RepoJournal
OpenAI OpenAI
150 wires and counting

$ follow OpenAI

Keep up with OpenAI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-03
stories 14
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

CODEX PATCHES CRITICAL XML PARSER VULNERABILITIES

By RepoJournal · Filed · About OpenAI · Composed from the cited sources · methodology

shijie-oai bolinfest dylan-hurd-oai
3 people shipped this
shijie-oai @shijie-oai 1 cited bolinfest @bolinfest 1 cited dylan-hurd-oai @dylan-hurd-oai 1 cited

Two denial-of-service flaws in quick-xml forced an emergency upgrade path that leaves the codebase split between safe and legacy versions.

Codex shipped a fix for RUSTSEC-2026-0194 and RUSTSEC-2026-0195, both DoS vulnerabilities in quick-xml 0.38.4 that caused cargo-deny to fail on main [1]. The team upgraded to quick-xml 0.41.0 where possible, but had to keep a 0.39.4 copy in place because plist and wayland-scanner haven't adopted the latest version yet [1]. The good news: neither retained path accepts attacker-controlled XML, so the vulnerability surface is contained. In parallel, the team shipped three feature-tier changes: configurable multi-agent mode hint text for deployments that need stable delegation policies regardless of reasoning effort [2], structured JSON telemetry for direct tool-call timing to let app servers measure dispatch and execution phases separately [3], and a websockets fix that ignores metadata when comparing incremental requests to the Responses API, improving success rates [4].

$ ls openai/reviews/ # the step-back reads

the week in review Codex hands model defaults to the server the month in review Agents API lands in both OpenAI SDKs
Full archive → Weekly reviews →

Quick answers

What shipped in OpenAI on July 3, 2026?
Two denial-of-service flaws in quick-xml forced an emergency upgrade path that leaves the codebase split between safe and legacy versions. In total, 6 commits, 6 pull requests, and 2 releases landed.
Who contributed to OpenAI on July 3, 2026?
3 developers shipped this update, including shijie-oai, bolinfest, and dylan-hurd-oai.
What were the notable OpenAI updates?
fix: address quick-xml security advisories (#30941), [codex] Add configurable multi-agent mode hint text, and telemetry: log structured direct tool-call timing.
♥

$ log OpenAI --recent

Safety identifiers reach images, plugin approvals bind to contents 93 shipped Credential masking lands in Codex, Live gains Decisions across both SDKs 100 shipped Codex stabilizes environment tools, python adds residency options 135 shipped openai-python restores streaming connection reuse, browser and computer toolsets land in both SDKs 123 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.