Python: allow OpenAI SDK 3.x

[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

The shipped Python integrations that directly depend on the OpenAI SDK currently cap it below 3. This prevents them from being installed with dependencies such as azure-ai-projects 2.5.0, which requires OpenAI 3.x.

This change widens the supported OpenAI range while retaining the existing package floors and preserving behavior across the Responses, Chat Completions, Embeddings, Azure OpenAI, DevUI, and hosting-responses surfaces.

Description & Review Guide

• What are the major changes? Raise direct OpenAI SDK upper bounds to <4 in agent-framework-openai, DevUI, hosting-responses, and the Hyperlight CodeAct sample; make feature-usage request handling work with the SDK-selected httpx or httpx2 transport without directly depending on either; suppress Azure API-key environment fallback when an explicit credential supplies a token provider; keep prompt-cache capability typing compatible with OpenAI 2.25.0; and add lock-bypassing CI lanes for each shipped OpenAI consumer on OpenAI 3.0.0 while retaining the 2.25.0 integration floor lane.
• What is the impact of these changes? Applications can use the affected packages with OpenAI SDK 3.x. Existing lower bounds remain unchanged, API-key and credential flows retain their documented precedence, and both supported SDK majors are exercised in PR CI.
• What do you want reviewers to focus on? The transport-neutral feature hook, explicit Azure credential precedence in _shared.py, broadened dependency declarations, and the dependency-bound CI lanes.

Related Issue

N/A

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Pull request overview

Expands agent-framework-openai compatibility to OpenAI SDK 3.x and adapts transport, authentication, and prompt-cache handling.

Changes:

• Raises the OpenAI dependency ceiling to <4.
• Makes feature-usage hooks transport-neutral.
• Updates Azure credential precedence and prompt-cache compatibility logic.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
python/uv.lock	Updates locked dependency metadata.
python/packages/openai/pyproject.toml	Allows OpenAI SDK 3.x.
python/packages/openai/agent_framework_openai/_shared.py	Updates response imports and Azure authentication selection.
python/packages/openai/agent_framework_openai/_feature_usage.py	Removes the direct httpx dependency.
python/packages/openai/agent_framework_openai/_chat_client.py	Adds version-neutral prompt-cache typing.
python/packages/openai/agent_framework_openai/_chat_completion_client.py	Adds version-neutral prompt-cache typing.
python/packages/openai/tests/openai/test_openai_shared.py	Builds requests through the selected transport.
python/packages/openai/tests/openai/test_openai_chat_client.py	Stabilizes prompt-cache capability testing.
python/packages/openai/tests/openai/test_openai_chat_completion_client.py	Stabilizes prompt-cache capability testing.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/openai/agent_framework_openai
_chat_client.py	1424	114	91%	355, 368, 722–728, 737–740, 746–750, 758, 802–807, 811–814, 816–818, 825–827, 830, 908, 916, 939, 1156, 1215, 1217, 1219, 1221, 1287, 1301, 1381, 1391, 1396, 1439, 1551–1552, 1567, 1846, 1958, 1963–1964, 2047, 2057, 2084, 2090, 2100, 2106, 2111, 2117, 2122–2123, 2203, 2247, 2250–2253, 2267, 2277–2278, 2290, 2397, 2414, 2417, 2444–2446, 2485, 2502, 2505, 2567, 2574, 2611–2612, 2653, 2691–2692, 2710–2711, 2883–2884, 2902, 2936, 3009–3012, 3196, 3211, 3300–3302, 3312–3313, 3319, 3334, 3467–3468
_chat_completion_client.py	452	21	95%	533, 627, 634–635, 639, 664, 839, 927, 929, 934, 937, 997, 1065, 1082, 1104, 1112, 1136, 1149, 1182, 1205, 1548
_feature_usage.py	27	0	100%
_shared.py	167	16	90%	246, 265–267, 279, 289, 306, 310, 333, 337, 371–372, 391, 410–411, 413
TOTAL	48411	4503	90%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9858	36 💤	0 ❌	0 🔥	2m 48s ⏱️

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (2 commit(s)): 875a4e62b487, 2b006a4123a7
Model: gpt-5.6-sol

Overview

The PR widens OpenAI SDK support to 3.x while adapting feature-usage request handling to the SDK-selected transport, preserving Azure credential precedence, and avoiding imports of optional prompt-cache types. Origin restrictions, explicit unsupported-feature guards, authentication tests, and successful package tests at both dependency boundaries provide strong coverage. No publishable Critical, High, or Medium issue was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.

[github-actions]

MAF Automated Review — Iteration 2

Result: No findings
Scope: 1 net-new commit(s): 681decdd07db
Model: gpt-5.6-sol

Overview

This incremental update suppresses Azure API-key environment fallback when an explicit credential is supplied and adds lock-bypassing CI lanes for the supported OpenAI SDK floors. The outbound-request test verifies bearer-token authentication without an api-key header, while both dependency-bound lanes run the full non-integration package suite and Pyright. No publishable Critical, High, or Medium issue remains in the reviewed range.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.