chore(deps): update dependency openai to v7.10.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	OpenSSF
openai	dependencies	minor	7.5.0 → 7.10.0	7.12.1
openai	devDependencies	minor	7.5.0 → 7.10.0	7.12.1

---

Release Notes

openai/openai-node (openai)

v7.10.0

Compare Source

Features

• api: add gpt-6-astra and related features (#​2582) (94ecdc4)

Documentation

• add canonical SDK security model (#​2566) (e6a7468)

v7.9.0

Compare Source

Features

• api: update usage APIs and documentation (#​2565) (4908505)

Bug Fixes

• api: prevent Responses WebSockets from following redirects (#​2513) (0a4fb1b)
• load CommonJS under browser export conditions (#​2507) (222f3d7)
• restore monthly Node version review (#​2553) (15dc890)
• support Jest 28 CommonJS package imports (#​2511) (eea2292)

Chores

• deps-dev: bump browserslist to 4.28.7 across ecosystem tests (#​2554) (a408e0b)
• raise custom-code budget to 4,000 lines (#​2562) (82c5b2d)

v7.8.0

Compare Source

Features

• api: add compute_units to Responses and Chat Completions usage (#​2505) (f9b1313)
• api: add default WebSocket User-Agent and audit log events (#​2504) (9b2f089)

Bug Fixes

• auth: clamp the workload-identity refresh buffer to the token lifetime (#​2490) (76b73a9)
• auth: secure first-class X.509 workload credentials (#​2479) (1b36c19)
• deps: harden dependency and release boundaries (#​2484) (b21ff45)
• events: settle WebSocket waiters when listeners throw (#​2491) (b5a13a7)
• restore native browser ESM imports (#​2495) (c8cab1e)
• uploads: detect multipart bodies from own properties only (#​2492) (559ffc8)

v7.7.0

Compare Source

Features

• api: make function call output call IDs optional (#​2488) (b932ae6)

Bug Fixes

• streaming: honor cancellation while decoding SSE responses (#​2487) (ababe12)

v7.6.0

Compare Source

Features

• api: Add obfuscation field to ChatCompletionChunk (#​2423) (39afa3a)
• api: Add project residency and usage quantity_unit fields (#​2461) (26d8158)
• api: support backend-mediated Realtime WebRTC calls (#​2469) (0d12ca8)
• auth: add pinned X.509 workload token exchange (#​2470) (9dd8648)
• auth: attest cross-module X.509 transport capabilities (#​2471) (c6769fa)
• auth: harden X.509 token lifecycle and tenant isolation (#​2473) (6992683)
• auth: integrate attested X.509 workload identity into clients (#​2472) (ee5229b)
• support named data-residency endpoints (#​2393) (62d98dd)

Bug Fixes

• [responses] Avoid quadratic comparisons when accumulating long text (#​2434) (95628ce)
• assistants: reject run-step identity hijacking before tool callbacks (#​2476) (63b1c75)
• audio: preserve recording outcomes during cancellation and cleanup (#​2482) (dafcac4)
• auth: honor an explicit zero GCP metadata timeout (#​2481) (7a9dec8)
• auth: sanitize malformed Azure IMDS token responses (#​2427) (bbfb792)
• auth: sanitize malformed workload OAuth token responses (#​2468) (cd5b2d8)
• avoid double-counting logprobs in streamed chat completions (#​2444) (ddf9922)
• bedrock: honor cancellation during bearer credential resolution (#​2478) (2dac2f4)
• drain tee stream queues in linear time (#​2379) (1f3ce07)
• polling: honor cancellation during polling delays (#​2477) (520d604)
• preserve large streaming responses (#​2433) (4e588c2)
• preserve multipart upload array order (#​2380) (f1a2b61)
• publish Castiron checks for behind-main pull requests (#​2486) (662bb37)
• publish Castiron checks for external-fork pull requests (#​2464) (a90581e)
• security: abort streaming examples when clients disconnect (#​2426) (b32a25b)
• security: authenticate Cloudflare tests and restrict streaming proxies (#​2413) (9286fdb)
• security: authenticate Vercel ecosystem APIs and clean up uploaded files (#​2412) (d58608a)
• security: bound SDK event streams and validate streamed item identities (#​2415) (7df29a9)
• security: bound SSE frames and NDJSON lines before buffering (#​2411) (0e250a4)
• security: close rejected Azure managed-identity response streams (#​2416) (387bbc8)
• security: harden Bedrock regions, query merges, and upload errors (#​2410) (ce45d0d)
• security: harden Realtime WebSocket origins, worker guards, and Azure credentials (#​2414) (5533f73)
• security: preserve chat structured response-format integrity (#​2402) (e69df93)
• security: prevent AssistantStream deltas leaking sensitive data (#​2392) (17cf54c)
• security: prevent streaming upload filename path disclosure (#​2386) (c88a024)
• security: prevent structured-output format downgrade (#​2394) (dd945e6)
• security: redact built-in structured JSON parse errors (#​2418) (a0d68cc)
• security: redact chat completion finalization snapshots (#​2400) (fb5d8e7)
• security: redact GCP metadata authentication error bodies (#​2399) (322840c)
• security: redact invalid Bedrock bearer credentials (#​2419) (39c06d1)
• security: redact invalid workload identity access tokens (#​2425) (0d28da3)
• security: redact malformed NDJSON stream diagnostics (#​2420) (dcc705c)
• security: redact malformed Realtime WebSocket error causes (#​2408) (e7a1a44)
• security: redact malformed SSE diagnostic payloads (#​2403) (272a2cc)
• security: redact sensitive assistant delta diagnostics (#​2406) (b130b83)
• security: redact unsupported Responses stream event payloads (#​2395) (32b2953)
• security: reject malformed Realtime WebSocket event frames (#​2391) (e6e11b0)
• security: require an exact SSE completion sentinel (#​2422) (a905bfb)
• security: require OIDC for npm publishing (#​2404) (342764b)
• security: respect configured logger for Assistants stream errors (#​2390) (8ba3009)
• security: restrict live CI credentials to protected main (#​2405) (3554cdc)
• security: scope Cloudflare ecosystem API key files (#​2398) (4f4b45d)
• security: secure Next.js Edge streaming example requests (#​2424) (861caed)
• security: stop delayed and additional tool callbacks after cancellation (#​2430) (c168599)
• security: stop retaining sensitive assistant stream events (#​2407) (dfec129)
• settle concurrent stream event waiters in linear time (#​2387) (a88c2ca)
• settle WebSocket event waiters in linear time (#​2389) (489dc72)
• standard-schema: preserve validator bindings across helpers (#​2483) (e4afdb7)
• streaming: reject named SSE provider error events (#​2409) (b7a0bd6)
• tests: make credential-lifecycle held-inode scenarios portable to macOS (#​2480) (60f5267)
• uploads: preserve Blob files and multipart media types (#​2467) (d497fb3)
• webhooks: bound signature verification work (#​2475) (05cf7ab)
• ws: block custom credential headers on redirects (#​2429) (d2ab6e7)
• zod: support only provably JSON-native structured outputs (#​2396) (c3d68e4)

Chores

• api: clarify image transparency and audio delta docs (#​2439) (f14e885)
• api: document supported image generation models (#​2432) (0e00909)
• api: update SDK generation metadata (#​2448) (d1410d1)
• deps-dev: bump @​cloudflare/workers-types from 5.20260809.1 to 5.20260816.1 in /ecosystem-tests/cloudflare-worker (#​2452) (cf7e588)
• deps-dev: bump @​smithy/hash-node from 4.4.16 to 4.5.2 (#​2455) (342b0a3)
• deps-dev: bump @​smithy/signature-v4 from 5.6.12 to 5.7.2 (#​2459) (bf4386c)
• deps-dev: bump publint from 0.3.22 to 0.3.23 (#​2457) (c100c83)
• deps-dev: bump puppeteer from 25.5.0 to 25.7.0 in /ecosystem-tests/browser-direct-import (#​2451) (c6c406b)
• deps-dev: bump puppeteer from 25.5.0 to 25.7.0 in /ecosystem-tests/ts-browser-webpack (#​2456) (e1faab1)
• deps-dev: bump ws from 8.21.1 to 8.21.3 (#​2454) (1f84889)
• deps: bump next from 15.5.21 to 15.5.23 in /ecosystem-tests/vercel-edge (#​2458) (cc532b3)
• deps: bump next from 16.3.0 to 16.3.1 (#​2460) (a2d88c1)
• set a 3,000-line custom-code budget (#​2446) (2035847)

Documentation

• encode recurring SDK review feedback in agent guidance (#​2378) (e552523)
• security: add secure contributor and agent guidance (#​2382) (459d009)

Refactors

• move embedding encoding into an SDK-owned helper (#​2436) (db9e930)
• move file processing wait into an SDK-owned helper (#​2438) (3d39e64)
• move vector store batch uploads into an SDK-owned helper (#​2441) (0257e51)
• move vector store polling into an SDK-owned helper (#​2437) (4317319)
• move webhook signature checks into an SDK-owned helper (#​2442) (283e12b)
• share SDK-owned assistant run polling (#​2440) (4de295b)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.