chore(deps): bump openai from 2.48.0 to 3.1.0

[dependabot]

Bumps openai from 2.48.0 to 3.1.0.

Release notes

Sourced from openai's releases.

v3.1.0

3.1.0 (2026-08-14)

Features

• api: add WebSocket stream IDs (#3612) (d9029e3)
• api: add workload identity access token issued event (#3601) (df274d4)
• api: deprecate Sora video APIs (#3610) (721cb1c)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#3617) (f38355e)

Chores

• remove Stainless attribution and infrastructure (#3599) (a1eeab5)

v3.0.0

3.0.0 (2026-08-12)

⚠ BREAKING CHANGES

• api: HTTPX2 is now the default HTTP client, and httpx is no longer installed automatically. Applications using custom HTTPX clients, transports, or configuration objects must migrate to their HTTPX2 equivalents or use the temporary, runtime-only legacy HTTPX escape hatch. See the HTTPX2 migration guide.

Features

• api: migrate to HTTPX2 (#3594)

v2.54.0

2.54.0 (2026-08-11)

Features

• api: Add new Responses model identifiers (#3595) (0652787)

Bug Fixes

• api: clarify audio upload metadata requirements (#3596) (28888f9)

Chores

• api: Update generated-file header attribution to Castiron (#3583) (ea17fda)

v2.53.0

2.53.0 (2026-08-03)

... (truncated)

Changelog

Sourced from openai's changelog.

3.1.0 (2026-08-14)

Features

• api: add WebSocket stream IDs (#3612) (d9029e3)
• api: add workload identity access token issued event (#3601) (df274d4)
• api: deprecate Sora video APIs (#3610) (721cb1c)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#3617) (f38355e)

Chores

• remove Stainless attribution and infrastructure (#3599) (a1eeab5)

3.0.0 (2026-08-12)

⚠ BREAKING CHANGES

• api: HTTPX2 is now the default HTTP client, and httpx is no longer installed automatically. Applications using custom HTTPX clients, transports, or configuration objects must migrate to their HTTPX2 equivalents or use the temporary, runtime-only legacy HTTPX escape hatch. See the HTTPX2 migration guide.

Features

• api: migrate to HTTPX2 (#3594)

2.54.0 (2026-08-11)

Features

• api: Add new Responses model identifiers (#3595) (0652787)

Bug Fixes

• api: clarify audio upload metadata requirements (#3596) (28888f9)

Chores

• api: Update generated-file header attribution to Castiron (#3583) (ea17fda)

2.53.0 (2026-08-03)

Features

• api: Add gpt-5.5 and tool name/namespace to Responses types (#3569) (dd1202d)

... (truncated)

Commits

• 10ee3f0 release: 3.1.0 (#3600)
• f38355e feat(api): Ultrafast tier, structured MCP and websocket errors, separate webs...
• d9029e3 feat(api): add WebSocket stream IDs (#3612)
• 721cb1c feat(api): deprecate Sora video APIs (#3610)
• df274d4 feat(api): add workload identity access token issued event (#3601)
• 5578d39 ci: fix CodeQL permissions for private repositories (#3606)
• a1eeab5 chore: remove Stainless attribution and infrastructure (#3599)
• 8bb0e14 release: 3.0.0 (#3598)
• ae8c3d5 feat(api)!: migrate to HTTPX2 (#3594)
• 03b3ec4 release: 2.54.0 (#3592)
• Additional commits viewable in compare view

[overcut-ai]

Completed Working on "Code Review"

✅ Review submitted: COMMENT. Total comments: 1 across 1 files.

✅ Workflow completed successfully.

---

👉 View complete log

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

uv.lock

Name	Version	Vulnerability	Severity
litellm	1.83.0	LiteLLM has SQL Injection in Proxy API key verification	critical
		LiteLLM: Authentication Bypass via Host Header Injection	critical
		LiteLLM: Server-Side Template Injection in /prompts/test endpoint	high
		LiteLLM: Authenticated command execution via MCP stdio test endpoints	high
		LiteLLM has a sandbox escape in custom-code guardrail	high
		LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit	high
		LiteLLM allows a user to modify their own user_role via the /user/update endpoint	high
		LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback	high
		LiteLLM: Arbitrary file write via path traversal in Skills archive extraction	moderate
		LiteLLM: Local file read via request-supplied OIDC file references	low

OpenSSF Scorecard

Package	Version	Score	Details
pip/litellm	1.83.0	Unknown	Unknown
pip/httpcore2	2.10.0	Unknown	Unknown
pip/httpx2	2.10.0	Unknown	Unknown
pip/httpx2-jsfetch	1.0	Unknown	Unknown
pip/idna	3.19	Unknown	Unknown
pip/openai	3.1.0	Unknown	Unknown
pip/truststore	0.10.4	Unknown	Unknown

Scanned Files

• uv.lock

[overcut-ai]

Final Review Summary

Thanks for the update. I reviewed the posted findings and consolidated the results below.

Comment counts by importance

• BLOCKER: 0
• CRITICAL: 0
• MAJOR: 1
• MINOR: 0
• SUGGESTION: 0
• PRAISE: 0

Affected files

• uv.lock

Key theme observed

• The dependency bump introduces unintended lockfile drift: while upgrading openai, litellm was downgraded, which may cause unrelated runtime regressions.

Actionable next steps

1. Re-generate the lockfile with a constrained/targeted update for openai and only required transitives.
2. Keep litellm at the intended version (or explicitly pin it before re-locking).
3. Re-run dependency validation/tests after lock refresh to confirm no behavioral regressions.

[overcut-ai]

[major]: This lockfile update downgrades litellm from 1.95.0 to 1.83.0 while bumping openai, which can silently remove fixes/features and change runtime behavior unrelated to this PR’s goal. Regenerate the lock with a constrained update (or pin litellm) so the OpenAI major bump does not introduce unrelated regressions.