vLLM leaks heap addresses through lowercase regex

sanitize_message() address regex is lowercase-only and does not match PIL's uppercase __repr__, leaking live heap addresses to unauthenticated clients vllm-project/vllm

The address regex in sanitize_message() matches lowercase hex only, so PIL's uppercase __repr__ slips past it and live heap addresses reach unauthenticated clients. This is the period's most consequential fix: if you expose a vLLM endpoint that can return PIL object reprs in error messages, your addresses have been leaking.

[Security] Fix ReDoS in validation error path sanitizer (#52120) vllm-project/vllm

by Juan Pérez de Algaba

A second vLLM security fix in the same week: a ReDoS in the validation error path sanitizer, where a crafted input drives pathological backtracking. It lands alongside the address leak, so patch once and cover both.

[Bugfix] Preserve FP8 indexer WK pairs across load_weights calls vllm-project/vllm

by pllopis

GLM-5.3 and DeepSeek-V3.2 checkpoints store FP8 indexer WK weights as pairs, and non-deterministic I/O completion order under the runai_streamer loader could drop them, leaving the model in thinking loops. The fix preserves the pairs across load_weights calls, so if you load deepseek_v32 under runai_streamer, reload after updating rather than trusting an existing load.

Fix Metal grid truncation in softmax/logsumexp/rms_norm/layer_norm past 2^27 rows ml-explore/mlx

by ArupKantiDas

Past roughly 2^27 rows of 128 values or fewer, the Metal grid setup truncated, and softmax, logsumexp, rms_norm and layer_norm each launched one threadgroup per row. MLX now bounds that, which matters if you push long contexts or wide batches through the Mac GPU.

CUDA: fuse FFN gate/up matmuls and GLU in MMQ with interleaved gate/up rows ggml-org/llama.cpp

by anujj

The gate/up plus GLU fusion had only covered small batches on the MMVQ and MMVF paths. llama.cpp keeps one accumulator and applies the GLU in the write-back, so prompt-processing batch sizes on the CUDA MMQ path now get the same fusion as decode.

ggml-cpu : rewrite concat as one row kernel for all types ggml-org/llama.cpp

by ServeurpersoCom

CPU concat collapses from the i8, f16, f32 and any-type variants into one row kernel, where each destination row is a single memcpy from a dense source and quantized types are included. It is a broad refactor inside a high-traffic op, so validate your own outputs on hosts you compile yourself.

model : add LiquidAI/LFM3-1.7B and LiquidAI/LFM3-VL-2B ggml-org/llama.cpp

by tdakhran

Quantized GGUF support for LiquidAI/LFM3-1.7B and the LFM3-VL-2B vision model landed, and Ollama added mlx-side DFlash2 support, extending the block draft with block-local dynamic convolutions and a candidate selector. The two across one week make LFM3 the family most local runtimes picked up.

cmd/launch: fix OpenCode v2 launch and config parsing ollama/ollama

by hoyyeva

OpenCode v2 rejects --model on the bare command, and its shared service could keep the global default rather than the model chosen by ollama launch. Ollama now uses --standalone for detected v2 clients while keeping v1's explicit model selection, so launching an uninstalled model works again.