$ cat openai/week/2026-10-19.log
the week in review · Oct 19 – Oct 25, 2026
Both OpenAI SDKs break Decisions types in minor
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
openai-node 7.43.0 and openai-python 3.37.0 widen Live response question instructions, and Codex scopes credential substitution.
v7.43.0 openai/openai-node
A Live response's Decisions question instructions can now be a string or an array of text, image, or JSON parts, and the release notes label it plainly: "Breaking change in a minor release." Any code that reads question.instructions as a string will need handling for the list shape before you take 7.43.0, and 7.42.0 remains the safe pin if you cannot.
v3.37.0 openai/openai-python
The Python SDK carries the same Decisions type widening in 3.37.0, with instructions accepting a string or a list of structured text, image, or JSON parts. Treat it as the same migration as the Node change: audit every place you consume instructions rather than only the call sites you remember.
Scope MITM credential substitution to trusted origins and placeholders (#56003) openai/codex
The MITM credential substitution path now authorizes both the destination and the original request before exposing host secrets, and project configuration can no longer redirect trusted credential policies. Older clients reject the new behavior, so mixed-version teams should check what their peers are running before rolling this out.
feat(realtime): add opt-in bounded connection recovery openai/openai-node
openai-node gained an opt-in bounded reconnection mode that reuses the shared WebSocket controller for both the ws and native WebSocket paths, with current behavior kept as the default. If you have written your own Realtime reconnect loop, this is the alternative to compare rather than adopt blind: the SDK only takes over when you ask it to.
fix(api): preserve large WebSocket messages and default compression off openai/openai-node
Native Node WebSocket connections no longer enable compression implicitly across Realtime, Live, and Responses, and large messages are allowed by default while caller-selected receive limits are preserved. The release notes acknowledge the tradeoff: disabling compression can increase network usage. Explicit perMessageDeflate settings still apply.
fix(realtime): honor native options for legacy beta sockets openai/openai-python
Legacy beta.realtime.connect() inherited a 1 MiB native receive limit, so a larger event closed the connection with code 1009 unless callers had already set max_size=None. The synchronous option type also advertised write_limit, which only native async connections support.
fix: preserve declared aliases during Pydantic v1 validation openai/openai-python
Under Pydantic v1, a valid Responses function call carrying both "async": true and an extra "async_": "future" could have the validated boolean replaced by the extra value, and nested SDK models with other aliased fields were exposed the same way. The fix preserves the declared wire field during validation.
feat: add Vertex AI support for the Responses API openai/openai-node
Alongside: the Node SDK added a vertex(...) entry point onto the standard OpenAI client for calling the Responses API through Google Vertex AI, with Application Default Credentials, an existing Google auth client, or an application-managed bearer token, and google-auth-library kept optional; Codex added RuntimeAuthProvider with dual_header and assertion_only modes, made injected input interrupt...
$ ls openai/week/ # the briefings behind this review
Keep up with OpenAI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.