vLLM 0.33.0 lands alongside three open advisories

Unauthenticated EngineCore crash via out-of-range prompt token id under skip_tokenizer_init (incomplete fix of GHSA-25q3-v2hm-8vpf) vllm-project/vllm

The report describes an unauthenticated EngineCore crash reachable with an out-of-range prompt token id when skip_tokenizer_init is set, and is flagged as an incomplete fix of GHSA-25q3-v2hm-8vpf rather than a fresh issue. If you serve with skip_tokenizer_init and expose the API beyond localhost, the earlier patch is not the whole story.

v0.33.0 vllm-project/vllm

by khluu

The release covers 927 commits from 389 contributors, 122 of them new, and adds Reflection Beam-1.0 with its DFlash2 drafter, Yandex AliceAI-Foundation-80B-A3B, Recursive Flint, Step-5 Preview and Nemotron Parse 3.5, among others. It ships as v0.33.0rc3.

llama + CUDA: flash_attn_ext_rows (fix unified kv for multi-seq) ggml-org/llama.cpp

by am17an

llama.cpp extends flash attention with flash_attn_ext_rows so backends can receive a compact kv_rows representation of the tokens each sequence actually needs, instead of masking out other sequences' tokens. Unified KV cache currently pays that filtering cost on every multi-seq decode.

[Feat] paged-experts: size the resident experts automatically sgl-project/sglang

by N3mezis

Paged Experts no longer needs --paged-experts-num-resident K chosen by hand: the server sizes resident experts itself, since K shares the --mem-fraction-static budget with the KV cache and depends on GPU, model, quantization and cache dtype. A K set too high used to fail at startup.

[Metal] Route qqmm without global scales like quantized_matmul ml-explore/mlx

by XXXXRT666

On Metal, qqmm without global scales always ran dispatch_qmv regardless of row count, so 256- and 1024-row calls used a vector kernel the PR measures at 6 to 13 times slower than the matrix path quantized_matmul picks for the same weights. That routing now matches quantized_matmul.