fix(deps): update dependencies with published security fixes - #3680
Merged
Conversation
apcha-oai
marked this pull request as ready for review
August 19, 2026 15:49
Contributor
OkTest Summary❌ Failed for Python SDK PR #3680. SDK merge ( |
jbeckwith-oai
approved these changes
Aug 19, 2026
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
Contributor
There was a problem hiding this comment.
Reviewed the complete security dependency update against published advisory ranges and fixed versions. Pydantic v1/v2 and Python 3.10-3.14 compatibility remain intact; jiter, Azure authentication, cryptography, HTTP, and test dependency fixes are reflected consistently in published constraints and the locked graph. Build requirements, wheel validation, public artifact URLs and hashes, and the eight-day update policy remain sound. All checks pass. No actionable findings.
apcha-oai
enabled auto-merge
August 19, 2026 16:17
Merged
pull Bot
pushed a commit
to tooniez/openai-python
that referenced
this pull request
Aug 19, 2026
Automated Release PR --- ## [3.3.1](openai/openai-python@v3.3.0...v3.3.1) (2026-08-19) ### Bug Fixes * **deps:** update dependencies with published security fixes ([openai#3680](openai#3680)) ([53aa4fc](openai@53aa4fc)) ### Chores * **build:** migrate to uv ([openai#3653](openai#3653)) ([b37e85d](openai@b37e85d)) * **deps:** remove jsonschema and unused fixture-validation dependencies ([0dfdfdd](openai@0dfdfdd)) * lock the repository Pyright toolchain ([openai#3678](openai#3678)) ([3079be2](openai@3079be2)) * run the mock server from locked local tooling ([openai#3679](openai#3679)) ([370fcc6](openai@370fcc6)) ### Refactors * **deps:** use the standard library for platform detection ([d5b0065](openai@d5b0065)) ### Build System * replace the external README metadata hook ([e673ca8](openai@e673ca8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: openai-sdks[bot] <284451331+openai-sdks[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This continues our work to reduce the SDK’s dependency surface and keep dependencies on releases with published security fixes.
The development lockfile bumps landed in #3676 while this PR was in flight. After merging current main, only jiter and Hatchling change versions here; none of the newly landed fixes is downgraded. The root lock has 74 package names and 76 exact versions, with no active reviewed Python advisory matches. Separate native-dependency findings in Pydantic remain follow-up work pending a compatible stable upstream release.
Published advisories covered by the updates and retained security floors