python3Packages.vllm: 0.14.0 -> 0.15.1

[GaetanLepage]

Things done

• python3Packages.vllm: 0.14.0 -> 0.14.1
  • Diff: vllm-project/vllm@v0.14.0...v0.14.1
  • Changelog: https://github.com/vllm-project/vllm/releases/tag/v0.14.1
• python3Packages.vllm: 0.14.1 -> 0.15.0
  • Diff: vllm-project/vllm@v0.14.1...v0.15.0
  • Changelog: https://github.com/vllm-project/vllm/releases/tag/v0.15.0
• python3Packages.vllm: 0.15.0 -> 0.15.1
  • Diff: vllm-project/vllm@v0.15.0...v0.15.1
  • Changelog: https://github.com/vllm-project/vllm/releases/tag/v0.15.1

cc @happysalada @CertainLach @daniel-fahey

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

[GaetanLepage]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 483505
Commit: 96122a5a99dc5197d81885533511888663971e58

---

x86_64-linux

❌ 2 packages failed to build:

• python313Packages.torchrl
• python313Packages.torchrl.dist

✅ 6 packages built:

• python313Packages.kserve
• python313Packages.kserve.dist
• python313Packages.vllm
• python313Packages.vllm.dist
• vllm
• vllm.dist

[GaetanLepage]

• torchrl fails because its dependency pygame is broken (see python3Packages.{pygame,pytest-markdown-docs,pysdl2}: fix build #483784, merged in python-updates)
• the cuda build is broken because of bitsandbytes (see python3Packages.bitsandbytes: fix cuda build #483507)

[GaetanLepage]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 483505
Commit: ffdaf9faeaac40f38e121df45e97ed0d3e33bb71

---

x86_64-linux

✅ 8 packages built:

• python313Packages.kserve
• python313Packages.kserve.dist
• python313Packages.torchrl
• python313Packages.torchrl.dist
• python313Packages.vllm
• python313Packages.vllm.dist
• vllm
• vllm.dist

[GaetanLepage]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 483505
Commit: 22f6fcdfe89356d35083ee33558ec1f00763d5d5

---

x86_64-linux

✅ 8 packages built:

• python313Packages.kserve
• python313Packages.kserve.dist
• python313Packages.torchrl
• python313Packages.torchrl.dist
• python313Packages.vllm
• python313Packages.vllm.dist
• vllm
• vllm.dist

[GaetanLepage]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 483505 --extra-nixpkgs-config '{ allowUnfree = true; cudaSupport = true; }'
Commit: 80282ca350ec642a06fdba485d51390164b51704

---

x86_64-linux

✅ 9 packages built:

• nixpkgs-manual
• python313Packages.kserve
• python313Packages.kserve.dist
• python313Packages.torchrl
• python313Packages.torchrl.dist
• python313Packages.vllm
• python313Packages.vllm.dist
• vllm
• vllm.dist

---

aarch64-linux

✅ 1 package built:

• nixpkgs-manual

[LeSuisse]

This fixes CVE-2026-22778 / #488751

Can one of the maintainers take a look at backporting the security fixes to stable branch which is currently using vLLM 0.11.2?

[nixpkgs-ci]

Backport failed for release-25.11, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release-25.11
git worktree add -d .worktree/backport-483505-to-release-25.11 origin/release-25.11
cd .worktree/backport-483505-to-release-25.11
git switch --create backport-483505-to-release-25.11
git cherry-pick -x a1fe3d6f7e61ae658f7626f0176210e716f53631 715481ee1c4b46027087deff497d408e1111091b 315eefb91376ddd12e6de869997c728c478faca5 3dc1661ab4803bac458f65bbb5faac54a578c52b 80282ca350ec642a06fdba485d51390164b51704

[daniel-fahey]

This fixes CVE-2026-22778 / #488751

Can one of the maintainers take a look at backporting the security fixes to stable branch which is currently using vLLM 0.11.2?

Easier said than done @LeSuisse, but I think I've identified all the right cherry-picks, takes a while to test each time due to the long compile time, watch this space 💪