chore(deps): update openai requirement from <3,>=2.52.0 to >=3.7.0,<4

[dependabot]

Updates the requirements on openai to permit the latest version.

Release notes

Sourced from openai's releases.

v3.7.0

3.7.0 (2026-09-02)

Features

• api: update usage APIs and documentation (#3779) (6f0da16)

Bug Fixes

• avoid repeated numpy checks for embeddings (#3757) (b19c216)

Changelog

Sourced from openai's changelog.

3.7.0 (2026-09-02)

Features

• api: update usage APIs and documentation (#3779) (6f0da16)

Bug Fixes

• avoid repeated numpy checks for embeddings (#3757) (b19c216)

3.6.0 (2026-08-27)

Features

• api: add compute_units to Responses and Chat Completions usage (#3749) (52421d1)

Bug Fixes

• auth: harden X.509 workload identity integration (#3740) (fc3ad6c)

Chores

• deps-dev: bump @​stdy/cli from 0.22.1 to 0.22.2 (#3719) (4f5598c)
• deps-dev: bump mypy from 1.17 to 2.3.1 (#3747) (0b52c9e)
• deps-dev: bump pandas-stubs from 2.2.2.240807 to 2.3.3.260113 (#3659) (95f0b43)
• deps-dev: bump pyright from 1.1.399 to 1.1.413 (#3744) (9917c6e)
• deps-dev: bump rich from 14.2.0 to 15.0.0 (#3717) (7a5484d)
• deps: bump actions/checkout from 6.0.2 to 7.0.1 (#3665) (d0a2550)
• deps: bump actions/download-artifact from 6.0.0 to 8.0.1 (#3669) (f627619)
• deps: bump github/codeql-action/init from 4.37.1 to 4.37.7 (#3745) (a36010d)

Build System

• deps: bump actions/setup-python from 5.6.0 to 7.0.0 (#3672) (d765db7)
• deps: bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 (#3666) (dacbb66)

3.5.0 (2026-08-27)

Features

• api: make function call output call IDs optional (#3738) (c74501d)

3.4.0 (2026-08-25)

... (truncated)

Commits

• ab76ab5 release: 3.7.0 (#3758)
• 6f0da16 feat(api): update usage APIs and documentation (#3779)
• b19c216 fix: avoid repeated numpy checks for embeddings (#3757)
• 1cfa80a release: 3.6.0 (#3752)
• 9917c6e chore(deps-dev): bump pyright from 1.1.399 to 1.1.413 (#3744)
• 0b52c9e chore(deps-dev): bump mypy from 1.17 to 2.3.1 (#3747)
• 4f5598c chore(deps-dev): bump @​stdy/cli from 0.22.1 to 0.22.2 (#3719)
• 95f0b43 chore(deps-dev): bump pandas-stubs from 2.2.2.240807 to 2.3.3.260113 (#3659)
• a36010d chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.7 (#3745)
• 7a5484d chore(deps-dev): bump rich from 14.2.0 to 15.0.0 (#3717)
• Additional commits viewable in compare view

[claude]

Review

Single-line change: requirements/base.txt bumps openai from >=2.52.0,<3 to >=3.6.0,<4.

This is a major-version bump (openai 2.x → 3.x), not routine dependabot churn, and it deserves more scrutiny than the diff size suggests:

1. Coupling with pydantic-ai-slim: The very next lines in requirements/base.txt (43-59) carry a long comment explaining that this codebase pins pydantic-ai-slim>=1.107.5,<2 deliberately, and that bumping pydantic-ai is treated as a decision requiring validation against opencontractserver/tests/test_pydantic_ai_factory.py. pydantic_ai.models.openai reaches into openai.types.* internals (chat completion + Responses API shapes), not just the top-level stable client surface. A major SDK bump can change those internal types even when the public client.chat.completions.create(...) surface looks unchanged. Nothing in this PR indicates that pydantic-ai 1.107.5 has been validated against openai 3.x — worth confirming (e.g. check pydantic-ai's own openai dependency spec, and whether their 1.x line has an openai<3 upper bound that would make this combination untested upstream) before merging.

2. This project has been burned by exactly this class of issue before — see CLAUDE.md pitfalls Bump pytz from 2021.3 to 2022.5 #17 (pydantic-ai dataclass-shape assertion breaking at import time on a message-shape change), Bump traefik from v2.9.1 to v2.9.4 in /compose/production/traefik #20 (OpenAI Responses-API routing / orphaned function_call items for reasoning models), and Bump django-debug-toolbar from 3.2.2 to 3.7.0 #21 (tool-call audit log silently missing tools after a framework upgrade). All three are "SDK bump looked safe, broke at runtime" stories. Given that history, I'd treat a green CI resolve/typecheck as necessary but not sufficient here.

3. Suggested validation before merge (beyond pip install resolving cleanly):

   • Run opencontractserver/tests/test_pydantic_ai_factory.py explicitly — it's called out by name as the regression canary for pydantic-ai/openai precedence behavior.
   • Run the LLM/agent test suite that exercises tool calls and streaming against a real or recorded OpenAI backend, plus test_batch_embedding.py (uses openai directly).
   • If feasible, a live smoke test of a chat-completions agent run and a Responses-API (reasoning-model) run, since pitfall Bump traefik from v2.9.1 to v2.9.4 in /compose/production/traefik #20's failure mode is specifically invisible on /v1/chat/completions and only surfaces on the Responses path.

4. Low-risk area: opencontractserver/pipeline/embedders/openai_embedder.py only uses long-stable surface (openai.OpenAI, client.embeddings.create, and the standard openai.AuthenticationError / BadRequestError / RateLimitError / APITimeoutError / APIConnectionError / APIStatusError exception classes). This part is unlikely to be affected by the bump.

5. Minor doc nit: the inline comment on the pin (# ... (pydantic-ai 1.x requires >=2.11.0)) only documents the lower-bound rationale. If this bump is validated and merged, consider adding a short note on why the upper bound moved to <4 (mirroring the multi-line rationale already given for the pydantic-ai pin two lines below), so a future reader doesn't have to re-derive that this was a deliberate, tested decision rather than an unreviewed dependabot auto-merge.

No test coverage was added/changed here (expected for a dependency bump), but given the coupling above, I'd want the existing pydantic-ai/openai-touching tests to be run explicitly against this version rather than relying on typecheck/lint-only CI signal.

[JSv4]

@dependabot rebase

[claude]

Review

This is a Dependabot-style bump of the openai package's minimum/maximum bounds in requirements/base.txt:

-openai>=2.52.0,<3
+openai>=3.7.0,<4

A few observations:

This crosses a major version boundary (2.x -> 3.x), not just a patch/minor bump. The upper bound moves from <3 to <4, so this intentionally adopts a new major release line of openai-python, which per semver may include breaking changes to the public API surface.

The existing tests will not catch a real breaking change here. opencontractserver/pipeline/embedders/openai_embedder.py uses the SDK directly (openai.OpenAI(...), client.embeddings.create(...), response.data[i].embedding) and depends on the exception hierarchy (AuthenticationError, BadRequestError, RateLimitError, APITimeoutError, APIConnectionError, APIStatusError). Both test_openai_embedder.py and test_batch_embedding.py fully mock openai.OpenAI, so a green CI run confirms the wrapper's internal logic but not that these attribute names/response shapes are unchanged in 3.x. Worth either a quick smoke test against the live Embeddings API or a check of the SDK's migration notes for the 3.0.0 release before merging, since this package is consumed directly and not only through pydantic-ai.

Worth confirming the resolver is happy end-to-end. pydantic-ai-slim[openai,anthropic,google,mcp]>=1.107.5,<2 is the other consumer of openai in this file. If that pydantic-ai version caps its own openai dependency below 3.x, pip install -r requirements/base.txt could fail to resolve (or silently pull a lower openai than this line implies). A clean pip install/pip-compile --dry-run against both constraints would confirm there is no conflict.

CI status at time of review: redis-integration, linter, and claude-review were still in progress; changes and CLAAssistant passed and CodeQL was neutral. Recommend waiting for the full suite (especially anything touching embeddings/LLM tooling) to go green before merging, given the major-version nature of this bump.

No security, style, or test-coverage concerns beyond the above - the diff itself is a single well-scoped line change consistent with the file's existing conventions (inline comment documenting the rationale for the pin).