Skip to content

v7.5.0

Latest
Latest

Choose a tag to compare

View all tags
@openai-sdks openai-sdks released this 17 Aug 19:13
v7.5.0
5b96016
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

7.5.0 (2026-08-17)

Features

  • add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
  • api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
  • api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
  • api: Add ServiceTier and ImageDetail types (#2364) (602d481)
  • api: add WebSocket stream IDs (#2314) (156a8db)
  • api: add workload identity access token issued event (#2307) (322a5b1)
  • api: deprecate Sora video APIs (#2313) (4424b40)
  • api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)

Bug Fixes

  • api: clarify audio upload metadata requirements (#2279) (34ecf3f)
  • audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
  • audio: reject ffplay spawn errors (#2012) (6d42d4d)
  • auth: reject redirects during workload identity token exchange (#2321) (240385e)
  • auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
  • avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
  • await webhook verification in README examples (#2302) (0fe7ad0)
  • azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
  • azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
  • azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
  • azure: prevent deployment path traversal (#2337) (a9d9d41)
  • bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
  • chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
  • client: handle empty JSON response body without content-length (#1998) (b6447e9)
  • configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
  • deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
  • embedding: response type for base64 encoding format (#1554) (ef69801)
  • export AzureClientOptions (#1760) (511bf6d), closes #1735
  • export workload identity helpers from openai/auth (#2344) (af8f14f)
  • fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
  • format: restore formatting for generated SDK files (#2089) (6d69d4b)
  • harden runTools against inherited function names (#2333) (f4496d1)
  • honor defaultHeaders null for helper method header (#1857) (8eab09a)
  • include items for strict Zod v3 any arrays (#2357) (4c32089)
  • isolate Vercel ecosystem tests per request (#2359) (2831290)
  • keep streamed Responses output text linear and canonical (#2354) (6827a40)
  • lint: recognize Castiron-generated headers (#2124) (cf6237f)
  • lint: restore generated SDK lint rules (#2126) (6b8162c)
  • parse empty chat content when present (#2331) (53dd723)
  • parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
  • pass file batch helper options through (#1855) (05ce028)
  • preserve File-like metadata in toFile (#1883) (ba1a781)
  • preserve skill upload paths without buffering native files (#2303) (30b9c41)
  • preserve Skills upload file paths (#1856) (e75de97)
  • preserve zero retry-after-ms precedence (#2329) (b44644e)
  • prevent prototype event names from crashing SDK streams (#2315) (c014250)
  • prevent prototype manipulation in strict Structured Outputs schemas (#2341) (838de7e)
  • prevent prototype pollution in assistant stream deltas (#2280) (928fa2b)
  • realtime: allow overriding WebSocket connection URLs (#2308) (7407413), closes #2305
  • realtime: enforce Azure browser denial and redact all credentials (#2340) (a77861d)
  • realtime: prevent Azure API-key disclosure across WebSocket redirects (#2325) (d5a1a1e)
  • realtime: prevent remote error payloads from crashing clients (#2350) (896f021)
  • realtime: remove immutable model updates from public and Azure examples (#2327) (08bd80a)
  • reject unsupported proto Zod v3 object properties (#2352) (46a8ca0)
  • remove vulnerable extract-zip from browser tests (#2312) (567ad4f)
  • responses: reject with OpenAIError when the stream emits an error event (#2021) (a54014d)
  • responses: validate streaming event indices before array access (#2323) (13eaf1d)
  • security: bound untrusted AssistantStream delta array indices (#2326) (afdf5ef)
  • security: contain Bedrock credentials to the configured endpoint origin (#2342) (23f0575)
  • security: keep browser ecosystem API keys out of navigation URLs (#2353) (1029e82)
  • security: prevent Bedrock bearer credential disclosure across redirects (#2377) (bfcccad)
  • security: prevent global Array.prototype pollution in chat completion streams (#2318) (486e191)
  • security: prevent multipart upload content-type header injection (#2322) (1c0b9ca)
  • security: prevent process-wide prototype pollution via assistant stream snapshot IDs (#2316) (21a0653)
  • security: prevent prototype manipulation in streamed chat snapshots (#2335) (e81d766)
  • security: prevent streaming upload filename/header injection (#2363) (4ba4084)
  • streaming: eliminate quadratic EventStream FIFO draining (#2356) (57521a1)
  • streaming: eliminate quadratic SSE buffer copying (#2324) (ebdb296)
  • streaming: finish SSE streams immediately after [DONE] (#2317) (7722171)
  • streaming: handle mixed SSE line endings (#2309) (24d5ada)
  • streaming: isolate AssistantStream message and tool-call lifecycles (#2334) (178e85f)
  • streaming: make fragmented line decoding amortized linear (#2336) (f32e2df)
  • streaming: surface mid-stream errors when iterating buffered streams (#2047) (8cc6cac)
  • ws: prevent duplicate listener leaks in Node and browser adapters (#2347) (a032b85)
  • zod: preserve literal payloads when escaping schema references (#2351) (8f189f4)
  • zod: preserve null literals in Zod v3 JSON schemas (#2355) (ed5c5e6)
  • zod: prevent generated definition name collisions (#2346) (0844573)
  • zod: reject non-object Zod v3 strict schema roots (#2358) (cc7dbfa)

Chores

Documentation

  • api: describe response stream event unions (#2319) (3f0f688)
  • document all handwritten SDK surfaces (#2281) (d9c212a)
  • readme: fix links to relocated documentation (#2088) (a82e8de)

Build System

  • deps-dev: bump @swc/core from 1.15.40 to 1.15.47 (#2187) (f79329f)
  • deps-dev: bump jest and @types/jest (#2157) (55dd17b)
  • deps-dev: bump ws from 8.21.0 to 8.21.1 (#2155) (d0e67a9)
  • deps-dev: bump yargs from 17.7.2 to 18.1.0 (#2154) (c5f12d1)
  • deps: bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/ts-browser-webpack (#2069) (c6e9ba3)
  • deps: bump nanoid from 3.3.15 to 3.3.18 in /ecosystem-tests/vercel-edge (#2142) (7b986fc)
  • deps: bump next from 15.5.20 to 15.5.21 in /ecosystem-tests/vercel-edge (#2128) (3f8403a)
  • deps: bump next from 15.5.21 to 16.2.12 (#2156) (9387d40)
  • deps: bump undici from 7.28.0 to 7.29.0 in /ecosystem-tests/node-ts-cjs (#2070) (130b038)
  • deps: enforce an eight-day dependency cooldown (#2186) (c052204)
Assets 2
Loading