vllm - 💡(How to fix) Fix [Installation]: PyPI release blocks installation on enterprise systems: xgrammar==0.1.29 blocked by security scanners (CVE-2026-25048) [1 participants]

Error: pip install vllm tries to install xgrammar==0.1.29, which is affected by CVE-2026-25048. The vLLM package requirement was limited to only accept version 0.1.29.

Fix Plan

To resolve the issue, a new version of vLLM needs to be released to PyPI with the updated xgrammar dependency.

Steps to Release a New Version of vLLM

1. Update the setup.py file: Modify the setup.py file to include the updated xgrammar version.

# setup.py
from setuptools import setup

setup(
    # ... other dependencies ...
    install_requires=[
        # ... other dependencies ...
        'xgrammar>=0.1.32',
        # ... other dependencies ...
    ],
)

1. Create a new release: Create a new release of vLLM with the updated setup.py file.
2. Upload to PyPI: Upload the new release to PyPI using the following command:

pip install twine
python -m twine upload dist/*

Temporary Workaround

Until the new version is released, users can install vLLM with the updated xgrammar version using the following command:

pip install --upgrade xgrammar>=0.1.32
pip install vllm

Verification

To verify that the fix worked, install vLLM using the following command:

pip install vllm

Check the installed version of xgrammar using:

pip show xgrammar

The version should be 0.1.32 or higher.