Repository navigation
chore(deps-dev): bump openai from 2.29.0 to 3.31.0 - #2051
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [openai](https://github.com/openai/openai-python) from 2.29.0 to 3.31.0. - [Release notes](https://github.com/openai/openai-python/releases) - [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md) - [Commits](openai/openai-python@v2.29.0...v3.31.0) --- updated-dependencies: - dependency-name: openai dependency-version: 3.31.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this lockfile bump and didn't find any bugs. It still needs a human look: it moves openai up a major version (2.x to 3.x), and that is the library the SDK's OpenAI integration wraps.
What was reviewed:
- The uv.lock package changes: openai 2.29.0 -> 3.31.0, which now depends on httpx2/httpcore2 instead of httpx and no longer pulls in tqdm or distro; langchain-core 1.2.22 -> 1.6.11; langchain-openai 1.1.12 -> 1.7.2; langsmith 0.8.0 -> 0.14.11; and new packages truststore, websockets and langchain-protocol.
- pyproject.toml is unchanged. The dev constraints
openai>=1.0.0andlangchain-openai>=1,<2allow these versions, so the lock resolves. - The SDK itself still uses
httpx(inlangfuse/_client/resource_manager.pyandlangfuse/media.py). That is separate from openai's new httpx2 transport, but it is worth confirming the OpenAI and LangChain integration tests pass against 3.x.
Extended reasoning...
The change touches only uv.lock (+239/-26) and doesn't affect any security-sensitive code. I deferred because openai jumps a major version and switches its HTTP stack to httpx2, while langsmith and langchain-core jump several minor versions. Those are the libraries the SDK's OpenAI and LangChain integrations patch and wrap. The manifest constraints were left alone, so the major version is only exercised through dev and test resolution. A green CI run on the integration tests is the main evidence a human should check.
Bumps openai from 2.29.0 to 3.31.0.
Release notes
Sourced from openai's releases.
... (truncated)
Changelog
Sourced from openai's changelog.
... (truncated)
Commits
86cae50release: 3.31.0 (#4078)47b9e4efeat: add browser and computer toolsets (1/4) (#4073)16a8340release: 3.30.0 (#4059)1f6cfe1fix(streaming): restore async HTTP/1.1 connection reuse (#4041)c5452affeat(api): expose image tool error and moderation details (#4072)1f05e33feat(api): support updating project API key expiry (#4066)0f73f1dchore(api): clarify agent tool limits and environment pagination (#4065)5e7a23efeat(api): add organization Decisions usage reporting (#4062)3c50399feat(api): support image URLs and detailed safety alert explanations (#4061)9eb83fefeat(api): add OCI external-storage provider support (#4060)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)