[knostic-renovate]

This PR contains the following updates:

Package	Update	Change
openai	minor	==3.37.0 -> ==3.40.0

---

Release Notes

openai/openai-python (openai)

v3.40.0

Compare Source

Features

• api: add prompt cache breakpoint TTL options (#​4188) (3596d18)

Bug Fixes

• ci: use an explicit browser demo dependency (#​4185) (a3f4302)

Chores

• api: record completed generated-code separation (#​4190) (d7ab5ee)
• deps-dev: bump griffe from 1.14.0 to 2.3.0 (#​4069) (766b849)
• deps: bump actions/create-github-app-token from 3.2.0 to 3.3.0 (#​4178) (06dbb5d)
• deps: bump actions/download-artifact from 8.0.1 to 8.0.2 (#​4110) (2404d04)
• deps: bump actions/upload-artifact from 7.0.1 to 7.0.2 (#​4107) (0adf711)
• deps: bump github/codeql-action/analyze from 4.38.2 to 4.39.0 (#​4177) (1e42321)
• deps: bump openai/codex-action from 1.12 to 1.13 (#​4070) (904ed3f)
• update generated-code verification and preserve SDK helpers (#​4186) (9412200)

v3.39.0

Compare Source

Features

• api: add gpt-6.1-terra model identifier (#​4180) (e8beb1a)

v3.38.0

Compare Source

Features

• api: add delegation controls and prompt cache lifetimes (#​4169) (43045fc)
• api: expand Live Decision item and question types (#​4175) (5d72315)

Bug Fixes

• agents: clarify result schema warnings (#​4165) (cfa0a79)
• format API status errors using the server message (#​4161) (6ce5f05)
• preserve fallback parsing for PEP 604 unions (#​4160) (05dfea0)
• responses: resolve function arguments within their namespace (#​4166) (81792ff)
• responses: validate tool namespaces before runner dispatch (#​4167) (56a55f2)

Chores

• api: preserve client and resource compatibility (#​4157) (56f33a1)
• enforce zero custom code in generated Python files (#​4168) (d622f28)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[gadievron]

R3/R4 — PR 873, at head 95083ae4 — CLEAN ON ITS OWN MERITS, HALTED ON A SIBLING'S DEFECT

@sounil — eligible non-author CODEOWNER, re-derived from .github/CODEOWNERS at live master (9143061f) this arc and not cached: a single * rule naming seven owners. A notice for the record, not a gate on any merge.

DISCLOSURE, re-derived live at this head: repo-visibility public · enforce_admins=false · required_reviews unmet · escape-hatch not allowance (the allowance exists and names ar7casper, not the acting identity). Ruleset ci-required (id 23956162, active) carries 0 bypass_actors across its 14 required contexts. Approving review count 0, none manufactured.

CI: 19/19, THE FOURTEEN REQUIRED CONTEXTS MAPPED NAME BY NAME

required-minus-success is EMPTY, derived by name and not inferred from a count. Zero reruns; no named flake family was invoked and none is claimed.

THE BUMP DISCIPLINE — THE REACHED SURFACE IS UNCHANGED, MEASURED NOT ASSUMED

openai==3.37.0 → 3.38.0, one line in libs/openant-core/requirements.txt. Both wheels were downloaded and compared.

Metadata: requires_python >=3.10 identical; the twelve requires_dist entries identical, including httpx2<3,>=2.12.0 against the repo's pinned httpx2==2.16.0.

File set: 53 modules added, 0 removed (the only deletions are the dist-info directory rename) — purely additive.

The reached surface, enumerated from the repo and then diffed at both versions:

reached surface	result
openai/_exceptions.py	byte-identical between 3.37.0 and 3.38.0
the 8 reached exception classes + OpenAI	exported in __all__ at both versions; same MRO at the same lines
OpenAI.__init__ / AsyncOpenAI.__init__	positional and keyword-only parameter lists identical (17 kwonly, incl. api_key, base_url, timeout, max_retries, default_headers)
chat.completions.create	4 overloads both sides, 0 kwonly added, 0 removed, positional identical
responses.create	4 overloads both sides, 0 kwonly added, 0 removed, positional identical

The call sites are three adapters — utilities/llm/providers/openai.py, ollama.py, openrouter.py — invoking openai.OpenAI(...), chat.completions.create and responses.create, plus the isinstance taxonomy over APITimeoutError, APIConnectionError, RateLimitError, NotFoundError, AuthenticationError, PermissionDeniedError, APIError, APIStatusError.

BOTH-UNREACHABLE, RE-DERIVED THIS ARC AND NOT CARRIED FROM THE 851/853/857 LINEAGE: of the 49 added library modules (agents/automations, assistants runs/threads, response resources, voice), zero leaf names are referenced anywhere in the repository's .py surface. The added surface is unreachable from this codebase at both versions.

NEGATIVE CONTROL — the versions do not differ in behaviour on the reached surface, so the control is on the instrument instead. A synthetic mutant removing timeout from OpenAI.__init__ in a copy of 3.38.0 was compared by the same comparator: control (96f6317992c8a8cd) reports identical and PASSES; mutant (417272279d7acbaf) reports REMOVED: ['timeout'] and FAILS. The comparator discriminates, so "identical" is a real finding rather than a blind instrument. Disclosed: the first mutant attempt missed its anchor and produced a non-mutant whose verdict matched the control — it was re-run with a corrected anchor rather than reported as a survivor (the named #870 method defect, kept fixed).

WHY IT IS NOT MERGED

Gate C1 exits 2. Not for anything in this PR: all three pairs are CLEAN with zero shared paths, and the single failing coupled-surface guard is ui-vendor on the 872+873 tree — PR #872 is independently broken against master (go vet ./ui/... rc=1 at master+872, rc=0 at master). Executed attribution, four legs: master alone rc=0, 873 alone rc=0, 872 alone rc=1, 872+873 rc=1 with the identical error.

So one broken open sibling fails C1 for every other PR in the lane, because the guard has no baseline leg distinguishing "this pair breaks each other" from "the other PR is already broken". bin/collide.py makes a failing guard an unconditional rc=2 with no escape, and there is no flag to exclude a PR; hand-editing the open-set input would be fabricating it. That is an instrument finding, handed to the maintainer rather than patched by the seat the gate is currently blocking. No [WAIVER] was authored and no bypass attempted. Once #872 is resolved this PR re-arcs cheaply: everything above is already measured and green.