Who contributed to OpenAI on August 18, 2026?

6 developers shipped this update, including Eric Traut, chess, copyberry, Hayden, openai-sdks[bot], and Justin Beckwith.

What were the notable OpenAI updates?

release: 7.5.0 (#2087), v3.2.0, and fix(security): prevent streaming upload filename/header injection (#2363).

OpenAI

Codex, the SDKs, and the engine behind ChatGPT

Pick a date

Topics: AI / ML Full archive →

The Wire · Showcase

OpenAI SDKs ship Bedrock Runtime and credential injection fixes

By RepoJournal · Filed 06:58 UTC on August 18, 2026 · About OpenAI

6 people shipped this

Hayden @HAYDEN-OAI 3 cited

openai-sdks[bot] @openai-sdks[bot] 2 cited

Eric Traut @etraut-openai 1 cited

chess @chess-oai 1 cited

copyberry @copyberry 1 cited

Justin Beckwith @jbeckwith-oai 1 cited

OpenAI's Node and Python SDKs both land Bedrock Runtime support alongside critical security patches that block credential disclosure.

Both Node and Python SDKs released support for the Bedrock Runtime endpoint this week, with Mantle remaining the default. The Node 7.5.0 release adds Bedrock Runtime endpoint support [1], while the Python SDK's 3.2.0 brings the same feature [2]. More urgent: two security patches in openai-node prevent streaming upload filename and header injection [3], and block Bedrock bearer credential disclosure across redirects, protecting `x-amz-security-token` and API keys [4]. Hayden's Python contribution guidance now demands "credential and log redaction" and CODEOWNER review for security changes [5]. On the auth front, Python SDK gains X.509 workload identity federation for HTTP [6], letting customers exchange mTLS-backed workload identity without SDK-owned certificates. Note that Codex explicitly closed its doors to external code contributions [7] as it redefines its community interface. The new `desktop.security.enforcement` doctor check in Codex will flag blocked macOS Gatekeeper and Windows Defender events [8], and its TUI subagent navigation is now hardened with consistent `/subagents` commands [9].

Action items

→ Upgrade openai-node to 7.5.0 immediately to fix streaming upload and redirect credential leaks openai/openai-node [immediate]
→ Update openai-python to 3.2.0 to get Bedrock Runtime and X.509 auth openai/openai-python [immediate]
→ Review your Codex TUI and plugin setup for expected behavior changes openai/codex [monitor]

References

[1] release: 7.5.0 (#2087) openai/openai-node
[2] v3.2.0 ↗ openai/openai-python
[3] fix(security): prevent streaming upload filename/header injection (#2363) openai/openai-node
[4] fix(security): prevent Bedrock bearer credential disclosure across redirects (#2377) openai/openai-node
[5] docs: strengthen Python SDK security contribution guidance (#3639) openai/openai-python
[6] feat(auth): add X.509 workload identity federation for HTTP (#3622) openai/openai-python
[7] Clarify the external contribution policy (#39089) openai/codex
[8] Add desktop security enforcement diagnostics (#39067) openai/codex
[9] Harden TUI subagent navigation ↗ openai/codex

Quick answers

What shipped in OpenAI on August 18, 2026?: OpenAI's Node and Python SDKs both land Bedrock Runtime support alongside critical security patches that block credential disclosure. In total, 65 commits, 74 pull requests, and 3 releases landed.
Who contributed to OpenAI on August 18, 2026?: 6 developers shipped this update, including Eric Traut, chess, copyberry, Hayden, openai-sdks[bot], and Justin Beckwith.
What were the notable OpenAI updates?: release: 7.5.0 (#2087), v3.2.0, and fix(security): prevent streaming upload filename/header injection (#2363).

OPENAI SHIPS SECURITY BLITZ ACROSS SDKs

Overnight, OpenAI hardened its entire client stack, patching WebSocket origin bypasses and credential leaks in node, Python, and Codex sandboxes alike.

ai 162 shipped

OpenAI Aug 16

CODEX HARDENS SESSION STATE, NODE SDK TIGHTENS ZOD VALIDATION

Codex shipped five fixes to prevent stale app state from bleeding into active sessions, while the Node SDK now rejects malformed Zod v3 schemas before they reach the API.

ai 39 shipped

OpenAI Aug 15

OPENAI NODE HARDENS AGAINST CREDENTIAL LEAKS AND REMOTE CRASHES

Hayden shipped five security fixes across Realtime, streaming, and Bedrock clients, closing credential-exposure paths and preventing malformed server payloads from crashing applications.

ai 181 shipped

OpenAI Aug 14

OPENAI-NODE SHIPS FOUR SECURITY FIXES OVERNIGHT

Four high-severity vulnerabilities closed in the JavaScript SDK, including prototype pollution, API-key disclosure across redirects, and multipart upload header injection.

ai 139 shipped

Elsewhere on the wire

AI Agents Aug 19

CLINE DESKTOP GOES NATIVE WITH BACKGROUND ALERTS

Cline's desktop app just became a tool you can leave running while you grab coffee, and LangChain is quietly fixing the token math that makes DeepSeek caching actually count.

ai-agents 97 shipped

@CachyOS Aug 19

CACHYOS PUSHES KERNEL 7.1.8 AND SCHEDULER FIXES ACROSS THE STACK

CachyOS is shipping a new kernel meanwhile patching its scheduler stack, and that combination is exactly what you want before your next deploy.

infra 58 shipped

Elixir & Phoenix Aug 19

LiveView memory leak fix leads overnight Elixir cleanup

A handful of pull requests across Elixir and Phoenix are quietly fixing leaks and edge cases that have been nagging at production apps.

elixir 19 shipped

@dotnet Aug 19

MAUI Overhauls NuGet Publishing as FSharp Preps for VS 18.11

MAUI is replacing its custom NuGet publishing with Microsoft's 1ES.PublishNuget, and FSharp is rolling Microsoft.Build deps forward to VS 18.11, two moves that reshape release engineering across the .NET ecosystem.