[pull] main from openai:main

.github/workflows/castiron-custom-code-comment.yml

@@ -32,7 +32,7 @@ jobs:
       budget: ${{ steps.budget.outputs.budget }}
     steps:
       - name: Check out the trusted reporter
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           persist-credentials: false
@@ -183,7 +183,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Check out the trusted publisher
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.workflow_sha }}
           persist-credentials: false

.github/workflows/castiron-custom-code.yml

@@ -47,7 +47,7 @@ jobs:
             > "$RUNNER_TEMP/castiron-custom-code/context.json"
 
       - name: Check out the pull request
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
     name: dependency lock freshness
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -73,7 +73,7 @@ jobs:
     needs: dependency-locks
     if: github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -100,7 +100,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -128,15 +128,15 @@ jobs:
         run: uv run --locked --all-extras python scripts/utils/validate-httpx2-wheel.py
 
       - name: Set up Python 3.9 for resolver rejection
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.9'
 
       - name: Prove Python 3.9 rejects the wheel
         run: python scripts/utils/validate-python-version-wheel.py --check-python-39
 
       - name: Set up Python 3.14
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.14'
 
@@ -155,15 +155,15 @@ jobs:
         # Per-PR coverage protects both ends of the support window.
         python-version: ["3.10", "3.14"]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - uses: ./.github/actions/setup-node-tooling
 
       - name: Set up Python ${{ matrix.python-version }}
         id: setup-python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -187,15 +187,15 @@ jobs:
     needs: dependency-locks
     if: github.event_name == 'push' || github.event_name == 'merge_group' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - uses: ./.github/actions/setup-node-tooling
 
       - name: Set up Python 3.14
         id: setup-python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.14'
 
@@ -224,7 +224,7 @@ jobs:
     if: github.repository == 'openai/openai-python' && github.event_name == 'push' && github.ref == 'refs/heads/main'
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -252,7 +252,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name != 'schedule'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -285,13 +285,13 @@ jobs:
           - python-version: "3.15"
             experimental: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         id: setup-python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: ${{ matrix.experimental }}

.github/workflows/codeql.yml

@@ -25,14 +25,14 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
         with:
           languages: python
 
       - name: Analyze
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4

.github/workflows/create-releases.yml

@@ -44,7 +44,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -84,4 +84,4 @@ jobs:
           path: dist/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

.github/workflows/detect-breaking-changes.yml

@@ -25,7 +25,7 @@ jobs:
     env:
       BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1

.github/workflows/publish-pypi.yml

@@ -15,7 +15,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -56,4 +56,4 @@ jobs:
           path: dist/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

package.json

@@ -6,7 +6,7 @@
     "node": "22.22.3"
   },
   "devDependencies": {
-    "@stdy/cli": "0.22.1",
-    "pyright": "1.1.399"
+    "@stdy/cli": "0.22.2",
+    "pyright": "1.1.413"
   }
 }

pyproject.toml

@@ -53,7 +53,7 @@ bedrock = [
 
 [dependency-groups]
 dev = [
-    "mypy==1.17",
+    "mypy==2.3.1",
     "pytest>=9.0.3",
     "pytest-asyncio>=1.4.0",
     "ruff",
@@ -249,6 +249,11 @@ module = "black.files.*"
 ignore_errors = true
 ignore_missing_imports = true
 
+# Preserve the existing _files.py exclusion when mypy follows its imports.
+[[tool.mypy.overrides]]
+module = "openai._files"
+follow_imports = "silent"
+
 [tool.ruff]
 extend-exclude = ["tests/respx2", "src/openai/_vendor"]
 line-length = 120

src/openai/_response.py

@@ -243,7 +243,7 @@ def _parse(self, *, to: type[_T] | None = None) -> R | _T:
         # in the response, e.g. application/json; charset=utf-8
         content_type, *_ = response.headers.get("content-type", "*").split(";")
         if not content_type.endswith("json"):
-            if is_basemodel(cast_to):
+            if is_basemodel(cast(type, cast_to)):
                 try:
                     data = response.json()
                 except Exception as exc:

src/openai/_utils/_compat.py

@@ -9,7 +9,7 @@
 from .._types import StrBytesIntFloat
 from ._datetime_parse import parse_date as _parse_date, parse_datetime as _parse_datetime
 
-_LITERAL_TYPES = {Literal, typing_extensions.Literal}
+_LITERAL_TYPES: set[object] = {Literal, typing_extensions.Literal}
 
 
 def get_args(tp: type[Any]) -> tuple[Any, ...]:

tests/lib/test_bedrock_credential_chain.py

@@ -3,7 +3,7 @@
 import sys
 import json
 import threading
-from typing import Any, Iterator, cast
+from typing import Any, Generator, cast
 from pathlib import Path
 from datetime import datetime, timezone, timedelta
 from contextlib import contextmanager
@@ -102,7 +102,7 @@ def _assert_signed_with(request: httpx2.Request, name: str, *, region: str) -> N
 
 
 @contextmanager
-def _metadata_server() -> Iterator[tuple[str, list[tuple[str, str, str | None]]]]:
+def _metadata_server() -> Generator[tuple[str, list[tuple[str, str, str | None]]], None, None]:
     calls: list[tuple[str, str, str | None]] = []
 
     class Handler(BaseHTTPRequestHandler):

tests/node-tooling.test.cjs

@@ -22,7 +22,7 @@ function fixture(t) {
   return root;
 }
 
-function installFake(root, version = '1.1.399') {
+function installFake(root, version = JSON.parse(fs.readFileSync(path.join(root, 'package.json'))).devDependencies.pyright) {
   const directory = path.join(root, 'node_modules/pyright');
   fs.mkdirSync(directory, { recursive: true });
   fs.writeFileSync(path.join(directory, 'package.json'), JSON.stringify({ version }));
@@ -86,8 +86,9 @@ test('Steady is local-only and receives the original arguments', (t) => {
   assert.equal(missing.status, 1);
   assert.match(missing.stderr, /Missing local steady/);
   const directory = path.join(root, 'node_modules/@stdy/cli');
+  const manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
   fs.mkdirSync(directory, { recursive: true });
-  fs.writeFileSync(path.join(directory, 'package.json'), JSON.stringify({ version: '0.22.1' }));
+  fs.writeFileSync(path.join(directory, 'package.json'), JSON.stringify({ version: manifest.devDependencies['@stdy/cli'] }));
   fs.writeFileSync(path.join(directory, 'steady.js'), 'console.log(JSON.stringify(process.argv.slice(2)));');
   const result = run(root, ['steady', 'spec with spaces.yml', '--version']);
   assert.equal(result.status, 0);