openai

Features

• api: Add obfuscation field to ChatCompletionChunk

• api: Add project residency and usage quantity_unit fields

• api: support backend-mediated Realtime WebRTC calls

• auth: add pinned X.509 workload token exchange

• auth: attest cross-module X.509 transport capabilities

• auth: harden X.509 token lifecycle and tenant isolation

• auth: integrate attested X.509 workload identity into clients

• Support named data-residency endpoints

Bug Fixes

• Avoid quadratic comparisons when accumulating long text

• assistants: reject run-step identity hijacking before tool callbacks

• audio: preserve recording outcomes during cancellation and cleanup

• auth: honor an explicit zero GCP metadata timeout

• auth: sanitize malformed Azure IMDS token responses

• auth: sanitize malformed workload OAuth token responses

• Avoid double-counting logprobs in streamed chat completions

• bedrock: honor cancellation during bearer credential resolution

• Drain tee stream queues in linear time

• polling: honor cancellation during polling delays

• Preserve large streaming responses

• Preserve multipart upload array order

• Publish Castiron checks for behind-main pull requests

• Publish Castiron checks for external-fork pull requests

• security: abort streaming examples when clients disconnect

• security: authenticate Cloudflare tests and restrict streaming proxies

• security: authenticate Vercel ecosystem APIs and clean up uploaded files

• security: bound SDK event streams and validate streamed item identities

• security: bound SSE frames and NDJSON lines before buffering

• security: close rejected Azure managed-identity response streams

• security: harden Bedrock regions, query merges, and upload errors

• security: harden Realtime WebSocket origins, worker guards, and Azure credentials

• security: preserve chat structured response-format integrity

• security: prevent AssistantStream deltas leaking sensitive data

• security: prevent streaming upload filename path disclosure

• security: prevent structured-output format downgrade

• security: redact built-in structured JSON parse errors

• security: redact chat completion finalization snapshots

• security: redact GCP metadata authentication error bodies

• security: redact invalid Bedrock bearer credentials

• security: redact invalid workload identity access tokens

• security: redact malformed NDJSON stream diagnostics

• security: redact malformed Realtime WebSocket error causes

• security: redact malformed SSE diagnostic payloads

• security: redact sensitive assistant delta diagnostics

• security: redact unsupported Responses stream event payloads

• security: reject malformed Realtime WebSocket event frames

• security: require an exact SSE completion sentinel

• security: require OIDC for npm publishing

• security: respect configured logger for Assistants stream errors

• security: restrict live CI credentials to protected main

• security: scope Cloudflare ecosystem API key files

• security: secure Next.js Edge streaming example requests

• security: stop delayed and additional tool callbacks after cancellation

• security: stop retaining sensitive assistant stream events

• Settle concurrent stream event waiters in linear time

• Settle WebSocket event waiters in linear time

• standard-schema: preserve validator bindings across helpers

• streaming: reject named SSE provider error events

• uploads: preserve Blob files and multipart media types

• webhooks: bound signature verification work

• ws: block custom credential headers on redirects

• zod: support only provably JSON-native structured outputs