RepoJournal
OpenAI

OpenAI

Codex, the SDKs, and the engine behind ChatGPT

Keep up with OpenAI in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Tue 14 jul
  2. Wed 15 jul
  3. Thu 16 jul
  4. Sat 18 jul
  5. Sun 19 jul
  6. Mon 20 jul
  7. Tue 21 jul
  8. Wed 22 jul
  9. Thu 23 jul
  10. Fri 24 jul
  11. Sat 25 jul
  12. Sun 26 jul
  13. Mon 27 jul
  14. Tue 28 jul
  15. Wed 29 jul
  16. Thu 30 jul
  17. Fri 31 jul
  18. Sat 1 aug
  19. Sun 2 aug
  20. Mon 3 aug
  21. Tue 4 aug
  22. Wed 5 aug
  23. Thu 6 aug
  24. Fri 7 aug
  25. Sat 8 aug
  26. Sun 9 aug
  27. Mon 10 aug
  28. Tue 11 aug
  29. Wed 12 aug
  30. Today 13 aug
Topics: AI / ML Full archive →

The Wire · Showcase

PYTHON SDK GOES HTTPX2, NODE PATCHES PROTOTYPE POLLUTION, CODEX HARDENS STREAMING

By RepoJournal · Filed · About OpenAI

Hayden Bryan Ashley Channing Conger Tamir Duberstein copyberry openai-sdks[bot] Alex Chang
10 people shipped this
Hayden @HAYDEN-OAI 3 cited Bryan Ashley @bryanashley 1 cited Channing Conger @cconger 1 cited Tamir Duberstein @tamird 1 cited copyberry @copyberry 1 cited openai-sdks[bot] @openai-sdks[bot] 1 cited Alex Chang @apcha-oai 1 cited mchen-oai @mchen-oai dependabot @dependabot camdencheek @camdencheek

OpenAI Python SDK v3.0.0 ships HTTPX2 as the default HTTP client, breaking the old httpx dependency entirely while Node.js closes a critical prototype-pollution vulnerability in assistant streams.

The Python SDK's major version bump [1] marks the end of httpx era, forcing all custom client implementations to migrate to HTTPX2 equivalents or use a temporary legacy escape hatch. This change consolidates infrastructure and simplifies dependency management, though it demands immediate attention from anyone using custom transports or configuration objects. On the security front, the Node.js SDK [2] patched a CodeQL-flagged prototype-pollution vulnerability in AssistantStream delta merging, rejecting unsafe property-chain names before they can be exploited. The Node team also resolved 45 Dependabot alerts across undici, js-yaml, postcss, and other dependencies [5], then capped future noise by limiting Dependabot to 10 concurrent pull requests [6]. Meanwhile, Codex hardened its TUI streaming by persisting per-chunk traces at DEBUG level instead of TRACE [3], preventing SQLite log queue floods, while adding turn-aware response injection [4] to keep user input and injected items atomically persisted together. The team also routed gRPC code-mode sessions through the shared HTTP client [7] for better proxy and CA configuration support, and built metadata preservation across conversation history [8] without exposing harness details to model providers.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] v3.0.0 ↗ openai/openai-python
  2. [2] fix: prevent prototype pollution in assistant stream deltas (#2280) openai/openai-node
  3. [3] Limit TUI streaming traces in SQLite logs (#38036) openai/codex
  4. [4] Add turn-aware response item injection (#38047) openai/codex
  5. [5] fix(deps): remediate Dependabot and fixture vulnerabilities (#2282) openai/openai-node
  6. [6] chore: limit Dependabot to 10 open pull requests (#2297) openai/openai-node
  7. [7] Route gRPC code-mode sessions through the shared HTTP client (#38087) openai/codex
  8. [8] Preserve harness metadata across conversation history ↗ openai/codex
  9. [9] feat(api)!: migrate to HTTPX2 ↗ openai/openai-python

Quick answers

What shipped in OpenAI on August 12, 2026?
OpenAI Python SDK v3.0.0 ships HTTPX2 as the default HTTP client, breaking the old httpx dependency entirely while Node.js closes a critical prototype-pollution vulnerability in assistant streams. In total, 87 commits, 104 pull requests, and 5 releases landed.
Who contributed to OpenAI on August 12, 2026?
10 developers shipped this update, including Bryan Ashley, Channing Conger, mchen-oai, Tamir Duberstein, copyberry, Hayden, dependabot, and camdencheek, and 2 more.
What were the notable OpenAI updates?
v3.0.0, fix: prevent prototype pollution in assistant stream deltas (#2280), and Limit TUI streaming traces in SQLite logs (#38036).

More from OpenAI

OpenAI OpenAI

CODEX HARDENS PLUGIN METRICS AND SESSION RESILIENCE WHILE NODE SDK FIXES STREAMING ERRORS

Codex shipped resilience upgrades for gRPC reconnection and multi-review rejection reporting, while the Node SDK patches a critical streaming bug that could mask failed requests as successes.

rka-oai copyberry HAYDEN-OAI pouyashahrdami +1
ai 112 shipped
OpenAI OpenAI

CODEX TIGHTENS MEMORY WITH MOVE-ONLY SUBMISSIONS AS NODE SDK COMPLETES LINTING OVERHAUL

Codex eliminated cloning overhead from submission operations while the Node SDK wrapped up a 185-part linting cleanup that touches every rule in the compatibility matrix.

Owen Lin copyberry cooper-oai Hayden +1
ai 186 shipped
OpenAI OpenAI

CODEX FIXES IMAGE TRANSPARENCY AND PATH RESOLUTION VULNERABILITIES

Codex shipped native transparency support for image generation and patched a directory traversal risk in project path resolution.

copyberry
ai 16 shipped
OpenAI OpenAI

CODEX HARDENS IDENTITY AND AUDIT LAYER ACROSS PLUGIN, HOOK, AND PROCESS EXECUTION

Codex shipped five infrastructure changes overnight that lock down environment isolation, plugin failure tracking, and workload identity token handling across the entire execution stack.

copyberry
ai 16 shipped

Daily updates, in your inbox

Follow OpenAI

Keep up with OpenAI in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

ANTHROPIC INTEGRATION FIXES TOOL BLOCKS, OPENHANDS UNBLOCKS CI, CLINE PATCHES COMPOSER WEDGE

LangChain's Anthropic integration corrected tool result handling and model profiles [ref:1], while OpenHands fixed a critical test infrastructure failure blocking all PRs and shipped 1.13.0 with conversation archives [ref:6][ref:9].

github-actions[bot] langchain-oss-model-profiles[bot] ccurme Hunter Lovell +5
ai-agents 81 shipped
Local LLMs Local LLMs

OLLAMA PATCHES CRITICAL SSRF VULNERABILITY IN MANIFEST HANDLING

A rogue OCI registry could exploit duplicate digest collisions in Ollama's blob verification to exfiltrate data from internal endpoints.

Vignesh ParthSareen parabelboi Chipmunk +13
llms 249 shipped
CachyOS @CachyOS

CACHY-UPDATE REBASES UPSTREAM, EXPANDS PACKAGE ROSTER

CachyOS pushed a major upstream rebase to cachy-update while steadily expanding the AUR-derived package ecosystem across 40 commits.

Peter Jung Vladislav Nepogodin github-actions witchlliee +2
infra 54 shipped
Elixir & Phoenix Elixir & Phoenix

URI ENCODING GETS 10X SPEEDUP AS PHOENIX PATCHES BOOT CRASH

Elixir landed a massive optimization for URL encoding that hits 10x gains on empty strings, while Phoenix 1.8.11 fixes a critical startup failure.

NelsonVides Alexander Gubarev preciz github-actions[bot]
elixir 9 shipped
Want every project, not just this one?