release: 0.79.0

[openai-sdks]

Automated Release PR

0.79.0 (2026-08-12)

Features

• add HTTP response observability (#365) (48d36b7)
• add Tapioca typing for structured outputs (#364) (738e2b4)
• api: Add new model identifiers and remove audit log source (e0a4bc5)
• api: add workload identity access token issued event (#372) (9199779)
• client: add default headers (#369) (d516874)
• expose request IDs (#352) (c15fb7b)
• support Azure OpenAI v1 (#355) (c1d223e)

Bug Fixes

• api: Add new model identifiers and remove audit log source (#360) (e0a4bc5)
• api: allow nil timeout in client signatures (#363) (e52ca61)
• api: document file upload metadata defaults (#361) (b4bc1ea)
• coerce nested BaseModel fields (#295) (e5152a9)
• encode multipart array and nested fields (#348) (1c71a1e)
• loading after ActiveSupport 6 subclass extensions (#346) (20fbb09)
• preserve binary multipart stream reads (#354) (b3a1ba7)
• return values from interruptible enumerator (#350) (327dad7)
• tighten JSON, JSONL, and SSE content type matching (#277) (66359a0)

Chores

• Cover Ruby files at the SDK root (#362) (d11f25b)
• enforce redundant directive lint (#366) (8448a4c)
• remove Stainless attribution and infrastructure (#371) (33d2c86)

Documentation

• clarify file upload metadata (#358) (698ac65), closes #243
• document fiber scheduler concurrency (#357) (25a7bbc)

---

This PR was generated with Release Please. See documentation.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.189s for Ruby SDK PR #347.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	232ms
tests/chat-completions-create.test.ts	✅ Passed	256ms
tests/chat-completions-stream.test.ts	✅ Passed	136ms
tests/files-content-binary.test.ts	✅ Passed	268ms
tests/files-create-multipart.test.ts	✅ Passed	267ms
tests/files-list-pagination.test.ts	✅ Passed	160ms
tests/initialize-config.test.ts	✅ Passed	195ms
tests/instance-isolation.test.ts	✅ Passed	214ms
tests/models-list.test.ts	✅ Passed	321ms
tests/responses-background-lifecycle.test.ts	✅ Passed	231ms
tests/responses-body-method-errors.test.ts	✅ Passed	453ms
tests/responses-cancel-timeout.test.ts	✅ Passed	212ms
tests/responses-cancel.test.ts	✅ Passed	268ms
tests/responses-compact-retries.test.ts	✅ Passed	262ms
tests/responses-compact.test.ts	✅ Passed	307ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	139ms
tests/responses-create-advanced.test.ts	✅ Passed	170ms
tests/responses-create-disconnect.test.ts	✅ Passed	170ms
tests/responses-create-errors.test.ts	✅ Passed	279ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	148ms
tests/responses-create-retries.test.ts	✅ Passed	274ms
tests/responses-create-stream-failures.test.ts	✅ Passed	152ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	236ms
tests/responses-create-stream-wire.test.ts	✅ Passed	2.07s
tests/responses-create-stream.test.ts	✅ Passed	132ms
tests/responses-create-terminal-states.test.ts	✅ Passed	280ms
tests/responses-create-timeout.test.ts	✅ Passed	215ms
tests/responses-create.test.ts	✅ Passed	311ms
tests/responses-delete.test.ts	✅ Passed	344ms
tests/responses-input-items-errors.test.ts	✅ Passed	215ms
tests/responses-input-items-list.test.ts	✅ Passed	190ms
tests/responses-input-items-options.test.ts	✅ Passed	198ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	264ms
tests/responses-input-tokens-count.test.ts	✅ Passed	311ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.297s
tests/responses-not-found-errors.test.ts	✅ Passed	346ms
tests/responses-parse.test.ts	✅ Passed	241ms
tests/responses-retrieve-retries.test.ts	✅ Passed	254ms
tests/responses-retrieve.test.ts	✅ Passed	283ms
tests/responses-stored-method-errors.test.ts	✅ Passed	817ms
tests/retry-behavior.test.ts	✅ Passed	1.961s
tests/sdk-error-shape.test.ts	✅ Passed	404ms

View OkTest run #31622969885

_{SDK merge (d7816d343a14) · head (9a2e5ef7814b) · base (919977919667) · OkTest (a845fa206fa4)}

[jbeckwith-oai]

Release metadata is consistent for 0.78.1, the changelog covers the sole commit since v0.78.0, the gem builds successfully, and exact-head CI is green.

[jbeckwith-oai]

Release metadata is consistent for 0.78.1, the changelog now covers all three user-facing fixes since v0.78.0 while correctly omitting the test-only commit, the gem builds successfully with the expected package metadata, targeted load-order and multipart/IO tests pass, lint/type validation passes, and exact-head CI is green across Ruby 3.3, 3.4, and 4.0.

[jbeckwith-oai]

Re-reviewed the complete 0.78.1 release at this refreshed head. The manifest, runtime version, README install version, lockfile path version, changelog heading/date, and compare link are consistent. The changelog covers all four user-facing fixes since v0.78.0 and correctly omits the test-only commit; the newly included binary multipart stream-read fix has matching runtime, RBI/RBS, and regression-test coverage. Exact-head package, RuboCop, Sorbet, RBS, Ruby 3.3/3.4/4.0, required CI, and CodeQL checks are green. I found no release-integrity, compatibility, security, supply-chain, architecture, file-size, or maintainability blocker.

[jbeckwith-oai]

Fresh review of the complete 0.79.0 release at this exact head. The minor version is appropriate for the new Azure OpenAI v1 provider; manifest, runtime version, README install version, lockfile path version, changelog heading/date, and compare link all agree. The changelog covers the Azure feature and all four user-facing fixes since v0.78.0 while correctly omitting the test-only commit. The Azure implementation stays behind the existing provider boundary, refreshes tokens per attempt, validates origin before attaching credentials, rejects custom-auth ambiguity, normalizes endpoints explicitly, and includes aligned RBI/RBS plus focused configuration, retry, origin, and authentication coverage. The multipart stream-read addition likewise has matching runtime/type/test coverage. Exact-head package, RuboCop, Sorbet, RBS, Ruby 3.3/3.4/4.0, required CI, and CodeQL are green. No release-integrity, compatibility, security, supply-chain, architecture, file-size, or maintainability blocker found.

[jbeckwith-oai]

Fresh thermo-nuclear review of the complete 0.79.0 release at this exact head. The new delta since the prior approval cleanly exposes request IDs on successful top-level models/pages and API errors without leaking metadata into model serialization, with aligned runtime, RBI/RBS, documentation, and regression coverage. The fiber-scheduler documentation matches the existing Net::HTTP behavior and is backed by an integration test that proves concurrent progress on one scheduler thread. The manifest, runtime version, README install version, lockfile path version, changelog heading/date/compare link, and built gem metadata are consistent; the changelog covers all user-facing commits since v0.78.0 and omits the test-only commit. The earlier Azure, multipart, nested-form, interruptible-enumerator, and load-order deltas remain coherent. Exact-head package, RuboCop, Sorbet, RBS, Ruby 3.3/3.4/4.0, required CI, and CodeQL checks are green. No release-integrity, compatibility, security, supply-chain, architecture, file-size, or maintainability blocker found.

[jbeckwith-oai]

Fresh thermo-nuclear review of the complete 0.79.0 release at this exact head. The new delta cleanly tightens JSON, JSONL, and SSE content-type matching: matching is anchored, case-insensitive, parameter-aware, and avoids false-positive prefixes, with aligned RBI declarations and focused matcher/dispatch regression coverage. The manifest, runtime version, README install version, lockfile path version, changelog heading/date/compare link, and built gem metadata remain consistent. The changelog now covers all nine user-facing commits since v0.78.0 and correctly omits the test-only commit. Previously reviewed Azure, request-ID, multipart, enumerator, load-order, and scheduler-documentation changes remain coherent. Exact-head package, RuboCop, Sorbet, RBS, Ruby 3.3/3.4/4.0, required CI, and CodeQL checks are green. No release-integrity, runtime/API compatibility, security, architecture, file-size, or maintainability blocker found.

[jbeckwith-oai]

The newly accumulated nested-model coercion change adds the cross-component OpenAI::Internal::Type::Converter.coerce_with_error singleton method in lib/openai/internal/type/converter.rb, and calls it from ArrayOf, HashOf, BaseModel, and Union, but the shipped declarations in rbi/openai/internal/type/converter.rbi and sig/openai/internal/type/converter.rbs do not declare it. That leaves the runtime and the SDK's RBI/RBS surface out of sync and conflicts with this repository's contributor rule that public @api private methods used across components retain declarations at the same visibility. Please add matching singleton declarations (including the coerced-value/error tuple return), validate Sorbet and RBS, and regenerate this release. The exact-head package build, 568-test suite, targeted 13-test/95-assertion nested-coercion suite, diff check, and CI matrix are otherwise clean.

[jbeckwith-oai]

The prior blocker remains unresolved on this refreshed release head. OpenAI::Internal::Type::Converter.coerce_with_error still exists only in lib/openai/internal/type/converter.rb and is still absent from both shipped declaration files, rbi/openai/internal/type/converter.rbi and sig/openai/internal/type/converter.rbs, even though ArrayOf, HashOf, BaseModel, and Union call it across components. Please add matching singleton declarations, including the coerced-value/error tuple return, then run Sorbet/RBS validation and regenerate the release. The newly accumulated file-upload documentation accurately describes the SDK's fallback filename/content types and FilePart escape hatch; version/changelog/compare metadata is consistent; the local 568-test suite, gem package build, diff check, exact-head CI matrix, and file-threshold audit are otherwise clean.

[jbeckwith-oai]

Two release blockers remain on this exact head:

1. OpenAI::Internal::Type::Converter.coerce_with_error is shipped in lib/openai/internal/type/converter.rb and is called by ArrayOf, HashOf, BaseModel, and Union, but the packaged declarations still omit it from both rbi/openai/internal/type/converter.rbi and sig/openai/internal/type/converter.rbs. Please add matching singleton declarations with the (coerced value, nullable StandardError) tuple return, then rerun Sorbet/RBS validation and regenerate the release. The built 0.79.0 gem confirms the mismatch: the runtime method is present while neither declaration contains it.

2. The 0.79.0 changelog lists commit e0a4bc5 twice for the same “Add new model identifiers and remove audit log source” change: once under Features and again under Bug Fixes. Please keep the entry once under the intended category and regenerate the release notes.

The remaining release metadata is internally consistent; the targeted 131-test/750-assertion release-delta suite, RuboCop (2,601 files), Sorbet, RBS (1,211 files), gem build/inspection, diff check, exact-head Ruby 3.3/3.4/4.0 CI, required CI, and CodeQL are otherwise clean.

[jbeckwith-oai]

Both blockers from the previous release head remain unresolved:

1. OpenAI::Internal::Type::Converter.coerce_with_error is still shipped in lib/openai/internal/type/converter.rb and called across ArrayOf, HashOf, BaseModel, and Union, but it remains absent from both packaged declaration files: rbi/openai/internal/type/converter.rbi and sig/openai/internal/type/converter.rbs. Please add matching singleton declarations with the coerced-value / nullable StandardError tuple return, validate Sorbet and RBS, and regenerate the release.

2. The 0.79.0 changelog still lists commit e0a4bc5 twice for the same “Add new model identifiers and remove audit log source” change, once under Features and once under Bug Fixes. Please retain a single PR-linked entry under the intended category and regenerate the release notes.

The newly accumulated upload-metadata documentation is consistent with the runtime fallback filename/content types and FilePart escape hatch. The remaining version/package metadata, all 12 other user-facing release entries, complete v0.78.0 release delta, file thresholds, and diff hygiene look clean. Local 568-test/1,971-assertion suite, targeted nested-coercion tests, RuboCop, Sorbet, RBS, and 0.79.0 gem build/inspection pass; exact-head package, Ruby 3.3/3.4/4.0, required CI, and CodeQL checks are green.

[jbeckwith-oai]

Both previously reported release blockers remain unresolved on exact head 8788fc66189f4e417276d8a5c85d4feadb123842:

1. OpenAI::Internal::Type::Converter.coerce_with_error is still shipped at

   openai-ruby/lib/openai/internal/type/converter.rb

   Line 282 in 8788fc6

   def coerce_with_error(target, value, state:)

   and directly called by ArrayOf/HashOf/BaseModel/Union, but both packaged declaration files still omit the public singleton method:

   openai-ruby/rbi/openai/internal/type/converter.rbi

   Line 185 in 8788fc6

   # @api private

   and

   openai-ruby/sig/openai/internal/type/converter.rbs

   Line 69 in 8788fc6

   def self.dump: (

   . This violates the repository cross-component visibility/declaration rule and leaves the runtime and type surfaces inconsistent. Add matching singleton declarations with target, value, and state parameters and tuple returns [T.anything, T.nilable(StandardError)] / [top, StandardError?], run Sorbet/RBS, and regenerate the release.

2. CHANGELOG.md still lists commit e0a4bc5 twice with identical text/hash under both Features and Bug Fixes:

   openai-ruby/CHANGELOG.md

   Line 9 in 8788fc6

   * **api:** Add new model identifiers and remove audit log source ([e0a4bc5](https://github.com/openai/openai-ruby/commit/e0a4bc56d5280c45a12e44adc49b6c34e182b33f))

   and

   openai-ruby/CHANGELOG.md

   Line 16 in 8788fc6

   * **api:** Add new model identifiers and remove audit log source ([#360](https://github.com/openai/openai-ruby/issues/360)) ([e0a4bc5](https://github.com/openai/openai-ruby/commit/e0a4bc56d5280c45a12e44adc49b6c34e182b33f))

   . Keep one entry, preferably the Bug Fixes entry linked to #360, and regenerate the release notes.

The newly accumulated Tapioca typing, root lint coverage, and nil-timeout changes are otherwise coherent, and release metadata is aligned. Local validation passed 169 tests / 901 assertions, RuboCop over 2,607 files, Sorbet, RBS validation over 1,211 files, gem build/package inspection, diff checks, and file-threshold checks. Exact-head Ruby-matrix CI, required CI, CodeQL, and 237/237 OkTest SDK tests are green.

[jbeckwith-oai]

Three release blockers remain on exact head f81ea9b9770f85ef31b5719e3541f5a4f0fd94da:

1. The new purportedly safe info/error summaries disclose non-credential query values. Both completion and failure logs use safe_path(@url), but safe_path preserves every query value whose key does not match the credential regex. For example, the generated organization-users list accepts emails, and an info/error log emits /v1/organization/users?emails%5B%5D=alice%40example.com; other generated query fields include actor_emails and user-provided name. That conflicts with the README description of :info as a safe summary and its warning that sensitive-content disclosure is limited to debug diagnostics. Please make the non-debug path omit the query or redact every query value, keep selective query rendering in debug-only safe_url, and add info/error regression coverage with a PII query.

2. The prior type-surface blocker remains. Runtime still ships public Converter.coerce_with_error, called by four SDK components, but the packaged RBI and RBS still omit it. The same declarations type CoerceState#error as a class even though runtime initializes it to nil and stores StandardError instances. Add matching singleton declarations with the coerced-value / nullable-error tuple return and model the state member as nullable StandardError, then rerun both type validations and regenerate the release.

3. CHANGELOG.md:10 and CHANGELOG.md:17 still list the same e0a4bc5 change under both Features and Bug Fixes. Remove the unlinked Features duplicate and retain the complete PR-linked Bug Fixes entry.

The rest of the new observability delta is cohesive, version/package metadata is aligned, no file crossed 1,000 lines, and exact-head CI plus 237/237 OkTest cases are green. Local validation passed 136 targeted tests / 770 assertions, RuboCop across 2,611 files, Sorbet, all 1,212 RBS files, gem build/package inspection, syntax, and diff checks.

[jbeckwith-oai]

Requesting changes on exact head a00e645f84178192a06417d3f2f7ff1365c3c6db after a full v0.78.0-to-v0.79.0 release-delta review.

1. High — keep query values out of default info/error logs. Context#completed and request_failed log safe_path, but that helper preserves every query value not matched by the credential-key denylist. This includes generated filters such as emails, actor_emails, and name; an exact-head reproduction returned those PII/resource values while redacting only api_key. The README calls info summaries safe and reserves its sensitive-content warning for debug, so ordinary production success and failure logs can persist customer data. Please make safe_path path-only for info/error, keep sanitized query diagnostics confined to debug safe_url, and add success/failure PII regressions. Expanding the denylist remains brittle.

2. Medium — complete and correct the shipped Converter signatures. Converter.coerce_with_error is directly shared by BaseModel, ArrayOf, HashOf, and Union, but neither packaged RBI nor RBS declares it. The runtime CoerceState#error, RBI, and RBS also describe an error class even though runtime state starts as nil and stores exception instances. Please add matching singleton declarations returning a value plus nullable StandardError, and type the state as a nullable StandardError instance across runtime/RBI/RBS (including the YARD option docs).

3. Low — remove the duplicate release note. Changelog line 10 and line 17 list the same e0a4bc5 change under both Features and Bug Fixes. Keep the complete PR-linked Bug Fix entry and remove the duplicate; adjust generator inputs only if regeneration brings it back.

Validation otherwise looks healthy: full local suite 612 runs / 2,307 assertions; RuboCop clean across 2,611 files; Sorbet clean; 1,212 RBS files valid; gem builds; git diff --check passes; exact-head GitHub CI and OkTest 237/237 are green; version/manifest/README/lockfile align at 0.79.0; no file crossed the 1,000-line threshold.

[jbeckwith-oai]

Requesting changes on exact head 6c14d142c3bb5366d6a6e0e822c60500fe0b88e7 after a full v0.78.0-to-v0.79.0 release review.

1. High — keep query values out of default info/error logs. Context#completed and request_failed log safe_path, which preserves every query value outside a narrow credential-key denylist. An exact-head reproduction emitted emails, actor_emails, and name while redacting only api_key. Since README describes info summaries as safe and warns about sensitive content only for debug, ordinary success/failure logs can persist customer PII. Please make safe_path path-only for info/error, keep sanitized query diagnostics confined to debug safe_url, and add success/failure PII regressions. Expanding the denylist remains brittle.

2. Medium — complete and correct the shipped Converter signatures. Converter.coerce_with_error is directly shared by BaseModel, ArrayOf, HashOf, and Union, but neither packaged RBI nor RBS declares it. Runtime initializes the state error to nil and stores exception instances, while the runtime alias, RBI, and RBS describe an error class. Please add matching singleton declarations returning a value plus nullable StandardError, and type the state as a nullable StandardError instance across runtime/RBI/RBS, including the YARD option docs.

3. Low — remove the duplicate release note. Changelog line 10 and line 18 list the same e0a4bc5 change under Features and Bug Fixes. Keep the complete PR-linked Bug Fix entry and remove the duplicate; adjust release generation only if it reappears.

The new default_headers API looks sound: normalization/removal semantics, merge precedence, provider authentication, docs, RBI/RBS, and coverage align. Validation otherwise passes: targeted 114 runs / 675 assertions, diff and syntax checks, exact-head GitHub CI, and OkTest 237/237; release metadata aligns at 0.79.0 and no file crossed the 1,000-line threshold.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9a2e5ef781

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Add migration guidance for the removed audit source

For users upgrading from 0.78.0 who read AuditLogListResponse::Data#source, e0a4bc5 removes the public accessor and its RBI/RBS types; VERSIONING.md classifies removals as breaking and says 0.x releases need migration guidance. This release note only states the removal, so those users have no upgrade path or replacement called out—please add a brief migration note, even if the guidance is that there is no replacement.

Useful? React with 👍 / 👎.