Starstruk Logo MarkStarstruk

v0.28.0 v2026.08.27

high risk

karpathy/nn-zero-to-heroAug 26, 2026 → Aug 27, 20261 day between releases

What's New

vLLM v0.28.0 optimized Kimi-K3 and DeepSeek V4, while Huginn v2026.08.27 addressed critical security vulnerabilities.

Breaking Changes

  • bitsandbytes support migrated to an out-of-tree plugin
  • Transformers bumped to version 5.15.0
  • The deprecated `calculate_kv_scales` runtime KV scale calculation was removed
  • The `override_attention_dtype` configuration was removed
  • Service-binding migration disconnects unauthorized private bindings and disables affected Agents

New Features

  • DFlash2 speculative decoding with local convolution
  • Default prefix caching enabled for Mamba models
  • Raised `max_num_batched_tokens` from 8192 to 16384
  • Standalone renderer and multimodal image inference over gRPC
  • Migration logic to disconnect unauthorized private bindings

Improvements

  • Kimi-K3 performance push with Decode Context Parallel (DCP) and fused kernels
  • DeepSeek V4 sparse MLA support and AMD Quark NVFP4 support
  • Tiered KV cache offloading support with disk offloading
  • Security fixes for command injection, unauthorized OAuth binding, and duplicate event delivery
  • Model Runner V2 expands to encoder-only workloads and attention-free models

Bug Fixes

  • Fixes manual event propagation across other users' Agents
  • Fixes duplicate event delivery during concurrent propagation scans

Upgrade Notes

For vLLM v0.28.0, bitsandbytes is now a plugin and Transformers is updated to 5.15.0; the deprecated `calculate_kv_scales` and `override_attention_dtype` configurations have been removed. For Huginn v2026.08.27, the service-binding migration will disconnect unauthorized private bindings and disable affected Agents, requiring administrator review.

The Two Releases

v0.28.0

v0.28.0

Aug 26, 2026· 2 months ago

A major performance release for vLLM featuring optimizations for Kimi-K3 and DeepSeek V4, Model Runner V2 maturation, and expanded hardware support including ROCm.

Full release notes
v2026.08.27

v2026.08.27

Aug 27, 2026· 2 months ago

A critical security release for Huginn fixing command injection, unauthorized OAuth binding, and duplicate event delivery issues.

Full release notes