feat(vllm-omni): prepare 0.21.0rc1 release branch

[Yadan-Wei]

Summary

Bumps the vLLM-Omni AL2023 image to vllm-omni 0.21.0rc1 (pre-release), tracking upstream vLLM v0.21.0 (the rebase target — see vllm-project/vllm-omni#3530). DLC tag bumps v1.2 → v1.3.

This is a preparation PR ahead of the official 0.21.0 release. Public docs and release notes are intentionally unchanged; they land in the follow-up PR once 0.21.0 ships final.

Upstream Dockerfile changes ported to the AL2023 fork

Cherry-picked from the upstream vllm v0.20.0 → v0.21.0 docker/Dockerfile diff:

• libcublas-${CUDA_DASH} → libcublas-devel-${CUDA_DASH} in the runtime stage so cublas headers are present for JIT (fastsafetensors, nccl_allocator).
• flashinfer download-cubin moved to a final RUN after the vllm wheel, EP kernels, and KV connectors finish installing. Earlier downloads cause ~2.5 GB of layer duplication when later pip installs overwrite flashinfer files.
• nixl-cu${CUDA_MAJOR} --force-reinstall --no-deps after the kv_connectors install (replacing the bare nixl-cu13 install), so the matching nixl_ep_cpp.so is shipped.

Upstream changes intentionally skipped

Upstream change	Reason
BUILD_OS=manylinux apt/dnf branching	We are dnf-only on AL2023; the existing dnf path covers us.
nvidia-cutlass-dsl[cu13] strip-shim for cu12	We pin CUDA 13.
DeepGEMM multi-Python interpreter matrix	We build a single-Python image.
examples/online_serving → examples/deployment entrypoint move	We ship our own entrypoint scripts in scripts/vllm/.
New VLLM_BUILD_* and OCI labels	Not required for DLC.

vllm-omni Dockerfile.cuda

Byte-identical between v0.20.0 and v0.21.0rc1 (same blob SHA 78f64f6a). The Dockerfile.ci only bumps VLLM_BASE_TAG=v0.21.0; we don't consume that file, so no port needed.

Pre-release handling

uv pip install adds --prerelease=allow because 0.21.0rc1 is a PEP 440 pre-release. Strip the flag when bumping to stable 0.21.0.

Transformers 5.9.0 compatibility (workaround: pin <5.9.0)

vllm-omni 0.21.0rc1 inherits vLLM core's transformers floor >=4.56.0,!=5.0.*,!=5.1.*,!=5.2.*,!=5.3.*,!=5.4.*,!=5.5.0 with no upper bound, so a fresh install resolves to transformers 5.9.0 (released 2026-05-20). 5.9.0 made two breaking changes to transformers.masking_utils.create_causal_mask / create_sliding_window_causal_mask:

1. Removed the deprecated input_embeds alias (renamed to inputs_embeds in 5.5.1, alias dropped in 5.9.0).
2. Removed cache_position from the signature entirely.

Qwen3TTSTokenizerV2DecoderTransformerModel.forward in vllm-omni 0.21.0rc1 still passes the old kwargs, so every qwen3-tts decode raises TypeError: create_causal_mask() got an unexpected keyword argument 'input_embeds' on 5.9.0.

Workaround in this PR: add a transformers>=4.56.0,<5.9.0 pin to Dockerfile.amzn2023. The upstream call site is being fixed in vllm-project/vllm-omni#3786 (signature-filtered helper that works on 4.56–5.9+). We will not cherry-pick the fix into this image — once vllm-omni ships a release containing #3786, drop the pin and let pip resolve transformers freely again.

New model & feature audit (no test-suite changes)

Walked through the new model + feature delta from v0.20.0 → v0.21.0rc1:

New model	Decision	Reason
SenseNova-U1 (SenseNovaU1Pipeline, DiT-only image gen)	Skip	/v1/images/generations route already covered by flux2-klein-4b and ernie-image-turbo — no new code path.
Tencent Covo-Audio-Chat (CovoAudioForConditionalGeneration, omni-chat)	Skip with TODO	Would be the first omni-chat smoke test, but the model is multi-GPU class and the g6e12xl-runner CodeBuild fleet is ICE in us-west-2 (same constraint as qwen2.5-omni-3b). Revisit when fleet capacity returns.

Notable feature changes (HunyuanImage-3.0 KV reuse + IT2I editing, HunyuanVideo-1.5 USP, FLUX.2-dev TP, Voxtral TTS FP8, attention_config → diffusion_attention_config rename per #3489) do not alter our existing test request shapes or routes — extra_args: "" defaults shield us from the config rename.

No SageMaker endpoint test additions: 0.21.0rc1 introduces no new route or content-type that the existing endpoint suite (Qwen3-TTS on /v1/audio/speech, Wan2.1-VACE on /v1/videos/sync multipart) doesn't already exercise.

Files changed

• docker/vllm_omni/versions.env — VLLM_VERSION 0.20.0 → 0.21.0, VLLM_OMNI_VERSION 0.20.0 → 0.21.0rc1, DLC_MINOR_VERSION 2 → 3.
• docker/vllm_omni/Dockerfile.amzn2023 — same default-ARG bumps + the three upstream-derived hunks + --prerelease=allow on the omni pip install + transformers>=4.56.0,<5.9.0 pin (to be removed once vllm-omni ships Fix build dependencies #3786).
• .github/config/image/vllm-omni-{ec2,sagemaker}-amzn2023.yml — framework_version: "0.21.0rc1", vllm_ref: "v0.21.0".

Test plan

• Build the image locally (or via the build workflow): docker build -f docker/vllm_omni/Dockerfile.amzn2023 ...
• Run the vLLM-Omni smoke-test workflow against the new image (covers /v1/audio/speech, /v1/images/generations, /v1/videos, /v1/videos/sync, /v1/audio/generate).
• Run the SageMaker endpoint test (test/vllm-omni/sagemaker/test_sm_omni_endpoint.py) against the new image.
• Run the security scan workflow; confirm the existing vllm_omni/framework_allowlist.json still covers the diffusers/safetensors advisory chain (vllm-omni#3349 raises diffusers>=0.38.0 but is itself blocked on safetensors 0.8.0 final, so the allowlist entries remain valid).
• Re-evaluate dropping --prerelease=allow and the rc1 suffix once stable 0.21.0 ships.
• Drop the transformers<5.9.0 pin once vllm-omni ships a release containing [Bugfix] Fix qwen3-tts create_causal_mask kwarg for transformers >=5.9.0 vllm-project/vllm-omni#3786.