Bump vllm from 0.28.0 to 0.30.0 in /requirements

[dependabot]

Bumps vllm from 0.28.0 to 0.30.0.

Release notes

Sourced from vllm's releases.

v0.30.0

Highlights

This release features 762 commits from 315 contributors (104 new)!

• New models: DeepSeek-V4.1-Flash (#56214, #56228, #56208) with the whole KV stored in MXFP8 through the FlashMLA V4.1 record on SM100 (#56893), DeepGEMM Mega-mHC (#56962), and async Engram prefetch with Engram DP sharding (#56512); DeepSeek-V4-Flash-Vision-Exp (#54566), also on ROCm (#55107) and with LoRA (#55897); GLM-5.3-Flash (#53906) with EPLB (#55119); K2-Horizon (#55063); Cohere Compass (#54774); Bailing V3 VL (#55921); Nanbeige4.2 via the Transformers backend (#56071); and a DeepSeek-V4 CPU backend with AVX512/AMX sparse MLA, indexer, mHC and compressor kernels (#55355).
• Fast Start: a persistent per-GPU weight-cache daemon holds post-quantized, TP-sharded weights in GPU memory so restarting engines map them over CUDA IPC with --load-format ipc_cache instead of reloading from disk (#54921), now covering FP4 checkpoints (#55465) and multi-node TP (#55468).
• Watermarking: Gumbel-max watermarked generation and detection with a keyed PRF, per-request opt-out and an example detection endpoint (#54053); dual-key Gumbel-max makes it compatible with speculative decoding (#56122); the Rust frontend forwards the per-request controls (#56338).
• HiSparse: a host-resident tier for sparse-MLA decode that spills KV pages to pinned host memory under GPU pressure and serves top-k misses from a per-request GPU hot buffer, enabled through HiSparseConnector (#53781), with Prometheus counters (#56061), a host cache shared across TP ranks (#56629), and the attention config inferred from the connector (#57041).
• Model Runner V2: dual-batch overlap in eager mode (#50945) and with FULL CUDA graphs for microbatched steps (#51700); MTP (#46994) and EAGLE3/DFlash/DSpark (#50514) speculative decoding under pipeline parallelism; adaptive verification for every draft-model speculator through an online acceptance estimator (#52228); gc frozen during graph capture, cutting capture from 12s to 2s and engine init from 28.9s to 8.2s on H200 (#54646); --return-sampling-mask compacted on GPU, fixing an about 2x RL step-time regression (#54901).
• Qwen3.8-Flash-Next performance: separate prefill and decode QSA indexer kernels (#54513), fused PLE kernels (#54517), FP8 indexer cache (#54890), padded-index skipping in sparse GQA (#54873), fused PLE residual and QSA output gate (#55309), UVA PLE offload and Engram tensor parallelism via --engram-config (#54371), and torch.compile removed from the NVIDIA implementation so FP8 fits on a single GB300 (#55272).
• Kimi K3 performance: native CUDA AttnRes default on SM100 (#54261), KDA mixed-batch gather/scatter removed (5.2-7.7% E2E throughput, #56159), grouped FP8 MLA cache insertion (4-6x kernel speedup at small batch, #55356), DSV3 low-latency GEMM on strided tensors (12-81% kernel speedup, #54565), overlapped TP8 KDA projections (#54697), FlashInfer KDA kernels (#55364), internal prefix checkpoints with partial prefix caching and speculative decoding (#53614), and symmetric DCP disaggregation for hybrid Mamba models (#55531).
• Large scale serving: PCP+DCP on sparse-MLA models (#56157), PCP with single-module MTP and replicated DSpark (#56107) and decode-only FULL CUDA graphs (#53867), Elastic EP reusing CUDA graphs across reconfiguration (#54985), an opt-in FlashInfer PCIe IPC all-reduce for NVLink-less boxes (#53576), DeepEP v2 async finalize overlapping shared experts with combine (#52781), Mooncake Store heterogeneous TP sharing (#53129), a KVCR secondary-tier adapter (#53624), and encoder-cache sharing over NIXL (#47941) and Mooncake (#41567).
• Quantization: targeted online quantization through quantization_config.targets (#51285) and on partially pre-quantized checkpoints from any quant method (#51392), W4A16 DSA with the nvfp4_fp8_ds_mla KV cache (#51724), FlashInfer CuTeDSL NVFP4 W4A16 default over Marlin on SM100/103 (#53014), NVFP4 in the torch linear backend (#53319), per-quantization linear backend overrides (#51204), AutoRound 2/3/5/6/7-bit on CUDA (#52890), and DeepSelect top-k for the DSA sparse indexer (#56464).
• Breaking changes: scale-out endpoints are opt-in on plain vllm serve via --enable-scale-out, replacing VLLM_ENABLE_SCALE_OUT_ENDPOINTS (#54579, #55176); GPTQ activation ordering (g_idx) removed (#54809); items deprecated for 0.29 removed, including the VLLM_PREFIX_CACHE_RETENTION_INTERVAL and VLLM_MM_HASHER_ALGORITHM env vars (#55353); the all Mamba cache mode deprecated (#55041); python -m vllm.entrypoints.grpc_server deprecated in favor of vllm serve --grpc (#56746); YaRN aligned with Transformers so vendor YaRN aliases no longer re-scale max_model_len (#56446).

Release Artifacts

Python Wheels

Platform	Install
PyPI (CUDA 13.0)	pip install vllm
PyPI (CUDA 13.0, uv)	uv pip install vllm --torch-backend=auto
ROCm	pip install vllm --extra-index-url https://wheels.vllm.ai/rocm/0.30.0/rocm723
XPU	uv pip install vllm --extra-index-url https://wheels.vllm.ai/0.30.0/xpu --extra-index-url https://download.pytorch.org/whl/xpu --index-strategy unsafe-best-match

Docker Images

Platform	Docker Image
CUDA 13.0 (Default)	docker pull vllm/vllm-openai:v0.30.0
CUDA 12.9	docker pull vllm/vllm-openai:v0.30.0-cu129
CUDA 13.0 + Ubuntu 24.04	docker pull vllm/vllm-openai:v0.30.0-ubuntu2404
CUDA 12.9 + Ubuntu 24.04	docker pull vllm/vllm-openai:v0.30.0-cu129-ubuntu2404
ROCm	docker pull vllm/vllm-openai-rocm:v0.30.0
CPU	docker pull vllm/vllm-openai-cpu:v0.30.0
XPU	docker pull vllm/vllm-openai-xpu:v0.30.0

Other Artifacts

Pre-built release artifacts are available in the Assets section at the bottom of this page, including:

• Source distribution tarball
• CUDA 12.9 Python wheels for x86_64 and arm64
• CUDA 13.0 Python wheels for x86_64 and arm64
• CPU Python wheels for x86_64, arm64, and macOS
• XPU Python wheel for x86_64

Model Support

... (truncated)

Commits

• ced6857 [CI][Build] Harden triton-cpu sleef submodule fetch in CPU image build (#57871)
• 9ed533e [Build] Fix DeepGEMM CUDA 12.9 release builds (#57554)
• fa6ff06 [Bugfix][NIXL] Avoid receive reports for notification-only requests (#57570)
• 526f127 [Bugfix][HiSparse][NIXL] Import full blocks without tail prefill on D (#57049)
• 4df23e6 [XPU] Fix incorrect context-key normalization for Qwen DFlash-based models (#...
• a00a354 [Bugfix] Isolate supplemental FlashInfer BF16 autotuning (#57285)
• 201132e [Bugfix][HiSparse][PD] Align region-mapped pulls across logical block sizes (...
• 57105e3 [Bugfix] Make GPU sync checks safe under torch.compile (#56904)
• 69ca4a5 [Build][NVIDIA] Update public Rubin dependencies and MSA compatibility (#56545)
• 99a9381 [BugFix][PCP] Handle missing DP metadata in one-sided EP (#54016)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​vllm@​0.28.0 ⏵ 0.30.0		+16

View full report