7.5.0 (2026-08-17)
Features
- add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
- api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
- api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
- api: Add ServiceTier and ImageDetail types (#2364) (602d481)
- api: add WebSocket stream IDs (#2314) (156a8db)
- api: add workload identity access token issued event (#2307) (322a5b1)
- api: deprecate Sora video APIs (#2313) (4424b40)
- api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)
Bug Fixes
- api: clarify audio upload metadata requirements (#2279) (34ecf3f)
- audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
- audio: reject ffplay spawn errors (#2012) (6d42d4d)
- auth: reject redirects during workload identity token exchange (#2321) (240385e)
- auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
- avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
- await webhook verification in README examples (#2302) (0fe7ad0)
- azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
- azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
- azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
- azure: prevent deployment path traversal (#2337) (a9d9d41)
- bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
- chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
- client: handle empty JSON response body without content-length (#1998) (b6447e9)
- configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
- deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
- embedding: response type for base64 encoding format (#1554) (ef69801)
- export AzureClientOptions (#1760) (511bf6d), closes #1735
- export workload identity helpers from openai/auth (#2344) (af8f14f)
- fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
- format: restore formatting for generated SDK files (#2089) (6d69d4b)
- harden runTools against inherited function names (#2333) (f4496d1)
- honor defaultHeaders null for helper method header (#1857) (8eab09a)
- include items for strict Zod v3 any arrays (#2357) (4c32089)
- isolate Vercel ecosystem tests per request (#2359) (2831290)
- keep streamed Responses output text linear and canonical (#2354) (6827a40)
- lint: recognize Castiron-generated headers (#2124) (cf6237f)
- lint: restore generated SDK lint rules (#2126) (6b8162c)
- parse empty chat content when present (#2331) (53dd723)
- parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
- pass file batch helper options through (#1855) (05ce028)
- preserve File-like metadata in toFile (#1883) (ba1a781)
- preserve skill upload paths without buffering native files (#2303) (30b9c41)
- preserve Skills upload file paths (#1856) (e75de97)
- preserve zero retry-after-ms precedence (#2329) (b44644e)
- prevent prototype event names from crashing SDK streams (#2315) (c014250)
- prevent prototype manipulation in strict Structured Outputs schemas (#2341) (838de7e)
- prevent prototype pollution in assistant stream deltas (#2280) (928fa2b)
- realtime: allow overriding WebSocket connection URLs (#2308) (7407413), closes #2305
- realtime: enforce Azure browser denial and redact all credentials (#2340) (a77861d)
- realtime: prevent Azure API-key disclosure across WebSocket redirects (#2325) (d5a1a1e)
- realtime: prevent remote error payloads from crashing clients (#2350) (896f021)
- realtime: remove immutable model updates from public and Azure examples (#2327) (08bd80a)
- reject unsupported proto Zod v3 object properties (#2352) (46a8ca0)
- remove vulnerable extract-zip from browser tests (#2312) (567ad4f)
- responses: reject with OpenAIError when the stream emits an error event (#2021) (a54014d)
- responses: validate streaming event indices before array access (#2323) (13eaf1d)
- security: bound untrusted AssistantStream delta array indices (#2326) (afdf5ef)
- security: contain Bedrock credentials to the configured endpoint origin (#2342) (23f0575)
- security: keep browser ecosystem API keys out of navigation URLs (#2353) (1029e82)
- security: prevent Bedrock bearer credential disclosure across redirects (#2377) (bfcccad)
- security: prevent global Array.prototype pollution in chat completion streams (#2318) (486e191)
- security: prevent multipart upload content-type header injection (#2322) (1c0b9ca)
- security: prevent process-wide prototype pollution via assistant stream snapshot IDs (#2316) (21a0653)
- security: prevent prototype manipulation in streamed chat snapshots (#2335) (e81d766)
- security: prevent streaming upload filename/header injection (#2363) (4ba4084)
- streaming: eliminate quadratic EventStream FIFO draining (#2356) (57521a1)
- streaming: eliminate quadratic SSE buffer copying (#2324) (ebdb296)
- streaming: finish SSE streams immediately after [DONE] (#2317) (7722171)
- streaming: handle mixed SSE line endings (#2309) (24d5ada)
- streaming: isolate AssistantStream message and tool-call lifecycles (#2334) (178e85f)
- streaming: make fragmented line decoding amortized linear (#2336) (f32e2df)
- streaming: surface mid-stream errors when iterating buffered streams (#2047) (8cc6cac)
- ws: prevent duplicate listener leaks in Node and browser adapters (#2347) (a032b85)
- zod: preserve literal payloads when escaping schema references (#2351) (8f189f4)
- zod: preserve null literals in Zod v3 JSON schemas (#2355) (ed5c5e6)
- zod: prevent generated definition name collisions (#2346) (0844573)
- zod: reject non-object Zod v3 strict schema roots (#2358) (cc7dbfa)
Chores
- api: update generated SDK attribution (#2125) (cd7c3e5)
- deps-dev: bump @aws-sdk/credential-provider-node from 3.972.47 to 3.972.77 (#2298) (67b581a)
- deps-dev: bump @aws-sdk/credential-provider-node from 3.972.77 to 3.972.78 (#2371) (2cc57c3)
- deps-dev: bump @cloudflare/workers-types from 5.20260710.1 to 5.20260804.1 in /ecosystem-tests/cloudflare-worker (#2283) (c9cdbad)
- deps-dev: bump @cloudflare/workers-types from 5.20260804.1 to 5.20260809.1 in /ecosystem-tests/cloudflare-worker (#2366) (6983363)
- deps-dev: bump @smithy/hash-node from 4.4.15 to 4.4.16 (#2293) (ba2fc9f)
- deps-dev: bump @smithy/protocol-http from 5.4.5 to 5.5.16 (#2289) (81cf407)
- deps-dev: bump @smithy/signature-v4 from 5.4.5 to 5.6.12 (#2294) (c70c34f)
- deps-dev: bump @types/node from 24.12.4 to 26.2.0 (#2370) (50db5db)
- deps-dev: bump html-webpack-plugin from 5.6.7 to 5.6.8 in /ecosystem-tests/ts-browser-webpack (#2367) (7259f9f)
- deps-dev: bump iconv-lite from 0.6.3 to 0.7.3 (#2299) (7cfb7f3)
- deps-dev: bump oxfmt from 0.61.0 to 0.62.0 (#2373) (16172a4)
- deps-dev: bump signal-exit from 3.0.7 to 4.1.0 (#2296) (9dac77d)
- deps-dev: bump start-server-and-test from 3.0.11 to 3.0.12 in /ecosystem-tests/vercel-edge (#2369) (9ff1aff)
- deps-dev: bump superstruct from 1.0.4 to 2.0.2 (#2285) (190d58c)
- deps-dev: bump ts-jest from 29.4.11 to 29.4.12 (#2374) (6320b64)
- deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/cloudflare-worker (#2284) (9230649)
- deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/node-ts-cjs (#2287) (a4b36bd)
- deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/node-ts-cjs-web (#2288) (25d94fa)
- deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/node-ts-esm (#2290) (9b33e5e)
- deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/node-ts-esm-auto (#2291) (1579ae0)
- deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/node-ts-esm-web (#2292) (6449a74)
- deps-dev: bump ts-jest from 29.4.11 to 29.4.12 in /ecosystem-tests/vercel-edge (#2295) (93096e2)
- deps-dev: bump ultracite from 7.8.4 to 7.10.0 (#2300) (8a7508c)
- deps-dev: bump webpack from 5.108.4 to 5.109.2 in /ecosystem-tests/ts-browser-webpack (#2368) (b49b227)
- deps-dev: bump wrangler from 4.110.0 to 4.118.0 in /ecosystem-tests/cloudflare-worker (#2286) (1c46aad)
- deps-dev: bump wrangler from 4.118.0 to 4.120.0 in /ecosystem-tests/cloudflare-worker (#2365) (01fae5e)
- limit Dependabot to 10 open pull requests (#2297) (b05dd10)
- lint: enable array-callback-return (#2104) (44fac0d)
- lint: enable arrow-body-style (#2238) (0a78d59)
- lint: enable class-methods-use-this (#2215) (cc73167)
- lint: enable complexity (#2230) (44004d6)
- lint: enable curly (#2275) (ac6d82f)
- lint: enable default-case (#2222) (037545a)
- lint: enable eqeqeq (#2259) (8e8fb1c)
- lint: enable func-name-matching (#2225) (a299c40)
- lint: enable func-names (#2274) (3055ccc)
- lint: enable guard-for-in (#2140) (1e2a7f4)
- lint: enable import/consistent-type-specifier-style (#2265) (559b8d0)
- lint: enable import/first (#2192) (bc116ec)
- lint: enable import/namespace (#2090) (31d8c66)
- lint: enable import/newline-after-import (#2174) (b2f57eb)
- lint: enable import/no-cycle (#2268) (5b1f37c)
- lint: enable import/no-duplicates (#2081) (44df76a)
- lint: enable import/no-mutable-exports (#2105) (9399d4c)
- lint: enable import/no-named-as-default-member (#2091) (bff8c24)
- lint: enable import/no-self-import (#2092) (38acc27)
- lint: enable jsdoc/check-property-names (#2093) (689aef6)
- lint: enable jsdoc/check-tag-names (#2147) (f7e60a9)
- lint: enable jsdoc/empty-tags (#2094) (d653124)
- lint: enable jsdoc/no-defaults (#2208) (fd5d85a)
- lint: enable jsdoc/require-param-description (#2209) (0ca3b41)
- lint: enable jsdoc/require-property-description (#2095) (2832fef)
- lint: enable jsdoc/require-property-name (#2096) (27c46d7)
- lint: enable jsdoc/require-property-type (#2097) (a1b69cd)
- lint: enable jsdoc/require-returns-description (#2106) (9aefc9e)
- lint: enable jsdoc/require-throws-description (#2098) (693dc5a)
- lint: enable jsdoc/require-throws-type (#2099) (2569734)
- lint: enable jsdoc/require-yields (#2137) (9aba641)
- lint: enable jsdoc/require-yields-description (#2100) (be49a47)
- lint: enable logical-assignment-operators (#2175) (35dbf46)
- lint: enable max-classes-per-file (#2197) (90a4982)
- lint: enable no-await-in-loop (#2256) (40da819)
- lint: enable no-bitwise (#2249) (6ac6d6d)
- lint: enable no-case-declarations (#2176) (181adc9)
- lint: enable no-duplicate-imports (#2082) (3ea6880)
- lint: enable no-else-return (#2181) (da60bda)
- lint: enable no-empty (#2146) (8862525)
- lint: enable no-empty-function (#2203) (75459e6)
- lint: enable no-eq-null (#2253) (18253be)
- lint: enable no-extend-native (#2107) (2e41934)
- lint: enable no-fallthrough (#2134) (f40eb23)
- lint: enable no-inline-comments (#2263) (3485404)
- lint: enable no-inner-declarations (#2198) (7c3fa63)
- lint: enable no-lonely-if (#2145) (e114825)
- lint: enable no-loop-func (#2108) (6f04bf0)
- lint: enable no-multi-assign (#2136) (dfe0fc6)
- lint: enable no-negated-condition (#2199) (b560532)
- lint: enable no-nested-ternary (#2223) (48d3c80)
- lint: enable no-new-wrappers (#2141) (4051f9f)
- lint: enable no-param-reassign (#2231) (7db898d)
- lint: enable no-plusplus (#2260) (570686e)
- lint: enable no-promise-executor-return (#2234) (381697a)
- lint: enable no-prototype-builtins (#2084) (dcdd7f1)
- lint: enable no-regex-spaces (#2077) (82d4671)
- lint: enable no-sequences (#2123) (33b07fc)
- lint: enable no-shadow (#2241) (602bc22)
- lint: enable no-sparse-arrays (#2235) (baf2e10)
- lint: enable no-template-curly-in-string (#2071) (3be6bc8)
- lint: enable no-throw-literal (#2149) (71bc2a6)
- lint: enable no-unmodified-loop-condition (#2109) (0cd20f7)
- lint: enable no-unsafe-optional-chaining (#2182) (2e88b45)
- lint: enable no-unused-vars (#2257) (d13da1d)
- lint: enable no-use-before-define (#2276) (246cd5f)
- lint: enable no-useless-concat (#2171) (582af5b)
- lint: enable no-useless-constructor (#2072) (04ab85b)
- lint: enable no-useless-escape (#2148) (bf154b5)
- lint: enable no-useless-rename (#2076) (84df305)
- lint: enable no-useless-return (#2177) (da234df)
- lint: enable no-var (#2258) (efc4c01)
- lint: enable no-warning-comments (#2200) (e061fc2)
- lint: enable node/callback-return (#2101) (2176c4e)
- lint: enable node/global-require (#2213) (3683c1d)
- lint: enable object-shorthand (#2237) (c2f448b)
- lint: enable oxc/no-accumulating-spread (#2201) (6f657c4)
- lint: enable oxc/no-barrel-file (#2183) (700f6f0)
- lint: enable prefer-arrow-callback (#2273) (d430d32)
- lint: enable prefer-const (#2085) (3c261d3)
- lint: enable prefer-destructuring (#2264) (afa0c8c)
- lint: enable prefer-exponentiation-operator (#2073) (10af170)
- lint: enable prefer-named-capture-group (#2246) (3989eed)
- lint: enable prefer-object-has-own (#2210) (f6c50d2)
- lint: enable prefer-object-spread (#2078) (127d266)
- lint: enable prefer-regex-literals (#2110) (a6cbb45)
- lint: enable prefer-template (#2266) (84e6741)
- lint: enable promise/avoid-new (#2245) (6d8ac0c)
- lint: enable promise/param-names (#2166) (7a29da3)
- lint: enable promise/prefer-await-to-callbacks (#2224) (53ab08d)
- lint: enable promise/prefer-await-to-then (#2232) (d0eeccf)
- lint: enable promise/prefer-catch (#2111) (fb3406a)
- lint: enable radix (#2083) (a205dff)
- lint: enable require-await (#2271) (d687018)
- lint: enable require-unicode-regexp (#2269) (1299a38)
- lint: enable typescript/array-type (#2250) (c769c3d)
- lint: enable typescript/ban-ts-comment (#2261) (6f395e4)
- lint: enable typescript/ban-types (#2211) (01a28d0)
- lint: enable typescript/consistent-generic-constructors (#2080) (f69b229)
- lint: enable typescript/consistent-indexed-object-style (#2216) (467336c)
- lint: enable typescript/consistent-type-definitions (#2262) (94445b1)
- lint: enable typescript/consistent-type-imports (#2272) (259b978)
- lint: enable typescript/method-signature-style (#2248) (fd2d250)
- lint: enable typescript/no-dynamic-delete (#2217) (89ef2c4)
- lint: enable typescript/no-empty-interface (#2112) (9522416)
- lint: enable typescript/no-empty-object-type (#2184) (b0f697e)
- lint: enable typescript/no-explicit-any (#2277) (0eae8c6)
- lint: enable typescript/no-extraneous-class (#2113) (509ba3e)
- lint: enable typescript/no-import-type-side-effects (#2227) (2e608ef)
- lint: enable typescript/no-inferrable-types (#2185) (ee0c84c)
- lint: enable typescript/no-invalid-void-type (#2167) (cd2d035)
- lint: enable typescript/no-namespace (#2214) (254364a)
- lint: enable typescript/no-non-null-assertion (#2267) (702cf6d)
- lint: enable typescript/no-this-alias (#2114) (191e1fe)
- lint: enable typescript/no-wrapper-object-types (#2178) (b2e79a9)
- lint: enable typescript/parameter-properties (#2195) (2f5b813)
- lint: enable typescript/prefer-for-of (#2194) (3c6465a)
- lint: enable typescript/prefer-ts-expect-error (#2247) (0dd1882)
- lint: enable typescript/unified-signatures (#2139) (4427bb5)
- lint: enable unicorn/catch-error-name (#2242) (0698eb4)
- lint: enable unicorn/consistent-assert (#2229) (50d46bd)
- lint: enable unicorn/consistent-existence-index-check (#2143) (1828b28)
- lint: enable unicorn/consistent-function-scoping (#2255) (09c4946)
- lint: enable unicorn/custom-error-definition (#2179) (47d4eed)
- lint: enable unicorn/error-message (#2115) (61f47a8)
- lint: enable unicorn/escape-case (#2074) (808929e)
- lint: enable unicorn/filename-case (#2243) (fd8b09d)
- lint: enable unicorn/import-style (#2205) (2e71d00)
- lint: enable unicorn/new-for-builtins (#2190) (5e23c02)
- lint: enable unicorn/no-anonymous-default-export (#2191) (7e84bb2)
- lint: enable unicorn/no-array-for-each (#2206) (af85397)
- lint: enable unicorn/no-array-reduce (#2207) (18d3fdb)
- lint: enable unicorn/no-array-sort (#2189) (dfc05e0)
- lint: enable unicorn/no-await-expression-member (#2218) (d756a97)
- lint: enable unicorn/no-console-spaces (#2226) (9a36d9d)
- lint: enable unicorn/no-hex-escape (#2129) (d395852)
- lint: enable unicorn/no-immediate-mutation (#2116) (b06c584)
- lint: enable unicorn/no-lonely-if (#2172) (3e26105)
- lint: enable unicorn/no-negated-condition (#2202) (e82bd88)
- lint: enable unicorn/no-nested-ternary (#2219) (068015f)
- lint: enable unicorn/no-object-as-default-parameter (#2117) (6ae2ed7)
- lint: enable unicorn/no-thenable (#2118) (0b521ea)
- lint: enable unicorn/no-this-assignment (#2119) (4a4396d)
- lint: enable unicorn/no-typeof-undefined (#2220) (556bb04)
- lint: enable unicorn/no-useless-fallback-in-spread (#2102) (008eebd)
- lint: enable unicorn/no-useless-switch-case (#2168) (5401737)
- lint: enable unicorn/no-useless-undefined (#2239) (12ea4bb)
- lint: enable unicorn/no-zero-fractions (#2075) (ec42da9)
- lint: enable unicorn/numeric-separators-style (#2251) (4fa2035)
- lint: enable unicorn/prefer-at (#2221) (08f37c7)
- lint: enable unicorn/prefer-bigint-literals (#2144) (d272540)
- lint: enable unicorn/prefer-class-fields (#2138) (da7b9f5)
- lint: enable unicorn/prefer-code-point (#2173) (319536a)
- lint: enable unicorn/prefer-dom-node-append (#2131) (1369610)
- lint: enable unicorn/prefer-dom-node-text-content (#2132) (a210c6c)
- lint: enable unicorn/prefer-event-target (#2204) (93e8c79)
- lint: enable unicorn/prefer-includes (#2130) (892eeaf)
- lint: enable unicorn/prefer-logical-operator-over-ternary (#2120) (7373314)
- lint: enable unicorn/prefer-math-trunc (#2103) (1230e64)
- lint: enable unicorn/prefer-module (#2240) (05eaa62)
- lint: enable unicorn/prefer-native-coercion-functions (#2121) (a596287)
- lint: enable unicorn/prefer-node-protocol (#2252) (15009d6)
- lint: enable unicorn/prefer-number-properties (#2180) (9cd0461)
- lint: enable unicorn/prefer-object-from-entries (#2122) (1be3aae)
- lint: enable unicorn/prefer-optional-catch-binding (#2196) (8aa1a3c)
- lint: enable unicorn/prefer-query-selector (#2169) (4c3932e)
- lint: enable unicorn/prefer-regexp-test (#2133) (68df5ae)
- lint: enable unicorn/prefer-response-static-json (#2254) (96859ed)
- lint: enable unicorn/prefer-spread (#2212) (0e1ec6f)
- lint: enable unicorn/prefer-string-replace-all (#2233) (a780b74)
- lint: enable unicorn/prefer-string-slice (#2236) (f3bde9e)
- lint: enable unicorn/prefer-ternary (#2188) (353ef7e)
- lint: enable unicorn/prefer-type-error (#2193) (633512b)
- lint: enable unicorn/require-module-specifiers (#2170) (0876cbd)
- lint: enable unicorn/switch-case-braces (#2270) (f64e5d5)
- lint: enable unicorn/text-encoding-identifier-case (#2244) (420529c)
- lint: enable unicorn/throw-new-error (#2079) (28408f8)
- lint: enable vars-on-top (#2228) (322e4d2)
- lint: enable yoda (#2135) (7eef244)
- remove Stainless attribution from legacy SDK files (#2304) (85f7c6b)
Documentation
- api: describe response stream event unions (#2319) (3f0f688)
- document all handwritten SDK surfaces (#2281) (d9c212a)
- readme: fix links to relocated documentation (#2088) (a82e8de)
Build System
- deps-dev: bump @swc/core from 1.15.40 to 1.15.47 (#2187) (f79329f)
- deps-dev: bump jest and @types/jest (#2157) (55dd17b)
- deps-dev: bump ws from 8.21.0 to 8.21.1 (#2155) (d0e67a9)
- deps-dev: bump yargs from 17.7.2 to 18.1.0 (#2154) (c5f12d1)
- deps: bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/ts-browser-webpack (#2069) (c6e9ba3)
- deps: bump nanoid from 3.3.15 to 3.3.18 in /ecosystem-tests/vercel-edge (#2142) (7b986fc)
- deps: bump next from 15.5.20 to 15.5.21 in /ecosystem-tests/vercel-edge (#2128) (3f8403a)
- deps: bump next from 15.5.21 to 16.2.12 (#2156) (9387d40)
- deps: bump undici from 7.28.0 to 7.29.0 in /ecosystem-tests/node-ts-cjs (#2070) (130b038)
- deps: enforce an eight-day dependency cooldown (#2186) (c052204)