chore(deps): update dependency openai to v7

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
openai	^6.45.0 → ^7.0.0

---

Release Notes

openai/openai-node (openai)

v7.10.0

Compare Source

Features

• api: add gpt-6-astra and related features (#​2582) (94ecdc4)

Documentation

• add canonical SDK security model (#​2566) (e6a7468)

v7.9.0

Compare Source

Features

• api: update usage APIs and documentation (#​2565) (4908505)

Bug Fixes

• api: prevent Responses WebSockets from following redirects (#​2513) (0a4fb1b)
• load CommonJS under browser export conditions (#​2507) (222f3d7)
• restore monthly Node version review (#​2553) (15dc890)
• support Jest 28 CommonJS package imports (#​2511) (eea2292)

Chores

• deps-dev: bump browserslist to 4.28.7 across ecosystem tests (#​2554) (a408e0b)
• raise custom-code budget to 4,000 lines (#​2562) (82c5b2d)

v7.8.0

Compare Source

Features

• api: add compute_units to Responses and Chat Completions usage (#​2505) (f9b1313)
• api: add default WebSocket User-Agent and audit log events (#​2504) (9b2f089)

Bug Fixes

• auth: clamp the workload-identity refresh buffer to the token lifetime (#​2490) (76b73a9)
• auth: secure first-class X.509 workload credentials (#​2479) (1b36c19)
• deps: harden dependency and release boundaries (#​2484) (b21ff45)
• events: settle WebSocket waiters when listeners throw (#​2491) (b5a13a7)
• restore native browser ESM imports (#​2495) (c8cab1e)
• uploads: detect multipart bodies from own properties only (#​2492) (559ffc8)

v7.7.0

Compare Source

Features

• api: make function call output call IDs optional (#​2488) (b932ae6)

Bug Fixes

• streaming: honor cancellation while decoding SSE responses (#​2487) (ababe12)

v7.6.0

Compare Source

Features

• api: Add obfuscation field to ChatCompletionChunk (#​2423) (39afa3a)
• api: Add project residency and usage quantity_unit fields (#​2461) (26d8158)
• api: support backend-mediated Realtime WebRTC calls (#​2469) (0d12ca8)
• auth: add pinned X.509 workload token exchange (#​2470) (9dd8648)
• auth: attest cross-module X.509 transport capabilities (#​2471) (c6769fa)
• auth: harden X.509 token lifecycle and tenant isolation (#​2473) (6992683)
• auth: integrate attested X.509 workload identity into clients (#​2472) (ee5229b)
• support named data-residency endpoints (#​2393) (62d98dd)

Bug Fixes

• [responses] Avoid quadratic comparisons when accumulating long text (#​2434) (95628ce)
• assistants: reject run-step identity hijacking before tool callbacks (#​2476) (63b1c75)
• audio: preserve recording outcomes during cancellation and cleanup (#​2482) (dafcac4)
• auth: honor an explicit zero GCP metadata timeout (#​2481) (7a9dec8)
• auth: sanitize malformed Azure IMDS token responses (#​2427) (bbfb792)
• auth: sanitize malformed workload OAuth token responses (#​2468) (cd5b2d8)
• avoid double-counting logprobs in streamed chat completions (#​2444) (ddf9922)
• bedrock: honor cancellation during bearer credential resolution (#​2478) (2dac2f4)
• drain tee stream queues in linear time (#​2379) (1f3ce07)
• polling: honor cancellation during polling delays (#​2477) (520d604)
• preserve large streaming responses (#​2433) (4e588c2)
• preserve multipart upload array order (#​2380) (f1a2b61)
• publish Castiron checks for behind-main pull requests (#​2486) (662bb37)
• publish Castiron checks for external-fork pull requests (#​2464) (a90581e)
• security: abort streaming examples when clients disconnect (#​2426) (b32a25b)
• security: authenticate Cloudflare tests and restrict streaming proxies (#​2413) (9286fdb)
• security: authenticate Vercel ecosystem APIs and clean up uploaded files (#​2412) (d58608a)
• security: bound SDK event streams and validate streamed item identities (#​2415) (7df29a9)
• security: bound SSE frames and NDJSON lines before buffering (#​2411) (0e250a4)
• security: close rejected Azure managed-identity response streams (#​2416) (387bbc8)
• security: harden Bedrock regions, query merges, and upload errors (#​2410) (ce45d0d)
• security: harden Realtime WebSocket origins, worker guards, and Azure credentials (#​2414) (5533f73)
• security: preserve chat structured response-format integrity (#​2402) (e69df93)
• security: prevent AssistantStream deltas leaking sensitive data (#​2392) (17cf54c)
• security: prevent streaming upload filename path disclosure (#​2386) (c88a024)
• security: prevent structured-output format downgrade (#​2394) (dd945e6)
• security: redact built-in structured JSON parse errors (#​2418) (a0d68cc)
• security: redact chat completion finalization snapshots (#​2400) (fb5d8e7)
• security: redact GCP metadata authentication error bodies (#​2399) (322840c)
• security: redact invalid Bedrock bearer credentials (#​2419) (39c06d1)
• security: redact invalid workload identity access tokens (#​2425) (0d28da3)
• security: redact malformed NDJSON stream diagnostics (#​2420) (dcc705c)
• security: redact malformed Realtime WebSocket error causes (#​2408) (e7a1a44)
• security: redact malformed SSE diagnostic payloads (#​2403) (272a2cc)
• security: redact sensitive assistant delta diagnostics (#​2406) (b130b83)
• security: redact unsupported Responses stream event payloads (#​2395) (32b2953)
• security: reject malformed Realtime WebSocket event frames (#​2391) (e6e11b0)
• security: require an exact SSE completion sentinel (#​2422) (a905bfb)
• security: require OIDC for npm publishing (#​2404) (342764b)
• security: respect configured logger for Assistants stream errors (#​2390) (8ba3009)
• security: restrict live CI credentials to protected main (#​2405) (3554cdc)
• security: scope Cloudflare ecosystem API key files (#​2398) (4f4b45d)
• security: secure Next.js Edge streaming example requests (#​2424) (861caed)
• security: stop delayed and additional tool callbacks after cancellation (#​2430) (c168599)
• security: stop retaining sensitive assistant stream events (#​2407) (dfec129)
• settle concurrent stream event waiters in linear time (#​2387) (a88c2ca)
• settle WebSocket event waiters in linear time (#​2389) (489dc72)
• standard-schema: preserve validator bindings across helpers (#​2483) (e4afdb7)
• streaming: reject named SSE provider error events (#​2409) (b7a0bd6)
• tests: make credential-lifecycle held-inode scenarios portable to macOS (#​2480) (60f5267)
• uploads: preserve Blob files and multipart media types (#​2467) (d497fb3)
• webhooks: bound signature verification work (#​2475) (05cf7ab)
• ws: block custom credential headers on redirects (#​2429) (d2ab6e7)
• zod: support only provably JSON-native structured outputs (#​2396) (c3d68e4)

Chores

• api: clarify image transparency and audio delta docs (#​2439) (f14e885)
• api: document supported image generation models (#​2432) (0e00909)
• api: update SDK generation metadata (#​2448) (d1410d1)
• deps-dev: bump @​cloudflare/workers-types from 5.20260809.1 to 5.20260816.1 in /ecosystem-tests/cloudflare-worker (#​2452) (cf7e588)
• deps-dev: bump @​smithy/hash-node from 4.4.16 to 4.5.2 (#​2455) (342b0a3)
• deps-dev: bump @​smithy/signature-v4 from 5.6.12 to 5.7.2 (#​2459) (bf4386c)
• deps-dev: bump publint from 0.3.22 to 0.3.23 (#​2457) (c100c83)
• deps-dev: bump puppeteer from 25.5.0 to 25.7.0 in /ecosystem-tests/browser-direct-import (#​2451) (c6c406b)
• deps-dev: bump puppeteer from 25.5.0 to 25.7.0 in /ecosystem-tests/ts-browser-webpack (#​2456) (e1faab1)
• deps-dev: bump ws from 8.21.1 to 8.21.3 (#​2454) (1f84889)
• deps: bump next from 15.5.21 to 15.5.23 in /ecosystem-tests/vercel-edge (#​2458) (cc532b3)
• deps: bump next from 16.3.0 to 16.3.1 (#​2460) (a2d88c1)
• set a 3,000-line custom-code budget (#​2446) (2035847)

Documentation

• encode recurring SDK review feedback in agent guidance (#​2378) (e552523)
• security: add secure contributor and agent guidance (#​2382) (459d009)

Refactors

• move embedding encoding into an SDK-owned helper (#​2436) (db9e930)
• move file processing wait into an SDK-owned helper (#​2438) (3d39e64)
• move vector store batch uploads into an SDK-owned helper (#​2441) (0257e51)
• move vector store polling into an SDK-owned helper (#​2437) (4317319)
• move webhook signature checks into an SDK-owned helper (#​2442) (283e12b)
• share SDK-owned assistant run polling (#​2440) (4de295b)

v7.5.0

Compare Source

Features

• add Bedrock Runtime endpoint support (SDK-290) (#​2348) (4a199af)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (#​2278) (9a38e63)
• api: Add ServiceTier and ImageDetail types (#​2364) (602d481)
• api: add WebSocket stream IDs (#​2314) (156a8db)
• api: add workload identity access token issued event (#​2307) (322a5b1)
• api: deprecate Sora video APIs (#​2313) (4424b40)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#​2332) (a3deafb)

Bug Fixes

• api: clarify audio upload metadata requirements (#​2279) (34ecf3f)
• audio: prevent microphone leaks and playback pipe deadlocks (#​2339) (1c692fe)
• audio: reject ffplay spawn errors (#​2012) (6d42d4d)
• auth: reject redirects during workload identity token exchange (#​2321) (240385e)
• auth: reject unsafe workload-identity token expirations (#​2345) (1f0349d)
• avoid TypeError in toFile for Responses without a URL (#​2311) (3313f54)
• await webhook verification in README examples (#​2302) (0fe7ad0)
• azure: honor explicit browser denial for Entra token providers (#​2328) (9d47510)
• azure: preserve model-to-deployment mapping for images.edit (#​1918) (6c207c6)
• azure: prevent API-key disclosure across HTTP redirects (#​2320) (f36c418)
• azure: prevent deployment path traversal (#​2337) (a9d9d41)
• bedrock: safely sign inherited query parameter names (#​2375) (3f8d5cc)
• chat: support custom tool calls in parser and ChatCompletionStream (#​2023) (6fa9152)
• client: handle empty JSON response body without content-length (#​1998) (b6447e9)
• configure Bash for pnpm scripts on Windows (#​2330) (f5a0ad1)
• deps: remediate Dependabot and fixture vulnerabilities (#​2282) (783da8f)
• embedding: response type for base64 encoding format (#​1554) (ef69801)
• export AzureClientOptions (#​1760) (511bf6d), closes #​1735
• export workload identity helpers from openai/auth (#​2344) (af8f14f)
• fail ecosystem CI when live credentials are missing (#​2349) (a47dc75)
• format: restore formatting for generated SDK files (#​2089) (6d69d4b)
• harden runTools against inherited function names (#​2333) (f4496d1)
• honor defaultHeaders null for helper method header (#​1857) (8eab09a)
• include items for strict Zod v3 any arrays (#​2357) (4c32089)
• isolate Vercel ecosystem tests per request (#​2359) (2831290)
• keep streamed Responses output text linear and canonical (#​2354) (6827a40)
• lint: recognize Castiron-generated headers (#​2124) (cf6237f)
• lint: restore generated SDK lint rules (#​2126) (6b8162c)
• parse empty chat content when present (#​2331) (53dd723)
• parser: recognize raw json_schema response format in auto-parsing checks (#​2015) (fbd2541)
• pass file batch helper options through (#​1855) (05ce028)
• preserve File-like metadata in toFile (#​1883) (ba1a781)
• preserve skill upload paths without buffering native files (#​2303) (30b9c41)
• preserve Skills upload file paths (#​1856) (e75de97)
• preserve zero retry-after-ms precedence (#​2329) (b44644e)
• prevent prototype event names from crashing SDK streams (#​2315) (c014250)
• prevent prototype manipulation in strict Structured Outputs schemas (#​2341) (838de7e)
• prevent prototype pollution in assistant stream deltas (#​2280) (928fa2b)
• realtime: allow overriding WebSocket connection URLs (#​2308) (7407413), closes #​2305
• realtime: enforce Azure browser denial and redact all credentials (#​2340) (a77861d)
• realtime: prevent Azure API-key disclosure across WebSocket redirects (#​2325) (d5a1a1e)
• realtime: prevent remote error payloads from crashing clients (#​2350) (896f021)
• realtime: remove immutable model updates from public and Azure examples (#​2327) (08bd80a)
• reject unsupported proto Zod v3 object properties (#​2352) (46a8ca0)
• remove vulnerable extract-zip from browser tests (#​2312) (567ad4f)
• responses: reject with OpenAIError when the stream emits an error event (#​2021) (a54014d)
• responses: validate streaming event indices before array access (#​2323) (13eaf1d)
• security: bound untrusted AssistantStream delta array indices (#​2326) (afdf5ef)
• security: contain Bedrock credentials to the configured endpoint origin (#​2342) (23f0575)
• security: keep browser ecosystem API keys out of navigation URLs (#​2353) (1029e82)
• security: prevent Bedrock bearer credential disclosure across redirects (#​2377) (bfcccad)
• security: prevent global Array.prototype pollution in chat completion streams (#​2318) (486e191)
• security: prevent multipart upload content-type header injection (#​2322) (1c0b9ca)
• security: prevent process-wide prototype pollution via assistant stream snapshot IDs (#​2316) (21a0653)
• security: prevent prototype manipulation in streamed chat snapshots (#​2335) (e81d766)
• security: prevent streaming upload filename/header injection (#​2363) (4ba4084)
• streaming: eliminate quadratic EventStream FIFO draining (#​2356) (57521a1)
• streaming: eliminate quadratic SSE buffer copying (#​2324) (ebdb296)
• streaming: finish SSE streams immediately after [DONE] (#​2317) (7722171)
• streaming: handle mixed SSE line endings (#​2309) (24d5ada)
• streaming: isolate AssistantStream message and tool-call lifecycles (#​2334) (178e85f)
• streaming: make fragmented line decoding amortized linear (#​2336) (f32e2df)
• streaming: surface mid-stream errors when iterating buffered streams (#​2047) (8cc6cac)
• ws: prevent duplicate listener leaks in Node and browser adapters (#​2347) (a032b85)
• zod: preserve literal payloads when escaping schema references (#​2351) (8f189f4)
• zod: preserve null literals in Zod v3 JSON schemas (#​2355) (ed5c5e6)
• zod: prevent generated definition name collisions (#​2346) (0844573)
• zod: reject non-object Zod v3 strict schema roots (#​2358) (cc7dbfa)

Chores

• api: update generated SDK attribution (#​2125) (cd7c3e5)
• deps-dev: bump @​aws-sdk/credential-provider-node from 3.972.47 to 3.972.77 (#​2298) (67b581a)
• deps-dev: bump @​aws-sdk/credential-provider-node from 3.972.77 to 3.972.78 (#​2371) (2cc57c3)
• deps-dev: bump @​cloudflare/workers-types from 5.20260710.1 to 5.20260804.1 in /ecosystem-tests/cloudflare-worker (#​2283) (c9cdbad)
• deps-dev: bump @​cloudflare/workers-types from 5.20260804.1 to 5.20260809.1 in /ecosystem-tests/cloudflare-worker (#​2366) (6983363)
• deps-dev: bump @​smithy/hash-node from 4.4.15 to 4.4.16 (#​2293) (ba2fc9f)
• deps-dev: bump @​smithy/protocol-http from 5.4.5 to 5.5.16 (#​2289) (81cf407)
• deps-dev: bump @​smithy/signature-v4 from 5.4.5 to 5.6.12 (#​2294) (c70c34f)
• deps-dev: bump @​types/node from 24.12.4 to 26.2.0 (#​2370) (50db5db)
• deps-dev: bump html-webpack-plugin from 5.6.7 to 5.6.8 in /ecosystem-tests/ts-browser-webpack (#​2367) (7259f9f)
• deps-dev: bump iconv-lite from 0.6.3 to 0.7.3 (#​2299) (7cfb7f3)
• deps-dev: bump oxfmt from 0.61.0 to 0.62.0 (#​2373) (16172a4)
• deps-dev: bump signal-exit from 3.0.7 to 4.1.0 (#​2296) (9dac77d)
• deps-dev: bump start-server-and-test from 3.0.11 to 3.0.12 in /ecosystem-tests/vercel-edge (#​2369) (9ff1aff)
• deps-dev: bump superstruct from 1.0.4 to 2.0.2 (#​2285) (190d58c)
• deps-dev: bump ts-jest from 29.4.11 to 29.4.12 (#​2374) (6320b64)
• deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/cloudflare-worker (#​2284) (9230649)
• deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/node-ts-cjs (#​2287) (a4b36bd)
• deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/node-ts-cjs-web (#​2288) (25d94fa)
• deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/node-ts-esm (#​2290) (9b33e5e)
• deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/node-ts-esm-auto (#​2291) (1579ae0)
• deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/node-ts-esm-web (#​2292) (6449a74)
• deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/vercel-edge (#​2295) (93096e2)
• deps-dev: bump ultracite from 7.8.4 to 7.10.0 (#​2300) (8a7508c)
• deps-dev: bump webpack from 5.108.4 to 5.109.2 in /ecosystem-tests/ts-browser-webpack (#​2368) (b49b227)
• deps-dev: bump wrangler from 4.110.0 to 4.118.0 in /ecosystem-tests/cloudflare-worker (#​2286) (1c46aad)
• deps-dev: bump wrangler from 4.118.0 to 4.120.0 in /ecosystem-tests/cloudflare-worker (#​2365) (01fae5e)
• limit Dependabot to 10 open pull requests (#​2297) (b05dd10)
• lint: enable array-callback-return (#​2104) (44fac0d)
• lint: enable arrow-body-style (#​2238) (0a78d59)
• lint: enable class-methods-use-this (#​2215) (cc73167)
• lint: enable complexity (#​2230) (44004d6)
• lint: enable curly (#​2275) (ac6d82f)
• lint: enable default-case (#​2222) (037545a)
• lint: enable eqeqeq (#​2259) (8e8fb1c)
• lint: enable func-name-matching (#​2225) (a299c40)
• lint: enable func-names (#​2274) (3055ccc)
• lint: enable guard-for-in (#​2140) (1e2a7f4)
• lint: enable import/consistent-type-specifier-style (#​2265) (559b8d0)
• lint: enable import/first (#​2192) (bc116ec)
• lint: enable import/namespace (#​2090) (31d8c66)
• lint: enable import/newline-after-import (#​2174) (b2f57eb)
• lint: enable import/no-cycle (#​2268) ([5b1f37c](https://redirect.github.com/openai/openai-node/commit/5b1f37c03ecc90bf

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying auth-wiki with    Cloudflare Pages

Latest commit:	a9ec606
Status:	✅  Deploy successful!
Preview URL:	https://de7ebd04.auth-wiki.pages.dev
Branch Preview URL:	https://renovate-openai-7-x.auth-wiki.pages.dev

View logs