chore(deps): Bump openai from 7.4.0 to 7.5.0

[dependabot]

Bumps openai from 7.4.0 to 7.5.0.

Release notes

Sourced from openai's releases.

v7.5.0

7.5.0 (2026-08-17)

Features

• add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
• api: Add ServiceTier and ImageDetail types (#2364) (602d481)
• api: add WebSocket stream IDs (#2314) (156a8db)
• api: add workload identity access token issued event (#2307) (322a5b1)
• api: deprecate Sora video APIs (#2313) (4424b40)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)

Bug Fixes

• api: clarify audio upload metadata requirements (#2279) (34ecf3f)
• audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
• audio: reject ffplay spawn errors (#2012) (6d42d4d)
• auth: reject redirects during workload identity token exchange (#2321) (240385e)
• auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
• avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
• await webhook verification in README examples (#2302) (0fe7ad0)
• azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
• azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
• azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
• azure: prevent deployment path traversal (#2337) (a9d9d41)
• bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
• chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
• client: handle empty JSON response body without content-length (#1998) (b6447e9)
• configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
• deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
• embedding: response type for base64 encoding format (#1554) (ef69801)
• export AzureClientOptions (#1760) (511bf6d), closes #1735
• export workload identity helpers from openai/auth (#2344) (af8f14f)
• fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
• format: restore formatting for generated SDK files (#2089) (6d69d4b)
• harden runTools against inherited function names (#2333) (f4496d1)
• honor defaultHeaders null for helper method header (#1857) (8eab09a)
• include items for strict Zod v3 any arrays (#2357) (4c32089)
• isolate Vercel ecosystem tests per request (#2359) (2831290)
• keep streamed Responses output text linear and canonical (#2354) (6827a40)
• lint: recognize Castiron-generated headers (#2124) (cf6237f)
• lint: restore generated SDK lint rules (#2126) (6b8162c)
• parse empty chat content when present (#2331) (53dd723)
• parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
• pass file batch helper options through (#1855) (05ce028)
• preserve File-like metadata in toFile (#1883) (ba1a781)

... (truncated)

Changelog

Sourced from openai's changelog.

7.5.0 (2026-08-17)

Features

• add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
• api: Add ServiceTier and ImageDetail types (#2364) (602d481)
• api: add WebSocket stream IDs (#2314) (156a8db)
• api: add workload identity access token issued event (#2307) (322a5b1)
• api: deprecate Sora video APIs (#2313) (4424b40)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)

Bug Fixes

• api: clarify audio upload metadata requirements (#2279) (34ecf3f)
• audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
• audio: reject ffplay spawn errors (#2012) (6d42d4d)
• auth: reject redirects during workload identity token exchange (#2321) (240385e)
• auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
• avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
• await webhook verification in README examples (#2302) (0fe7ad0)
• azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
• azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
• azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
• azure: prevent deployment path traversal (#2337) (a9d9d41)
• bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
• chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
• client: handle empty JSON response body without content-length (#1998) (b6447e9)
• configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
• deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
• embedding: response type for base64 encoding format (#1554) (ef69801)
• export AzureClientOptions (#1760) (511bf6d), closes #1735
• export workload identity helpers from openai/auth (#2344) (af8f14f)
• fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
• format: restore formatting for generated SDK files (#2089) (6d69d4b)
• harden runTools against inherited function names (#2333) (f4496d1)
• honor defaultHeaders null for helper method header (#1857) (8eab09a)
• include items for strict Zod v3 any arrays (#2357) (4c32089)
• isolate Vercel ecosystem tests per request (#2359) (2831290)
• keep streamed Responses output text linear and canonical (#2354) (6827a40)
• lint: recognize Castiron-generated headers (#2124) (cf6237f)
• lint: restore generated SDK lint rules (#2126) (6b8162c)
• parse empty chat content when present (#2331) (53dd723)
• parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
• pass file batch helper options through (#1855) (05ce028)
• preserve File-like metadata in toFile (#1883) (ba1a781)
• preserve skill upload paths without buffering native files (#2303) (30b9c41)

... (truncated)

Commits

• 5b96016 release: 7.5.0 (#2087)
• bfcccad fix(security): prevent Bedrock bearer credential disclosure across redirects ...
• 3f8d5cc fix(bedrock): safely sign inherited query parameter names (#2375)
• 16172a4 chore(deps-dev): bump oxfmt from 0.61.0 to 0.62.0 (#2373)
• 6320b64 chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 (#2374)
• b49b227 chore(deps-dev): bump webpack from 5.108.4 to 5.109.2 in /ecosystem-tests/ts-...
• 2cc57c3 chore(deps-dev): bump @​aws-sdk/credential-provider-node from 3.972.77 to 3.97...
• 6983363 chore(deps-dev): bump @​cloudflare/workers-types from 5.20260804.1 to 5.202608...
• 50db5db chore(deps-dev): bump @​types/node from 24.12.4 to 26.2.0 (#2370)
• 7259f9f chore(deps-dev): bump html-webpack-plugin from 5.6.7 to 5.6.8 in /ecosystem-t...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[oratis]

Reviewed and verified locally against current main. Minor bump inside the v7 line that #264 moved onto earlier today.

Same reasoning as #264 and it still holds: one consumer (packages/core/src/providers/deepseek.ts), a narrow surface (chat.completions.create streaming plus stream_options.include_usage), and deepseek.test.ts injects a mock fetch rather than a mock client — so real SDK code runs, only the transport is faked. 20 provider tests pass.

Same caveat as #264: deepseek.live.test.ts self-skips without a DEEPSEEK_API_KEY, so nothing here exercises a real endpoint.

Verified locally: typecheck, lint, format, docs clean; 1672 tests pass, 19 skipped.