openai

Features

• api: add gpt-6.1-terra model identifier

Bug Fixes

• deps-dev: bump @cloudflare/workers-types from 5.20261011.1 to 5.20261018.1 in /ecosystem-tests/cloudflare-worker

• deps-dev: bump @types/node from 26.6.4 to 26.6.5

• deps-dev: bump fast-uri from 3.1.7 to 3.1.9 in /ecosystem-tests/ts-browser-webpack

• deps-dev: bump fast-uri from 3.1.7 to 3.1.9 in /ecosystem-tests/vercel-edge

• deps-dev: bump puppeteer from 25.13.0 to 25.14.0 in /ecosystem-tests/browser-direct-import

• deps-dev: bump puppeteer from 25.13.0 to 25.14.0 in /ecosystem-tests/ts-browser-webpack

• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/cloudflare-worker

• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-cjs

• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-cjs-web

• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-esm

• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-esm-auto

• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-esm-web

• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/vercel-edge

• deps-dev: bump vitest from 5.0.3 to 5.0.5

• deps-dev: bump wrangler from 4.149.0 to 4.151.1 in /ecosystem-tests/cloudflare-worker

• deps: bump undici from 7.30.0 to 7.30.1 in /ecosystem-tests/node-ts-cjs

Features

• api: add delegation controls and prompt cache lifetimes and scheduled automations via client.beta.agents.automations, including invocation endpoints and the automations agent-tool variant

• breaking

  api: expand Live Decision item and question types. Breaking change in a minor release. Live Decision item events now include messages and function/custom-tool calls and outputs. DecisionItemCreatedEvent.item and DecisionItemCreateEvent.item are unions, so callers that directly access item.content or item.role may no longer compile. For both event types, use if ('content' in event.item) before accessing message fields, and handle tool-item variants separately. Message items may omit type, so checking only item.type === 'message' can skip valid messages. This release also updates image-model documentation: gpt-image-1 was shut down on October 23, 2026; replace explicit selections with gpt-image-2.5-sunburst or gpt-image-2.5-flare. The documented default for Responses image-generation tools is now gpt-image-2; specify a supported model explicitly when you need a particular model.

Performance Improvements

• agents: reuse action checks between stream events

Features

• breaking

  api: Breaking change in a minor release. A Live response's Decisions question instructions can now be a string or an array of text, image, or JSON parts. Code such as question.instructions.trim() can fail when it receives an array; check typeof question.instructions === 'string' and handle the array case. Decisions request inputs also accept new message roles and tool-history items, so update code that assumes it knows every input type. DecisionInputMessage is now a union: code that extends or implements the old interface must use DecisionInputMessage.DecisionInputUserMessage instead. Existing string instructions and user-message inputs still work.

Bug Fixes

• deps-dev: bump follow-redirects from 1.16.0 to 1.16.1 in /ecosystem-tests/vercel-edge

• deps-dev: bump launch-editor from 2.14.1 to 2.14.2 in /ecosystem-tests/ts-browser-webpack

• deps: bump next from 15.5.27 to 15.5.28 in /ecosystem-tests/vercel-edge

Features

• api: add voice deletion

Bug Fixes

• agents: avoid repeated ancestor-path hashing

• api: avoid excessive work when redacting long log values

Features

• api: add 30-minute cache-write usage counts

• api: add compaction trigger IDs

• api: add custom voice consent management

Bug Fixes

• api: align request encoding and response parsing

• api: preserve large WebSocket messages and default compression off

• api: preserve multipart headers and clarify cache-write totals

• audio: use named DirectShow inputs on Windows

• deps-dev: bump @cloudflare/workers-types from 5.20261005.1 to 5.20261011.1 in /ecosystem-tests/cloudflare-worker

• deps-dev: bump @swc/core from 1.16.2 to 1.16.18

• deps-dev: bump publint from 0.3.24 to 0.3.25

• deps-dev: bump puppeteer from 25.12.0 to 25.13.0 in /ecosystem-tests/browser-direct-import

• deps-dev: bump puppeteer from 25.12.0 to 25.13.0 in /ecosystem-tests/ts-browser-webpack

• deps-dev: bump vercel from 56.2.1 to 56.5.0 in /ecosystem-tests/vercel-edge

• deps-dev: bump wrangler from 4.147.0 to 4.149.0 in /ecosystem-tests/cloudflare-worker

• deps-dev: bump ws and @types/ws

• Preserve Realtime and Translation WebSocket option overrides

• Preserve WebSocket lifecycle state when observers throw

• realtime: receive large websocket messages by default

• realtime: refresh factory URLs for each connection attempt

Features

• realtime: add opt-in bounded connection recovery

Features

• api: add degraded external storage status

Features

• api: add Decisions prompt caching options

• api: add prompt-based voice creation

• api: add response error diagnostics and model notices

• api: support audio fixture playback in Live sessions

• api: support Decisions in Live sessions

• api: support project API key scope updates

Bug Fixes

• api: declare Realtime response error messages

Features

• api: add regional processing residency options

Bug Fixes

• deps-dev: bump @cloudflare/workers-types from 5.20260927.1 to 5.20261005.1 in /ecosystem-tests/cloudflare-worker

• deps-dev: bump @types/node from 26.4.1 to 26.6.4

• deps-dev: bump @types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts-cjs

• deps-dev: bump @types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts-cjs-auto

• deps-dev: bump @types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts4.5-jest28

• deps-dev: bump oxfmt from 0.70.0 to 0.72.0

• deps-dev: bump oxlint from 1.82.0 to 1.87.0

• deps-dev: bump vitest from 5.0.1 to 5.0.3

• deps-dev: bump wrangler from 4.142.0 to 4.147.0 in /ecosystem-tests/cloudflare-worker

• deps: bump undici from 7.29.1 to 7.30.0 in /ecosystem-tests/node-ts-cjs

Features

• Add browser and computer toolsets (1/4)

• api: add beta session spending limits

• api: add billing_not_active session error code

• api: add OCI external-storage provider support

• api: add organization Decisions usage reporting

• api: add shida to named Live voices

• api: add vault updates and metadata filters

• api: align beta pagination limits and non-null parameters

• api: expose image tool error and moderation details

• api: support image URLs and detailed safety alert explanations

• api: support updating project API key expiry

Features

• api: add agent environment suspension and expiration

Bug Fixes

• deps: bump next from 15.5.25 to 15.5.27 in /ecosystem-tests/vercel-edge

• runners: preserve detailed token usage in totalUsage

Bug Fixes

• api: correct custom voice creation parameters

• deps-dev: bump @aws-sdk/credential-provider-node from 3.972.83 to 3.972.84

• deps-dev: bump @smithy/signature-v4 from 5.7.3 to 5.7.4

• deps-dev: bump jest from 30.5.1 to 30.5.2

• deps-dev: bump oxfmt from 0.67.0 to 0.70.0

• deps-dev: bump puppeteer from 25.11.0 to 25.12.0 in /ecosystem-tests/browser-direct-import

• deps-dev: bump puppeteer from 25.11.0 to 25.12.0 in /ecosystem-tests/ts-browser-webpack

• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/cloudflare-worker

• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-cjs

• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-cjs-web

• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm

• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm-auto

• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm-web

• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/vercel-edge

• deps-dev: bump yargs from 18.1.0 to 18.2.0

• deps: refresh development and ecosystem dependencies

• responses: parse structured text only in final message phases

• uploads: decode inferred URL filenames safely

Features

• Collect final output from beta Agents streams

• agents: [1/n] parse typed output from agent streams

• api: Add agent session trace listing

• beta: bind typed application functions to Agents tools

Bug Fixes

• api: allow original image detail in Chat Completions

• api: correct the eval run cancellation endpoint

• deps-dev: bump @swc/core from 1.16.1 to 1.16.2

• deps-dev: bump puppeteer from 25.10.0 to 25.11.0 in /ecosystem-tests/browser-direct-import

• deps-dev: bump puppeteer from 25.10.0 to 25.11.0 in /ecosystem-tests/ts-browser-webpack

• deps-dev: bump webpack from 5.110.3 to 5.111.1 in /ecosystem-tests/ts-browser-webpack

• deps-dev: bump wrangler from 4.131.1 to 4.135.0 in /ecosystem-tests/cloudflare-worker

• deps-dev: update Vercel CLI to remove legacy proxy dependencies

• deps-dev: upgrade Vitest and migrate performance benchmarks

• responses: refresh credentials on WebSocket reconnects

• responses: reserve lane IDs across WebSocket session replacements

Features

• api: add Agents credential and session options

• api: add Cyber access programs to Responses

• api: add GPT-6.1 Sol model identifier

• api: add Realtime Translation client secret creation

• realtime: add dedicated Node translation WebSocket

• responses: add opt-in WebSocket incremental output snapshots

Bug Fixes

• client: preserve base URL queries when joining relative endpoints

• deps-dev: bump @arethetypeswrong/cli from 0.18.3 to 0.18.5

• deps-dev: bump @aws-sdk/credential-provider-node from 3.972.81 to 3.972.83

• deps-dev: bump @cloudflare/workers-types from 5.20260906.1 to 5.20260911.1 in /ecosystem-tests/cloudflare-worker

• deps-dev: bump publint from 0.3.23 to 0.3.24

• deps-dev: bump ultracite from 7.11.0 to 7.11.1

• deps-dev: bump wrangler from 4.129.0 to 4.131.1 in /ecosystem-tests/cloudflare-worker

• live: prevent hangs on fractional transcript grouping deadlines

• live: prevent replay of delivery-uncertain queued writes

• responses: preserve supported streamed logprobs and provisional metadata

Features

• api: add GCP external storage support

• api: add GPT-Rosalind research model

Features

• api: add session environment reset events

Bug Fixes

• api: preserve model choices and improve request handling

Features

• api: add environment-variable vault credentials

• api: add external storage configuration management

• api: add safety case retrieval

• api: add safety warning and deactivation webhook events

• api: add SIP media security to incoming call events

Bug Fixes

• api: Preserve request options in legacy GET calls

Features

• api: add agent session model settings

• api: add audio-mini model choices

• api: add managed Responses WebSocket sessions

• api: add prompt-cache prewarming

Bug Fixes

• api: validate WebSocket results and preserve header defaults

Features

• api: add compaction progress events

Bug Fixes

• Preserve chat runner abort reasons

• realtime: preserve native WebSocket error causes

• responses: reject function-based API keys in WebSocket constructors

• runners: reject unfinished turns in streaming runTools

• streaming: emit terminal SSE events missing a trailing blank line

• zod: omit impossible optional branch in strict schemas

Features

• websocket: add per-iterator incoming event limits

Bug Fixes

• api: handle malformed WebSocket events and improve buffering

• Bound fallback abort subscriptions with weak lifetimes

• deps-dev: bump @cloudflare/workers-types from 5.20260830.1 to 5.20260906.1 in /ecosystem-tests/cloudflare-worker

• deps-dev: bump @types/node from 26.2.0 to 26.4.1

• deps-dev: bump oxfmt from 0.62.0 to 0.66.0

• deps-dev: bump oxlint from 1.80.0 to 1.81.0

• deps-dev: bump puppeteer from 25.9.0 to 25.10.0 in /ecosystem-tests/browser-direct-import

• deps-dev: bump puppeteer from 25.9.0 to 25.10.0 in /ecosystem-tests/ts-browser-webpack

• deps-dev: bump webpack from 5.110.2 to 5.110.3 in /ecosystem-tests/ts-browser-webpack

• deps-dev: bump wrangler from 4.127.1 to 4.129.0 in /ecosystem-tests/cloudflare-worker

• deps: bump undici from 7.29.0 to 7.29.1 in /ecosystem-tests/node-ts-cjs

• Keep callback credentials local to each HTTP request

• live: avoid repeated acknowledgment normalization

• live: trim transcript acknowledgment suffixes in linear time

• responses: safely format WebSocket error messages

• websocket: discard unread events when an iterator returns

Includes the GPT Image 2.5 support from 7.12.0, which was not published to npm.

Features

• api: add GPT Image 2.5 models and image options

Features

• api: add gpt-6-astra and related features

Features

• api: update usage APIs and documentation

Bug Fixes

• api: prevent Responses WebSockets from following redirects

• Load CommonJS under browser export conditions

• Restore monthly Node version review

• Support Jest 28 CommonJS package imports

Features

• api: add compute_units to Responses and Chat Completions usage

• api: add default WebSocket User-Agent and audit log events

Bug Fixes

• auth: clamp the workload-identity refresh buffer to the token lifetime

• auth: secure first-class X.509 workload credentials

• deps: harden dependency and release boundaries

• events: settle WebSocket waiters when listeners throw

• Restore native browser ESM imports

• uploads: detect multipart bodies from own properties only

Features

• api: Add obfuscation field to ChatCompletionChunk

• api: Add project residency and usage quantity_unit fields

• api: support backend-mediated Realtime WebRTC calls

• auth: add pinned X.509 workload token exchange

• auth: attest cross-module X.509 transport capabilities

• auth: harden X.509 token lifecycle and tenant isolation

• auth: integrate attested X.509 workload identity into clients

• Support named data-residency endpoints

Bug Fixes

• Avoid quadratic comparisons when accumulating long text

• assistants: reject run-step identity hijacking before tool callbacks

• audio: preserve recording outcomes during cancellation and cleanup

• auth: honor an explicit zero GCP metadata timeout

• auth: sanitize malformed Azure IMDS token responses

• auth: sanitize malformed workload OAuth token responses

• Avoid double-counting logprobs in streamed chat completions

• bedrock: honor cancellation during bearer credential resolution

• Drain tee stream queues in linear time

• polling: honor cancellation during polling delays

• Preserve large streaming responses

• Preserve multipart upload array order

• Publish Castiron checks for behind-main pull requests

• Publish Castiron checks for external-fork pull requests

• security: abort streaming examples when clients disconnect

• security: authenticate Cloudflare tests and restrict streaming proxies

• security: authenticate Vercel ecosystem APIs and clean up uploaded files

• security: bound SDK event streams and validate streamed item identities

• security: bound SSE frames and NDJSON lines before buffering

• security: close rejected Azure managed-identity response streams

• security: harden Bedrock regions, query merges, and upload errors

• security: harden Realtime WebSocket origins, worker guards, and Azure credentials

• security: preserve chat structured response-format integrity

• security: prevent AssistantStream deltas leaking sensitive data

• security: prevent streaming upload filename path disclosure

• security: prevent structured-output format downgrade

• security: redact built-in structured JSON parse errors

• security: redact chat completion finalization snapshots

• security: redact GCP metadata authentication error bodies

• security: redact invalid Bedrock bearer credentials

• security: redact invalid workload identity access tokens

• security: redact malformed NDJSON stream diagnostics

• security: redact malformed Realtime WebSocket error causes

• security: redact malformed SSE diagnostic payloads

• security: redact sensitive assistant delta diagnostics

• security: redact unsupported Responses stream event payloads

• security: reject malformed Realtime WebSocket event frames

• security: require an exact SSE completion sentinel

• security: require OIDC for npm publishing

• security: respect configured logger for Assistants stream errors

• security: restrict live CI credentials to protected main

• security: scope Cloudflare ecosystem API key files

• security: secure Next.js Edge streaming example requests

• security: stop delayed and additional tool callbacks after cancellation

• security: stop retaining sensitive assistant stream events

• Settle concurrent stream event waiters in linear time

• Settle WebSocket event waiters in linear time

• standard-schema: preserve validator bindings across helpers

• streaming: reject named SSE provider error events

• uploads: preserve Blob files and multipart media types

• webhooks: bound signature verification work

• ws: block custom credential headers on redirects

• zod: support only provably JSON-native structured outputs

Features

• Add Bedrock Runtime endpoint support (SDK-290)

• api: add new Daybreak and gpt-5.6-cyber model identifiers

• api: add new Daybreak and gpt-5.6-cyber model identifiers

• api: Add ServiceTier and ImageDetail types

• api: add WebSocket stream IDs

• api: add workload identity access token issued event

• deprecated

  api: deprecate Sora video APIs

• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events

Bug Fixes

• api: clarify audio upload metadata requirements

• audio: prevent microphone leaks and playback pipe deadlocks

• audio: reject ffplay spawn errors

• auth: reject redirects during workload identity token exchange

• auth: reject unsafe workload-identity token expirations

• Avoid TypeError in toFile for Responses without a URL

• Await webhook verification in README examples

• azure: honor explicit browser denial for Entra token providers

• azure: preserve model-to-deployment mapping for images.edit

• azure: prevent API-key disclosure across HTTP redirects

• security

  azure: prevent deployment path traversal

• bedrock: safely sign inherited query parameter names

• chat: support custom tool calls in parser and ChatCompletionStream

• client: handle empty JSON response body without content-length

• Configure Bash for pnpm scripts on Windows

• security

  deps: remediate Dependabot and fixture vulnerabilities

• embedding: response type for base64 encoding format

• Export AzureClientOptions (#1760) (511bf6d), closes #1735

• Export workload identity helpers from openai/auth

• Fail ecosystem CI when live credentials are missing

• format: restore formatting for generated SDK files

• Harden runTools against inherited function names

• Honor defaultHeaders null for helper method header

• Include items for strict Zod v3 any arrays

• Isolate Vercel ecosystem tests per request

• Keep streamed Responses output text linear and canonical

• lint: recognize Castiron-generated headers

• lint: restore generated SDK lint rules

• Parse empty chat content when present

• parser: recognize raw json_schema response format in auto-parsing checks

• Pass file batch helper options through

• Preserve File-like metadata in toFile

• Preserve skill upload paths without buffering native files

• Preserve Skills upload file paths

• Preserve zero retry-after-ms precedence

• Prevent prototype event names from crashing SDK streams

• Prevent prototype manipulation in strict Structured Outputs schemas

• security

  Prevent prototype pollution in assistant stream deltas

• realtime: allow overriding WebSocket connection URLs (#2308) (7407413), closes #2305

• realtime: enforce Azure browser denial and redact all credentials

• realtime: prevent Azure API-key disclosure across WebSocket redirects

• realtime: prevent remote error payloads from crashing clients

• realtime: remove immutable model updates from public and Azure examples

• Reject unsupported proto Zod v3 object properties

• Remove vulnerable extract-zip from browser tests

• responses: reject with OpenAIError when the stream emits an error event

• responses: validate streaming event indices before array access

• security: bound untrusted AssistantStream delta array indices

• security: contain Bedrock credentials to the configured endpoint origin

• security: keep browser ecosystem API keys out of navigation URLs

• security: prevent Bedrock bearer credential disclosure across redirects

• security

  security: prevent global Array.prototype pollution in chat completion streams

• security

  security: prevent multipart upload content-type header injection

• security

  security: prevent process-wide prototype pollution via assistant stream snapshot IDs

• security: prevent prototype manipulation in streamed chat snapshots

• security

  security: prevent streaming upload filename/header injection

• streaming: eliminate quadratic EventStream FIFO draining

• streaming: eliminate quadratic SSE buffer copying

• streaming: finish SSE streams immediately after [DONE]

• streaming: handle mixed SSE line endings

• streaming: isolate AssistantStream message and tool-call lifecycles

• streaming: make fragmented line decoding amortized linear

• streaming: surface mid-stream errors when iterating buffered streams

• ws: prevent duplicate listener leaks in Node and browser adapters

• zod: preserve literal payloads when escaping schema references

• zod: preserve null literals in Zod v3 JSON schemas

• zod: prevent generated definition name collisions

• zod: reject non-object Zod v3 strict schema roots

Features

• api: Add gpt-5.5 model and tool metadata fields

Bug Fixes

• Defer release PR output parsing

Features

• api: content provenance checks

Features

• api: transcription model updates

Breaking changes

• breaking

  Require Node.js 22 and codify version support

Features

• Require Node.js 22 and codify version support