RepoJournal
OpenAI

OpenAI

Codex, the SDKs, and the engine behind ChatGPT

Keep up with OpenAI in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Sat 18 jul
  2. Sun 19 jul
  3. Mon 20 jul
  4. Tue 21 jul
  5. Wed 22 jul
  6. Thu 23 jul
  7. Fri 24 jul
  8. Sat 25 jul
  9. Sun 26 jul
  10. Mon 27 jul
  11. Tue 28 jul
  12. Wed 29 jul
  13. Thu 30 jul
  14. Fri 31 jul
  15. Sat 1 aug
  16. Sun 2 aug
  17. Mon 3 aug
  18. Tue 4 aug
  19. Wed 5 aug
  20. Thu 6 aug
  21. Fri 7 aug
  22. Sat 8 aug
  23. Sun 9 aug
  24. Mon 10 aug
  25. Tue 11 aug
  26. Wed 12 aug
  27. Thu 13 aug
  28. Fri 14 aug
  29. Sat 15 aug
  30. Today 16 aug
Topics: AI / ML Full archive →

The Wire · Showcase

OPENAI NODE HARDENS AGAINST CREDENTIAL LEAKS AND REMOTE CRASHES

By RepoJournal · Filed · About OpenAI

Hayden felixxia-oai jif kevinlin-openai openai-sdks[bot] apcha-oai copyberry
8 people shipped this
Hayden @HAYDEN-OAI 4 cited felixxia-oai @felixxia-oai 1 cited jif @jif-oai 1 cited kevinlin-openai @kevinlin-openai 1 cited openai-sdks[bot] @openai-sdks[bot] 1 cited apcha-oai @apcha-oai 1 cited copyberry @copyberry openai-sdks @openai-sdks

Hayden shipped five security fixes across Realtime, streaming, and Bedrock clients, closing credential-exposure paths and preventing malformed server payloads from crashing applications.

The openai-node repo absorbed five breaking changes in a single push, all addressing authentication and stability gaps. Realtime clients now enforce browser denial correctly [1] and protect all five server-controlled error fields with exception-safe string conversion [2], preventing remote error payloads from crashing downstream code. Bedrock credentials are now contained to their configured endpoint origin across HTTP and WebSocket transports [3], closing an absolute credential-exposure path. Streaming performance got a critical fix: EventStream FIFO draining eliminated its quadratic behavior by replacing Array.shift() queues with a head-indexed FIFO [4]. On the Python side, openai-python 3.1.0 shipped with GPT-5.5 model identifiers, the ultrafast Responses tier, and a reusable structured error model for MCP tool-call failures [5] [6]. Meanwhile in codex, Guardian risk classification got policy enforcement [7], the sampling pool expanded from 8 to 16 WebSocket connections under load [8], and Thai combining marks now delete character-by-character instead of collapsing entire grapheme clusters [9]. Across all three repos this period: 88 commits, 88 PRs, 5 releases.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] fix(realtime): enforce Azure browser denial and redact all credentials (#2340) openai/openai-node
  2. [2] fix(realtime): prevent remote error payloads from crashing clients (#2350) openai/openai-node
  3. [3] fix(security): contain Bedrock credentials to the configured endpoint origin (#2342) openai/openai-node
  4. [4] fix(streaming): eliminate quadratic EventStream FIFO draining (#2356) openai/openai-node
  5. [5] v3.1.0 ↗ openai/openai-python
  6. [6] feat(api): Ultrafast tier, structured MCP and websocket errors, separate websocket events (#3617) openai/openai-python
  7. [7] Apply Guardian policies to v2 risk classification (#38618) openai/codex
  8. [8] Prioritize new Guardian classifications under load (#38596) openai/codex
  9. [9] Delete Thai combining marks one at a time in the composer (#38662) openai/codex

Quick answers

What shipped in OpenAI on August 15, 2026?
Hayden shipped five security fixes across Realtime, streaming, and Bedrock clients, closing credential-exposure paths and preventing malformed server payloads from crashing applications. In total, 88 commits, 88 pull requests, and 5 releases landed.
Who contributed to OpenAI on August 15, 2026?
8 developers shipped this update, including felixxia-oai, jif, copyberry, kevinlin-openai, Hayden, openai-sdks[bot], apcha-oai, and openai-sdks.
What were the notable OpenAI updates?
fix(realtime): enforce Azure browser denial and redact all credentials (#2340), fix(realtime): prevent remote error payloads from crashing clients (#2350), and fix(security): contain Bedrock credentials to the configured endpoint origin (#2342).

More from OpenAI

OpenAI OpenAI

CODEX HARDENS SESSION STATE, NODE SDK TIGHTENS ZOD VALIDATION

Codex shipped five fixes to prevent stale app state from bleeding into active sessions, while the Node SDK now rejects malformed Zod v3 schemas before they reach the API.

copyberry HAYDEN-OAI
ai 39 shipped
OpenAI OpenAI

OPENAI-NODE SHIPS FOUR SECURITY FIXES OVERNIGHT

Four high-severity vulnerabilities closed in the JavaScript SDK, including prototype pollution, API-key disclosure across redirects, and multipart upload header injection.

copyberry Matthew Zeng Hayden Alex Chang +1
ai 139 shipped
OpenAI OpenAI

CODEX HARDENS PLUGIN METRICS AND SESSION RESILIENCE WHILE NODE SDK FIXES STREAMING ERRORS

Codex shipped resilience upgrades for gRPC reconnection and multi-review rejection reporting, while the Node SDK patches a critical streaming bug that could mask failed requests as successes.

rka-oai copyberry HAYDEN-OAI pouyashahrdami +1
ai 112 shipped
OpenAI OpenAI

PYTHON SDK GOES HTTPX2, NODE PATCHES PROTOTYPE POLLUTION, CODEX HARDENS STREAMING

OpenAI Python SDK v3.0.0 ships HTTPX2 as the default HTTP client, breaking the old httpx dependency entirely while Node.js closes a critical prototype-pollution vulnerability in assistant streams.

Bryan Ashley Channing Conger mchen-oai Tamir Duberstein +6
ai 196 shipped

Daily updates, in your inbox

Follow OpenAI

Keep up with OpenAI in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

OPENHANDS PINS CLIENT DEPENDENCY, ADDS STRUCTURED ERROR HANDLING

OpenHands locked its TypeScript client to exact version 1.37.0 and merged canvas error outcome improvements in a single commit cycle.

neubig
ai-agents 2 shipped
Local LLMs Local LLMs

LLAMA.CPP OVERHAULS INFERENCE FLAGS, VLLM PATCHES DEEPSEEK SPARSE MLA

llama.cpp deprecates mmap flags in favor of unified load-mode, while vllm fixes critical issues blocking DeepSeek-V4-Flash across all decode paths.

github-actions[bot] dhiltgen Fathi Boudra Eric Zhang +11
llms 136 shipped
CachyOS @CachyOS

DASHBOARD SEO OVERHAUL SHIPS AS PACKAGE TRAIN ROLLS FORWARD

CachyOS public-dashboard refactored routes with canonical metadata and improved crawler visibility [ref:18] while 61 commits across five repos kept the AUR pipeline humming.

github-actions witchlliee Jinra azdanov +1
infra 72 shipped
Elixir & Phoenix Elixir & Phoenix

ELIXIR CORE CUTS ALLOCATIONS ACROSS STRING AND AST OPERATIONS

Thomas Cioppettini landed four performance wins overnight that eliminate unnecessary allocations in List.myers_difference, String case conversion, and Macro tree walkers.

Thomas Cioppettini LostKobrakai
elixir 17 shipped
Want every project, not just this one?