release: 1.9.0

[openai-sdks]

Automated Release PR

1.9.0 (2026-08-26)

Features

• api: Add residency flag and deprecate geography (#136) (e460582)

Bug Fixes

• Add provenance-aware untrusted stdin mode (#137) (a133707)
• build CLI releases with patched Go toolchains (#93) (a58f1cc)
• discard fish completion diagnostics (#109) (4f35fc0)
• escape raw output controls on interactive terminals (#112) (7601afb)
• fail closed when bootstrapping Go dependencies (#94) (4ebe610)
• lock and verify Steady mock tooling (#95) (681d595)
• prepare release artifacts before publishing (#111) (4193619)
• redact sensitive response headers in debug logs (#106) (4931572)
• reject invalid multipart MIME header controls (#105) (fad98b4)
• restrict downloaded file permissions (#107) (7a3a7d1)
• safely construct bash file completions (#110) (b3e0946)
• stream binary download responses (#108) (1f3ba6c)
• stream multipart uploads without buffering (#65) (bcf0ecd)
• verify GoReleaser before privileged release execution (#96) (b3729ea)

Chores

• api: clarify image background and audio delta docs (#124) (056f306)
• api: No customer-visible SDK or public API changes (#128) (12e0d28)
• api: refresh image model API reference (#115) (a771913)
• api: Refresh the bundled OpenAPI reference (#66) (d14387a)
• api: Report no customer-visible SDK or public API changes (#113) (8da2d53)
• api: update generation metadata only (#138) (4244a62)
• configure Dependabot for Go and GitHub Actions (#69) (f495366)
• deps: bump actions/attest-build-provenance from 4.1.0 to 4.2.2 (#102) (6594c73)
• deps: bump actions/checkout from 6.0.2 to 7.0.1 (#103) (ce6a6d0)
• deps: bump actions/checkout from 6.0.2 to 7.0.1 (#134) (f40d5f2)
• deps: bump actions/download-artifact from 4.3.0 to 8.0.1 (#133) (98ed029)
• deps: bump actions/github-script from 7.1.0 to 9.0.0 (#132) (978ce47)
• deps: bump actions/setup-go in / (#101) (5564982)
• deps: bump actions/upload-artifact from 4.6.2 to 7.0.1 (#104) (b3ac15a)
• deps: bump github.com/charmbracelet/bubbles from 0.21.0 to 1.0.0 (#99) (7ac7035)
• deps: bump github.com/urfave/cli/v3 from 3.4.1 to 3.10.1 in the go-minor-and-patch group across 1 directory (#130) (ddc612e)
• deps: bump the charmbracelet group across 1 directory with 2 updates (#97) (2137b80)
• deps: bump the codeql group across 1 directory with 2 updates (#100) (c95ac0a)
• deps: bump the codeql group across 1 directory with 2 updates (#131) (58e3bdd)
• deps: bump the go-minor-and-patch group across 1 directory with 5 updates (#98) (74822be)
• deps: update openai-go to v3.51.0 (#63) (68e3e70)
• deps: update openai-go to v3.52.0 (#67) (7d87ee2)
• set a 1,000-line custom-code budget (#126) (016bfb2)

Documentation

• add secure CLI agent and contributor guidance (#72) (09ec087)
• standardize CLI vulnerability disclosure policy (#71) (d082a01)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

5 mixed files remain; 0 existing customizations changed.

Compared 4244a62d530c → d0440105bbe2. Generated baselines verified.

5 existing customizations unchanged

• pkg/cmd/adminorganizationcertificate.go
• pkg/cmd/cmd.go
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 32933015273 --repo openai/openai-cli \
  --name castiron-custom-code-32933015273-1 --dir /tmp/castiron-custom-code-32933015273-1
git apply --stat /tmp/castiron-custom-code-32933015273-1/custom-code.patch
cat /tmp/castiron-custom-code-32933015273-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 4244a62d530c81ef1924ac6ef666dbab10d58e64 d0440105bbe2a290a0f54939cce113aee0e88316
python3 scripts/castiron/custom_code_report.py report \
  --base 4244a62d530c81ef1924ac6ef666dbab10d58e64 \
  --head d0440105bbe2a290a0f54939cce113aee0e88316 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-d0440105bbe2
cat /tmp/castiron-custom-code-d0440105bbe2/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[openai-sdks]

🤖 Created releases:

• v1.9.0

🌻