vLLM 0.32 stops letting any website call your model server

In vLLM 0.32 the --allowed-origins flag now defaults to an empty list instead of ["*"], so third-party sites can no longer reach a model server from the browser. The change landed on October 11 and shipped in the 0.32.0rc0 release candidate on October 12; stable 0.31.0 still allows any origin.

• allowed-origins now defaults to [] instead of ["*"]
• Change landed Oct 11, shipped in 0.32.0rc0 on Oct 12
• Non-browser clients (curl, OpenAI SDK, agents) keep working
• Browser UIs on other origins will start hitting CORS errors