Tools · · 2 min read

vLLM 0.32.0 upgrade checklist: Python 3.11 minimum, CORS closed by default, max_tokens no longer reserved, renamed Responses reasoning events

vLLM 0.32.0 shipped on October 18, 2026 with 814 commits. Before you bump the pin, check five changes that can break a working deployment: Python 3.10 is gone, browser clients need --allowed-origins, the transformers pin moved, Responses API reasoning stream events were renamed, and a few flags were removed. Here is what to change.

vLLM v0.32.0 is out as a stable release, with the wheel live on PyPI since October 18, 2026. The release notes count 814 commits from 363 contributors. Most of it is new kernels and model support, but a handful of changes can break a server that worked fine on 0.31.

Builder question this answers: I run vLLM in production or behind a web UI. What do I have to change before upgrading to 0.32.0, and what can I ignore?

1. Python 3.10 no longer installs

PR #60402 sets requires-python = ">=3.11,<3.15", and PyPI lists the same range for 0.32.0. On a 3.10 environment, pip install -U vllm will not resolve to 0.32.0. Rebuild the venv on 3.11–3.14, or use the official image:

docker pull vllm/vllm-openai:v0.32.0        # CUDA 13.0 default
docker pull vllm/vllm-openai:v0.32.0-cu129  # CUDA 12.9

The release also requires transformers>=5.16.1,<5.20.0 and tokenizers>=0.23.2. If you pin those yourself, move the pins first. CUDA source builds now need GCC 13.

2. Browser clients lose CORS unless you allow them

This is the one most likely to look like a mystery outage. PR #61009 changes the default allowed origins from ["*"] to an empty list in both the Python and Rust frontends. The PR explains why. With the old default, any website could read responses from a vLLM server the browser could reach, if no API key was set.

Server-to-server calls (curl, the OpenAI SDK, agents) are unaffected, because CORS only applies to browsers. A web chat UI calling vLLM directly from the page will start failing preflight. The fix is the existing flag, which takes a JSON list:

vllm serve <model> --allowed-origins '["https://chat.example.com"]'

Passing '["*"]' restores the old behavior, but the PR says wildcard is now an explicit opt-in for a reason.

3. max_tokens is a cap, not a reservation

PR #57035 fixes a common complaint from coding agents. Before, vLLM subtracted the requested max_tokens from the context window before checking the prompt. The PR’s example has a 128,000-token context, a 62,466-token prompt and max_tokens: 65535. That request used to be rejected. It is now accepted, and generation is clamped to 65,534 tokens. If you had client-side workarounds that shrank max_tokens to dodge this error, you can drop them. Requests whose prompt alone overflows the context are still rejected.

4. Responses API streaming: reasoning events renamed

If you consume /v1/responses streams yourself, PR #59652 replaces vLLM’s custom response.reasoning_part.added/done events with the standard response.content_part.added/done, using part.type="reasoning_text". The old names failed validation against the official OpenAI Python SDK’s event schema. The PR lists possible transition options but implements none of them, so handlers hard-coded to reasoning_part.* will stop seeing reasoning start and end. Update them to filter on part.type instead.

5. Removed flags and modes

  • --mamba-cache-mode all now fails validation (#58997). Use align, which is already the prefix-caching default, or none.
  • Cascade attention is gone (#61126). --disable-cascade-attn still parses but only warns, and is scheduled for removal in v0.33.0. Delete it from launch scripts now.
  • torch.compile sequence-parallel and AsyncTP passes were removed, along with PassConfig.enable_sp, fuse_gemm_comms and sp_min_token_num. Model-level sequence parallelism is unaffected.

Worth adding after the upgrade

PR #58765 adds vllm download-kernels, which installs FlashInfer’s precompiled kernels so they are not downloaded and compiled at startup. The PR says this matters most on Hopper and newer GPUs. Run it after every pip upgrade. If you run --api-server-count above 1, PR #60723 now sends each connection to the least-loaded API worker. The PR measured 43–85% more requests per second on very short Qwen3-0.6B requests, so treat that as a best case, not a typical gain.

0.32.0 is also the image NVIDIA’s model card pins in our Nemotron 3.5 Super VL serving guide. Our Granite Switch 4.1 note covers why not every model’s docs agree on it yet. For a full vLLM deployment walkthrough, see how to serve Qwen3.8-Flash-Next with vLLM.

Sources: vLLM v0.32.0 release notes · vllm 0.32.0 on PyPI · PR #61009 (CORS) · PR #57035 (max_tokens) · PR #59652 (Responses events) · PR #60402 (Python 3.11) · PR #58765 (download-kernels)

Source: vLLM v0.32.0 release notes