr> <tr> <td>CUDA 12.9 + Ubuntu 24.04</td> <td><code>docker pull vllm/vllm-openai:v0.28.0-cu129-ubuntu2404</code></td> </tr> <tr> <td>ROCm</td> <td><code>docker pull vllm/vllm-openai-rocm:v0.28.0</code></td> </tr> <tr> <td>CPU</td> <td><code>docker pull vllm/vllm-openai-cpu:v0.28.0</code></td> </tr> <tr> <td>XPU</td> <td><code>docker pull vllm/vllm-openai-xpu:v0.28.0</code></td> </tr> </tbody> </table> <h3>Other Artifacts</h3> <p>Pre-built release artifacts are available in the <strong>Assets</strong> section at the bottom of this page, including:</p> <ul> <li>Source distribution tarball</li> <li>CUDA 12.9 Python wheels for x86_64 and arm64</li> <li>CUDA 13.0 Python wheels for x86_64 and arm64</li> <li>CPU Python wheels for x86_64, arm64, and macOS</li> </ul> <h2>Model Support</h2> <ul> <li><strong>New models</strong>: Muse Glimmer (<a href="https://redirect.github.com/vllm-project/vllm/issues/51655";>#51655</a>), Ling 3.0 Flash with BF16, MTP, and parser support (<a href="https://redirect.github.com/vllm-project/vllm/issues/51045";>#51045</a>) plus an FP8 variant (<a href="https://redirect.github.com/vllm-project/vllm/issues/51265";>#51265</a>) and hybrid MXFP4 routed experts (<a href="https://redirect.github.com/vllm-project/vllm/issues/52114";>#52114</a>), Dots3 NOTE native multimodal support (<a href="https://redirect.github.com/vllm-project/vllm/issues/51255";>#51255</a>), and Interns2mobius (<a href="https://redirect.github.com/vllm-project/vllm/issues/51149";>#51149</a>).</li> <li><strong>Qwen</strong>: Qwen3.8 enabled on AMD ROCm (<a href="https://redirect.github.com/vllm-project/vllm/issues/50068";>#50068</a>), fused CUDA post-conv MTP decode kernel for Qwen3.5 GDN (<a href="https://redirect.github.com/vllm-project/vllm/issues/51674";>#51674</a>), GDN gates aligned with speculative tokens (<a href="https://redirect.github.com/vllm-project/vllm/issues/51812";>#51812</a>), and Qwen3.5 fixes for text-only checkpoints (<a href="https://redirect.github.com/vllm-project/vllm/issues/50734";>#50734</a>, <a href="https://redirect.github.com/vllm-project/vllm/issues/50355";>#50355</a>).</li> <li><strong>Transformers modeling backend</strong>: MLA support (<a href="https://redirect.github.com/vllm-project/vllm/issues/48250";>#48250</a>), hardware-agnostic model definition (<a href="https://redirect.github.com/vllm-project/vllm/issues/49458";>#49458</a>), fully generalized input embedding handling (<a href="https://redirect.github.com/vllm-project/vllm/issues/51247";>#51247</a>), logit softcapping (<a href="https://redirect.github.com/vllm-project/vllm/issues/52173";>#52173</a>), and a hardened multimodal path (<a href="https://redirect.github.com/vllm-project/vllm/issues/51408";>#51408</a>, <a href="https://redirect.github.com/vllm-project/vllm/issues/51657";>#51657</a>).</li> <li><strong>LoRA</strong>: vision tower LoRA for Gemma4 (<a href="https://redirect.github.com/vllm-project/vllm/issues/42662";>#42662</a>), tower/connector LoRA for Keye (<a href="https://redirect.github.com/vllm-project/vllm/issues/51780";>#51780</a>) and Ultravox (<a href="https://redirect.github.com/vllm-project/vllm/issues/48215";>#48215</a>).</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vllm-project/vllm/commit/2cf0a6915ce544dc493a0990f2ea38d81601128a";><code>2cf0a69</code></a> [CI/Build] Pin Cython below 3.3 for arm64 tilelang sdist (<a href="https://redirect.github.com/vllm-project/vllm/issues/53358";>#53358</a>)</li> <li><a href="https://github.com/vllm-project/vllm/commit/9991487661f64176bbf9a4bea6c4d91b96c9ae6e";><code>9991487</code></a> Revert "[Kernel] Gemma-4 FA4 FP8 Kernel" (<a href="https://redirect.github.com/vllm-project/vllm/issues/52987";>#52987</a>)</li> <li><a href="https://github.com/vllm-project/vllm/commit/1af5a386cd43695b23a1f7a63b0646bbf043fc9c";><code>1af5a38</code></a> [CI][Release] Extend DSv4 engine readiness timeout (<a href="https://redirect.github.com/vllm-project/vllm/issues/53252";>#53252</a>)</li> <li><a href="https://github.com/vllm-project/vllm/commit/74a6576b9b5832494c314405c3cae94db55801e1";><code>74a6576</code></a> [Spec Decode] DFlash2: local convolution + candidate selector (<a href="https://redirect.github.com/vllm-project/vllm/issues/52816";>#52816</a>)</li> <li><a href="https://github.com/vllm-project/vllm/commit/cf902bda5ddf3ecee63d4b8365686ce37e842c06";><code>cf902bd</code></a> [CI/Build] Fix accident pre-commit breakage due to concurrent merge (<a href="https://redirect.github.com/vllm-project/vllm/issues/52578";>#52578</a>)</li> <li><a href="https://github.com/vllm-project/vllm/commit/cd6ae1e0a08845eb4e186ca7fdbb25cfc7008014";><code>cd6ae1e</code></a> [Bugfix][Security] Guard _load_ov2_processor with resolve_trust_remote_code (...</li> <li><a href="https://github.com/vllm-project/vllm/commit/b7d8e0f7493d75186028fd9873d9d5a346a41d11";><code>b7d8e0f</code></a> [kv_offload] fix(metrics): rename kv_offload_tiering_block_{queries,hits} → c...</li> <li><a href="https://github.com/vllm-project/vllm/commit/c0eac6ff95f0857f854de957334baf5e29d54573";><code>c0eac6f</code></a> [ROCm]: Bump triton 3.7 commit (<a href="https://redirect.github.com/vllm-project/vllm/issues/52819";>#52819</a>)</li> <li><a href="https://github.com/vllm-project/vllm/commit/855e09e2c38d4ad168ba7da63a37e723d201c520";><code>855e09e</code></a> [Kernel] SM120: stop routing misaligned-M blockwise FP8 GEMMs to the small-M ...</li> <li><a href="https://github.com/vllm-project/vllm/commit/1b6ed9bc2e5dc7c788aadb9cb38e2071cdd97576";><code>1b6ed9b</code></a> [EPD] Allow KV consumers to omit MM embeddings (<a href="https://redirect.github.com/vllm-project/vllm/issues/52697";>#52697</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vllm-project/vllm/compare/v0.10.1.1...v0.28.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/beam/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
