RepoJournal
OpenAI OpenAI
137 wires and counting

$ follow OpenAI

Keep up with OpenAI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-19
stories 162
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

OPENAI SHIPS SECURITY BLITZ ACROSS SDKs

By RepoJournal · Filed · About OpenAI · Composed from the cited sources · methodology

Hayden olliem-oai iceweasel-oai github-actions[bot] openai-sdks[bot] apcha-oai felixxia-oai
7 people shipped this
Hayden @HAYDEN-OAI 4 cited olliem-oai @olliem-oai 1 cited iceweasel-oai @iceweasel-oai 1 cited github-actions[bot] @github-actions[bot] 1 cited openai-sdks[bot] @openai-sdks[bot] 1 cited apcha-oai @apcha-oai 1 cited felixxia-oai @felixxia-oai

Overnight, OpenAI hardened its entire client stack, patching WebSocket origin bypasses and credential leaks in node, Python, and Codex sandboxes alike.

A coordinated security sweep landed across the OpenAI ecosystem this morning, led by a run of fixes in the Node SDK. A high-severity advisory removes the beta Realtime constructor's public `__url` override and validates the WebSocket destination against the configured client origin [1]. The same repo also locks down Vercel ecosystem APIs, closing an unauthenticated assistant listing that exposed account data [2]. The Python SDK ships 3.3.0, which requires patched versions of aiohttp and urllib3 to quash two supply-chain advisories: 'Support named data-residency endpoints' is the marquee feature, but the dependency floor is the real headline [3][4]. On the Codex side, Guardian v2 risk classification gets a more aggressive default prompt that triggers full review at a 0.5 `action_risk` score, down from 0.8 [5]. A Windows sandbox ACL failure could previously report success while leaving world-writable paths unguarded; now preflight fails hard after aggregating every deny-ACE error [6]. The security posture extends to CI: both node and Python repos now run CodeQL on merge queues, failing closed on any finding [7][8]. The release train also brings Codex 0.148.0, which adds `/export` for TUI conversations to Markdown and a `codex exec fork` command [9].

Action items

References

  1. [1] fix(security): harden Realtime WebSocket origins, worker guards, and Azure credentials (#2414) ↗ openai/openai-node
  2. [2] fix(security): authenticate Vercel ecosystem APIs and clean up uploaded files (#2412) ↗ openai/openai-node
  3. [3] v3.3.0 ↗ openai/openai-python
  4. [4] fix: require patched optional networking dependencies ↗ openai/openai-python
  5. [5] Improve Guardian v2 risk classification (#39264) openai/codex ↗
  6. [6] Propagate Windows sandbox ACL update failures (#39279) openai/codex ↗
  7. [7] ci(security): run CodeQL for pull requests and merge groups (#2388) ↗ openai/openai-node
  8. [8] ci: run CodeQL analysis for merge-queue entries (#3643) ↗ openai/openai-python
  9. [9] 0.148.0 ↗ openai/codex

$ ls openai/reviews/ # the step-back reads

the week in review openai-python 3.24.0 lands alongside Codex 0.160.0 the month in review Agents API lands in both OpenAI SDKs
Full archive → Weekly reviews →

Quick answers

What shipped in OpenAI on August 19, 2026?
Overnight, OpenAI hardened its entire client stack, patching WebSocket origin bypasses and credential leaks in node, Python, and Codex sandboxes alike. In total, 79 commits, 78 pull requests, and 5 releases landed.
Who contributed to OpenAI on August 19, 2026?
7 developers shipped this update, including olliem-oai, iceweasel-oai, felixxia-oai, github-actions[bot], Hayden, openai-sdks[bot], and apcha-oai.
What were the notable OpenAI updates?
fix(security): harden Realtime WebSocket origins, worker guards, and Azure credentials (#2414), fix(security): authenticate Vercel ecosystem APIs and clean up uploaded files (#2412), and v3.3.0.
♥

$ log OpenAI --recent

Codex stabilizes the tool prefix across turns 45 shipped Codex drops the provider gate on tool namespaces, openai-python ships 3.24.0 112 shipped Codex 0.160.0 and typed agent tooling land across the SDKs 144 shipped Agent stream helpers land in both SDKs, Codex daemons survive cwd deletion 137 shipped

$ log --all # elsewhere on the wire

@openclaw OpenClaw's deslop sweep removes 1,000+ production lines Agentic Coding Codex keeps deferred tools stable across turns, Windows Terminal Shift+Enter fixed

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.