vLLM blocks client-set image processing settings by default

vLLM now rejects non-empty multimodal processing settings sent by API clients, per PR #58830, merged September 26.

Before this, a client could set mm_processor_kwargs or media_io_kwargs on a single request and push image or video processing past whatever limits the operator intended. Nothing on the server side stopped it, and that gap could exhaust memory on any deployment that doesn't fully trust its API callers.

The patch flips the default. Per-request kwargs are now refused unless the operator passes --trust-request-mm-kwargs at startup. That one flag decides whether the server accepts any per-request override at all.

Server-level configuration and offline use through the LLM class don't change. Only the API path that let per-request callers override processing settings is closed.

Anyone tuning image resolution per request, for instance raising it for a single call without touching global config, will start hitting errors after upgrading. Turning on --trust-request-mm-kwargs restores the old behavior for deployments that already trust every caller.