# vLLM v0.32.0 — Release & Upgrade Intelligence
- **Product:** vLLM (https://vllm.ai)
- **Version:** v0.32.0
- **Released:** Oct 18, 2026
- **Impact Score:** 7/10
- **Breaking Changes:** Source flagged
- **Canonical Analysis:** https://changelogs.us/vllm/updates/v0.32.0/

## Executive Summary (TL;DR)
vLLM v0.32.0. Source highlight: This release features 814 commits from 363 contributors (121 new)!

## Breaking Changes & Deprecations
- Breaking changes**: Python 3.10 dropped (#60402); default CORS origins restricted (#61009); `transformers>=5.16.1,<5.20.0` and `tokenizers>=0.23.2` (#57387, #59796); torch.compile sequence parallelism and AsyncTP passes removed (#60517); cascade attention removed (#61126); `mamba_cache_mode="all"` removed (#58997); `max_tokens` no longer reserved from the context window (#57035); Responses API reasoning stream events renamed (#59652).
- Breaking Changes & Deprecations * Python 3.10 is no longer supported; the minimum is Python 3.11 (#60402). * Default CORS origins changed from `*` to none; set `--allowed-origins` for browser clients (#61009).

## New Features
- **Tool calling and structured output**: `parallel_tool_calls=false` enforced (#50502, #59298), `tool_choice="required"` streaming (#60354) and native XML parsers (#47512), Step-3.5 and `minimax_m3` on the parser engine (#59321, #59743), xgrammar `propertyNames` (#57594), and LoRA PEFT `rank_pattern`/`alpha_pattern` applied with unsupported features rejected (#59801, #60225).
- API changes: `max_tokens` is treated as an upper bound on output rather than reserved from the context window (#57035); Responses API streaming uses `response.content_part.added/done` with `part.type="reasoning_text"` instead of `response.reasoning_part.added/done` (#59652); `SamplingParams.prompt_logprob_token_ids` is per row (#56984); `/inference/v1/generate` logprobs use integer token IDs (#58181); sleep API responses are standardized and invalid levels return 400 (#52864); `return_mm_kwargs`

## Improvements
- **NVIDIA**: native 64-head FlashMLA sparse prefill on SM100 (1.16-1.18x TTFT, #60029), block-FP8 DeepGEMM experts skipping padding (#59128), SM120 split-K attention (#58482), DGX Spark Qwen4Exp GEMM plans (#59753, #59632, #60027), OAI Triton MXFP4 MoE on SM12x (#58877), and FlashInfer autotune cache per rank (#57635).
- **CPU**: vectorized sampler (up to 58x on s390x, #53913), aarch64 causal conv1d (about 9%, #54093), POWER10 AWQ/GPTQ (#59149), and PowerPC `dtype=auto` choosing bfloat16 (#58528).
- **Other**: tpu-inference v0.31.0 (#60190) and out-of-tree platforms registering multiple attention backends (#41091).

## Bug Fixes
- **Security**: fixes for GHSA-4hhp-h66f-j5j7 (chat template resource exhaustion, #50300), GHSA-q97c-p368-75c4 (tokenizer `max_token_id`, #59491) and GHSA-frvg-qw88-hww9 (P2P ZMQ socket exhaustion, #51504); CORS no longer allows every origin by default (#61009); untrusted images are limited to raster formats (#60022); shared-memory multimodal cache handles are signed (#59357); and JSON schemas nested deeper than 64 levels are rejected (#60036).
- **GLM-5.3 and GLM-5.3-Flash**: sparse MLA index conversion reused across layers (#59464), fused multi-step draft decode (#57443), FP8 KV cache default on SM100 (#60140, #60281), `fp8_ds_mla` on SM90 (#59246), qlnorm skipped for MHA (4.4-7.7% TTFT, #58845), long-context indexer prefill sharded across TP (up to 25% lower TTFT at 1M context, #54951), DCP for the kpool indexer (#59211, #60032), KDA prefill checkpoints with FlashKDA (#56960), FP8 KV on SM90 sparse MLA (#55222), `--mamba-ssm-cache-dty
- **DeepSeek-V4 and V4.1**: decoder-side SWA bounded replay (#58132) with replay layers in CUDA graphs and trimmed in PIECEWISE graphs (`compilation_config.decoder_replay_trim_threshold`, #59532) plus last KV-source layer trimming (+3.6%, #59894), packed FP8 Engram exchange across DP (#59923), faster CPU-offloaded Engram lookups (#59327), fused DeepSeek V4 + MTP drafting (#58463), encoder CUDA graph packing for V4.1 and Kimi-K3 (11% lower mean TTFT, #58925), EPLB for DSpark drafts (#57549), and fi
- **Qwen**: Qwen3.8-Flash-Next (Qwen4Exp) merged QSA projections in one GEMM (1.45-1.68x, #59533), fused QSA pre-indexer (#57097), sequence parallelism through `--enable-hc-sp` (#56322), SM100 low-latency decode GEMM plans (up to 2.7x vs cuBLAS on small-M, #59214), `--kv-cache-dtype-skip-layers` honored (#60023), and PLE loading for INC (#59990), Quark (#59443) and pre-SM89 GPUs (#60142); Qwen3-VL/Qwen3.5/Qwen3.8 M-RoPE cache 4x smaller and Qwen3.5 YaRN matching Transformers (#59853); Qwen3-Omni M
- **Kimi-K3 and MiniMax-M3**: Kimi-K3 FlashInfer fused speculative KDA on SM100 (#54255), fused vision processor (10-20x preprocessing at 1080p-8K, #59278), fused K/V pack on the DCP prefill path (#56881), and DSpark KV cache back to 4 groups (#59733); MiniMax-M3 MSA prefill with an E4M3 query (26-37% faster with FP8 KV, #60684), FP8 indexer cache on non-SM100 GPUs (#59081), Triton indexer tuning (#56151, #59481), and indexer score fixes (#60194, #54597).
- **Multimodal**: device-side input normalization for Qwen3-VL/Qwen3.5/Qwen4Exp (#51289), GLM-V and GLM-OCR (#55389), Llama Nemotron VL (#57928) and Kimi K2.5/K3 (#59278), kept fused under `compile_mm_encoder` (#59195); encoder inputs sorted by modality (6.5-8.2% more req/s, #60196); Mistral 3 preprocessing 8% faster (#57531); Pixtral `compile_mm_encoder` (#57168); and fixes for Llama 4 / Mistral Large 3 EAGLE drafters (regression since v0.28.0, #57633), Phi-4 MM audio OOM (#60614), DeepSeek-OCR z

## Upgrade Command
```bash
python -m pip install 'vllm==0.32.0'
```