Comparing changes

# Summary Rye is no longer maintained. Moving to its [maintained successor, uv](https://rye.astral.sh/guide/uv/). - Keep the familiar `scripts/*` commands and both Pydantic compatibility lanes, while making `uv.lock` the source of truth. - Build releases with a small, hash-checked dependency set. Preserve the separate, upload-only PyPI Trusted Publishing job. - Give routine Python and GitHub Actions updates an eight-day cooldown. Keep Dependabot security updates exempt, with a narrow, reviewed uv exception process for urgent fixes. - Reduce the development graph from 88 packages to 79. The default runtime graph stays at 15 and all runtime extras stay at 37; existing patched networking dependencies are retained. There is no SDK API or Python-support change. Pyright's installation path and unrelated dependency upgrades remain separate follow-ups.

# Summary This is part of a series to reduce the SDK’s dependency surface where a small, purpose-built alternative is sufficient. - Replace the general-purpose JSON Schema dependency with explicit checks for our small, checked-in Bedrock authentication fixture. - Keep the shared schema as the contract, and fail if it changes beyond what the manual checks cover. - Remove four development packages (`jsonschema`, `jsonschema-specifications`, `referencing`, and `rpds-py`), reducing the development dependency graph from 79 to 75 distributions. Runtime dependencies are unchanged. ## Stack - #3653 (merged) - #3654 👈 this PR - #3655 - #3656

# Summary This is part of a series to reduce the SDK’s dependency surface where a small, purpose-built alternative is sufficient. - Replace `hatch-fancy-pypi-readme` with a small repository-owned Hatch metadata hook for our existing relative-link rewrite. - Preserve the README published in package metadata, including when a wheel is built from the source distribution. - Reduce the isolated build dependency graph from seven to six distributions across supported Python versions. Runtime and development dependencies are unchanged. ## Stack - #3653 (merged) - #3654 (merged) - #3655 👈 this PR - #3656

# Summary This is part of a series to reduce the SDK’s dependency surface where a small, purpose-built alternative is sufficient. - Replace `distro` with Python’s standard OS-release lookup for the diagnostic platform header. - Preserve mobile detection, recognize FreeBSD and OpenBSD directly, and fall back to `Linux` if OS-release information is unavailable. - Matching `distro`’s exact behavior is explicitly a non-goal. This header only needs to be close enough for our analytics purposes; we prefer removing the dependency over reproducing its full distribution-detection and fallback behavior. - Remove one runtime dependency: the default graph goes from 15 to 14 distributions, and the all-extras graph from 37 to 36. No remaining dependency versions change. ## Stack - #3653 (merged) - #3654 (merged) - #3655 (merged) - #3656 👈 this PR

- [x] I understand that this repository is auto-generated and my pull request may not be merged ## Changes being requested ## Additional context & links

# Summary This is part of a series to reduce the SDK's dependency surface and make contributor tooling more predictable. - Manage Microsoft's Pyright package with an exact version and a checked-in pnpm lockfile, keeping the existing type-checker version. - Remove the Python Pyright wrapper and its `nodeenv` dependency. Lint runs the repository-local tool and fails with setup instructions when it is missing. - Make bootstrap and CI install the pinned toolchain explicitly, with frozen dependencies, an eight-day update policy, and lifecycle scripts disabled. Packages without publication dates are rejected too. - Keep Node tooling out of the SDK runtime and wheel build requirements. This supersedes the Pyright/toolchain portion of #3116 on top of the merged uv migration. Locking the existing Steady mock-server invocation is a separate follow-up.

# Summary This is part of a series to reduce the SDK's dependency surface and make contributor tooling more predictable. It builds on the merged #3678. - Lock the existing Steady 0.22.1 release and its platform packages in the repository's pnpm lockfile. - Keep `./scripts/bootstrap` followed by `./scripts/test` working, including automatic mock-server startup, an existing server, `TEST_API_BASE_URL`, and both Pydantic test lanes. - Run only the locally installed mock server. Missing tooling produces setup instructions instead of an on-demand npm download. This completes the mock-tooling portion of #3116 using the current uv/pnpm setup.

# Summary This continues our work to reduce the SDK’s dependency surface and keep dependencies on releases with published security fixes. - Update jiter and exclude affected Pydantic releases while retaining Pydantic 1.x and 2.x support. - Retain security floors for the development-only Azure authentication and test updates already merged in #3676, and update the isolated wheel-test pins. Bump Hatchling to 1.27 so the patched Pygments release can still build from source. - Keep the eight-day policy and existing package count unchanged. Add an offline regression test and contributor guidance to prevent private registry URLs from entering the public lockfile. The development lockfile bumps landed in #3676 while this PR was in flight. After merging current main, only jiter and Hatchling change versions here; none of the newly landed fixes is downgraded. The root lock has 74 package names and 76 exact versions, with no active reviewed Python advisory matches. Separate native-dependency findings in Pydantic remain follow-up work pending a compatible stable upstream release. <details> <summary>Published advisories covered by the updates and retained security floors</summary> - Pydantic’s supported version range: [GHSA-mr82-8j83-vxmv](GHSA-mr82-8j83-vxmv). - jiter’s PyO3 update: [GHSA-36hh-v3qg-5jq4](GHSA-36hh-v3qg-5jq4), [GHSA-chgr-c6px-7xpp](GHSA-chgr-c6px-7xpp). - Azure Core and Requests: [GHSA-jm66-cg57-jjv5](GHSA-jm66-cg57-jjv5), [GHSA-gc5v-m9x4-r6x2](GHSA-gc5v-m9x4-r6x2). - PyJWT: [GHSA-993g-76c3-p5m4](GHSA-993g-76c3-p5m4), [GHSA-752w-5fwx-jx9f](GHSA-752w-5fwx-jx9f), [GHSA-w7vc-732c-9m39](GHSA-w7vc-732c-9m39), [GHSA-xgmm-8j9v-c9wx](GHSA-xgmm-8j9v-c9wx), [GHSA-jq35-7prp-9v3f](GHSA-jq35-7prp-9v3f), [GHSA-fhv5-28vv-h8m8](GHSA-fhv5-28vv-h8m8). - Cryptography: [GHSA-m2h6-j472-rp4c](GHSA-m2h6-j472-rp4c), [GHSA-jwv3-5hgf-82ww](GHSA-jwv3-5hgf-82ww), [GHSA-g6cj-pr64-35w5](GHSA-g6cj-pr64-35w5), [GHSA-537c-gmf6-5ccf](GHSA-537c-gmf6-5ccf), [GHSA-p423-j2cm-9vmq](GHSA-p423-j2cm-9vmq), [GHSA-m959-cc7f-wv43](GHSA-m959-cc7f-wv43), [GHSA-r6ph-v2qm-q3c2](GHSA-r6ph-v2qm-q3c2). - pytest and Pygments: [GHSA-6w46-j5rx-g56g](GHSA-6w46-j5rx-g56g), [GHSA-5239-wwwm-4pmq](GHSA-5239-wwwm-4pmq). </details>

Automated Release PR --- ## [3.3.1](v3.3.0...v3.3.1) (2026-08-19) ### Bug Fixes * **deps:** update dependencies with published security fixes ([#3680](#3680)) ([53aa4fc](53aa4fc)) ### Chores * **build:** migrate to uv ([#3653](#3653)) ([b37e85d](b37e85d)) * **deps:** remove jsonschema and unused fixture-validation dependencies ([0dfdfdd](0dfdfdd)) * lock the repository Pyright toolchain ([#3678](#3678)) ([3079be2](3079be2)) * run the mock server from locked local tooling ([#3679](#3679)) ([370fcc6](370fcc6)) ### Refactors * **deps:** use the standard library for platform detection ([d5b0065](d5b0065)) ### Build System * replace the external README metadata hook ([e673ca8](e673ca8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: openai-sdks[bot] <284451331+openai-sdks[bot]@users.noreply.github.com>

- [x] I understand that this repository is auto-generated and my pull request may not be merged ## Changes being requested - Standardize `SECURITY.md` on the shared public SDK policy: **Reporting a vulnerability**, **What to include**, and **Coordinated disclosure**. - Use the exact shared warnings against public GitHub issues/pull requests/discussions and including live credentials, API keys, customer data, or unredacted sensitive logs. - Preserve Python's existing coordinated-disclosure URL, `disclosure@openai.com` contact, authentication-header/private-key redaction, and respectful disclosure commitment. - Document the official `openai` PyPI package, published source distributions/wheels, and relevant package version, Python version, operating system, impact, and sanitized reproduction details. ## Verification - CommonMark parsing and exact assertions for the three canonical headings, three shared report-detail bullets, and all three verbatim shared warning/disclosure sentences. - Existing disclosure endpoint returned HTTP 200; disclosure URL/contact were preserved, and the PyPI URL matches the existing README and actual `sdist`/wheel build targets. - Credential-like-literal, line-ending, trailing-whitespace, and Markdown-link validation. - `python scripts/check-python-version-policy.py` - `git diff origin/main...HEAD --check` ## Additional context & links Only the existing root `SECURITY.md` is changed; no private-reporting settings, workflows, package code, or unrelated policies are modified.

Azure requests that select a deployment through `model` should handle its name consistently with other SDK path parameters. Use the existing path encoder when constructing the deployment URL, preserving the selected operation and normal deployment names. Fixed-deployment clients and non-deployment endpoints retain their existing routing behavior. Includes focused synchronous and asynchronous regression coverage.

Troubleshooting logs should help identify request failures without retaining the data applications send or receive. This change keeps request, retry, status, and WebSocket size information while limiting SDK diagnostics to metadata. Request delivery, response parsing, and error handling are unchanged. The SDK logging setting now controls SDK logs without changing application-configured HTTP transport logging.

## Summary - Generate each upload fixture pair in a fresh private temporary directory, refuse existing output files, and clean up incomplete generation. - Print the generated directory for explicit use by the upload example; retain disk and in-memory modes and document caller cleanup. - Add a bounded byte-count option and focused local regression tests. No SDK runtime, API, dependency, Python-version, or generated-code changes; no Castiron follow-up is needed. ## Validation - 20 focused tests passed using fake/local fixtures and a mocked upload client. - Shell syntax, Python compilation, repository-wide Ruff, focused formatting, mypy, and repository-pinned Pyright passed. - Independent read-only Codex review round 1 was clean (no actionable P0–P2 findings). - No live-service probes or full-size fixture generation. This is an independent PR against public main. SDK CODEOWNER review requested for the example file-handling change.

## Summary Keep queued and in-flight messages charged to the existing byte limit until each send succeeds. Serialize overlapping flushes, preserve FIFO restoration on errors or cancellation, and keep concurrent drains from releasing pending-message capacity. The change is confined to the shared SendQueue helper and focused queue/reconnect tests. It preserves ordinary enqueue/backpressure behavior and does not change generated connection APIs, logging, dependencies, or Python support. This PR targets public main independently; no stacking dependency. ## Validation - 34 focused synchronous/asynchronous queue and mocked reconnect tests passed, covering all six GA/beta Responses and Realtime connection classes. - Repository-wide Ruff, mypy (1,562 source files), and pinned Pyright passed; changed-file formatting and git diff checks passed. - Separate read-only Codex review round 1 was clean (no actionable P0–P2 findings), including 20 repeated focused-suite runs. - Local environment used the exact committed frozen lockfile because the public-main lock freshness check requested an update; no dependency files changed. ## Generation follow-up SDK CODEOWNER review requested. Carry the shared-helper accounting behavior and regression coverage into the corresponding Castiron source/template so regeneration preserves it; no generated resource patch is needed here.

## Summary - Share an amortized-linear incremental SSE line framer between synchronous and asynchronous decoding. - Process complete lines as they arrive so comments and ignored fields are discarded before the event finishes. - Preserve historical unlimited line/event sizes, CR/LF/CRLF framing, UTF-8 chunking, and response cleanup. No new size-limit API, dependencies, exported client APIs, or `[DONE]` drain changes. This removes quadratic prefix copying and unnecessary whole-frame retention. It does not impose a memory bound on arbitrarily large data events or unfinished lines. ## Validation - 62 focused streaming/framing tests passed, including synchronous and asynchronous events larger than 64 MiB, fragmented and unterminated input, all newline forms, transport interruption, and cancellation. - Ruff, targeted Mypy, targeted Pyright, and `git diff --check` passed. - Final separate local review (round 3 of 3) was clean at `d3667578e1a4e8da9d1962bfd403d98f4a0f945c`; its exhaustive short-input CR/LF fragmentation matrix also passed. Independent PR against public main. Please confirm this handwritten shared-runtime patch is preserved in the next Castiron Python candidate; no schema or generation-metadata change is needed.

## Summary - Resolve one Azure authentication mode consistently for synchronous and asynchronous clients. Explicit credentials take precedence over credential environment variables; conflicting explicit modes raise the existing `MutuallyExclusiveAuthError`. - Preserve environment-only AD-token precedence, client-copy behavior, and callable API-key refresh. - Keep module-level explicit Azure configuration separate from environment fallback, including import-time configuration and automatic Azure selection. - Add focused regressions for explicit and ambient credential selection, client copies, HTTP and Realtime configuration, and callable keys. No dependency or exported client API changes. This is independent of the Azure redirect-transport changes in #3684.

## Summary Introduce an optional obfuscation field on ChatCompletionChunk to support size-normalized streamed chunks. The new field is optional and omitted when stream_options.include_obfuscation is false. ## Changes - Add ChatCompletionChunk.obfuscation: Optional[str]. This optional string may be included on streamed moderation chunks to normalize chunk sizes; it is returned by default and omitted when stream_options.include_obfuscation is false. Co-authored-by: apcha-oai <228803254+apcha-oai@users.noreply.github.com>

Navigation Menu

Uh oh!

Comparing changes

Open a pull request

Commits on Aug 19, 2026

This comparison is taking too long to generate.

Uh oh!