OSS Releases: vLLM 0.31, Nuxt 4.6, LiteLLM 1.104, Terraform 1.16.5

Frameworks

• vitejs/vite, v8.3.3 release: Fixes filename handling in transformIndexHtml, filesystem safety for ?vite-wasm-instance, and module-path storage correctness. (Older patch releases v6.4.4, v7.3.7, v8.1.6, and v8.2.4 contain only dependency bumps and are skipped.)
• nuxt/nuxt, v4.6.0 release: Ships the new @nuxt/cli v4 as a bundled dependency, delivering an interactive terminal UI, per-module startup timing, a lock-file mechanism that lets multiple dev processes coordinate, and a 6.6x faster first-paint with a 73% smaller install footprint.
• remix-run/remix (multiple packages), v1.0.0 release: First stable releases for spa, static-middleware, session-storage-redis, session-storage-memcache, tar-parser, terminal, and test, marking the completion of the modular Remix package split.

Infra

• hashicorp/terraform, v1.16.5 release: Fixes a crash triggered by tainted instance state with no valid status, and resolves a nil-identity panic during resource deletion.

Data

All ClickHouse/ClickHouse releases this week (v26.3, v26.7, v26.8, v26.9 patch trains) carried no published release notes, indicating maintenance-only patch content; they are skipped per policy.

AI

• vllm-project/vllm, v0.31.0 release: Major inference-performance release built around DeepSeek-V4.1-Flash, including FlashMLA mega-attention with NVFP4 compressed KV cache as the SM100 default, Mega-Gate fusing gate GEMM with expert selection, fused small-batch weight-only attention with inverse RoPE and MXFP8 quantization, and SWA bounded replay that keeps sliding-window KV out of prefix caching. Introduces a vllm preload CLI daemon for fast engine restarts and experimental CRIU-based vllm snapshot create/restore for TP1 engines. Draft-model speculative decoding and custom logits processors now run on Model Runner V2.
• BerriAI/litellm, v1.104.0 release: Adds breached-password detection, self-service password change with plaintext-leak remediation, and forced password reset for admin-set or compromised passwords; also serializes /model/info listing with orjson for a latency improvement.
• BerriAI/litellm, v1.103.3 release: Stable backport that stops migration checks from rebuilding SpendLogs indexes on startup, preventing costly blocking operations.
• openai/openai-python, v3.24.0 release: Adds custom voice creation and agent session events; fixes Python request-routing field priority in parse helpers.
• openai/openai-python, v3.23.0 release: Returns typed answers from agent session streams, supports file staging and turn-artifact downloads, exposes typed application actions as agent tools, and adds session traces with Realtime translations.

Runtime

• cloudflare/workerd, v1.20261006.1 release: Tunes re-entrancy and microtask resolution timing, pins SharedArrayBuffer view rejection across byte-stream entry points, and aligns the TypeScript ReadableStream async iterator with WebIDL.
• cloudflare/workerd, v1.20261004.1 release: Exposes Durable Object snapshot APIs.
• cloudflare/workerd, v1.20261003.1 release: Adds ctx.cache.invalidate() and wraps non-coercible JSG values.
• cloudflare/workerd, v1.20261002.1 release: Adds Workflows create batch overload and restores the C++ exception boundary in console.* decorators.
• vercel/turborepo, v2.11.7 release: Passes SDKROOT through to repository tasks and ignores Vercel OIDC token rotation in .env.local cache inputs.

Devtools

• neovim/neovim released only a nightly prerelease build this week with no stable tag; skipped per policy.

---

This week's releases reveal two converging priorities across the ecosystem: squeezing more performance from GPU inference (vLLM's sweeping SM100 kernel fusions and fast-restart daemon) and tightening the security and developer-experience surface of production tooling (LiteLLM's password-hardening suite, Nuxt's dramatically leaner CLI, and workerd's stream-conformance fixes). Projects are increasingly treating startup latency and runtime safety as first-class features rather than afterthoughts.