RepoJournal
OpenAI OpenAI
150 wires and counting

$ follow OpenAI

Keep up with OpenAI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-18
stories 142
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

OpenAI SDKs ship Bedrock Runtime and credential injection fixes

By RepoJournal · Filed · About OpenAI · Composed from the cited sources · methodology

Hayden openai-sdks[bot] Eric Traut chess copyberry Justin Beckwith
6 people shipped this
Hayden @HAYDEN-OAI 3 cited openai-sdks[bot] @openai-sdks[bot] 2 cited Eric Traut @etraut-openai 1 cited chess @chess-oai 1 cited copyberry @copyberry 1 cited Justin Beckwith @jbeckwith-oai 1 cited

OpenAI's Node and Python SDKs both land Bedrock Runtime support alongside critical security patches that block credential disclosure.

Both Node and Python SDKs released support for the Bedrock Runtime endpoint this week, with Mantle remaining the default. The Node 7.5.0 release adds Bedrock Runtime endpoint support [1], while the Python SDK's 3.2.0 brings the same feature [2]. More urgent: two security patches in openai-node prevent streaming upload filename and header injection [3], and block Bedrock bearer credential disclosure across redirects, protecting `x-amz-security-token` and API keys [4]. Hayden's Python contribution guidance now demands "credential and log redaction" and CODEOWNER review for security changes [5]. On the auth front, Python SDK gains X.509 workload identity federation for HTTP [6], letting customers exchange mTLS-backed workload identity without SDK-owned certificates. Note that Codex explicitly closed its doors to external code contributions [7] as it redefines its community interface. The new `desktop.security.enforcement` doctor check in Codex will flag blocked macOS Gatekeeper and Windows Defender events [8], and its TUI subagent navigation is now hardened with consistent `/subagents` commands [9].

Action items

References

  1. [1] release: 7.5.0 (#2087) ↗ openai/openai-node
  2. [2] v3.2.0 ↗ openai/openai-python
  3. [3] fix(security): prevent streaming upload filename/header injection (#2363) openai/openai-node ↗
  4. [4] fix(security): prevent Bedrock bearer credential disclosure across redirects (#2377) ↗ openai/openai-node
  5. [5] docs: strengthen Python SDK security contribution guidance (#3639) ↗ openai/openai-python
  6. [6] feat(auth): add X.509 workload identity federation for HTTP (#3622) ↗ openai/openai-python
  7. [7] Clarify the external contribution policy (#39089) openai/codex ↗
  8. [8] Add desktop security enforcement diagnostics (#39067) openai/codex ↗
  9. [9] Harden TUI subagent navigation ↗ openai/codex

$ ls openai/reviews/ # the step-back reads

the week in review Codex hands model defaults to the server the month in review Agents API lands in both OpenAI SDKs
Full archive → Weekly reviews →

Quick answers

What shipped in OpenAI on August 18, 2026?
OpenAI's Node and Python SDKs both land Bedrock Runtime support alongside critical security patches that block credential disclosure. In total, 65 commits, 74 pull requests, and 3 releases landed.
Who contributed to OpenAI on August 18, 2026?
6 developers shipped this update, including Eric Traut, chess, copyberry, Hayden, openai-sdks[bot], and Justin Beckwith.
What were the notable OpenAI updates?
release: 7.5.0 (#2087), v3.2.0, and fix(security): prevent streaming upload filename/header injection (#2363).
♥

$ log OpenAI --recent

Safety identifiers reach images, plugin approvals bind to contents 93 shipped Credential masking lands in Codex, Live gains Decisions across both SDKs 100 shipped Codex stabilizes environment tools, python adds residency options 135 shipped openai-python restores streaming connection reuse, browser and computer toolsets land in both SDKs 123 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.