ci(deps): bump the major-updates group with 17 updates

[dependabot]

Bumps the major-updates group with 17 updates:

Package	From	To
@nestjs/bullmq	11.0.5	12.0.0
@nestjs/common	11.1.28	12.0.1
@nestjs/config	4.0.4	12.0.0
@nestjs/core	11.1.28	12.0.1
@nestjs/platform-express	11.1.28	12.0.1
@nestjs/typeorm	11.0.3	12.0.1
bullmq	5.78.0	6.3.1
ioredis	5.11.1	6.0.0
js-yaml	4.3.1	5.4.1
openai	6.42.0	7.8.0
typeorm	0.3.31	1.1.0
@nestjs/cli	11.0.22	12.0.0
@nestjs/schematics	11.1.0	12.0.0
@nestjs/testing	11.1.26	12.0.1
@types/node	25.9.2	26.4.0
jscpd	4.2.4	5.0.16
typescript	6.0.3	7.0.2

Updates @nestjs/bullmq from 11.0.5 to 12.0.0

Release notes

Sourced from @​nestjs/bullmq's releases.

@​nestjs/bullmq@​12.0.0

What's Changed

@nestjs/bull, @nestjs/bullmq, and @nestjs/bull-shared are now native ES modules, and the major version is aligned with the Nest 12 release line.

ESM migration

All three packages are published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. Deep imports into build internals are no longer resolvable — import from the package root:

// still fine
import { BullModule, InjectQueue, Processor } from '@nestjs/bullmq';
// no longer resolvable
import { BullExplorer } from '@​nestjs/bullmq/dist/bull.explorer';

./package.json is exposed as a subpath for tooling that resolves the manifest through the package specifier.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, the exports map ships a require condition alongside import, so require('@nestjs/bullmq') from a CommonJS Nest app keeps working. This needs Node 20.19+, 22.12+, or 24+ — the versions where require(esm) is enabled by default.

TypeScript consumers should be on "moduleResolution": "node16", "nodenext", or "bundler" so the exports map is honored.

Commits

• 1ee6596 chore(release): publish new releases
• 1aaa028 chore: resolve conflicts
• 7e14d30 chore: upgrade to v12
• f4c01b0 chore(deps): update dependency bullmq to v6.3.1 (#2893)
• 8dbd280 chore(deps): update dependency oxlint to v1.80.0 (#2892)
• 5767b19 chore(deps): update dependency bullmq to v6.2.2 (#2890)
• a2ebecb chore(deps): update nest monorepo to v11.2.3 (#2891)
• 3b07d26 chore(deps): update dependency bullmq to v6.2.0 (#2889)
• d815bd9 chore(deps): update dependency lerna to v10.0.1 (#2888)
• 86beb81 chore(deps): update dependency oxlint to v1.79.0 (#2887)
• Additional commits viewable in compare view

Updates @nestjs/common from 11.1.28 to 12.0.1

Release notes

Sourced from @​nestjs/common's releases.

v12.0.0

NestJS v12.0.0

NestJS 12 is centered around ESM-ready packages, first-class Standard Schema support for validation and serialization, a rebuilt CLI, and native observability through the new @nestjs/observe SDK.

Existing CommonJS applications keep working — migrating your own code to ESM is entirely optional.

📖 Full migration guide

---

Upgrading

Upgrade the CLI first, since the upgrade command ships with it:

npm i -g @nestjs/cli@latest

Then, from the root of your project:

nest upgrade

nest upgrade moves every @nestjs/* package to its v12-compatible major at once and applies the mechanical parts of the migration for you — nest-cli.json webpack options, the GraphQL playground → graphiql rename and subscriptions transport swap, the NATS package replacement, @nestjs/config validation options, Jest and Joi bumps — then prints a report of everything it changed and everything you still need to review by hand. Run it with --dry-run first to see that report without touching your files.

It deliberately does not migrate your project to ESM, Vitest, or oxlint. Those are the defaults for newly generated projects; existing projects adopt them on their own schedule.

Node.js: v12 requires Node.js v20.19+ or v22.12+. Both require(esm) and the ESM packages depend on it; the upgrade command refuses to run on older releases (including the 21.x line). The latest active LTS is recommended.

---

Highlights

ESM packages

All core Nest packages now ship as ESM. Thanks to require(esm) in modern Node.js, most existing CommonJS applications continue to work without a rewrite. Review custom bootstrapping scripts, build tooling, and test runners if they assume CommonJS-only packages.

nest new now asks whether to scaffold a CommonJS or an ESM project.

Standard Schema validation

Route parameter decorators — @Body(), @Query(), @Param(), @RawBody() — accept a new schema option, designed for Standard Schema compatible libraries such as Zod, Valibot, and ArkType:

@Post()
create(@Body({ schema: createUserSchema }) body: CreateUserDto) {
  return this.usersService.create(body);
}
</tr></table> 

... (truncated)

Commits

• 4c751c5 chore(release): publish v12.0.1 release
• 6494a6c chore(release): publish v12.0.0 release
• e306724 fix(deps): update dependency file-type to v22
• edb0034 Merge branch 'master' into v12.0.0
• 4535f43 chore(release): publish v11.2.1 release
• e255755 chore: resolve conflicts, minor fixes
• 5d1b19b Merge branch 'master' into v12.0.0
• f2a7e4b chore(release): publish v11.2.0 release
• b2e7fb5 Merge pull request #17469 from nestjs/feat/sse-signal
• 6498f11 feat: signal should finalize in every case
• Additional commits viewable in compare view

Updates @nestjs/config from 4.0.4 to 12.0.0

Release notes

Sourced from @​nestjs/config's releases.

12.0.0

What's Changed

@nestjs/config is now a native ES module, environment validation is built on Standard Schema instead of Joi-specific code, and the major version is aligned with the Nest 12 release line (there is no 5.x — 4.0.4 goes straight to 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

// ✅
import { ConfigModule, ConfigService } from '@nestjs/config';
// ❌ no longer resolvable
import { ConfigService } from '@​nestjs/config/dist/config.service';

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support (Node 20.19+ / 22.12+), a CommonJS app can keep using require('@nestjs/config') unchanged.

Validation is now Standard Schema based

validationSchema accepts any schema implementing the Standard Schema spec — Zod (v3, v4, v4-mini), Valibot, ArkType, Joi 18+, and anything else that adopts it. There is no longer any Joi-specific code path in the module, and Joi is no longer implied as the validation library.

ConfigModule.forRoot({
  validationSchema: z.object({
    PORT: z.coerce.number().default(3000),
    DATABASE_NAME: z.string(),
  }),
});

Joi keeps working — it implements Standard Schema as of v18 — and the historical abortEarly: false / allowUnknown: true defaults are still applied automatically for Joi schemas, so existing Joi setups behave as before.

Breaking: validationOptions shape

Options are now the Standard Schema Options object, and library-specific settings move under libraryOptions:

// Before (4.x)
validationOptions: { allowUnknown: false, abortEarly: true }
// Now (12.x)
validationOptions: { libraryOptions: { allowUnknown: false, abortEarly: true } }

The generic parameter changed accordingly: ConfigModuleOptions<ValidationOptions extends StandardSchemaV1.Options>, and validationSchema is typed as StandardSchemaV1 rather than any — a schema that does not implement the spec is now a compile-time error instead of a runtime one.

... (truncated)

Commits

• 269312f chore(): release v12.0.0
• 5748c1f chore: upgrade to v12
• d833a6a chore(deps): update dependency oxlint to v1.80.0 (#2408)
• 4555cbc chore(deps): update nest monorepo to v11.2.3 (#2407)
• 4561739 chore(deps): update dependency vite to v8.2.2 (#2406)
• 0fc13bb chore(deps): update dependency joi to v18.2.5 (#2405)
• 22642b8 chore(deps): update dependency oxlint to v1.79.0 (#2404)
• d3a7dd5 chore(deps): update dependency vitest to v4.1.11 (#2403)
• 8c87973 chore(deps): update dependency zod to v4.4.3 (#2402)
• 949dc88 Merge pull request #2356 from nestjs/renovate/cimg-node-24.x
• Additional commits viewable in compare view

Updates @nestjs/core from 11.1.28 to 12.0.1

Release notes

Sourced from @​nestjs/core's releases.

v12.0.0

NestJS v12.0.0

NestJS 12 is centered around ESM-ready packages, first-class Standard Schema support for validation and serialization, a rebuilt CLI, and native observability through the new @nestjs/observe SDK.

Existing CommonJS applications keep working — migrating your own code to ESM is entirely optional.

📖 Full migration guide

---

Upgrading

Upgrade the CLI first, since the upgrade command ships with it:

npm i -g @nestjs/cli@latest

Then, from the root of your project:

nest upgrade

nest upgrade moves every @nestjs/* package to its v12-compatible major at once and applies the mechanical parts of the migration for you — nest-cli.json webpack options, the GraphQL playground → graphiql rename and subscriptions transport swap, the NATS package replacement, @nestjs/config validation options, Jest and Joi bumps — then prints a report of everything it changed and everything you still need to review by hand. Run it with --dry-run first to see that report without touching your files.

It deliberately does not migrate your project to ESM, Vitest, or oxlint. Those are the defaults for newly generated projects; existing projects adopt them on their own schedule.

Node.js: v12 requires Node.js v20.19+ or v22.12+. Both require(esm) and the ESM packages depend on it; the upgrade command refuses to run on older releases (including the 21.x line). The latest active LTS is recommended.

---

Highlights

ESM packages

All core Nest packages now ship as ESM. Thanks to require(esm) in modern Node.js, most existing CommonJS applications continue to work without a rewrite. Review custom bootstrapping scripts, build tooling, and test runners if they assume CommonJS-only packages.

nest new now asks whether to scaffold a CommonJS or an ESM project.

Standard Schema validation

Route parameter decorators — @Body(), @Query(), @Param(), @RawBody() — accept a new schema option, designed for Standard Schema compatible libraries such as Zod, Valibot, and ArkType:

@Post()
create(@Body({ schema: createUserSchema }) body: CreateUserDto) {
  return this.usersService.create(body);
}
</tr></table> 

... (truncated)

Commits

• 4c751c5 chore(release): publish v12.0.1 release
• 3c25112 chore: update peer deps
• 6494a6c chore(release): publish v12.0.0 release
• c9d59f2 chore: expose missing internals
• 45485b5 fix(core): circular durable providers issue #17562
• f94e9eb fix(core): preserve middleware arity and harden instance decorator
• 1dcbc25 fix(core): instrument midldeware issue #17554
• f5bf4dd docs(core): update Mercure SSE header comment to current path
• edb0034 Merge branch 'master' into v12.0.0
• 4535f43 chore(release): publish v11.2.1 release
• Additional commits viewable in compare view

Updates @nestjs/platform-express from 11.1.28 to 12.0.1

Release notes

Sourced from @​nestjs/platform-express's releases.

v12.0.0

NestJS v12.0.0

NestJS 12 is centered around ESM-ready packages, first-class Standard Schema support for validation and serialization, a rebuilt CLI, and native observability through the new @nestjs/observe SDK.

Existing CommonJS applications keep working — migrating your own code to ESM is entirely optional.

📖 Full migration guide

---

Upgrading

Upgrade the CLI first, since the upgrade command ships with it:

npm i -g @nestjs/cli@latest

Then, from the root of your project:

nest upgrade

nest upgrade moves every @nestjs/* package to its v12-compatible major at once and applies the mechanical parts of the migration for you — nest-cli.json webpack options, the GraphQL playground → graphiql rename and subscriptions transport swap, the NATS package replacement, @nestjs/config validation options, Jest and Joi bumps — then prints a report of everything it changed and everything you still need to review by hand. Run it with --dry-run first to see that report without touching your files.

It deliberately does not migrate your project to ESM, Vitest, or oxlint. Those are the defaults for newly generated projects; existing projects adopt them on their own schedule.

Node.js: v12 requires Node.js v20.19+ or v22.12+. Both require(esm) and the ESM packages depend on it; the upgrade command refuses to run on older releases (including the 21.x line). The latest active LTS is recommended.

---

Highlights

ESM packages

All core Nest packages now ship as ESM. Thanks to require(esm) in modern Node.js, most existing CommonJS applications continue to work without a rewrite. Review custom bootstrapping scripts, build tooling, and test runners if they assume CommonJS-only packages.

nest new now asks whether to scaffold a CommonJS or an ESM project.

Standard Schema validation

Route parameter decorators — @Body(), @Query(), @Param(), @RawBody() — accept a new schema option, designed for Standard Schema compatible libraries such as Zod, Valibot, and ArkType:

@Post()
create(@Body({ schema: createUserSchema }) body: CreateUserDto) {
  return this.usersService.create(body);
}
</tr></table> 

... (truncated)

Commits

• 4c751c5 chore(release): publish v12.0.1 release
• 3c25112 chore: update peer deps
• 6494a6c chore(release): publish v12.0.0 release
• e03cf5c fix(express,fastify): apply falsy status codes in reply()
• edb0034 Merge branch 'master' into v12.0.0
• 4535f43 chore(release): publish v11.2.1 release
• e255755 chore: resolve conflicts, minor fixes
• 5d1b19b Merge branch 'master' into v12.0.0
• f2a7e4b chore(release): publish v11.2.0 release
• 03587a1 chore(release): publish v11.1.29 release
• Additional commits viewable in compare view

Updates @nestjs/typeorm from 11.0.3 to 12.0.1

Release notes

Sourced from @​nestjs/typeorm's releases.

Release 12.0.1

• fix: add default condition to exports so CJS can resolve the package (01874dc)

Release 12.0.0

What's Changed

@nestjs/typeorm is now a native ES module, and the major version is aligned with the Nest 12 release line (11.0.3 → 12.0.0).

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.js / index.d.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root.

The minimum supported Node version is now >=20.19.0.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, CJS apps still work.

Commits

• 3513624 chore(): release v12.0.1
• b36b36c Merge pull request #2685 from iflov/fix/cjs-exports-condition
• 01874dc fix: add default condition to exports so CJS can resolve the package
• 5ccaea4 chore(deps): update dependency lint-staged to v17.4.1 (#2683)
• de68dfe Merge branch 'master' of https://github.com/nestjs/typeorm
• afe5dc3 chore: bump deps to v12.0.1
• 2d2c86a Merge pull request #2682 from nestjs/renovate/cimg-node-24.x
• d40e0a5 chore(): release v12.0.0
• 36a765c chore: resolve conflicts
• d80cf31 chore: upgrade to v12 deps
• Additional commits viewable in compare view

Updates bullmq from 5.78.0 to 6.3.1

Release notes

Sourced from bullmq's releases.

v6.3.1

6.3.1 (2026-08-27)

Bug Fixes

• postgres: resolve priv SQL dir at runtime for Mix releases (#4636) (9d737e9)

v6.3.0

6.3.0 (2026-08-26)

Features

• postgres: forward :ssl option to Postgrex connection (#4631) (elixir) (bb569b8)

v6.2.2

6.2.2 (2026-08-25)

Performance Improvements

• queue: do not affect rate limit when processing deferred failures (python) (elixir) (rust) (dotnet) (#4607) (ec4be04)

v6.2.1

6.2.1 (2026-08-25)

Bug Fixes

• stalled: provide right key values in move_stalled_jobs_to_wait (#4589) (ec1c812)

v6.2.0

6.2.0 (2026-08-21)

Features

• types: add generic ProgressType parameter to Job and Worker (#4529) fixes #3721 (c06b51c)

v6.1.2

6.1.2 (2026-08-16)

Bug Fixes

• deps: update security patches [security] (#4566) (cb37233)

v6.1.1

6.1.1 (2026-08-14)

... (truncated)

Commits

• 9d737e9 fix(postgres): resolve priv SQL dir at runtime for Mix releases (#4636)
• 808161a chore(release): vex2.2.0 (#4634)
• 936f07d chore(release): 6.3.0 (#4633)
• bb569b8 feat(postgres): forward :ssl option to Postgrex connection (#4631) (elixir)
• 3508972 chore(deps): update python dependencies [python] (#4579)
• 498ddd3 chore(deps): lock file maintenance [rust] (#4630)
• fdbe4fa chore(release): vpy3.0.6 (#4625)
• df2d206 chore(release): vrs1.2.7 (#4627)
• b716e53 chore(release): vnet1.1.1 (#4628)
• edc74b0 chore(release): vex2.1.3 (#4626)
• Additional commits viewable in compare view

Updates ioredis from 5.11.1 to 6.0.0

Release notes

Sourced from ioredis's releases.

v6.0.0

6.0.0 (2026-07-31)

• Add RESP3 (#2127) (5d0862e)

Bug Fixes

• clear stale socket timeout on reconnect (#2148) (6455dbe)
• cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
• cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
• command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
• redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
• sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
• tracing: redact values for GETSET and PSETEX (#2134) (832765d)
• types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

• add LMOVEM and BLMOVEM command support (#2144) (c26af46)
• add Redis 8.10 set cardinality commands (#2143) (301099b)
• himport managed fieldsets (#2159) (729f174)
• improve default connection resilience (#2160) (6d0716e)
• support MAXCOUNT and MAXSIZE for stream reads (#2142) (ae5e41b)

BREAKING CHANGES

• ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

v6.0.0-beta.1

6.0.0-beta.1 (2026-07-29)

• Add RESP3 (#2127) (5d0862e)

Bug Fixes

• clear stale socket timeout on reconnect (#2148) (6455dbe)
• cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
• cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
• command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
• redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
• sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
• tracing: redact values for GETSET and PSETEX (#2134) (832765d)

... (truncated)

Changelog

Sourced from ioredis's changelog.

6.0.0 (2026-07-31)

• Add RESP3 (#2127) (5d0862e)

Bug Fixes

• clear stale socket timeout on reconnect (#2148) (6455dbe)
• cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
• cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
• command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
• redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
• sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
• tracing: redact values for GETSET and PSETEX (#2134) (832765d)
• types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

• add LMOVEM and BLMOVEM command support (#2144) (c26af46)
• add Redis 8.10 set cardinality commands (#2143) (301099b)
• himport managed fieldsets (#2159) (729f174)
• improve default connection resilience (#2160) (6d0716e)
• support MAXCOUNT and MAXSIZE for stream reads (#2142) (ae5e41b)

BREAKING CHANGES

• ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

Commits

• 8ed2946 chore(release): 6.0.0 [skip ci]
• 3b410f8 docs: clarify managed HIMPORT fieldset behavior (#2161)
• 729f174 feat: himport managed fieldsets (#2159)
• 6d0716e feat: improve default connection resilience (#2160)
• cf3bf71 fix(types): export ScanStreamOptions, RedisStatus and ClusterStatus (#2158)
• aac171b ci: update Redis test image (#2156)
• 807bb1c chore(release): update repository URL (#2154)
• 6c889e7 docs: add security policy (#2153)
• 6455dbe fix: clear stale socket timeout on reconnect (#2148)
• 9618206 fix(cluster): validate MOVED slot to prevent Array.prototype pollution (#2151)
• Additional commits viewable in compare view

Updates js-yaml from 4.3.1 to 5.4.1

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

... (truncated)

Commits

• e5a3ba0 5.4.1 released
• e54dea3 Hard-limit merge sequence size to 100
• dfd3a29 Cleanup 6a8e05f, #797
• 6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
• 6b4ff5e 5.4.0 released
• 3b3625e Update changelog
• 4f25a74 Fix file name
• 3bd003b Expose new scalar styling API
• fbb3e9d Remove regex lookbehind for ES2015 compatibility
• d43c185 Fix flowSkipColonSpace by forcing quoteFlowKeys
• Additional commits viewable in compare view

Updates openai from 6.42.0 to 7.8.0

Release notes

Sourced from openai's releases.

v7.8.0

7.8.0 (2026-08-27)

Features

• api: add compute_units to Responses and Chat Completions usage (#2505) (f9b1313)
• api: add default WebSocket User-Agent and audit log events (#2504) (9b2f089)

Bug Fixes

• auth: clamp the workload-identity refresh buffer to the token lifetime (#2490) (76b73a9)
• auth: secure first-class X.509 workload credentials (#2479) (1b36c19)
• deps: harden dependency and release boundaries (#2484) (b21ff45)
• events: settle WebSocket waiters when listeners throw (#2491) (b5a13a7)
• restore native browser ESM imports (#2495) (c8cab1e)
• uploads: detect multipart bodies from own properties only (#2492) (559ffc8)

v7.7.0

7.7.0 (2026-08-26)

Features

• api: make function call output call IDs optional (#2488) (b932ae6)

Bug Fixes

• streaming: honor cancellation while decoding SSE responses (#2487) (ababe12)

v7.6.0

7.6.0 (2026-08-26)

Features

• api: Add obfuscation field to ChatCompletionChunk (#2423) (39afa3a)
• api: Add project residency and usage quantity_unit fields (#2461) (26d8158)
• api: support backend-mediated Realtime WebRTC calls (#2469) (0d12ca8)
• auth: add pinned X.509 workload token exchange (#2470) (9dd8648)
• auth: attest cross-module X.509 transport capabilities (#2471) (c6769fa)
• auth: harden X.509 token lifecycle and tenant isolation (#2473) (6992683)
• auth: integrate attested X.509 workload identity into clients (#2472) (ee5229b)
• support named data-residency endpoints (#2393) (62d98dd)

Bug Fixes

... (truncated)

Changelog

Sourced from openai's changelog.

7.8.0 (2026-08-27)

Features

• api: add compute_units to Responses and Chat Completions usage (#2505) (f9b1313)
• api: add default WebSocket User-Agent and audit log events (#2504) (9b2f089)

Bug Fixes

• auth: clamp the workload-identity refresh buffer to the token lifetime (#2490) (76b73a9)
• auth: secure first-class X.509 workload credentials (#2479) (1b36c19)
• deps: harden dependency and release boundaries (#2484) (b21ff45)
• events: settle WebSocket waiters when listeners throw (#2491) (b5a13a7)
• restore native browser ESM imports (#2495) (c8cab1e)
• uploads: detect multipart bodies from own properties only (#2492) (559ffc8)

7.7.0 (2026-08-26)

Features

• api: make function call output call IDs optional (#2488) (b932ae6)

Bug Fixes

• streaming: honor cancellation while decoding SSE responses (#2487) (ababe12)

7.6.0 (2026-08-26)

Features

• api: Add obfuscation field to ChatCompletionChunk (#2423) (39afa3a)
• api: Add project residency and usage quantity_unit fields (#2461) (26d8158)
• api: support backend-mediated Realtime WebRTC calls (#2469) (0d12ca8)
• auth: add pinned X.509 workload token exchange (#2470) (9dd8648)
• auth: attest cross-module X.509 transport capabilities (#2471) (c6769fa)
• auth: harden X.509 token lifecycle and tenant isolation (#2473) (6992683)
• auth: integrate attested X.509 workload identity into clients (#2472) (ee5229b)
• support named data-residency endpoints (#2393) (62d98dd)

Bug Fixes

• [responses] Avoid quadratic comparisons when accumulating long text (#2434) (95628ce)
• assistants: reject run-step identity hijacking before tool callbacks (#2476) (63b1c75)
• audio: preserve recording outcomes during cancellation and cleanup (

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.