chore(deps): bump vllm from 0.26.0 to 0.28.0 in /backend/python/vllm

[dependabot]

Bumps vllm from 0.26.0 to 0.28.0.

Release notes

Sourced from vllm's releases.

v0.28.0

Highlights

This release features 584 commits from 270 contributors (76 new)!

• Kimi-K3 performance push: a major optimization effort for Kimi-K3 across the stack — Decode Context Parallel (DCP) support (#50484), fused FlashKDA decode and prefill kernels (#50654, #51311, #52458), SiTU activation support for MegaMoE (#50510), GEMM-RS for sequence parallelism (#52079), combined all-gathers with 1.5~3x kernel-level speedup (#51070), an adaptive speculative token budget delivering ~60% better DSpark TTFT (#51725), and optional shared-expert sharding saving ~17 GiB of memory per GPU (#50912). Kimi-K3 also now runs on ROCm with the V2 model runner (#51653).
• DeepSeek V4: sparse MLA now works end-to-end for plain decode, MTP, and DSpark speculative decoding (#51538), joined by AMD Quark NVFP4 support (#47972), reasoning-effort prompts and mappings (#50580), sparse top-k metadata kernel optimizations (#52084, #51967), narrowed eager CUDA graph regions (#51430, #52401), and ROCm enablement on gfx11 and gfx950 (#47017, #52212).
• Speculative decoding advances: DFlash2 with local convolution and a candidate selector (#52816), DSpark confidence-scheduled verification (#47808), and async scheduling auto-enabled for draft models (#48341).
• Model Runner V2 maturation: E/P/D disaggregation (#38390), weight offloading (#51413), multi-layer MTP KV cache support (#50062), encoder CUDA graphs (#49852), decoder token-wise pooling (#50931) plus Transformers pooling models (#52425), attention-free models (#52374), and thinking_token_budget support (#46727).
• Tiered KV cache offloading: disk offloading support (#49644), out-of-tree secondary tier managers via module_path (#51007), partial secondary-tier load results (#50321), tiering metrics (#48798), and a canonical CPU layout for parallelism-agnostic offload (#48414).
• Rust frontend & gRPC: a standalone renderer (#50289), multimodal image inference over gRPC (#50368), explicit data-parallel rank routing (#51178), and RL lifecycle control (#51316), with protobuf schemas now published to Buf (#51276).
• New defaults: max_num_batched_tokens raised from 8192 to 16384 (#51726), prefix caching enabled by default for Mamba models (#50991), and the Blackwell CUDA graph capture default raised to 1024 (#49390).
• Breaking changes: bitsandbytes support migrated to an out-of-tree plugin (#43529); Transformers bumped to 5.15.0 (#51668); the deprecated calculate_kv_scales runtime KV scale calculation was removed (#49389); override_attention_dtype was removed (#48684).

Release Artifacts

Python Wheels

Platform	Install
PyPI (CUDA 13.0)	pip install vllm
PyPI (CUDA 13.0, uv)	uv pip install vllm --torch-backend=auto
ROCm	pip install vllm --extra-index-url https://wheels.vllm.ai/rocm/0.28.0/rocm722

Docker Images

Platform	Docker Image
CUDA 13.0 (Default)	docker pull vllm/vllm-openai:v0.28.0 (v0.28.0-cu130 also works)
CUDA 12.9	docker pull vllm/vllm-openai:v0.28.0-cu129
CUDA 13.0 + Ubuntu 24.04	docker pull vllm/vllm-openai:v0.28.0-ubuntu2404
CUDA 12.9 + Ubuntu 24.04	docker pull vllm/vllm-openai:v0.28.0-cu129-ubuntu2404
ROCm	docker pull vllm/vllm-openai-rocm:v0.28.0
CPU	docker pull vllm/vllm-openai-cpu:v0.28.0
XPU	docker pull vllm/vllm-openai-xpu:v0.28.0

Other Artifacts

Pre-built release artifacts are available in the Assets section at the bottom of this page, including:

• Source distribution tarball
• CUDA 12.9 Python wheels for x86_64 and arm64
• CUDA 13.0 Python wheels for x86_64 and arm64
• CPU Python wheels for x86_64, arm64, and macOS

Model Support

• New models: Muse Glimmer (#51655), Ling 3.0 Flash with BF16, MTP, and parser support (#51045) plus an FP8 variant (#51265) and hybrid MXFP4 routed experts (#52114), Dots3 NOTE native multimodal support (#51255), and Interns2mobius (#51149).
• Qwen: Qwen3.8 enabled on AMD ROCm (#50068), fused CUDA post-conv MTP decode kernel for Qwen3.5 GDN (#51674), GDN gates aligned with speculative tokens (#51812), and Qwen3.5 fixes for text-only checkpoints (#50734, #50355).
• Transformers modeling backend: MLA support (#48250), hardware-agnostic model definition (#49458), fully generalized input embedding handling (#51247), logit softcapping (#52173), and a hardened multimodal path (#51408, #51657).
• LoRA: vision tower LoRA for Gemma4 (#42662), tower/connector LoRA for Keye (#51780) and Ultravox (#48215).

... (truncated)

Commits

• 2cf0a69 [CI/Build] Pin Cython below 3.3 for arm64 tilelang sdist (#53358)
• 9991487 Revert "[Kernel] Gemma-4 FA4 FP8 Kernel" (#52987)
• 1af5a38 [CI][Release] Extend DSv4 engine readiness timeout (#53252)
• 74a6576 [Spec Decode] DFlash2: local convolution + candidate selector (#52816)
• cf902bd [CI/Build] Fix accident pre-commit breakage due to concurrent merge (#52578)
• cd6ae1e [Bugfix][Security] Guard _load_ov2_processor with resolve_trust_remote_code (...
• b7d8e0f [kv_offload] fix(metrics): rename kv_offload_tiering_block_{queries,hits} → c...
• c0eac6f [ROCm]: Bump triton 3.7 commit (#52819)
• 855e09e [Kernel] SM120: stop routing misaligned-M blockwise FP8 GEMMs to the small-M ...
• 1b6ed9b [EPD] Allow KV consumers to omit MM embeddings (#52697)
• Additional commits viewable in compare view

[localai-org-maint-bot]

Reviewed: the change is scoped to the documented L4T CUDA 13 vLLM pin, and the L4T 13 backend image build passed along with every vLLM image variant. Good to merge from the dependency/backend perspective, @mudler. The generic Linux test job is red while its Apple counterpart and all targeted backend builds pass, so that remaining check should be treated separately.

[dependabot]

Superseded by #11752.