release: 7.6.0

[openai-sdks]

Automated Release PR

7.6.0 (2026-08-26)

Features

• api: Add obfuscation field to ChatCompletionChunk (#2423) (39afa3a)
• api: Add project residency and usage quantity_unit fields (#2461) (26d8158)
• api: support backend-mediated Realtime WebRTC calls (#2469) (0d12ca8)
• auth: add pinned X.509 workload token exchange (#2470) (9dd8648)
• auth: attest cross-module X.509 transport capabilities (#2471) (c6769fa)
• auth: harden X.509 token lifecycle and tenant isolation (#2473) (6992683)
• auth: integrate attested X.509 workload identity into clients (#2472) (ee5229b)
• support named data-residency endpoints (#2393) (62d98dd)

Bug Fixes

• [responses] Avoid quadratic comparisons when accumulating long text (#2434) (95628ce)
• assistants: reject run-step identity hijacking before tool callbacks (#2476) (63b1c75)
• audio: preserve recording outcomes during cancellation and cleanup (#2482) (dafcac4)
• auth: honor an explicit zero GCP metadata timeout (#2481) (7a9dec8)
• auth: sanitize malformed Azure IMDS token responses (#2427) (bbfb792)
• auth: sanitize malformed workload OAuth token responses (#2468) (cd5b2d8)
• avoid double-counting logprobs in streamed chat completions (#2444) (ddf9922)
• bedrock: honor cancellation during bearer credential resolution (#2478) (2dac2f4)
• drain tee stream queues in linear time (#2379) (1f3ce07)
• polling: honor cancellation during polling delays (#2477) (520d604)
• preserve large streaming responses (#2433) (4e588c2)
• preserve multipart upload array order (#2380) (f1a2b61)
• publish Castiron checks for behind-main pull requests (#2486) (662bb37)
• publish Castiron checks for external-fork pull requests (#2464) (a90581e)
• security: abort streaming examples when clients disconnect (#2426) (b32a25b)
• security: authenticate Cloudflare tests and restrict streaming proxies (#2413) (9286fdb)
• security: authenticate Vercel ecosystem APIs and clean up uploaded files (#2412) (d58608a)
• security: bound SDK event streams and validate streamed item identities (#2415) (7df29a9)
• security: bound SSE frames and NDJSON lines before buffering (#2411) (0e250a4)
• security: close rejected Azure managed-identity response streams (#2416) (387bbc8)
• security: harden Bedrock regions, query merges, and upload errors (#2410) (ce45d0d)
• security: harden Realtime WebSocket origins, worker guards, and Azure credentials (#2414) (5533f73)
• security: preserve chat structured response-format integrity (#2402) (e69df93)
• security: prevent AssistantStream deltas leaking sensitive data (#2392) (17cf54c)
• security: prevent streaming upload filename path disclosure (#2386) (c88a024)
• security: prevent structured-output format downgrade (#2394) (dd945e6)
• security: redact built-in structured JSON parse errors (#2418) (a0d68cc)
• security: redact chat completion finalization snapshots (#2400) (fb5d8e7)
• security: redact GCP metadata authentication error bodies (#2399) (322840c)
• security: redact invalid Bedrock bearer credentials (#2419) (39c06d1)
• security: redact invalid workload identity access tokens (#2425) (0d28da3)
• security: redact malformed NDJSON stream diagnostics (#2420) (dcc705c)
• security: redact malformed Realtime WebSocket error causes (#2408) (e7a1a44)
• security: redact malformed SSE diagnostic payloads (#2403) (272a2cc)
• security: redact sensitive assistant delta diagnostics (#2406) (b130b83)
• security: redact unsupported Responses stream event payloads (#2395) (32b2953)
• security: reject malformed Realtime WebSocket event frames (#2391) (e6e11b0)
• security: require an exact SSE completion sentinel (#2422) (a905bfb)
• security: require OIDC for npm publishing (#2404) (342764b)
• security: respect configured logger for Assistants stream errors (#2390) (8ba3009)
• security: restrict live CI credentials to protected main (#2405) (3554cdc)
• security: scope Cloudflare ecosystem API key files (#2398) (4f4b45d)
• security: secure Next.js Edge streaming example requests (#2424) (861caed)
• security: stop delayed and additional tool callbacks after cancellation (#2430) (c168599)
• security: stop retaining sensitive assistant stream events (#2407) (dfec129)
• settle concurrent stream event waiters in linear time (#2387) (a88c2ca)
• settle WebSocket event waiters in linear time (#2389) (489dc72)
• standard-schema: preserve validator bindings across helpers (#2483) (e4afdb7)
• streaming: reject named SSE provider error events (#2409) (b7a0bd6)
• tests: make credential-lifecycle held-inode scenarios portable to macOS (#2480) (60f5267)
• uploads: preserve Blob files and multipart media types (#2467) (d497fb3)
• webhooks: bound signature verification work (#2475) (05cf7ab)
• ws: block custom credential headers on redirects (#2429) (d2ab6e7)
• zod: support only provably JSON-native structured outputs (#2396) (c3d68e4)

Chores

• api: clarify image transparency and audio delta docs (#2439) (f14e885)
• api: document supported image generation models (#2432) (0e00909)
• api: update SDK generation metadata (#2448) (d1410d1)
• deps-dev: bump @cloudflare/workers-types from 5.20260809.1 to 5.20260816.1 in /ecosystem-tests/cloudflare-worker (#2452) (cf7e588)
• deps-dev: bump @smithy/hash-node from 4.4.16 to 4.5.2 (#2455) (342b0a3)
• deps-dev: bump @smithy/signature-v4 from 5.6.12 to 5.7.2 (#2459) (bf4386c)
• deps-dev: bump publint from 0.3.22 to 0.3.23 (#2457) (c100c83)
• deps-dev: bump puppeteer from 25.5.0 to 25.7.0 in /ecosystem-tests/browser-direct-import (#2451) (c6c406b)
• deps-dev: bump puppeteer from 25.5.0 to 25.7.0 in /ecosystem-tests/ts-browser-webpack (#2456) (e1faab1)
• deps-dev: bump ws from 8.21.1 to 8.21.3 (#2454) (1f84889)
• deps: bump next from 15.5.21 to 15.5.23 in /ecosystem-tests/vercel-edge (#2458) (cc532b3)
• deps: bump next from 16.3.0 to 16.3.1 (#2460) (a2d88c1)
• set a 3,000-line custom-code budget (#2446) (2035847)

Documentation

• encode recurring SDK review feedback in agent guidance (#2378) (e552523)
• security: add secure contributor and agent guidance (#2382) (459d009)

Refactors

• move embedding encoding into an SDK-owned helper (#2436) (db9e930)
• move file processing wait into an SDK-owned helper (#2438) (3d39e64)
• move vector store batch uploads into an SDK-owned helper (#2441) (0257e51)
• move vector store polling into an SDK-owned helper (#2437) (4317319)
• move webhook signature checks into an SDK-owned helper (#2442) (283e12b)
• share SDK-owned assistant run polling (#2440) (4de295b)

---

This PR was generated with Release Please. See documentation.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-26T21:47:29.693155Z	f513ff5	Draft marked ready
🔒 Security Review	✅ Completed 2026-08-26T21:46:34.903427Z	f513ff5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 10.033s for Node SDK PR #2381.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	194ms
tests/chat-completions-create.test.ts	✅ Passed	211ms
tests/chat-completions-stream.test.ts	✅ Passed	129ms
tests/files-content-binary.test.ts	✅ Passed	128ms
tests/files-create-multipart.test.ts	✅ Passed	155ms
tests/files-list-pagination.test.ts	✅ Passed	136ms
tests/initialize-config.test.ts	✅ Passed	153ms
tests/instance-isolation.test.ts	✅ Passed	100ms
tests/models-list.test.ts	✅ Passed	136ms
tests/responses-background-lifecycle.test.ts	✅ Passed	196ms
tests/responses-body-method-errors.test.ts	✅ Passed	284ms
tests/responses-cancel-timeout.test.ts	✅ Passed	195ms
tests/responses-cancel.test.ts	✅ Passed	192ms
tests/responses-compact-retries.test.ts	✅ Passed	248ms
tests/responses-compact.test.ts	✅ Passed	238ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	107ms
tests/responses-create-advanced.test.ts	✅ Passed	210ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.113s
tests/responses-create-errors.test.ts	✅ Passed	206ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	145ms
tests/responses-create-retries.test.ts	✅ Passed	229ms
tests/responses-create-stream-failures.test.ts	✅ Passed	201ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	2.15s
tests/responses-create-stream-wire.test.ts	✅ Passed	2.416s
tests/responses-create-stream.test.ts	✅ Passed	84ms
tests/responses-create-terminal-states.test.ts	✅ Passed	243ms
tests/responses-create-timeout.test.ts	✅ Passed	212ms
tests/responses-create.test.ts	✅ Passed	184ms
tests/responses-delete.test.ts	✅ Passed	210ms
tests/responses-input-items-errors.test.ts	✅ Passed	185ms
tests/responses-input-items-list.test.ts	✅ Passed	170ms
tests/responses-input-items-options.test.ts	✅ Passed	101ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	222ms
tests/responses-input-tokens-count.test.ts	✅ Passed	311ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.058s
tests/responses-not-found-errors.test.ts	✅ Passed	256ms
tests/responses-parse.test.ts	✅ Passed	168ms
tests/responses-retrieve-retries.test.ts	✅ Passed	294ms
tests/responses-retrieve.test.ts	✅ Passed	238ms
tests/responses-stored-method-errors.test.ts	✅ Passed	528ms
tests/retry-behavior.test.ts	✅ Passed	3.057s
tests/sdk-error-shape.test.ts	✅ Passed	284ms

View OkTest run #33016815063

_{SDK merge (a1b0518cb355) · head (f513ff5dee7a) · base (cd5b2d8b4b1e) · OkTest (2b1bdfd25e98)}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f513ff5dee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Include the caller-attested transport feature

The release range includes 01a15bd, which introduced the public openai/auth/x509-transport entrypoint and createX509Transport, but this feature is absent from the 7.6.0 changelog while the subsequent X.509 commits are listed. Users upgrading to 7.6.0 therefore have no release-note indication that this new entrypoint and its optional undici integration are available; add the omitted feature entry.

AGENTS.md reference: AGENTS.md:L72-L74

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Remove the reverted streaming-limit entry

This entry claims that 7.6.0 bounds SSE frames and NDJSON lines, but later commit 4e588c2 in the same release explicitly removed those unreleased 8 MiB limits and their OPENAI_MAX_SSE_EVENT_BYTES and OPENAI_MAX_NDJSON_LINE_BYTES controls to preserve valid large responses. Leaving the superseded entry falsely documents a security behavior that the released code does not provide and directly conflicts with the large-payload contract; remove this entry rather than advertising both changes.

AGENTS.md reference: AGENTS.md:L124-L133

Useful? React with 👍 / 👎.

[openai-sdks]

🤖 Created releases:

• v7.6.0

🌻