chore(deps): Bump openai from 6.39.1 to 7.4.0

[dependabot]

Bumps openai from 6.39.1 to 7.4.0.

Release notes

Sourced from openai's releases.

v7.4.0

7.4.0 (2026-08-03)

Features

• api: Add gpt-5.5 model and tool metadata fields (#2049) (6d8fb53)

Bug Fixes

• defer release PR output parsing (#2052) (395bdde)

Documentation

• add HTTP mTLS transport examples (#2029) (2cc5f96)

Build System

• deps-dev: bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064) (481b325)
• deps-dev: bump @​types/web from 0.0.194 to 0.0.354 (#2061) (f61f267)
• deps-dev: bump publint from 0.2.12 to 0.3.22 (#2058) (823d7df)
• deps: bump dotenv from 16.6.1 to 17.4.2 (#2065) (3576574)
• deps: bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edge (#2050) (590982f)
• deps: bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel-edge (#2056) (4d927de)
• migrate release workflow to upstream release-please (#2048) (d41c272)

v7.3.0

7.3.0 (2026-07-31)

Full Changelog: v7.2.0...v7.3.0

Features

• api: content provenance checks (c6f9339)

Chores

• remove Brewfile setup path (#2031) (6b63159)
• remove JSR publishing (#2037) (b1fc7df)

Documentation

• organize SDK guides and repository metadata (#2032) (275dff4)
• remove root-level provider guides (98a2ae7)

... (truncated)

Changelog

Sourced from openai's changelog.

7.4.0 (2026-08-03)

Features

• api: Add gpt-5.5 model and tool metadata fields (#2049) (6d8fb53)

Bug Fixes

• defer release PR output parsing (#2052) (395bdde)

Documentation

• add HTTP mTLS transport examples (#2029) (2cc5f96)

Build System

• deps-dev: bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064) (481b325)
• deps-dev: bump @​types/web from 0.0.194 to 0.0.354 (#2061) (f61f267)
• deps-dev: bump publint from 0.2.12 to 0.3.22 (#2058) (823d7df)
• deps: bump dotenv from 16.6.1 to 17.4.2 (#2065) (3576574)
• deps: bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edge (#2050) (590982f)
• deps: bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel-edge (#2056) (4d927de)
• migrate release workflow to upstream release-please (#2048) (d41c272)

7.3.0 (2026-07-31)

Full Changelog: v7.2.0...v7.3.0

Features

• api: content provenance checks (c6f9339)

Chores

• remove Brewfile setup path (#2031) (6b63159)
• remove JSR publishing (#2037) (b1fc7df)

Documentation

• organize SDK guides and repository metadata (#2032) (275dff4)
• remove root-level provider guides (98a2ae7)

7.2.0 (2026-07-30)

... (truncated)

Commits

• 83c437f release: 7.4.0 (#2055)
• a97cbff ci: prepare checks for merge queue (#2066)
• 481b325 build(deps-dev): bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064)
• 3576574 build(deps): bump dotenv from 16.6.1 to 17.4.2 (#2065)
• 823d7df build(deps-dev): bump publint from 0.2.12 to 0.3.22 (#2058)
• f61f267 build(deps-dev): bump @​types/web from 0.0.194 to 0.0.354 (#2061)
• 85ea6b2 [dependabot] Configure a seven-day npm cooldown (#2054)
• 4d927de build(deps): bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel...
• 590982f build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edg...
• 6d8fb53 feat(api): Add gpt-5.5 model and tool metadata fields (#2049)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[oratis]

Reviewed and verified locally against current main (the CI run on this PR predates #269–#275).

Why a major bump is safe here. openai has exactly one consumer — packages/core/src/providers/deepseek.ts — and it uses a narrow, stable slice of the SDK: new OpenAI({ apiKey, baseURL, fetch }), client.chat.completions.create({ stream: true, stream_options: { include_usage: true } }), and for await over the chunks. None of that is touched by v7's removals.

The tests actually exercise the SDK. deepseek.test.ts injects a mock fetch rather than mocking the client, so new OpenAI(...), request construction, SSE decoding and chunk iteration all run through real v7 code with only the transport faked. A version bump that broke the streaming surface would fail here rather than pass vacuously. 20 provider tests pass.

Engine check. openai@7 declares engines.node >= 22.0.0; the root and apps/cli both declare >=22 and CI pins node-version: '22'. No floor is raised for anyone.

One thing this does not cover, honestly: the three tests in deepseek.live.test.ts — real streaming, tool-call emission, and reasoning_content → thinking blocks against deepseek-reasoner — self-skip without a DEEPSEEK_API_KEY and did not run. The mock-fetch tests replay captured chunk shapes, so anything that changed in how the SDK talks to the endpoint (rather than how it parses the reply) is unverified until someone runs those with a key.

Full gate on the merged result: typecheck, lint, format, docs clean; 1671 tests pass, 19 skipped.