Who contributed to OpenAI on July 3, 2026?

3 developers shipped this update, including shijie-oai, bolinfest, and dylan-hurd-oai.

What were the notable OpenAI updates?

fix: address quick-xml security advisories (#30941), [codex] Add configurable multi-agent mode hint text, and telemetry: log structured direct tool-call timing.

OpenAI

Codex, the SDKs, and the engine behind ChatGPT

Pick a date

Topics: AI / ML Full archive →

The Wire · Showcase

CODEX PATCHES CRITICAL XML PARSER VULNERABILITIES

By RepoJournal · Filed 06:02 UTC on July 3, 2026 · About OpenAI

3 people shipped this

shijie-oai @shijie-oai 1 cited

bolinfest @bolinfest 1 cited

dylan-hurd-oai @dylan-hurd-oai 1 cited

Two denial-of-service flaws in quick-xml forced an emergency upgrade path that leaves the codebase split between safe and legacy versions.

Codex shipped a fix for RUSTSEC-2026-0194 and RUSTSEC-2026-0195, both DoS vulnerabilities in quick-xml 0.38.4 that caused cargo-deny to fail on main [1]. The team upgraded to quick-xml 0.41.0 where possible, but had to keep a 0.39.4 copy in place because plist and wayland-scanner haven't adopted the latest version yet [1]. The good news: neither retained path accepts attacker-controlled XML, so the vulnerability surface is contained. In parallel, the team shipped three feature-tier changes: configurable multi-agent mode hint text for deployments that need stable delegation policies regardless of reasoning effort [2], structured JSON telemetry for direct tool-call timing to let app servers measure dispatch and execution phases separately [3], and a websockets fix that ignores metadata when comparing incremental requests to the Responses API, improving success rates [4].

Action items

→ Verify quick-xml 0.41.0 adoption in your dependency tree; if you're on plist or wayland-scanner, confirm no blockers before upgrading openai/codex [immediate]
→ If running multi-agent V2, test the new multi_agent_mode_hint_text configuration in staging openai/codex [plan]
→ For app-server deployments consuming structured logs, enable the new tool-call timing telemetry and validate parser compatibility openai/codex [plan]

References

[1] fix: address quick-xml security advisories (#30941) openai/codex
[2] [codex] Add configurable multi-agent mode hint text ↗ openai/codex
[3] telemetry: log structured direct tool-call timing ↗ openai/codex
[4] fix(websockets) ignore metadata for incremental requests ↗ openai/codex

Quick answers

What shipped in OpenAI on July 3, 2026?: Two denial-of-service flaws in quick-xml forced an emergency upgrade path that leaves the codebase split between safe and legacy versions. In total, 6 commits, 6 pull requests, and 2 releases landed.
Who contributed to OpenAI on July 3, 2026?: 3 developers shipped this update, including shijie-oai, bolinfest, and dylan-hurd-oai.
What were the notable OpenAI updates?: fix: address quick-xml security advisories (#30941), [codex] Add configurable multi-agent mode hint text, and telemetry: log structured direct tool-call timing.

CODEX FIXES THREAD REPLAY ERRORS AND TIGHTENS SHUTDOWN SEQUENCING

Failed turn completions were being silently restored as successes when replaying conversation history, masking critical errors in the TUI transcript.

ai 10 shipped 1-min read

OpenAI 2 days ago

CODEX SHIPS RESPONSIVE UI FIXES AND FRESHENS MENTION SEARCH STATE

Codex tightened its interface handling across four critical flows: responsive keymap menus now adapt to narrow terminals, mention popups purge stale search results, completion events now track item lifecycles, and exec-server network policy decisions move client-side.

ai 15 shipped 1-min read

OpenAI 3 days ago

CODEX HARDENS MCP RUNTIME STABILITY ACROSS FIVE CRITICAL FIXES

OpenAI shipped a coordinated hardening of the Model Context Protocol layer across Codex, patching race conditions in thread startup, resource access, and authority management that could leave stale configurations in production.

ai 66 shipped 1-min read

OpenAI 4 days ago

SDK RELEASES LOCK IN PROMPT CACHING AND SPEND CONTROLS

Both Node and Python clients shipped v6.49.0 and v2.48.0 overnight with admin spend limit APIs and relaxed prompt cache validation.

ai 103 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.