chore(deps): update openai requirement from <3,>=2.52.0 to >=3.6.0,<4

[dependabot]

Updates the requirements on openai to permit the latest version.

Release notes

Sourced from openai's releases.

v3.6.0

3.6.0 (2026-08-27)

Features

• api: add compute_units to Responses and Chat Completions usage (#3749) (52421d1)

Bug Fixes

• auth: harden X.509 workload identity integration (#3740) (fc3ad6c)

Chores

• deps-dev: bump @​stdy/cli from 0.22.1 to 0.22.2 (#3719) (4f5598c)
• deps-dev: bump mypy from 1.17 to 2.3.1 (#3747) (0b52c9e)
• deps-dev: bump pandas-stubs from 2.2.2.240807 to 2.3.3.260113 (#3659) (95f0b43)
• deps-dev: bump pyright from 1.1.399 to 1.1.413 (#3744) (9917c6e)
• deps-dev: bump rich from 14.2.0 to 15.0.0 (#3717) (7a5484d)
• deps: bump actions/checkout from 6.0.2 to 7.0.1 (#3665) (d0a2550)
• deps: bump actions/download-artifact from 6.0.0 to 8.0.1 (#3669) (f627619)
• deps: bump github/codeql-action/init from 4.37.1 to 4.37.7 (#3745) (a36010d)

Build System

• deps: bump actions/setup-python from 5.6.0 to 7.0.0 (#3672) (d765db7)
• deps: bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 (#3666) (dacbb66)

Changelog

Sourced from openai's changelog.

3.6.0 (2026-08-27)

Features

• api: add compute_units to Responses and Chat Completions usage (#3749) (52421d1)

Bug Fixes

• auth: harden X.509 workload identity integration (#3740) (fc3ad6c)

Chores

• deps-dev: bump @​stdy/cli from 0.22.1 to 0.22.2 (#3719) (4f5598c)
• deps-dev: bump mypy from 1.17 to 2.3.1 (#3747) (0b52c9e)
• deps-dev: bump pandas-stubs from 2.2.2.240807 to 2.3.3.260113 (#3659) (95f0b43)
• deps-dev: bump pyright from 1.1.399 to 1.1.413 (#3744) (9917c6e)
• deps-dev: bump rich from 14.2.0 to 15.0.0 (#3717) (7a5484d)
• deps: bump actions/checkout from 6.0.2 to 7.0.1 (#3665) (d0a2550)
• deps: bump actions/download-artifact from 6.0.0 to 8.0.1 (#3669) (f627619)
• deps: bump github/codeql-action/init from 4.37.1 to 4.37.7 (#3745) (a36010d)

Build System

• deps: bump actions/setup-python from 5.6.0 to 7.0.0 (#3672) (d765db7)
• deps: bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 (#3666) (dacbb66)

3.5.0 (2026-08-27)

Features

• api: make function call output call IDs optional (#3738) (c74501d)

3.4.0 (2026-08-25)

Features

• api: Add obfuscation field to ChatCompletionChunk (#3690) (c7d8e1d)
• api: add project residency configuration and cost quantity units (#3726) (bc4f8ef)

Bug Fixes

• api: encode Realtime call offers and session configuration (#3736) (555ac48)
• apply consistent origin checks to WebSocket redirects (#3693) (1b324d0)

... (truncated)

Commits

• 1cfa80a release: 3.6.0 (#3752)
• 9917c6e chore(deps-dev): bump pyright from 1.1.399 to 1.1.413 (#3744)
• 0b52c9e chore(deps-dev): bump mypy from 1.17 to 2.3.1 (#3747)
• 4f5598c chore(deps-dev): bump @​stdy/cli from 0.22.1 to 0.22.2 (#3719)
• 95f0b43 chore(deps-dev): bump pandas-stubs from 2.2.2.240807 to 2.3.3.260113 (#3659)
• a36010d chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.7 (#3745)
• 7a5484d chore(deps-dev): bump rich from 14.2.0 to 15.0.0 (#3717)
• d0a2550 chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 (#3665)
• dacbb66 build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 (#3666)
• d765db7 build(deps): bump actions/setup-python from 5.6.0 to 7.0.0 (#3672)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Review

Single-line change: requirements/base.txt bumps openai from >=2.52.0,<3 to >=3.6.0,<4.

This is a major-version bump (openai 2.x → 3.x), not routine dependabot churn, and it deserves more scrutiny than the diff size suggests:

1. Coupling with pydantic-ai-slim: The very next lines in requirements/base.txt (43-59) carry a long comment explaining that this codebase pins pydantic-ai-slim>=1.107.5,<2 deliberately, and that bumping pydantic-ai is treated as a decision requiring validation against opencontractserver/tests/test_pydantic_ai_factory.py. pydantic_ai.models.openai reaches into openai.types.* internals (chat completion + Responses API shapes), not just the top-level stable client surface. A major SDK bump can change those internal types even when the public client.chat.completions.create(...) surface looks unchanged. Nothing in this PR indicates that pydantic-ai 1.107.5 has been validated against openai 3.x — worth confirming (e.g. check pydantic-ai's own openai dependency spec, and whether their 1.x line has an openai<3 upper bound that would make this combination untested upstream) before merging.

2. This project has been burned by exactly this class of issue before — see CLAUDE.md pitfalls Bump pytz from 2021.3 to 2022.5 #17 (pydantic-ai dataclass-shape assertion breaking at import time on a message-shape change), Bump traefik from v2.9.1 to v2.9.4 in /compose/production/traefik #20 (OpenAI Responses-API routing / orphaned function_call items for reasoning models), and Bump django-debug-toolbar from 3.2.2 to 3.7.0 #21 (tool-call audit log silently missing tools after a framework upgrade). All three are "SDK bump looked safe, broke at runtime" stories. Given that history, I'd treat a green CI resolve/typecheck as necessary but not sufficient here.

3. Suggested validation before merge (beyond pip install resolving cleanly):

   • Run opencontractserver/tests/test_pydantic_ai_factory.py explicitly — it's called out by name as the regression canary for pydantic-ai/openai precedence behavior.
   • Run the LLM/agent test suite that exercises tool calls and streaming against a real or recorded OpenAI backend, plus test_batch_embedding.py (uses openai directly).
   • If feasible, a live smoke test of a chat-completions agent run and a Responses-API (reasoning-model) run, since pitfall Bump traefik from v2.9.1 to v2.9.4 in /compose/production/traefik #20's failure mode is specifically invisible on /v1/chat/completions and only surfaces on the Responses path.

4. Low-risk area: opencontractserver/pipeline/embedders/openai_embedder.py only uses long-stable surface (openai.OpenAI, client.embeddings.create, and the standard openai.AuthenticationError / BadRequestError / RateLimitError / APITimeoutError / APIConnectionError / APIStatusError exception classes). This part is unlikely to be affected by the bump.

5. Minor doc nit: the inline comment on the pin (# ... (pydantic-ai 1.x requires >=2.11.0)) only documents the lower-bound rationale. If this bump is validated and merged, consider adding a short note on why the upper bound moved to <4 (mirroring the multi-line rationale already given for the pydantic-ai pin two lines below), so a future reader doesn't have to re-derive that this was a deliberate, tested decision rather than an unreviewed dependabot auto-merge.

No test coverage was added/changed here (expected for a dependency bump), but given the coupling above, I'd want the existing pydantic-ai/openai-touching tests to be run explicitly against this version rather than relying on typecheck/lint-only CI signal.