What shipped in OpenAI on August 21, 2026?

If you run the official OpenAI Node SDK, today's security patch train is the one you can't skip. In total, 80 commits, 80 pull requests, and 7 releases landed.

Who contributed to OpenAI on August 21, 2026?

3 developers shipped this update, including copyberry, Hayden, and Alex Chang.

What were the notable OpenAI updates?

fix(ws): block custom credential headers on redirects (#2429), fix(security): abort streaming examples when clients disconnect (#2426), and fix(security): redact invalid workload identity access tokens (#2425).

Aug 21, 2026

$ the-wire · showcase

OPENAI NODE SHIPS FOUR SECURITY FIXES, STREAMING SAFETY AND CREDENTIAL LEAKS PATCHED

By RepoJournal · Filed 07:04 UTC on August 21, 2026 · About OpenAI · Composed from the cited sources · methodology

3 people shipped this

Hayden @HAYDEN-OAI 4 cited

Alex Chang @apcha-oai 4 cited

copyberry @copyberry 2 cited

If you run the official OpenAI Node SDK, today's security patch train is the one you can't skip.

The openai-node repo pushed four breaking security fixes in the last 24 hours, and two of them demand immediate attention. The WebSocket client now blocks custom credential headers from leaking across redirects [1], and streaming examples abort upstream generation the moment a client disconnects [2]. The SDK also redacts invalid workload identity tokens before they hit the wire [3] and caps detached event iterators at 4,096 events or 8 MiB while validating streamed item identities [4]. Just as critical, a follow-up removes unreleased SDK-side size limits that were aborting valid large streaming responses, including image generation events over 8 MiB [5]. The security work mirrors a parallel fix in openai-python: Azure authentication now stays scoped to the original origin across HTTP and Realtime transports [6]. Meanwhile, codex is quieter but still meaningful: it updated rmcp to 3.1.3, preserving auth and retryable transport classifications during MCP discovery fallback [7], and added hostname to the configurable TUI status line [8]. The openai-python repo spent most of its effort on cleanup, moving handwritten tests out of generated code [9][10], which is a watch item but not a rush.

Action items

→ Upgrade openai-node to the latest version that includes all four security fixes (WS redirect credential block, stream abort on disconnect, token redaction, and event stream bounds). openai/openai-node [immediate]
→ If you pinned the unreleased SDK-side size limit, unpin it now to avoid aborting large streaming responses. openai/openai-node [immediate]
→ Verify your Azure HTTP and Realtime clients handle off-origin redirects after the authentication boundary fix. openai/openai-python [plan]
→ Monitor codex TUI changes (rmcp 3.1.3 and hostname status line) for any regressions in your workflows. openai/codex [monitor]

References

[1] fix(ws): block custom credential headers on redirects (#2429) ↗ openai/openai-node
[2] fix(security): abort streaming examples when clients disconnect (#2426) ↗ openai/openai-node
[3] fix(security): redact invalid workload identity access tokens (#2425) ↗ openai/openai-node
[4] fix(security): bound SDK event streams and validate streamed item identities (#2415) ↗ openai/openai-node
[5] fix: preserve large streaming responses (#2433) ↗ openai/openai-node
[6] fix: Preserve Azure authentication boundaries across transports (#3684) ↗ openai/openai-python
[7] Update rmcp to 3.1.3 ↗ openai/codex
[8] Add hostname to the configurable TUI status line ↗ openai/codex
[9] chore(api): move chat validation tests out of generated code (#3698) ↗ openai/openai-python
[10] chore(api): move webhook tests out of generated code (#3700) ↗ openai/openai-python