Bump openai from 2.41.0 to 3.1.0 in /backend

[dependabot]

Bumps openai from 2.41.0 to 3.1.0.

Release notes

Sourced from openai's releases.

v3.1.0

3.1.0 (2026-08-14)

Features

• api: add WebSocket stream IDs (#3612) (d9029e3)
• api: add workload identity access token issued event (#3601) (df274d4)
• api: deprecate Sora video APIs (#3610) (721cb1c)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#3617) (f38355e)

Chores

• remove Stainless attribution and infrastructure (#3599) (a1eeab5)

v3.0.0

3.0.0 (2026-08-12)

⚠ BREAKING CHANGES

• api: HTTPX2 is now the default HTTP client, and httpx is no longer installed automatically. Applications using custom HTTPX clients, transports, or configuration objects must migrate to their HTTPX2 equivalents or use the temporary, runtime-only legacy HTTPX escape hatch. See the HTTPX2 migration guide.

Features

• api: migrate to HTTPX2 (#3594)

v2.54.0

2.54.0 (2026-08-11)

Features

• api: Add new Responses model identifiers (#3595) (0652787)

Bug Fixes

• api: clarify audio upload metadata requirements (#3596) (28888f9)

Chores

• api: Update generated-file header attribution to Castiron (#3583) (ea17fda)

v2.53.0

2.53.0 (2026-08-03)

... (truncated)

Changelog

Sourced from openai's changelog.

3.1.0 (2026-08-14)

Features

• api: add WebSocket stream IDs (#3612) (d9029e3)
• api: add workload identity access token issued event (#3601) (df274d4)
• api: deprecate Sora video APIs (#3610) (721cb1c)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#3617) (f38355e)

Chores

• remove Stainless attribution and infrastructure (#3599) (a1eeab5)

3.0.0 (2026-08-12)

⚠ BREAKING CHANGES

• api: HTTPX2 is now the default HTTP client, and httpx is no longer installed automatically. Applications using custom HTTPX clients, transports, or configuration objects must migrate to their HTTPX2 equivalents or use the temporary, runtime-only legacy HTTPX escape hatch. See the HTTPX2 migration guide.

Features

• api: migrate to HTTPX2 (#3594)

2.54.0 (2026-08-11)

Features

• api: Add new Responses model identifiers (#3595) (0652787)

Bug Fixes

• api: clarify audio upload metadata requirements (#3596) (28888f9)

Chores

• api: Update generated-file header attribution to Castiron (#3583) (ea17fda)

2.53.0 (2026-08-03)

Features

• api: Add gpt-5.5 and tool name/namespace to Responses types (#3569) (dd1202d)

... (truncated)

Commits

• 10ee3f0 release: 3.1.0 (#3600)
• f38355e feat(api): Ultrafast tier, structured MCP and websocket errors, separate webs...
• d9029e3 feat(api): add WebSocket stream IDs (#3612)
• 721cb1c feat(api): deprecate Sora video APIs (#3610)
• df274d4 feat(api): add workload identity access token issued event (#3601)
• 5578d39 ci: fix CodeQL permissions for private repositories (#3606)
• a1eeab5 chore: remove Stainless attribution and infrastructure (#3599)
• 8bb0e14 release: 3.0.0 (#3598)
• ae8c3d5 feat(api)!: migrate to HTTPX2 (#3594)
• 03b3ec4 release: 2.54.0 (#3592)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[zmustafa]

Holding this one for a deliberate upgrade rather than taking it as a routine bump. Leaving the PR open on purpose (no ignore rule added) so it stays visible.

What was actually tested: I applied openai==3.1.0 locally and the full backend suite passed (5696 passed / 16 skipped / 523 deselected / 8 xfailed), and pip check was clean. So this is not a known-broken bump.

Two things make it more than a version change:

1. It brings a second HTTP stack into the image. Installing it pulls httpx2==2.12.0, httpcore2==2.12.0 and truststore alongside the already-pinned httpx==0.28.1. backend/requirements.txt is a FULLY pinned lock, and those three arrive unpinned, so a later image build could resolve them differently. Taking v3 means pinning the new transitives explicitly.
2. The green suite is not sufficient evidence here. app/agent/openai_provider.py drives the primary chat path through responses.create(...) and chat.completions.create(...) in streaming mode, and the tests exercise that with mocks. A v3 change to streaming event shapes, tool-call framing or error types would not show up in a mocked run.

To take it: pin httpx2 / httpcore2 / truststore, then verify with a live provider E2E (streaming + a tool-calling turn) on both AsyncOpenAI and AsyncAzureOpenAI, since both are constructed here.

The other four updates in this batch (cachetools, Mako, websockets, svglib) were taken in 97f2abb.

[zmustafa]

Taken in f6a7c92 (pushed to main), so this PR is superseded.

It was held back once, and the reason is worth recording: pip install succeeded and the whole suite passed on the raw bump, but neither was evidence for this particular package.

Two things were needed before it could be taken safely.

1. The transitives had to be pinned. openai 3.x moves the transport to httpx2, so it installs httpx2==2.12.0, httpcore2==2.12.0 and truststore==0.10.4 alongside the existing pinned httpx==0.28.1. backend/requirements.txt is a fully pinned lock, so leaving those three unpinned would let a later image build resolve different versions. All three are now pinned explicitly.

2. The tests could not see a response-shape change. test_openai_provider.py covers request shaping with duck-typed stand-ins built as type("Event", (), {...})(). Those always have whatever attribute the test gave them, so they cannot notice the SDK reshaping what it returns. app/agent/openai_provider.py drives the primary chat path through streaming responses.create and chat.completions.create; a renamed field would have degraded live chat into empty tokens or dropped tool calls while every test stayed green.

Added tests/test_openai_sdk_contract.py, which drives both streaming parsers with real SDK models — a ChatCompletionChunk sequence whose tool-call arguments are split across chunks and reassembled by index, and ResponseTextDeltaEvent / ResponseOutputItemDoneEvent carrying a native function_call — and constructs AsyncOpenAI and AsyncAzureOpenAI with the exact kwargs the provider passes. Proven non-vacuous: appending to the parsed tool name makes it fail at the assertion, and it passes again once reverted.

Worth noting for future bumps: openai 3.x adds a required cache_write_tokens field to InputTokensDetails. The provider reads usage through getattr defaults and only uses input_tokens / output_tokens, so it is unaffected.

Verified: pip check clean, pip-audit reports no known vulnerabilities, backend 5699 passed / 16 skipped / 523 deselected / 8 xfailed.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.